@stigmer/react 3.11.0 → 3.12.0

package/src/manifest/__tests__/ApplyManifestDialog.test.tsx

@@ -36,7 +36,7 @@ function entry(
 ): ManifestPreviewEntry {
   return {
     document: {
-      handler: { yamlKind: "datastore", displayName: "Datastore" },
+      handler: { yamlKind: "mcpserver", displayName: "McpServer" },
       name: slug,
       slug,
       org: "acme",
@@ -55,7 +55,7 @@ const applyAllMock = vi.fn(async () => applyAllResult);
 vi.mock("../useApplyManifest", () => ({
   useApplyManifest: (): UseApplyManifestReturn =>
     ({
-      content: "kind: Datastore",
+      content: "kind: McpServer",
       setContent: vi.fn(),
       readFile: vi.fn(),
       entries: mockEntries,

package/src/manifest/__tests__/EditResourceYamlDialog.test.tsx

@@ -1,13 +1,13 @@
 // Tests for the shared Edit-YAML dialog's apply-error affordance
 // (DD-008 SD-6): the server's refusal renders verbatim with
-// Try-again/Dismiss — shared by every kind (McpServer, Agent, Skill,
-// Datastore), so the datastore collection-removal rejection and any
-// other apply-time guard get the same acknowledge-and-retry treatment.
+// Try-again/Dismiss — shared by every kind (McpServer, Agent, Skill),
+// so any apply-time guard gets the same acknowledge-and-retry
+// treatment.
 
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, screen, cleanup, fireEvent } from "@testing-library/react";
 import { create } from "@bufbuild/protobuf";
-import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { EditResourceYamlDialog } from "../EditResourceYamlDialog";
 import type { useEditResourceYaml } from "../useEditResourceYaml";
 
@@ -34,7 +34,7 @@ let editState: Partial<EditState>;
 
 vi.mock("../useEditResourceYaml", () => ({
   useEditResourceYaml: () => ({
-    yaml: "kind: Datastore",
+    yaml: "kind: McpServer",
     setYaml: vi.fn(),
     validation: { status: "valid" as const },
     target: { action: "update" as const, slug: "clinic" },
@@ -54,8 +54,8 @@ vi.mock("../YamlEditor", () => ({
   YamlEditor: () => <div data-testid="yaml-editor" />,
 }));
 
-const RESOURCE = create(DatastoreSchema, {
-  metadata: { id: "dst_1", slug: "clinic", org: "acme", name: "Clinic" },
+const RESOURCE = create(McpServerSchema, {
+  metadata: { id: "mcp_1", slug: "clinic", org: "acme", name: "Clinic" },
 });
 
 function renderDialog() {
@@ -73,14 +73,14 @@ describe("EditResourceYamlDialog — apply-error affordance", () => {
   it("renders the server's refusal verbatim with Try again and Dismiss", () => {
     editState = {
       error: new Error(
-        'collection "old_notes" was removed from the spec; re-apply with the removal acknowledged',
+        'spec change refused by an apply-time guard; re-apply with the change acknowledged',
       ),
     };
     renderDialog();
 
     const alert = screen.getByRole("alert");
     expect(alert.textContent).toContain(
-      'collection "old_notes" was removed from the spec',
+      "spec change refused by an apply-time guard",
     );
     expect(screen.getByRole("button", { name: "Try again" })).toBeTruthy();
     expect(screen.getByRole("button", { name: "Dismiss error" })).toBeTruthy();

package/src/mcp-server/McpServerConfigPanel.tsx

@@ -14,7 +14,11 @@ import {
   type EnvVarFormSubmitOptions,
 } from "../environment/EnvVarForm.js";
 import { McpToolSelector } from "./McpToolSelector.js";
-import type { OAuthConnectPhase } from "./useMcpServerOAuthConnect.js";
+import { VendorApprovalBlockedNotice } from "./VendorApprovalBlockedNotice.js";
+import {
+  getOAuthConnectErrorMessage,
+  type OAuthConnectPhase,
+} from "./useMcpServerOAuthConnect.js";
 
