@iblai/web-containers 1.57.0 → 1.58.1

package/dist/esm/components/modals/edit-mentor-modal/tabs/mcp-tab/connector-dialogs.js

@@ -3,25 +3,79 @@ import { useState, useRef, useEffect, useCallback } from 'react';
 import { useT } from '../../../../../i18n/context.js';
 import '../../../../../packages/i18n/dist/index.esm.js';
 import { Button } from '../../../../ui/button.js';
+import { Spinner } from '../../../../spinner/index.js';
 import { Input } from '../../../../ui/input.js';
 import { Label } from '../../../../ui/label.js';
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '../../../../ui/dialog.js';
 import { Textarea } from '../../../../ui/textarea.js';
 import { Select, SelectTrigger, SelectValue, SelectContent, SelectItem } from '../../../../ui/select.js';
 import { RadioGroup, RadioGroupItem } from '../../../../ui/radio-group.js';
+import { currentSignInScope, MCP_RADIO_ITEM_CLASS } from './mcp-connector-helpers.js';
+import { Switch } from '../../../../ui/switch.js';
 import { toast } from 'sonner';
 import { TransportEnum } from '@iblai/iblai-api';
-import { useLazyGetMCPServersQuery, useOauthFindMutation, useLazyStartOAuthFlowQuery, useCreateMCPServerMutation, usePartialUpdateMCPServerMutation, useCreateMCPServerConnectionMutation, usePatchMCPServerConnectionMutation, useGetConnectedServicesQuery } from '@iblai/data-layer';
+import { AlertDialog, AlertDialogContent, AlertDialogHeader, AlertDialogTitle, AlertDialogDescription, AlertDialogFooter, AlertDialogCancel, AlertDialogAction } from '../../../../chat/ui/alert-dialog.js';
+import { emptyOAuthAppForm, storedAppEndpoints, oauthAppFormFromCredentials, sameOAuthAppForm, validateOAuthAppForm, oauthAppFormToFindFields, oauthAppFormToBody, describeApiFailure, OAuthAppFields, readOAuthAppFieldErrors, readEndpointRefusal } from './oauth-app-fields.js';
+import { FieldInfo } from './field-info.js';
+import { useLazyGetMCPServersQuery, useOauthFindMutation, useLazyStartOAuthFlowQuery, useCreateMCPServerMutation, usePartialUpdateMCPServerMutation, useCreateMCPServerConnectionMutation, usePatchMCPServerConnectionMutation, useGetConnectedServicesQuery, useSetMCPServerCredentialsMutation, useDeleteMCPServerCredentialsMutation, useGetMCPServerCredentialsQuery, useGetOAuthServicesQuery } from '@iblai/data-layer';
 import { useLocalStorage } from '../../../../../hooks/use-local-storage.js';
 import Image from '../../../../../node_modules/.pnpm/lucide-react@0.528.0_react@19.1.0/node_modules/lucide-react/dist/esm/icons/image.js';
+import Unlink from '../../../../../node_modules/.pnpm/lucide-react@0.528.0_react@19.1.0/node_modules/lucide-react/dist/esm/icons/unlink.js';
+import Link2 from '../../../../../node_modules/.pnpm/lucide-react@0.528.0_react@19.1.0/node_modules/lucide-react/dist/esm/icons/link-2.js';
 import Lock from '../../../../../node_modules/.pnpm/lucide-react@0.528.0_react@19.1.0/node_modules/lucide-react/dist/esm/icons/lock.js';
 
 const AUTH_SCOPE = {
-    TENANT: 'tenant',
+    // The API's name for the organization-wide scope.
+    TENANT: 'platform',
     MENTOR: 'mentor',
     USER: 'user',
 };
 const KNOWN_TOKEN_TYPES = ['Bearer', 'Basic', 'API-Key', 'API-Token', 'Token'];
+// Why discovery stopped, in our words, by the step oauth-find reports, when an
+// app of the organization's own cannot help.
+const DISCOVERY_MESSAGE_KEYS = {
+    mcp_server_url: 'mcpTabConnectorDialogs.diagnosticMcpServerUrl',
+    provider_name_conflict: 'mcpTabConnectorDialogs.diagnosticProviderNameConflict',
+    internal_error: 'mcpTabConnectorDialogs.diagnosticInternalError',
+};
+// The backend takes an organization's own app only when the server answered
+// but registers no apps or publishes no sign-in settings, and never after a
+// check that ran out of time; anything else is said under the address.
+const discoveryStopMessageKey = (diagnostic) => {
+    var _a;
+    if (diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.timed_out)
+        return 'mcpTabConnectorDialogs.diagnosticTimedOut';
+    const step = diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.failed_step;
+    if (step === 'mcp_server_url' &&
+        ((_a = diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.attempts) === null || _a === void 0 ? void 0 : _a.some((attempt) => attempt.outcome === 'blocked'))) {
+        return 'mcpTabConnectorDialogs.diagnosticMcpServerUrlBlocked';
+    }
+    return step ? DISCOVERY_MESSAGE_KEYS[step] : undefined;
+};
+/** The `diagnostic` an oauth-find 400 carries, when the error has one. */
+const readOAuthFindDiagnostic = (error) => {
+    var _a;
+    const diagnostic = (_a = error === null || error === void 0 ? void 0 : error.data) === null || _a === void 0 ? void 0 : _a.diagnostic;
+    return diagnostic && typeof diagnostic === 'object' ? diagnostic : null;
+};
+// A provider's sign-in page against the one discovery found, trailing slashes aside.
+const sameUrl = (a, b) => !!a && !!b && a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
+const hostOf = (url) => {
+    try {
+        return url ? new URL(url).hostname.toLowerCase() : null;
+    }
+    catch (_a) {
+        return null;
+    }
+};
+/**
+ * The organization's provider a hand-entered app belongs to, found without
+ * asking: the sign-in page discovery named, else its host, else the server's host.
+ */
+const matchProvider = (providers, authEndpoint, serverUrl) => {
+    var _a, _b;
+    return (_b = (_a = providers.find((p) => sameUrl(p.auth_url, authEndpoint))) !== null && _a !== void 0 ? _a : providers.find((p) => !!hostOf(p.auth_url) && hostOf(p.auth_url) === hostOf(authEndpoint))) !== null && _b !== void 0 ? _b : providers.find((p) => !!hostOf(p.url) && hostOf(p.url) === hostOf(serverUrl));
+};
 const normalizeTransportValue = (value) => {
     const candidate = value === null || value === void 0 ? void 0 : value.toLowerCase();
     if (candidate === TransportEnum.SSE)
@@ -93,7 +147,8 @@ const validateCustomTokenType = (value) => {
     }
     return { isValid: true, error: null };
 };
-function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editingConnectionId, tenantKey, username, mentorId, onOAuthComplete, }) {
+function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editingConnectionId, tenantKey, username, mentorId, onOAuthComplete, restricted = false, onRestrictedSave, clearAgentScopeOverride, openOnSignInApp = false, onAuthScopeChanged, connection, }) {
+    var _a, _b, _c, _d, _e;
     const t = useT();
     // Form state
     const [connectorName, setConnectorName] = useState('');
@@ -101,8 +156,10 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
     const [connectorDescription, setConnectorDescription] = useState('');
     const [transport, setTransport] = useState(TransportEnum.STREAMABLE_HTTP);
     const [authMethod, setAuthMethod] = useState('no-auth');
-    const [authScope, setAuthScope] = useState(AUTH_SCOPE.TENANT);
+    // The backend default, and the safer choice: each user signs in with their own account.
+    const [authScope, setAuthScope] = useState(AUTH_SCOPE.USER);
     const [connectorScope, setConnectorScope] = useState('tenant');
+    const [userCanDisable, setUserCanDisable] = useState(true);
     const [tokenType, setTokenType] = useState('Bearer');
     const [customTokenType, setCustomTokenType] = useState('');
     const [tokenValue, setTokenValue] = useState('');
@@ -111,6 +168,22 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
     const [credentialsMasked, setCredentialsMasked] = useState(false);
     const [isSubmitting, setIsSubmitting] = useState(false);
     const [oauthUrlError, setOauthUrlError] = useState(null);
+    // A server that didn't answer, or answered too slowly, may answer the next
+    // Connect at the same address.
+    const [addressErrorRetryable, setAddressErrorRetryable] = useState(false);
+    const [nameError, setNameError] = useState(null);
+    // The sign-in app fields show only when the connector needs an app entered by hand.
+    const [signInAppOpen, setSignInAppOpen] = useState(false);
+    const [signInReason, setSignInReason] = useState(null);
+    const [oauthApp, setOauthApp] = useState(() => emptyOAuthAppForm());
+    const [oauthServiceId, setOauthServiceId] = useState(null);
+    const [signInError, setSignInError] = useState(null);
+    const [appFieldErrors, setAppFieldErrors] = useState({});
+    // Discovery found no sign-in settings, so the app's addresses are the only ones there are.
+    const [endpointsUndiscovered, setEndpointsUndiscovered] = useState(false);
+    const [confirmRemoveApp, setConfirmRemoveApp] = useState(false);
+    // The sign-in page discovery found, to tell the provider of an app entered by hand.
