From e15e495515621830a1002e27b0ecc61f898d55ae Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:07:21 +0200
Subject: [PATCH 01/30] feat: Add a Connected Account Setting for Pull Requests

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 267 ++++++++++++++++++
 .../__tests__/ConnectedAccounts.spec.tsx      | 216 ++++++++++++++
 .../Nav/Settings/__tests__/Sidebar.spec.tsx   |   1 +
 .../Nav/Settings/__tests__/registry.spec.ts   |   1 +
 .../src/components/Nav/Settings/context.tsx   |   3 +
 .../src/components/Nav/Settings/registry.tsx  |  11 +
 client/src/components/Nav/Settings/types.ts   |   3 +
 .../PullRequest/connection.test.tsx           |  96 +++++++
 .../data-provider/PullRequest/connection.ts   |  59 ++++
 client/src/data-provider/PullRequest/index.ts |   1 +
 client/src/locales/en/translation.json        |  19 ++
 packages/data-provider/src/api-endpoints.ts   |   8 +
 packages/data-provider/src/data-service.ts    |  12 +
 packages/data-provider/src/keys.ts            |   3 +
 14 files changed, 700 insertions(+)
 create mode 100644 client/src/components/Nav/Settings/ConnectedAccounts.tsx
 create mode 100644 client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
 create mode 100644 client/src/data-provider/PullRequest/connection.test.tsx
 create mode 100644 client/src/data-provider/PullRequest/connection.ts

