From 79896b63560874c78800a902011e492c06ed9ff7 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Thu, 3 Sep 2026 20:28:53 -0400 Subject: [PATCH] fix: state the credential impact, not the disconnect, in the shared-URL toast Copilot: the stale-session guard deliberately skips `disconnect()` after a switch, and `disconnect()` can also reject (which gets its own toast), so claiming the active session "was disconnected too" is not always true. What is always true is that its stored tokens went with the shared blob and it must reconnect, so the message says that instead. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01VGbw6TezNWnXZSCSp7sqb4 Signed-off-by: cliffhall --- clients/web/src/hooks/useOAuthRecovery.test.tsx | 4 +++- clients/web/src/hooks/useOAuthRecovery.ts | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/clients/web/src/hooks/useOAuthRecovery.test.tsx b/clients/web/src/hooks/useOAuthRecovery.test.tsx index 5cd1da51..6ffcc6c1 100644 --- a/clients/web/src/hooks/useOAuthRecovery.test.tsx +++ b/clients/web/src/hooks/useOAuthRecovery.test.tsx @@ -1646,7 +1646,9 @@ describe("useOAuthRecovery", () => { }), ); expect( - toastWith("authorizes against the same URL, so it shared that state"), + toastWith( + "authorizes against the same URL, so its stored tokens went too", + ), ).toBeDefined(); }); diff --git a/clients/web/src/hooks/useOAuthRecovery.ts b/clients/web/src/hooks/useOAuthRecovery.ts index 0223bdb2..9998590d 100644 --- a/clients/web/src/hooks/useOAuthRecovery.ts +++ b/clients/web/src/hooks/useOAuthRecovery.ts @@ -1474,7 +1474,12 @@ export function useOAuthRecovery({ message: isActive ? `Stored tokens and client registration were removed. Reconnect to run a fresh authorization flow.${revocationSuffix(revocation)}` : sharesActiveOAuthKey - ? `Stored OAuth state was removed for "${server.name}". The active session authorizes against the same URL, so it shared that state and was disconnected too — reconnect to run a fresh authorization flow.${revocationSuffix(revocation)}` + ? // States the credential impact, which is certain, rather than + // the disconnect, which is not: the stale-session guard skips it + // after a switch, and `disconnect()` can reject (that failure + // gets its own toast above). Either way the shared state is gone, + // so the session must reconnect (Copilot). + `Stored OAuth state was removed for "${server.name}". The active session authorizes against the same URL, so its stored tokens went too — reconnect to run a fresh authorization flow.${revocationSuffix(revocation)}` : `Stored OAuth state was removed for "${server.name}". Connect to authorize again.${revocationSuffix(revocation)}`, color: "blue", });