Align managed-auth app completion with wait guards

Author: cursoragent

src/lib/mcp/apps/managed-auth-entry.tsx

@@ -61,6 +61,11 @@ type BeginResult = {
   };
   isError?: boolean;
 };
+type WaitToolResult = {
+  structuredContent?: {
+    state?: "authenticated" | "failed" | "pending";
+  };
+};
 
 let nextRequestId = 1;
 const pendingRequests = new Map<number, PendingRequest>();
@@ -118,11 +123,11 @@ function sendNotification(method: string, params: JsonObject) {
   postToHost({ jsonrpc: "2.0", method, params });
 }
 
-function callTool(name: string, args: JsonObject): Promise<BeginResult> {
+function callTool<T = BeginResult>(name: string, args: JsonObject): Promise<T> {
   return sendRequest("tools/call", {
     name,
     arguments: args,
-  }) as Promise<BeginResult>;
+  }) as Promise<T>;
 }
 
 function applyHostContext(context: JsonObject | undefined) {
@@ -247,6 +252,37 @@ function sanitizeBeginArguments(input: JsonObject): JsonObject {
   );
 }
 
+function waitArgumentsFromLauncher(
+  content: JsonObject | undefined,
+): JsonObject | null {
+  const nextAction = content?.next_action as
+    | {
+        tool?: unknown;
+        arguments?: JsonObject;
+      }
+    | undefined;
+  if (nextAction?.tool !== "manage_auth_connections" || !nextAction.arguments) {
+    return null;
+  }
+  const args = nextAction.arguments;
+  if (args.action !== "wait") return null;
+  const allowed = [
+    "action",
+    "id",
+    "domain_filter",
+    "profile_name",
+    "wait_seconds",
+    "required_flow_type",
+    "previous_flow_expires_at",
+    "previous_flow_event_id",
+  ];
+  return Object.fromEntries(
+    allowed
+      .filter((key) => args[key] !== undefined)
+      .map((key) => [key, args[key]]),
+  );
+}
+
 function ManagedAuthApp() {
   const launcher = useLauncherData();
   const [beginResult, setBeginResult] = useState<BeginResult | null>(null);
@@ -266,6 +302,7 @@ function ManagedAuthApp() {
   const launcherContent = launcher.result?.structuredContent as
     | {
         connection?: { domain?: string; profile_name?: string };
+        next_action?: { tool?: string; arguments?: JsonObject };
       }
     | undefined;
   const targetDomain =
@@ -277,6 +314,9 @@ function ManagedAuthApp() {
   const privateAuth =
     beginResult?._meta?.auth_login ??
     beginResult?.structuredContent?.app_private;
+  const waitArguments = waitArgumentsFromLauncher(
+    launcher.result?.structuredContent as JsonObject | undefined,
+  );
 
   const appearance = useMemo(
     () => ({ theme: launcher.theme, layout: { skipPrimeStep: true } }),
@@ -450,6 +490,24 @@ function ManagedAuthApp() {
         current.flow_status === "SUCCESS" &&
         current.status === "AUTHENTICATED"
       ) {
+        if (waitArguments) {
+          const wait = await callTool<WaitToolResult>(
+            "manage_auth_connections",
+            waitArguments,
+          );
+          const waitState = wait.structuredContent?.state;
+          if (waitState === "authenticated") {
+            finish("success");
+            return;
+          }
+          if (waitState === "failed") {
+            finish("failure");
+            return;
+          }
+          setStatusText("Secure login is still in progress…");
+          pollTimer.current = window.setTimeout(checkStatus, 2000);
+          return;
+        }
         finish("success");
         return;
       }

src/lib/mcp/tools/auth-connections.test.ts

@@ -516,6 +516,42 @@ describe("managed-auth wait", () => {
     expect(result.state).toBe("authenticated");
   });
 
+  test("null timeline baseline does not treat old success as a new flow", async () => {
+    const stale = connection({
+      status: "AUTHENTICATED",
+      flow_status: "SUCCESS",
+      flow_type: "REAUTH",
+      flow_expires_at: null,
+    });
+    const client = {
+      auth: {
+        connections: {
+          retrieve: async () => stale,
+          timeline: async () => ({
+            getPaginatedItems: () => [
+              {
+                id: "flow_old",
+                type: "reauth",
+                status: "SUCCESS",
+                timestamp: "2026-01-01T00:00:00Z",
+              },
+            ],
+          }),
+        },
+      },
+    } as unknown as KernelClient;
+    const result = await waitForAuthConnection(
+      client,
+      {
+        connectionId: stale.id,
+        previousFlowExpiresAt: null,
+        previousFlowEventId: null,
+      },
+      { timeoutMs: 0 },
+    );
+    expect(result.state).toBe("pending");
+  });
+
   test("baseline-guarded wait stays pending on the stale pre-flow success", async () => {
     const stale = connection({
       status: "AUTHENTICATED",

