muster release v5.7.8
Fixed
muster agent --mcp-server now honors MUSTER_OAUTH_CALLBACK_PORT. The agent’s OAuth flow hardcoded port 3000 for its AuthManager, while the environment variable was read in exactly one place that this path never consulted — so with 3000 occupied, setting the variable made muster auth login work while the agent still bound 3000 and failed, and the port-in-use message interpolated the env-derived port, naming a port the failing code never used. cli.GetCallbackPort is now the single resolver for every OAuth entry point, and the cmd package’s duplicate DefaultOAuthCallbackPort constant is removed. docs/reference/cli/agent.md lists the variable now, instead of leaving it documented as belonging to muster auth login alone. The re-auth failure message the MCP server returns no longer names port 3000 either: the number was written into its text, so it stated the default even when the flow had been configured onto another port – and when the cause really is a bind failure, the wrapped error printed above it already reports the port that was tried. (#1111)- The CLI auth handler registry no longer serves a closed adapter, and get-or-create no longer orphans one. Get-or-create was a check-then-act –
GetAuthHandler, construct, Register, GetAuthHandler again: handlerMutex makes the individual registry calls atomic but leaves the composite racy, so concurrent callers each built and published their own adapter and every loser was orphaned without Close(). Both sites that spelled it that way – the auth commands and the ToolExecutor behind muster list/get/call – now go through the new primitive. (noSilentRefresh still lives on the shared adapter, so the caller that registers it fixes the value for the process; that is unchanged here, and no muster command runs a second registrant.) Separately, AuthAdapter.Close() tore down its managers but never unpublished, so api.GetAuthHandler() kept returning a closed adapter that — carrying no closed flag — silently re-created managers on itself instead of failing. New api.GetOrRegisterAuthHandler runs the check, the construction and the publish under one write lock so the factory runs exactly once, and Close() now clears the registration through api.UnregisterAuthHandler (a no-op when the adapter is not the registered one). (#1111)