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
new file mode 100644
index 00000000000..393f3fd46e8
--- /dev/null
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -0,0 +1,267 @@
+import { useCallback, useId, useRef, useState } from 'react';
+import { ExternalLink, Gitlab } from 'lucide-react';
+import {
+  AlertDialog,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+  Button,
+  Chip,
+  GithubIcon,
+  Skeleton,
+  Spinner,
+} from '@librechat/client';
+import type { PullRequestProvider } from 'librechat-data-provider';
+import type { ComponentType } from 'react';
+import type { TranslationKeys } from '~/hooks';
+import {
+  useGetStartupConfig,
+  usePullRequestConnectionQuery,
+  useConnectPullRequestAccountMutation,
+  useDisconnectPullRequestAccountMutation,
+} from '~/data-provider';
+import { useLocalize } from '~/hooks';
+
+const PROVIDERS: Record<
+  PullRequestProvider,
+  { Icon: ComponentType<{ className?: string }>; name: TranslationKeys }
+> = {
+  github: { Icon: GithubIcon, name: 'com_ui_pr_provider_github' },
+  gitlab: { Icon: Gitlab, name: 'com_ui_pr_provider_gitlab' },
+  bitbucket: { Icon: ExternalLink, name: 'com_ui_pr_provider_bitbucket' },
+};
+
+type ConnectError = 'com_ui_pr_account_connect_error' | 'com_ui_pr_account_popup_blocked';
+
+/**
+ * The user's own account for pull request lookups. One row for the provider the operator
+ * configured: the status, and a single action to connect or disconnect it. The action button is
+ * swapped as the state changes, so focus is carried over to whichever button replaces it.
+ */
+export default function ConnectedAccounts() {
+  const localize = useLocalize();
+  const rowId = useId();
+  const { data: startupConfig } = useGetStartupConfig();
+  const status = usePullRequestConnectionQuery();
+  const connectMutation = useConnectPullRequestAccountMutation();
+  const disconnectMutation = useDisconnectPullRequestAccountMutation();
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const [connectError, setConnectError] = useState<ConnectError | null>(null);
+  const [disconnectFailed, setDisconnectFailed] = useState(false);
+  const actionRef = useRef<HTMLButtonElement | null>(null);
+  const keepFocus = useRef(false);
+
+  /**
+   * Callback ref, so a replacement button takes focus as it mounts after an action, but only
+   * when the button it replaced took focus away with it.
+   */
+  const bindAction = useCallback((button: HTMLButtonElement | null) => {
+    actionRef.current = button;
+    if (button == null || !keepFocus.current) {
+      return;
+    }
+    keepFocus.current = false;
+    if (document.activeElement == null || document.activeElement === document.body) {
+      button.focus();
+    }
+  }, []);
+
+  const provider = startupConfig?.pullRequestsConnect;
+  /** The server is the authority: an app it no longer has is nothing to connect to. */
+  if (provider == null || status.data?.configured === false) {
+    return null;
+  }
+
+  const { Icon, name: nameKey } = PROVIDERS[provider];
+  const name = localize(nameKey);
+  const labelId = `${rowId}-label`;
+  const descriptionId = `${rowId}-description`;
+
+  const connect = () => {
+    if (connectMutation.isLoading) {
+      return;
+    }
+    setConnectError(null);
+    /** Opened inside the click so the browser treats it as user initiated. */
+    const popup = window.open('', '_blank');
+    if (popup == null) {
+      setConnectError('com_ui_pr_account_popup_blocked');
+      return;
+    }
+    popup.opener = null;
+    connectMutation.mutate(undefined, {
+      onSuccess: ({ url }) => {
+        keepFocus.current = true;
+        popup.location.href = url;
+      },
+      onError: () => {
+        popup.close();
+        setConnectError('com_ui_pr_account_connect_error');
+      },
+    });
+  };
+
+  const disconnect = () => {
+    setDisconnectFailed(false);
+    disconnectMutation.mutate(undefined, {
+      onSuccess: () => {
+        keepFocus.current = true;
+        setConfirmOpen(false);
+      },
+      onError: () => setDisconnectFailed(true),
+    });
+  };
+
+  const retry = () => {
+    keepFocus.current = true;
+    status.refetch().then((result) => {
+      if (result.isError) {
+        keepFocus.current = false;
+      }
+    });
+  };
+
+  let statusContent = <Chip tone="neutral">{localize('com_ui_pr_account_checking')}</Chip>;
+  let action = <Skeleton className="h-9 w-24" aria-hidden="true" />;
+
+  if (status.isError) {
+    statusContent = (
+      <span className="text-text-destructive text-xs">
+        {localize('com_ui_pr_account_status_error')}
+      </span>
+    );
+    action = (
+      <Button
+        ref={bindAction}
+        type="button"
+        variant="outline"
+        size="sm"
+        aria-busy={status.isFetching}
+        onClick={retry}
+      >
+        {status.isFetching ? <Spinner className="h-4 w-4" /> : localize('com_ui_retry')}
+      </Button>
+    );
+  } else if (status.data?.connected === true) {
+    statusContent = <Chip tone="success">{localize('com_ui_pr_account_connected')}</Chip>;
+    action = (
+      <AlertDialogTrigger asChild>
+        <Button
+          ref={bindAction}
+          type="button"
+          variant="outline"
+          size="sm"
+          aria-label={localize('com_ui_pr_account_disconnect_aria', { 0: name })}
+        >
+          {localize('com_ui_pr_account_disconnect')}
+        </Button>
+      </AlertDialogTrigger>
+    );
+  } else if (status.data != null) {
+    statusContent = <Chip tone="neutral">{localize('com_ui_pr_account_not_connected')}</Chip>;
+    action = (
+      <Button
+        ref={bindAction}
+        type="button"
+        variant="outline"
+        size="sm"
+        aria-label={localize('com_ui_pr_account_connect_aria', { 0: name })}
+        aria-busy={connectMutation.isLoading}
+        aria-disabled={connectMutation.isLoading}
+        onClick={connect}
+      >
+        {connectMutation.isLoading ? (
+          <Spinner className="h-4 w-4" />
+        ) : (
+          localize('com_ui_pr_account_connect')
+        )}
+      </Button>
+    );
+  }
+
+  return (
+    <AlertDialog
+      open={confirmOpen}
+      onOpenChange={(open) => {
+        setConfirmOpen(open);
+        setDisconnectFailed(false);
+      }}
+    >
+      <div
+        role="group"
+        aria-labelledby={labelId}
+        aria-describedby={descriptionId}
+        className="flex flex-col gap-2"
+      >
+        <div className="flex items-center gap-3">
+          <span className="text-text-secondary shrink-0" aria-hidden="true">
+            <Icon className="h-5 w-5" />
+          </span>
+          <div className="min-w-0 flex-1">
+            <p id={labelId} className="text-text-primary text-sm font-medium">
+              {name}
+            </p>
+            <p id={descriptionId} className="text-text-secondary text-xs">
+              {localize('com_ui_pr_account_description')}
+            </p>
+          </div>
+          <div role="status" className="shrink-0">
+            {statusContent}
+          </div>
+          <div className="shrink-0">{action}</div>
+        </div>
+        {connectError != null && (
+          <p role="alert" className="text-text-destructive text-xs">
+            {localize(connectError)}
+          </p>
+        )}
+      </div>
+
+      <AlertDialogContent
+        className="w-11/12 max-w-md"
+        onCloseAutoFocus={(event) => {
+          event.preventDefault();
+          actionRef.current?.focus();
+        }}
+      >
+        <AlertDialogHeader>
+          <AlertDialogTitle>
+            {localize('com_ui_pr_account_disconnect_title', { 0: name })}
+          </AlertDialogTitle>
+          <AlertDialogDescription>
+            {localize('com_ui_pr_account_disconnect_description')}
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        {disconnectFailed && (
+          <p role="alert" className="text-text-destructive text-xs">
+            {localize('com_ui_pr_account_disconnect_error')}
+          </p>
+        )}
+        <AlertDialogFooter className="mt-2">
+          <AlertDialogCancel asChild>
+            <Button type="button" variant="outline">
+              {localize('com_ui_cancel')}
+            </Button>
+          </AlertDialogCancel>
+          <Button
+            type="button"
+            variant="destructive"
+            aria-busy={disconnectMutation.isLoading}
+            disabled={disconnectMutation.isLoading}
+            onClick={disconnect}
+          >
+            {disconnectMutation.isLoading ? (
+              <Spinner className="h-4 w-4" />
+            ) : (
+              localize('com_ui_pr_account_disconnect')
+            )}
+          </Button>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
new file mode 100644
index 00000000000..8399fd316ce
--- /dev/null
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -0,0 +1,216 @@
+import React from 'react';
+import '@testing-library/jest-dom';
+import userEvent from '@testing-library/user-event';
+import { QueryKeys } from 'librechat-data-provider';
+import { render, screen, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
+import ConnectedAccounts from '../ConnectedAccounts';
+
+const mockGetConnection = jest.fn();
+const mockConnect = jest.fn();
+const mockDisconnect = jest.fn();
+const mockStartup: { current: Partial<TStartupConfig> | undefined } = {
+  current: { pullRequestsConnect: 'github' },
+};
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string, values?: Record<string, string | number>) =>
+    values == null ? key : `${key}:${Object.values(values).join(',')}`,
+}));
+
+jest.mock('~/data-provider/Endpoints', () => ({
+  ...jest.requireActual('~/data-provider/Endpoints'),
+  useGetStartupConfig: () => ({ data: mockStartup.current }),
+}));
+
+jest.mock('librechat-data-provider', () => {
+  const actual = jest.requireActual('librechat-data-provider');
+  return {
+    ...actual,
+    dataService: {
+      ...actual.dataService,
+      getPullRequestConnection: (...args: unknown[]) => mockGetConnection(...args),
+      connectPullRequestAccount: (...args: unknown[]) => mockConnect(...args),
+      disconnectPullRequestAccount: (...args: unknown[]) => mockDisconnect(...args),
+    },
+  };
+});
+
+const connection = (connected: boolean): TPullRequestConnection => ({
+  configured: true,
+  provider: 'github',
+  connected,
+});
+
+/** Rejections are part of these tests; keep React Query from logging each one. */
+const logger = { log: () => undefined, warn: () => undefined, error: () => undefined };
+
+const renderRow = () => {
+  const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
+  const invalidate = jest.spyOn(client, 'invalidateQueries');
+  render(
+    <QueryClientProvider client={client}>
+      <ConnectedAccounts />
+    </QueryClientProvider>,
+  );
+  return { client, invalidate };
+};
+
+const fakeWindow = () => ({ opener: {} as unknown, location: { href: '' }, close: jest.fn() });
+
+describe('ConnectedAccounts', () => {
+  let openSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    mockStartup.current = { pullRequestsConnect: 'github' };
+    mockGetConnection.mockReset();
+    mockConnect.mockReset();
+    mockDisconnect.mockReset();
+    openSpy = jest.spyOn(window, 'open');
+  });
+
+  afterEach(() => {
+    openSpy.mockRestore();
+  });
+
+  it('renders nothing and asks nothing when the deployment offers no account to connect', () => {
+    mockStartup.current = {};
+    const { container } = render(
+      <QueryClientProvider client={new QueryClient({ logger })}>
+        <ConnectedAccounts />
+      </QueryClientProvider>,
+    );
+    expect(container).toBeEmptyDOMElement();
+    expect(mockGetConnection).not.toHaveBeenCalled();
+  });
+
+  it('renders nothing once the server says no app is configured', async () => {
+    mockGetConnection.mockResolvedValue({ configured: false, connected: false });
+    renderRow();
+    await waitFor(() => expect(mockGetConnection).toHaveBeenCalled());
+    await waitFor(() => expect(screen.queryByRole('status')).not.toBeInTheDocument());
+    expect(screen.queryByRole('button')).not.toBeInTheDocument();
+  });
+
+  it('shows a checking status and no action while the connection loads', () => {
+    mockGetConnection.mockReturnValue(new Promise(() => undefined));
+    renderRow();
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_checking');
+    expect(screen.queryByRole('button')).not.toBeInTheDocument();
+  });
+
+  it('connects through a window opened in the click, then sends it to the sign-in page', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    mockConnect.mockResolvedValue({ url: 'https://github.com/login/oauth/authorize?x=1' });
+    renderRow();
+
+    const button = await screen.findByRole('button', {
+      name: 'com_ui_pr_account_connect_aria:com_ui_pr_provider_github',
+    });
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_not_connected');
+    await userEvent.click(button);
+
+    expect(openSpy).toHaveBeenCalledWith('', '_blank');
+    expect(popup.opener).toBeNull();
+    expect(mockConnect).toHaveBeenCalledTimes(1);
+    await waitFor(() =>
+      expect(popup.location.href).toBe('https://github.com/login/oauth/authorize?x=1'),
+    );
+    expect(popup.close).not.toHaveBeenCalled();
+  });
+
+  it('closes the opened window and explains when the connection cannot start', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    mockConnect.mockRejectedValue(new Error('500'));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+
+    expect(await screen.findByRole('alert')).toHaveTextContent('com_ui_pr_account_connect_error');
+    expect(popup.close).toHaveBeenCalledTimes(1);
+    expect(popup.location.href).toBe('');
+  });
+
+  it('does not start the flow when the browser blocks the window', async () => {
+    openSpy.mockReturnValue(null);
+    mockGetConnection.mockResolvedValue(connection(false));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+
+    expect(screen.getByRole('alert')).toHaveTextContent('com_ui_pr_account_popup_blocked');
+    expect(mockConnect).not.toHaveBeenCalled();
+  });
+
+  it('asks before disconnecting, then disconnects and refreshes pull requests', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    mockDisconnect.mockResolvedValue(undefined);
+    const { invalidate } = renderRow();
+
+    const trigger = await screen.findByRole('button', {
+      name: 'com_ui_pr_account_disconnect_aria:com_ui_pr_provider_github',
+    });
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_connected');
+    await userEvent.click(trigger);
+
+    const dialog = await screen.findByRole('alertdialog');
+    expect(dialog).toHaveTextContent(
+      'com_ui_pr_account_disconnect_title:com_ui_pr_provider_github',
+    );
+    expect(mockDisconnect).not.toHaveBeenCalled();
+
+    mockGetConnection.mockResolvedValue(connection(false));
+    await userEvent.click(screen.getByRole('button', { name: 'com_ui_pr_account_disconnect' }));
+
+    await waitFor(() => expect(mockDisconnect).toHaveBeenCalledTimes(1));
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument());
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.pullRequestConnection]);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    const connect = await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ });
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_not_connected');
+    await waitFor(() => expect(connect).toHaveFocus());
+  });
+
+  it('keeps the confirmation open with an error when disconnecting fails', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    mockDisconnect.mockRejectedValue(new Error('500'));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' }),
+    );
+
+    expect(await screen.findByRole('alert')).toHaveTextContent(
+      'com_ui_pr_account_disconnect_error',
+    );
+    expect(screen.getByRole('alertdialog')).toBeInTheDocument();
+  });
+
+  it('explains a failed status check and retries it', async () => {
+    mockGetConnection.mockRejectedValueOnce(new Error('500'));
+    renderRow();
+
+    const retry = await screen.findByRole('button', { name: 'com_ui_retry' });
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_status_error');
+
+    mockGetConnection.mockResolvedValueOnce(connection(true));
+    await userEvent.click(retry);
+
+    expect(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    ).toBeInTheDocument();
+    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx b/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx
index e6b62614a92..0c42e897c07 100644
--- a/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx
@@ -18,6 +18,7 @@ const ctx: SettingsContextValue = {
   emailEnabled: true,
   allowEmailChange: true,
   passkeyLoginEnabled: false,
+  hasPullRequestConnect: false,
   isTwoFactorPolicyProvider: true,
   twoFactorEnabled: false,
   allowAccountDeletion: true,
diff --git a/client/src/components/Nav/Settings/__tests__/registry.spec.ts b/client/src/components/Nav/Settings/__tests__/registry.spec.ts
index 22439a9d866..fd7d4d7de4c 100644
--- a/client/src/components/Nav/Settings/__tests__/registry.spec.ts
+++ b/client/src/components/Nav/Settings/__tests__/registry.spec.ts
@@ -20,6 +20,7 @@ const settingsContext: SettingsContextValue = {
   emailEnabled: true,
   allowEmailChange: true,
   passkeyLoginEnabled: false,
+  hasPullRequestConnect: false,
   isTwoFactorPolicyProvider: true,
   twoFactorEnabled: false,
   allowAccountDeletion: true,
diff --git a/client/src/components/Nav/Settings/context.tsx b/client/src/components/Nav/Settings/context.tsx
index 6a2db1bb55d..6ef3303877e 100644
--- a/client/src/components/Nav/Settings/context.tsx
+++ b/client/src/components/Nav/Settings/context.tsx
@@ -40,6 +40,7 @@ export function useSettingsContext(): SettingsContextValue {
   const emailEnabled = startupConfig?.emailEnabled === true;
   const allowEmailChange = startupConfig?.allowEmailChange === true;
   const passkeyLoginEnabled = startupConfig?.passkeyLoginEnabled === true;
+  const hasPullRequestConnect = startupConfig?.pullRequestsConnect != null;
   const twoFactorPolicyProvider = user != null && isTwoFactorPolicyProvider(user.provider);
   const twoFactorEnabled = user?.twoFactorEnabled === true;
   const allowAccountDeletion = startupConfig?.allowAccountDeletion !== false;
@@ -79,6 +80,7 @@ export function useSettingsContext(): SettingsContextValue {
       emailEnabled,
       allowEmailChange,
       passkeyLoginEnabled,
+      hasPullRequestConnect,
       isTwoFactorPolicyProvider: twoFactorPolicyProvider,
       twoFactorEnabled,
       allowAccountDeletion,
@@ -105,6 +107,7 @@ export function useSettingsContext(): SettingsContextValue {
       emailEnabled,
       allowEmailChange,
       passkeyLoginEnabled,
+      hasPullRequestConnect,
       twoFactorPolicyProvider,
       twoFactorEnabled,
       allowAccountDeletion,
diff --git a/client/src/components/Nav/Settings/registry.tsx b/client/src/components/Nav/Settings/registry.tsx
index ff7e713747b..e1a0bea7981 100644
--- a/client/src/components/Nav/Settings/registry.tsx
+++ b/client/src/components/Nav/Settings/registry.tsx
@@ -59,6 +59,7 @@ import ProviderKeys from '../SettingsTabs/ProviderKeys';
 import { showLiaAtom } from '~/components/Lia/store';
 import { autoScrollAtom } from '~/store/autoScroll';
 import Avatar from '../SettingsTabs/Account/Avatar';
+import ConnectedAccounts from './ConnectedAccounts';
 import CodeEnvironments from './CodeEnvironments';
 import About from '../SettingsTabs/About/About';
 import ApiKeys from '../SettingsTabs/ApiKeys';
@@ -829,6 +830,16 @@ export const registry: SettingEntry[] = [
     show: (ctx) => ctx.passkeyLoginEnabled,
     Component: Passkeys,
   },
+  // Account · Connected accounts
+  {
+    id: 'pullRequestAccount',
+    tab: ACCOUNT,
+    section: 'connections',
+    labelKey: 'com_ui_settings_label_pull_request_account',
+    keywords: ['github', 'gitlab', 'bitbucket', 'pull request', 'oauth', 'connect'],
+    show: (ctx) => ctx.hasPullRequestConnect,
+    Component: ConnectedAccounts,
+  },
   // Account · Billing
   {
     id: 'tokenCredits',
diff --git a/client/src/components/Nav/Settings/types.ts b/client/src/components/Nav/Settings/types.ts
index 145bd7b8096..098c6851f66 100644
--- a/client/src/components/Nav/Settings/types.ts
+++ b/client/src/components/Nav/Settings/types.ts
@@ -35,6 +35,7 @@ export type SectionId =
   | 'danger'
   | 'profile'
   | 'security'
+  | 'connections'
   | 'billing'
   | 'about';
 
