unified-mcp-server: concurrency and credential-isolation hardening under one shared process #413

Part of #408. Depends on the HTTP transport.

Why

Per-call work is already stateless — each tools/call spawns a CLI with its own scoped env ({...process.env, ...resolveEnvPlaceholders(provider.env)}, bin/unified-mcp-server.mjs:415) — so sharing one process across sessions should be safe. "Should be" is not evidence.

The specific hazard: the slot-mode credential bootstrap mutates global process.env (:1001, :1025). It is guarded by if (SLOT ...) and so never runs in unified mode, but that guard is now load-bearing for cross-session credential isolation rather than merely tidy. It deserves a test that fails if someone removes it.

Acceptance

• load test: N concurrent tools/call across different providers, no crossed responses
• a test asserts no global process.env mutation happens in unified/HTTP mode
• provider A's credentials never appear in provider B's spawn env
• memory stays flat under sustained concurrent load (the entire point of the epic)