fix(mship): return the chat connect flow to the tab that started it

Connecting an integration from a chat credential chip opened OAuth in a
new tab and returned there, so the user landed on a second copy of the
app while the conversation they started from sat stale behind it.

The flow now runs in a popup and returns through a new self-closing page
at /oauth/chat-complete, which publishes its verdict to the shared
attempt record and closes. The chat tab picks that up over its storage
listener and updates in place, so it never navigates. A blocked popup
takes the same route in a new tab and still lands on the completion
page, so both paths share one verdict source.

That verdict is now the server's: reaching the completion page means
Better Auth routed the flow to its success callback. The previous check
diffed the workspace credential list, which reported failure whenever a
user re-authorized an account they had already linked -- that path
updates the account row and creates no new credential.

The lock is stricter than the label. A failure to create the credential
from its draft is swallowed server-side, so a flow can report success
with nothing in the workspace; the row stays retryable unless the
credential actually appears.

Also: the popup is named per attempt so sibling rows cannot renavigate
each other's window; a cross-origin connect URL keeps the anchor's
noopener instead of taking the popup path; the focus verifier reads the
attempt after its refetch so a verdict published mid-flight is not
overwritten; and the verifier treats a popup parked on a terminal page
(/oauth-error, the workspace error exit) as finished rather than
waiting on it forever.

Author: j15z

apps/sim/app/oauth/chat-complete/chat-complete-handoff.test.tsx

@@ -0,0 +1,135 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createOAuthChatAttempt,
+  type OAuthChatAttempt,
+  readOAuthChatAttempt,
+} from '@/lib/credentials/oauth-chat-attempt'
+import { ChatCompleteHandoff } from '@/app/oauth/chat-complete/chat-complete-handoff'
+
+function renderAt(search: string): { root: Root } {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  window.history.replaceState({}, '', `/oauth/chat-complete${search}`)
+  const root: Root = createRoot(document.createElement('div'))
+  act(() => root.render(<ChatCompleteHandoff />))
+  return { root }
+}
+
+describe('ChatCompleteHandoff', () => {
+  let attempt: OAuthChatAttempt
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    window.localStorage.clear()
+    vi.spyOn(window, 'close').mockImplementation(() => {})
+    attempt = createOAuthChatAttempt({
+      workspaceId: 'workspace-1',
+      providerId: 'google-email',
+      baseProviderId: 'google',
+      displayName: 'Gmail',
+      controlId: 'message-1:0:0',
+      baselineCredentialIds: ['existing-gmail'],
+    })
+  })
+
+  it('publishes success on arrival, without requiring a new credential to appear', () => {
+    // Re-authorizing an already-linked account updates the account row rather
+    // than creating one, so no new credential lands — reaching this page is
+    // still the server telling us the flow succeeded.
+    const { root } = renderAt(`?oauthAttempt=${attempt.id}`)
+
+    expect(readOAuthChatAttempt(attempt.id)?.status).toBe('connected')
+    expect(window.close).toHaveBeenCalledOnce()
+    act(() => root.unmount())
+  })
+
+  it('publishes failure when the provider returned an error', () => {
+    const { root } = renderAt(`?oauthAttempt=${attempt.id}&error=access_denied`)
+
+    expect(readOAuthChatAttempt(attempt.id)?.status).toBe('failed')
+    act(() => root.unmount())
+  })
+
+  it('leaves an unrelated attempt untouched when no attempt is named', () => {
+    const { root } = renderAt('')
+
+    expect(readOAuthChatAttempt(attempt.id)?.status).toBe('pending')
+    expect(window.close).toHaveBeenCalledOnce()
+    act(() => root.unmount())
+  })
+
+  it('still publishes the verdict when the attempt store rejects the write', () => {
+    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new DOMException('quota', 'QuotaExceededError')
+    })
+
+    // The verdict is lost, but the window must still be released — an
+    // unguarded throw would strand the popup open on this page.
+    expect(() => renderAt(`?oauthAttempt=${attempt.id}`)).not.toThrow()
+    expect(window.close).toHaveBeenCalledOnce()
+    setItem.mockRestore()
+  })
+
+  describe('close-refused fallback', () => {
+    const realLocation = window.location
+
+    afterEach(() => {
+      vi.useRealTimers()
+      Object.defineProperty(window, 'location', { configurable: true, value: realLocation })
+    })
+
+    /**
+     * jsdom performs no navigation and forbids redefining `location.replace`,
+     * so the whole location is swapped for a stub carrying only what the
+     * handoff reads: the current href, the origin, and the redirect sink.
+     */
+    function renderWithStubbedLocation(search: string): { calls: string[]; root: Root } {
+      const calls: string[] = []
+      Object.defineProperty(window, 'location', {
+        configurable: true,
+        value: {
+          href: `https://sim.test/oauth/chat-complete${search}`,
+          origin: 'https://sim.test',
+          replace: (url: string) => calls.push(url),
+        },
+      })
+      ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+      const root: Root = createRoot(document.createElement('div'))
+      act(() => root.render(<ChatCompleteHandoff />))
+      return { calls, root }
+    }
+
+    it('redirects to a same-origin returnTo once the close is refused', () => {
+      vi.useFakeTimers()
+      const returnTo = 'https://sim.test/workspace/workspace-1/chat/chat-1'
+
+      const { calls, root } = renderWithStubbedLocation(
+        `?oauthAttempt=${attempt.id}&returnTo=${encodeURIComponent(returnTo)}`
+      )
+      act(() => {
+        vi.advanceTimersByTime(400)
+      })
+
+      expect(calls).toEqual([returnTo])
+      act(() => root.unmount())
+    })
+
+    it('refuses a cross-origin returnTo and falls back to the workspace', () => {
+      vi.useFakeTimers()
+
+      const { calls, root } = renderWithStubbedLocation(
+        `?oauthAttempt=${attempt.id}&returnTo=${encodeURIComponent('https://evil.example/steal')}`
+      )
+      act(() => {
+        vi.advanceTimersByTime(400)
+      })
+
+      expect(calls).toEqual(['/workspace'])
+      act(() => root.unmount())
+    })
+  })
+})

