feat(web): URL elicitation — explicit completion step + error-path (-32042) handling (#1415) (#1436)

* feat(web): two-step URL elicitation completion (#1415)

Replace accept-on-open with an explicit completion step for URL
elicitations. Opening the URL now only transitions the panel to its
waiting state; the elicitation resolves with `accept` only when the user
clicks the revealed "I've completed it" action, or with `cancel`.

- ElicitationUrlPanel: add `onComplete`, reveal the completion button and
  relabel open→"Reopen in Browser" while `isWaiting`.
- PendingClientRequestModal: wire local `isWaiting`; open no longer sends
  a response. Removed the accept-on-open comment that pointed here.
- Tests cover open→waiting→complete and open→cancel, and assert opening
  alone does not resolve the elicitation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(web): handle URL-elicitation-required (-32042) error path

Implements the spec's "URL mode with elicitation required error" flow
(2025-11-25). When a tools/call returns a `-32042`
UrlElicitationRequired error, the client now surfaces the required URL
elicitation(s) and retries the call once completed, instead of showing a
bare error.

Core (InspectorClient.callTool):
- Detect `-32042` (typed UrlElicitationRequiredError or generic McpError)
  via the new `getUrlElicitationsFromError` helper.
- Surface each carried elicitation in order through the existing pending-
  elicitation queue / modal (reusing the two-step "Open → I've completed
  it" UI), then re-issue the original call once all are accepted. A
  decline/cancel aborts with a clear message; a bounded retry count guards
  a server that keeps returning the error.
- `ElicitationCreateMessage.completeIfPending()` lets the optional
  `notifications/elicitation/complete` auto-advance/auto-accept an open
  URL elicitation; the completion-notification handler now resolves
  (was: only removed) the pending entry.
- Extracted `attemptToolCall` / `dispatchFailedToolCall` from the old
  callTool body to support the retry loop without duplicating bookkeeping.

Web (App):
- A non-spec `-32042` with no elicitations (nothing to open) shows a
  dedicated yellow toast linking to a new UrlElicitationErrorModal with
  the raw error body, mirroring the output-schema-validation toast.

Tests: helper unit tests, completeIfPending unit tests, callTool
error-path retry/cancel/no-list/ordinary-error tests (injected fake
client), the new modal (test + stories), and an App toast test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(web): abort URL-elicitation error path on a repeated URL

Guard the -32042 retry loop: if the server's retry error re-requests a
URL the user already completed earlier in the same call, completing it
again can't make progress, so callTool aborts with a new typed
UrlElicitationLoopError instead of re-prompting (which would loop until
the retry cap). The web layer detects it and shows a "URL elicitation
loop" toast naming the repeated URL rather than a generic failure.

Tests: core abort-on-repeat test (URL presented once, two attempts, then
loop error) and an App loop-toast test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(web): let Copy-URL reach the URL-elicitation completion step

Address review of #1436: the "I've completed it" action was gated behind
clicking "Open in Browser" (only that set isWaiting), so a user who used
Copy URL to finish the flow externally could only Cancel. Copying the URL
now also moves the panel into the waiting state, exposing the completion
step. Also trims the now-redundant second sentence of the waiting hint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(core): address review of error-path URL elicitation

Review follow-ups on #1436 (all non-blocking):
- Remove the leftover bare block scope in attemptToolCall (extraction
  artifact); body de-indented one level.
- Log a warning when callTool gives up after the URL-elicitation retry
  cap is hit, so a server that keeps demanding new elicitations is
  diagnosable rather than looking like an ordinary failure.
- Assert the dispatch-once invariant on the loop-abort and cancel-abort
  paths (exactly one failed toolCallResultChange event).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* style(core): fix attemptToolCall body indentation

Run prettier over the extracted attemptToolCall method body, which was left
over-indented by 2 spaces after the bare-block removal in 0754b43d. core/ is
outside clients/web's format:check scope, so npm run validate did not catch it.

