From 4f1ae8602136efbd42d3ebaefe7d68ef89f2499f Mon Sep 17 00:00:00 2001
From: David Kaya <david@kaya.sk>
Date: Fri, 27 Mar 2026 19:31:03 +0100
Subject: [PATCH] fix: add diagnostic logging to MCP OAuth probing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add [aryx oauth] log messages throughout the proactive auth flow so
failures are visible in the Electron main process console (DevTools →
Main Process or terminal output). Logs cover: probe start, HTTP status,
PRM discovery, token skip, flow start, and success/failure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/main/AryxAppService.ts           | 21 ++++++++++++++++++---
 src/main/services/mcpOAuthService.ts | 11 +++++++++--
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/src/main/AryxAppService.ts b/src/main/AryxAppService.ts
index d12fbeb..e78384a 100644
--- a/src/main/AryxAppService.ts
+++ b/src/main/AryxAppService.ts
@@ -944,18 +944,33 @@ export class AryxAppService extends EventEmitter<AppServiceEvents> {
       .filter((s): s is McpServerDefinition => !!s && s.transport !== 'local')
       .filter((s) => s.transport === 'http' || s.transport === 'sse');
 
+    if (httpServers.length === 0) {
+      return;
+    }
+
+    console.log(`[aryx oauth] Probing ${httpServers.length} HTTP MCP server(s) for OAuth requirements…`);
+
     for (const server of httpServers) {
       if (server.transport === 'local') continue;
       const existingToken = getStoredToken(server.url);
-      if (existingToken) continue;
+      if (existingToken) {
+        console.log(`[aryx oauth] Skipping ${server.name} — token already stored`);
+        continue;
+      }
 
       try {
         const needsAuth = await requiresOAuth(server.url);
-        if (!needsAuth) continue;
+        if (!needsAuth) {
+          console.log(`[aryx oauth] ${server.name} does not require OAuth`);
+          continue;
+        }
 
+        console.log(`[aryx oauth] ${server.name} requires OAuth — starting flow…`);
         const result = await performMcpOAuthFlow({ serverUrl: server.url });
 
-        if (!result.success) {
+        if (result.success) {
+          console.log(`[aryx oauth] ${server.name} authenticated successfully`);
+        } else {
           console.warn(`[aryx oauth] Proactive auth failed for ${server.name}: ${result.error}`);
         }
       } catch (err) {
diff --git a/src/main/services/mcpOAuthService.ts b/src/main/services/mcpOAuthService.ts
index 5b5941c..e05bb3d 100644
--- a/src/main/services/mcpOAuthService.ts
+++ b/src/main/services/mcpOAuthService.ts
@@ -27,22 +27,29 @@ export interface McpOAuthFlowResult {
  */
 export async function requiresOAuth(serverUrl: string): Promise<boolean> {
   try {
+    console.log(`[aryx oauth] Probing ${serverUrl} for OAuth requirements…`);
     const response = await fetch(serverUrl, {
       method: 'GET',
       signal: AbortSignal.timeout(5_000),
     });
 
+    console.log(`[aryx oauth] Probe ${serverUrl} returned ${response.status}`);
+
     if (response.status !== 401) {
       return false;
     }
 
     const base = serverUrl.replace(/\/+$/, '');
-    const prmResponse = await fetch(`${base}/.well-known/oauth-protected-resource`, {
+    const prmUrl = `${base}/.well-known/oauth-protected-resource`;
+    console.log(`[aryx oauth] Checking PRM at ${prmUrl}…`);
+    const prmResponse = await fetch(prmUrl, {
       signal: AbortSignal.timeout(5_000),
     });
 
+    console.log(`[aryx oauth] PRM response: ${prmResponse.status}`);
     return prmResponse.ok;
-  } catch {
+  } catch (err) {
+    console.warn(`[aryx oauth] Probe failed for ${serverUrl}:`, err instanceof Error ? err.message : err);
     return false;
   }
 }