fix(desktop): review fixes — OAuth error handling, query freshness, invitations

Findings from an end-to-end review of the desktop work, fixed and verified.

OAuth connect/login handoff:
- Add a friendly /oauth-error landing page + onAPIError.errorURL so provider
  Cancel/Deny (which Better Auth redirects before the flow state is parsed)
  no longer dead-ends on a 404; re-initiating supersedes the idle loopback.
- Stop a post-consent failure from reporting success (drop the baked-in
  errorCallbackURL param that collided with Better Auth's appended code;
  coerce an array error defensively on the complete page).
- Guard the desktop connect listener with the same context-age check the web
  routers use, so an abandoned flow can't mislabel a later completion.
- Clear an orphaned pending handoff when a loopback re-bind fails.

Query freshness (desktop refetchOnWindowFocus):
- Pin refetchOnWindowFocus off on queries that seed editable forms
  (environment/secrets, credential detail, schedules) so a background focus
  refetch can't drop an unsaved draft, and on the useWorkflowStates fan-out so
  returning to a large table doesn't fire N heavy envelope fetches. All no-ops
  on web (default already false).

Invitations (in-app pending invitations):
- Map accept/decline failures to friendly copy instead of raw machine codes.
- Invalidate subscription + refresh session on accept (parity with the email
  path); reconcile the list on failure (onSettled) so dead rows drop.
- Gate the modal's query on open so it no longer fetches on every app load.

CI:
- Wrap the latest-mac.yml update-feed route in withRouteHandler and allowlist
  it as a non-boundary route (input-less, YAML) so the contract audit passes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: icecrasher321

apps/desktop/src/main/handoff.ts

@@ -177,8 +177,12 @@ export function createHandoffManager(
     params: Record<string, string>
   ): Promise<boolean> => {
     const state = generateShortId(STATE_LENGTH)
+    // startLoopback() already tore down any prior server; if this bind fails,
+    // clear the now-orphaned pending so a superseded flow can't linger as a
+    // dangling entry pointing at a server that no longer exists.
     const port = await startLoopback()
     if (!port) {
+      clear()
       return false
     }
     pending = { state, createdAt: now(), kind }

apps/sim/app/_shell/providers/get-query-client.test.ts

@@ -0,0 +1,26 @@
+/**
+ * @vitest-environment jsdom
+ */
+import type { SimDesktopApi } from '@sim/desktop-bridge'
+import { afterEach, describe, expect, it } from 'vitest'
+import { makeQueryClient } from '@/app/_shell/providers/get-query-client'
+
+function focusRefetchDefault(): boolean | 'always' | ((...args: unknown[]) => boolean) | undefined {
+  return makeQueryClient().getDefaultOptions().queries?.refetchOnWindowFocus
+}
+
+describe('makeQueryClient refetchOnWindowFocus default', () => {
+  afterEach(() => {
+    // biome-ignore lint/performance/noDelete: test teardown of a global stub
+    delete (window as { simDesktop?: SimDesktopApi }).simDesktop
+  })
+
+  it('is off on the web (no desktop bridge) — tab-switch focus is noisy there', () => {
+    expect(focusRefetchDefault()).toBe(false)
+  })
+
+  it('is on in the desktop app — refetches stale queries when the long-lived window refocuses', () => {
+    ;(window as { simDesktop?: SimDesktopApi }).simDesktop = {} as SimDesktopApi
+    expect(focusRefetchDefault()).toBe(true)
+  })
+})

apps/sim/app/_shell/providers/get-query-client.ts

@@ -1,12 +1,23 @@
 import { defaultShouldDehydrateQuery, isServer, QueryClient } from '@tanstack/react-query'
+import { isDesktopApp } from '@/lib/desktop'
 
