From faa2f00cfdafc34320513715822e89a6c4dc885f Mon Sep 17 00:00:00 2001
From: DIodide <ibraheem.amin3@gmail.com>
Date: Sat, 22 Aug 2026 16:19:14 -0400
Subject: [PATCH] Evict tokenless Google connections; always mint a fresh
 consent URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Chats created before token gating still carried anonymous Google
connections — tools appeared, every call 401'd. The reconcile now
removes a chat's Google connection whenever the desk holds no tokens.

The consent URL is minted fresh on demand: a connection restored in the
authenticating state can't run the probe's auth leg, and redeeming the
persisted auth_url is a trap once its OAuth state record expires (10
minutes). The desk now resets to a clean anonymous connection and
probes again whenever no live URL exists.

Claude-Session: https://claude.ai/code/session_01MKLJUWk6biNAKXupHTTWn5
---
 app/src/server/pi.ts | 36 ++++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/app/src/server/pi.ts b/app/src/server/pi.ts
index d14f914..b241b85 100644
--- a/app/src/server/pi.ts
+++ b/app/src/server/pi.ts
@@ -121,6 +121,12 @@ export class Pi extends Think<Env, PiState> {
     const base = this.engineBase();
     const expectedUrl = (app: (typeof PI_APPS)[number]) =>
       app.mcpUrl ?? `${base}${app.mcpPath}`;
+    // Chats may only hold a Google connection while the desk has tokens —
+    // this also evicts legacy connections made before token gating existed.
+    const gcalEntitled =
+      !enabled.has("gcal") || this.isDesk()
+        ? true
+        : await (await this.deskStub(settings.netid)).gcalTokensHas();
 
     // Land the user back on My apps after a Google consent round-trip.
     this.mcp.configureOAuthCallback({
@@ -134,6 +140,7 @@ export class Pi extends Think<Env, PiState> {
         !app ||
         !enabled.has(app.key) ||
         (identityChanged && app.key !== "gcal") ||
+        (app.key === "gcal" && !gcalEntitled) ||
         server.server_url !== expectedUrl(app);
       if (stale) await this.removeMcpServer(id);
     }
@@ -291,10 +298,35 @@ export class Pi extends Think<Env, PiState> {
         server_options: string | null;
       }) => void;
     };
-    const url =
+    let url =
       manager.mcpConnections?.gcal?.options?.transport?.authProvider?.authUrl ??
-      this.getMcpServers().servers.gcal?.auth_url ??
       null;
+    if (!url) {
+      // The connection was likely restored in the authenticating state, so
+      // the probe couldn't run the auth leg. Reset to a fresh anonymous
+      // connection and probe again — a persisted auth_url is useless once
+      // its OAuth state expires (10 minutes).
+      console.log("gcal: resetting connection to mint a fresh consent URL");
+      await this.removeMcpServer("gcal");
+      await this.addMcpServer("Google Calendar", GCAL_MCP_URL, {
+        id: "gcal",
+        callbackHost: this.appOrigin(),
+        callbackPath: GCAL_CALLBACK_PATH.slice(1),
+        transport: { type: "streamable-http" },
+      });
+      try {
+        await this.mcp.callTool({
+          serverId: "gcal",
+          name: "list_calendars",
+          arguments: {},
+        });
+      } catch {
+        // expected 401 — the transport just ran the authorization leg
+      }
+      url =
+        manager.mcpConnections?.gcal?.options?.transport?.authProvider
+          ?.authUrl ?? null;
+    }
     if (!url) {
       console.warn("gcal: probe ran but no consent URL was produced");
       return null;