@@ -51,6 +52,7 @@ export interface SettingsContextValue {
   emailEnabled: boolean;
   allowEmailChange: boolean;
   passkeyLoginEnabled: boolean;
+  hasPullRequestConnect: boolean;
   isTwoFactorPolicyProvider: boolean;
   twoFactorEnabled: boolean;
   allowAccountDeletion: boolean;
@@ -167,6 +169,7 @@ export const TABS: TabMeta[] = [
     sections: [
       { id: 'profile', labelKey: 'com_ui_settings_section_profile' },
       { id: 'security', labelKey: 'com_ui_settings_section_security' },
+      { id: 'connections', labelKey: 'com_ui_settings_section_connections' },
       { id: 'billing', labelKey: 'com_ui_settings_section_billing' },
       { id: 'danger', labelKey: 'com_ui_settings_section_danger_zone', danger: true },
     ],
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
new file mode 100644
index 00000000000..f7d415a5016
--- /dev/null
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -0,0 +1,96 @@
+import React from 'react';
+import { QueryKeys } from 'librechat-data-provider';
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
+import {
+  usePullRequestConnectionQuery,
+  useDisconnectPullRequestAccountMutation,
+} from './connection';
+
+const mockGetConnection = jest.fn();
+const mockDisconnect = jest.fn();
+const mockStartup: { current: Partial<TStartupConfig> | undefined } = {
+  current: { pullRequestsConnect: 'github' },
+};
+
+jest.mock('../Endpoints', () => ({
+  useGetStartupConfig: () => ({ data: mockStartup.current }),
+}));
+
+jest.mock('librechat-data-provider', () => {
+  const actual = jest.requireActual('librechat-data-provider');
+  return {
+    ...actual,
+    dataService: {
+      ...actual.dataService,
+      getPullRequestConnection: (...args: unknown[]) => mockGetConnection(...args),
+      disconnectPullRequestAccount: (...args: unknown[]) => mockDisconnect(...args),
+    },
+  };
+});
+
+const connection = (connected: boolean): TPullRequestConnection => ({
+  configured: true,
+  provider: 'github',
+  connected,
+});
+
+const setup = () => {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const invalidate = jest.spyOn(client, 'invalidateQueries');
+  const wrapper = ({ children }: { children: React.ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+  return { client, invalidate, wrapper };
+};
+
+describe('pull request connection hooks', () => {
+  beforeEach(() => {
+    mockStartup.current = { pullRequestsConnect: 'github' };
+    mockGetConnection.mockReset();
+    mockDisconnect.mockReset();
+  });
+
+  it('never asks a deployment that offers no account to connect', () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    const { wrapper } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    expect(result.current.fetchStatus).toBe('idle');
+    expect(mockGetConnection).not.toHaveBeenCalled();
+  });
+
+  it('refetches cached pull requests once a connection made elsewhere shows up', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(false));
+    const { wrapper, invalidate } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(result.current.data?.connected).toBe(false));
+    expect(invalidate).not.toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+
+    mockGetConnection.mockResolvedValueOnce(connection(true));
+    await act(async () => {
+      await result.current.refetch();
+    });
+
+    await waitFor(() =>
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+    );
+  });
+
+  it('marks the account disconnected and refetches the status and pull requests', async () => {
+    mockDisconnect.mockResolvedValue(undefined);
+    const { client, wrapper, invalidate } = setup();
+    client.setQueryData([QueryKeys.pullRequestConnection], connection(true));
+    const { result } = renderHook(() => useDisconnectPullRequestAccountMutation(), { wrapper });
+
+    await act(async () => {
+      await result.current.mutateAsync();
+    });
+
+    expect(
+      client.getQueryData<TPullRequestConnection>([QueryKeys.pullRequestConnection])?.connected,
+    ).toBe(false);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.pullRequestConnection]);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+});
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
new file mode 100644
index 00000000000..5952e5a0a00
--- /dev/null
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -0,0 +1,59 @@
+import { useEffect, useRef } from 'react';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { MutationKeys, QueryKeys, dataService } from 'librechat-data-provider';
+import type { TPullRequestConnection } from 'librechat-data-provider';
+import { useGetStartupConfig } from '../Endpoints';
+
+/**
+ * Whether the signed-in user has connected their own account. Asked only when the deployment
+ * offers connecting one, and again when the window regains focus, so the answer catches up once
+ * the provider's sign-in tab closes. A change in either direction swaps the token the server
+ * looks pull requests up with, so every cached pull request is refetched.
+ */
+export const usePullRequestConnectionQuery = () => {
+  const queryClient = useQueryClient();
+  const { data: startupConfig } = useGetStartupConfig();
+  const query = useQuery<TPullRequestConnection>(
+    [QueryKeys.pullRequestConnection],
+    () => dataService.getPullRequestConnection(),
+    {
+      enabled: startupConfig?.pullRequestsConnect != null,
+      retry: false,
+      refetchOnWindowFocus: true,
+    },
+  );
+
+  const connected = query.data?.connected;
+  const previous = useRef(connected);
+  useEffect(() => {
+    if (previous.current != null && connected != null && previous.current !== connected) {
+      queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+    }
+    previous.current = connected ?? previous.current;
+  }, [connected, queryClient]);
+
+  return query;
+};
+
+/** Starts the provider's sign-in; the caller navigates a window it opened to the returned url. */
+export const useConnectPullRequestAccountMutation = () =>
+  useMutation<{ url: string }, unknown, void>({
+    mutationKey: [MutationKeys.connectPullRequestAccount],
+    mutationFn: () => dataService.connectPullRequestAccount(),
+  });
+
+export const useDisconnectPullRequestAccountMutation = () => {
+  const queryClient = useQueryClient();
+  return useMutation<void, unknown, void>({
+    mutationKey: [MutationKeys.disconnectPullRequestAccount],
+    mutationFn: () => dataService.disconnectPullRequestAccount(),
+    onSuccess: () => {
+      queryClient.setQueryData<TPullRequestConnection>(
+        [QueryKeys.pullRequestConnection],
+        (current) => (current == null ? current : { ...current, connected: false }),
+      );
+      queryClient.invalidateQueries([QueryKeys.pullRequestConnection]);
+      queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+    },
+  });
+};
diff --git a/client/src/data-provider/PullRequest/index.ts b/client/src/data-provider/PullRequest/index.ts
index a4878becc89..75b1685dae8 100644
--- a/client/src/data-provider/PullRequest/index.ts
+++ b/client/src/data-provider/PullRequest/index.ts
@@ -1,2 +1,3 @@
 export * from './queries';
 export * from './batch';
+export * from './connection';
diff --git a/client/src/locales/en/translation.json b/client/src/locales/en/translation.json
index c8ddc9f4bd2..fe80c258b5f 100644
--- a/client/src/locales/en/translation.json
+++ b/client/src/locales/en/translation.json
@@ -1,4 +1,18 @@
 {
+  "com_ui_pr_account_checking": "Checking connection",
+  "com_ui_pr_account_connect": "Connect",
+  "com_ui_pr_account_connect_aria": "Connect {{0}}",
+  "com_ui_pr_account_connect_error": "Couldn't start connecting. Try again.",
+  "com_ui_pr_account_connected": "Connected",
+  "com_ui_pr_account_description": "Look up pull requests with your own account",
+  "com_ui_pr_account_disconnect": "Disconnect",
+  "com_ui_pr_account_disconnect_aria": "Disconnect {{0}}",
+  "com_ui_pr_account_disconnect_description": "Pull requests will no longer be looked up with your account. You can connect it again at any time.",
+  "com_ui_pr_account_disconnect_error": "Couldn't disconnect. Try again.",
+  "com_ui_pr_account_disconnect_title": "Disconnect {{0}}?",
+  "com_ui_pr_account_not_connected": "Not connected",
+  "com_ui_pr_account_popup_blocked": "Your browser blocked the sign-in window. Allow pop-ups and try again.",
+  "com_ui_pr_account_status_error": "Couldn't check the connection",
   "com_ui_pr_additions": "{{0}} lines added",
   "com_ui_pr_checks": "Checks: {{0}}",
   "com_ui_pr_checks_failing": "Failing",
@@ -12,6 +26,9 @@
   "com_ui_pr_open_in_bitbucket": "Open in Bitbucket",
   "com_ui_pr_open_in_github": "Open in GitHub",
   "com_ui_pr_open_in_gitlab": "Open in GitLab",
+  "com_ui_pr_provider_bitbucket": "Bitbucket",
+  "com_ui_pr_provider_github": "GitHub",
+  "com_ui_pr_provider_gitlab": "GitLab",
   "com_ui_pr_refresh_failed": "Couldn't refresh the pull request",
   "com_ui_pr_state": "State: {{0}}",
   "com_ui_pr_state_closed": "Closed",
@@ -2842,6 +2859,7 @@
   "com_ui_settings_label_language_stt": "Speech-to-text language",
   "com_ui_settings_label_playback_rate": "Playback rate",
   "com_ui_settings_label_provider_api_keys": "Provider API keys",
+  "com_ui_settings_label_pull_request_account": "Pull request account",
   "com_ui_settings_label_revoke_keys": "Revoke all provider API keys",
   "com_ui_settings_label_shared_links": "Shared chats",
   "com_ui_settings_label_voice": "Voice",
@@ -2854,6 +2872,7 @@
   "com_ui_settings_section_appearance": "Appearance",
   "com_ui_settings_section_billing": "Billing",
   "com_ui_settings_section_commands": "Commands",
+  "com_ui_settings_section_connections": "Connected accounts",
   "com_ui_settings_section_conversations": "Conversations",
   "com_ui_settings_section_danger_zone": "Danger zone",
   "com_ui_settings_section_data": "Your data",
diff --git a/packages/data-provider/src/api-endpoints.ts b/packages/data-provider/src/api-endpoints.ts
index d98d43370dc..a06d908ed3a 100644
--- a/packages/data-provider/src/api-endpoints.ts
+++ b/packages/data-provider/src/api-endpoints.ts
@@ -173,6 +173,14 @@ export const conversationPullRequest = (conversationId: string) =>
 