 // ---------------------------------------------------------------------------
 // Credential sub-props
@@ -93,8 +97,27 @@ export interface McpServerOAuthSignInProps {
   readonly onClearDisconnectError?: () => void;
   /** Error from the most recent failed OAuth attempt, or `null`. */
   readonly error: Error | null;
+  /**
+   * The OAuth flow phase in which {@link error} was thrown, or `null`.
+   *
+   * Threading it lets the panel compose error copy through
+   * `getOAuthConnectErrorMessage`: a `"connecting"`-phase failure means
+   * sign-in SUCCEEDED and only the chained tool discovery failed —
+   * without this, the raw RPC error reads as a failed sign-in
+   * (stigmer/stigmer#418).
+   */
+  readonly failedPhase?: OAuthConnectPhase | null;
   /** Clear the OAuth error state. */
   readonly onClearError: () => void;
+  /**
+   * `true` when the user is signed in but the server has no discovered
+   * tools — the "signed in — tools not discovered yet" state
+   * (stigmer/stigmer#229/#418). The action button reads "Discover tools"
+   * and `onSignIn` is expected to run bare discovery instead of the
+   * OAuth popup. The caller owns that branch; this prop only drives
+   * presentation.
+   */
+  readonly isOAuthStranded?: boolean;
   /**
    * `true` when the platform's OAuth app is pending vendor approval.
    * Disables the sign-in button and shows an informational message.
@@ -120,6 +143,16 @@ export interface McpServerOAuthSignInProps {
    * `true` when an org-level BYOA override is active.
    */
   readonly isOrgOAuthApp?: boolean;
+  /**
+   * Whether a manually-entered static token can authenticate this server
+   * (`false` for `oauth_only` servers whose endpoint rejects static
+   * tokens). Consulted by the vendor-approval-blocked message so it never
+   * recommends manual entry on a server where it cannot work.
+   * When omitted, falls back to whether `onSwitchToManual` is wired on
+   * {@link McpServerConfigPanelProps} — callers gate that affordance on
+   * the same fact.
+   */
+  readonly manualEntrySupported?: boolean;
   /**
    * Open the BYOA form. The parent is responsible for rendering the
    * form/dialog and handling the mutation.
@@ -331,6 +364,8 @@ export function McpServerConfigPanel({
           disconnectError={oauthSignIn.disconnectError}
           onClearDisconnectError={oauthSignIn.onClearDisconnectError}
           error={oauthSignIn.error}
+          failedPhase={oauthSignIn.failedPhase}
+          isOAuthStranded={oauthSignIn.isOAuthStranded}
           onClearError={oauthSignIn.onClearError}
           isVendorApprovalPending={oauthSignIn.isVendorApprovalPending}
           isVendorApprovalBlocked={oauthSignIn.isVendorApprovalBlocked}
@@ -340,6 +375,7 @@ export function McpServerConfigPanel({
           onBringOwnApp={oauthSignIn.onBringOwnApp}
           onRemoveOrgApp={oauthSignIn.onRemoveOrgApp}
           isRemovingOrgApp={oauthSignIn.isRemovingOrgApp}
+          manualEntrySupported={oauthSignIn.manualEntrySupported}
           onSwitchToManual={onSwitchToManual}
         />
       )}
@@ -451,6 +487,8 @@ function InlineOAuthSignIn({
   disconnectError,
   onClearDisconnectError,
   error,
+  failedPhase,
+  isOAuthStranded,
   onClearError,
   isVendorApprovalPending,
   isVendorApprovalBlocked,
@@ -460,6 +498,7 @@ function InlineOAuthSignIn({
   onBringOwnApp,
   onRemoveOrgApp,
   isRemovingOrgApp,
+  manualEntrySupported,
   onSwitchToManual,
 }: {
   readonly serverName: string;
@@ -472,6 +511,8 @@ function InlineOAuthSignIn({
   readonly disconnectError?: Error | null;
   readonly onClearDisconnectError?: () => void;
   readonly error: Error | null;
+  readonly failedPhase?: OAuthConnectPhase | null;
+  readonly isOAuthStranded?: boolean;
   readonly onClearError: () => void;
   readonly isVendorApprovalPending?: boolean;
   readonly isVendorApprovalBlocked?: boolean;
@@ -481,6 +522,7 @@ function InlineOAuthSignIn({
   readonly onBringOwnApp?: () => void;
   readonly onRemoveOrgApp?: () => Promise<void>;
   readonly isRemovingOrgApp?: boolean;
+  readonly manualEntrySupported?: boolean;
   readonly onSwitchToManual?: () => void;
 }) {
   const [disconnectPhase, setDisconnectPhase] = useState<InlineDisconnectPhase>("idle");
@@ -494,17 +536,28 @@ function InlineOAuthSignIn({
     phase === "completing" ||
     phase === "connecting";
 
