smart-mcp-proxy
diff --git a/‎cmd/mcpproxy/auth_cmd.go‎
Lines changed: 39 additions & 9 deletions b/‎cmd/mcpproxy/auth_cmd.go‎
Lines changed: 39 additions & 9 deletions
diff --git a/‎docs/bugs/oauth-reconnection-after-login.md‎
Lines changed: 82 additions & 46 deletions b/‎docs/bugs/oauth-reconnection-after-login.md‎
Lines changed: 82 additions & 46 deletions
diff --git a/‎frontend/src/components/ServerCard.vue‎
Lines changed: 80 additions & 14 deletions b/‎frontend/src/components/ServerCard.vue‎
Lines changed: 80 additions & 14 deletions
diff --git a/‎frontend/src/stores/servers.ts‎
Lines changed: 17 additions & 0 deletions b/‎frontend/src/stores/servers.ts‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎frontend/src/types/api.ts‎
Lines changed: 3 additions & 0 deletions b/‎frontend/src/types/api.ts‎
Lines changed: 3 additions & 0 deletions
@@ -230,6 +230,8 @@ func runAuthStatusClientMode(ctx context.Context, dataDir, serverName string, al
 		authenticated, _ := srv["authenticated"].(bool)
 		connected, _ := srv["connected"].(bool)
 		lastError, _ := srv["last_error"].(string)
+		enabled, _ := srv["enabled"].(bool)
+		userLoggedOut, _ := srv["user_logged_out"].(bool)
 
 		// Check if this is an OAuth server by:
 		// 1. Has oauth config OR
@@ -245,18 +247,46 @@ func runAuthStatusClientMode(ctx context.Context, dataDir, serverName string, al
 
 		hasOAuthServers = true
 
-		// Determine status emoji and text (improved logic)
+		// Determine status emoji and text using oauth_status for accurate state
+		oauthStatus, _ := srv["oauth_status"].(string)
 		var status string
-		if authenticated && connected {
-			status = "✅ Authenticated & Connected"
-		} else if authenticated && !connected {
-			status = "✅ Authenticated (Disconnected)"
+
+		// Check priority states first
+		if !enabled {
+			// Server is disabled - no reconnection attempts
+			status = "⏸️  Disabled"
+		} else if userLoggedOut {
+			// User explicitly logged out - no auto-reconnection
+			status = "🚪 Logged Out (Login Required)"
 		} else if connected {
-			status = "⚠️  Connected (No OAuth Token)"
-		} else if lastError != "" {
-			status = "❌ Authentication Failed"
+			// Connected states
+			if authenticated {
+				status = "✅ Authenticated & Connected"
+			} else {
+				status = "⚠️  Connected (No OAuth Token)"
+			}
 		} else {
-			status = "⏳ Pending Authentication"
+			// Disconnected states - use oauth_status for clarity
+			switch oauthStatus {
+			case "authenticated":
+				// Token valid but not connected - likely reconnecting
+				status = "⏳ Reconnecting (Token Valid)"
+			case "expired":
+				// Token expired - needs re-authentication
+				status = "⚠️  Token Expired (Login Required)"
+			case "error":
+				status = "❌ Authentication Error"
+			default:
+				// No token or oauth_status not set
+				if lastError != "" {
+					status = "❌ Authentication Failed"
+				} else if authenticated {
+					// Fallback: has token but no oauth_status
+					status = "⏳ Reconnecting"
+				} else {
+					status = "⏳ Pending Authentication"
+				}
+			}
 		}
 
 		fmt.Printf("Server: %s\n", name)
 
@@ -1,5 +1,10 @@
 # Bug: Server doesn't connect immediately after OAuth login
 
+## Status: FIXED
+
+**Fixed in:** PR #181 (fix/oauth-reconnection-after-login branch)
+**Fix Date:** 2025-12-07
+
 ## Summary
 After successful OAuth authentication via browser flow, the server remains in "Disconnected" status instead of automatically connecting. Users must manually restart the server to establish a connection.
 