 export const conversationPullRequests = () => `${conversationsRoot}/pull-requests`;
 
+const pullRequestOAuthRoot = `${BASE_URL}/api/pull-requests/oauth`;
+
+export const pullRequestConnection = () => `${pullRequestOAuthRoot}/status`;
+
+export const pullRequestConnect = () => `${pullRequestOAuthRoot}/connect`;
+
+export const pullRequestDisconnect = () => pullRequestOAuthRoot;
+
 export const genTitle = (conversationId: string) =>
   `${conversationsRoot}/gen_title/${encodeURIComponent(conversationId)}`;
 
diff --git a/packages/data-provider/src/data-service.ts b/packages/data-provider/src/data-service.ts
index 12ccf44b8df..99b0288269f 100644
--- a/packages/data-provider/src/data-service.ts
+++ b/packages/data-provider/src/data-service.ts
@@ -1247,6 +1247,18 @@ export function getConversationPullRequests(
   return request.post(endpoints.conversationPullRequests(), { conversationIds }, options);
 }
 
+export function getPullRequestConnection(): Promise<t.TPullRequestConnection> {
+  return request.get(endpoints.pullRequestConnection());
+}
+
+export function connectPullRequestAccount(): Promise<{ url: string }> {
+  return request.get(endpoints.pullRequestConnect());
+}
+
+export function disconnectPullRequestAccount(): Promise<void> {
+  return request.delete(endpoints.pullRequestDisconnect());
+}
+
 export function getPrompt(id: string): Promise<{ prompt: t.TPrompt }> {
   return request.get(endpoints.getPrompt(id));
 }
diff --git a/packages/data-provider/src/keys.ts b/packages/data-provider/src/keys.ts
index d950178f53e..6facec62d3d 100644
--- a/packages/data-provider/src/keys.ts
+++ b/packages/data-provider/src/keys.ts
@@ -111,6 +111,7 @@ export enum QueryKeys {
   subagentThread = 'subagentThread',
   backgroundTasks = 'backgroundTasks',
   conversationPullRequest = 'conversationPullRequest',
+  pullRequestConnection = 'pullRequestConnection',
   codeEnvironments = 'codeEnvironments',
   agentQueuedTurns = 'agentQueuedTurns',
   /* Combined Pinned-section display order (favorites + pinned chats) */
@@ -198,4 +199,6 @@ export enum MutationKeys {
   moveConversationCodeEnvironment = 'moveConversationCodeEnvironment',
   convoSeen = 'convoSeen',
   convoUnread = 'convoUnread',
+  connectPullRequestAccount = 'connectPullRequestAccount',
+  disconnectPullRequestAccount = 'disconnectPullRequestAccount',
 }

From 889bddfa82f35a5d0f4e14041cdc3298ef90b58b Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Sun, 11 Oct 2026 21:00:40 +0200
Subject: [PATCH 02/30] fix: Watch an Open Account Sign-In and Keep the Retry
 Button Named

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 24 ++++++++-
 .../__tests__/ConnectedAccounts.spec.tsx      | 50 +++++++++++++++++++
 .../data-provider/PullRequest/connection.ts   | 12 +++--
 3 files changed, 81 insertions(+), 5 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 393f3fd46e8..cf554c3915c 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useId, useRef, useState } from 'react';
+import { useCallback, useEffect, useId, useRef, useState } from 'react';
 import { ExternalLink, Gitlab } from 'lucide-react';
 import {
   AlertDialog,
@@ -37,6 +37,9 @@ const PROVIDERS: Record<
 
 type ConnectError = 'com_ui_pr_account_connect_error' | 'com_ui_pr_account_popup_blocked';
 
+/** How long a started sign-in is watched for; the server's signed state expires after this. */
+const CONNECT_FLOW_MS = 10 * 60 * 1000;
+
 /**
  * The user's own account for pull request lookups. One row for the provider the operator
  * configured: the status, and a single action to connect or disconnect it. The action button is
@@ -46,7 +49,9 @@ export default function ConnectedAccounts() {
   const localize = useLocalize();
   const rowId = useId();
   const { data: startupConfig } = useGetStartupConfig();
-  const status = usePullRequestConnectionQuery();
+  /** A sign-in sent to the provider and not yet seen to finish. */
+  const [awaitingSignIn, setAwaitingSignIn] = useState(false);
+  const status = usePullRequestConnectionQuery({ watch: awaitingSignIn });
   const connectMutation = useConnectPullRequestAccountMutation();
   const disconnectMutation = useDisconnectPullRequestAccountMutation();
   const [confirmOpen, setConfirmOpen] = useState(false);
@@ -55,6 +60,19 @@ export default function ConnectedAccounts() {
   const actionRef = useRef<HTMLButtonElement | null>(null);
   const keepFocus = useRef(false);
 
+  const connected = status.data?.connected === true;
+  useEffect(() => {
+    if (!awaitingSignIn) {
+      return;
+    }
+    if (connected) {
+      setAwaitingSignIn(false);
+      return;
+    }
+    const timer = setTimeout(() => setAwaitingSignIn(false), CONNECT_FLOW_MS);
+    return () => clearTimeout(timer);
+  }, [awaitingSignIn, connected]);
+
   /**
    * Callback ref, so a replacement button takes focus as it mounts after an action, but only
    * when the button it replaced took focus away with it.
@@ -96,6 +114,7 @@ export default function ConnectedAccounts() {
     connectMutation.mutate(undefined, {
       onSuccess: ({ url }) => {
         keepFocus.current = true;
+        setAwaitingSignIn(true);
         popup.location.href = url;
       },
       onError: () => {
@@ -140,6 +159,7 @@ export default function ConnectedAccounts() {
         type="button"
         variant="outline"
         size="sm"
+        aria-label={localize('com_ui_retry')}
         aria-busy={status.isFetching}
         onClick={retry}
       >
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 8399fd316ce..899f72409c6 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -122,6 +122,35 @@ describe('ConnectedAccounts', () => {
     expect(popup.close).not.toHaveBeenCalled();
   });
 
+  it('keeps asking while the sign-in is open, so a finish without refocus still shows', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    mockConnect.mockResolvedValue({ url: 'https://github.com/login/oauth/authorize?x=1' });
+    const { invalidate } = renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(popup.location.href).not.toBe(''));
+    const before = mockGetConnection.mock.calls.length;
+    mockGetConnection.mockResolvedValue(connection(true));
+
+    expect(
+      await screen.findByRole(
+        'button',
+        { name: /com_ui_pr_account_disconnect_aria/ },
+        { timeout: 5000 },
+      ),
+    ).toBeInTheDocument();
+    expect(mockGetConnection.mock.calls.length).toBeGreaterThan(before);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+
+    const settled = mockGetConnection.mock.calls.length;
+    await new Promise((resolve) => setTimeout(resolve, 2500));
+    expect(mockGetConnection).toHaveBeenCalledTimes(settled);
+  }, 15000);
+
   it('closes the opened window and explains when the connection cannot start', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);
@@ -213,4 +242,25 @@ describe('ConnectedAccounts', () => {
     ).toBeInTheDocument();
     expect(mockGetConnection).toHaveBeenCalledTimes(2);
   });
+
+  it('keeps the retry button named while a failed refresh is retried', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(false));
+    const { client } = renderRow();
+    await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ });
+
+    mockGetConnection.mockRejectedValueOnce(new Error('500'));
+    await client.refetchQueries([QueryKeys.pullRequestConnection]);
+    const retry = await screen.findByRole('button', { name: 'com_ui_retry' });
+
+    let answer: (value: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockReturnValueOnce(new Promise((resolve) => (answer = resolve)));
+    await userEvent.click(retry);
+
+    await waitFor(() => expect(retry).toHaveAttribute('aria-busy', 'true'));
+    expect(screen.getByRole('button', { name: 'com_ui_retry' })).toBe(retry);
+    answer(connection(false));
+    expect(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    ).toBeInTheDocument();
+  });
 });
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 5952e5a0a00..525dc894c38 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -4,13 +4,17 @@ import { MutationKeys, QueryKeys, dataService } from 'librechat-data-provider';
 import type { TPullRequestConnection } from 'librechat-data-provider';
 import { useGetStartupConfig } from '../Endpoints';
 
