feat(tray,frontend): use health.action as single source of truth for actions

Implements User Stories 4 and 5 from spec 013:

Tray (US4 - FR-013 through FR-017):
- Remove serverSupportsOAuth() URL heuristic, use health.action instead
- Show Login Required for stdio OAuth servers (e.g., npx @anthropic/mcp-gcal)
- Add menu items for set_secret and configure health actions
- Use health.level for connected count (no legacy fallback)
- Use health.detail for tooltip instead of last_error

Web UI (US5 - FR-018, FR-019):
- Suppress redundant last_error display when health.action conveys the issue
- Add shouldShowError computed property
- Login/set_secret/configure actions suppress verbose error alert

Tests:
- TestServerNeedsAction: verifies health.action detection
- TestTrayLoginActionForStdioServers: stdio OAuth servers show login
- TestConnectedCountHealthLevelOnly: no fallback to legacy connected
- TestHealthActionMenuItemSelection: correct menu items per action

Author: technicalpickles

frontend/src/components/ServerCard.vue

@@ -50,8 +50,8 @@
         </div>
       </div>
 
-      <!-- Error message -->
-      <div v-if="server.last_error" class="alert alert-error alert-sm mb-4">
+      <!-- Error message - suppressed when health.action conveys the issue (FR-018, FR-019) -->
+      <div v-if="shouldShowError" class="alert alert-error alert-sm mb-4">
         <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
           <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
         </svg>
@@ -269,6 +269,22 @@ const healthAction = computed(() => {
   return props.server.health?.action || ''
 })
 
+// Determine if error message should be shown (FR-018, FR-019)
+// Suppress verbose last_error when health.action already conveys the issue
+const shouldShowError = computed(() => {
+  // No error to show
+  if (!props.server.last_error) return false
+
+  // Actions where the button is sufficient - error is redundant (T043-T046)
+  const actionsSuppressingError = ['login', 'set_secret', 'configure']
+  if (actionsSuppressingError.includes(healthAction.value)) {
+    return false
+  }
+
+  // Show error for other cases (restart, view_logs, or no action)
+  return true
+})
+
 const canLogout = computed(() => {
   // Don't show Logout button if server is disabled
   if (!props.server.enabled) return false

frontend/src/types/contracts.ts

@@ -1,6 +1,6 @@
 // Generated TypeScript types from Go contracts
 // DO NOT EDIT - This file is auto-generated by cmd/generate-types
-// Generated at: 2026-01-06T12:50:41-05:00
+// Generated at: 2026-01-06T13:08:25-05:00
 
 export interface APIResponse<T = any> {
   success: boolean;

internal/tray/managers.go

@@ -344,40 +344,18 @@ func (m *MenuManager) UpdateUpstreamServersMenu(servers []map[string]interface{}
 	}
 
 	// --- Update Title ---
-	// Use health.level as source of truth for connected count (spec: Health is single source of truth)
+	// Use health.level as single source of truth for connected count (FR-013, T039, T040)
 	totalServers := len(servers)
 	connectedServers := 0
-	healthyCount := 0
-	legacyConnectedCount := 0
 	for _, server := range servers {
-		serverName, _ := server["name"].(string)
-		healthRaw := server["health"]
-
-		// Check health.level - "healthy" means connected
+		// Check health.level - "healthy" means connected (no legacy fallback per FR-013)
 		healthLevel := extractHealthLevel(server)
 		if healthLevel == "healthy" {
-			healthyCount++
-			connectedServers++
-			continue
-		}
-		// Fallback to legacy connected field for backward compatibility
-		if connected, ok := server["connected"].(bool); ok && connected {
-			legacyConnectedCount++
 			connectedServers++
 		}
-
-		// Debug: Log servers where health extraction failed but connected=true
-		if healthLevel == "" && healthRaw != nil {
-			m.logger.Warnw("Health extraction failed",
-				"server", serverName,
-				"health_type", fmt.Sprintf("%T", healthRaw),
-				"health_raw", healthRaw)
-		}
 	}
-	m.logger.Infow("Connected count calculated",
-		"healthy", healthyCount,
-		"legacy_connected", legacyConnectedCount,
-		"total_connected", connectedServers,
+	m.logger.Debugw("Connected count calculated",
+		"healthy", connectedServers,
 		"total_servers", totalServers)
 	menuTitle := fmt.Sprintf("Upstream Servers (%d/%d)", connectedServers, totalServers)
 	if m.upstreamServersMenu != nil {
@@ -657,10 +635,9 @@ func (m *MenuManager) ForceRefresh() {
 }
 
