fix(oauth): say that a stale sign-in link was used instead of "try again"

The runtime's callback listener rejects a callback whose state is not
the current attempt's - the browser finished a link from an earlier
attempt, since every retry issues a new one. That failure was folded
into the generic oauth_login_failed; it is now oauth_state_mismatch and
the dialog explains to start again and open the link shown now. The
raw runtime message still never crosses the protocol.

Author: devswha

server/gjc-bun-oauth-controller.ts

@@ -271,11 +271,18 @@ export class GjcBunOAuthController {
         },
         signal: attempt.abortController.signal,
       });
-    } catch {
+    } catch (error) {
       if (!this.#isActive(attempt)) return;
       clearTimeout(attempt.timeout);
       this.#active = undefined;
-      this.#transition(attempt, 'failed', { errorCode: 'oauth_login_failed' });
+      // The runtime's callback listener rejects a callback whose `state` is
+      // not this attempt's: the browser finished a link from an earlier
+      // attempt (a retry issues a new one). Named so the dialog can say
+      // "use the newest link" instead of a generic "try again"; the raw
+      // message never crosses the protocol.
+      const message = error instanceof Error ? error.message : String(error);
+      const errorCode = /state mismatch/i.test(message) ? 'oauth_state_mismatch' : 'oauth_login_failed';
+      this.#transition(attempt, 'failed', { errorCode });
       return;
     }
 

server/gjc-sdk-contract.bun.test.ts

@@ -825,6 +825,31 @@ test('OAuth refresh failure preserves persisted auth state and reports a distinc
   }
 });
 
+test('a callback from an earlier attempt fails as a state mismatch, named but never quoted', async () => {
+  const f = await fixture(
+    'contract-model',
+    undefined,
+    { id: 'contract-model', provider: 'contract-provider' },
+    undefined,
+    async () => { throw new Error('State mismatch - possible CSRF attack (canary)'); },
+  );
+  try {
+    await f.host.handle(request('oauth.start', 'oauth-state-mismatch', { providerId: 'openai-codex' }));
+    const start = ((response(f.frames, 'oauth-state-mismatch').payload as Record<string, unknown>).result ?? {}) as Record<string, unknown>;
+    const attemptId = start.attemptId as string;
+    const failed = await waitFor(() => f.frames
+      .filter((frame) => frame.method === 'oauth.phase')
+      .map((frame) => frame.payload as Record<string, unknown>)
+      .find((phase) => phase.attemptId === attemptId && phase.phase === 'failed'));
+
+    assert.equal(failed.errorCode, 'oauth_state_mismatch');
+    assert.equal(JSON.stringify(f.frames).includes('canary'), false);
+    assert.equal(JSON.stringify(f.frames).includes('CSRF'), false);
+  } finally {
+    await f.close();
+  }
+});
+
 test('OAuth automatic callback flow completes without a manual submit', async () => {
   const f = await fixture(
     'contract-model',

src/components/chat/hooks/useOAuthLogin.ts

@@ -194,6 +194,8 @@ const safeFailure = (code: string): OAuthLoginFailure => {
       return { code, message: 'Connection lost. Reconnect before continuing sign-in.' };
     case 'oauth_model_refresh_failed':
       return { code, message: 'Sign-in was saved, but available models could not be refreshed.' };
+    case 'oauth_state_mismatch':
+      return { code, message: 'The link you opened belongs to an earlier sign-in attempt. Each attempt issues a new link: start again and open the link shown now.' };
     default:
       return { code: 'oauth_failed', message: 'Sign-in could not be completed. Try again.' };
   }

src/components/chat/tests/OAuthLogin.test.tsx

@@ -79,6 +79,13 @@ test('OAuth failure messages distinguish disconnect and persisted-login refresh
   assert.equal(oauthFailureForCode('raw-provider-error').code, 'oauth_failed');
 });
 
+test('a state mismatch tells the person to use the newest link', () => {
+  const failure = oauthFailureForCode('oauth_state_mismatch');
+  assert.equal(failure.code, 'oauth_state_mismatch');
+  assert.match(failure.message, /earlier sign-in attempt/);
+  assert.match(failure.message, /link shown now/);
+});
+
 test('OAuth terminal failures expose safe retry messages without raw provider errors', () => {
   for (const code of ['oauth_login_failed', 'oauth_timed_out', 'raw-provider-error']) {
     const failure = oauthFailureForCode(code);