+    const [discoveredAuthEndpoint, setDiscoveredAuthEndpoint] = useState(null);
     const [originalTokenPlaceholder, setOriginalTokenPlaceholder] = useState(null);
     // API hooks
     const [getMCPServers] = useLazyGetMCPServersQuery();
@@ -121,10 +194,64 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
     const [createMCPServerConnection] = useCreateMCPServerConnectionMutation();
     const [patchMCPServerConnection] = usePatchMCPServerConnectionMutation();
     const { refetch: refetchConnected } = useGetConnectedServicesQuery({ org: tenantKey || '', userId: username || '' }, { skip: !tenantKey || !username });
+    const [saveCredentials] = useSetMCPServerCredentialsMutation();
+    const [deleteCredentials] = useDeleteMCPServerCredentialsMutation();
+    // The stored sign-in app of the connector being edited (secrets masked);
+    // `currentData`, so the previous connector's app never shows on this one.
+    const credentialsQuery = useGetMCPServerCredentialsQuery({ org: tenantKey || '', userId: username || '', id: (_a = editingServer === null || editingServer === void 0 ? void 0 : editingServer.id) !== null && _a !== void 0 ? _a : 0 }, { skip: !open || !editingServer || authMethod !== 'oauth' || !tenantKey || !username });
+    // The stored app belongs to the stored address's provider; another address may be another's.
+    const storedAppApplies = !!editingServer && connectorServer.trim() === editingServer.url;
+    const storedApp = storedAppApplies && ((_b = credentialsQuery.currentData) === null || _b === void 0 ? void 0 : _b.auth_type) === 'oauth2'
+        ? credentialsQuery.currentData
+        : undefined;
+    const appConfigured = !!(storedApp === null || storedApp === void 0 ? void 0 : storedApp.configured);
+    // Only an app entered by hand is what the fields edit; one the service registered for us is not shown.
+    const manualAppConfigured = appConfigured && (storedApp === null || storedApp === void 0 ? void 0 : storedApp.source) !== 'dcr';
+    // Nobody can sign in: no app of the organization's, none shared by ibl.ai.
+    const needsApp = !!storedApp && !storedApp.configured && !storedApp.shared_client_allowed;
+    // The app goes to oauth-find, which finds or creates its provider itself.
+    const findsWithApp = signInReason === 'registration' || signInReason === 'metadata';
+    const appEndpoints = signInReason === 'metadata' || (!findsWithApp && endpointsUndiscovered)
+        ? 'required'
+        : findsWithApp
+            ? 'hidden'
+            : storedAppEndpoints(storedApp);
+    // The organization's sign-in providers, to tell the connector's provider without asking.
+    const providersQuery = useGetOAuthServicesQuery({ org: tenantKey || '' }, { skip: !open || !tenantKey || !signInAppOpen || restricted || findsWithApp });
+    const storedService = ((_c = editingServer === null || editingServer === void 0 ? void 0 : editingServer.oauth_service_data) === null || _c === void 0 ? void 0 : _c.id) === oauthServiceId
+        ? editingServer === null || editingServer === void 0 ? void 0 : editingServer.oauth_service_data
+        : undefined;
+    const chosenService = storedService !== null && storedService !== void 0 ? storedService : ((_d = providersQuery.data) !== null && _d !== void 0 ? _d : [])
+        .flatMap((provider) => provider.services)
+        .find((service) => service.id === oauthServiceId);
+    // Whether the app entered by hand has a provider to be stored under.
+    const providerState = oauthServiceId !== null
+        ? 'known'
+        : providersQuery.isError
+            ? 'failed'
+            : providersQuery.data === undefined
+                ? 'checking'
+                : 'unknown';
+    // Whose developer settings the redirect URI goes into.
+    const providerLabel = (chosenService === null || chosenService === void 0 ? void 0 : chosenService.display_name) || connectorName.trim() || t('mcpTabConnectorDialogs.oauth');
     // Use localStorage hook for pending OAuth server data
     const [, setPendingOAuthServer, removePendingOAuthServer] = useLocalStorage('oauth_pending_server', null);
     const fileInputRef = useRef(null);
+    const contentRef = useRef(null);
+    const nameInputRef = useRef(null);
     const objectUrlRef = useRef(null);
+    // A connector created by hand whose sign-in app then failed to save: the retry updates it.
+    const createdServerRef = useRef(null);
+    // The service oauth-find made for the organization's app, for a retry after
+    // the connector could not be saved: the app is stored already, and a second
+    // oauth-find with it would be refused.
+    // The app it was found with is kept too: one corrected since is saved over it.
+    const foundServiceRef = useRef(null);
+    // The address the effect below last handled, and the reason the fields are
+    // open, read there without re-running it.
+    const handledAddressRef = useRef(null);
+    const signInReasonRef = useRef(signInReason);
+    signInReasonRef.current = signInReason;
     // Cleanup object URL on unmount
     useEffect(() => {
         return () => {
@@ -144,8 +271,9 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         setConnectorDescription('');
         setTransport(TransportEnum.STREAMABLE_HTTP);
         setAuthMethod('no-auth');
-        setAuthScope(AUTH_SCOPE.TENANT);
+        setAuthScope(AUTH_SCOPE.USER);
         setConnectorScope('tenant');
+        setUserCanDisable(true);
         setTokenType('Bearer');
         setCustomTokenType('');
         setTokenValue('');
@@ -153,13 +281,26 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         setImageFile(null);
         setCredentialsMasked(false);
         setOauthUrlError(null);
+        setNameError(null);
+        setSignInAppOpen(false);
+        setSignInReason(null);
+        setOauthApp(emptyOAuthAppForm());
+        setOauthServiceId(null);
+        setSignInError(null);
+        setAppFieldErrors({});
+        setEndpointsUndiscovered(false);
+        setConfirmRemoveApp(false);
+        setDiscoveredAuthEndpoint(null);
+        createdServerRef.current = null;
+        foundServiceRef.current = null;
+        handledAddressRef.current = null;
         setOriginalTokenPlaceholder(null);
         if (fileInputRef.current)
             fileInputRef.current.value = '';
     }, []);
     // Pre-fill form when editing
     useEffect(() => {
-        var _a, _b;
+        var _a, _b, _c, _d;
         if (!open)
             return;
         if (editingServer) {
@@ -175,11 +316,22 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
             setConnectorImage(editingServer.image || null);
             setImageFile(null);
             setConnectorScope(editingServer.mentor ? 'this-mentor' : 'tenant');
+            setUserCanDisable(editingServer.user_can_disable !== false);
             // Check auth type and set appropriate method
             const authType = (_b = editingServer.auth_type) === null || _b === void 0 ? void 0 : _b.toLowerCase();
             if (authType === 'oauth2') {
                 setAuthMethod('oauth');
-                setAuthScope(editingServer.auth_scope || AUTH_SCOPE.TENANT);
+                // The scope in force for this agent: its own choice, else the connector's.
+                setAuthScope(editingServer.effective_auth_scope || editingServer.auth_scope || AUTH_SCOPE.USER);
+                setOauthServiceId((_d = (_c = editingServer.oauth_service_data) === null || _c === void 0 ? void 0 : _c.id) !== null && _d !== void 0 ? _d : null);
+                // A stored app entered by hand, once read, opens the fields too.
+                setSignInAppOpen(openOnSignInApp);
+                setSignInReason(null);
+                setOauthApp(emptyOAuthAppForm());
+                setSignInError(null);
+                setAppFieldErrors({});
+                setEndpointsUndiscovered(false);
+                setDiscoveredAuthEndpoint(null);
                 setTokenType('Bearer');
                 setCustomTokenType('');
                 setTokenValue('');
@@ -210,6 +362,7 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                 }
                 else {
                     setAuthMethod('no-auth');
+                    setOauthServiceId(null);
                     setTokenType('Bearer');
                     setCustomTokenType('');
                     setTokenValue('');
@@ -221,13 +374,66 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         else {
             resetForm();
         }
-    }, [editingServer, open, resetForm]);
-    // Clear OAuth error when URL changes
+    }, [editingServer, open, openOnSignInApp, resetForm]);
+    // The address decides the sign-in app. A changed one means discovery runs
+    // again for it, so what the last one said, and the stored provider and app,
+    // no longer apply; back on the stored address, they do (an app entered by
+    // hand opens with its fields, prefilled). Runs once on open, before the prefill.
     useEffect(() => {
-        if (authMethod === 'oauth') {
-            setOauthUrlError(null);
+        var _a, _b, _c;
+        if (authMethod !== 'oauth') {
+            handledAddressRef.current = null;
+            return;
+        }
+        const address = `${(_a = editingServer === null || editingServer === void 0 ? void 0 : editingServer.id) !== null && _a !== void 0 ? _a : ''} ${connectorServer.trim()} ${openOnSignInApp}`;
+        const sameAddress = handledAddressRef.current === address;
+        handledAddressRef.current = address;
+        // The stored app refetched while an app is being entered (oauth-find with
+        // one refreshes it) changes nothing typed.
