fix(mship): bind a settle to its own attempt and keep the deadline armed

Two races the previous rounds left behind.

A settle read the attempt only after its refetch, so a retry landing during
that window was resolved by a run it never triggered — failing a replacement
whose popup was still going. The attempt id is now captured before the await
and the verdict only lands if it still matches; the status is still re-read
after, so a verdict published mid-refetch is not overwritten.

The safety deadline was one-shot. A consent screen that outlived it consumed
the timeout while still live, leaving nothing to catch the popup dying
unobservably afterwards. It now re-checks at the poll interval instead of
expiring against a live window.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.test.tsx

@@ -591,6 +591,53 @@ describe('CredentialDisplay link tag', () => {
     act(() => root.unmount())
   })
 
+  it('holds the deadline open while the popup is live, then settles once it is not', async () => {
+    // A consent screen can outlive the safety timeout. Expiring against a live
+    // window would spend the bound early and leave nothing to catch the popup
+    // dying unobservably later, so the deadline waits instead of firing.
+    vi.useFakeTimers()
+    const popup = {
+      focus: vi.fn(),
+      closed: false,
+      // Still on the provider's pages: reading location across origins throws.
+      get location(): Location {
+        throw new DOMException('cross-origin', 'SecurityError')
+      },
+    }
+    const openSpy = vi
+      .spyOn(window, 'open')
+      .mockReturnValue(popup as unknown as ReturnType<typeof window.open>)
+    const { container, root } = renderCredentialLink({
+      type: 'link',
+      provider: 'google-email',
+      value:
+        'https://sim.test/api/auth/oauth2/authorize?providerId=google-email&callbackURL=https%3A%2F%2Fsim.test%2Fworkspace%2Fworkspace-1%2Fchat%2Fchat-1',
+    })
+
+    await act(async () => {
+      container
+        .querySelector('a')
+        ?.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true }))
+    })
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(11 * 60 * 1000)
+    })
+
+    expect(container.textContent).toContain('Waiting for Gmail connection')
+
+    // Dies unobservably well after the original deadline — the watcher releases
+    // the handle without a verdict, so only a still-armed deadline can settle.
+    popup.closed = true
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(2000)
+    })
+
+    expect(container.textContent).toContain('Not connected — connect Gmail')
+    vi.useRealTimers()
+    openSpy.mockRestore()
+    act(() => root.unmount())
+  })
+
   it('keeps the unobservable deadline across a remount', async () => {
     // The transcript virtualizes, so a row can scroll away mid-connect and come
     // back with no window handle and no blur behind it. The deadline is derived

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/use-oauth-chip-connection.ts

@@ -301,6 +301,11 @@ export function useOAuthChipConnection({
    * Idempotent — an attempt is only rewritten while still `pending`.
    */
   const settleFromCredentials = useCallback(async () => {
+    // Identity is captured up front so the verdict below can only land on the
+    // attempt this settle was started for. A retry during the refetch installs
+    // a replacement, and resolving that one from a run it never triggered would
+    // fail a connect whose popup is still going.
+    const targetAttemptId = readRowAttempt()?.id
     const result = await refetchWorkspaceOAuthCredentials()
     const credentials = result.data ?? []
 
@@ -313,11 +318,11 @@ export function useOAuthChipConnection({
       )
     }
 
-    // Read after the await: a snapshot taken before it goes stale the moment the
-    // popup publishes its verdict mid-refetch, and that stale 'pending' would
-    // license the very overwrite the guard below exists to prevent.
+    // Status is re-read after the await: the snapshot above goes stale the
+    // moment the popup publishes its verdict mid-refetch, and that stale
+    // 'pending' would license the very overwrite this guard exists to prevent.
     const attempt = readRowAttempt()
-    if (!attempt || attempt.status !== 'pending') return
+    if (!attempt || attempt.id !== targetAttemptId || attempt.status !== 'pending') return
     // Only the callback path can prove a reconnect returned — an unrelated edit
     // to the credential is indistinguishable from one here.
     const attemptConnected = reconnectCredentialId
@@ -415,12 +420,18 @@ export function useOAuthChipConnection({
       0,
       OAUTH_POPUP_UNOBSERVABLE_TIMEOUT_MS - (Date.now() - attempt.requestedAt)
     )
-    const deadline = window.setTimeout(() => {
-      // A popup still demonstrably running owns the flow; the watcher settles
-      // it the moment it ends, so there is nothing to bound here.
-      if (isPopupStillOpen(popupRef.current)) return
+    let deadline: number
+    const settleUnlessPopupOwnsIt = () => {
+      // A popup still demonstrably running owns the flow, so the deadline waits
+      // rather than expiring: giving up here would spend the bound on a live
+      // window that can still die unobservably long afterwards.
+      if (isPopupStillOpen(popupRef.current)) {
+        deadline = window.setTimeout(settleUnlessPopupOwnsIt, OAUTH_POPUP_POLL_INTERVAL_MS)
+        return
+      }
       void settleFromCredentials()
-    }, remaining)
+    }
+    deadline = window.setTimeout(settleUnlessPopupOwnsIt, remaining)
     return () => window.clearTimeout(deadline)
   }, [connectionStatus, readRowAttempt, settleFromCredentials])