-  const signInDisabled = isBusy || (!!blocked && !isOrgOAuthApp);
+  // Stranded ("signed in — tools not discovered yet", stigmer/stigmer#418):
+  // the action is bare tool discovery, which needs no OAuth app — so the
+  // vendor-approval block must not gate it.
+  const stranded = !!isOAuthStranded;
+
+  const signInDisabled = isBusy || (!!blocked && !isOrgOAuthApp && !stranded);
   const anyBusy = isBusy || !!isDisconnecting || !!isRemovingOrgApp;
 
   const needsReAuth =
     connectionHealth === OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED;
 
-  const status = inlineHealthProps(
-    connectionHealth,
-    isConnected,
-    !!isVendorApprovalPending && !isOrgOAuthApp,
-  );
+  const status = stranded
+    ? {
+        textClass: "stg:text-amber-600 stg:dark:text-amber-400",
+        dotClass: "stg:bg-amber-500",
+        label: "Signed in \u2014 tools not discovered yet",
+      }
+    : inlineHealthProps(
+        connectionHealth,
+        isConnected,
+        !!isVendorApprovalPending && !isOrgOAuthApp,
+      );
 
   const showDisconnectLink =
     isConnected && onDisconnect && !anyBusy && disconnectPhase === "idle";
@@ -668,7 +721,7 @@ function InlineOAuthSignIn({
           disabled={signInDisabled}
           className={cn(
             "stg:inline-flex stg:items-center stg:gap-1 stg:rounded stg:px-2 stg:py-0.5 stg:text-[0.65rem] stg:font-medium",
-            isConnected && !needsReAuth
+            isConnected && !needsReAuth && !stranded
               ? "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover"
               : "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
             "stg:disabled:pointer-events-none stg:disabled:opacity-50",
@@ -676,6 +729,8 @@ function InlineOAuthSignIn({
         >
           {isBusy ? (
             <InlineSpinner />
+          ) : stranded ? (
+            "Discover tools"
           ) : isOrgOAuthApp && !isConnected ? (
             "Sign in with your app"
           ) : isConnected && !needsReAuth ? (
@@ -689,34 +744,16 @@ function InlineOAuthSignIn({
       </div>
 