-function makeQueryClient() {
+export function makeQueryClient() {
   return new QueryClient({
     defaultOptions: {
       queries: {
         staleTime: 30 * 1000,
         gcTime: 5 * 60 * 1000,
-        refetchOnWindowFocus: false,
+        // The desktop app window lives for days, so cross-session changes —
+        // an admin upgrading your org/workspace role, a workspace you were
+        // auto-added to, seat/entitlement changes — would otherwise stay
+        // stale until a manual reload (there is no push channel for them).
+        // Refetch stale queries when the app window regains focus: the "user
+        // came back after doing something elsewhere" signal, which is exactly
+        // this bug class. staleTime still gates it, so rapid focus changes
+        // cost nothing. Left off on the web, where tab-switch focus events are
+        // frequent and noisy. Per-query overrides (e.g. useWorkspaceSchedules
+        // pins this off) always win over this default.
+        refetchOnWindowFocus: isDesktopApp(),
         retry: 1,
         retryOnMount: false,
       },

apps/sim/app/api/desktop/update/latest-mac.yml/route.ts

@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { NextResponse } from 'next/server'
 import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import {
   channelForHostname,
   DESKTOP_RELEASE_REPO,
@@ -28,7 +29,7 @@ const RELEASES_API_URL = `https://api.github.com/repos/${DESKTOP_RELEASE_REPO}/r
  * design: the updater's HTTP client carries no session, and the response
  * only describes public GitHub release artifacts.
  */
-export async function GET(): Promise<Response> {
+export const GET = withRouteHandler(async (): Promise<Response> => {
   const hostname = new URL(env.NEXT_PUBLIC_APP_URL).hostname
   const channel = channelForHostname(hostname)
 
@@ -89,4 +90,4 @@ export async function GET(): Promise<Response> {
       'cache-control': `public, max-age=${REVALIDATE_SECONDS}`,
     },
   })
-}
+})

apps/sim/app/desktop/connect/complete/page.tsx

@@ -43,6 +43,9 @@ export default async function ConnectCompletePage({ searchParams }: ConnectCompl
     return <InvalidRequest />
   }
 
-  const error = sanitizeOAuthErrorSlug(params.error)
+  // Defensive: if `error` somehow arrives as a repeated query key (array), a
+  // failure must never read as success — take the first code.
+  const rawError = Array.isArray(params.error) ? params.error[0] : params.error
+  const error = sanitizeOAuthErrorSlug(rawError)
   redirect(buildConnectLoopbackUrl(state, port, error ?? undefined))
 }

apps/sim/app/desktop/connect/connect-launcher.tsx

@@ -27,9 +27,12 @@ export function ConnectLauncher({ providerId, completePath }: ConnectLauncherPro
       await client.oauth2.link({
         providerId,
         callbackURL: completePath,
-        // Failed flows still bounce to the loopback so the desktop app can
-        // surface the failure instead of waiting out the handoff TTL.
-        errorCallbackURL: `${completePath}&error=oauth_failed`,
+        // Failed flows bounce to the same complete page (which forwards the
+        // failure to the loopback) instead of waiting out the handoff TTL.
+        // Do NOT bake in a query param here: better-auth appends its own
+        // `&error=<code>`, and a second `error` key deserializes to an array
+        // that the complete page can't read — so it would look like success.
+        errorCallbackURL: completePath,
       })
     } catch (err) {
       setError(getErrorMessage(err, 'Could not start the connection.'))

apps/sim/app/oauth-error/page.tsx

@@ -0,0 +1,49 @@
+import type { Metadata } from 'next'
+
+export const metadata: Metadata = {
+  title: 'Sign-in couldn’t be completed',
+  robots: { index: false },
+}
+
+export const dynamic = 'force-dynamic'
+
+interface OAuthErrorPageProps {
+  searchParams: Promise<Record<string, string | string[] | undefined>>
+}
+
+/**
+ * Landing page for OAuth flows that end in an error before the flow state can
+ * be parsed — most commonly the user clicking "Cancel"/"Deny" at the
+ * provider's consent screen (`?error=access_denied`). Better Auth redirects
+ * such errors to `onAPIError.errorURL` (this page) BEFORE it can honor a
+ * per-flow `errorCallbackURL`, so the desktop handoff's loopback is never
+ * pinged. Without this page those errors 404'd (a dead-end); here the user
+ * gets a clear message and a way back. Re-initiating the sign-in/connect from
+ * the app supersedes the idle handoff, so no explicit hand-back is needed.
+ */
+const FRIENDLY: Record<string, string> = {
+  access_denied: 'You declined the request at the provider, so nothing was connected.',
+  oAuth_code_missing: 'The provider didn’t return a valid response. Please try again.',
+}
+
+function messageForError(code: string | undefined): string {
+  if (code && FRIENDLY[code]) return FRIENDLY[code]
+  return 'The sign-in couldn’t be completed. Please try again.'
+}
+
+export default async function OAuthErrorPage({ searchParams }: OAuthErrorPageProps) {
+  const params = await searchParams
+  const code = typeof params.error === 'string' ? params.error : undefined
+
+  return (
+    <main className='flex min-h-screen items-center justify-center px-6'>
+      <div className='max-w-sm text-center'>
+        <h1 className='font-semibold text-foreground text-lg'>Couldn’t complete that</h1>
+        <p className='mt-2 text-muted-foreground text-sm'>{messageForError(code)}</p>
+        <p className='mt-4 text-muted-foreground text-sm'>
+          You can close this tab and try again from Sim.
+        </p>
+      </div>
+    </main>
+  )
+}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx

