fix(mcp): clear execution timeout to avoid timer leak; redact callback error

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/mcp/oauth/callback/route.ts

@@ -106,6 +106,6 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     return htmlClose('Connected. You can close this window.', true)
   } catch (error) {
     logger.error('MCP OAuth callback failed', error)
-    return htmlClose(`Authorization failed: ${toError(error).message}`, false)
+    return htmlClose('Authorization failed. Please try again.', false)
   }
 })

apps/sim/app/api/mcp/tools/execute/route.ts

@@ -193,12 +193,18 @@ export const POST = withRouteHandler(
         extraHeaders[SIM_VIA_HEADER] = simViaHeader
       }
 
+      let timeoutHandle: ReturnType<typeof setTimeout> | undefined
       const result = await Promise.race([
         mcpService.executeTool(userId, serverId, toolCall, workspaceId, extraHeaders),
-        new Promise<never>((_, reject) =>
-          setTimeout(() => reject(new Error('Tool execution timeout')), executionTimeout)
-        ),
-      ])
+        new Promise<never>((_, reject) => {
+          timeoutHandle = setTimeout(
+            () => reject(new Error('Tool execution timeout')),
+            executionTimeout
+          )
+        }),
+      ]).finally(() => {
+        if (timeoutHandle !== undefined) clearTimeout(timeoutHandle)
+      })
 
       const transformedResult = transformToolResult(result)