modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: state the credential impact, not the disconnect, in the shared-URL toast

Browse source 
Copilot: the stale-session guard deliberately skips `disconnect()` after a
switch, and `disconnect()` can also reject (which gets its own toast), so
claiming the active session "was disconnected too" is not always true.
What is always true is that its stored tokens went with the shared blob
and it must reconnect, so the message says that instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VGbw6TezNWnXZSCSp7sqb4
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-03 20:28:53 -04:00
commit 79896b6356
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
clients/web/src/hooks/useOAuthRecovery.test.tsx
View file

@ -1646,7 +1646,9 @@ describe("useOAuthRecovery", () => {
}),
);
expect(
toastWith("authorizes against the same URL, so it shared that state"),
toastWith(
"authorizes against the same URL, so its stored tokens went too",
),
).toBeDefined();
});

7
clients/web/src/hooks/useOAuthRecovery.ts
View file

@ -1474,7 +1474,12 @@ export function useOAuthRecovery({
message: isActive
? `Stored tokens and client registration were removed. Reconnect to run a fresh authorization flow.${revocationSuffix(revocation)}`
: sharesActiveOAuthKey
? `Stored OAuth state was removed for "${server.name}". The active session authorizes against the same URL, so it shared that state and was disconnected too — reconnect to run a fresh authorization flow.${revocationSuffix(revocation)}`
? // States the credential impact, which is certain, rather than
// the disconnect, which is not: the stale-session guard skips it
// after a switch, and `disconnect()` can reject (that failure
// gets its own toast above). Either way the shared state is gone,
// so the session must reconnect (Copilot).
`Stored OAuth state was removed for "${server.name}". The active session authorizes against the same URL, so its stored tokens went too — reconnect to run a fresh authorization flow.${revocationSuffix(revocation)}`
: `Stored OAuth state was removed for "${server.name}". Connect to authorize again.${revocationSuffix(revocation)}`,
color: "blue",
});