improvement(mcp): let users re-open OAuth authorization anytime by waleedlatif1 · Pull Request #5809 · simstudioai/sim

waleedlatif1 · 2026-07-21T19:15:48Z

Summary

A server stuck on "OAuth Authorization required" had no discoverable way to re-open the auth popup once it was closed/abandoned. The connect button lived only in the server detail view and hard-disabled while "Connecting…" — a state cleared by polling popup.closed, which is unreliable under COOP (Gauge and many auth pages set it), so it could stay locked until the 10-minute safety timeout.
List row: add an "Authorize" / "Reopen authorization" action to the ⋯ menu for unconnected OAuth servers, so re-auth is reachable without drilling into Details.
Detail view: the button is now always clickable (reopens a fresh popup — the hook already drops the prior in-flight flow safely) instead of locking on an unverifiable "Connecting…" state; label reads "Reopen authorization window" while a flow is pending.
Matches how Cursor/Claude/VS Code treat re-auth: an idempotent, always-available action, never a lockout.

Type of Change

Improvement (UX)

Testing

Type-checks and biome clean. Manual: an OAuth server that needs auth now offers Authorize/Reopen from both the list menu and the detail button, and re-clicking after closing the popup opens a fresh window.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

A server stuck on 'OAuth Authorization required' had no discoverable way to re-trigger the auth popup once it was closed or abandoned: the connect button lived only in the server detail view and hard-disabled while 'Connecting…', a state cleared by polling popup.closed (unreliable under COOP), so it could stay locked until the 10-minute safety timeout. - Add an 'Authorize'/'Reopen authorization' action to the server list row menu for unconnected OAuth servers, so re-auth is reachable without drilling in. - Make the detail-view button always clickable (reopens a fresh popup) instead of locking on an unverifiable 'Connecting…' state.

cursor · 2026-07-21T19:15:58Z

PR Summary

Low Risk
Workspace MCP settings UX and client-side OAuth popup state only; no auth backend or token handling changes.

Overview
Makes MCP OAuth re-authorization reachable and repeatable when a popup was closed or abandoned, instead of hiding the action in details only or locking the UI on an unreliable “Connecting…” state.

Settings UI: Unconnected OAuth servers get Authorize / Reopen authorization in the list row ⋯ menu (managers only). The detail Connect with OAuth chip stays enabled while a flow is pending and shows Reopen authorization window when connecting.

useMcpOauthPopup: Drops popup.closed polling (unreliable under COOP). Uses per-server reference counting for connecting state, a concurrent-start guard on /oauth/start, and retires superseded flows only after a successful new start; failed reopens leave an in-flight flow’s connecting state intact. already_authorized still invalidates server queries.

Adds Vitest coverage for double-start prevention, reopen-after-settle, query invalidation, and failed-reopen with a live prior flow.

^{Reviewed by Cursor Bugbot for commit 778a534. Configure here.}

greptile-apps · 2026-07-21T19:18:44Z

Greptile Summary

This PR makes MCP OAuth authorization available again after a popup is closed or abandoned. The main changes are:

Adds Authorize and Reopen authorization actions to eligible server-row menus.
Keeps the detail-view authorization button clickable during a pending flow.
Tracks concurrent authorization attempts with per-server reference counts.
Adds tests for concurrent starts, reopened flows, cache invalidation, and failed replacement attempts.

Confidence Score: 5/5

This looks safe to merge.

Each authorization attempt has a balanced start and settlement path.
A failed replacement keeps the earlier live flow active.
Successful replacement flows retire stale state before tracking the new callback.
No blocking issue remains in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx	Adds list authorization actions and keeps the detail authorization action available while a flow is pending.
apps/sim/hooks/mcp/use-mcp-oauth-popup.ts	Uses per-server reference counts to coordinate pending, replaced, failed, completed, and timed-out OAuth attempts.
apps/sim/hooks/mcp/use-mcp-oauth-popup.test.tsx	Adds focused coverage for concurrent starts, reopening, cache invalidation, and replacement failure.

