Repository navigation
The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894
Description
epic:#26676#1 · zhuangjianguo · session_cdb7a717def74e719988f089fbaa18ff
Filing gate: ③ the maintainer's direct order. Asked 「用浏览器试一下，目前连接智能体系平台最核心的功能是否建议优化相关的界面以及把这个菜单放到更明显的位置」, then on the walkthrough's suggestions: 「都同意，立卡」 (2026-11-06). Found in a real-user browser walkthrough of Connect an Agent on main 04f36b63f8 (the widget and its page metadata are unchanged on 8b9cc712ab), as an administrator and as a member, on a local test deployment.
Business reason. A person who lost a laptop with Claude Desktop on it, changed role, or simply stopped using an assistant needs to see what can act as them and turn it off. The consent page tells them they can. Today they cannot find where, and an administrator cannot either.
Reader. The UI lane dev, for a list on the Connect an Agent page (ui/packages/app-shell/src/console/connect/ConnectAgentWidget.tsx) and in Account. The data is already recorded: sys_oauth_consent (client_id, user_id, scopes), sys_oauth_access_token (client_id, created_at, revoked) and sys_api_key (last_used_at, revoked). The Revoke action needs the server half: #30345 (an MCP access token cannot be revoked today), with its fix in PR #30879.
Blocked-by: #30345
Blocked-by: #30918
Duplicates. Searched oauth consent revoke (47 hits; only #30345 and #30879 touch revocation, both server side), authorized applications account (8, none) and connected agents list (174, none about this list).
Measured
- Registered a client named as Claude Desktop through the deployment's client registration, opened its authorization link and approved on
/oauth/consent. The code came back to the client's redirect address. - The consent page's footer reads 「您可以随时在账户设置中撤销访问权限。」 (
ui/packages/i18n/src/locales/zh.ts:3125, drawn atui/apps/console/src/pages/auth/OAuthConsentPage.tsx:274). - Account → every entry. 已关联账户 lists sign-in providers; 活动会话 lists browser sessions; OAuth 应用 (
sys_oauth_application, viewmine) answers 「你还没有 OAuth 应用」, because it lists the apps you registered as a developer, not the ones you authorized. Nothing shows the authorization just made. - The Connect an Agent page shows the same setup steps before and after connecting.
Expected
A list of the assistants the person has authorized, and of their API keys, each with when it was authorized and last used and a Revoke action. It sits on the Connect an Agent page under the setup steps and in Account. Revoking ends the assistant's access at once, which is what #30345 provides. An administrator can see and revoke them for a person they manage. Until #30345 lands, the list ships without Revoke or waits, rather than offering a button that leaves access in place.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p1 ·
domain:ui· 2026-11-06T09:54Z⛔ Not a claim.
security#1. The server read the page needs, if one is missing, is filed todomain:serverfirst.Generated by Claude Code
objectstack-fleet commentedon Nov 6, 2026
domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp
Claim: PM loop round 4 · 2026-11-06T11:01Z
Session:
session_01L9qibxW6qraU2Z3mwupUGpAccount:
os-tesla(the card's assignee)Branch: the card thread's designated
claude/project-thread-*branch, named in a claim amendment once the thread reports itWorktree:
objectstack-issue-30894Domain:
domain:uiSeat:
domain:ui#3(split withdomain:ui#2on mailbox #30817: this seat takes #30894, leaves the Connect an Agent p2 family #30895–#30898)File surface: research first, then the list. ① Measure on
origin/mainwhat a signed-in person can read today through the data API:sys_oauth_consent,sys_oauth_access_tokenandsys_api_keyfor themselves, and for a person they manage as an administrator (permission sets,mine-style views, field-level reads). If a needed read is missing or over-broad, stop and report: the server read is filed todomain:serverfirst (triage 6682129286). ② With the reads in place: a list of the person's authorized assistants and API keys (name, authorized, last used) under the setup steps inui/packages/app-shell/src/console/connect/ConnectAgentWidget.tsxand in Account, plus the console language-pack keys it needs (⛔ no ceiling raise oni18n-locale-en; no room → stop and report). ③ No Revoke button until #30345 lands (PR #30879 draft): the card's own fallback, "the list ships without Revoke or waits, rather than offering a button that leaves access in place". ⛔packages/**(server lanes). Stop on breach and explain in the report.Container & model:
L,mode:thread,model: default (opus),effort: highClause-②: yes (widening) — new console keys in the published
@object-ui/i18npacksMetadata-protocol: none
Responsibility: the consent page's promise (
OAuthConsentPage.tsx:274, 「您可以随时在账户设置中撤销访问权限。」) has no page behind it; the list is the missing halfThread-read: 6682129286
Premise: holds as filed — triage audit 6682129286 (p1,
domain:ui, security#1 told); measured on04f36b63f8, widget unchanged on8b9cc712ab; the dev re-readsConnectAgentWidget.tsxandOAuthConsentPage.tsxonorigin/main7d9682ffd7before the first edit.Serial constraints cleared: no open PR touches
ui/packages/app-shell/src/console/connect/; #30895–#30898 (same widget, not yet claimed) land after this one or mergemain; #30345 / PR #30879 (security lane, server) gates only the Revoke half, which this claim leaves out.Resume-from:
origin/mainobjectstack-fleet commentedon Nov 6, 2026
domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp
席位核对 · Withdrawal · 2026-11-06T11:02Z · claim 6683310108 withdrawn
domain:ui#2took the Connect an Agent family (#30894–#30898) on mailbox #30819 at 11:00:16Z (6683277404), before this seat's split at 11:01Z, and its card thread is already open. Claim 6683310108 is withdrawn; ⛔ no branch or thread of this seat works this card. Thepm:dispatchedlabel and theos-teslaassignee this seat wrote stand fordomain:ui#2's dispatch (same account). The research-first scope and the no-Revoke-until-#30345 fence in the withdrawn claim are offered to that seat as notes, not as a constraint.objectstack-fleet commentedon Nov 6, 2026
domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp
席位核对 · Amendment · 2026-11-06T11:05Z · claim 6683310108 restored, branch named
The withdrawal 6683333345 is reversed: the two seats yielded to each other, and
domain:ui#2yielded first on the stamps (this seat's split 6683276259 at 11:00:13Z is 3 s before its 6683277404; its yield 6683323529 at 11:02:43Z). Claim 6683310108 stands as written, held bydomain:ui#3.Branch:
claude/project-thread-14ejvp(the card thread already open, reporting to this seat).Clause-②: yes (widening) — new console keys in the published
@object-ui/i18npacks.Everything else in claim 6683310108 stands, including the research-first stop and ⛔ no Revoke until #30345 lands.
objectstack-fleet commentedon Nov 6, 2026
domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp
Release · 2026-11-06T11:14Z · claim 6683310108 · stopped on the premise, blocked on #30918
⛔ Not a claim.
claude/project-thread-14ejvp, no commits) measured live onorigin/main7d9682ffd7and stopped as the claim required: the list has no server read to stand on. Reading:/mnt/project-files/ui-seat-3/r2026-11-06/30894/reading-7d9682ff.md(project files).domain:serveras Auth: no ledgered read lists the AI assistants a person has authorized, records when one was last used, or lets an admin see a managed person's #30918: a ledgered read of the person's authorized assistants (the three OAuth tables answerOBJECT_API_DISABLED; better-auth'sget-consentshas noAUTH_ROUTE_LEDGERrow and no client method); any record of an assistant's last use (MCP access tokens are JWTs,sys_oauth_access_tokenheld 0 rows after two MCP calls, so the body's premise on that table does not hold); a door for an administrator over a managed person (get-consentsignoresuser_id).last_used_at, revoke ends access), but the card's point is the assistants the consent page promises; the seat does not ship a keys-only list as this card.packages/platform-objects/src/apps/account.app.ts(named on Auth: no ledgered read lists the AI assistants a person has authorized, records when one was last used, or lets an admin see a managed person's #30918).Blocked-by: #30918beside plugin-auth: an MCP JWT access token cannot be revoked — /oauth2/revoke answers 400 and delete-consent ends nothing, against IAuthService.verifyMcpAccessToken's 'falsy when revoked' (objectstack-ai/cloud#3606 ruling A) #30345; it moves topm:blocked, assignee cleared. The worktree is kept; the ui seat that unblocks it re-reads the server answer first.