       {/* Vendor approval blocked message with BYOA CTA */}
-      {blocked && !isConnected && !isOrgOAuthApp && (
-        <div className="stg:text-[0.65rem] stg:text-amber-700 stg:dark:text-amber-300">
-          <p>
-            OAuth sign-in is pending vendor approval.
-            {canBringOwnApp && onBringOwnApp
-              ? " You can use your own OAuth app or enter a token manually."
-              : ""}
-          </p>
-          {canBringOwnApp && onBringOwnApp && (
-            <button
-              type="button"
-              onClick={onBringOwnApp}
-              className="stg:mt-1 stg:inline-flex stg:items-center stg:gap-1 stg:rounded stg:bg-amber-600 stg:px-2 stg:py-0.5 stg:text-[0.6rem] stg:font-medium stg:text-white stg:hover:bg-amber-700 stg:dark:bg-amber-500 stg:dark:text-amber-950 stg:dark:hover:bg-amber-400"
-            >
-              Use your own OAuth app
-            </button>
-          )}
-          {vendorApprovalDocsUrl && !canBringOwnApp && (
-            <a
-              href={vendorApprovalDocsUrl}
-              target="_blank"
-              rel="noopener noreferrer"
-              className="stg:underline stg:decoration-amber-600/40 stg:underline-offset-2 stg:hover:decoration-amber-600 stg:dark:decoration-amber-400/40 stg:dark:hover:decoration-amber-400"
-            >
-              Learn how to bring your own token
-            </a>
-          )}
-        </div>
+      {!isConnected && !isOrgOAuthApp && (
+        <VendorApprovalBlockedNotice
+          blocked={!!blocked}
+          pending={!!isVendorApprovalPending}
+          manualEntrySupported={manualEntrySupported ?? Boolean(onSwitchToManual)}
+          canBringOwnApp={Boolean(canBringOwnApp && onBringOwnApp)}
+          docsUrl={vendorApprovalDocsUrl ?? null}
+          onBringOwnApp={onBringOwnApp}
+          compact
+        />
       )}
 
       {/* Org override indicator when not connected */}
@@ -728,7 +765,12 @@ function InlineOAuthSignIn({
 
       {error && (
         <div className="stg:flex stg:items-start stg:gap-1.5 stg:text-[0.65rem] stg:text-destructive" role="alert">
-          <span className="stg:flex-1">{getUserMessage(error)}</span>
+          {/* Phase-aware copy: a "connecting"-phase failure means sign-in
+              succeeded and only tool discovery failed — the raw RPC message
+              alone reads as a failed sign-in (stigmer/stigmer#418). */}
+          <span className="stg:flex-1">
+            {getOAuthConnectErrorMessage(error, failedPhase ?? null)}
+          </span>
           <div className="stg:flex stg:shrink-0 stg:items-center stg:gap-1.5">
             {isRetryableError(error) && (
               <button

package/src/mcp-server/McpServerConnectDialog.tsx

@@ -13,6 +13,7 @@ import { EnvVarForm } from "../environment/EnvVarForm.js";
 import { ErrorMessage } from "../error/ErrorMessage.js";
 import { StdioSandboxNotice } from "./StdioSandboxNotice.js";
 import { OAuthRequiredNotice } from "./OAuthRequiredNotice.js";
+import { VendorApprovalBlockedNotice } from "./VendorApprovalBlockedNotice.js";
 
