fix(mship): return the chat connect flow to the tab that started it (#6403)

* fix(mship): return the chat connect flow to the tab that started it

Connecting an integration from a chat credential chip opened OAuth in a
new tab and returned there, so the user landed on a second copy of the
app while the conversation they started from sat stale behind it.

The flow now runs in a popup and returns through a new self-closing page
at /oauth/chat-complete, which publishes its verdict to the shared
attempt record and closes. The chat tab picks that up over its storage
listener and updates in place, so it never navigates. A blocked popup
takes the same route in a new tab and still lands on the completion
page, so both paths share one verdict source.

That verdict is now the server's: reaching the completion page means
Better Auth routed the flow to its success callback. The previous check
diffed the workspace credential list, which reported failure whenever a
user re-authorized an account they had already linked -- that path
updates the account row and creates no new credential.

The lock is stricter than the label. A failure to create the credential
from its draft is swallowed server-side, so a flow can report success
with nothing in the workspace; the row stays retryable unless the
credential actually appears.

Also: the popup is named per attempt so sibling rows cannot renavigate
each other's window; a cross-origin connect URL keeps the anchor's
noopener instead of taking the popup path; the focus verifier reads the
attempt after its refetch so a verdict published mid-flight is not
overwritten; and the verifier treats a popup parked on a terminal page
(/oauth-error, the workspace error exit) as finished rather than
waiting on it forever.

* fix(mship): settle the connect row from the popup, not from focus alone

Addresses the review findings on the chat OAuth return leg.

- Watch the popup on an interval. A provider interstitial bouncing to the
  workspace root, a denied consent on /oauth-error, or a closed window all end
  the flow without publishing a verdict or firing any event in this tab, so the
  row waited forever. The focus handler also no longer consumes the away flag
  when it defers to a live popup.
- Focus an already-running popup on a repeat click instead of starting a rival
  attempt, which orphaned the first flow's verdict on an attempt id the row had
  stopped reading.
- Settle from the refetched credentials on the popup success path, so the row's
  lock is corroborated and a connected row stops being clickable.

Extracts the shared refetch-then-decide step into settleFromCredentials, used
by the focus handler, the popup watcher, and the success path.

* fix(mship): never read a disowned popup handle as a finished flow

A provider page with COOP same-origin disowns the popup, and the disowned
handle reports closed for a consent screen still running. The watcher took
that as an ending and published 'failed' against a live flow.

- Replace the boolean with a three-state observation. Only a same-origin
  terminal page counts as 'ended'; a closed-or-disowned handle is
  'unobservable' and publishes no verdict. Closing a popup hands focus back
  to this tab anyway, so the focus verification settles that case.
- Stop the interval before settling. The refetch leaves the status pending
  for its duration, so a running interval could fire again and resolve an
  attempt a retry had since replaced.
- Gate the success toast on a launched-attempt ref rather than the window
  handle, which the watcher clears before React applies the verdict.

* fix(oauth): keep the chat connect return leg in its opener's browsing context

/oauth/chat-complete runs as a popup but fell into the strict COOP rule, so
same-origin moved it into its own browsing-context group the moment it loaded
— disowning it from the tab that opened it. That is the documented cause of a
popup that is not reliably script-closable and whose opener sees window.closed
report true for a live window.

Matches it to its opener's same-origin-allow-popups instead, which is the
directive the platform provides for exactly this case.

* fix(oauth): keep every page an OAuth popup lands on observable to its opener

The popup watcher settles on a same-origin terminal page, but both entries in
OAUTH_POPUP_TERMINAL_PATHS were served strict same-origin COOP, which moves the
popup into its own browsing-context group. The opener could then neither read
its location nor trust window.closed, so the terminal-page branch could never
fire in production and a flow exiting through one of those pages left the row
waiting until the user happened to refocus the tab.

Serves /oauth-error and the /workspace root the same same-origin-allow-popups
their opener uses. The workspace root previously fell under the strict rule
while every /workspace/... route already got the permissive one.

* test(mship): cover the announcement surviving an early popup release

The success toast is gated on the launched-attempt ref rather than the window
handle; nothing pinned that. Adds the regression test, and trims the comment
duplication the fix left behind.

* fix(mship): bound the wait on a popup whose outcome became unobservable

A closed handle and a COOP-disowned one are indistinguishable, so the watcher
published no verdict for either and relied on the focus verification to settle
it. That recovers the normal case — closing a popup hands focus back — but not
one where the opener was never blurred, leaving the row waiting indefinitely.

Arms the same safety timeout the MCP OAuth popup uses for the same reason: past
it, the row decides from the credential list rather than waiting on a verdict
that is never going to arrive. Cleared as soon as a real verdict lands.

* fix(mship): survive a remount while an attempt is still pending

The unobservable deadline lived in the watcher effect's closure, so it was
armed only by the mount that launched the popup. The transcript virtualizes:
a row scrolled away mid-connect came back with no window handle and no blur
behind it, and nothing re-armed the bound.

