Waleed e51a867de3 fix(mcp): open the OAuth popup synchronously and bound the start request (#5824) ...

* fix(mcp): open the OAuth popup synchronously and bound the start request

Two bugs behind 'pressed Connect/Reopen and nothing happened':
- window.open ran AFTER awaiting /oauth/start, outside the browser's user
  activation, so the popup was silently blocked (worst on the add-server flow).
  Popup-first now: open about:blank synchronously in the click (named window,
  so a re-click focuses/reuses an existing authorization window), navigate it
  once the start returns; close it on failure/already_authorized; clear toast
  when genuinely blocked (and skip the request entirely).
- /oauth/start had no client timeout, so a stalled start held the re-entrancy
  guard and the connecting label indefinitely. Bounded at 30s; on timeout the
  popup closes, the label resets, and retry is immediately available.

* fix(mcp): harden popup-first reopen edges

- Retire prior flows as soon as the named popup opens (the open already blanked
  any prior auth window; a failed start must not leave a windowless flow
  'connecting' for the 10-minute safety timeout).
- Check the COOP-fallback window.open result; when blocked, clear the state and
  toast instead of registering a windowless pending flow.
- Feature-detect AbortSignal.timeout (Safari <16) with an AbortController
  fallback for the bounded /oauth/start.

* fix(mcp): close the blank popup when post-start navigation fails

* chore(mcp): correct connecting-count ordering comment

2026-07-21 17:15:11 -07:00

..

docs

feat(pi): add code review mode (#5577)

2026-07-20 16:25:40 -07:00

pii

fix(pii): mask offloaded large payloads chunk-by-chunk instead of aborting at 16MB (#5810)

2026-07-21 18:03:14 -04:00

realtime

fix(workflow-edges): enforce edge/block validation server-side, not just client-side (#5571)

2026-07-10 15:25:25 -07:00

sim

fix(mcp): open the OAuth popup synchronously and bound the start request (#5824)

2026-07-21 17:15:11 -07:00