René's URL Explorer Experiment

Title: fix(mcp): bound and tear down one-shot OAuth fetches so auth can't hang by waleedlatif1 · Pull Request #5789 · simstudioai/sim · GitHub

Open Graph Title: fix(mcp): bound and tear down one-shot OAuth fetches so auth can't hang by waleedlatif1 · Pull Request #5789 · simstudioai/sim

X Title: fix(mcp): bound and tear down one-shot OAuth fetches so auth can't hang by waleedlatif1 · Pull Request #5789 · simstudioai/sim

Description: Summary Root-caused the Gauge MCP OAuth "Connecting… forever" hang on staging: the SSRF-guarded fetch used for all one-shot OAuth legs (discovery, dynamic client registration, token exchange/refresh, RFC 7009 revocation) created a fresh pinned undici Agent per request and never destroyed it, and returned the live response so the MCP SDK read the body outside any deadline. The SDK sets no timeout on OAuth legs, so a stalled body read or an accumulating leaked keep-alive socket could leave the callback (and the browser waiting on it) pending indefinitely. Empirically confirmed via a staging diagnostic + DB: the callback burned its state, completed discovery, then hung before the token POST — no token exchange, no error, tokens never persisted. An isolated repro proved the SDK/flow itself reaches the token POST in <1s; the guard's lifecycle was the fault. What changed Buffer the (always-small) OAuth JSON body inside the guard, under the composed deadline/caller AbortSignal, then return a detached in-memory Response. undici's bodyTimeout only measures idle gaps between chunks and cannot bound a slow-drip/stalled body — the AbortSignal is the only true wall-clock deadline over the body read, so the read now lives inside it. destroy() (not close()) the per-request pinned Agent on every path so a one-shot leg can't strand its keep-alive socket, and teardown itself can't hang on an in-flight request. Fixed the same per-request Agent leak in the auth-type probe (tears the Agent down after best-effort session cleanup settles). Returning a normalized global Response also makes provider token-endpoint errors surface cleanly instead of the SDK's opaque "[object Response]" parse failure. Aligned with the official MCP TypeScript SDK's contract (all lifecycle/deadline enforcement lives in the injected fetch) and undici best practice (per-request pinned Agent → buffer body → destroy(); AbortSignal as the authoritative deadline). Type of Change Bug fix Testing Unit: 14 guard tests (pinning, teardown on success/failure, detached-body readability, deadline over a stalled body read, DNS/abort composition) + updated probe/revoke suites — full lib/mcp suite green (366 tests). Integration against live Gauge: drove the real SDK auth() with the new guard behavior — reaches the token POST, returns in ~1.9s, 0 leaked Agents (8 created / 8 destroyed), and surfaces a clean invalid_grant message. tsc clean; biome clean. Not yet re-run through the full staging OAuth flow end-to-end (the temporary McpHttpDiag logging from #5782 is still live and will confirm the token POST now fires; a follow-up removes it once verified). Checklist Code follows project style guidelines Self-reviewed my changes Tests added/updated and passing No new warnings introduced I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Open Graph Description: Summary Root-caused the Gauge MCP OAuth "Connecting… forever" hang on staging: the SSRF-guarded fetch used for all one-shot OAuth legs (discovery, dynamic client registration, token exch...

X Description: Summary Root-caused the Gauge MCP OAuth &quot;Connecting… forever&quot; hang on staging: the SSRF-guarded fetch used for all one-shot OAuth legs (discovery, dynamic client registration, to...

Opengraph URL: https://github.com/simstudioai/sim/pull/5789

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width