fix(api): answer /connections per caller, and reload the page on a 401 - #152
Merged
Merged
Conversation
GET /connections worked out `supplied` once, from the process environment. A deployment that sets a per-user credential header for a signed-in caller never has it there, so every such caller was told to paste a token the server was about to supply. It is now resolved for each request, the way a run resolves credentials. The client also had no handling for a 401: an expired session silently started a new thread, or ended a run in `client error`. Every API request, runs included, now goes through a fetch that reloads the page on a 401, so whatever sits in front can send the visitor to sign in. It will not reload again within 30 seconds, so a 401 a reload does not fix cannot loop. Closes #127 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ciaransweet
pushed a commit
that referenced
this pull request
Sep 18, 2026
🤖 I have created a release *beep* *boop* --- ## [0.10.1](mcp-toolsets-runtime-v0.10.0...mcp-toolsets-runtime-v0.10.1) (2026-09-18) ### Features * **api:** one run per thread, and a signal when it ends ([#153](#153)) ([350b21b](350b21b)) ### Bug Fixes * **api:** answer /connections per caller, and reload the page on a 401 ([#152](#152)) ([c55a0fc](c55a0fc)) * **state:** describe a state handle by its shape, not an example key ([#150](#150)) ([163bfac](163bfac)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: ds-release-bot[bot] <116609932+ds-release-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #127.
GET /connectionsworks outsuppliedfor each request, the same way a run resolves credentials, instead of once from the environment. A deployment that sets a per-user header for a signed-in caller (dss's PAT bridge) no longer asks that caller to paste it.apiFetch(js/agent-ui/src/session.ts), which reloads the page on a401, so a sign-in proxy can redirect the visitor to sign in. It won't reload again within 30 seconds, so it can't loop.Tested locally against dss with its PAT bridge. The
401reload has no automated test (agent-uihas no JS tests).Not covered: when oauth2-proxy's own session has expired, it redirects a
fetchto the sign-in page instead of returning401. The browser blocks the cross-origin redirect, so this path never sees a401.🤖 Generated with Claude Code