+        if (sameAddress && signInReasonRef.current)
+            return;
+        setOauthUrlError(null);
+        setSignInReason(null);
+        setSignInError(null);
+        setAppFieldErrors({});
+        setEndpointsUndiscovered(false);
+        setDiscoveredAuthEndpoint(null);
+        if (editingServer && connectorServer.trim() === editingServer.url) {
+            setOauthServiceId((_c = (_b = editingServer.oauth_service_data) === null || _b === void 0 ? void 0 : _b.id) !== null && _c !== void 0 ? _c : null);
+            setSignInAppOpen(openOnSignInApp || manualAppConfigured);
+            setOauthApp(manualAppConfigured && storedApp
+                ? oauthAppFormFromCredentials(storedApp)
+                : emptyOAuthAppForm());
+            return;
         }
-    }, [connectorServer, authMethod]);
+        setSignInAppOpen(false);
+        setOauthServiceId(null);
+        setOauthApp(emptyOAuthAppForm());
+        // `storedApp` changes identity with every fetch; what matters is its content.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [
+        connectorServer,
+        authMethod,
+        editingServer,
+        openOnSignInApp,
+        manualAppConfigured,
+        storedApp === null || storedApp === void 0 ? void 0 : storedApp.updated_at,
+    ]);
+    // A new connector's provider, told from what discovery found; never asked.
+    useEffect(() => {
+        if (!signInAppOpen || findsWithApp || oauthServiceId !== null || !providersQuery.data)
+            return;
+        const owner = matchProvider(providersQuery.data, discoveredAuthEndpoint, connectorServer);
+        if (owner === null || owner === void 0 ? void 0 : owner.services[0])
+            setOauthServiceId(owner.services[0].id);
+    }, [
+        signInAppOpen,
+        findsWithApp,
+        oauthServiceId,
+        providersQuery.data,
+        discoveredAuthEndpoint,
+        connectorServer,
+    ]);
     const handleImageUpload = useCallback((event) => {
         var _a;
         const file = (_a = event.target.files) === null || _a === void 0 ? void 0 : _a[0];
@@ -258,7 +464,7 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         objectUrlRef.current = previewUrl;
         setConnectorImage(previewUrl);
         setImageFile(file);
-    }, []);
+    }, [t]);
     // Handle OAuth flow
     // Note: tenantKey and username are validated in handleSubmit before this is called
     const handleOAuthFlow = useCallback(async (server, provider, service) => {
@@ -418,11 +624,10 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         setPendingOAuthServer,
         removePendingOAuthServer,
         onOAuthComplete,
-        resetForm,
-        onClose,
+        t,
     ]);
     const handleSubmit = useCallback(async () => {
-        var _a, _b;
+        var _a, _b, _c, _d, _e, _f, _g;
         if (isSubmitting)
             return;
         const trimmedName = connectorName.trim();
@@ -438,60 +643,369 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                 toast.error(t('mcpTabConnectorDialogs.missingRequiredParams'));
                 return;
             }
-            setIsSubmitting(true);
-            setOauthUrlError(null);
-            try {
-                // Editing an existing OAuth server
-                if (editingServer) {
-                    const urlChanged = editingServer.url !== trimmedServer;
-                    // Update server metadata (name, description, transport, auth_scope, mentor)
-                    await updateMCPServer({
-                        id: editingServer.id,
-                        org: tenantKey,
-                        userId: username,
-                        body: {
+            const callbackUrl = `${window.location.origin}/google-oauth-callback/`;
+            // The form opens on the scope in force for this agent, which may be the
+            // agent's own choice. Left as it opened, the connector keeps its own scope;
+            // only a scope the person changed is written for every agent.
+            const scopeEdited = !!editingServer && authScope !== currentSignInScope(editingServer);
+            const connectorAuthScope = editingServer && !scopeEdited ? editingServer.auth_scope || AUTH_SCOPE.USER : authScope;
+            const serverBody = {
+                name: trimmedName,
+                url: trimmedServer,
+                transport: transport,
+                description: connectorDescription.trim() || undefined,
+                auth_type: 'oauth2',
+                auth_scope: connectorAuthScope,
+                mentor: connectorScope === 'this-mentor' && mentorId ? mentorId : null,
+                user_can_disable: userCanDisable,
+            };
+            // The connector's fields, then the connection's scope when it changed.
+            const updateConnector = async (server, body, { signInFollows = false } = {}) => {
+                await updateMCPServer({ id: server.id, org: tenantKey, userId: username, body }).unwrap();
+                if (!scopeEdited)
+                    return;
+                if (currentSignInScope(server) !== (server.auth_scope || AUTH_SCOPE.USER)) {
+                    await (clearAgentScopeOverride === null || clearAgentScopeOverride === void 0 ? void 0 : clearAgentScopeOverride(server));
+                }
+                if (editingConnectionId) {
+                    try {
+                        await patchMCPServerConnection({
+                            org: tenantKey,
+                            userId: username,
+                            id: editingConnectionId,
+                            scope: authScope,
+                            mentor: authScope === AUTH_SCOPE.MENTOR && mentorId ? mentorId : '',
+                            ...(authScope !== AUTH_SCOPE.MENTOR && { user: username }),
+                        }).unwrap();
+                    }
+                    catch (_a) {
+                        // Non-blocking: server was updated, connection patch is best-effort
+                    }
+                }
+                // A sign-in the dialog starts next creates the new scope's connection itself.
+                if (!signInFollows) {
+                    await (onAuthScopeChanged === null || onAuthScopeChanged === void 0 ? void 0 : onAuthScopeChanged(server, authScope));
+                }
+            };
+            // An app entered by hand and left as stored is not written again.
+            const appUnchanged = manualAppConfigured &&
+                !!storedApp &&
+                sameOAuthAppForm(oauthApp, oauthAppFormFromCredentials(storedApp));
+            const saveSignInApp = async (serverId) => {
+                if (appUnchanged)
+                    return;
+                await saveCredentials({
+                    org: tenantKey,
+                    userId: username,
+                    id: serverId,
+                    body: oauthAppFormToBody(oauthApp, manualAppConfigured, appEndpoints),
+                }).unwrap();
+            };
+            // The backend's word on the app: each field's under its input, the
+            // address's and the name's under theirs, anything else as one sentence.
+            const showAppFailure = (error) => {
+                const fieldErrors = readOAuthAppFieldErrors(error);
+                setAppFieldErrors(fieldErrors);
+                const body = error === null || error === void 0 ? void 0 : error.data;
+                const joined = (messages) => (Array.isArray(messages) ? messages.join(' ') : null);
+                const addressError = joined(body === null || body === void 0 ? void 0 : body.url);
+                const connectorNameError = joined(body === null || body === void 0 ? void 0 : body.name);
+                if (addressError) {
+                    setOauthUrlError(addressError);
+                    setAddressErrorRetryable(false);
+                }
+                if (connectorNameError)
+                    setNameError(connectorNameError);
+                if (Object.keys(fieldErrors).length > 0 || addressError || connectorNameError)
+                    return;
+                const diagnostic = readOAuthFindDiagnostic(error);
+                const step = diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.failed_step;
+                const hint = step === 'manual_client' ? diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.hint : null;
+                if (hint && /publishes no OAuth metadata/i.test(hint)) {
+                    // The server has no sign-in settings after all: its addresses are needed.
+                    setEndpointsUndiscovered(true);
+                    setSignInReason('metadata');
+                    setAppFieldErrors({ authorizationUrl: t('mcpOAuthApp.endpointsRequired') });
+                    return;
+                }
+                const refusal = readEndpointRefusal(hint !== null && hint !== void 0 ? hint : (typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : null), t, providerLabel);
+                if (refusal && appEndpoints !== 'hidden') {
+                    setAppFieldErrors({ [refusal.field]: refusal.message });
+                    return;
+                }
+                const key = discoveryStopMessageKey(diagnostic);
+                setSignInError(hint || (key && t(key)) || describeApiFailure(error, t) || t('mcpOAuthApp.saveFailed'));
+            };
+            // Only the settings for this agent, and the sign-in app when its fields
+            // are open: the connector itself is not written.
+            if (restricted && editingServer) {
+                if (signInAppOpen) {
+                    if (!oauthServiceId) {
+                        setSignInError(t('mcpTabConnectorDialogs.signInProviderUnknown'));
+                        return;
+                    }
+                    // An app left as stored is not written, so nothing in it is checked either.
+                    const appError = appUnchanged
+                        ? null
+                        : validateOAuthAppForm(oauthApp, manualAppConfigured, t, appEndpoints);
+                    if (appError) {
+                        setAppFieldErrors({ [appError.field]: appError.message });
+                        return;
+                    }
+                }
+                setIsSubmitting(true);
+                setSignInError(null);
+                setAppFieldErrors({});
+                let appPending = signInAppOpen && !appUnchanged;
+                try {
+                    if (appPending) {
+                        await saveSignInApp(editingServer.id);
+                        appPending = false;
+                        toast.success(t('mcpTabConnectorDialogs.appCredentialsSaved'));
+                        if (onOAuthComplete)
+                            onOAuthComplete();
+                    }
+                    await (onRestrictedSave === null || onRestrictedSave === void 0 ? void 0 : onRestrictedSave(editingServer, {
+                        scope: authScope,
+                        userCanDisable,
+                    }));
+                    setIsSubmitting(false);
+                    resetForm();
+                    onClose();
+                }
+                catch (error) {
+                    // A refused choice was said by the host; only the app's failure reads here.
+                    if (appPending)
+                        showAppFailure(error);
+                }
+                finally {
+                    setIsSubmitting(false);
+                }
+                return;
+            }
+            // The organization's own app for a service that cannot register one
+            // itself (guide §5.4): oauth-find again with the app, which stores it and
+            // returns the service; then the connector, then the sign-in.
