Problem
The built-in Toolcraft hosted OAuth login form gives no visible feedback after a valid submit. Provider authentication can take up to the configured request timeout, while the Connect button remains enabled and unchanged. Users reasonably conclude that clicking it did nothing and may submit repeatedly.
Reproduction
- Configure
createHTTPMCPServer(..., { oauth: hostedOAuth(...) }) with the built-in provider login form.
- Make
provider.connect() take several seconds.
- Submit valid fields.
- Observe no pending state while the native POST is in flight.
Expected
- Immediate accessible pending feedback.
- Disable duplicate submits while the request is in flight.
- Preserve the native form POST and cross-origin OAuth callback behavior.
- Keep the strict CSP; use a per-response nonce rather than
unsafe-inline.
- Restore the button on BFCache navigation.
- Regression coverage for initial and retry pages.
Problem
The built-in Toolcraft hosted OAuth login form gives no visible feedback after a valid submit. Provider authentication can take up to the configured request timeout, while the Connect button remains enabled and unchanged. Users reasonably conclude that clicking it did nothing and may submit repeatedly.
Reproduction
createHTTPMCPServer(..., { oauth: hostedOAuth(...) })with the built-in provider login form.provider.connect()take several seconds.Expected
unsafe-inline.