Security: Follow-up tool call silently routed to a different connector

In the reported setup, two connectors—a custom developer-mode connector (A) and a published app-directory connector (B)—pointed to the same MCP server but each had its own OAuth client, so the server saw two separate clients for one user. After the user confirmed an action in connector A's widget, which issued a one-time confirmation code via ui/message, the model sent the follow-up call with that code through connector B without notifying the user; the server rejected it because the code was bound to connector A's OAuth client, and every attempt in that conversation failed. The case matters because connectors are separate apps with separate OAuth grants, so the silent switch passed data produced in one app to another without user consent, and the server-side binding only caught it because both connectors came from the same provider. The expected behavior is that tool calls are matched to a connector by its OAuth client rather than by the shared MCP server URL, since a single URL can serve different tenants, partners or environments; watch for whether the routing is fixed to preserve authorization continuity and how third-party connectors behave in the same conversation.