+            if (signInAppOpen && findsWithApp) {
+                const appError = validateOAuthAppForm(oauthApp, false, t, appEndpoints);
+                if (appError) {
+                    setAppFieldErrors({ [appError.field]: appError.message });
+                    return;
+                }
+                setIsSubmitting(true);
+                setOauthUrlError(null);
+                setNameError(null);
+                setSignInError(null);
+                setAppFieldErrors({});
+                try {
+                    const earlier = ((_a = foundServiceRef.current) === null || _a === void 0 ? void 0 : _a.url) === trimmedServer ? foundServiceRef.current : null;
+                    // Stored with the app as it was then; corrected since, it is saved again below.
+                    const appChanged = !!earlier &&
+                        (!sameOAuthAppForm(earlier.app, oauthApp) || earlier.endpoints !== appEndpoints);
+                    let found = (_b = earlier === null || earlier === void 0 ? void 0 : earlier.service) !== null && _b !== void 0 ? _b : null;
+                    if (!found) {
+                        found = await oauthFind({
+                            org: tenantKey,
+                            userId: username,
+                            url: trimmedServer,
                             name: trimmedName,
+                            ...oauthAppFormToFindFields(oauthApp, appEndpoints),
+                        }).unwrap();
+                        foundServiceRef.current = {
                             url: trimmedServer,
-                            transport: transport,
-                            description: connectorDescription.trim() || undefined,
-                            auth_type: 'oauth2',
-                            auth_scope: authScope,
-                            mentor: connectorScope === 'this-mentor' && mentorId ? mentorId : null,
-                        },
-                    }).unwrap();
-                    // If auth_scope changed, update the connection's mentor field
-                    const scopeChanged = editingServer.auth_scope !== authScope;
-                    if (scopeChanged && editingConnectionId) {
-                        try {
-                            await patchMCPServerConnection({
+                            service: found,
+                            app: oauthApp,
+                            endpoints: appEndpoints,
+                        };
+                    }
+                    const body = { ...serverBody, oauth_service: found.id };
+                    let server;
+                    if (editingServer) {
+                        await updateConnector(editingServer, body, { signInFollows: true });
+                        server = { ...editingServer, url: trimmedServer };
+                    }
+                    else if (createdServerRef.current) {
+                        await updateMCPServer({
+                            id: createdServerRef.current.id,
+                            org: tenantKey,
+                            userId: username,
+                            body,
+                        }).unwrap();
+                        server = { ...createdServerRef.current, ...body };
+                    }
+                    else {
+                        server = await createMCPServer({ org: tenantKey, userId: username, body }).unwrap();
+                        createdServerRef.current = server;
+                    }
+                    if (appChanged) {
+                        await saveCredentials({
+                            org: tenantKey,
+                            userId: username,
+                            id: server.id,
+                            body: oauthAppFormToBody(oauthApp, false, appEndpoints),
+                        }).unwrap();
+                        foundServiceRef.current = {
+                            url: trimmedServer,
+                            service: found,
+                            app: oauthApp,
+                            endpoints: appEndpoints,
+                        };
+                    }
+                    await handleOAuthFlow(server, found.oauth_provider, found.name);
+                    setIsSubmitting(false);
+                    resetForm();
+                    onClose();
+                }
+                catch (error) {
+                    const diagnostic = readOAuthFindDiagnostic(error);
+                    if ((diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.failed_step) === 'tenant_client_configured') {
+                        // The organization has an app for this service already: it is
+                        // edited through the connector's credentials, not stored again.
+                        setDiscoveredAuthEndpoint((_d = (_c = diagnostic.discovered) === null || _c === void 0 ? void 0 : _c.authorization_endpoint) !== null && _d !== void 0 ? _d : null);
+                        setSignInReason('existing');
+                    }
+                    else {
+                        showAppFailure(error);
+                    }
+                }
+                finally {
+                    setIsSubmitting(false);
+                }
+                return;
+            }
+            // A hand-entered sign-in app: no discovery. The connector keeps its
+            // provider, or gets the one told from what discovery found.
+            if (signInAppOpen) {
+                if (!oauthServiceId) {
+                    setSignInError(t('mcpTabConnectorDialogs.signInProviderUnknown'));
+                    return;
+                }
+                // An app left as stored is not written, so nothing in it is checked either.
+                const appError = appUnchanged
+                    ? null
+                    : validateOAuthAppForm(oauthApp, manualAppConfigured, t, appEndpoints);
+                if (appError) {
+                    setAppFieldErrors({ [appError.field]: appError.message });
+                    return;
+                }
+                setIsSubmitting(true);
+                setOauthUrlError(null);
+                setNameError(null);
+                setSignInError(null);
+                setAppFieldErrors({});
+                try {
+                    if (editingServer) {
+                        await updateConnector(editingServer, {
+                            ...serverBody,
+                            ...(oauthServiceId !== ((_e = editingServer.oauth_service_data) === null || _e === void 0 ? void 0 : _e.id) && {
+                                oauth_service: oauthServiceId,
+                            }),
+                        });
+                        await saveSignInApp(editingServer.id);
+                        toast.success(t('mcpTabConnectorDialogs.connectorUpdatedSuccess'));
+                    }
+                    else {
+                        const body = { ...serverBody, oauth_service: oauthServiceId };
+                        let server = createdServerRef.current;
+                        if (server) {
+                            // Created on an earlier try whose app then failed to save.
+                            await updateMCPServer({
+                                id: server.id,
                                 org: tenantKey,
                                 userId: username,
-                                id: editingConnectionId,
-                                scope: authScope,
-                                mentor: authScope === AUTH_SCOPE.MENTOR && mentorId ? mentorId : '',
-                                ...(authScope !== AUTH_SCOPE.MENTOR && { user: username }),
+                                body,
                             }).unwrap();
                         }
-                        catch (_c) {
-                            // Non-blocking: server was updated, connection patch is best-effort
+                        else {
+                            server = await createMCPServer({ org: tenantKey, userId: username, body }).unwrap();
+                            createdServerRef.current = server;
+                        }
+                        await saveSignInApp(server.id);
+                        toast.success(t('mcpTabConnectorDialogs.appCredentialsSaved'));
+                        // As after discovery: the sign-in starts right away.
+                        if (chosenService) {
+                            await handleOAuthFlow(server, chosenService.oauth_provider, chosenService.name);
                         }
                     }
-                    // Only restart OAuth flow if the URL changed
-                    if (urlChanged) {
+                    if (onOAuthComplete)
+                        onOAuthComplete();
+                    setIsSubmitting(false);
+                    resetForm();
+                    onClose();
+                }
+                catch (error) {
+                    showAppFailure(error);
+                }
+                finally {
+                    setIsSubmitting(false);
+                }
+                return;
+            }
+            setIsSubmitting(true);
+            setOauthUrlError(null);
+            setSignInError(null);
+            // Discovery stopped. A service that registers no apps itself, or publishes
+            // no sign-in settings, or one the organization already has an app for,
+            // shows the app fields with what was found; for anything else an app of
+            // the organization's own cannot help, so it is one sentence under the address.
+            const handleDiscoveryFailure = (error, fallbackKey) => {
+                var _a, _b, _c, _d, _e;
+                const diagnostic = readOAuthFindDiagnostic(error);
+                const step = (diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.timed_out) ? null : diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.failed_step;
+                setEndpointsUndiscovered(step === 'authorization_server_metadata');
+                const reason = step === 'client_registration'
+                    ? 'registration'
+                    : step === 'authorization_server_metadata'
+                        ? 'metadata'
+                        : step === 'tenant_client_configured'
+                            ? 'existing'
+                            : null;
+                if (reason) {
+                    const found = (_b = (_a = diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.discovered) === null || _a === void 0 ? void 0 : _a.scopes_supported) !== null && _b !== void 0 ? _b : [];
+                    setDiscoveredAuthEndpoint((_d = (_c = diagnostic === null || diagnostic === void 0 ? void 0 : diagnostic.discovered) === null || _c === void 0 ? void 0 : _c.authorization_endpoint) !== null && _d !== void 0 ? _d : null);
+                    setOauthApp((form) => ({ ...form, scopes: form.scopes || found.join(' ') }));
+                    setSignInReason(reason);
+                    setSignInAppOpen(true);
+                    return;
+                }
+                const key = discoveryStopMessageKey(diagnostic);
+                setAddressErrorRetryable(key === 'mcpTabConnectorDialogs.diagnosticTimedOut' ||
+                    key === 'mcpTabConnectorDialogs.diagnosticMcpServerUrl');
+                // No reason in the answer (a server error, a refused or lost request):
+                // its status says more than blaming the address would.
+                const status = error === null || error === void 0 ? void 0 : error.status;
+                setOauthUrlError(key
+                    ? t(key)
+                    : getValidationErrorMessage((_e = describeApiFailure(error, t)) !== null && _e !== void 0 ? _e : extractApiErrorMessage(error), typeof status === 'number'
+                        ? t('mcpTabConnectorDialogs.discoveryFailedStatus', { status })
+                        : typeof status === 'string' && status
+                            ? t('mcpTabConnectorDialogs.discoveryUnreachable')
+                            : t(fallbackKey)));
+            };
+            try {
+                // Editing an existing OAuth server
+                if (editingServer) {
+                    const urlChanged = editingServer.url !== trimmedServer;
+                    // A new address, or no app anyone can sign in through: find and
+                    // register again.