+/** How often the status is asked while a sign-in started from this window is still open. */
+export const PULL_REQUEST_CONNECT_POLL_MS = 2000;
+
 /**
  * Whether the signed-in user has connected their own account. Asked only when the deployment
- * offers connecting one, and again when the window regains focus, so the answer catches up once
- * the provider's sign-in tab closes. A change in either direction swaps the token the server
+ * offers connecting one, and again when the window regains focus. With `watch`, it is also asked
+ * on an interval, in the background too, because the provider's sign-in can finish without this
+ * window ever regaining focus afterwards. A change in either direction swaps the token the server
  * looks pull requests up with, so every cached pull request is refetched.
  */
-export const usePullRequestConnectionQuery = () => {
+export const usePullRequestConnectionQuery = ({ watch = false }: { watch?: boolean } = {}) => {
   const queryClient = useQueryClient();
   const { data: startupConfig } = useGetStartupConfig();
   const query = useQuery<TPullRequestConnection>(
@@ -20,6 +24,8 @@ export const usePullRequestConnectionQuery = () => {
       enabled: startupConfig?.pullRequestsConnect != null,
       retry: false,
       refetchOnWindowFocus: true,
+      refetchInterval: watch ? PULL_REQUEST_CONNECT_POLL_MS : false,
+      refetchIntervalInBackground: watch,
     },
   );
 

From b7a80887681c53357a6af5d31e446eaef3faa2f7 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:16:31 +0200
Subject: [PATCH 03/30] fix: Name the Disconnect Confirmation and Show the
 Provider the Server Reports

---
 .../Nav/Settings/ConnectedAccounts.tsx        |  8 +++--
 .../__tests__/ConnectedAccounts.spec.tsx      | 30 +++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index cf554c3915c..3f1bbccedc4 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -88,8 +88,11 @@ export default function ConnectedAccounts() {
     }
   }, []);
 
-  const provider = startupConfig?.pullRequestsConnect;
-  /** The server is the authority: an app it no longer has is nothing to connect to. */
+  /**
+   * The server is the authority: an app it no longer has is nothing to connect to, and once the
+   * status loads its provider is the one a connection goes to, whatever the cached startup says.
+   */
+  const provider = status.data?.provider ?? startupConfig?.pullRequestsConnect;
   if (provider == null || status.data?.configured === false) {
     return null;
   }
@@ -270,6 +273,7 @@ export default function ConnectedAccounts() {
           <Button
             type="button"
             variant="destructive"
+            aria-label={localize('com_ui_pr_account_disconnect')}
             aria-busy={disconnectMutation.isLoading}
             disabled={disconnectMutation.isLoading}
             onClick={disconnect}
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 899f72409c6..7f794632d26 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -227,6 +227,36 @@ describe('ConnectedAccounts', () => {
     expect(screen.getByRole('alertdialog')).toBeInTheDocument();
   });
 
+  it('keeps the confirmation button named while the disconnect is in flight', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    let settle: () => void = () => undefined;
+    mockDisconnect.mockReturnValueOnce(new Promise<void>((resolve) => (settle = resolve)));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    const confirm = await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' });
+    await userEvent.click(confirm);
+
+    await waitFor(() => expect(confirm).toHaveAttribute('aria-busy', 'true'));
+    expect(screen.getByRole('button', { name: 'com_ui_pr_account_disconnect' })).toBe(confirm);
+    settle();
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument());
+  });
+
+  it('names the provider the server reports over a stale startup config', async () => {
+    mockGetConnection.mockResolvedValue({ configured: true, provider: 'gitlab', connected: false });
+    renderRow();
+
+    expect(
+      await screen.findByRole('button', {
+        name: 'com_ui_pr_account_connect_aria:com_ui_pr_provider_gitlab',
+      }),
+    ).toBeInTheDocument();
+    expect(screen.getByRole('group')).toHaveAccessibleName('com_ui_pr_provider_gitlab');
+  });
+
   it('explains a failed status check and retries it', async () => {
     mockGetConnection.mockRejectedValueOnce(new Error('500'));
     renderRow();

From 1653795e42212e7e39b4e5dc6a9890a9d6df3b16 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:26:32 +0200
Subject: [PATCH 04/30] feat: Tell the Client How Long a Pull Request Account
 Sign-In Lasts

---
 packages/data-provider/src/data-service.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/data-provider/src/data-service.ts b/packages/data-provider/src/data-service.ts
index 99b0288269f..2843e72c965 100644
--- a/packages/data-provider/src/data-service.ts
+++ b/packages/data-provider/src/data-service.ts
@@ -1251,7 +1251,7 @@ export function getPullRequestConnection(): Promise<t.TPullRequestConnection> {
   return request.get(endpoints.pullRequestConnection());
 }
 
-export function connectPullRequestAccount(): Promise<{ url: string }> {
+export function connectPullRequestAccount(): Promise<t.TPullRequestConnectStart> {
   return request.get(endpoints.pullRequestConnect());
 }
 

From aa1646a2be86c69b712a11207543b74480fcdfc2 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:29:58 +0200
Subject: [PATCH 05/30] fix: Follow the Sign-In Lifetime and Keep Account
 Actions Settled Past Settings

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 39 +++++----
 .../__tests__/ConnectedAccounts.spec.tsx      | 85 ++++++++++++++++++-
 .../Nav/Settings/__tests__/context.spec.tsx   | 33 ++++++-
 .../src/components/Nav/Settings/context.tsx   |  6 +-
 .../data-provider/PullRequest/connection.ts   | 22 ++++-
 5 files changed, 162 insertions(+), 23 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 3f1bbccedc4..36e825e21db 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -37,8 +37,8 @@ const PROVIDERS: Record<
 
 type ConnectError = 'com_ui_pr_account_connect_error' | 'com_ui_pr_account_popup_blocked';
 
-/** How long a started sign-in is watched for; the server's signed state expires after this. */
-const CONNECT_FLOW_MS = 10 * 60 * 1000;
+/** How long a started sign-in is watched for when the server does not say how long it lasts. */
+const DEFAULT_CONNECT_FLOW_SECONDS = 10 * 60;
 
 /**
  * The user's own account for pull request lookups. One row for the provider the operator
@@ -49,8 +49,9 @@ export default function ConnectedAccounts() {
   const localize = useLocalize();
   const rowId = useId();
   const { data: startupConfig } = useGetStartupConfig();
-  /** A sign-in sent to the provider and not yet seen to finish. */
-  const [awaitingSignIn, setAwaitingSignIn] = useState(false);
+  /** When a sign-in sent to the provider and not yet seen to finish stops being valid. */
+  const [awaitingUntil, setAwaitingUntil] = useState<number | null>(null);
+  const awaitingSignIn = awaitingUntil != null;
   const status = usePullRequestConnectionQuery({ watch: awaitingSignIn });
   const connectMutation = useConnectPullRequestAccountMutation();
   const disconnectMutation = useDisconnectPullRequestAccountMutation();
@@ -62,16 +63,16 @@ export default function ConnectedAccounts() {
 
   const connected = status.data?.connected === true;
   useEffect(() => {
-    if (!awaitingSignIn) {
+    if (awaitingUntil == null) {
       return;
     }
     if (connected) {
-      setAwaitingSignIn(false);
+      setAwaitingUntil(null);
       return;
     }
-    const timer = setTimeout(() => setAwaitingSignIn(false), CONNECT_FLOW_MS);
+    const timer = setTimeout(() => setAwaitingUntil(null), Math.max(0, awaitingUntil - Date.now()));
     return () => clearTimeout(timer);
-  }, [awaitingSignIn, connected]);
+  }, [awaitingUntil, connected]);
 
   /**
    * Callback ref, so a replacement button takes focus as it mounts after an action, but only
@@ -114,17 +115,21 @@ export default function ConnectedAccounts() {
       return;
     }
     popup.opener = null;
-    connectMutation.mutate(undefined, {
-      onSuccess: ({ url }) => {
-        keepFocus.current = true;
-        setAwaitingSignIn(true);
+    /**
+     * The promise, not `mutate` callbacks, so the window opened in the click is still sent to the
+     * sign-in page (or closed) when Settings is closed before the server answers.
+     */
+    connectMutation.mutateAsync().then(
+      ({ url, expiresInSeconds }) => {
         popup.location.href = url;
+        keepFocus.current = true;
+        setAwaitingUntil(Date.now() + (expiresInSeconds ?? DEFAULT_CONNECT_FLOW_SECONDS) * 1000);
       },
-      onError: () => {
+      () => {
         popup.close();
         setConnectError('com_ui_pr_account_connect_error');
       },
-    });
+    );
   };
 
   const disconnect = () => {
@@ -210,6 +215,10 @@ export default function ConnectedAccounts() {
     <AlertDialog
       open={confirmOpen}
       onOpenChange={(open) => {
+        /** A disconnect already sent cannot be taken back, so it is not dismissed mid-request. */
+        if (!open && disconnectMutation.isLoading) {
+          return;
+        }
         setConfirmOpen(open);
         setDisconnectFailed(false);
       }}
@@ -266,7 +275,7 @@ export default function ConnectedAccounts() {
         )}
         <AlertDialogFooter className="mt-2">
           <AlertDialogCancel asChild>
-            <Button type="button" variant="outline">
+            <Button type="button" variant="outline" disabled={disconnectMutation.isLoading}>
               {localize('com_ui_cancel')}
             </Button>
           </AlertDialogCancel>
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 7f794632d26..a79b49b89e4 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -49,12 +49,12 @@ const logger = { log: () => undefined, warn: () => undefined, error: () => undef
 const renderRow = () => {
   const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
   const invalidate = jest.spyOn(client, 'invalidateQueries');
-  render(
+  const { unmount } = render(
     <QueryClientProvider client={client}>
       <ConnectedAccounts />
     </QueryClientProvider>,
   );
-  return { client, invalidate };
+  return { client, invalidate, unmount };
 };
 
 const fakeWindow = () => ({ opener: {} as unknown, location: { href: '' }, close: jest.fn() });
@@ -151,6 +151,65 @@ describe('ConnectedAccounts', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(settled);
   }, 15000);
 