 /** Props for {@link McpServerConnectDialog}. */
 export interface McpServerConnectDialogProps {
@@ -33,6 +34,17 @@ export interface McpServerConnectDialogProps {
   readonly onClose: () => void;
   /** Called after a successful connect with the server name. */
   readonly onConnected?: (serverName: string) => void;
+  /**
+   * Called when the user needs the server's detail page — today the
+   * "Use your own OAuth app" escape hatch shown when the platform OAuth
+   * app is vendor-approval blocked on an `oauth_only` server, since the
+   * BYOA form lives on the detail page, not in this dialog.
+   *
+   * The host owns navigation (and should close the dialog itself if its
+   * route keeps this component mounted). When omitted, the blocked notice
+   * still explains the state; only the navigation affordance is dropped.
+   */
+  readonly onOpenDetails?: () => void;
   /** Additional CSS classes for the dialog element. */
   readonly className?: string;
 }
@@ -73,6 +85,7 @@ export function McpServerConnectDialog({
   open,
   onClose,
   onConnected,
+  onOpenDetails,
   className,
 }: McpServerConnectDialogProps) {
   const dialogRef = useRef<HTMLDialogElement>(null);
@@ -125,6 +138,7 @@ export function McpServerConnectDialog({
           activeOrg={resolvedOrg}
           onClose={onClose}
           onConnected={onConnected}
+          onOpenDetails={onOpenDetails}
         />
       </div>
     </dialog>
@@ -137,12 +151,14 @@ function ConnectDialogContent({
   activeOrg,
   onClose,
   onConnected,
+  onOpenDetails,
 }: {
   readonly org: string;
   readonly slug: string;
   readonly activeOrg: string;
   readonly onClose: () => void;
   readonly onConnected?: (serverName: string) => void;
+  readonly onOpenDetails?: () => void;
 }) {
   const { mcpServer, isLoading: isServerLoading, error: serverError } = useMcpServer(org, slug);
   const creds = useMcpServerCredentials(activeOrg, mcpServer);
@@ -327,11 +343,16 @@ function ConnectDialogContent({
           phase={oauth.phase}
           onSignIn={handleOAuthSignIn}
           isVendorApprovalBlocked={creds.isVendorApprovalBlocked}
+          isVendorApprovalPending={creds.isVendorApprovalPending}
+          manualEntrySupported={creds.manualEntrySupported}
+          canBringOwnApp={creds.canBringOwnApp}
+          vendorApprovalDocsUrl={creds.vendorApprovalDocsUrl}
           onSwitchToManual={
             creds.manualEntrySupported
               ? () => creds.setManualOverride(true)
               : undefined
           }
+          onOpenDetails={onOpenDetails}
           disabled={isConnectingPhase}
         />
       )}
@@ -437,15 +458,26 @@ function OAuthSection({
   phase,
   onSignIn,
   isVendorApprovalBlocked,
+  isVendorApprovalPending,
+  manualEntrySupported,
+  canBringOwnApp,
+  vendorApprovalDocsUrl,
   onSwitchToManual,
+  onOpenDetails,
   disabled,
 }: {
   readonly isConnected: boolean;
   readonly phase: OAuthConnectPhase;
   readonly onSignIn: () => void;
   readonly isVendorApprovalBlocked: boolean;
+  readonly isVendorApprovalPending: boolean;
+  readonly manualEntrySupported: boolean;
+  readonly canBringOwnApp: boolean;
+  readonly vendorApprovalDocsUrl: string | null;
   /** When omitted (e.g. `oauth_only` servers), no manual-entry link is shown. */
   readonly onSwitchToManual?: () => void;
+  /** Navigates to the detail page, where the BYOA form lives. */
+  readonly onOpenDetails?: () => void;
   readonly disabled?: boolean;
 }) {
   if (isConnected) {
@@ -482,11 +514,15 @@ function OAuthSection({
         {isInProgress && <LoadingSpinner size="sm" />}
         {isInProgress ? (phaseLabel[phase] ?? "Connecting...") : "Sign in with OAuth"}
       </button>
-      {isVendorApprovalBlocked && onSwitchToManual && (
-        <p className="stg:text-xs stg:text-muted-foreground">
-          OAuth sign-in is pending vendor approval. You can enter your token manually instead.
-        </p>
-      )}
+      <VendorApprovalBlockedNotice
+        blocked={isVendorApprovalBlocked}
+        pending={isVendorApprovalPending}
+        manualEntrySupported={manualEntrySupported}
+        canBringOwnApp={canBringOwnApp}
+        docsUrl={vendorApprovalDocsUrl}
+        onBringOwnApp={onOpenDetails}
+        className="stg:rounded-md stg:border stg:border-amber-500/20"
+      />
       {onSwitchToManual && (
         <button
           type="button"

