Fixed false-positive connection status in Composio

Summary

Closed, Completed

Understand
Investigated backend and UI connection status logic.
Understand
Build
Implemented reconciliation logic and UI fixes.
Build
Edit
Added tests and improved UI error indicators.
Edit
Verify
Ran tests and ensured no regressions.
Verify
Cleanup
Cleaned up collateral formatting changes.
Cleanup

so even though something didn't connect, let's say this lag landed me on the compose.io page, but it asked me for the workspace. I did not provide any workspace URL or anything. Even though when I went back it says working and connected, we definitely need to fix this. Go deep into it, probably understand what we are doing that goes wrong, create a substantial plan, and let's get cooking

I'll dig into the Composio connect flow to understand why a source shows "connected" even when the OAuth handshake never actually completed. Let me explore the relevant code.

Async agent launched successfully.
agentId: accb7fc82cfd7ec56 (internal ID - do not mention to user. Use SendMessage with to: 'accb7fc82cfd7ec56' to continue this agent.)
The agent is working in the background. You will be notified automatically when it completes.
Do not duplicate this agent's work — avoid working with the same files or topics it is using. Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
output_file: /private/tmp/claude-501/-Users-venusbhatia-Downloads-Zrux/7bafd0cd-72f6-4811-8ba2-2e9c7e9f2330/tasks/accb7fc82cfd7ec56.output
Do NOT Read or tail this file via the shell tool — it is the full subagent JSONL transcript and reading it will overflow your context. If the user asks for progress, say the agent is still running; you'll get a completion notification.

I launched an explorer to map the full connect flow. Let me also look directly at the Composio connection status logic in parallel while that runs.

>echo "=== connect-related API routes ===" && find app -type d | grep -iE "connect|onboard|composio" 2>/dev/null; echo "=== files mentioning connectedAccounts or link( ===" && grep -rln "connectedAccounts" app lib components 2>/dev/null; echo "=== source_connection references ===" && grep -rln "source_connection" app lib components supabase 2>/dev/null

=== connect-related API routes ===
app/onboarding
app/api/connections
app/api/connect
app/api/connect/[source]
=== files mentioning connectedAccounts or link( ===
app/api/oauth/callback/route.ts
app/api/connect/[source]/route.ts
=== source_connection references ===
app/api/oauth/callback/route.ts
app/api/connections/route.test.ts
app/api/connections/route.ts
app/api/webhooks/[source]/route.ts
app/api/connect/[source]/route.ts
lib/db/types.ts
supabase/migrations/0004_source_connection.sql

Let me read the key files directly to understand the status logic.

Now I have the backend flow. The backend logic looks careful (status starts initiated, callback verifies ACTIVE before flipping to active). So the false-positive likely lives in the UI — how it interprets status. Let me look at the onboarding page and the status-consuming components.

>echo "=== onboarding dir ===" && ls -la app/onboarding && echo "=== files referencing /api/connections or connect ===" && grep -rln "api/connect\|/api/connections\|connected=1\|alreadyConnected\|ConnectionStatus" app components 2>/dev/null && echo "=== status usage in components ===" && grep -rln "'active'\|initiated\|isConnected\|connected" components app/onboarding 2>/dev/null

=== onboarding dir ===
total 16
drwxr-xr-x@  3 venusbhatia  staff    96 Jun 16 20:08 .
drwxr-xr-x  11 venusbhatia  staff   352 Jun 16 19:30 ..
-rw-r--r--   1 venusbhatia  staff  6312 Jun 16 20:08 page.tsx
=== files referencing /api/connections or connect ===
app/(app)/search/page.tsx
app/api/oauth/callback/route.ts
app/api/connections/route.test.ts
app/api/connections/route.ts
app/api/connect/[source]/route.ts
app/onboarding/page.tsx
components/shell/SourceDots.tsx
=== status usage in components ===
components/ui/EmptyState.tsx
components/shell/TopBar.tsx
components/shell/SourceDots.tsx
components/graph/DetailPanel.tsx
components/graph/layout.ts
app/onboarding/page.tsx

This is the smoking gun. Let me confirm the Composio status semantics and check for a disconnect/reconcile path before I write the plan.

>echo "=== connect API dir ===" && ls -R app/api/connect app/api/connections app/api/oauth 2>/dev/null; echo "=== disconnect/delete routes ===" && grep -rln "disconnect\|delete\|DELETE\|\.delete(" app/api 2>/dev/null; echo "=== composio status strings used ===" && grep -rn "ACTIVE\|INITIAT\|EXPIRED\|FAILED\|INACTIVE\|status" lib/connectors 2>/dev/null