+  it('stops watching when the flow the server started expires', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    mockConnect.mockResolvedValue({
+      url: 'https://github.com/login/oauth/authorize?x=1',
+      expiresInSeconds: 1,
+    });
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(popup.location.href).not.toBe(''));
+    const started = mockGetConnection.mock.calls.length;
+    /** Past one poll interval: a watch still running would have asked again by now. */
+    await new Promise((resolve) => setTimeout(resolve, 2500));
+    expect(mockGetConnection).toHaveBeenCalledTimes(started);
+  }, 10000);
+
+  it('still sends the window to the sign-in page when Settings closes first', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    let answer: (value: { url: string }) => void = () => undefined;
+    mockConnect.mockReturnValueOnce(new Promise((resolve) => (answer = resolve)));
+    const { unmount } = renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(mockConnect).toHaveBeenCalledTimes(1));
+    unmount();
+    answer({ url: 'https://github.com/login/oauth/authorize?x=1' });
+
+    await waitFor(() =>
+      expect(popup.location.href).toBe('https://github.com/login/oauth/authorize?x=1'),
+    );
+    expect(popup.close).not.toHaveBeenCalled();
+  });
+
+  it('closes the window when the connection fails after Settings closed', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    let fail: (error: Error) => void = () => undefined;
+    mockConnect.mockReturnValueOnce(new Promise((_resolve, reject) => (fail = reject)));
+    const { unmount } = renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(mockConnect).toHaveBeenCalledTimes(1));
+    unmount();
+    fail(new Error('500'));
+
+    await waitFor(() => expect(popup.close).toHaveBeenCalledTimes(1));
+  });
+
   it('closes the opened window and explains when the connection cannot start', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);
@@ -209,6 +268,28 @@ describe('ConnectedAccounts', () => {
     await waitFor(() => expect(connect).toHaveFocus());
   });
 
+  it('cannot be cancelled or dismissed once the disconnect is sent', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    let settle: () => void = () => undefined;
+    mockDisconnect.mockReturnValueOnce(new Promise<void>((resolve) => (settle = resolve)));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' }),
+    );
+
+    const cancel = screen.getByRole('button', { name: 'com_ui_cancel' });
+    await waitFor(() => expect(cancel).toBeDisabled());
+    await userEvent.keyboard('{Escape}');
+    expect(screen.getByRole('alertdialog')).toBeInTheDocument();
+
+    settle();
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument());
+  });
+
   it('keeps the confirmation open with an error when disconnecting fails', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     mockDisconnect.mockRejectedValue(new Error('500'));
diff --git a/client/src/components/Nav/Settings/__tests__/context.spec.tsx b/client/src/components/Nav/Settings/__tests__/context.spec.tsx
index c6add06fe17..16b84ab78bb 100644
--- a/client/src/components/Nav/Settings/__tests__/context.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/context.spec.tsx
@@ -1,12 +1,14 @@
 import { RecoilRoot } from 'recoil';
 import { renderHook } from '@testing-library/react';
-import type { TUser } from 'librechat-data-provider';
+import type { TPullRequestConnection, TStartupConfig, TUser } from 'librechat-data-provider';
 import type { PropsWithChildren } from 'react';
 import { useSettingsContext } from '../context';
 
 type LegacyProviderUser = Omit<TUser, 'provider'> & { provider?: string | null };
 
 let mockUser: LegacyProviderUser | undefined;
+let mockStartup: Partial<TStartupConfig> | undefined;
+let mockConnection: TPullRequestConnection | undefined;
 
 jest.mock('~/hooks', () => ({
   useAuthContext: () => ({ user: mockUser }),
@@ -20,7 +22,8 @@ jest.mock('~/hooks/usePersonalizationAccess', () => () => ({
 }));
 
 jest.mock('~/data-provider', () => ({
-  useGetStartupConfig: () => ({ data: undefined }),
+  useGetStartupConfig: () => ({ data: mockStartup }),
+  usePullRequestConnectionStatus: () => mockConnection,
 }));
 
 jest.mock('../../SettingsTabs/ProviderKeys/useProviderKeys', () => () => []);
@@ -76,3 +79,29 @@ describe('useSettingsContext two-factor policy scope', () => {
     expect(policyProviderFor(undefined)).toBe(false);
   });
 });
+
+describe('useSettingsContext connected accounts', () => {
+  afterEach(() => {
+    mockStartup = undefined;
+    mockConnection = undefined;
+  });
+
+  const hasConnect = () =>
+    renderHook(() => useSettingsContext(), { wrapper }).result.current.hasPullRequestConnect;
+
+  it('offers the section when the deployment advertises an app, before the status loads', () => {
+    mockStartup = { pullRequestsConnect: 'github' };
+    expect(hasConnect()).toBe(true);
+  });
+
+  it('hides the section once the server says no app is configured', () => {
+    mockStartup = { pullRequestsConnect: 'github' };
+    mockConnection = { configured: false, connected: false };
+    expect(hasConnect()).toBe(false);
+  });
+
+  it('never offers the section when the deployment advertises no app', () => {
+    mockConnection = { configured: true, provider: 'github', connected: false };
+    expect(hasConnect()).toBe(false);
+  });
+});
diff --git a/client/src/components/Nav/Settings/context.tsx b/client/src/components/Nav/Settings/context.tsx
index 6ef3303877e..894e658ce76 100644
--- a/client/src/components/Nav/Settings/context.tsx
+++ b/client/src/components/Nav/Settings/context.tsx
@@ -7,10 +7,10 @@ import {
   isTwoFactorPolicyProvider,
 } from 'librechat-data-provider';
 import type { SettingsContextValue } from './types';
+import { useGetStartupConfig, usePullRequestConnectionStatus } from '~/data-provider';
 import useProviderKeys from '../SettingsTabs/ProviderKeys/useProviderKeys';
 import { useHasAccess, useAuthContext, useGetAgentsConfig } from '~/hooks';
 import usePersonalizationAccess from '~/hooks/usePersonalizationAccess';
-import { useGetStartupConfig } from '~/data-provider';
 import { hasAnalyticsGtmId } from '~/store/analytics';
 import store from '~/store';
 
@@ -18,6 +18,7 @@ export function useSettingsContext(): SettingsContextValue {
   const { user } = useAuthContext();
   const { data: startupConfig } = useGetStartupConfig();
   const { agentsConfig } = useGetAgentsConfig();
+  const pullRequestConnection = usePullRequestConnectionStatus();
   const { hasAnyPersonalizationFeature, hasMemoryOptOut } = usePersonalizationAccess();
 
   const hasRemoteAgents = useHasAccess({
@@ -40,7 +41,8 @@ export function useSettingsContext(): SettingsContextValue {
   const emailEnabled = startupConfig?.emailEnabled === true;
   const allowEmailChange = startupConfig?.allowEmailChange === true;
   const passkeyLoginEnabled = startupConfig?.passkeyLoginEnabled === true;
-  const hasPullRequestConnect = startupConfig?.pullRequestsConnect != null;
+  const hasPullRequestConnect =
+    startupConfig?.pullRequestsConnect != null && pullRequestConnection?.configured !== false;
   const twoFactorPolicyProvider = user != null && isTwoFactorPolicyProvider(user.provider);
   const twoFactorEnabled = user?.twoFactorEnabled === true;
   const allowAccountDeletion = startupConfig?.allowAccountDeletion !== false;
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 525dc894c38..912cf7cd18a 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -1,7 +1,7 @@
 import { useEffect, useRef } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { MutationKeys, QueryKeys, dataService } from 'librechat-data-provider';
-import type { TPullRequestConnection } from 'librechat-data-provider';
+import type { TPullRequestConnectStart, TPullRequestConnection } from 'librechat-data-provider';
 import { useGetStartupConfig } from '../Endpoints';
 
 /** How often the status is asked while a sign-in started from this window is still open. */
@@ -42,8 +42,26 @@ export const usePullRequestConnectionQuery = ({ watch = false }: { watch?: boole
 };
 
 /** Starts the provider's sign-in; the caller navigates a window it opened to the returned url. */
+/**
+ * The same status for what contains the Settings row, so an app the server no longer has hides
+ * the whole section, and a later answer that it has one again brings the section back. It shares
+ * the row's query and leaves refetching pull requests on a change to the row.
+ */
+export const usePullRequestConnectionStatus = () => {
+  const { data: startupConfig } = useGetStartupConfig();
+  return useQuery<TPullRequestConnection>(
+    [QueryKeys.pullRequestConnection],
+    () => dataService.getPullRequestConnection(),
+    {
+      enabled: startupConfig?.pullRequestsConnect != null,
+      retry: false,
+      refetchOnWindowFocus: true,
+    },
+  ).data;
+};
+
 export const useConnectPullRequestAccountMutation = () =>
-  useMutation<{ url: string }, unknown, void>({
+  useMutation<TPullRequestConnectStart, unknown, void>({
     mutationKey: [MutationKeys.connectPullRequestAccount],
     mutationFn: () => dataService.connectPullRequestAccount(),
   });