@@ -9,82 +14,113 @@ After OAuth login completes successfully:
 2. Server automatically attempts connection using the new token
 3. Server status updates to "Connected" in UI
 
-## Actual Behavior
+## Actual Behavior (BEFORE FIX)
 After OAuth login completes:
 1. Token is saved to persistent storage ✅
 2. `RetryConnection` is called but fails with "OAuth authentication required"
 3. Server remains "Disconnected" despite having a valid token
 
 ## Root Cause Analysis
 
-The issue is in `internal/upstream/core/connection.go` lines 1028-1033:
-
-```go
-// Check if we have a recently completed OAuth flow that should have tokens
-if oauth.GetTokenStoreManager().HasRecentOAuthCompletion(c.serverName) {
-    c.logger.Info("OAuth flow recently completed, tokens should be available",
-        zap.String("server", c.serverName))
-    // Skip the browser flow since tokens should be available
-}
-```
-
-**Problem**: The code logs "Skip the browser flow since tokens should be available" but doesn't actually change the control flow. The browser OAuth flow is still triggered, which fails because OAuth is already complete.
+The issue was in `internal/upstream/core/connection.go`:
 
-### Why this happens:
+1. **Cross-process OAuth issue**: When CLI completed OAuth, the daemon's `HasRecentOAuthCompletion()` check returned false because it only checks in-memory state (per-process)
+2. **Missing token pre-check**: The code didn't directly check if a valid persisted token existed before triggering browser OAuth flow
+3. **No flow skip logic**: Even when a valid token was detected, the code only logged the finding but didn't actually skip the browser OAuth flow
 
-1. **Managed client calls `RetryConnection`** (`internal/upstream/manager.go:1326-1355`)
-2. **Core client's `Connect()` is called** which goes through `connectWithOAuth()`
-3. **`connectWithOAuth()` checks `HasRecentOAuthCompletion()`** but only logs - doesn't skip OAuth
-4. **OAuth flow coordinator returns "flow already active" or times out**
-5. **Connection fails** even though valid token exists in storage
+### Why this happened:
 
-### The architectural issue:
+1. **Managed client calls `RetryConnection`** (`internal/upstream/manager.go`)
+2. **Core client's `Connect()` is called** which goes through `tryOAuthAuth()`
+3. **`tryOAuthAuth()` checks `HasRecentOAuthCompletion()`** - but this is per-process, so cross-process OAuth (CLI → daemon) wasn't detected
+4. **OAuth flow coordinator triggers browser flow** even though valid token exists in storage
+5. **Connection fails** unnecessarily
 
-The core client (`internal/upstream/core/`) doesn't directly read tokens from the persistent token store during connection. Instead:
-- Tokens are managed by `PersistentTokenStore` in `internal/oauth/persistent_token_store.go`
-- Core client relies on OAuth flow to provide tokens
-- When OAuth flow is skipped/already complete, no mechanism exists to retrieve existing tokens
+## The Fix
 
-## Proposed Fix
+The fix adds three key improvements to `internal/upstream/core/connection.go`:
 
-Option A: **Skip OAuth flow when recent completion detected**
+### 1. Direct Persisted Token Check (lines ~1032-1045)
 ```go
-if oauth.GetTokenStoreManager().HasRecentOAuthCompletion(c.serverName) {
-    c.logger.Info("OAuth flow recently completed, using existing token")
-    // Actually skip the OAuth flow - just attempt connection with existing token
-    return c.connectWithExistingToken(ctx)
+// First check for valid persisted token directly (handles cross-process OAuth)
+hasTokenPrecheck, hasRefreshPrecheck, tokenExpiredPrecheck := oauth.HasPersistedToken(c.config.Name, c.config.URL, c.storage)
+if hasTokenPrecheck && !tokenExpiredPrecheck {
+    logger.Info("🔄 Valid OAuth token found in persistent storage - will skip browser flow if OAuth error occurs",
+        zap.String("server", c.config.Name),
+        zap.Bool("has_refresh_token", hasRefreshPrecheck))
+    skipBrowserFlow = true
+} else if tokenManager.HasRecentOAuthCompletion(c.config.Name) {
+    // Also check in-memory completion flag (same-process OAuth)
+    ...
 }
 ```
 
-Option B: **Add token retrieval to core client**
-- Add method to retrieve token from persistent store
-- Use token directly in HTTP transport without triggering OAuth flow
+### 2. Skip Browser Flow When Token Exists (lines ~1217-1230)
+```go
+if client.IsOAuthAuthorizationRequiredError(lastErr) {
+    // CRITICAL FIX: If we have a valid persisted token (e.g., from CLI OAuth),
+    // skip browser flow and return retriable error. The token exists but
+    // the mcp-go client needs to pick it up on retry.
+    if skipBrowserFlow {
+        c.logger.Info("🔄 OAuth authorization error but valid token exists - skipping browser flow",
+            zap.String("server", c.config.Name),
+            zap.String("tip", "Token should be used on next connection attempt"))
+
+        c.clearOAuthState()
+        return fmt.Errorf("OAuth token exists in storage, retry connection to use it: %w", lastErr)
+    }
+    // ... proceed with browser flow only if no valid token exists
+}
+```
 
-Option C: **Fix RetryConnection to reinitialize transport with token**
-- When `RetryConnection` is called after OAuth completion
-- Reinitialize the HTTP transport with the token from storage
-- Skip the full OAuth flow
+### 3. Same Fix Applied to SSE OAuth Flow (lines ~1465-1683)
+The same `skipBrowserFlow` logic was applied to the SSE OAuth flow to handle SSE-based OAuth servers.
 
