most of the implementation looking ok but sharing the token the wrong way

src/lib/mcp-auth-config.ts

@@ -1,4 +1,3 @@
-import crypto from 'crypto'
 import path from 'path'
 import os from 'os'
 import fs from 'fs/promises'
@@ -27,7 +26,61 @@ import { log, MCP_REMOTE_VERSION } from './utils'
 /**
  * Known configuration file names that might need to be cleaned
  */
-export const knownConfigFiles = ['client_info.json', 'tokens.json', 'code_verifier.txt']
+export const knownConfigFiles = ['client_info.json', 'tokens.json', 'code_verifier.txt', 'lock.json']
+
+/**
+ * Lockfile data structure
+ */
+export interface LockfileData {
+  pid: number
+  port: number
+  timestamp: number
+}
+
+/**
+ * Creates a lockfile for the given server
+ * @param serverUrlHash The hash of the server URL
+ * @param pid The process ID
+ * @param port The port the server is running on
+ */
+export async function createLockfile(serverUrlHash: string, pid: number, port: number): Promise<void> {
+  const lockData: LockfileData = {
+    pid,
+    port,
+    timestamp: Date.now(),
+  }
+  await writeJsonFile(serverUrlHash, 'lock.json', lockData)
+}
+
+/**
+ * Checks if a lockfile exists for the given server
+ * @param serverUrlHash The hash of the server URL
+ * @returns The lockfile data or null if it doesn't exist
+ */
+export async function checkLockfile(serverUrlHash: string): Promise<LockfileData | null> {
+  try {
+    const lockfile = await readJsonFile<LockfileData>(serverUrlHash, 'lock.json', {
+      async parseAsync(data: any) {
+        if (typeof data !== 'object' || data === null) return null
+        if (typeof data.pid !== 'number' || typeof data.port !== 'number' || typeof data.timestamp !== 'number') {
+          return null
+        }
+        return data as LockfileData
+      },
+    })
+    return lockfile || null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Deletes the lockfile for the given server
+ * @param serverUrlHash The hash of the server URL
+ */
+export async function deleteLockfile(serverUrlHash: string): Promise<void> {
+  await deleteConfigFile(serverUrlHash, 'lock.json')
+}
 
 /**
  * Deletes all known configuration files for a specific server
@@ -63,15 +116,6 @@ export async function ensureConfigDir(): Promise<void> {
   }
 }
 
-/**
- * Generates a hash for the server URL to use in filenames
- * @param serverUrl The server URL to hash
- * @returns The hashed server URL
- */
-export function getServerUrlHash(serverUrl: string): string {
-  return crypto.createHash('md5').update(serverUrl).digest('hex')
-}
-
 /**
  * Gets the file path for a config file
  * @param serverUrlHash The hash of the server URL