Derives the deadline from the attempt's own requestedAt and arms it for any
pending attempt, so a remount inherits the time remaining rather than
restarting the clock or losing it. A demonstrably live popup still owns the
flow and is left to the watcher.

* fix(mship): bind a settle to its own attempt and keep the deadline armed

Two races the previous rounds left behind.

A settle read the attempt only after its refetch, so a retry landing during
that window was resolved by a run it never triggered — failing a replacement
whose popup was still going. The attempt id is now captured before the await
and the verdict only lands if it still matches; the status is still re-read
after, so a verdict published mid-refetch is not overwritten.

The safety deadline was one-shot. A consent screen that outlived it consumed
the timeout while still live, leaving nothing to catch the popup dying
unobservably afterwards. It now re-checks at the poll interval instead of
expiring against a live window.

* chore(mship): tighten the comments on the OAuth popup flow

Trims the COOP rationale in next.config.ts to the point, and condenses the
longest blocks in the connect hook without dropping the reasoning a reader
needs to keep the invariants.

---------

Co-authored-by: Waleed Latif <walif6@gmail.com>

Author: j15z

apps/sim/app/oauth/chat-complete/chat-complete-handoff.test.tsx

@@ -0,0 +1,135 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createOAuthChatAttempt,
+  type OAuthChatAttempt,
+  readOAuthChatAttempt,
+} from '@/lib/credentials/oauth-chat-attempt'
+import { ChatCompleteHandoff } from '@/app/oauth/chat-complete/chat-complete-handoff'
+
+function renderAt(search: string): { root: Root } {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  window.history.replaceState({}, '', `/oauth/chat-complete${search}`)
+  const root: Root = createRoot(document.createElement('div'))
+  act(() => root.render(<ChatCompleteHandoff />))
+  return { root }
+}
+
+describe('ChatCompleteHandoff', () => {
+  let attempt: OAuthChatAttempt
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    window.localStorage.clear()
+    vi.spyOn(window, 'close').mockImplementation(() => {})
+    attempt = createOAuthChatAttempt({
+      workspaceId: 'workspace-1',
+      providerId: 'google-email',
+      baseProviderId: 'google',
+      displayName: 'Gmail',
+      controlId: 'message-1:0:0',
+      baselineCredentialIds: ['existing-gmail'],
+    })
+  })
+
+  it('publishes success on arrival, without requiring a new credential to appear', () => {
+    // Re-authorizing an already-linked account updates the account row rather
+    // than creating one, so no new credential lands — reaching this page is
+    // still the server telling us the flow succeeded.
+    const { root } = renderAt(`?oauthAttempt=${attempt.id}`)
+
+    expect(readOAuthChatAttempt(attempt.id)?.status).toBe('connected')
+    expect(window.close).toHaveBeenCalledOnce()
+    act(() => root.unmount())
+  })
+
+  it('publishes failure when the provider returned an error', () => {
+    const { root } = renderAt(`?oauthAttempt=${attempt.id}&error=access_denied`)
+
+    expect(readOAuthChatAttempt(attempt.id)?.status).toBe('failed')
+    act(() => root.unmount())
+  })
+
+  it('leaves an unrelated attempt untouched when no attempt is named', () => {
+    const { root } = renderAt('')
+
+    expect(readOAuthChatAttempt(attempt.id)?.status).toBe('pending')
+    expect(window.close).toHaveBeenCalledOnce()
+    act(() => root.unmount())
+  })
+
+  it('still publishes the verdict when the attempt store rejects the write', () => {
+    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new DOMException('quota', 'QuotaExceededError')
+    })
+
+    // The verdict is lost, but the window must still be released — an
+    // unguarded throw would strand the popup open on this page.
+    expect(() => renderAt(`?oauthAttempt=${attempt.id}`)).not.toThrow()
+    expect(window.close).toHaveBeenCalledOnce()
+    setItem.mockRestore()
+  })
+
+  describe('close-refused fallback', () => {
+    const realLocation = window.location
+
+    afterEach(() => {
+      vi.useRealTimers()
+      Object.defineProperty(window, 'location', { configurable: true, value: realLocation })
+    })
+
+    /**
+     * jsdom performs no navigation and forbids redefining `location.replace`,
+     * so the whole location is swapped for a stub carrying only what the
+     * handoff reads: the current href, the origin, and the redirect sink.
+     */
+    function renderWithStubbedLocation(search: string): { calls: string[]; root: Root } {
+      const calls: string[] = []
+      Object.defineProperty(window, 'location', {
+        configurable: true,
+        value: {
+          href: `https://sim.test/oauth/chat-complete${search}`,
+          origin: 'https://sim.test',
+          replace: (url: string) => calls.push(url),
+        },
+      })
+      ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+      const root: Root = createRoot(document.createElement('div'))
+      act(() => root.render(<ChatCompleteHandoff />))
+      return { calls, root }
+    }
+
+    it('redirects to a same-origin returnTo once the close is refused', () => {
+      vi.useFakeTimers()
+      const returnTo = 'https://sim.test/workspace/workspace-1/chat/chat-1'
+
+      const { calls, root } = renderWithStubbedLocation(
+        `?oauthAttempt=${attempt.id}&returnTo=${encodeURIComponent(returnTo)}`
+      )
+      act(() => {
+        vi.advanceTimersByTime(400)
+      })
+
+      expect(calls).toEqual([returnTo])
+      act(() => root.unmount())
+    })
+
+    it('refuses a cross-origin returnTo and falls back to the workspace', () => {
+      vi.useFakeTimers()
+
+      const { calls, root } = renderWithStubbedLocation(
+        `?oauthAttempt=${attempt.id}&returnTo=${encodeURIComponent('https://evil.example/steal')}`
+      )
+      act(() => {
+        vi.advanceTimersByTime(400)
+      })
+
+      expect(calls).toEqual(['/workspace'])
+      act(() => root.unmount())
+    })
+  })
+})