Whitespace-only; the pre-existing line 658 wrap (also outside the format scope)
is left as-is, out of scope for this PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(core): settle pending elicitations on disconnect to avoid callTool hang

Address review of #1436: an error-path `awaitUrlElicitation` promise only
settled via respond, but `disconnect()` cleared `pendingElicitations`
wholesale — so a disconnect mid-elicitation (server crash, manual
disconnect, transport close) left `callTool` (and the UI's in-flight
toolCallState) hanging forever.

- Add `ElicitationCreateMessage.cancel()`: settles a pending elicitation
  as `{ action: "cancel" }` without calling `onRemove` (the queue is
  cleared by the caller, so it must not splice mid-iteration).
- `disconnect()` now cancels each pending elicitation before clearing the
  array, and dispatches `pendingElicitationsChange` (it already did so for
  samples) so the modal closes on a transport-close teardown too.

Tests: disconnect-mid-elicitation settles callTool (no hang); cancel()
unit tests (resolves-without-remove, no-op once responded).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-06-06 18:25:01 -04:00 • committed by GitHub
commit 5cabc1ecd7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 1232 additions and 124 deletions

View file

@ -8,6 +8,7 @@ const meta: Meta<typeof ElicitationUrlPanel> = {
args: {
onCopyUrl: fn(),
onOpenInBrowser: fn(),
onComplete: fn(),
onCancel: fn(),
message: "Please authenticate with the external service.",
requestId: "elicit-abc-123",

View file

@ -10,6 +10,7 @@ const baseProps = {
isWaiting: false,
onCopyUrl: vi.fn(),
onOpenInBrowser: vi.fn(),
onComplete: vi.fn(),
onCancel: vi.fn(),
};
@ -33,16 +34,29 @@ describe("ElicitationUrlPanel", () => {
).toBeInTheDocument();
});
it("does not render waiting indicator when isWaiting is false", () => {
it("does not render the waiting indicator or complete action when not waiting", () => {
renderWithMantine(<ElicitationUrlPanel {...baseProps} />);
expect(
screen.queryByText("Waiting for completion..."),
screen.queryByText(/Waiting for completion/),
).not.toBeInTheDocument();
expect(
screen.queryByRole("button", { name: "I've completed it" }),
).not.toBeInTheDocument();
expect(
screen.getByRole("button", { name: "Open in Browser" }),
).toBeInTheDocument();
});
it("renders waiting indicator when isWaiting is true", () => {
it("renders the waiting indicator and complete action when waiting", () => {
renderWithMantine(<ElicitationUrlPanel {...baseProps} isWaiting />);
expect(screen.getByText("Waiting for completion...")).toBeInTheDocument();
expect(screen.getByText(/Waiting for completion/)).toBeInTheDocument();
expect(
screen.getByRole("button", { name: "I've completed it" }),
).toBeInTheDocument();
// The open action is relabelled so the user can reopen the tab.
expect(
screen.getByRole("button", { name: "Reopen in Browser" }),
).toBeInTheDocument();
});
it("invokes onCopyUrl when Copy URL is clicked", async () => {
@ -65,6 +79,16 @@ describe("ElicitationUrlPanel", () => {
expect(onOpenInBrowser).toHaveBeenCalledTimes(1);
});
it("invokes onComplete when I've completed it is clicked while waiting", async () => {
const user = userEvent.setup();
const onComplete = vi.fn();
renderWithMantine(
<ElicitationUrlPanel {...baseProps} isWaiting onComplete={onComplete} />,
);
await user.click(screen.getByRole("button", { name: "I've completed it" }));
expect(onComplete).toHaveBeenCalledTimes(1);
});
it("invokes onCancel when Cancel is clicked", async () => {
const user = userEvent.setup();
const onCancel = vi.fn();
@ -74,4 +98,12 @@ describe("ElicitationUrlPanel", () => {
await user.click(screen.getByRole("button", { name: "Cancel" }));
expect(onCancel).toHaveBeenCalledTimes(1);
});
it("disables the completion and cancel actions when busy", () => {
renderWithMantine(<ElicitationUrlPanel {...baseProps} isWaiting busy />);
expect(
screen.getByRole("button", { name: "I've completed it" }),
).toBeDisabled();
expect(screen.getByRole("button", { name: "Cancel" })).toBeDisabled();
});
});