 // getServerStatusDisplay returns display text, tooltip, and icon data for a server
-// Uses the unified health status from the backend when available
+// Uses the unified health status from the backend as single source of truth (FR-013, FR-016, FR-017)
 func (m *MenuManager) getServerStatusDisplay(server map[string]interface{}) (displayText, tooltip string, iconData []byte) {
 	serverName, _ := server["name"].(string)
-	lastError, _ := server["last_error"].(string)
 	shouldRetry, _ := server["should_retry"].(bool)
 
 	var retryCount int
@@ -782,17 +759,13 @@ func (m *MenuManager) getServerStatusDisplay(server map[string]interface{}) (dis
 	var tooltipLines []string
 	tooltipLines = append(tooltipLines, fmt.Sprintf("%s - %s", serverName, statusText))
 
-	// Add health detail if available
+	// Use health.detail for tooltip details instead of last_error (FR-017, T034)
 	if hasHealth {
 		if detail, ok := healthData["detail"].(string); ok && detail != "" {
 			tooltipLines = append(tooltipLines, fmt.Sprintf("Detail: %s", detail))
 		}
 	}
 
-	if lastError != "" {
-		tooltipLines = append(tooltipLines, fmt.Sprintf("Last error: %s", lastError))
-	}
-
 	if shouldRetry {
 		if retryCount > 0 {
 			tooltipLines = append(tooltipLines, fmt.Sprintf("Retry scheduled (attempts: %d)", retryCount))
@@ -812,49 +785,19 @@ func (m *MenuManager) getServerStatusDisplay(server map[string]interface{}) (dis
 	return
 }
 
-// serverSupportsOAuth determines if a server supports OAuth authentication
-func (m *MenuManager) serverSupportsOAuth(server map[string]interface{}) bool {
-	// Get server URL
-	serverURL, ok := server["url"].(string)
-	if !ok || serverURL == "" {
-		return false
-	}
-
-	// Check if it's an HTTP/HTTPS server (OAuth is typically used with HTTP-based APIs)
-	urlLower := strings.ToLower(serverURL)
-	if !strings.HasPrefix(urlLower, "http://") && !strings.HasPrefix(urlLower, "https://") {
+// serverNeedsAction checks if a server needs a specific action based on health.action
+// This replaces the old URL-based serverSupportsOAuth heuristic (FR-014)
+func (m *MenuManager) serverNeedsAction(server map[string]interface{}, action string) bool {
+	healthData, ok := server["health"].(map[string]interface{})
+	if !ok {
 		return false
 	}
-
-	// Check for OAuth-related URLs patterns
-	if strings.Contains(urlLower, "oauth") || strings.Contains(urlLower, "auth") {
-		return true
-	}
-
-	// For common MCP servers that we know support OAuth
-	oauthDomains := []string{
-		"sentry.dev",
-		"github.com",
-		"gitlab.com",
-		"google.com",
-		"googleapis.com",
-		"microsoft.com",
-		"oauth.com",
-	}
-
-	for _, domain := range oauthDomains {
-		if strings.Contains(urlLower, domain) {
-			return true
-		}
-	}
-
-	// For any HTTP/HTTPS server, show OAuth option since it might support it
-	// Users can try it and it will fail gracefully if not supported
-	return true
+	healthAction, _ := healthData["action"].(string)
+	return healthAction == action
 }
 
-// createServerActionSubmenus creates action submenus for a server (enable/disable, quarantine, OAuth login, restart)
-// Uses health.action to determine which actions are most relevant
+// createServerActionSubmenus creates action submenus for a server based on health.action
+// Uses health.action as single source of truth for determining which actions to show (FR-014, FR-015)
 func (m *MenuManager) createServerActionSubmenus(serverMenuItem *systray.MenuItem, server map[string]interface{}) {
 	serverName, _ := server["name"].(string)
 	if serverName == "" {
@@ -864,13 +807,13 @@ func (m *MenuManager) createServerActionSubmenus(serverMenuItem *systray.MenuIte
 	enabled, _ := server["enabled"].(bool)
 	quarantined, _ := server["quarantined"].(bool)
 
-	// Get health.action if available
+	// Get health.action - this is the single source of truth for what action is needed
 	healthAction := ""
 	if healthData, ok := server["health"].(map[string]interface{}); ok {
 		healthAction, _ = healthData["action"].(string)
 	}
 
-	// Enable/Disable action
+	// Enable/Disable action - always shown
 	var enableText string
 	if enabled {
 		enableText = textDisable
@@ -880,40 +823,67 @@ func (m *MenuManager) createServerActionSubmenus(serverMenuItem *systray.MenuIte
 	enableItem := serverMenuItem.AddSubMenuItem(enableText, fmt.Sprintf("%s server %s", enableText, serverName))
 	m.serverActionItems[serverName] = enableItem
 