@@ -5,6 +5,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useRouter } from 'next/navigation'
 import type { InvitationDetails } from '@/lib/api/contracts/invitations'
+import { getInvitationErrorMessage } from '@/lib/invitations/error-messages'
 import {
   useAcceptMyInvitation,
   useDeclineMyInvitation,
@@ -50,7 +51,7 @@ interface ViewInvitationsModalProps {
  * the joined workspace; declining keeps it open for the remaining rows.
  */
 export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModalProps) {
-  const { data: invitations } = useMyPendingInvitations()
+  const { data: invitations } = useMyPendingInvitations(open)
   const acceptInvitation = useAcceptMyInvitation()
   const declineInvitation = useDeclineMyInvitation()
   const router = useRouter()
@@ -65,7 +66,12 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
       router.push(result.redirectPath)
     } catch (error) {
       logger.error('Failed to accept invitation', { error })
-      toast.error(getErrorMessage(error, 'Could not accept the invitation. It may have expired.'))
+      toast.error(
+        getInvitationErrorMessage(
+          getErrorMessage(error, ''),
+          'Could not accept the invitation. It may have expired.'
+        )
+      )
     }
   }
 
@@ -74,7 +80,9 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
       await declineInvitation.mutateAsync({ invitationId: inv.id })
     } catch (error) {
       logger.error('Failed to decline invitation', { error })
-      toast.error(getErrorMessage(error, 'Could not decline the invitation.'))
+      toast.error(
+        getInvitationErrorMessage(getErrorMessage(error, ''), 'Could not decline the invitation.')
+      )
     }
   }
 

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx

@@ -32,6 +32,7 @@ import {
 import { InviteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal'
 import { ViewInvitationsMenuItem } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-menu-item'
 import { ViewInvitationsModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal'
+import { invitationKeys } from '@/hooks/queries/invitations'
 import {
   type Workspace,
   type WorkspaceCreationPolicy,
@@ -370,11 +371,12 @@ function WorkspaceHeaderImpl({
               return
             }
             if (open) {
-              // The workspace list is mounted app-wide, so it never refetches
-              // on its own (no focus refetch). Opening the switcher is the
-              // "user is looking" moment: refetch when stale so workspaces
-              // the user was auto-added to appear without a page refresh.
+              // Opening the switcher is the "user is looking" moment: refetch
+              // stale server state so a workspace the user was auto-added to,
+              // or a fresh pending invitation, appears without a page refresh
+              // (these are app-wide queries with no focus refetch on the web).
               void queryClient.refetchQueries({ queryKey: workspaceKeys.lists(), stale: true })
+              void queryClient.refetchQueries({ queryKey: invitationKeys.mine(), stale: true })
             }
             setIsWorkspaceMenuOpen(open)
           }}

apps/sim/hooks/queries/credentials.ts

@@ -92,6 +92,10 @@ export function useWorkspaceCredential(credentialId?: string, enabled = true) {
     },
     enabled: Boolean(credentialId) && enabled,
     staleTime: WORKSPACE_CREDENTIAL_DETAIL_STALE_TIME,
+    // The credential-detail form seeds editable name/description fields from
+    // this data, so a background focus refetch during an edit could clobber
+    // an unsaved draft. Off the desktop focus-refetch default; no-op on web.
+    refetchOnWindowFocus: false,
   })
 }