Stop headless MCP connect from advertising interactive OAuth

Headless exec was registering an onAuthURL callback it could never complete, so OAuth-backed MCP servers hung automation. Gate the callback on interactiveAuth: TUI keeps the browser flow; exec and other headless hosts reuse stored tokens only.

Author: TheGreatAxios

src/agent/tools.ts

@@ -145,6 +145,9 @@ export type MCPServerState =
   | { name: string; state: "failed"; error: string };
 
 export type MCPConnectCallbacks = {
+  // Headless hosts must not advertise an auth callback they cannot complete.
+  // Its presence is how the MCP client decides an OAuth flow is interactive.
+  interactiveAuth: boolean;
   // Fired whenever a server's connection state changes.
   onStatus: (state: MCPServerState) => void;
   // Fired after a server connects and its tools are registered, with the new
@@ -360,7 +363,9 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
         callbacks.onStatus({ name: config.name, state: "connecting" });
         const result = await connectMCPServer(config, {
           stderr: "ignore",
-          onAuthURL: (name, url) => callbacks.onStatus({ name, state: "needs-auth", url }),
+          ...(callbacks.interactiveAuth
+            ? { onAuthURL: (name: string, url: string) => callbacks.onStatus({ name, state: "needs-auth", url }) }
+            : {}),
           // Mid-session re-auth fires needs-auth again without a later connected
           // event. Re-emit connected only when tools are already registered so
           // first-connect still waits for the real post-connect status.

src/exec/runner.ts

@@ -591,6 +591,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
     if (agentToolset.connectMCP !== undefined) {
       await agentToolset
         .connectMCP({
+          interactiveAuth: false,
           onStatus: (status) => {
             if (status.state === "connected") {
               connectedMcp = [

src/tui/runner.ts

@@ -2471,6 +2471,7 @@ export async function runTUI(initialConfig: Config): Promise<number> {
   void toolset
     .connectMCP(
       {
+        interactiveAuth: true,
         onStatus: (status) => {
           mcpStates.set(status.name, status);
           emitter.emit("mcp.status", status);

tests/unit/tui/agent-tools.test.ts

@@ -27,6 +27,7 @@ const mockPosixTools = {
 // mock.module below runs, making the "restore" a no-op.
 const realToolsPosix = { ...(await import("@intx/tools-posix")) };
 const realPosixToolPlugins = { ...(await import("../../../src/agent/posix-tool-plugins.js")) };
+const realMcpClient = { ...(await import("../../../src/mcp/client.js")) };
 const realMcpPlugin = { ...(await import("../../../src/mcp/plugin.js")) };
 const realPathEscapePlugin = { ...(await import("../../../src/plugins/path-escape-plugin.js")) };
 const realAuthzPlugin = { ...(await import("../../../src/plugins/authz-plugin.js")) };
@@ -47,6 +48,17 @@ mock.module("../../../src/agent/posix-tool-plugins.js", () => ({
   buildCorePosixToolPlugins: () => [],
 }));
 
+const mockConnectMCPServer = mock(async (config: { name: string }) => ({
+  ok: false as const,
+  serverName: config.name,
+  error: "not connected",
+}));
+
+mock.module("../../../src/mcp/client.js", () => ({
+  ...realMcpClient,
+  connectMCPServer: mockConnectMCPServer,
+}));
+
 mock.module("../../../src/mcp/plugin.js", () => ({
   mcpClientToAgentTools: () => [],
 }));
@@ -113,6 +125,7 @@ mock.module("../../../src/agent/director.js", () => ({
 afterAll(() => {
   mock.module("@intx/tools-posix", () => realToolsPosix);
   mock.module("../../../src/agent/posix-tool-plugins.js", () => realPosixToolPlugins);
+  mock.module("../../../src/mcp/client.js", () => realMcpClient);
   mock.module("../../../src/mcp/plugin.js", () => realMcpPlugin);
   mock.module("../../../src/plugins/path-escape-plugin.js", () => realPathEscapePlugin);
   mock.module("../../../src/plugins/authz-plugin.js", () => realAuthzPlugin);
@@ -304,6 +317,26 @@ test("default session registers task and search_agents", async () => {
   expect(names).toContain("search_agents");
 });
 
+test("headless MCP connection does not wait for interactive OAuth", async () => {
+  mockConnectMCPServer.mockClear();
+  const toolset = await createAgentToolset({
+    cwd: "/fake",
+    permissionGate: fakePermissionGate,
+    onOperatorGate: async () => ({ kind: "cancel" }),
+    mcpServers: [{ name: "granola", url: "https://example.test/mcp" }],
+    mcpServersSource: "global",
+  });
+
+  await toolset.connectMCP({
+    interactiveAuth: false,
+    onStatus: () => {},
+    onToolsChanged: () => {},
+  });
+
+  expect(mockConnectMCPServer).toHaveBeenCalledTimes(1);
+  expect(mockConnectMCPServer.mock.calls[0]?.[1]?.onAuthURL).toBeUndefined();
+});
+
 test("dispose calls posixTools.dispose", async () => {
   mockDispose.mockClear();