View file

@ -13,9 +13,16 @@ export interface ElicitationUrlPanelProps {
message: string;
url: string;
requestId: string;
/**
* The URL has been opened and we're waiting for the user to confirm they
* finished the external flow. Reveals the "I've completed it" action; opening
* the URL does not resolve the elicitation on its own.
*/
isWaiting: boolean;
onCopyUrl: () => void;
onOpenInBrowser: () => void;
/** User confirms the external flow is done — sends `accept`. */
onComplete: () => void;
onCancel: () => void;
/**
* A response has been dispatched; lock the responding actions so a second
@ -56,6 +63,7 @@ export function ElicitationUrlPanel({
isWaiting,
onCopyUrl,
onOpenInBrowser,
onComplete,
onCancel,
busy = false,
}: ElicitationUrlPanelProps) {
@ -70,7 +78,7 @@ export function ElicitationUrlPanel({
Copy URL
</Button>
<Button variant="light" onClick={onOpenInBrowser} disabled={busy}>
Open in Browser
{isWaiting ? "Reopen in Browser" : "Open in Browser"}
</Button>
</Group>
<Divider />
@ -88,6 +96,11 @@ export function ElicitationUrlPanel({
<Button variant="light" onClick={onCancel} disabled={busy}>
Cancel
</Button>
{isWaiting && (
<Button onClick={onComplete} disabled={busy}>
I've completed it
</Button>
)}
</Group>
</Stack>
);

View file

@ -214,18 +214,39 @@ describe("PendingClientRequestModal", () => {
});
});
it("opens the URL and accepts a URL elicitation", async () => {
it("opens the URL into a waiting state without resolving the elicitation", async () => {
const user = userEvent.setup();
const openSpy = vi.spyOn(window, "open").mockReturnValue(null);
renderWithMantine(
<PendingClientRequestModal {...baseProps} request={urlContent} />,
);
// Before opening there is no completion action.
expect(
screen.queryByRole("button", { name: "I've completed it" }),
).not.toBeInTheDocument();
await user.click(screen.getByRole("button", { name: "Open in Browser" }));
expect(openSpy).toHaveBeenCalledWith(
"https://example.com/authorize",
"_blank",
"noopener,noreferrer",
);
// Opening alone must not resolve the elicitation; it only reveals the
// explicit completion step.
expect(baseProps.onElicitationRespond).not.toHaveBeenCalled();
expect(
screen.getByRole("button", { name: "I've completed it" }),
).toBeInTheDocument();
openSpy.mockRestore();
});
it("accepts a URL elicitation only after the user confirms completion", async () => {
const user = userEvent.setup();
const openSpy = vi.spyOn(window, "open").mockReturnValue(null);
renderWithMantine(
<PendingClientRequestModal {...baseProps} request={urlContent} />,
);
await user.click(screen.getByRole("button", { name: "Open in Browser" }));
await user.click(screen.getByRole("button", { name: "I've completed it" }));
expect(baseProps.onElicitationRespond).toHaveBeenCalledWith({
action: "accept",
});
@ -246,14 +267,38 @@ describe("PendingClientRequestModal", () => {
expect(writeText).toHaveBeenCalledWith("https://example.com/authorize");
});
it("cancels a URL elicitation", async () => {
it("reveals the completion step after Copy URL so a copy-paste flow can accept", async () => {
const user = userEvent.setup();
Object.defineProperty(navigator, "clipboard", {
value: { writeText: vi.fn().mockResolvedValue(undefined) },
configurable: true,
});
renderWithMantine(
<PendingClientRequestModal {...baseProps} request={urlContent} />,
);
// Before copying there is no completion action.
expect(
screen.queryByRole("button", { name: "I've completed it" }),
).not.toBeInTheDocument();
await user.click(screen.getByRole("button", { name: "Copy URL" }));
await user.click(screen.getByRole("button", { name: "I've completed it" }));
expect(baseProps.onElicitationRespond).toHaveBeenCalledWith({
action: "accept",
});
});
it("cancels a URL elicitation after opening without sending accept", async () => {
const user = userEvent.setup();
const openSpy = vi.spyOn(window, "open").mockReturnValue(null);
renderWithMantine(
<PendingClientRequestModal {...baseProps} request={urlContent} />,
);
await user.click(screen.getByRole("button", { name: "Open in Browser" }));
await user.click(screen.getByRole("button", { name: "Cancel" }));
expect(baseProps.onElicitationRespond).toHaveBeenCalledTimes(1);
expect(baseProps.onElicitationRespond).toHaveBeenCalledWith({
action: "cancel",
});
openSpy.mockRestore();
});
});