 ## Affected Files
 - `internal/upstream/core/connection.go` - Main fix location
-- `internal/upstream/core/client.go` - May need token retrieval method
-- `internal/upstream/manager.go` - RetryConnection logic
+  - HTTP OAuth flow: lines ~1026-1350
+  - SSE OAuth flow: lines ~1465-1710
 
-## Reproduction Steps
+## Test Results
+- ✅ Core unit tests pass
+- ✅ OAuth unit tests pass
+- ✅ OAuth E2E tests pass (29 tests)
+- ✅ API E2E tests pass (except 1 unrelated test)
+
+## Reproduction Steps (BEFORE FIX)
 1. Configure an OAuth-enabled server (e.g., cloudflare-logs)
 2. Start mcpproxy - server shows as "Disconnected"
 3. Click "Login" button or run `mcpproxy auth login --server=<name>`
 4. Complete OAuth flow in browser
 5. Observe: Server still shows "Disconnected" despite successful login
 6. Click "Restart" to manually connect
 
-## Impact
-- User experience degradation - requires manual intervention after OAuth
-- Confusion about whether OAuth succeeded
-- Extra clicks/commands to get server connected
+## Expected Behavior (AFTER FIX)
+1. Configure an OAuth-enabled server
+2. Start mcpproxy - server shows as "Disconnected"
+3. Complete OAuth login via CLI or Web UI
+4. Server automatically retries connection with existing token
+5. Server status updates to "Connected" (or returns retriable error for managed client to retry)
 
-## Priority
-Medium - Workaround exists (manual restart), but UX is poor
+## Additional Improvements
+
+### 4. "Connecting" State Notification (notifications.go)
+Added `StateConnecting` to the state change notifier so UI shows "Connecting" immediately when reconnection starts:
+```go
+case types.StateConnecting:
+    // Notify when connection attempt starts (important for UI feedback after OAuth)
+    if oldState != types.StateConnecting {
+        nm.NotifyServerConnecting(serverName)
+    }
+```
+
+This triggers an SSE event to refresh the UI, showing "Connecting" badge instead of "Disconnected" during reconnection.
+
+## Impact
+- ✅ Better user experience - no manual intervention needed after OAuth
+- ✅ Clear feedback about OAuth status ("Connecting" badge during reconnection)
+- ✅ Reduced confusion about whether OAuth succeeded
+- ✅ Real-time UI updates via SSE when connection state changes
 
 ## Related
 - Feature 009: Proactive OAuth Token Refresh (this bug was discovered during testing)
 
@@ -174,12 +174,41 @@ const loading = ref(false)
 const showDeleteConfirmation = ref(false)
 
 const needsOAuth = computed(() => {
-  // Check if server requires OAuth authentication
+  // Don't show Login button if server is disabled
+  if (!props.server.enabled) return false
+
+  // Don't show Login button while connecting (let the connection attempt finish)
+  if (props.server.connecting) return false
+
   const isHttpProtocol = props.server.protocol === 'http' || props.server.protocol === 'streamable-http'
-  const notConnected = !props.server.connected
-  const isEnabled = props.server.enabled
+  if (!isHttpProtocol) return false
+
+  // Don't show Login if already connected
+  if (props.server.connected) return false
+
+  // Check if server has OAuth configuration
+  const hasOAuthConfig = props.server.oauth !== null && props.server.oauth !== undefined
+  if (!hasOAuthConfig) return false
+
+  // Show Login if user explicitly logged out
+  if (props.server.user_logged_out) {
+    return true
+  }
+
+  // Use oauth_status for more accurate token state detection
+  // Show Login if: no token, expired token, or error state
+  const oauthStatus = props.server.oauth_status
+  if (oauthStatus === 'expired' || oauthStatus === 'error' || oauthStatus === 'none') {
+    return true
+  }
 
-  // Check for OAuth-related errors in last_error
+  // Fallback: if oauth_status not available, use authenticated flag
+  // Show Login if not authenticated (no stored token)
+  if (!props.server.authenticated) {
+    return true
+  }
+
+  // Check for OAuth-related errors that indicate re-authentication is needed
   const hasOAuthError = props.server.last_error && (
     props.server.last_error.includes('authorization') ||
     props.server.last_error.includes('OAuth') ||
@@ -188,21 +217,58 @@ const needsOAuth = computed(() => {
     props.server.last_error.includes('Missing or invalid access token')
   )
 