=== connect API dir ===
app/api/connect:
[source]

app/api/connect/[source]:
route.ts

app/api/connections:
route.test.ts
route.ts

app/api/oauth:
callback

app/api/oauth/callback:
route.ts
=== disconnect/delete routes ===
app/api/connections/route.ts
app/api/webhooks/[source]/route.ts
app/api/remember/route.test.ts
app/api/remember/[memoryId]/route.ts
=== composio status strings used ===
lib/connectors/linear.test.ts:19:  it('maps an issue into a RawItem and flags blocked state in status', async () => {
lib/connectors/linear.test.ts:47:      status: 'blocked',
lib/connectors/linear.test.ts:57:    expect(items[0]!.status).toBe('resolved')
lib/connectors/notion.ts:82:  // short status string that would otherwise be stored verbatim as the body.
lib/connectors/calendar.test.ts:30:            status: 'confirmed',
lib/connectors/calendar.test.ts:50:      status: 'confirmed',
lib/connectors/calendar.ts:21:  status?: string
lib/connectors/calendar.ts:58:    status: e.status ?? undefined,
lib/connectors/types.ts:27:  status?: string
lib/connectors/linear.ts:2:// items: status maps from the workflow state name so blocker_scan can filter on
lib/connectors/linear.ts:38:// Linear state -> our status vocabulary. Anything named/typed "blocked" -> blocked.
lib/connectors/linear.ts:64:    status: mapStatus(issue.state),

I have a clear picture. Let me quickly check the connections test to know what contract I must preserve, then wait for the explorer's findings to fill any gaps.

Let me read the remaining status consumers to scope the UI fix completely.

>echo "=== TopBar ===" && grep -n "connect\|status\|active\|initiated\|/api/connections" components/shell/TopBar.tsx; echo "=== EmptyState ===" && grep -n "connect\|status\|active\|initiated" components/ui/EmptyState.tsx; echo "=== search page ===" && grep -n "connect\|status\|active\|initiated\|/api/connections" "app/(app)/search/page.tsx"

=== TopBar ===
13:  '/ask': { title: 'Ask', sub: "Grounded answers from everything you're connected to" },
=== EmptyState ===
1:// Shared empty / zero-data state. Real tenants start with nothing connected, so
=== search page ===
3:// Search: hybrid keyword + semantic search across the tenant's connected tools.
5:// derived from what the tenant actually has connected.
17:  status: string
29:  // Filter chips: All + the tenant's active sources.
33:        const res = await fetch('/api/connections')
35:        const json = (await res.json()) as { connections: Connection[] }
36:        setSources(json.connections.filter((c) => c.status === 'active').map((c) => c.source))
104:          const active = filter === c
111:                (active
126:          body="One query runs over email, Slack, Linear, Notion and everything else you have connected."

Diagnosis confirmed by both my reads and the explorer. Let me state it, then build the fix.

The bug, precisely

There are two compounding failures:

UI false-positive — app/onboarding/page.tsx:122 does const connected = Boolean(c). Any source_connection row counts as "connected", so an initiated row (OAuth started, never completed) renders the green "Working" badge and hides the Connect button. That's exactly what you saw.
No reconciliation of abandoned initiated rows — when you bail on Composio's workspace-URL screen and hit browser-back, our /api/oauth/callback never runs. The row sits at initiated forever. Nothing ever verifies it against live Composio status or expires it, and the callback always redirects with ?connected=1 claiming success.

So: a row exists → UI says connected → but the poller (status='active' only) never ingests. Permanent lie, no retry path.

The plan

A. UI truth — connected means status === 'active', not "row exists". initiated/error show their real label and keep an actionable Connect/Retry button.

B. Reconcile abandoned connections — a shared reconcileInitiated(userId) that checks each initiated row against live Composio: ACTIVE→active+load; terminal/past-TTL→error; genuinely-pending-and-recent→leave. Exposed as POST /api/connections/reconcile, called by onboarding on mount; the OAuth callback uses it too.

C. Callback honesty — redirect ?connected=1 only when something actually activated; otherwise ?pending=1.

Let me get cooking. First, isolate in a worktree.

Created worktree at /Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive on branch worktree-fix-connect-false-positive. The session is now working in the worktree. Use ExitWorktree to leave mid-session, or exit the session to be prompted.

Now let me verify enqueueLoad's signature and check the worktree path before editing.

Now let me create the shared reconcile helper.

Now the reconcile API route:

Now refactor the OAuth callback to use the shared reconcile and redirect honestly:

Now the onboarding UI — the core false-positive. Let me read the worktree copy and fix it:

Now the three onboarding edits. First, the notice handling (add pending):

Now the core fix — connected must mean active, and the button stays available for initiated/error:

Now improve SourceDots so an error connection is visually distinct (red) rather than grey-as-idle:

Now a focused unit test for the reconcile logic (the heart of the fix). Let me model the Supabase mock on the existing connections test:

Now let me run the new test and typecheck/lint to verify everything compiles.

>pnpm vitest run lib/connectors/reconcile.test.ts app/api/connections/route.test.ts 2>&1 | tail -40

[90mundefined[39m
[41m[30m ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL [39m[49m [31mCommand "vitest" not found[39m

Did you mean "pnpm test"?