View file

@ -174,25 +174,30 @@ function ElicitationUrlModalBody({
url: string;
onRespond: (result: ElicitResult) => void;
}) {
const [isWaiting, setIsWaiting] = useState(false);
const { responded, once } = useRespondOnce();
return (
<ElicitationUrlPanel
message={message}
url={url}
requestId={id}
isWaiting={false}
isWaiting={isWaiting}
onCopyUrl={() => {
void navigator.clipboard?.writeText(url);
// Copying the URL is the other way to start the external flow (paste
// into a browser). Reveal the completion step too, otherwise a user who
// copies rather than clicking "Open in Browser" could only Cancel.
setIsWaiting(true);
}}
onOpenInBrowser={once(() => {
onOpenInBrowser={() => {
window.open(url, "_blank", "noopener,noreferrer");
// Accept-on-open: the inspector can't observe completion of an external
// flow, so opening the URL is treated as acceptance. This is optimistic
// — the user could close the tab without finishing. A proper two-step
// "open, then confirm completion" flow (using ElicitationUrlPanel's
// isWaiting state) is tracked as a follow-up; see #1415.
onRespond({ action: "accept" });
})}
// Opening the URL only moves the panel into its waiting state — the
// inspector can't observe completion of an external flow, so the
// elicitation resolves only when the user explicitly confirms
// completion (accept) or cancels.
setIsWaiting(true);
}}
onComplete={once(() => onRespond({ action: "accept" }))}
onCancel={once(() => onRespond({ action: "cancel" }))}
busy={responded}
/>

View file

@ -0,0 +1,59 @@
import { AppShell } from "@mantine/core";
import type { Meta, StoryObj } from "@storybook/react-vite";
import { expect, fn, within } from "storybook/test";
import {
UrlElicitationErrorModal,
type UrlElicitationErrorModalProps,
} from "./UrlElicitationErrorModal";
const SAMPLE_DETAILS = JSON.stringify(
{
code: -32042,
message: "This request requires browser-based authorization.",
data: {},
},
null,
2,
);
function InteractiveRender(args: UrlElicitationErrorModalProps) {
return (
<AppShell>
<AppShell.Main>
<UrlElicitationErrorModal {...args} />
</AppShell.Main>
</AppShell>
);
}
const meta: Meta<typeof UrlElicitationErrorModal> = {
title: "Groups/UrlElicitationErrorModal",
component: UrlElicitationErrorModal,
parameters: { layout: "fullscreen" },
render: InteractiveRender,
args: {
opened: true,
onClose: fn(),
toolName: "trigger-url-elicitation",
details: SAMPLE_DETAILS,
},
};
export default meta;
type Story = StoryObj<typeof UrlElicitationErrorModal>;
export const Default: Story = {
play: async ({ canvasElement }) => {
// Mantine renders the modal in a portal at document.body.
const body = within(canvasElement.ownerDocument.body);
await body.findByText("URL elicitation required");
expect(body.getByText(/trigger-url-elicitation/)).toBeInTheDocument();
const details = body.getByLabelText("Error details") as HTMLTextAreaElement;
expect(details.value).toContain("-32042");
expect(details.readOnly).toBe(true);
},
};
export const WithoutToolName: Story = {
args: { toolName: undefined },
};

