{"record":{"id":"dc2dd96929da6a21","repo":"different-ai/openwork","slug":"openwork-managed-mcp-oauth-is-currently-available","errorCode":null,"errorMessage":"OpenWork-managed MCP OAuth is currently available for local desktop workspaces only.","messagePattern":"OpenWork-managed MCP OAuth is currently available for local desktop workspaces only\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"apps/app/src/react-app/domains/connections/store.ts","lineNumber":799,"sourceCode":"        }\n        const summary = cloudMcpDisplaySummary({\n          signedIn: Boolean(context.denAuthToken?.trim()),\n          orgSelected: Boolean(context.orgId.trim()),\n          connecting: false,\n          health: result.health,\n        });\n        setStateField(\"mcpStatus\", `${summary.stageLabel}. ${summary.recommendedAction}`);\n        finishPerf(options.developerMode(), \"mcp.connect\", \"error\", startedAt, {\n          name: entry.name,\n          type: entryType,\n          error: summary.stageLabel,\n        });\n        return { ok: false, error: `${summary.stageLabel}. ${summary.recommendedAction}` };\n      }\n\n      if (entry.managedOAuth) {\n        if (isRemoteWorkspace || !isDesktopRuntime()) {\n          throw new Error(\"OpenWork-managed MCP OAuth is currently available for local desktop workspaces only.\");\n        }\n        if (entryType !== \"remote\" || !entry.url) {\n          throw new Error(\"OpenWork-managed OAuth requires a remote MCP URL.\");\n        }\n        if (!canUseOpenworkServer || !openworkClient || !openworkWorkspaceId) {\n          throw new Error(\"The local OpenWork server is required for managed MCP sign-in.\");\n        }\n        const result = await openworkClient.addManagedMcp(openworkWorkspaceId, {\n          name: slug,\n          url: entry.url,\n          oauth: {\n            applicationType: \"native\",\n            requestedScopes: entry.oauthConfig?.scope?.split(/\\s+/).filter(Boolean),\n            clientId: entry.oauthConfig?.clientId,\n            clientSecret: entry.oauthConfig?.clientSecret,\n          },\n        });\n        const connected = await waitForManagedMcpAuthorization(","sourceCodeStart":781,"sourceCodeEnd":817,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/apps/app/src/react-app/domains/connections/store.ts#L781-L817","documentation":"For entries with managedOAuth, the connect action only proceeds when the workspace is local (not remote) and the runtime is the desktop app. Otherwise it throws 'OpenWork-managed MCP OAuth is currently available for local desktop workspaces only.' Managed OAuth performs a desktop-browser OAuth dance mediated by the local OpenWork server, which remote/web runtimes cannot do.","triggerScenarios":"Calling connect on an entry with managedOAuth from a remote workspace (isRemoteWorkspace true) or from a non-desktop runtime (isDesktopRuntime() false), e.g. headless web UI or CI.","commonSituations":"Trying to connect an OAuth-managed service from the headless web dev environment; connecting from a cloud/remote workspace; running the app in a browser tab instead of the Electron desktop app.","solutions":["Use the OpenWork desktop app on a local workspace for managed OAuth sign-in","Move the work to a local (non-remote) workspace before connecting the managed service","For remote/headless environments, connect the service via API keys instead of managed OAuth","If this is a legitimate desktop+local case, verify isDesktopRuntime() detection isn't misfiring"],"exampleFix":"// before\nawait connect(entry); // managedOAuth entry, running in headless web\n// after\nif (entry.managedOAuth && (!isDesktopRuntime() || isRemoteWorkspace)) {\n  throwIfNoKeyFallback(entry); // or instruct: open the desktop app\n} else {\n  await connect(entry);\n}","handlingStrategy":"validation","validationCode":"if (entry.managedOAuth && (!isDesktopRuntime() || isRemoteWorkspace)) {\n  showNotice(\"Managed OAuth requires the OpenWork desktop app on a local workspace.\");\n  return;\n}","typeGuard":"function supportsManagedOAuth(e: McpEntry, runtime: { isDesktop: boolean; isRemote: boolean }): boolean {\n  return !e.managedOAuth || (runtime.isDesktop && !runtime.isRemote);\n}","tryCatchPattern":"try {\n  await connectionsStore.connect(entry);\n} catch (err) {\n  if (err.message.includes(\"local desktop workspaces only\")) {\n    offerApiKeyFallback(entry); // or deep-link to desktop app\n  } else throw err;\n}","preventionTips":["Only offer managed-OAuth connections in the desktop app on local workspaces","Prefer API-key auth for remote/headless/web environments","Check isDesktopRuntime() and workspace locality before rendering managed OAuth buttons","Document the desktop-only constraint for users automating headless setups"],"tags":["oauth","mcp","desktop-only","runtime-guard"],"backgroundTag":"unsupported-runtime-environment","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}