improvement(mcp): trace OAuth state writes to diagnose invalid_state clobber

[waleedlatif1]

Summary

• MCP OAuth (app.withgauge.com/mcp and others) fails on the callback with invalid_state ("Authorization expired"). Staging DB + logs confirm the authorization state is cleared ~5s after /oauth/start saves it, before the user authorizes — but clearState was silent, so the clobber never appeared in logs.
• Verified this is the only path that can null an existing row's state: safeDecrypt never touches state (it's a hash, not encrypted), and the discovery/connection paths short-circuit (if (!row.tokens)) before ever running the SDK auth() flow.
• Adds a caller context to saveState/clearState and logs every write, so the exact clobber source is pinned on the next repro — then the precise fix follows.

Type of Change

• Improvement (diagnostic instrumentation)

Testing

Tested manually — lint, typecheck, and 29 OAuth unit tests pass. Instrumentation is behavior-preserving (optional param defaults to unknown).

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 20, 2026 6:43pm

[cursor]

PR Summary

Low Risk
Behavior-preserving logging only; optional context param defaults preserve existing call sites.

Overview
Adds diagnostic logging for MCP OAuth authorization state persistence so production can identify what clears state before the callback (the suspected cause of invalid_state / "Authorization expired").

saveState and clearState in storage.ts now accept an optional context string (default unknown) and emit info logs on every save/clear with rowId and context. Call sites pass explicit labels: provider.state, callback:provider_error, callback:burn-before-exchange, and invalidateCredentials:${scope}.

No change to OAuth behavior beyond observability; existing callers without a context still work via the default.

^{Reviewed by Cursor Bugbot for commit 8bf096a. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds caller context to MCP OAuth state-write diagnostics. The main changes are:

• Logs state saves and clears with the OAuth row ID and caller context.
• Labels provider state creation and credential invalidation.
• Labels provider-error and pre-exchange callback cleanup.

Confidence Score: 5/5

The changed flow looks mergeable after a small cleanup to its diagnostics.

• State persistence and callback behavior remain unchanged.
• All current callers provide bounded context values.
• Production-mode staging suppresses the new state-write traces.

apps/sim/lib/mcp/oauth/storage.ts

Important Files Changed

Filename	Overview
apps/sim/lib/mcp/oauth/storage.ts	Adds context-aware state-write logs, but their level suppresses them in production-mode deployments.
apps/sim/lib/mcp/oauth/provider.ts	Adds bounded context labels for state creation and credential invalidation.
apps/sim/app/api/mcp/oauth/callback/route.ts	Labels provider-error and pre-exchange state clears without changing callback behavior.

_{Reviews (1): Last reviewed commit: "improvement(mcp): trace OAuth state writ..." | Re-trigger Greptile}