-	// Restart action (for stdio servers when health.action is "restart" or server has errors)
-	if enabled && !quarantined {
-		restartItem := serverMenuItem.AddSubMenuItem("🔄 Restart", fmt.Sprintf("Restart server %s", serverName))
-		m.serverRestartItems[serverName] = restartItem
+	// Show action-specific menu items based on health.action (FR-014, FR-015, FR-036-038)
+	if !quarantined && enabled {
+		switch healthAction {
+		case "login":
+			// Login Required - show prominently (FR-015, T036)
+			oauthItem := serverMenuItem.AddSubMenuItem("⚠️ Login Required", fmt.Sprintf("Authenticate with %s using OAuth", serverName))
+			m.serverOAuthItems[serverName] = oauthItem
+			go func(name string, item *systray.MenuItem) {
+				for range item.ClickedCh {
+					if m.onServerAction != nil {
+						go m.onServerAction(name, "oauth_login")
+					}
+				}
+			}(serverName, oauthItem)
 
-		// Set up restart click handler
-		go func(name string, item *systray.MenuItem) {
-			for range item.ClickedCh {
-				if m.onServerAction != nil {
-					go m.onServerAction(name, "restart")
+		case "set_secret":
+			// Set Secret - opens Web UI secrets page (T037)
+			secretItem := serverMenuItem.AddSubMenuItem("⚠️ Set Secret", fmt.Sprintf("Configure missing secret for %s", serverName))
+			go func(name string, item *systray.MenuItem) {
+				for range item.ClickedCh {
+					if m.onServerAction != nil {
+						go m.onServerAction(name, "set_secret")
+					}
 				}
-			}
-		}(serverName, restartItem)
-	}
+			}(serverName, secretItem)
 
-	// OAuth Login action (only for servers that support OAuth)
-	if m.serverSupportsOAuth(server) && !quarantined {
-		// Highlight login if health.action suggests it
-		loginLabel := "🔐 OAuth Login"
-		if healthAction == "login" {
-			loginLabel = "⚠️ Login Required"
-		}
-		oauthItem := serverMenuItem.AddSubMenuItem(loginLabel, fmt.Sprintf("Authenticate with %s using OAuth", serverName))
-		m.serverOAuthItems[serverName] = oauthItem
+		case "configure":
+			// Configure - opens Web UI server config (T038)
+			configItem := serverMenuItem.AddSubMenuItem("⚠️ Configure", fmt.Sprintf("Fix configuration for %s", serverName))
+			go func(name string, item *systray.MenuItem) {
+				for range item.ClickedCh {
+					if m.onServerAction != nil {
+						go m.onServerAction(name, "configure")
+					}
+				}
+			}(serverName, configItem)
 
-		// Set up OAuth login click handler
-		go func(name string, item *systray.MenuItem) {
-			for range item.ClickedCh {
-				if m.onServerAction != nil {
-					// Run in new goroutines to avoid blocking the event channel
-					go m.onServerAction(name, "oauth_login")
+		case "restart":
+			// Restart suggested by health - show prominently
+			restartItem := serverMenuItem.AddSubMenuItem("⚠️ Restart Required", fmt.Sprintf("Restart server %s to fix issues", serverName))
+			m.serverRestartItems[serverName] = restartItem
+			go func(name string, item *systray.MenuItem) {
+				for range item.ClickedCh {
+					if m.onServerAction != nil {
+						go m.onServerAction(name, "restart")
+					}
 				}
-			}
-		}(serverName, oauthItem)
+			}(serverName, restartItem)
+
+		default:
+			// No specific action needed - show standard restart option
+			restartItem := serverMenuItem.AddSubMenuItem("🔄 Restart", fmt.Sprintf("Restart server %s", serverName))
+			m.serverRestartItems[serverName] = restartItem
+			go func(name string, item *systray.MenuItem) {
+				for range item.ClickedCh {
+					if m.onServerAction != nil {
+						go m.onServerAction(name, "restart")
+					}
+				}
+			}(serverName, restartItem)
+		}
 	}
 
 	// Quarantine action (only if not already quarantined)
@@ -925,7 +895,6 @@ func (m *MenuManager) createServerActionSubmenus(serverMenuItem *systray.MenuIte
 		go func(name string, item *systray.MenuItem) {
 			for range item.ClickedCh {
 				if m.onServerAction != nil {
-					// Run in new goroutines to avoid blocking the event channel
 					go m.onServerAction(name, "quarantine")
 				}
 			}
@@ -936,8 +905,6 @@ func (m *MenuManager) createServerActionSubmenus(serverMenuItem *systray.MenuIte
 	go func(name string, item *systray.MenuItem) {
 		for range item.ClickedCh {
 			if m.onServerAction != nil {
-				// The best approach is to have the sync manager handle the toggle.
-				// We send a generic 'toggle_enable' action and let the handler determine the state.
 				go m.onServerAction(name, "toggle_enable")
 			}
 		}