View file

@ -0,0 +1,63 @@
import { describe, it, expect, vi } from "vitest";
import userEvent from "@testing-library/user-event";
import { renderWithMantine, screen } from "../../../test/renderWithMantine";
import { UrlElicitationErrorModal } from "./UrlElicitationErrorModal";
const DETAILS = JSON.stringify(
{
code: -32042,
message: "This request requires browser-based authorization.",
data: {},
},
null,
2,
);
describe("UrlElicitationErrorModal", () => {
it("renders the tool name and the raw error body in a read-only field", () => {
renderWithMantine(
<UrlElicitationErrorModal
opened
onClose={vi.fn()}
toolName="trigger-url-elicitation"
details={DETAILS}
/>,
);
expect(screen.getByText("URL elicitation required")).toBeInTheDocument();
expect(screen.getByText(/trigger-url-elicitation/)).toBeInTheDocument();
const details = screen.getByLabelText(
"Error details",
) as HTMLTextAreaElement;
expect(details.value).toBe(DETAILS);
expect(details.readOnly).toBe(true);
});
it("falls back to a generic message when no tool name is provided", () => {
renderWithMantine(
<UrlElicitationErrorModal opened onClose={vi.fn()} details={DETAILS} />,
);
expect(screen.getByText(/no required elicitations/i)).toBeInTheDocument();
});
it("calls onClose when the close button is clicked", async () => {
const onClose = vi.fn();
renderWithMantine(
<UrlElicitationErrorModal opened onClose={onClose} details={DETAILS} />,
);
await userEvent.click(screen.getByRole("button", { name: "Close" }));
expect(onClose).toHaveBeenCalledTimes(1);
});
it("renders nothing visible when closed", () => {
renderWithMantine(
<UrlElicitationErrorModal
opened={false}
onClose={vi.fn()}
details={DETAILS}
/>,
);
expect(
screen.queryByText("URL elicitation required"),
).not.toBeInTheDocument();
});
});

View file

@ -0,0 +1,64 @@
import {
CloseButton,
Group,
Modal,
Stack,
Text,
Textarea,
Title,
} from "@mantine/core";
export interface UrlElicitationErrorModalProps {
opened: boolean;
onClose: () => void;
/** The tool whose call returned the URL-elicitation-required error. */
toolName?: string;
/** The raw error body (message + data), pretty-printed for inspection. */
details?: string;
}
/**
* Surfaces the raw body of a `URLElicitationRequired` (`-32042`) error that
* carried no `elicitations` list — a non-spec server response the inspector
* can't act on (there's no URL to open). The Tools screen shows a short toast;
* this modal, opened from that toast, exposes the full error so a server
* developer can see what the server actually returned.
*/
export function UrlElicitationErrorModal({
opened,
onClose,
toolName,
details,
}: UrlElicitationErrorModalProps) {
return (
<Modal
opened={opened}
onClose={onClose}
withCloseButton={false}
size="lg"
centered
>
<Stack gap="md">
<Group justify="space-between" wrap="nowrap">
<Title order={4} flex={1}>
URL elicitation required
</Title>
<CloseButton aria-label="Close" onClick={onClose} />
</Group>
<Text size="sm" c="dimmed">
{toolName
? `"${toolName}" returned a URLElicitationRequired (-32042) error with no required elicitations. Per the MCP spec the error must list the URL elicitations to complete before retrying, so the inspector has nothing to open.`
: "The server returned a URLElicitationRequired (-32042) error with no required elicitations. Per the MCP spec the error must list the URL elicitations to complete before retrying, so the inspector has nothing to open."}
</Text>
<Textarea
aria-label="Error details"
readOnly
autosize
minRows={6}
maxRows={18}
value={details ?? ""}
/>
</Stack>
</Modal>
);
}