From d520033771beee603fac76c046e3b44edcb5ab15 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:13:12 +0200
Subject: [PATCH 06/30] fix: Watch an Account Sign-In Until Its Window Closes,
 Even After Settings Closes

---
 .../Nav/Settings/ConnectedAccounts.tsx        |  31 ++--
 .../__tests__/ConnectedAccounts.spec.tsx      |  56 +++++++-
 .../data-provider/PullRequest/connection.ts   |  15 +-
 client/src/data-provider/PullRequest/index.ts |   1 +
 .../data-provider/PullRequest/signIn.test.ts  | 134 ++++++++++++++++++
 .../src/data-provider/PullRequest/signIn.ts   |  87 ++++++++++++
 6 files changed, 293 insertions(+), 31 deletions(-)
 create mode 100644 client/src/data-provider/PullRequest/signIn.test.ts
 create mode 100644 client/src/data-provider/PullRequest/signIn.ts

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 36e825e21db..a228b2eb350 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -1,5 +1,6 @@
-import { useCallback, useEffect, useId, useRef, useState } from 'react';
+import { useCallback, useId, useRef, useState } from 'react';
 import { ExternalLink, Gitlab } from 'lucide-react';
+import { useQueryClient } from '@tanstack/react-query';
 import {
   AlertDialog,
   AlertDialogCancel,
@@ -23,6 +24,7 @@ import {
   usePullRequestConnectionQuery,
   useConnectPullRequestAccountMutation,
   useDisconnectPullRequestAccountMutation,
+  watchPullRequestSignIn,
 } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 
@@ -49,10 +51,8 @@ export default function ConnectedAccounts() {
   const localize = useLocalize();
   const rowId = useId();
   const { data: startupConfig } = useGetStartupConfig();
-  /** When a sign-in sent to the provider and not yet seen to finish stops being valid. */
-  const [awaitingUntil, setAwaitingUntil] = useState<number | null>(null);
-  const awaitingSignIn = awaitingUntil != null;
-  const status = usePullRequestConnectionQuery({ watch: awaitingSignIn });
+  const queryClient = useQueryClient();
+  const status = usePullRequestConnectionQuery();
   const connectMutation = useConnectPullRequestAccountMutation();
   const disconnectMutation = useDisconnectPullRequestAccountMutation();
   const [confirmOpen, setConfirmOpen] = useState(false);
@@ -61,19 +61,6 @@ export default function ConnectedAccounts() {
   const actionRef = useRef<HTMLButtonElement | null>(null);
   const keepFocus = useRef(false);
 
-  const connected = status.data?.connected === true;
-  useEffect(() => {
-    if (awaitingUntil == null) {
-      return;
-    }
-    if (connected) {
-      setAwaitingUntil(null);
-      return;
-    }
-    const timer = setTimeout(() => setAwaitingUntil(null), Math.max(0, awaitingUntil - Date.now()));
-    return () => clearTimeout(timer);
-  }, [awaitingUntil, connected]);
-
   /**
    * Callback ref, so a replacement button takes focus as it mounts after an action, but only
    * when the button it replaced took focus away with it.
@@ -117,13 +104,17 @@ export default function ConnectedAccounts() {
     popup.opener = null;
     /**
      * The promise, not `mutate` callbacks, so the window opened in the click is still sent to the
-     * sign-in page (or closed) when Settings is closed before the server answers.
+     * sign-in page (or closed) when Settings is closed before the server answers. The watch on the
+     * sign-in lives outside this row for the same reason.
      */
     connectMutation.mutateAsync().then(
       ({ url, expiresInSeconds }) => {
         popup.location.href = url;
         keepFocus.current = true;
-        setAwaitingUntil(Date.now() + (expiresInSeconds ?? DEFAULT_CONNECT_FLOW_SECONDS) * 1000);
+        watchPullRequestSignIn(queryClient, {
+          popup,
+          expiresAt: Date.now() + (expiresInSeconds ?? DEFAULT_CONNECT_FLOW_SECONDS) * 1000,
+        });
       },
       () => {
         popup.close();
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index a79b49b89e4..c9d849e7a50 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -5,6 +5,7 @@ import { QueryKeys } from 'librechat-data-provider';
 import { render, screen, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
+import { stopPullRequestSignIn } from '~/data-provider/PullRequest/signIn';
 import ConnectedAccounts from '../ConnectedAccounts';
 
 const mockGetConnection = jest.fn();
@@ -46,8 +47,12 @@ const connection = (connected: boolean): TPullRequestConnection => ({
 /** Rejections are part of these tests; keep React Query from logging each one. */
 const logger = { log: () => undefined, warn: () => undefined, error: () => undefined };
 
+/** A sign-in watch outlives the row, so each test ends the one it started. */
+const clients: QueryClient[] = [];
+
 const renderRow = () => {
   const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
+  clients.push(client);
   const invalidate = jest.spyOn(client, 'invalidateQueries');
   const { unmount } = render(
     <QueryClientProvider client={client}>
@@ -57,7 +62,12 @@ const renderRow = () => {
   return { client, invalidate, unmount };
 };
 
-const fakeWindow = () => ({ opener: {} as unknown, location: { href: '' }, close: jest.fn() });
+const fakeWindow = () => ({
+  opener: {} as unknown,
+  closed: false,
+  location: { href: '' },
+  close: jest.fn(),
+});
 
 describe('ConnectedAccounts', () => {
   let openSpy: jest.SpyInstance;
@@ -71,6 +81,7 @@ describe('ConnectedAccounts', () => {
   });
 
   afterEach(() => {
+    clients.splice(0).forEach(stopPullRequestSignIn);
     openSpy.mockRestore();
   });
 
@@ -210,6 +221,49 @@ describe('ConnectedAccounts', () => {
     await waitFor(() => expect(popup.close).toHaveBeenCalledTimes(1));
   });
 
+  it('stops asking once the sign-in window is closed without finishing', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    mockConnect.mockResolvedValue({ url: 'https://github.com/login/oauth/authorize?x=1' });
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(popup.location.href).not.toBe(''));
+    popup.closed = true;
+    /** The next tick asks one last time; nothing after it. */
+    await new Promise((resolve) => setTimeout(resolve, 2500));
+    const settled = mockGetConnection.mock.calls.length;
+    await new Promise((resolve) => setTimeout(resolve, 2500));
+    expect(mockGetConnection).toHaveBeenCalledTimes(settled);
+    expect(
+      screen.getByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    ).toBeInTheDocument();
+  }, 10000);
+
+  it('refreshes pull requests when the sign-in finishes after Settings closed', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    mockConnect.mockResolvedValue({ url: 'https://github.com/login/oauth/authorize?x=1' });
+    const { client, invalidate, unmount } = renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(popup.location.href).not.toBe(''));
+    unmount();
+    mockGetConnection.mockResolvedValue(connection(true));
+
+    await waitFor(
+      () => expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+      { timeout: 5000 },
+    );
+    expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
+  }, 10000);
+
   it('closes the opened window and explains when the connection cannot start', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 912cf7cd18a..fc2d79419a6 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -4,17 +4,14 @@ import { MutationKeys, QueryKeys, dataService } from 'librechat-data-provider';
 import type { TPullRequestConnectStart, TPullRequestConnection } from 'librechat-data-provider';
 import { useGetStartupConfig } from '../Endpoints';
 
-/** How often the status is asked while a sign-in started from this window is still open. */
-export const PULL_REQUEST_CONNECT_POLL_MS = 2000;
-
 /**
  * Whether the signed-in user has connected their own account. Asked only when the deployment
- * offers connecting one, and again when the window regains focus. With `watch`, it is also asked
- * on an interval, in the background too, because the provider's sign-in can finish without this
- * window ever regaining focus afterwards. A change in either direction swaps the token the server
- * looks pull requests up with, so every cached pull request is refetched.
+ * offers connecting one, and again when the window regains focus; a sign-in in progress is
+ * watched by `watchPullRequestSignIn`, which outlives this hook. A change in either direction
+ * swaps the token the server looks pull requests up with, so every cached pull request is
+ * refetched.
  */
-export const usePullRequestConnectionQuery = ({ watch = false }: { watch?: boolean } = {}) => {
+export const usePullRequestConnectionQuery = () => {
   const queryClient = useQueryClient();
   const { data: startupConfig } = useGetStartupConfig();
   const query = useQuery<TPullRequestConnection>(
@@ -24,8 +21,6 @@ export const usePullRequestConnectionQuery = ({ watch = false }: { watch?: boole
       enabled: startupConfig?.pullRequestsConnect != null,
       retry: false,
       refetchOnWindowFocus: true,
-      refetchInterval: watch ? PULL_REQUEST_CONNECT_POLL_MS : false,
-      refetchIntervalInBackground: watch,
     },
   );
 