+                    const signInFollows = urlChanged || needsApp;
+                    await updateConnector(editingServer, serverBody, { signInFollows });
+                    if (signInFollows) {
                         // Re-check featured servers for the new URL
-                        const existingServersResult = await getMCPServers({
-                            org: tenantKey,
-                            userId: username,
-                            url: trimmedServer,
-                            isFeatured: true,
-                        }).unwrap();
-                        const matchingServer = (_a = existingServersResult.results) === null || _a === void 0 ? void 0 : _a.find((s) => { var _a; return s.url === trimmedServer && ((_a = s.auth_type) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'oauth2'; });
+                        const existingServersResult = urlChanged
+                            ? await getMCPServers({
+                                org: tenantKey,
+                                userId: username,
+                                url: trimmedServer,
+                                isFeatured: true,
+                            }).unwrap()
+                            : undefined;
+                        const matchingServer = (_f = existingServersResult === null || existingServersResult === void 0 ? void 0 : existingServersResult.results) === null || _f === void 0 ? void 0 : _f.find((s) => { var _a; return s.url === trimmedServer && ((_a = s.auth_type) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'oauth2'; });
                         if (matchingServer === null || matchingServer === void 0 ? void 0 : matchingServer.oauth_service_data) {
                             const oauthData = matchingServer.oauth_service_data;
                             await handleOAuthFlow(matchingServer, oauthData.oauth_provider, oauthData.name);
                         }
                         else {
-                            const callbackUrl = `${window.location.origin}/google-oauth-callback/`;
                             const oauthFindResult = await oauthFind({
                                 org: tenantKey,
                                 userId: username,
@@ -499,6 +1013,13 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                                 name: trimmedName,
                                 callback_url: callbackUrl,
                             }).unwrap();
+                            // The connector now signs in through what discovery found.
+                            await updateMCPServer({
+                                id: editingServer.id,
+                                org: tenantKey,
+                                userId: username,
+                                body: { oauth_service: oauthFindResult.id },
+                            }).unwrap();
                             await handleOAuthFlow({ ...editingServer, url: trimmedServer }, oauthFindResult.oauth_provider, oauthFindResult.name);
                         }
                     }
@@ -520,7 +1041,7 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                     url: trimmedServer,
                     isFeatured: true,
                 }).unwrap();
-                const existingServer = (_b = existingServersResult.results) === null || _b === void 0 ? void 0 : _b.find((s) => { var _a; return s.url === trimmedServer && ((_a = s.auth_type) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'oauth2'; });
+                const existingServer = (_g = existingServersResult.results) === null || _g === void 0 ? void 0 : _g.find((s) => { var _a; return s.url === trimmedServer && ((_a = s.auth_type) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'oauth2'; });
                 if (existingServer && existingServer.oauth_service_data) {
                     // Use existing server
                     const oauthData = existingServer.oauth_service_data;
@@ -532,7 +1053,6 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                 }
                 // If not found, call oauth-find endpoint
                 try {
-                    const callbackUrl = `${window.location.origin}/google-oauth-callback/`;
                     const oauthFindResult = await oauthFind({
                         org: tenantKey,
                         userId: username,
@@ -540,21 +1060,22 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                         name: trimmedName,
                         callback_url: callbackUrl,
                     }).unwrap();
-                    // Create new MCP server with OAuth
-                    const newServer = await createMCPServer({
-                        org: tenantKey,
-                        userId: username,
-                        body: {
-                            name: trimmedName,
-                            url: trimmedServer,
-                            transport: transport,
-                            description: connectorDescription.trim() || undefined,
-                            auth_type: 'oauth2',
-                            auth_scope: authScope,
-                            oauth_service: oauthFindResult.id,
-                            mentor: connectorScope === 'this-mentor' && mentorId ? mentorId : null,
-                        },
-                    }).unwrap();
+                    const body = { ...serverBody, oauth_service: oauthFindResult.id };
+                    let newServer = createdServerRef.current;
+                    if (newServer) {
+                        // Created on an earlier try whose app then failed to save: it now
+                        // signs in through what discovery found.
+                        await updateMCPServer({
+                            id: newServer.id,
+                            org: tenantKey,
+                            userId: username,
+                            body,
+                        }).unwrap();
+                        newServer = { ...newServer, ...body };
+                    }
+                    else {
+                        newServer = await createMCPServer({ org: tenantKey, userId: username, body }).unwrap();
+                    }
                     // Start OAuth flow
                     await handleOAuthFlow(newServer, oauthFindResult.oauth_provider, oauthFindResult.name);
                     setIsSubmitting(false);
@@ -562,15 +1083,30 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                     onClose();
                 }
                 catch (error) {
-                    const msg = extractApiErrorMessage(error);
-                    setOauthUrlError(getValidationErrorMessage(msg, t('mcpTabConnectorDialogs.oauthUrlInvalid')));
-                    toast.error(t('mcpTabConnectorDialogs.oauthConfigNotFound'));
+                    handleDiscoveryFailure(error, 'mcpTabConnectorDialogs.oauthUrlInvalid');
                 }
             }
             catch (error) {
-                const msg = extractApiErrorMessage(error);
-                setOauthUrlError(getValidationErrorMessage(msg, t('mcpTabConnectorDialogs.oauthUrlInvalid')));
-                toast.error(t('mcpTabConnectorDialogs.oauthProcessFailed'));
+                handleDiscoveryFailure(error, 'mcpTabConnectorDialogs.oauthProcessFailed');
+            }
+            finally {
+                setIsSubmitting(false);
+            }
+            return;
+        }
+        // A connector without a sign-in has one setting for this agent to save.
+        if (restricted && editingServer) {
+            setIsSubmitting(true);
+            try {
+                await (onRestrictedSave === null || onRestrictedSave === void 0 ? void 0 : onRestrictedSave(editingServer, {
+                    scope: authScope,
+                    userCanDisable,
+                }));
+                resetForm();
+                onClose();
+            }
+            catch (_h) {
+                // Said by the host; the form stays open.
             }
             finally {
                 setIsSubmitting(false);
@@ -617,11 +1153,12 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
                 authType,
                 ...(imageFile && { image: imageFile }),
                 mentor: connectorScope === 'this-mentor' && mentorId ? mentorId : null,
+                userCanDisable,
             });
             resetForm();
             onClose();
         }
-        catch (_d) {
+        catch (_j) {
             // Error handled by parent
         }
         finally {
@@ -635,6 +1172,7 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         authMethod,
         authScope,
         connectorScope,
+        userCanDisable,
         tokenValue,
         tokenType,
         customTokenType,
@@ -656,6 +1194,58 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         editingConnectionId,
         originalTokenPlaceholder,
         onOAuthComplete,
+        signInAppOpen,
+        oauthApp,
+        oauthServiceId,
+        storedApp,
+        manualAppConfigured,
+        needsApp,
+        restricted,
+        onRestrictedSave,
+        clearAgentScopeOverride,
+        findsWithApp,
+        appEndpoints,
+        providerLabel,
+        saveCredentials,
+        chosenService,
+        onAuthScopeChanged,
+        t,
+    ]);
+    // Removing the organization's sign-in app signs everyone out of that provider.
+    const removeSignInApp = useCallback(async () => {
+        var _a;
+        if (!editingServer || !tenantKey || !username)
+            return;
+        setIsSubmitting(true);
+        try {
+            await deleteCredentials({ org: tenantKey, userId: username, id: editingServer.id }).unwrap();
+            toast.success(t('mcpOAuthApp.removed', { name: providerLabel }));
+            setConfirmRemoveApp(false);
+            setOauthApp(emptyOAuthAppForm());
+            setSignInError(null);
+            // The fields go away: the next save finds and registers an app again.