>cat package.json | grep -A20 '"scripts"'

  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start",
    "lint": "next lint",
    "typecheck": "tsc --noEmit",
    "format": "prettier --write .",
    "test": "vitest run",
    "test:watch": "vitest",
    "eval": "tsx eval/run.ts",
    "eval:seed": "tsx eval/seed.ts",
    "db:types": "supabase gen types typescript --linked > lib/db/types.ts"
  },
  "dependencies": {
    "@ai-sdk/openai": "^1.3.0",
    "@composio/core": "^0.10.0",
    "@langfuse/otel": "^5.4.1",
    "@langfuse/tracing": "^5.4.1",
    "@opentelemetry/api": "1.9.0",
    "@opentelemetry/sdk-trace-node": "^2.8.0",
    "@sentry/nextjs": "^10.58.0",

>pnpm test lib/connectors/reconcile.test.ts app/api/connections/route.test.ts 2>&1 | tail -45

> zrux@0.1.0 test /Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive
> vitest run lib/connectors/reconcile.test.ts app/api/connections/route.test.ts

sh: vitest: command not found
[41m[30m ELIFECYCLE [39m[49m [31mTest failed. See above for more details.[39m
[43m[30m WARN [39m[49m  Local package.json exists, but node_modules missing, did you mean to install?

The worktree lacks node_modules. Let me symlink the main checkout's to run tests:

>pnpm test lib/connectors/reconcile.test.ts app/api/connections/route.test.ts 2>&1 | tail -40

> zrux@0.1.0 test /Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive
> vitest run lib/connectors/reconcile.test.ts app/api/connections/route.test.ts


[1m[7m[36m RUN [39m[27m[22m [36mv2.1.9 [39m[90m/Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive[39m

 [32m✓[39m lib/connectors/reconcile.test.ts [2m([22m[2m6 tests[22m[2m)[22m[90m 6[2mms[22m[39m
 [32m✓[39m app/api/connections/route.test.ts [2m([22m[2m4 tests[22m[2m)[22m[90m 20[2mms[22m[39m
[90mstderr[2m | app/api/connections/route.test.ts[2m > [22m[2mGET /api/connections[2m > [22m[2mreturns 500 when the connections read fails
[22m[39m[connections] { userId: [32m'u1'[39m } boom


[2m Test Files [22m [1m[32m2 passed[39m[22m[90m (2)[39m
[2m      Tests [22m [1m[32m10 passed[39m[22m[90m (10)[39m
[2m   Start at [22m 20:36:13
[2m   Duration [22m 986ms[2m (transform 109ms, setup 0ms, collect 522ms, tests 27ms, environment 0ms, prepare 589ms)[22m

All 10 pass. Now typecheck the changed files to catch any type errors:

>pnpm typecheck 2>&1 | tail -25

> zrux@0.1.0 typecheck /Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive
> tsc --noEmit

lib/auth/supabase-browser.ts(6,37): error TS2307: Cannot find module '@supabase/ssr' or its corresponding type declarations.
lib/auth/supabase-server.ts(6,36): error TS2307: Cannot find module '@supabase/ssr' or its corresponding type declarations.
lib/auth/supabase-server.ts(25,16): error TS7006: Parameter 'cookiesToSet' implicitly has an 'any' type.
lib/auth/supabase-server.ts(30,37): error TS7031: Binding element 'name' implicitly has an 'any' type.
lib/auth/supabase-server.ts(30,43): error TS7031: Binding element 'value' implicitly has an 'any' type.
lib/auth/supabase-server.ts(30,50): error TS7031: Binding element 'options' implicitly has an 'any' type.
middleware.ts(6,36): error TS2307: Cannot find module '@supabase/ssr' or its corresponding type declarations.
middleware.ts(20,16): error TS7006: Parameter 'cookiesToSet' implicitly has an 'any' type.
middleware.ts(21,35): error TS7031: Binding element 'name' implicitly has an 'any' type.
middleware.ts(21,41): error TS7031: Binding element 'value' implicitly has an 'any' type.
middleware.ts(23,35): error TS7031: Binding element 'name' implicitly has an 'any' type.
middleware.ts(23,41): error TS7031: Binding element 'value' implicitly has an 'any' type.
middleware.ts(23,48): error TS7031: Binding element 'options' implicitly has an 'any' type.
[41m[30m ELIFECYCLE [39m[49m [31mCommand failed with exit code 2.[39m

The errors are all pre-existing and confined to @supabase/ssr auth files — none of my changed files appear. Let me confirm this is a pre-existing condition (missing dep in the symlinked node_modules), not something I introduced:

>echo "=== is @supabase/ssr installed? ===" && ls /Users/venusbhatia/Downloads/Zrux/node_modules/@supabase/ssr >/dev/null 2>&1 && echo "present" || echo "MISSING (pre-existing typecheck gap)"; echo "=== does main repo typecheck show same errors? ===" && cd /Users/venusbhatia/Downloads/Zrux && pnpm typecheck 2>&1 | grep -c "@supabase/ssr\|supabase-server\|middleware.ts"

=== is @supabase/ssr installed? ===
MISSING (pre-existing typecheck gap)
=== does main repo typecheck show same errors? ===
13
Shell cwd was reset to /Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive

Confirmed pre-existing (identical 13 errors on main — @supabase/ssr simply isn't installed locally). My files add zero type errors. Let me run lint on my changes and the full test suite:

>echo "=== full test suite ===" && pnpm test 2>&1 | tail -15

=== full test suite ===
[90mstderr[2m | lib/llm/gateway.test.ts[2m > [22m[2massertGatewayUp[2m > [22m[2mtransitions OPEN -> HALF_OPEN (persisted) once the cooldown has elapsed
[22m[39m[breaker] cooldown elapsed -> HALF_OPEN probe (streaming)

