Repository navigation
Conversation
…me Link An aggregating MCP gateway (the apro AgentCore gateway with its interceptor) serves one single-use authorization link per user and provider to every concurrent tool call that needs consent. Each call raised its own URL elicitation card with that same link, so after the first click the other cards pointed at a dead session (AgentCore answers 400 "Invalid request" on a second open), and the extra cards also ate the per-server pending-authorization cap, which is how "Too many pending authorizations" surfaced for the slack call on apro-prod while github and tempo cards were open. Concurrent calls that receive the same link now join the first call's flow: one card, one click authorizes them all, and each call retries once consent completes. A retry that still needs consent (the user clicked "I've authorized" without finishing) now reads as incomplete authorization with the link to open, instead of the raw -32042. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
On apro-prod (ai.apro.is), an agent fanning out parallel
invoke_toolcalls on theaprogateway got one URL elicitation card per call. The gateway's interceptor now serves one authorization link per user and provider to all of them (genai-infra LibreChat-AI#469), and AgentCore Identity links are single-use: the first open answers 302 to the provider, every later open answers 400Invalid request. So the second and third cards carried a dead link, and the duplicate cards also consumed the three-per-server pending cap (Too many pending authorizationson the slack call while github and tempo cards were open, 2026-10-27 22:28 UTC).What
MCPManager.callTool: concurrent calls that receive the same(user, server, url)join the first call'smcp_elicitflow instead of raising their own card; each retriestools/callonce consent completes. The join map is released with the flow.-32042now throws… Authorization did not complete. Open <url> to authorize, then retry.instead of the raw error with a dead link.Tests
urlElicitation.integration.test.ts: two concurrent gated calls → oneelicitationStart, onecreateFlow, both results authorized; a "complete" without consent → the incomplete-authorization error. All 46 elicitation tests and the 211MCPManagertests pass.🤖 Generated with Claude Code