+            setSignInAppOpen(false);
+            setSignInReason(null);
+            await credentialsQuery.refetch();
+            if (onOAuthComplete)
+                onOAuthComplete();
+        }
+        catch (error) {
+            setConfirmRemoveApp(false);
+            setSignInError((_a = describeApiFailure(error, t)) !== null && _a !== void 0 ? _a : t('mcpOAuthApp.removeFailed'));
+        }
+        finally {
+            setIsSubmitting(false);
+        }
+    }, [
+        editingServer,
+        tenantKey,
+        username,
+        deleteCredentials,
+        t,
+        providerLabel,
+        credentialsQuery,
+        onOAuthComplete,
     ]);
     const handleClose = useCallback(() => {
         if (isSubmitting)
@@ -664,18 +1254,91 @@ function ConnectorDialogs({ open, onClose, onAddConnector, editingServer, editin
         resetForm();
         onClose();
     }, [isSubmitting, resetForm, onClose]);
-    return (jsx(Dialog, { open: open, onOpenChange: handleClose, children: jsxs(DialogContent, { className: "bg-card flex max-h-[90vh] flex-col overflow-hidden p-0 sm:max-w-[600px]", onClick: (e) => e.stopPropagation(), onMouseDown: (e) => e.stopPropagation(), children: [jsx(DialogHeader, { className: "border-border flex-shrink-0 border-b px-6 py-4", children: jsx(DialogTitle, { className: "text-foreground text-xl font-semibold", children: editingServer
-                            ? t('mcpTabConnectorDialogs.editMcpConnector')
-                            : t('mcpTabConnectorDialogs.addMcpConnector') }) }), jsx("div", { className: "flex-1 overflow-y-auto p-6", children: jsxs("div", { className: "mx-auto max-w-2xl space-y-4", children: [jsxs("div", { className: "flex items-center gap-4", children: [jsxs("div", { className: "group relative", children: [jsx("input", { ref: fileInputRef, type: "file", accept: "image/*", onChange: handleImageUpload, className: "hidden", "aria-label": t('mcpTabConnectorDialogs.uploadConnectorImageLabel') }), jsx("div", { onClick: () => { var _a; return (_a = fileInputRef.current) === null || _a === void 0 ? void 0 : _a.click(); }, className: "group relative flex h-16 w-16 cursor-pointer items-center justify-center overflow-hidden rounded-lg transition-colors", children: connectorImage ? (jsxs(Fragment, { children: [jsx("img", { src: connectorImage, alt: t('mcpTabConnectorDialogs.connectorThumbnailAlt'), className: "h-full w-full object-cover" }), jsx("div", { className: "absolute right-1 bottom-1 flex h-6 w-6 items-center justify-center rounded-full bg-[#38A1E5] opacity-0 transition-opacity group-hover:opacity-100", children: jsx(Image, { className: "h-3 w-3 text-white" }) })] })) : (jsx("div", { className: "absolute inset-0 flex items-center justify-center bg-[#38A1E5]", children: jsx(Image, { className: "h-6 w-6 text-white" }) })) })] }), jsxs("div", { className: "flex flex-1 flex-col gap-2", children: [jsxs(Label, { className: "text-base font-medium", children: [t('mcpTabConnectorDialogs.connectorNameLabel'), jsx("span", { className: "text-red-500", children: "*" })] }), jsx(Input, { value: connectorName, onChange: (e) => setConnectorName(e.target.value), placeholder: t('mcpTabConnectorDialogs.connectorNamePlaceholder'), className: "bg-muted border-border", disabled: isSubmitting })] })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs(Label, { className: "text-base font-medium", children: [t('mcpTabConnectorDialogs.connectorServerLabel'), jsx("span", { className: "text-red-500", children: "*" })] }), jsx(Input, { value: connectorServer, onChange: (e) => setConnectorServer(e.target.value), placeholder: t('mcpTabConnectorDialogs.connectorServerPlaceholder'), className: `bg-muted border-border ${oauthUrlError ? 'border-red-500' : ''}`, disabled: isSubmitting }), oauthUrlError && jsx("p", { className: "text-xs text-red-500", children: oauthUrlError })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center justify-between", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.descriptionLabel') }), jsx("span", { className: "text-muted-foreground text-sm", children: t('mcpTabConnectorDialogs.optional') })] }), jsx(Textarea, { value: connectorDescription, onChange: (e) => setConnectorDescription(e.target.value), placeholder: t('mcpTabConnectorDialogs.descriptionPlaceholder'), className: "bg-muted border-border min-h-[100px]", disabled: isSubmitting })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.connectorScopeLabel') }), jsxs(RadioGroup, { value: connectorScope, onValueChange: (value) => setConnectorScope(value), disabled: isSubmitting, children: [jsxs("div", { className: "flex items-center space-x-2", children: [jsx(RadioGroupItem, { value: "tenant", id: "scope-tenant" }), jsx(Label, { htmlFor: "scope-tenant", className: "cursor-pointer font-normal", children: t('mcpTabConnectorDialogs.allAgents') })] }), jsxs("div", { className: "flex items-center space-x-2", children: [jsx(RadioGroupItem, { value: "this-mentor", id: "scope-this-mentor" }), jsx(Label, { htmlFor: "scope-this-mentor", className: "cursor-pointer font-normal", children: t('mcpTabConnectorDialogs.thisAgent') })] })] }), connectorScope === 'tenant' && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.mcpAvailableAllAgents') })), connectorScope === 'this-mentor' && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.mcpAvailableThisAgent') }))] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.transportLabel') }), jsxs(Select, { value: transport, onValueChange: (value) => setTransport(normalizeTransportValue(value)), disabled: isSubmitting, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: TransportEnum.SSE, children: "SSE" }), jsx(SelectItem, { value: TransportEnum.WEBSOCKET, children: t('mcpTabConnectorDialogs.websocket') }), jsx(SelectItem, { value: TransportEnum.STREAMABLE_HTTP, children: t('mcpTabConnectorDialogs.streamableHttp') })] })] })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.authMethodLabel') }), jsxs(Select, { value: authMethod, onValueChange: setAuthMethod, disabled: isSubmitting, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: "no-auth", children: t('mcpTabConnectorDialogs.noAuthentication') }), jsx(SelectItem, { value: "api-key", children: t('mcpTabConnectorDialogs.apiKey') }), jsx(SelectItem, { value: "oauth", children: t('mcpTabConnectorDialogs.oauth') })] })] })] }), authMethod === 'oauth' && (jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.authScopeLabel') }), jsxs(Select, { value: authScope, onValueChange: setAuthScope, disabled: isSubmitting, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: AUTH_SCOPE.TENANT, children: t('mcpTabConnectorDialogs.tenant') }), jsx(SelectItem, { value: AUTH_SCOPE.MENTOR, children: t('mcpTabConnectorDialogs.agent') }), jsx(SelectItem, { value: AUTH_SCOPE.USER, children: t('mcpTabConnectorDialogs.user') })] })] }), authScope === AUTH_SCOPE.TENANT && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.oauthScopeTenantHint') })), authScope === AUTH_SCOPE.MENTOR && (jsx("div", { className: "flex items-center gap-1.5", children: jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.oauthScopeMentorHint') }) })), authScope === AUTH_SCOPE.USER && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.oauthScopeUserHint') }))] })), authMethod === 'api-key' && (jsxs("div", { className: "space-y-4 pt-2", children: [jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.tokenTypeLabel') }), jsxs(Select, { value: tokenType, onValueChange: setTokenType, disabled: isSubmitting, children: [jsx(SelectTrigger, { className: "bg-background border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: "Bearer", children: "Bearer" }), jsx(SelectItem, { value: "Basic", children: "Basic" }), jsx(SelectItem, { value: "API-Key", children: "API-Key" }), jsx(SelectItem, { value: "API-Token", children: "API-Token" }), jsx(SelectItem, { value: "Token", children: "Token" }), jsx(SelectItem, { value: "Other", children: t('mcpTabConnectorDialogs.other') })] })] })] }), tokenType === 'Other' && (jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.customTokenTypeLabel') }), jsx(Input, { value: customTokenType, onChange: (e) => setCustomTokenType(e.target.value), placeholder: t('mcpTabConnectorDialogs.customTokenTypePlaceholder'), className: "bg-background border-border", disabled: isSubmitting, maxLength: 50 }), jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.customTokenTypeHint') })] })), jsxs("div", { className: "flex flex-col gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.tokenLabel') }), jsxs("div", { className: "relative", children: [jsx(Lock, { className: "text-muted-foreground absolute top-1/2 left-3 h-4 w-4 -translate-y-1/2" }), jsx(Input, { value: tokenValue, onChange: (e) => setTokenValue(e.target.value), placeholder: t('mcpTabConnectorDialogs.tokenPlaceholder'), type: "password", className: "bg-background border-border pl-10", disabled: isSubmitting })] }), credentialsMasked && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.existingTokenHidden') }))] })] })), jsx("div", { className: "flex justify-end", children: jsx(Button, { onClick: handleSubmit, disabled: !connectorName.trim() ||
-                                        !connectorServer.trim() ||
-                                        isSubmitting ||
-                                        (authMethod === 'oauth' && !!oauthUrlError) ||
-                                        (authMethod === 'api-key' && tokenType === 'Other' && !customTokenType.trim()), className: "ibl-button-primary shrink-0", children: isSubmitting
-                                        ? t('mcpTabConnectorDialogs.saving')
-                                        : editingServer
-                                            ? t('mcpTabConnectorDialogs.update')
-                                            : t('mcpTabConnectorDialogs.connect') }) })] }) })] }) }));
+    // The sign-in app, shown only when the connector needs one entered by hand:
+    // why, then the fields once the provider is known, or one sentence when not.