[90mstderr[2m | lib/llm/gateway.test.ts[2m > [22m[2massertGatewayUp[2m > [22m[2mre-OPENs (does not silently CLOSE) when a streaming probe fails after a stale window
[22m[39m[breaker] cooldown elapsed -> HALF_OPEN probe (streaming)
[breaker] HALF_OPEN probe failed -> OPEN

 [32m✓[39m lib/llm/gateway.test.ts [2m([22m[2m17 tests[22m[2m)[22m[33m 3638[2mms[22m[39m
   [33m[2m✓[22m[39m callWithFallback[2m > [22mthrows GatewayDownError when both primary and fallback fail [33m3606[2mms[22m[39m

[2m Test Files [22m [1m[32m30 passed[39m[22m[90m (30)[39m
[2m      Tests [22m [1m[32m154 passed[39m[22m[90m (154)[39m
[2m   Start at [22m 20:36:47
[2m   Duration [22m 5.15s[2m (transform 1.17s, setup 0ms, collect 9.91s, tests 4.14s, environment 8ms, prepare 3.97s)[22m

All 154 tests pass (30 files). Let me run lint on the changed files:

>pnpm lint 2>&1 | tail -20

> zrux@0.1.0 lint /Users/venusbhatia/Downloads/Zrux/.claude/worktrees/fix-connect-false-positive
> next lint

[1m[36m?[39m How would you like to configure ESLint? https://nextjs.org/docs/basic-features/eslint[22m
[?25l[36m❯ [39m [1m[4m[36mStrict[39m[24m[22m[1m[33m (recommended)[39m[22m
   Base
   Cancel [33m[1m⚠[22m[39m If you set up ESLint yourself, we recommend adding the Next.js ESLint plugin. See https://nextjs.org/docs/basic-features/eslint#migrating-existing-config
[41m[30m ELIFECYCLE [39m[49m [31mCommand failed with exit code 1.[39m

next lint prompts interactively because the worktree lacks the eslint config (an environment artifact, not a code issue). Let me verify formatting with prettier on my files instead:

>node_modules/.bin/prettier --check lib/connectors/reconcile.ts lib/connectors/reconcile.test.ts app/api/connections/reconcile/route.ts app/api/oauth/callback/route.ts app/onboarding/page.tsx components/shell/SourceDots.tsx 2>&1

Checking formatting...
All matched files use Prettier code style!

>git --no-pager diff --stat HEAD && echo "=== untracked new files ===" && git status --porcelain | grep '^??' | grep -v node_modules

 .claude/commands/review.md                         |    3 +
 .claude/commands/test.md                           |    1 +
 .github/workflows/claude-code-review.yml           |    1 -
 .github/workflows/claude.yml                       |    1 -
 CLAUDE.md                                          |   63 +-
 MEMORY.md                                          |    2 +-
 app/(app)/relationships/page.tsx                   |    9 +-
 app/(app)/today/page.tsx                           |    3 +-
 app/(marketing)/landing.css                        |   20 +-
 app/api/connections/route.test.ts                  |   18 +-
 app/api/oauth/callback/route.ts                    |   56 +-
 app/api/search/route.test.ts                       |   15 +-
 app/api/today/route.test.ts                        |   13 +-
 app/onboarding/page.tsx                            |   19 +-
 components/search/ResultCard.tsx                   |    5 +-
 components/shell/SourceDots.tsx                    |    1 +
 docs/Architecture.md                               |  237 +-
 docs/SETUP.md                                      |   28 +-
 docs/design/project/Zrux App.dc.html               | 1758 +++++++---
 docs/design/project/Zrux Landing.html              | 2099 ++++++++----
 docs/design/project/support.js                     | 1879 +++++------
 .../Building Optimal Architecture Claude.html      | 2099 ++++++++----
 .../uploads/Building Optimal Architecture.md       |  237 +-
 docs/phase6-trade-offs.md                          |   21 +-
 docs/plans/phase-4-personalization.md              |   96 +-
 docs/spec.md                                       |   61 +-
 docs/trade-offs.md                                 |    4 +-
 lib/connectors/calendar.ts                         |    6 +-
 lib/connectors/linear.test.ts                      |    5 +-
 lib/ingestion/chunk.ts                             |    5 +-
 lib/ingestion/enrich.test.ts                       |   12 +-
 lib/ingestion/normalize.test.ts                    |   11 +-
 lib/ui/source.ts                                   |    6 +-
 pnpm-lock.yaml                                     | 3500 +++++++++++++++-----
 scripts/verify-ingest.ts                           |    4 +-
 35 files changed, 8256 insertions(+), 4042 deletions(-)
=== untracked new files ===
?? app/api/connections/reconcile/
?? lib/connectors/reconcile.test.ts
?? lib/connectors/reconcile.ts

Let me review the complete diff for coherence:

The diff against HEAD shows far more than my 6 files — the worktree branched from origin/main (the default "fresh" base), which is behind the local main. Let me confirm so my fix lands on top of current main, not stale code:

>echo "=== worktree HEAD ===" && git rev-parse --short HEAD && echo "=== local main ===" && git rev-parse --short main && echo "=== origin/main ===" && git rev-parse --short origin/main 2>/dev/null || echo "no origin/main" && echo "=== is worktree base == local main? ===" && git merge-base --is-ancestor main HEAD 2>/dev/null && echo "main is ancestor of HEAD" || echo "main NOT ancestor — worktree is off stale base"

=== worktree HEAD ===
7375d1f
=== local main ===
7375d1f
=== origin/main ===
7375d1f
=== is worktree base == local main? ===
main is ancestor of HEAD

Odd — HEAD, main, and origin/main are all the same commit, yet the diff lists ~35 files. Let me see the actual worktree status to understand what's real vs. checkout noise:

>echo "=== worktree git status (short) ===" && git status --short | grep -v '^??' | head -40; echo "=== count modified tracked ===" && git status --short | grep -vc '^??'

=== worktree git status (short) ===
 M .claude/commands/review.md
 M .claude/commands/test.md
 M .github/workflows/claude-code-review.yml
 M .github/workflows/claude.yml
 M CLAUDE.md
 M MEMORY.md
 M app/(app)/relationships/page.tsx
 M app/(app)/today/page.tsx
 M app/(marketing)/landing.css
 M app/api/connections/route.test.ts
 M app/api/oauth/callback/route.ts
 M app/api/search/route.test.ts
 M app/api/today/route.test.ts
 M app/onboarding/page.tsx
 M components/search/ResultCard.tsx
 M components/shell/SourceDots.tsx
 M docs/Architecture.md
 M docs/SETUP.md
 M "docs/design/project/Zrux App.dc.html"
 M "docs/design/project/Zrux Landing.html"
 M docs/design/project/support.js
 M "docs/design/project/uploads/Building Optimal Architecture Claude.html"
 M "docs/design/project/uploads/Building Optimal Architecture.md"
 M docs/phase6-trade-offs.md
 M docs/plans/phase-4-personalization.md
 M docs/spec.md
 M docs/trade-offs.md
 M lib/connectors/calendar.ts
 M lib/connectors/linear.test.ts
 M lib/ingestion/chunk.ts
 M lib/ingestion/enrich.test.ts
 M lib/ingestion/normalize.test.ts
 M lib/ui/source.ts
 M pnpm-lock.yaml
 M scripts/verify-ingest.ts
=== count modified tracked ===
35

35 tracked files show modified, including many I never touched. Let me see what changed in one I didn't touch, to tell real edits from formatting noise:

>git --no-pager diff lib/connectors/calendar.ts lib/ui/source.ts | head -60

diff --git a/lib/connectors/calendar.ts b/lib/connectors/calendar.ts
index e056aca..8aea657 100644
--- a/lib/connectors/calendar.ts
+++ b/lib/connectors/calendar.ts
@@ -68,7 +68,11 @@ function toRawItem(e: CalEvent): RawItem | null {
   }
 }
 
-async function* fetchWindow(userId: string, timeMin: string, timeMax: string): AsyncIterable<RawItem> {
+async function* fetchWindow(
+  userId: string,
+  timeMin: string,
+  timeMax: string,
+): AsyncIterable<RawItem> {
   let pageToken: string | undefined
   do {
     const data = (await executeTool(SLUG, userId, {
diff --git a/lib/ui/source.ts b/lib/ui/source.ts
index c2b54ff..7fb9c18 100644
--- a/lib/ui/source.ts
+++ b/lib/ui/source.ts
@@ -29,7 +29,11 @@ const SOURCE_META: Record<string, { label: string; icon: IconName; tint: Tint }>
   voice_memo: { label: 'Voice', icon: 'mic', tint: { bg: '#f0f0f2', color: '#6e6e73' } },
 }
 
-const FALLBACK = { label: 'Source', icon: 'layers' as IconName, tint: { bg: '#f0f0f2', color: '#6e6e73' } }
+const FALLBACK = {
+  label: 'Source',
+  icon: 'layers' as IconName,
+  tint: { bg: '#f0f0f2', color: '#6e6e73' },
+}
 
 export function sourceMeta(source: string) {
   return SOURCE_META[source] ?? FALLBACK

Diagnosis: a format hook ran repo-wide Prettier on my first write, reformatting 29 files I never logically touched (pure line-wrapping, e.g. calendar.ts). That's collateral noise. Let me restore those unrelated files so the worktree contains only my actual fix:

>git restore -- $(git status --short | grep -v '^??' | grep -vE 'oauth/callback/route.ts|onboarding/page.tsx|shell/SourceDots.tsx' | sed 's/^ M //' | sed 's/^M  //') 2>&1; echo "=== remaining modified/new (my fix only) ===" && git status --short | grep -v node_modules

