Windows: runaway MCP OAuth initialization opens repeated browser sessions; Maximum update depth exceeded #5134

Describe the bug

Running copilot interactively on Windows causes repeated OAuth browser sessions during initialization. Browser sessions keep opening until the user terminates Copilot. This prevents normal startup and authentication.

Existing CLI logs confirm rapid repeated authentication initiation for the same MCP servers, and a "Maximum update depth exceeded" error during the same startup. No deliberate reproduction was attempted after the problem was reported, to avoid launching more browser sessions.

Affected version

• Copilot CLI: 1.0.60 (recorded in startup logs)
• Node.js: v24.16.0 (recorded in startup logs)
• Windows NT 10.0.26200.0, x64
• Installed via the npm launcher
• Terminal emulator and shell used for the affected launches: not collected
• Observed October 13, 2026

Steps to reproduce the behavior

1. Configure multiple remote HTTP MCP servers, including Supabase staging/production, Expo, Linear, and Resend in a workspace-root .mcp.json.
2. Have authentication required for configured remote servers.
3. Run copilot in the workspace.
4. During initialization, repeated OAuth browser sessions open. The user must terminate Copilot to stop them.

Representative sanitized workspace configuration:

{
  "mcpServers": {
    "supabase-staging": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp?project_ref=<staging-project-ref>"
    },
    "supabase-production": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp?project_ref=<production-project-ref>"
    },
    "expo": {
      "type": "http",
      "url": "https://mcp.expo.dev/mcp",
      "tools": ["*"]
    },
    "linear": {
      "type": "http",
      "url": "https://mcp.linear.app/mcp",
      "tools": ["*"]
    },
    "resend": {
      "type": "http",
      "url": "https://mcp.resend.com/mcp",
      "tools": ["*"]
    }
  }
}

Project references are redacted. Additional user-level MCP servers are configured, including Atlassian.

Expected behavior

Deduplicate in-progress OAuth flows per server, avoid launching a new browser flow repeatedly during initialization, and allow cancellation. Authentication waiting/failure should not cause an unbounded UI update loop or prevent startup.

Additional context

In one standalone CLI process log, from 18:15:57.838Z to 18:16:26.803Z (about 29 seconds), there are 488 messages matching Server <name> requires authentication, initiating OAuth flow:

Examples of the same server being retried within milliseconds:

2026-10-13T18:16:02.994Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow
2026-10-13T18:16:03.071Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow
2026-10-13T18:16:03.094Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow
2026-10-13T18:16:03.099Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow

During that startup:

2026-10-13T18:16:11.958Z [ERROR] Maximum update depth exceeded. This can happen when a component calls setState inside useEffect, but useEffect either doesn't have a dependency array, or one of the dependencies changes on every render.

That log records three explicit Opening browser for ... authentication messages. The user observed many browser sessions; the 488 count measures authentication-initiation messages, not independently verified browser launches.

A separate earlier CLI process log shows similarly repeated Supabase OAuth initiations within milliseconds, so the repetition is present across multiple launches.

Related VS Code issue: microsoft/vscode#341353. In a Copilot SDK-backed VS Code Agent Host session on this machine, Authenticate instead does nothing and authorization-server metadata discovery fails. Terminal authentication was attempted as a workaround and encountered this browser-session storm. These may be distinct bugs; a shared root cause is not established.

Possible related CLI report: #4695 (OAuth token reuse across sessions). The distinguishing symptom here is rapid repeated initiation within a single startup, accompanied by the UI update-depth error.

Only sanitized excerpts are included. No credentials, project identifiers, private repository details, OAuth URLs with query tokens, or complete raw logs are attached.