package/src/mcp-server/McpServerDetailView.tsx

@@ -26,11 +26,13 @@ import {
 import type { OAuthConnectPhase } from "./useMcpServerOAuthConnect.js";
 import { StdioSandboxNotice } from "./StdioSandboxNotice.js";
 import { OAuthRequiredNotice } from "./OAuthRequiredNotice.js";
+import { VendorApprovalBlockedNotice } from "./VendorApprovalBlockedNotice.js";
 import { useDisconnectOAuth } from "./useDisconnectOAuth.js";
 import { useOrgOAuthApp } from "./useOrgOAuthApp.js";
 import { OAuthAppForm } from "./OAuthAppForm.js";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ErrorMessage } from "../error/ErrorMessage.js";
+import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
 import { EnvVarForm } from "../environment/EnvVarForm.js";
 import type { EnvVarFormVariable } from "../environment/EnvVarForm.js";
 import { VisibilityBadge } from "../library/VisibilitySelector.js";
@@ -1135,38 +1137,15 @@ function ConnectBar({
 
       {/* Vendor approval blocked banner with BYOA CTA */}
       {oauthSignInDisabled && (
-        <div className="stg:flex stg:items-start stg:gap-2 stg:border-t stg:border-amber-500/20 stg:bg-amber-500/5 stg:px-3 stg:py-2">
-          <WarningIcon className="stg:mt-0.5 stg:size-3.5 stg:shrink-0 stg:text-amber-600 stg:dark:text-amber-400" />
-          <div className="stg:flex-1 stg:text-xs stg:text-amber-700 stg:dark:text-amber-300">
-            <p>
-              The platform&apos;s OAuth app is awaiting vendor approval.
-              {canBringOwnApp
-                ? " You can use your own OAuth app or enter a token manually."
-                : " You can still connect by entering your own token manually."}
-            </p>
-            {canBringOwnApp && (
-              <button
-                type="button"
-                onClick={onBringOwnApp}
-                data-cursor-target="byoa-cta-button"
-                className="stg:mt-1.5 stg:inline-flex stg:items-center stg:gap-1 stg:rounded-md stg:bg-amber-600 stg:px-2.5 stg:py-1 stg:text-[11px] stg:font-medium stg:text-white stg:hover:bg-amber-700 stg:dark:bg-amber-500 stg:dark:text-amber-950 stg:dark:hover:bg-amber-400"
-              >
-                Use your own OAuth app
-              </button>
-            )}
-            {vendorApprovalDocsUrl && !canBringOwnApp && (
-              <a
-                href={vendorApprovalDocsUrl}
-                target="_blank"
-                rel="noopener noreferrer"
-                className="stg:mt-1 stg:inline-flex stg:items-center stg:gap-1 stg:underline stg:decoration-amber-600/40 stg:underline-offset-2 stg:hover:decoration-amber-600 stg:dark:decoration-amber-400/40 stg:dark:hover:decoration-amber-400"
-              >
-                Learn how to bring your own token
-                <ExternalLinkIcon className="stg:size-3 stg:shrink-0" />
-              </a>
-            )}
-          </div>
-        </div>
+        <VendorApprovalBlockedNotice
+          blocked
+          pending={isVendorApprovalPending}
+          manualEntrySupported={manualEntrySupported}
+          canBringOwnApp={canBringOwnApp}
+          docsUrl={vendorApprovalDocsUrl}
+          onBringOwnApp={onBringOwnApp}
+          className="stg:border-t stg:border-amber-500/20"
+        />
       )}
 
       {/* Secondary actions: manual entry, BYOA, back to OAuth. Suppressed
@@ -1660,13 +1639,18 @@ function renderHeaderValue(value: string): React.ReactNode {
       parts.push(value.slice(lastIndex, match.index));
     }
     parts.push(
-      <span
-        key={match.index}
-        className="stg:inline-flex stg:items-center stg:gap-0.5 stg:rounded stg:bg-primary-subtle stg:px-1 stg:py-px stg:text-[10px] stg:font-medium stg:text-primary"
-        title={`Resolved from environment variable: ${match[1]}`}
-      >
-        {match[0]}
-      </span>,
+      <Tooltip key={match.index}>
+        <TooltipTrigger
+          render={
+            <span className="stg:inline-flex stg:items-center stg:gap-0.5 stg:rounded stg:bg-primary-subtle stg:px-1 stg:py-px stg:text-[10px] stg:font-medium stg:text-primary" />
+          }
+        >
+          {match[0]}
+        </TooltipTrigger>
+        <TooltipContent side="top">
+          {`Resolved from environment variable: ${match[1]}`}
+        </TooltipContent>
+      </Tooltip>,
     );
     lastIndex = match.index + match[0].length;
   }