error: pathspec '"docs/design/project/Zrux' did not match any file(s) known to git
error: pathspec 'App.dc.html"' did not match any file(s) known to git
error: pathspec '"docs/design/project/Zrux' did not match any file(s) known to git
error: pathspec 'Landing.html"' did not match any file(s) known to git
error: pathspec '"docs/design/project/uploads/Building' did not match any file(s) known to git
error: pathspec 'Optimal' did not match any file(s) known to git
error: pathspec 'Architecture' did not match any file(s) known to git
error: pathspec 'Claude.html"' did not match any file(s) known to git
error: pathspec '"docs/design/project/uploads/Building' did not match any file(s) known to git
error: pathspec 'Optimal' did not match any file(s) known to git
error: pathspec 'Architecture.md"' did not match any file(s) known to git
=== remaining modified/new (my fix only) ===
 M .claude/commands/review.md
 M .claude/commands/test.md
 M .github/workflows/claude-code-review.yml
 M .github/workflows/claude.yml
 M CLAUDE.md
 M MEMORY.md
 M app/(app)/relationships/page.tsx
 M app/(app)/today/page.tsx
 M app/(marketing)/landing.css
 M app/api/connections/route.test.ts
 M app/api/oauth/callback/route.ts
 M app/api/search/route.test.ts
 M app/api/today/route.test.ts
 M app/onboarding/page.tsx
 M components/search/ResultCard.tsx
 M components/shell/SourceDots.tsx
 M docs/Architecture.md
 M docs/SETUP.md
 M "docs/design/project/Zrux App.dc.html"
 M "docs/design/project/Zrux Landing.html"
 M docs/design/project/support.js
 M "docs/design/project/uploads/Building Optimal Architecture Claude.html"
 M "docs/design/project/uploads/Building Optimal Architecture.md"
 M docs/phase6-trade-offs.md
 M docs/plans/phase-4-personalization.md
 M docs/spec.md
 M docs/trade-offs.md
 M lib/connectors/calendar.ts
 M lib/connectors/linear.test.ts
 M lib/ingestion/chunk.ts
 M lib/ingestion/enrich.test.ts
 M lib/ingestion/normalize.test.ts
 M lib/ui/source.ts
 M pnpm-lock.yaml
 M scripts/verify-ingest.ts
?? app/api/connections/reconcile/
?? lib/connectors/reconcile.test.ts
?? lib/connectors/reconcile.ts

Filenames with spaces broke word-splitting. Let me use pathspec exclusions instead, which handles spaces correctly:

>git restore -- ':(exclude)app/api/oauth/callback/route.ts' ':(exclude)app/onboarding/page.tsx' ':(exclude)components/shell/SourceDots.tsx' . && echo "=== remaining (my fix only) ===" && git status --short | grep -v node_modules

=== remaining (my fix only) ===
 M app/api/oauth/callback/route.ts
 M app/onboarding/page.tsx
 M components/shell/SourceDots.tsx
?? app/api/connections/reconcile/
?? lib/connectors/reconcile.test.ts
?? lib/connectors/reconcile.ts

Clean — only my fix remains (3 modified, 3 new). Let me re-run the relevant tests to confirm nothing regressed after the restore:

>pnpm test lib/connectors/reconcile.test.ts app/api/connections/route.test.ts 2>&1 | tail -8

 [32m✓[39m app/api/connections/route.test.ts [2m([22m[2m4 tests[22m[2m)[22m[90m 26[2mms[22m[39m

[2m Test Files [22m [1m[32m2 passed[39m[22m[90m (2)[39m
[2m      Tests [22m [1m[32m10 passed[39m[22m[90m (10)[39m
[2m   Start at [22m 20:39:48
[2m   Duration [22m 912ms[2m (transform 98ms, setup 0ms, collect 471ms, tests 31ms, environment 0ms, prepare 117ms)[22m

All green. Let me record the key design invariant in memory (it updates the existing Composio-connect note), then summarize.

Done. Here's what I found and shipped.

Root cause — it was a lie in two places, not one

When you bailed on Composio's hosted screen (the workspace-URL prompt) and hit back, your browser never went through our /api/oauth/callback — so the connection was never finalized. Yet the app showed "Working / connected" because:

The UI treated any row as connected. app/onboarding/page.tsx did const connected = Boolean(c). A source_connection row in 'initiated' state (OAuth started, never finished) is not connected — but it rendered the green "Working" badge and hid the Connect button, so you couldn't even retry.
Nothing ever reconciled an abandoned initiated row. It sat at 'initiated' forever. Meanwhile the poller only ingests status='active' rows, so it silently did nothing — a permanent false-positive. The callback also always redirected with ?connected=1 even when nothing actually activated.

The fix (3 modified, 3 new files)

UI truth — connected = c?.status === 'active'. initiated/error now show their real label and keep an actionable Retry button. Sidebar dot gets red for error.
lib/connectors/reconcile.ts (new) — reconcileInitiated(userId) re-checks each initiated row against live Composio: ACTIVE→active + enqueue load; terminal (FAILED/EXPIRED/...) or past a 10-min TTL → error; genuinely-pending-and-recent → left alone. No schema change (TTL keys off updated_at).
POST /api/connections/reconcile (new) — onboarding calls it on mount, so an abandoned flow self-heals to a retryable state instead of lying.
OAuth callback — now uses the shared reconcile and redirects ?connected=1 only when something actually went ACTIVE, else ?pending=1.
reconcile.test.ts (new, 6 cases) covering active/pending/terminal/TTL/throw paths.

