Group of 2 Under the hood
Bearer-token 403 retry logic and the design-consent MCP error path now both require an extra same-origin check (Nk) before triggering.
What
- The fetch wrapper that retries a request after a 403 response with a sent bearer token now also requires a new check (
Nk) to pass, in addition to the existing check that the response was a 403 with a token sent. - The same check now gates whether a 403 response gets turned into a
needs_consentdesign-MCP error, restricting that behavior to first-party design MCP endpoints.
Why This narrows when the 403-retry and design-consent behavior kicks in, preventing them from firing for responses that aren't actually from the first-party design MCP service.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
What condition the new Nk(s) check actually verifies is not specified.