package/src/mcp-server/McpServerPicker.tsx

@@ -13,6 +13,7 @@ import { cn } from "@stigmer/theme";
 import type { EnvVarInput, McpServerUsageInput, ResourceRef } from "@stigmer/sdk";
 import type { SearchResult } from "@stigmer/protos/ai/stigmer/search/v1/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OAuthConnectionHealth } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import { VendorApprovalStatus } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
 import type { EnvVarFormSubmitOptions } from "../environment/EnvVarForm.js";
 import { useMcpServerSearch } from "./useMcpServerSearch.js";
@@ -20,6 +21,7 @@ import { useScrollShadows } from "../internal/useScrollShadows.js";
 import { ScrollFade } from "../internal/ScrollFade.js";
 import { McpServerConfigPanel } from "./McpServerConfigPanel.js";
 import type { McpServerSetupEntry } from "./mcpServerSetupReducer.js";
+import { useMcpServerConnect } from "./useMcpServerConnect.js";
 import { useMcpServerOAuthConnect } from "./useMcpServerOAuthConnect.js";
 import { ScopeToggle } from "../library/ScopeToggle.js";
 import type { ResourceListScope } from "../search/index.js";
@@ -269,6 +271,17 @@ export function McpServerPicker({
   const { results, isLoading, error, query, setQuery } =
     useMcpServerSearch(org, { scope: activeScope });
   const oauth = useMcpServerOAuthConnect();
+  // Bare tool-discovery `connect`, used when sign-in already succeeded and
+  // only the chained discovery leg failed — relaunching the OAuth popup
+  // would burn a consent round for nothing (stigmer/stigmer#418).
+  const discovery = useMcpServerConnect();
+  // The oauth/discovery hooks are single instances shared by every server
+  // in the picker, so their error/phase/failedPhase signals are only
+  // meaningful for the server an attempt was started for. Without this
+  // key, server A's discovery failure would render under server B's
+  // configure view — and worse, make B's sign-in click retry discovery
+  // for a grant B never had.
+  const [oauthAttemptKey, setOauthAttemptKey] = useState<string | null>(null);
 
   const [focusIndex, setFocusIndex] = useState(-1);
   const [view, setView] = useState<PickerView>(() =>
@@ -431,28 +444,105 @@ export function McpServerPicker({
       (oauthStatus?.vendorApprovalStatus === VendorApprovalStatus.PENDING ||
         oauthStatus?.vendorApprovalStatus === VendorApprovalStatus.REJECTED);
 