Verified

New + connections tests: 10/10 pass. Full suite: 154/154 pass.
Typecheck: zero new errors (the 13 @supabase/ssr errors are pre-existing — identical on main, package just isn't installed locally).
Prettier clean on all touched files.
I stripped 29 files of collateral repo-wide Prettier reformatting (a format hook fired on first write) so the worktree holds only the fix.

Work is isolated in worktree branch worktree-fix-connect-false-positive. I haven't committed — say the word and I'll commit just these 6 files (per your 5/5 Greptile gate before any merge to main).

result: Fixed the Composio false-positive "connected" bug — UI now treats only status==='active' as connected, abandoned initiated rows reconcile against live Composio (active/error/pending) via new reconcileInitiated + /api/connections/reconcile, and the OAuth callback no longer claims success when nothing activated; 154/154 tests pass.

Did you push this yet?

No — I haven't committed or pushed. The fix is sitting uncommitted in the worktree branch worktree-fix-connect-false-positive (3 modified + 3 new files). I held off because pushing is outward-facing and you hadn't asked.

Want me to commit and push? If so, note your standing 5/5 Greptile gate — that applies before merging a PR into main, not to the push itself, so I can push the branch now and you'd run the review before merge.

Yes, please.

I'll commit the 6 files and push the branch. Let me verify the staging is exactly my fix first.

>git status --short | grep -v node_modules && echo "=== branch ===" && git rev-parse --abbrev-ref HEAD

 M .claude/commands/review.md
 M .claude/commands/test.md
 M .github/workflows/claude-code-review.yml
 M .github/workflows/claude.yml
 M CLAUDE.md
 M MEMORY.md
 M app/(app)/relationships/page.tsx
 M app/(app)/today/page.tsx
 M app/(marketing)/landing.css
 M app/api/connections/route.test.ts
 M app/api/oauth/callback/route.ts
 M app/api/search/route.test.ts
 M app/api/today/route.test.ts
 M app/onboarding/page.tsx
 M components/search/ResultCard.tsx
 M components/shell/SourceDots.tsx
 M docs/Architecture.md
 M docs/SETUP.md
 M "docs/design/project/Zrux App.dc.html"
 M "docs/design/project/Zrux Landing.html"
 M docs/design/project/support.js
 M "docs/design/project/uploads/Building Optimal Architecture Claude.html"
 M "docs/design/project/uploads/Building Optimal Architecture.md"
 M docs/phase6-trade-offs.md
 M docs/plans/phase-4-personalization.md
 M docs/spec.md
 M docs/trade-offs.md
 M lib/connectors/calendar.ts
 M lib/connectors/linear.test.ts
 M lib/ingestion/chunk.ts
 M lib/ingestion/enrich.test.ts
 M lib/ingestion/normalize.test.ts
 M lib/ui/source.ts
 M pnpm-lock.yaml
 M scripts/verify-ingest.ts
?? app/api/connections/reconcile/
?? lib/connectors/reconcile.test.ts
?? lib/connectors/reconcile.ts
=== branch ===
worktree-fix-connect-false-positive

The repo-wide Prettier hook re-fired (back to 35 files). I'll restore the collateral again, then stage only my 6 files explicitly so the commit is clean and reviewable.

>git restore -- ':(exclude)app/api/oauth/callback/route.ts' ':(exclude)app/onboarding/page.tsx' ':(exclude)components/shell/SourceDots.tsx' . && echo "=== after restore ===" && git status --short | grep -v node_modules

=== after restore ===
 M app/api/oauth/callback/route.ts
 M app/onboarding/page.tsx
 M components/shell/SourceDots.tsx
?? app/api/connections/reconcile/
?? lib/connectors/reconcile.test.ts
?? lib/connectors/reconcile.ts

Now stage exactly my 6 files and commit:

>git add app/api/oauth/callback/route.ts app/onboarding/page.tsx components/shell/SourceDots.tsx app/api/connections/reconcile/route.ts lib/connectors/reconcile.ts lib/connectors/reconcile.test.ts && echo "=== staged ===" && git diff --cached --name-only

=== staged ===
app/api/connections/reconcile/route.ts
app/api/oauth/callback/route.ts
app/onboarding/page.tsx
components/shell/SourceDots.tsx
lib/connectors/reconcile.test.ts
lib/connectors/reconcile.ts

Exactly the 6 files staged. Now commit and push:

>git commit -m "$(cat <<'EOF'
fix(connect): stop false-positive "connected" on abandoned OAuth

A source_connection row starts as 'initiated' and only becomes 'active'
after the OAuth callback verifies Composio status is ACTIVE. But the
onboarding UI used `connected = Boolean(c)`, so an 'initiated' row (user
bailed on Composio's hosted screen and hit back, never reaching
/api/oauth/callback) showed a green "Working" badge with no retry, while
the poller silently ingested nothing.

- UI: connected = c?.status === 'active'; keep a Retry button for
  initiated/error rows; red sidebar dot for error.
- reconcileInitiated() re-checks each 'initiated' row against live
  Composio: ACTIVE -> active + enqueue load; terminal or past-10min-TTL
  -> error; recent + pending -> left. Exposed as
  POST /api/connections/reconcile, called by onboarding on mount and
  reused by the OAuth callback.
- Callback redirects ?connected=1 only when something actually
  activated, else ?pending=1. No schema change (TTL uses updated_at).

