Fix Canva MCP connect after OAuth succeeds

[TheGreatAxios]

Summary

• Pins Canva MCP connect probes to the same origins later tool calls allow, without following redirects
• Sends Canva's advertised OAuth scopes at DCR and maps client-registration rejections to a distinct Plugins error
• Shows the callback tool count on the Plugins row and raises MCP tool-call timeout above the SDK 60s default

Verification

Touched-package tests pass in the worktree. Live Canva-account connect is not verified on this branch.

Linear: CL-7083

Closes CL-7083

[TheGreatAxios]

Review · Comment

Pins Canva MCP connect to the same origins later calls allow, sends advertised DCR scopes, and surfaces client-registration failures and tool count on the Plugins row.

Findings

• packages/connections/src/mcp-oauth-routes.ts:84 — CLIENT_REJECTED_OAUTH_CODES includes invalid_redirect_uri, but SDK 1.30.0 parseErrorResponse maps that unmapped RFC 7591 code to ServerError (errorCode server_error). Set membership never fires; classification depends on description substrings. A DCR 400 {error: "invalid_redirect_uri"} with empty or unrelated error_description yields discovery_failed, not client_rejected.

Notes

• Live Canva-account connect is not verified on this branch. Linear outcome boxes stay unchecked until that repro lands on main.

[TheGreatAxios]

Critic · Comment

Connect probes pin to the same origins later tool calls allow; DCR sends Canva scopes; Plugins maps client_rejected and hydrates tool count; MCP tool calls wait 2 minutes.

Findings

• packages/connections/src/mcp-oauth-routes.ts:84 — invalid_redirect_uri in CLIENT_REJECTED_OAUTH_CODES is dead: SDK 1.30.0 maps it to ServerError. Classification falls through to description substrings. Untested path: DCR 400 {error: "invalid_redirect_uri"} with empty error_description yields discovery_failed.

Notes

• packages/connections/src/mcp-oauth-routes.ts:116 — substring matching on Error.message can misclassify a discovery/network throw as client_rejected.
• packages/plugins-ui/src/mcp-preset-cards.tsx:258 — toolCounts is seeded only from the OAuth return query; a later /plugins load without toolCount falls back to a bare Connected.
• packages/mcp-tools/src/mcp-client.ts:28 — the 2 minute timeout also applies to listMcpTools, so a hung post-auth tools/list can block the callback for 2 minutes.
• packages/credential-providers/src/mcp-origin-pinned-fetch.ts:13 — extras allow https://canva.ai when pinned to https://mcp.canva.com; canva.com remains refused.
• packages/connections/src/mcp-oauth.ts:142 — refreshMcpOAuthTokens still constructs the provider without scope.

[TheGreatAxios]

critique · approve

Canva MCP connect path matches the brief: shared origin pin (mcp.canva.com plus canva.ai first hop, no 3xx follow), DCR scopes, client_rejected for RFC 7591 4xx, toolCount on return, 120s tool timeout, empty package-registry catalog. mcp-tools 0.0.10 matches the timeout source change. No DATABASE_URL leak.

Live Canva OAuth is still unverified (docs already say so) — not a code defect.

GitHub will not accept approve on the author's own PR; this comment is the review.