mcp-publisher: device-flow login treats GitHub slow_down as fatal instead of backing off #1289

Summary

mcp-publisher login github (v1.7.9) fails with error polling for token: token request failed: slow_down if GitHub's device-flow token endpoint returns slow_down even once. Per RFC 8628 §3.5, slow_down is not a terminal error — the client is required to increase its polling interval by 5 seconds and continue polling.

Reproduction

1. mcp-publisher login github
2. Open the device URL but do not enter the code immediately (or enter it but delay authorization for ~30s).
3. Polling eventually returns slow_down; the publisher exits with:

Error: login failed: error polling for token: token request failed: slow_down

The login session is unrecoverable — the user must re-run the command and hope to authorize before any slow_down is emitted.

Root cause

cmd/publisher/auth/github-at.go lines 232–240 (v1.7.9), inside pollForToken:

if tokenResp.Error == "authorization_pending" {
    // User hasn't authorized yet, wait and retry
    time.Sleep(time.Duration(interval) * time.Second)
    continue
}

if tokenResp.Error != "" {
    return "", fmt.Errorf("token request failed: %s", tokenResp.Error)
}

Only authorization_pending is treated as retriable. slow_down falls into the catch-all branch and aborts.

Suggested fix

Treat slow_down as retriable as well, bumping the polling interval by 5 seconds as the RFC requires:

if tokenResp.Error == "authorization_pending" || tokenResp.Error == "slow_down" {
    if tokenResp.Error == "slow_down" {
        interval += 5
    }
    time.Sleep(time.Duration(interval) * time.Second)
    continue
}

Optionally, the initial interval could also be seeded from the interval field of the device-code response (already parsed into DeviceCodeResponse.Interval per line 26) rather than hardcoded to 5.

Environment

• mcp-publisher 1.7.9 (commit 35b2071, built 2026-05-12)
• Linux (WSL2)

Happy to send a PR if helpful.