Co-Authored-By: Claude Opus 4.8 (1M context) <[REDACTED]>
EOF
)" && echo "=== committed ===" && git log --oneline -1

[worktree-fix-connect-false-positive 0f0e63e] fix(connect): stop false-positive "connected" on abandoned OAuth
 6 files changed, 305 insertions(+), 38 deletions(-)
 create mode 100644 app/api/connections/reconcile/route.ts
 create mode 100644 lib/connectors/reconcile.test.ts
 create mode 100644 lib/connectors/reconcile.ts
=== committed ===
0f0e63e fix(connect): stop false-positive "connected" on abandoned OAuth

>git push -u origin worktree-fix-connect-false-positive 2>&1 | tail -15

remote: 
remote: Create a pull request for 'worktree-fix-connect-false-positive' on GitHub by visiting:        
remote:      https://github.com/venusbhatia/zrux/pull/new/worktree-fix-connect-false-positive        
remote: 
To https://github.com/venusbhatia/zrux.git
 * [new branch]      worktree-fix-connect-false-positive -> worktree-fix-connect-false-positive
branch 'worktree-fix-connect-false-positive' set up to track 'origin/worktree-fix-connect-false-positive'.

Pushed. Commit 0f0e63e (6 files, +305/−38) is now on origin/worktree-fix-connect-false-positive.

Want me to open a PR? GitHub's ready for one: https://github.com/venusbhatia/zrux/pull/new/worktree-fix-connect-false-positive — I can create it with gh. Per your 5/5 Greptile gate, run the review and resolve all P1s before merging into main.

result: Committed and pushed the connect false-positive fix as 0f0e63e to origin/worktree-fix-connect-false-positive (6 files, +305/−38); ready for a PR.

shall we add it to the #23 which is already open??

Let me check what PR #23 is and its branch before doing anything.

>gh pr view 23 --json number,title,headRefName,baseRefName,state,url 2>&1

{"baseRefName":"main","headRefName":"worktree-fix-connect-false-positive","number":23,"state":"OPEN","title":"fix(connect): stop false-positive \"connected\" on abandoned OAuth","url":"https://github.com/venusbhatia/zrux/pull/23"}

PR #23 is this fix — its head branch is worktree-fix-connect-false-positive, the exact branch I just pushed to. So my commit already landed on it; no separate PR needed. Let me confirm #23 contains the commit:

>gh pr view 23 --json commits --jq '.commits[] | .oid[0:7] + " " + .messageHeadline' 2>&1

0f0e63e fix(connect): stop false-positive "connected" on abandoned OAuth
844866c fix(onboarding): re-reconcile in-flight connections, not just on mount
e9708aa fix(reconcile): don't revert active rows on enqueue failure; scope up…

PR #23 already contains my commit plus two newer follow-up commits I didn't make (844866c re-reconcile in-flight, e9708aa don't revert active rows on enqueue failure) — someone pushed onto this branch after me. Let me check the real order so I know whether my local is behind:

>git fetch origin worktree-fix-connect-false-positive 2>&1 | tail -2; echo "=== origin branch log (newest first) ===" && git --no-pager log --oneline origin/worktree-fix-connect-false-positive -5; echo "=== local HEAD ===" && git rev-parse --short HEAD; echo "=== is local behind origin? ===" && git --no-pager log --oneline HEAD..origin/worktree-fix-connect-false-positive | sed 's/^/ahead-of-me: /'

From https://github.com/venusbhatia/zrux
 * branch            worktree-fix-connect-false-positive -> FETCH_HEAD
=== origin branch log (newest first) ===
e9708aa fix(reconcile): don't revert active rows on enqueue failure; scope updates
844866c fix(onboarding): re-reconcile in-flight connections, not just on mount
0f0e63e fix(connect): stop false-positive "connected" on abandoned OAuth
7375d1f Merge pull request #21 from venusbhatia/worktree-fix+composio-connect-link
61ae7b3 fix(connect): reconcile already-connected source into source_connection
=== local HEAD ===
0f0e63e
=== is local behind origin? ===
ahead-of-me: e9708aa fix(reconcile): don't revert active rows on enqueue failure; scope updates
ahead-of-me: 844866c fix(onboarding): re-reconcile in-flight connections, not just on mount

Good news: there's nothing to do. PR #23 already is this fix — it was opened on the same branch (worktree-fix-connect-false-positive) my commit went to, so my work is already in it.

Two follow-up commits landed on the branch after my push (from another session or your own edits), both building directly on my reconcile code:

844866c — re-reconcile in-flight connections, not just on mount
e9708aa — don't revert active rows on enqueue failure; scope updates

My local worktree is 2 commits behind origin as a result. I haven't touched anything, so no conflict.

So: the fix is already part of PR #23 — no new PR, no separate branch to merge in. Per your 5/5 Greptile gate, run the review on #23 and resolve all P1s before merging to main.

Want me to:

Pull the 2 follow-up commits into my worktree and sanity-check them (run the test suite against the full branch state), or
Leave it as-is since #23 already holds everything?

result: No action needed — my fix is already in PR #23 (same branch); two follow-up commits (844866c, e9708aa) were added on top by another session, so the PR is complete.