apps/sim/app/oauth/chat-complete/chat-complete-handoff.tsx

@@ -0,0 +1,71 @@
+'use client'
+
+import { useEffect, useRef } from 'react'
+import {
+  OAUTH_CHAT_ATTEMPT_PARAM,
+  OAUTH_CHAT_RETURN_TO_PARAM,
+  setOAuthChatAttemptStatus,
+} from '@/lib/credentials/oauth-chat-attempt'
+
+const CLOSE_FALLBACK_DELAY_MS = 400
+
+/**
+ * The fallback redirect must never leave this origin — the target rides in a
+ * query param the user could have tampered with.
+ */
+function sanitizeReturnTo(raw: string | null): string | null {
+  if (!raw) return null
+  try {
+    const url = new URL(raw, window.location.origin)
+    return url.origin === window.location.origin ? url.toString() : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Behavior half of the chat OAuth return leg: publishes the verdict to the
+ * attempt record — which the chat tab's chip picks up over its storage
+ * listener — then closes the window. Renders nothing, so the page's frame is
+ * plain server-rendered markup that paints before this hydrates.
+ *
+ * Reaching this page IS the verdict. Better Auth routes a flow here only as
+ * its success `callbackURL`, sending failures to `onAPIError.errorURL`
+ * (`/oauth-error`) or back here with an `error` code, so the server has
+ * already decided by the time this runs. That is a strictly better signal than
+ * the credential diffing the generic-page return does: re-authorizing an
+ * already-linked account updates the account row instead of creating one, so
+ * no new credential appears and a diff would call a perfectly good connect a
+ * failure.
+ *
+ * A window the browser refuses to close redirects on to the chat surface
+ * instead. That is the popup-blocked path: the anchor's `target='_blank'`
+ * opens this leg in a new tab, which no script may close. That URL
+ * deliberately carries no attempt id — the verdict is already published, and
+ * the destination's return router would otherwise re-decide it by the very
+ * diff this page exists to avoid.
+ */
+export function ChatCompleteHandoff() {
+  const ranRef = useRef(false)
+
+  useEffect(() => {
+    if (ranRef.current) return
+    ranRef.current = true
+
+    const params = new URL(window.location.href).searchParams
+    const attemptId = params.get(OAUTH_CHAT_ATTEMPT_PARAM)
+    const returnTo = sanitizeReturnTo(params.get(OAUTH_CHAT_RETURN_TO_PARAM))
+
+    if (attemptId) {
+      setOAuthChatAttemptStatus(attemptId, params.has('error') ? 'failed' : 'connected')
+    }
+
+    window.close()
+    const timer = window.setTimeout(() => {
+      window.location.replace(returnTo ?? '/workspace')
+    }, CLOSE_FALLBACK_DELAY_MS)
+    return () => window.clearTimeout(timer)
+  }, [])
+
+  return null
+}

apps/sim/app/oauth/chat-complete/page.tsx

@@ -0,0 +1,28 @@
+import type { Metadata } from 'next'
+import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-shell'
+import { ChatCompleteHandoff } from '@/app/oauth/chat-complete/chat-complete-handoff'
+
+export const metadata: Metadata = {
+  title: 'Returning to Sim',
+  robots: { index: false },
+}
+
+/**
+ * Post-OAuth return leg for the chat credential chips. The chip rewrites the
+ * authorize URL's return param to land here, so the OAuth window finishes on
+ * this page — which signals the chat tab and closes — instead of loading a
+ * second copy of the app.
+ *
+ * Shown for a few hundred milliseconds in a popup, or briefly in the original
+ * tab when the popup was blocked, so it wears the same handoff frame as the
+ * other minimal-chrome gates (the 404, the desktop connect screens) rather
+ * than styling of its own.
+ */
+export default function ChatCompletePage() {
+  return (
+    <>
+      <ChatCompleteHandoff />
+      <DesktopHandoffShell title='Finishing the connection' description='Returning you to Sim.' />
+    </>
+  )
+}