feat(oauth): give the browser redirect a real landing page - #3435
Open
taciturnaxolotl wants to merge 2 commits into
Open
feat(oauth): give the browser redirect a real landing page#3435taciturnaxolotl wants to merge 2 commits into
taciturnaxolotl wants to merge 2 commits into
Conversation
taciturnaxolotl
force-pushed
the
oauth-callback-page
branch
5 times, most recently
from
July 27, 2026 15:36
1171963 to
60dbe01
Compare
Finishing an OAuth authorization dropped the user on a bare line of text in an otherwise empty tab, with no indication of what had been authorized and nothing to do but close the tab by hand. The redirect now lands on a proper page: it names what was connected, matches the look of the generated usage report, and on success counts itself down and closes. A failure keeps the tab open and shows the provider's own error code and explanation instead of taking the reason away from whoever needs to read it. Rendering lives on its own so any future browser-based login can reuse it, and everything it needs is embedded in the binary. Also fixes two ways the flow could go wrong. Connecting to a server can put several requests in flight at once, and each one that was refused asked to log in, so a single login could open two browser tabs and then leave one of those requests waiting on a redirect the other had already taken. Requests now share one login attempt. Separately, the listener answered every path and treated anything it received as the redirect, so an incidental browser request such as a favicon lookup could be mistaken for the callback and abandon the login with an empty code.
taciturnaxolotl
force-pushed
the
oauth-callback-page
branch
from
July 27, 2026 15:37
60dbe01 to
d80fc22
Compare
The app event fan-in used lossy Publish for permission and question events, so a saturated subscriber buffer could silently drop a PermissionRequest and hang the tool call waiting on it. Fan them in with must-deliver semantics, matching run-completions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishing an OAuth authorization dropped the user on a bare line of text in an otherwise empty tab, with no indication of what had been authorized and nothing to do but close the tab by hand.