feat(web): confirm Slack workspace reassignment

[MaheshtheDev]

Adds an authenticated consent screen for Slack workspaces that are already connected to another Company Brain, so reassignment requires an explicit typed confirmation instead of happening silently.

Changes

• Add pending, armed, submitting, recovery, expired, cancelled, and conflict states matching the Company Brain OAuth design.
• Require the Slack workspace name or exact OVERRIDE confirmation before the destructive action is enabled.
• Handle ambiguous network outcomes with a safe inspection request rather than automatically repeating a mutation.
• Preserve safe same-origin destinations and the absolute override URL through sign-in, including the opaque request identifier.
• Support keyboard/screen-reader behavior and reachable controls on short, mobile, and zoomed viewports.
• Document the reassignment warning for Company Brain administrators.

Testing

• Focused Biome checks — passed.
• Changed-file TypeScript checks — passed.
• Contract/helper matrix — 12/12 passed.
• Production web build — passed for the final changed route.
• Browser matrix covering pending, armed, applying, error, expired, cancellation, connected handoff, and ambiguous network recovery — passed.
• Login-resume test with an opaque request containing reserved characters and Unicode — passed; the decoded login redirect exactly matched the absolute current override URL.
• Mobile 390px, short 900×500 viewport, and 200%-equivalent reflow — passed with no horizontal overflow and reachable controls.
• Keyboard operation, terminal focus, and live announcements — passed.
• Root frontend typecheck remains blocked by unrelated existing @supermemory/tools errors; an earlier full build attempt also encountered the unrelated existing /auth/agent-connect prerender failure.

Rollout

Requires the companion supermemoryai/mono backend guard and API routes. The backend feature flag remains off until both changes are deployed.

---

Attached Images and Videos

🎥 View recording: slack-override-desktop-flow.webm

🎥 View recording: slack-override-mobile-flow.webm

---

Session Details

• Session: View Session
• Requested by: Mahesh Sanikommu (mahesh@supermemory.com)
• Address comments on this PR. Add (aside) to your comment to have me ignore it.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	6f2ee73	Jul 24 2026, 07:37 PM

[claude]

Claude finished @MaheshtheDev's task in 1m 46s —— View job

---

Review Complete

• Gather full diff and existing review comments
• Analyze changed files for bugs, security issues, and logic errors
• Check surrounding code context for boundary issues
• Submit review findings

Result: No issues found — this PR is ready to ship.

The code implements a secure consent screen for Slack workspace reassignment with proper open redirect protection, XSS prevention, race condition handling, and comprehensive error recovery. The Codex-reported login redirect issue was already addressed in commit cf13314.

Score: 10/10

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
supermemory	🟢 Ready	View Preview	Jul 24, 2026, 6:55 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	6f2ee73	Commit Preview URL Branch Preview URL	Jul 24 2026, 07:38 PM

[claude]

Overview: Adds an authenticated consent screen requiring explicit typed confirmation before reassigning a Slack workspace from one Company Brain to another.

Issues found: None — this looks good to ship.

Security Analysis:

• ✅ Open redirect protection via getSafeAppDestination() correctly validates origin, rejects javascript:/data: URLs, and strips credentials from URLs
• ✅ XSS prevention — React auto-escapes all rendered user data (teamName, targetOrgName)
• ✅ URL encoding for requestId uses encodeURIComponent() properly
• ✅ Race condition handling with active flag in useEffect cleanup and submitting state guard
• ✅ Expiration timer handles edge cases (non-finite values, negative remaining time)
• ✅ Network error recovery triggers safe status inspection rather than auto-retrying mutations

Code Quality:

• State machine is well-designed with clear transitions between loading/checking/pending/terminal states
• Error handling is comprehensive with graceful degradation for malformed dates
• Accessibility is solid with proper ARIA attributes, focus management, and screen reader support

Score: 10/10

Clean, defensive code with thorough security considerations. The confirmation pattern (typed workspace name or OVERRIDE) is a solid safeguard against accidental destructive actions.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74dc227f30

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
supermemory	🟡 Building	–	Jul 24, 2026, 6:54 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[claude]

Overview: Adds an authenticated consent screen requiring explicit typed confirmation before reassigning a Slack workspace from one Company Brain to another.

Issues found: None — this looks good to ship.

Security Analysis:

• ✅ Open redirect protection via getSafeAppDestination() correctly validates origin, rejects javascript:/data: URLs (they fail the origin check), and strips credentials
• ✅ XSS prevention — React auto-escapes all rendered user data (teamName, targetOrgName)
• ✅ URL encoding for requestId uses encodeURIComponent() properly
• ✅ Login redirect now uses window.location.href (absolute URL) — the Codex-reported issue was addressed in cf13314
• ✅ Race condition handling with active flag in useEffect cleanup and submitting state guard
• ✅ Expiration timer handles edge cases (non-finite values, negative remaining time)
• ✅ Network error recovery triggers safe status inspection rather than auto-retrying mutations

Code Quality:

• State machine is well-designed with clear transitions between loading/checking/pending/terminal states
• Error handling is comprehensive with graceful degradation for malformed dates
• Accessibility is solid with proper ARIA attributes, focus management, and screen reader support

Score: 10/10

Clean, defensive code with thorough security considerations. The confirmation pattern (typed workspace name or exact OVERRIDE) is a solid safeguard against accidental destructive actions.