_{Reviews (5): Last reviewed commit: "refactor(mcp): make OAuth connecting sta..." | Re-trigger Greptile}

Now that the connect button stays clickable, block re-entry while the /oauth/start request is in flight; cleared once it settles so a later reopen still starts a fresh flow.

vercel · 2026-07-21T19:21:16Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 8:02pm

…e new flow Addresses a stale-poll race: an abandoned attempt's popup.closed interval could fire mid-reopen and clear 'Connecting…' for the fresh flow.

waleedlatif1 · 2026-07-21T19:34:11Z

@greptile

waleedlatif1 · 2026-07-21T19:34:12Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c261cf5. Configure here.}

… its poll Drop the previous attempt's pending-flow map entry and safety timeout up front too, so a late BroadcastChannel result (settleFlow) can't clear the reopened flow's connecting state during the new /oauth/start await.

waleedlatif1 · 2026-07-21T19:40:12Z

@greptile

waleedlatif1 · 2026-07-21T19:40:13Z

@cursor review

Reworks reopen concurrency so a superseded or failed reopen can't lose a real authorization: - Retire the prior flow only after the replacement /oauth/start succeeds; a failed reopen keeps it so its popup can still complete and be honored. - Guard the connecting-clear (settleFlow + popup poll) behind the in-flight start set, so a stale settle can't flicker the reopened flow's label. - Invalidate server queries on already_authorized so the UI reflects a server that authorized out from under the client. Adds a test for the already_authorized invalidation.

waleedlatif1 · 2026-07-21T19:51:45Z

@greptile

waleedlatif1 · 2026-07-21T19:51:46Z

@cursor review

…e counting Replaces the scattered, race-prone stopConnecting/set-based tracking with a per-server attempt count: each start increments once and clears exactly once (fail, already_authorized, settle, or supersede), so the 'Connecting…' / 'Reopen authorization' label can never get stuck or flicker across concurrent reopens. Retire prior flows whenever a replacement start succeeds (including already_authorized); a failed reopen keeps the prior flow so it can still complete. Drops the unreliable popup.closed poll entirely — the label already invites reopening and the safety timeout guarantees clearing. Adds a test for the failed-reopen-preserves-prior-flow case.

waleedlatif1 · 2026-07-21T20:02:39Z

@greptile

waleedlatif1 · 2026-07-21T20:02:40Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 778a534. Configure here.}

greptile-apps Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx

cursor Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx

fix(mcp): guard OAuth start against double-click opening two popups

c8d054a

Now that the connect button stays clickable, block re-entry while the /oauth/start request is in flight; cleared once it settles so a later reopen still starts a fresh flow.

vercel Bot temporarily deployed to Preview July 21, 2026 19:21 Inactive

test(mcp): cover OAuth popup double-click guard and reopen-after-settle

9914c82

vercel Bot temporarily deployed to Preview July 21, 2026 19:28 Inactive

fix(mcp): kill prior popup poll before reopening so it can't clear th…

c261cf5

…e new flow Addresses a stale-poll race: an abandoned attempt's popup.closed interval could fire mid-reopen and clear 'Connecting…' for the fresh flow.

vercel Bot temporarily deployed to Preview July 21, 2026 19:33 Inactive

cursor Bot reviewed Jul 21, 2026

View reviewed changes

greptile-apps Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts Outdated

vercel Bot temporarily deployed to Preview July 21, 2026 19:40 Inactive

greptile-apps Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts Outdated

cursor Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts Outdated

vercel Bot temporarily deployed to Preview July 21, 2026 19:51 Inactive

cursor Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts Outdated

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts Outdated

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts

greptile-apps Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/hooks/mcp/use-mcp-oauth-popup.ts Outdated

vercel Bot temporarily deployed to Preview July 21, 2026 20:02 Inactive

cursor Bot reviewed Jul 21, 2026

View reviewed changes

waleedlatif1 merged commit 6e5f685 into staging Jul 21, 2026
20 checks passed

waleedlatif1 deleted the fix/mcp-oauth-reconnect branch July 21, 2026 20:06

waleedlatif1 mentioned this pull request Jul 22, 2026

v0.7.41: email fixes, MCP fixes, gemini 3.6 flash, GitHub runners fallback, mothership experience improvements, soft delete chats #5835

Open

Uh oh!

Conversation

waleedlatif1 commented Jul 21, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

cursor Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vercel Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor Bot commented Jul 21, 2026 •

edited

Loading

greptile-apps Bot commented Jul 21, 2026 •

edited

Loading

vercel Bot commented Jul 21, 2026 •

edited

Loading