Fix auth wait guidance and live-view session validation

Author: cursoragent

src/lib/mcp/tools/auth-connections.ts

@@ -4,6 +4,7 @@ import { createKernelClient } from "@/lib/mcp/kernel-client";
 import {
   AuthLoginStartError,
   deriveAuthNextAction,
+  hasLiveAuthFlow,
   toSafeAuthConnection,
   waitForAuthConnection,
 } from "@/lib/mcp/tools/managed-auth-state";
@@ -108,12 +109,16 @@ export function registerAuthConnectionTools(server: McpServer) {
             const connection = await client.auth.connections.retrieve(
               params.id,
             );
+            const safeConnection = toSafeAuthConnection(connection);
+            const authFlowInProgress = hasLiveAuthFlow(safeConnection);
             return safeJsonResponse({
-              connection: toSafeAuthConnection(connection),
+              connection: safeConnection,
               instruction:
-                connection.status === "AUTHENTICATED"
+                safeConnection.status === "AUTHENTICATED" && !authFlowInProgress
                   ? "Authentication is verified. Use this profile_name when creating the browser."
-                  : "Do not continue the protected action. Ask for consent, then use open_auth_login to authenticate securely.",
+                  : authFlowInProgress
+                    ? "Authentication is still pending. Immediately call manage_auth_connections with action=wait and this id again. Do not continue the protected action yet."
+                    : "Do not continue the protected action. Ask for consent, then use open_auth_login to authenticate securely.",
             });
           }
           case "wait": {

src/lib/mcp/tools/auth-login-app.test.ts

@@ -180,6 +180,7 @@ describe("managed-auth MCP App registration", () => {
           domain_filter: "example.com",
           profile_name: "work",
           wait_seconds: 25,
+          previous_flow_expires_at: null,
         },
       },
     });
@@ -210,6 +211,50 @@ describe("managed-auth MCP App registration", () => {
     expect(JSON.stringify(result)).not.toContain("app_capability");
   });
 
+  test("new_login launcher guards wait with any matching pre-flow baseline", async () => {
+    kernelClientFactory = () => ({
+      auth: {
+        connections: {
+          list: async () => ({
+            getPaginatedItems: () => [
+              {
+                id: "conn_1",
+                domain: "example.com",
+                profile_name: "work",
+                status: "AUTHENTICATED",
+                flow_status: "SUCCESS",
+                flow_type: "LOGIN",
+                flow_expires_at: "2026-01-01T00:00:00Z",
+              },
+            ],
+            hasNextPage: () => false,
+          }),
+        },
+      },
+    });
+    try {
+      const { tools } = captureRegistration();
+      const result = await tools.get("open_auth_login")!.handler(
+        {
+          mode: "new_login",
+          domain: "example.com",
+          profile_name: "work",
+          text_only: false,
+        },
+        { authInfo: { token: "unused-api-key" } },
+      );
+      expect(result.structuredContent.next_action.arguments).toEqual({
+        action: "wait",
+        domain_filter: "example.com",
+        profile_name: "work",
+        wait_seconds: 25,
+        previous_flow_expires_at: "2026-01-01T00:00:00Z",
+      });
+    } finally {
+      resetKernelClientFactory();
+    }
+  });
+
   test("app-only tools fail closed on hosts without MCP Apps support", async () => {
     const { tools } = captureRegistration({ appsSupport: false });
     const calls: Array<[string, any]> = [

src/lib/mcp/tools/auth-login-app.ts

@@ -231,6 +231,32 @@ export function registerAuthLoginApp(server: McpServer) {
                 await client.auth.connections.retrieve(input.connection_id!),
               )
             : null;
+        const previousFlowExpiresAtForNewLogin =
+          !reauthConnection && input.mode === "new_login"
+            ? await (async () => {
+                try {
+                  const page = await client.auth.connections.list({
+                    domain: input.domain!,
+                    profile_name: input.profile_name!,
+                    limit: 100,
+                  });
+                  const matches = page
+                    .getPaginatedItems()
+                    .filter(
+                      (item) =>
+                        item.domain === input.domain &&
+                        item.profile_name === input.profile_name,
+                    );
+                  if (matches.length === 1 && !page.hasNextPage()) {
+                    return matches[0].flow_expires_at ?? null;
+                  }
+                } catch {
+                  // Keep launcher behavior available even if discovery fails;
+                  // a null baseline still guards against unflowed stale auth.
+                }
+                return null;
+              })()
+            : undefined;
         const connection = reauthConnection ?? {
           domain: input.domain!,
           profile_name: input.profile_name!,
@@ -253,6 +279,7 @@ export function registerAuthLoginApp(server: McpServer) {
               domain_filter: input.domain!,
               profile_name: input.profile_name!,
               wait_seconds: 25,
+              previous_flow_expires_at: previousFlowExpiresAtForNewLogin,
             };
         // The delete authorization capability is App-only: issue it solely to
         // hosts that declared MCP Apps support, and keep it in _meta (which

src/lib/mcp/tools/live-view-app.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, mock, test } from "bun:test";
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
 import { registerLiveViewApp } from "@/lib/mcp/tools/live-view-app";
 
 // Tests that exercise API-backed handlers substitute a fake Kernel client.
@@ -78,6 +79,18 @@ function fakeScreenshotClient() {
 }
 
 describe("live view MCP App", () => {
+  test("live view tool schemas reject empty session identifiers", () => {
+    const { tools } = captureRegistration();
+    const showSchema = z.object(
+      tools.get("show_browser_live_view")!.config.inputSchema,
+    );
+    expect(showSchema.safeParse({ session_id: "" }).success).toBe(false);
+    const captureSchema = z.object(
+      tools.get("capture_live_view_frame")!.config.inputSchema,
+    );
+    expect(captureSchema.safeParse({ session_id: "" }).success).toBe(false);
+  });
+
   test("capture_live_view_frame fails closed on hosts without MCP Apps support", async () => {
     redisMarkerPresent = false;
     const { tools } = captureRegistration({ appsSupport: false });

src/lib/mcp/tools/live-view-app.ts

@@ -460,6 +460,7 @@ export function registerLiveViewApp(server: McpServer) {
       inputSchema: {
         session_id: z
           .string()
+          .min(1)
           .describe("Browser session ID to display (from manage_browsers)."),
       },
       annotations: {
@@ -531,6 +532,7 @@ export function registerLiveViewApp(server: McpServer) {
       inputSchema: {
         session_id: z
           .string()
+          .min(1)
           .describe("Browser session ID to capture a frame from."),
       },
       annotations: {