apps/sim/app/oauth/chat-complete/chat-complete-handoff.tsx

@@ -0,0 +1,66 @@
+'use client'
+
+import { useEffect, useRef } from 'react'
+import {
+  OAUTH_CHAT_ATTEMPT_PARAM,
+  OAUTH_CHAT_RETURN_TO_PARAM,
+  setOAuthChatAttemptStatus,
+} from '@/lib/credentials/oauth-chat-attempt'
+
+const CLOSE_FALLBACK_DELAY_MS = 400
+
+/**
+ * The fallback redirect must never leave this origin — the target rides in a
+ * query param the user could have tampered with.
+ */
+function sanitizeReturnTo(raw: string | null): string | null {
+  if (!raw) return null
+  try {
+    const url = new URL(raw, window.location.origin)
+    return url.origin === window.location.origin ? url.toString() : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Behavior half of the chat OAuth return leg: publishes the verdict to the
+ * attempt record — which the chat tab's chip picks up over its storage
+ * listener — then closes the window. Renders nothing, so the page's frame
+ * paints as server markup before this hydrates.
+ *
+ * Reaching this page IS the verdict: Better Auth routes a flow here only as its
+ * success `callbackURL`, sending failures to `/oauth-error` or back here with
+ * an `error` code. That beats diffing the credential list, which calls a
+ * re-authorized account a failure — that path updates the existing account row
+ * and creates nothing for a diff to find.
+ *
+ * A window the browser refuses to close redirects to the chat instead (the
+ * popup-blocked path opens this leg in a tab, which no script may close). That
+ * URL carries no attempt id on purpose: the verdict is already published, and
+ * the destination would otherwise re-decide it by the very diff above.
+ */
+export function ChatCompleteHandoff() {
+  const ranRef = useRef(false)
+
+  useEffect(() => {
+    if (ranRef.current) return
+    ranRef.current = true
+
+    const params = new URL(window.location.href).searchParams
+    const attemptId = params.get(OAUTH_CHAT_ATTEMPT_PARAM)
+    const returnTo = sanitizeReturnTo(params.get(OAUTH_CHAT_RETURN_TO_PARAM))
+
+    if (attemptId) {
+      setOAuthChatAttemptStatus(attemptId, params.has('error') ? 'failed' : 'connected')
+    }
+
+    window.close()
+    const timer = window.setTimeout(() => {
+      window.location.replace(returnTo ?? '/workspace')
+    }, CLOSE_FALLBACK_DELAY_MS)
+    return () => window.clearTimeout(timer)
+  }, [])
+
+  return null
+}

apps/sim/app/oauth/chat-complete/page.tsx

@@ -0,0 +1,28 @@
+import type { Metadata } from 'next'
+import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-shell'
+import { ChatCompleteHandoff } from '@/app/oauth/chat-complete/chat-complete-handoff'
+
+export const metadata: Metadata = {
+  title: 'Returning to Sim',
+  robots: { index: false },
+}
+
+/**
+ * Post-OAuth return leg for the chat credential chips. The chip rewrites the
+ * authorize URL's return param to land here, so the OAuth window finishes on
+ * this page — which signals the chat tab and closes — instead of loading a
+ * second copy of the app.
+ *
+ * Shown for a few hundred milliseconds in a popup, or briefly in the original
+ * tab when the popup was blocked, so it wears the same handoff frame as the
+ * other minimal-chrome gates (the 404, the desktop connect screens) rather
+ * than styling of its own.
+ */
+export default function ChatCompletePage() {
+  return (
+    <>
+      <ChatCompleteHandoff />
+      <DesktopHandoffShell title='Finishing the connection' description='Returning you to Sim.' />
+    </>
+  )
+}