+    const signInAppMessage = (jsx("p", { className: "text-muted-foreground text-xs", "data-testid": "mcp-sign-in-message", children: signInReason && !restricted
+            ? t(signInReason === 'existing'
+                ? 'mcpTabConnectorDialogs.needsManualAppExisting'
+                : signInReason === 'metadata'
+                    ? 'mcpTabConnectorDialogs.needsManualAppMetadata'
+                    : 'mcpTabConnectorDialogs.needsManualApp')
+            : t('mcpTabConnectorDialogs.appCredentialsOnlyHint', { name: providerLabel }) }));
+    const signInAppControls = (jsxs(Fragment, { children: [providerState === 'known' || findsWithApp ? (jsx(OAuthAppFields, { form: oauthApp, onChange: (form) => {
+                    setOauthApp(form);
+                    setAppFieldErrors({});
+                }, configured: manualAppConfigured && !findsWithApp, providerName: providerLabel, sharedClientAllowed: storedApp === null || storedApp === void 0 ? void 0 : storedApp.shared_client_allowed, disabled: isSubmitting, endpoints: appEndpoints, extraParams: !findsWithApp, fieldErrors: appFieldErrors })) : (jsxs("div", { className: "flex flex-col gap-2", children: [jsx("p", { "data-testid": "mcp-sign-in-provider", className: providerState === 'checking'
+                            ? 'text-muted-foreground text-xs'
+                            : 'text-xs text-red-500', children: t(providerState === 'checking'
+                            ? 'mcpTabConnectorDialogs.signInProviderChecking'
+                            : providerState === 'failed'
+                                ? 'mcpTabConnectorDialogs.signInProviderLoadFailed'
+                                : 'mcpTabConnectorDialogs.signInProviderUnknown') }), providerState === 'failed' && (jsx(Button, { type: "button", variant: "outline", size: "sm", "data-testid": "mcp-sign-in-provider-retry", className: "self-start", onClick: () => void providersQuery.refetch(), children: t('mcpTabConnectorDialogs.signInProviderRetry') }))] })), appConfigured && editingServer && (jsx(Button, { type: "button", variant: "outline", size: "sm", "data-testid": "mcp-oauth-app-remove", disabled: isSubmitting, onClick: () => setConfirmRemoveApp(true), className: "text-red-600 hover:bg-red-50 hover:text-red-700", children: t('mcpOAuthApp.remove') })), signInError && (jsx("p", { role: "alert", "data-testid": "mcp-sign-in-error", className: "text-xs text-red-500", children: signInError }))] }));
+    const removeAppDialog = (jsx(AlertDialog, { open: confirmRemoveApp, onOpenChange: (next) => !next && setConfirmRemoveApp(false), children: jsxs(AlertDialogContent, { "data-testid": "mcp-oauth-app-remove-confirm", children: [jsxs(AlertDialogHeader, { children: [jsx(AlertDialogTitle, { children: t('mcpOAuthApp.removeTitle', { name: providerLabel }) }), jsx(AlertDialogDescription, { children: t('mcpOAuthApp.removeBody') })] }), jsxs(AlertDialogFooter, { children: [jsx(AlertDialogCancel, { disabled: isSubmitting, children: t('mcpTabConnectorManagementContent.cancel') }), jsx(AlertDialogAction, { "data-testid": "mcp-oauth-app-remove-confirm-button", disabled: isSubmitting, onClick: (event) => {
+                                event.preventDefault();
+                                void removeSignInApp();
+                            }, className: "bg-red-600 hover:bg-red-700", children: t('mcpOAuthApp.removeConfirm') })] })] }) }));
+    // In the restricted form, every control about the connector itself is shown
+    // as it is and cannot be changed; only its settings for this agent can.
+    const lockedField = isSubmitting || restricted;
+    // The host keeps an agent's choice only for a connector with a sign-in
+    // service; one without cannot sign in, so there is nothing to choose.
+    const lockedAuthScope = isSubmitting || (restricted && !(editingServer === null || editingServer === void 0 ? void 0 : editingServer.oauth_service_data));
+    const savedSignInScope = editingServer ? currentSignInScope(editingServer) : null;
+    // A changed, unsaved Authentication Scope would sign in at a scope nothing has stored yet.
+    const showConnection = !!connection &&
+        !!(editingServer === null || editingServer === void 0 ? void 0 : editingServer.oauth_service_data) &&
+        ((_e = editingServer.auth_type) === null || _e === void 0 ? void 0 : _e.toLowerCase()) === 'oauth2' &&
+        authMethod === 'oauth' &&
+        authScope === savedSignInScope &&
+        (connection.connected || connection.canConnect || connection.canDisconnect);
+    const connectionInfoKey = savedSignInScope === AUTH_SCOPE.TENANT
+        ? 'mcpTabConnectorDialogs.connectionInfoOrganization'
+        : savedSignInScope === AUTH_SCOPE.MENTOR
+            ? 'mcpTabConnectorDialogs.connectionInfoAgent'
+            : 'mcpTabConnectorDialogs.connectionInfoUser';
+    return (jsxs(Fragment, { children: [jsx(Dialog, { open: open, onOpenChange: handleClose, children: jsxs(DialogContent, { ref: contentRef, className: "bg-card flex max-h-[90vh] flex-col overflow-hidden p-0 sm:max-w-[600px]", onClick: (e) => e.stopPropagation(), onMouseDown: (e) => e.stopPropagation(), onOpenAutoFocus: (event) => {
+                        var _a;
+                        // Left to Radix, focus lands on the first info icon and opens its tooltip.
+                        event.preventDefault();
+                        const nameInput = nameInputRef.current;
+                        if (nameInput && !nameInput.disabled)
+                            nameInput.focus();
+                        else
+                            (_a = contentRef.current) === null || _a === void 0 ? void 0 : _a.focus();
+                    }, children: [jsx(DialogHeader, { className: "border-border flex-shrink-0 border-b px-6 py-4", children: jsx(DialogTitle, { className: "text-foreground text-xl font-semibold", children: editingServer
+                                    ? t('mcpTabConnectorDialogs.editMcpConnector')
+                                    : t('mcpTabConnectorDialogs.addMcpConnector') }) }), jsx("div", { className: "flex-1 overflow-y-auto p-6", children: jsxs("div", { className: "mx-auto max-w-2xl space-y-4", children: [jsxs("div", { className: "flex items-center gap-4", children: [jsxs("div", { className: "group relative", children: [jsx("input", { ref: fileInputRef, type: "file", accept: "image/*", onChange: handleImageUpload, className: "hidden", "aria-label": t('mcpTabConnectorDialogs.uploadConnectorImageLabel'), disabled: restricted }), jsx("div", { onClick: () => { var _a; return !restricted && ((_a = fileInputRef.current) === null || _a === void 0 ? void 0 : _a.click()); }, "aria-disabled": restricted || undefined, className: `group relative flex h-16 w-16 items-center justify-center overflow-hidden rounded-lg transition-colors ${restricted ? 'cursor-not-allowed opacity-50' : 'cursor-pointer'}`, children: connectorImage ? (jsxs(Fragment, { children: [jsx("img", { src: connectorImage, alt: t('mcpTabConnectorDialogs.connectorThumbnailAlt'), className: "h-full w-full object-cover" }), !restricted && (jsx("div", { className: "absolute right-1 bottom-1 flex h-6 w-6 items-center justify-center rounded-full bg-[#38A1E5] opacity-0 transition-opacity group-hover:opacity-100", children: jsx(Image, { className: "h-3 w-3 text-white" }) }))] })) : (jsx("div", { className: "absolute inset-0 flex items-center justify-center bg-[#38A1E5]", children: jsx(Image, { className: "h-6 w-6 text-white" }) })) })] }), jsxs("div", { className: "flex flex-1 flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsxs(Label, { className: "text-base font-medium", children: [t('mcpTabConnectorDialogs.connectorNameLabel'), jsx("span", { className: "text-red-500", children: "*" })] }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.connectorNameLabel'), text: t('mcpTabConnectorDialogs.connectorNameInfo') })] }), jsx(Input, { ref: nameInputRef, value: connectorName, onChange: (e) => {
+                                                            setConnectorName(e.target.value);
+                                                            setNameError(null);
+                                                        }, placeholder: t('mcpTabConnectorDialogs.connectorNamePlaceholder'), className: `bg-muted border-border ${nameError ? 'border-red-500' : ''}`, disabled: lockedField }), nameError && (jsx("p", { "data-testid": "mcp-connector-name-error", className: "text-xs text-red-500", children: nameError }))] })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsxs(Label, { className: "text-base font-medium", children: [t('mcpTabConnectorDialogs.connectorServerLabel'), jsx("span", { className: "text-red-500", children: "*" })] }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.connectorServerLabel'), text: t('mcpTabConnectorDialogs.connectorServerInfo') })] }), jsx(Input, { value: connectorServer, onChange: (e) => setConnectorServer(e.target.value), placeholder: t('mcpTabConnectorDialogs.connectorServerPlaceholder'), className: `bg-muted border-border ${oauthUrlError ? 'border-red-500' : ''}`, disabled: lockedField }), oauthUrlError && jsx("p", { className: "text-xs text-red-500", children: oauthUrlError })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center justify-between", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.descriptionLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.descriptionLabel'), text: t('mcpTabConnectorDialogs.descriptionInfo') })] }), jsx("span", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.optional') })] }), jsx(Textarea, { value: connectorDescription, onChange: (e) => setConnectorDescription(e.target.value), placeholder: t('mcpTabConnectorDialogs.descriptionPlaceholder'), className: "bg-muted border-border min-h-[100px]", disabled: lockedField })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.connectorScopeLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.connectorScopeLabel'), text: t('mcpTabConnectorDialogs.connectorScopeInfo') })] }), jsxs(RadioGroup, { value: connectorScope, onValueChange: (value) => setConnectorScope(value), disabled: lockedField, children: [jsxs("div", { className: "flex items-center space-x-2", children: [jsx(RadioGroupItem, { value: "tenant", id: "scope-tenant", className: MCP_RADIO_ITEM_CLASS }), jsx(Label, { htmlFor: "scope-tenant", className: restricted
+                                                                    ? 'cursor-not-allowed font-normal opacity-70'
