fix(den): harden imported MCP connection recovery

[reachjalil]

Summary

This follow-up lands after #2853 and #2851 and closes the end-to-end review findings around imported MCP authentication recovery.

• Make Den the source of truth for marketplace connection setup. Usable and manageable connection payloads now expose safe readiness booleans (setupRequired, oauthClientConfigured, required/mismatched auth) without exposing the OAuth client ID to members.
• Persist each plugin binding's required authentication policy and exact connection ownership. Admin repair rejects incompatible auth choices, moves bindings safely, and deletes an old plugin-owned connection only after a row-locked, in-transaction reference check.
• Preserve required auth in imported MCP payloads, clear stale no-auth connected state after failed revalidation, and compensate failed imports by removing created bindings/connections and archiving the incomplete plugin.
• Accept spec-legal MCP servers that advertise resources/prompts but no tools capability; tools/list validation now runs only when tools are advertised.
• Surface credential-invalidation failures together with callback-validation failures instead of silently leaving exchanged tokens behind.
• Keep legacy callback rows on their legacy OAuth identity: CIMD metadata is advertised only for shared-callback connections.
• Isolate concurrent OAuth popups with unique names and tolerate browser window-isolation SecurityErrors.
• Update the stale callback migration contract and the Den OAuth mock to reflect the real MCP protocol.

Why this is separate

#2853 established provider OAuth interoperability and #2851 added imported MCP authentication recovery. This PR is rebased on the merged #2851 commit and contains only the hardening and regression fixes found during the combined end-to-end review.

Verification

• pnpm --filter @openwork/enterprise-mcp-client typecheck
• pnpm --filter @openwork/enterprise-mcp-client test — 42 passed
• pnpm --filter @openwork-ee/den-web typecheck
• pnpm --filter @openwork-ee/den-api exec tsc --noEmit --pretty false
• Den web focused tests — 25 passed:
  • marketplace-mcp-readiness.test.ts
  • mcp-oauth-callback-migration.test.ts
  • mcp-authorization-url.test.ts
• Den API database-backed tests, each run in isolation against a fresh isolated current-schema MySQL database:
  • enterprise-mcp-oauth-persistence.test.ts — 6 passed
  • mcp-connections-edit.test.ts — 15 passed
  • marketplace-cloud-readiness.test.ts — 31 passed
  • mcp-connections-required-by.test.ts — 2 passed
  • mcp-connections-connect-start.test.ts — 15 passed
• Generated and applied migration 0043_talented_meteorite.sql to the isolated Den database.
• git diff --check

End-to-end behavior proved

1. An imported Slack-style OAuth requirement is blocked when the stored auth type is wrong.
2. An admin cannot recreate that mismatch through repair.
3. Repair persists the required auth and exact ownership, preserves unrelated/admin-owned connections, and removes only an unreferenced plugin-owned predecessor.
4. Once the org OAuth app is configured, scope=usable returns oauthClientConfigured: true and setupRequired: false without returning the client ID, so members can reach Connect your account.
5. Existing legacy callback rows continue through the legacy callback route without being re-advertised as shared-callback CIMD clients.
6. Resources-only MCP servers initialize successfully without an invalid tools/list request.
7. A failed post-callback validation attempts credential invalidation, and a failed invalidation remains visible in the returned error chain.

Remaining external verification

Live consent and tool calls against third-party production tenants (for example Slack, Salesforce, Vercel, or Descript) were not run because they require provider accounts and registered OAuth applications. The generic protocol, persistence, callback, and readiness paths they use are covered by the focused mock-server and database-backed journeys above.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 16, 2026 10:21pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openwork-diagnostics	Skipped		Jul 16, 2026 10:21pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

Deployment failed with the following error:

Creating the Deployment Timed Out.