src/lib/mcp/tools/auth-connections.ts

@@ -151,7 +151,7 @@ export function registerAuthConnectionTools(server: McpServer) {
                 ...(params.previous_flow_expires_at !== undefined && {
                   previousFlowExpiresAt: params.previous_flow_expires_at,
                 }),
-                ...(params.previous_flow_event_id !== undefined && {
+                ...(params.previous_flow_event_id != null && {
                   previousFlowEventId: params.previous_flow_event_id,
                 }),
               },

src/lib/mcp/tools/auth-login-app.test.ts

@@ -383,6 +383,47 @@ describe("managed-auth MCP App registration", () => {
     }
   });
 
+  test("reauth launcher omits timeline baseline when no prior flow event exists", async () => {
+    kernelClientFactory = () => ({
+      auth: {
+        connections: {
+          retrieve: async () => ({
+            id: "conn_1",
+            domain: "example.com",
+            profile_name: "work",
+            status: "AUTHENTICATED",
+            flow_status: "SUCCESS",
+            flow_type: "LOGIN",
+            flow_expires_at: null,
+          }),
+          timeline: async () => ({
+            getPaginatedItems: () => [],
+          }),
+        },
+      },
+    });
+    try {
+      const { tools } = captureRegistration();
+      const result = await tools
+        .get("open_auth_login")!
+        .handler(
+          { mode: "reauth", connection_id: "conn_1", text_only: false },
+          { authInfo: { token: "unused-api-key" } },
+        );
+      expect(result.structuredContent.next_action.arguments).toEqual({
+        action: "wait",
+        id: "conn_1",
+        wait_seconds: 25,
+        previous_flow_expires_at: null,
+      });
+      expect(
+        JSON.stringify(result.structuredContent.next_action.arguments),
+      ).not.toContain("previous_flow_event_id");
+    } finally {
+      resetKernelClientFactory();
+    }
+  });
+
   test("reauth launcher observing a live flow emits no baseline guard", async () => {
     kernelClientFactory = () => ({
       auth: {

src/lib/mcp/tools/auth-login-app.ts

@@ -55,17 +55,14 @@ const authLoginInputSchema = {
 async function latestAuthFlowEventId(
   client: KernelClient,
   connectionId: string,
-): Promise<string | null | undefined> {
+): Promise<string | undefined> {
   try {
     const page = await client.auth.connections.timeline(connectionId, {
       limit: 10,
     });
-    return (
-      page
-        .getPaginatedItems()
-        .find((event) => event.type === "login" || event.type === "reauth")
-        ?.id ?? null
-    );
+    return page
+      .getPaginatedItems()
+      .find((event) => event.type === "login" || event.type === "reauth")?.id;
   } catch {
     return undefined;
   }

src/lib/mcp/tools/managed-auth-state.ts

@@ -240,10 +240,7 @@ export async function waitForAuthConnection(
       if (connection) {
         latest = toSafeAuthConnection(connection);
         if (hasLiveAuthFlow(latest)) observedLiveFlow = true;
-        if (
-          selector.previousFlowEventId !== undefined &&
-          selector.connectionId
-        ) {
+        if (selector.previousFlowEventId != null && selector.connectionId) {
           try {
             const event = await latestAuthFlowEvent(
               client,
@@ -271,7 +268,7 @@ export async function waitForAuthConnection(
         const flowGuarded =
           selector.requiredFlowType !== undefined ||
           selector.previousFlowExpiresAt !== undefined ||
-          selector.previousFlowEventId !== undefined;
+          selector.previousFlowEventId != null;
         const flowFailed =
           observedNewFlowFailed ||
           latest.flow_status === "FAILED" ||
@@ -294,7 +291,7 @@ export async function waitForAuthConnection(
             (selector.previousFlowExpiresAt === undefined ||
               latest.flow_expires_at !== selector.previousFlowExpiresAt ||
               observedLiveFlow) &&
-            (selector.previousFlowEventId === undefined || observedNewFlow));
+            (selector.previousFlowEventId == null || observedNewFlow));
         // AUTHENTICATED with a live in-progress flow means a (re-)auth is
         // still running: report pending instead of the stale pre-flow state.
         if (