-  // Check if server has OAuth configuration
-  const hasOAuthConfig = props.server.oauth !== null && props.server.oauth !== undefined
-
-  // Check if server is authenticated
-  const notAuthenticated = !props.server.authenticated
-
-  return isHttpProtocol && notConnected && isEnabled && (hasOAuthError || (hasOAuthConfig && notAuthenticated))
+  return hasOAuthError
 })
 
 const canLogout = computed(() => {
-  // Show logout button if server is authenticated (has OAuth token)
+  // Don't show Logout button if server is disabled
+  if (!props.server.enabled) return false
+
+  // Don't show Logout if user already explicitly logged out
+  if (props.server.user_logged_out) return false
+
   const isHttpProtocol = props.server.protocol === 'http' || props.server.protocol === 'streamable-http'
-  const isAuthenticated = props.server.authenticated === true
+  if (!isHttpProtocol) return false
+
+  const hasToken = props.server.authenticated === true
+  if (!hasToken) return false
+
+  // Show Logout when:
+  // 1. Connected with valid token (normal case)
+  // 2. Has error but token is still valid (user may want to clear token to re-authenticate)
+  //
+  // Don't show Logout when:
+  // - Disconnected without error and token expired (show Login instead)
+  // - Server is connecting (wait for connection to complete)
+
+  if (props.server.connecting) return false
+
+  // If connected, always show Logout (user can log out of working connection)
+  if (props.server.connected) return true
+
+  // If not connected but has error, check if it's an OAuth authentication error
+  // If OAuth auth is required, show Login instead of Logout
+  if (props.server.last_error) {
+    // Don't show Logout if oauth_status says token is expired
+    // In that case, Login is more appropriate
+    if (props.server.oauth_status === 'expired') return false
+
+    // Don't show Logout if the error indicates OAuth authentication is required
+    // This means the stored token isn't valid, so Login is more appropriate
+    const isOAuthRequired = props.server.last_error.includes('OAuth authentication required') ||
+      props.server.last_error.includes('authorization') ||
+      props.server.last_error.includes('401') ||
+      props.server.last_error.includes('invalid_token')
+    if (isOAuthRequired) return false
+
+    return true
+  }
+
+  // Not connected, no error, has token - mcpproxy is likely trying to reconnect
+  // Show Logout only if token is still valid (authenticated status)
+  if (props.server.oauth_status === 'authenticated') return true
 
-  return isHttpProtocol && isAuthenticated
+  return false
 })
 
 async function toggleEnabled() {
 
@@ -207,15 +207,32 @@ export const useServersStore = defineStore('servers', () => {
 
   async function triggerOAuthLogout(serverName: string) {
     try {
+      const server = servers.value.find(s => s.name === serverName)
+
+      // Optimistic update: clear authentication status immediately
+      // This ensures Login button appears right away instead of waiting for SSE
+      if (server) {
+        server.authenticated = false
+      }
+
       const response = await api.triggerOAuthLogout(serverName)
       if (response.success) {
         // The SSE event will trigger a full refresh with actual state
         return true
       } else {
+        // Revert optimistic update on error
+        if (server) {
+          server.authenticated = true
+        }
         throw new Error(response.error || 'Failed to trigger OAuth logout')
       }
     } catch (error) {
       console.error('Failed to trigger OAuth logout:', error)
+      // Revert optimistic update on error
+      const server = servers.value.find(s => s.name === serverName)
+      if (server) {
+        server.authenticated = true
+      }
       throw error
     }
   }
 
@@ -24,6 +24,9 @@ export interface Server {
     auth_url: string
     token_url: string
   }
+  oauth_status?: 'authenticated' | 'expired' | 'error' | 'none'
+  token_expires_at?: string
+  user_logged_out?: boolean // True if user explicitly logged out (prevents auto-reconnection)
 }
 
 // Tool Annotation types
Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,9 @@ export interface Server {`
`24`	`24`	`auth_url: string`
`25`	`25`	`token_url: string`
`26`	`26`	`}`
	`27`	`+ oauth_status?: 'authenticated' \| 'expired' \| 'error' \| 'none'`
	`28`	`+ token_expires_at?: string`
	`29`	`+ user_logged_out?: boolean // True if user explicitly logged out (prevents auto-reconnection)`
`27`	`30`	`}`
`28`	`31`
`29`	`32`	`// Tool Annotation types`