+    // System env vars are only injected when the server declares them —
+    // the dialog and detail view pass these on every OAuth chain and
+    // bare connect; the picker must too.
+    const declaredEnvKeys = Object.keys(entry.mcpServer.spec?.env ?? {});
+
+    // Scope the shared hooks' signals to the server they belong to.
+    const isOwnOAuthAttempt = oauthAttemptKey === view.serverKey;
+    const oauthError = isOwnOAuthAttempt ? oauth.error : null;
+    const oauthFailedPhase = isOwnOAuthAttempt ? oauth.failedPhase : null;
+    const discoveryError = isOwnOAuthAttempt ? discovery.error : null;
+
+    // "Signed in — tools not discovered yet" (the stigmer/stigmer#229
+    // two-act persistence gap, picker arm: stigmer/stigmer#418). Two
+    // signals, mirroring the detail view:
+    // - In-flow: the OAuth chain broke in its "connecting" phase, so
+    //   sign-in succeeded and only discovery failed — the entry's own
+    //   data is still stale at this point.
+    // - Server truth: the entry resolved ready off a usable grant with
+    //   nothing discovered. Survives popover close/reopen, where the
+    //   in-flow signal dies with the hook. Token-expired grants are
+    //   excluded — re-auth, not discovery, is their next step.
+    const isDiscoveryRetry = oauthFailedPhase === "connecting";
+    const grantUsable =
+      entry.oauthConnectionHealth ===
+        OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY ||
+      entry.oauthConnectionHealth ===
+        OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE;
+    const isOAuthStranded =
+      isDiscoveryRetry ||
+      (hasOAuth &&
+        entry.status === "ready" &&
+        grantUsable &&
+        entry.discoveredTools.length === 0);
+
     const oauthSignInProps =
       hasOAuth && !isManualOverride
         ? {
             onSignIn: async () => {
               if (!entry.mcpServer.metadata?.id) return;
+              const serverId = entry.mcpServer.metadata.id;
+              const connectOrg = activeOrg ?? org;
+              setOauthAttemptKey(view.serverKey);
+
+              if (isOAuthStranded) {
+                // Sign-in already succeeded — the grant is stored
+                // server-side. Retry bare discovery; never relaunch the
+                // popup (stigmer/stigmer#418).
+                try {
+                  await discovery.connect(
+                    serverId,
+                    connectOrg,
+                    undefined,
+                    declaredEnvKeys,
+                  );
+                  // Discovery succeeded — retire the chain's stale
+                  // failure and re-evaluate the entry so it resolves
+                  // ready with the discovered tools.
+                  oauth.clearError();
+                  setup.onServerAdded(ref);
+                } catch {
+                  // error state managed by the discovery hook
+                }
+                return;
+              }
+
               try {
-                await oauth.startOAuth(
-                  entry.mcpServer.metadata.id,
-                  activeOrg ?? org,
-                );
+                await oauth.startOAuth(serverId, connectOrg, declaredEnvKeys);
                 setup.onServerAdded(ref);
               } catch {
                 // error state managed by oauth hook
               }
             },
-            phase: oauth.phase,
+            // oauth.phase stays unscoped on purpose: it disables every
+            // server's sign-in button while a popup flow is in flight,
+            // preventing two concurrent flows over the same hook.
+            phase:
+              discovery.isConnecting && isOwnOAuthAttempt
+                ? ("connecting" as const)
+                : oauth.phase,
             isConnected: !oauthTokenMissing,
-            error: oauth.error,
-            onClearError: oauth.clearError,
+            connectionHealth: entry.oauthConnectionHealth,
+            error: oauthError ?? discoveryError,
+            // A bare-discovery failure is by definition a discovery-leg
+            // failure — keep the honest "signed in, but discovery
+            // failed" copy for it.
+            failedPhase: oauthError
+              ? oauthFailedPhase
+              : discoveryError
+                ? ("connecting" as const)
+                : null,
+            isOAuthStranded,
+            onClearError: () => {
+              oauth.clearError();
+              discovery.clearError();
+            },
             isVendorApprovalPending,
             isVendorApprovalBlocked,
             vendorApprovalDocsUrl: oauthStatus?.vendorApprovalDocsUrl || null,
+            manualEntrySupported,
           }
         : undefined;
 
@@ -757,6 +847,7 @@ function SetupServerRow({
               "stg:text-warning stg:hover:bg-warning/10",
               "stg:disabled:pointer-events-none stg:disabled:opacity-50",
             )}
+            aria-label={`Configure ${slug}`}
           >
             Configure
           </button>
@@ -778,6 +869,7 @@ function SetupServerRow({
               "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
               "stg:disabled:pointer-events-none stg:disabled:opacity-50",
             )}
+            aria-label={`Configure ${slug}`}
           >
             {entry.discoveredTools.length > 0 && (
               <span>