+                                                                    : 'cursor-pointer font-normal', children: t('mcpTabConnectorDialogs.allAgents') })] }), jsxs("div", { className: "flex items-center space-x-2", children: [jsx(RadioGroupItem, { value: "this-mentor", id: "scope-this-mentor", className: MCP_RADIO_ITEM_CLASS }), jsx(Label, { htmlFor: "scope-this-mentor", className: restricted
+                                                                    ? 'cursor-not-allowed font-normal opacity-70'
+                                                                    : 'cursor-pointer font-normal', children: t('mcpTabConnectorDialogs.thisAgent') })] })] }), connectorScope === 'tenant' && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.mcpAvailableAllAgents') })), connectorScope === 'this-mentor' && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.mcpAvailableThisAgent') }))] }), jsxs("div", { className: "flex items-center justify-between gap-4", children: [jsxs("div", { className: "flex flex-col gap-1", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { htmlFor: "connector-user-can-disable", className: "text-base font-medium", children: t('mcpTabConnectorDialogs.userCanDisableLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.userCanDisableLabel'), text: t('mcpTabConnectorDialogs.userCanDisableInfo') })] }), jsx("p", { className: "text-muted-foreground text-xs", children: userCanDisable
+                                                            ? t('mcpTabConnectorDialogs.userCanDisableOnHint')
+                                                            : t('mcpTabConnectorDialogs.userCanDisableOffHint') })] }), jsx(Switch, { id: "connector-user-can-disable", "data-testid": "connector-user-can-disable", checked: userCanDisable, onCheckedChange: setUserCanDisable, disabled: isSubmitting, className: "data-[state=checked]:bg-[#38A1E5] data-[state=unchecked]:bg-gray-200" })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.transportLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.transportLabel'), text: t('mcpTabConnectorDialogs.transportInfo') })] }), jsxs(Select, { value: transport, onValueChange: (value) => setTransport(normalizeTransportValue(value)), disabled: lockedField, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: TransportEnum.SSE, children: "SSE" }), jsx(SelectItem, { value: TransportEnum.WEBSOCKET, children: t('mcpTabConnectorDialogs.websocket') }), jsx(SelectItem, { value: TransportEnum.STREAMABLE_HTTP, children: t('mcpTabConnectorDialogs.streamableHttp') })] })] })] }), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.authMethodLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.authMethodLabel'), text: t('mcpTabConnectorDialogs.authMethodInfo') })] }), jsxs(Select, { value: authMethod, onValueChange: setAuthMethod, disabled: lockedField, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: "no-auth", children: t('mcpTabConnectorDialogs.noAuthentication') }), jsx(SelectItem, { value: "api-key", children: t('mcpTabConnectorDialogs.apiKey') }), jsx(SelectItem, { value: "oauth", children: t('mcpTabConnectorDialogs.oauth') })] })] })] }), authMethod === 'oauth' && (jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.authScopeLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.authScopeLabel'), text: t('mcpTabConnectorDialogs.authScopeInfo') })] }), jsxs(Select, { value: authScope, onValueChange: setAuthScope, disabled: lockedAuthScope, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: AUTH_SCOPE.TENANT, children: t('mcpTabConnectorDialogs.tenant') }), jsx(SelectItem, { value: AUTH_SCOPE.MENTOR, children: t('mcpTabConnectorDialogs.agent') }), jsx(SelectItem, { value: AUTH_SCOPE.USER, children: t('mcpTabConnectorDialogs.user') })] })] }), authScope === AUTH_SCOPE.TENANT && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.oauthScopeTenantHint') })), authScope === AUTH_SCOPE.MENTOR && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.oauthScopeMentorHint') })), authScope === AUTH_SCOPE.USER && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.oauthScopeUserHint') }))] })), showConnection && connection && (jsxs("div", { className: "flex flex-col gap-2", "data-testid": "mcp-connection-row", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.connectionLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.connectionLabel'), text: t(connectionInfoKey) })] }), jsxs("div", { className: "flex items-center justify-between gap-3", children: [jsx("span", { className: "text-sm", "data-testid": "mcp-connection-status", children: connection.connected
+                                                            ? t('mcpTabConnectorDialogs.connected')
+                                                            : t('mcpTabConnectorDialogs.notConnected') }), connection.canDisconnect ? (jsxs(Button, { type: "button", variant: "outline", size: "sm", "data-testid": "mcp-connection-disconnect", className: "h-8 text-red-600 hover:bg-red-50 hover:text-red-700", onClick: () => connection.onDisconnect(), disabled: connection.disconnecting, children: [connection.disconnecting ? (jsx(Spinner, { className: "mr-2 h-4 w-4" })) : (jsx(Unlink, { className: "mr-2 h-4 w-4" })), connection.disconnecting
+                                                                ? t('mcpTabConnectorManagementContent.disconnecting')
+                                                                : t('mcpTabConnectorManagementContent.disconnect')] })) : connection.canConnect ? (jsxs(Button, { type: "button", variant: "outline", size: "sm", "data-testid": "mcp-connection-connect", className: "h-8 border-[#38A1E5] bg-[#38A1E5] text-white hover:bg-[#2d8bc7] hover:text-white", onClick: () => connection.onConnect(), disabled: connection.connecting, children: [connection.connecting ? (jsx(Spinner, { className: "mr-2 h-4 w-4" })) : (jsx(Link2, { className: "mr-2 h-4 w-4" })), connection.connecting
+                                                                ? t('mcpTabConnectorManagementContent.connecting')
+                                                                : t('mcpTabConnectorManagementContent.connect')] })) : null] })] })), authMethod === 'oauth' && signInAppOpen && (jsxs("div", { className: "space-y-4 pt-2", "data-testid": "mcp-sign-in-app", children: [jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.appCredentialsLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.appCredentialsLabel'), text: t('mcpTabConnectorDialogs.appCredentialsInfo') })] }), signInAppMessage] }), signInAppControls] })), authMethod === 'api-key' && (jsxs("div", { className: "space-y-4 pt-2", children: [jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.tokenTypeLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.tokenTypeLabel'), text: t('mcpTabConnectorDialogs.tokenTypeInfo') })] }), jsxs(Select, { value: tokenType, onValueChange: setTokenType, disabled: lockedField, children: [jsx(SelectTrigger, { className: "bg-muted border-border", children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: "Bearer", children: "Bearer" }), jsx(SelectItem, { value: "Basic", children: "Basic" }), jsx(SelectItem, { value: "API-Key", children: "API-Key" }), jsx(SelectItem, { value: "API-Token", children: "API-Token" }), jsx(SelectItem, { value: "Token", children: "Token" }), jsx(SelectItem, { value: "Other", children: t('mcpTabConnectorDialogs.other') })] })] })] }), tokenType === 'Other' && (jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.customTokenTypeLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.customTokenTypeLabel'), text: t('mcpTabConnectorDialogs.customTokenTypeInfo') })] }), jsx(Input, { value: customTokenType, onChange: (e) => setCustomTokenType(e.target.value), placeholder: t('mcpTabConnectorDialogs.customTokenTypePlaceholder'), className: "bg-muted border-border", disabled: lockedField, maxLength: 50 }), jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.customTokenTypeHint') })] })), jsxs("div", { className: "flex flex-col gap-2", children: [jsxs("div", { className: "flex items-center gap-2", children: [jsx(Label, { className: "text-base font-medium", children: t('mcpTabConnectorDialogs.tokenLabel') }), jsx(FieldInfo, { label: t('mcpTabConnectorDialogs.tokenLabel'), text: t('mcpTabConnectorDialogs.tokenInfo') })] }), jsxs("div", { className: "relative", children: [jsx(Lock, { className: "text-muted-foreground absolute top-1/2 left-3 h-4 w-4 -translate-y-1/2" }), jsx(Input, { value: tokenValue, onChange: (e) => setTokenValue(e.target.value), placeholder: t('mcpTabConnectorDialogs.tokenPlaceholder'), type: "password", className: "bg-muted border-border pl-10", disabled: lockedField })] }), credentialsMasked && (jsx("p", { className: "text-muted-foreground text-xs", children: t('mcpTabConnectorDialogs.existingTokenHidden') }))] })] })), jsx("div", { className: "flex justify-end", children: jsx(Button, { onClick: handleSubmit, disabled: isSubmitting ||
+                                                (authMethod === 'oauth' &&
+                                                    signInAppOpen &&
+                                                    !findsWithApp &&
+                                                    providerState !== 'known') ||
+                                                (!restricted &&
+                                                    (!connectorName.trim() ||
+                                                        !connectorServer.trim() ||
+                                                        (authMethod === 'oauth' && !!oauthUrlError && !addressErrorRetryable) ||
+                                                        (authMethod === 'api-key' &&
+                                                            tokenType === 'Other' &&
+                                                            !customTokenType.trim()))), className: "ibl-button-primary shrink-0", children: isSubmitting
+                                                ? t('mcpTabConnectorDialogs.saving')
+                                                : editingServer
+                                                    ? t('mcpTabConnectorDialogs.update')
+                                                    : t('mcpTabConnectorDialogs.connect') }) })] }) })] }) }), removeAppDialog] }));
 }
 
-export { ConnectorDialogs, canCreateOAuthConnection, extractApiErrorMessage, getValidationErrorMessage, validateConnectorForm, validateCustomTokenType };
+export { ConnectorDialogs, canCreateOAuthConnection, extractApiErrorMessage, getValidationErrorMessage, matchProvider, readOAuthFindDiagnostic, validateConnectorForm, validateCustomTokenType };
 //# sourceMappingURL=connector-dialogs.js.map