diff --git a/client/src/data-provider/PullRequest/index.ts b/client/src/data-provider/PullRequest/index.ts
index 75b1685dae8..d339cfb35bc 100644
--- a/client/src/data-provider/PullRequest/index.ts
+++ b/client/src/data-provider/PullRequest/index.ts
@@ -1,3 +1,4 @@
 export * from './queries';
 export * from './batch';
 export * from './connection';
+export * from './signIn';
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
new file mode 100644
index 00000000000..b1a6f3dbad8
--- /dev/null
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -0,0 +1,134 @@
+import { QueryKeys } from 'librechat-data-provider';
+import { QueryClient } from '@tanstack/react-query';
+import type { TPullRequestConnection } from 'librechat-data-provider';
+import { PULL_REQUEST_CONNECT_POLL_MS, watchPullRequestSignIn } from './signIn';
+
+const mockGetConnection = jest.fn();
+
+jest.mock('librechat-data-provider', () => {
+  const actual = jest.requireActual('librechat-data-provider');
+  return {
+    ...actual,
+    dataService: {
+      ...actual.dataService,
+      getPullRequestConnection: (...args: unknown[]) => mockGetConnection(...args),
+    },
+  };
+});
+
+const connection = (connected: boolean): TPullRequestConnection => ({
+  configured: true,
+  provider: 'github',
+  connected,
+});
+
+const MINUTE = 60_000;
+
+const setup = () => {
+  const client = new QueryClient({
+    logger: { log: () => undefined, warn: () => undefined, error: () => undefined },
+  });
+  const invalidate = jest.spyOn(client, 'invalidateQueries');
+  const popup = { closed: false };
+  return { client, invalidate, popup };
+};
+
+/** Every interval tick plus the reads it starts. */
+const pass = (ms: number) => jest.advanceTimersByTimeAsync(ms);
+
+describe('watchPullRequestSignIn', () => {
+  const stops: Array<() => void> = [];
+  const watch = (...args: Parameters<typeof watchPullRequestSignIn>) => {
+    stops.push(watchPullRequestSignIn(...args));
+  };
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    mockGetConnection.mockReset();
+    mockGetConnection.mockResolvedValue(connection(false));
+  });
+
+  afterEach(() => {
+    stops.splice(0).forEach((stop) => stop());
+    jest.useRealTimers();
+  });
+
+  it('asks while the window is open, then refreshes pull requests once connected', async () => {
+    const { client, invalidate, popup } = setup();
+    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+
+    await pass(PULL_REQUEST_CONNECT_POLL_MS * 2);
+    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+    expect(invalidate).not.toHaveBeenCalled();
+
+    mockGetConnection.mockResolvedValue(connection(true));
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
+
+    await pass(PULL_REQUEST_CONNECT_POLL_MS * 5);
+    window.dispatchEvent(new Event('focus'));
+    await pass(0);
+    expect(mockGetConnection).toHaveBeenCalledTimes(3);
+  });
+
+  it('stops asking on a timer once the window is closed, after one last ask', async () => {
+    const { client, popup } = setup();
+    watch(client, { popup, expiresAt: Date.now() + 60 * MINUTE });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+
+    popup.closed = true;
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+    await pass(10 * MINUTE);
+    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+  });
+
+  it('still notices a sign-in finished after its window closed, when this window is focused', async () => {
+    const { client, invalidate, popup } = setup();
+    popup.closed = true;
+    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    const asked = mockGetConnection.mock.calls.length;
+
+    mockGetConnection.mockResolvedValue(connection(true));
+    window.dispatchEvent(new Event('focus'));
+    await pass(0);
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked + 1);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
+  it('stops watching, focus included, when the flow expires', async () => {
+    const { client, popup } = setup();
+    watch(client, { popup, expiresAt: Date.now() + 1 * MINUTE });
+    await pass(1 * MINUTE);
+    const asked = mockGetConnection.mock.calls.length;
+
+    await pass(5 * MINUTE);
+    window.dispatchEvent(new Event('focus'));
+    await pass(0);
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  });
+
+  it('keeps watching through a failed status read', async () => {
+    const { client, invalidate, popup } = setup();
+    mockGetConnection.mockRejectedValueOnce(new Error('500'));
+    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+
+    mockGetConnection.mockResolvedValue(connection(true));
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
+  it('replaces the watch on an earlier sign-in when another starts', async () => {
+    const { client, popup } = setup();
+    const first = { closed: false };
+    watch(client, { popup: first, expiresAt: Date.now() + 10 * MINUTE });
+    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
new file mode 100644
index 00000000000..73028e3fbca
--- /dev/null
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -0,0 +1,87 @@
+import { QueryKeys, dataService } from 'librechat-data-provider';
+import type { TPullRequestConnection } from 'librechat-data-provider';
+import type { QueryClient } from '@tanstack/react-query';
+
+/** How often the status is asked while the sign-in window is still open. */
+export const PULL_REQUEST_CONNECT_POLL_MS = 2000;
+
+type Watch = { stop: () => void };
+
+/** One sign-in per app at a time: starting another replaces the watch on the first. */
+const watches = new WeakMap<QueryClient, Watch>();
+
+/**
+ * Watches a sign-in started from this window until the account is connected, outside any
+ * component, so closing Settings mid-flow still refreshes what was fetched with the old token.
+ *
+ * - While the sign-in window is open, the status is asked on an interval, because the provider can
+ *   finish without this window ever regaining focus.
+ * - Once that window is closed (finished, denied or cancelled) the interval stops after one last
+ *   ask. The flow may still finish in a window this one lost track of, so until it expires the
+ *   status is asked again whenever this window regains focus, and never on a timer.
+ * - At `expiresAt` the server's signed state is no longer accepted, so watching ends.
+ * - Seeing the account connected ends watching and refetches every cached pull request.
+ *
+ * A failed status read is not an answer, so watching continues; the row shows the failure.
+ * Returns a function that ends the watch.
+ */
+export function watchPullRequestSignIn(
+  queryClient: QueryClient,
+  { popup, expiresAt }: { popup: Pick<Window, 'closed'>; expiresAt: number },
+): () => void {
+  watches.get(queryClient)?.stop();
+  let interval: ReturnType<typeof setInterval> | undefined;
+  let stopped = false;
+
+  const check = async (): Promise<void> => {
+    if (stopped) {
+      return;
+    }
+    let status: TPullRequestConnection;
+    try {
+      status = await queryClient.fetchQuery<TPullRequestConnection>(
+        [QueryKeys.pullRequestConnection],
+        () => dataService.getPullRequestConnection(),
+        { staleTime: 0, retry: false },
+      );
+    } catch {
+      return;
+    }
+    if (stopped || !status.connected) {
+      return;
+    }
+    stop();
+    queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+  };
+
+  const tick = () => {
+    if (popup.closed) {
+      clearInterval(interval);
+      interval = undefined;
+    }
+    void check();
+  };
+  const onFocus = () => void check();
+  const expiry = setTimeout(() => stop(), Math.max(0, expiresAt - Date.now()));
+
+  function stop() {
+    stopped = true;
+    clearInterval(interval);
+    clearTimeout(expiry);
+    window.removeEventListener('focus', onFocus);
+    if (watches.get(queryClient) === watch) {
+      watches.delete(queryClient);
+    }
+  }
+
+  const watch: Watch = { stop };
+  watches.set(queryClient, watch);
+  interval = setInterval(tick, PULL_REQUEST_CONNECT_POLL_MS);
+  window.addEventListener('focus', onFocus);
+  return stop;
+}
+
+/** Ends the sign-in watch of an app, if one is running. */
+export function stopPullRequestSignIn(queryClient: QueryClient): void {
+  watches.get(queryClient)?.stop();
+}

From 0ad83ed67597a2ca855e18e21344ea0816dbc170 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:19:39 +0200
Subject: [PATCH 07/30] fix: Refresh Pull Requests Once per Change of the
 Credential They Were Fetched With

---
 .../PullRequest/connection.test.tsx           | 45 +++++++++++++++++++
 .../data-provider/PullRequest/connection.ts   | 45 +++++++++++++++----
 .../src/data-provider/PullRequest/signIn.ts   |  6 ++-
 3 files changed, 86 insertions(+), 10 deletions(-)

diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index f7d415a5016..9551846fa94 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -77,6 +77,51 @@ describe('pull request connection hooks', () => {
     );
   });
 
+  it('refetches cached pull requests when the first status shows the user connected', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(true));
+    const { wrapper, invalidate } = setup();
+    renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() =>
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+    );
+    expect(invalidate).toHaveBeenCalledTimes(1);
+  });
+
+  it('leaves cached pull requests alone when the first status shows the server token', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(false));
+    const { wrapper, invalidate } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(result.current.data?.connected).toBe(false));
+    expect(invalidate).not.toHaveBeenCalled();
+  });
+
+  it('refreshes pull requests once per change, not on every Settings visit', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    const { wrapper, invalidate } = setup();
+    const first = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
+    first.unmount();
+
+    const second = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await act(async () => {
+      await second.result.current.refetch();
+    });
+    expect(invalidate).toHaveBeenCalledTimes(1);
+  });
+
+  it('refetches cached pull requests when a connection moves to another provider', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(true));
+    const { wrapper, invalidate } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
+
+    mockGetConnection.mockResolvedValueOnce({ ...connection(true), provider: 'gitlab' });
+    await act(async () => {
+      await result.current.refetch();
+    });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
+  });
+
   it('marks the account disconnected and refetches the status and pull requests', async () => {
     mockDisconnect.mockResolvedValue(undefined);
     const { client, wrapper, invalidate } = setup();
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index fc2d79419a6..5fb09e899ab 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -1,9 +1,38 @@
-import { useEffect, useRef } from 'react';
+import { useEffect } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { MutationKeys, QueryKeys, dataService } from 'librechat-data-provider';
 import type { TPullRequestConnectStart, TPullRequestConnection } from 'librechat-data-provider';
+import type { QueryClient } from '@tanstack/react-query';
 import { useGetStartupConfig } from '../Endpoints';
 
+/** The credential the server looks this user's pull requests up with, as the status shows it. */
+const credentialOf = (status: TPullRequestConnection): string =>
+  status.connected ? `user:${status.provider ?? ''}` : 'server';
+
+/** Per app, the credential its cached pull requests were last refreshed under. */
+const refreshedUnder = new WeakMap<QueryClient, string>();
+
+/**
+ * Refetches every cached pull request when a status shows a different credential than the one
+ * they were last refreshed under: connecting, disconnecting, or a connection moving to another
+ * provider. The first status an app sees refreshes them only when it shows the user's own
+ * account, since anything fetched before it may have used the server's token; one showing the
+ * server's token, the common case, costs nothing. Every path that learns the status goes
+ * through here, so a change refetches pull requests once.
+ */
+export function syncPullRequestConnection(
+  queryClient: QueryClient,
+  status: TPullRequestConnection,
+): void {
+  const credential = credentialOf(status);
+  const previous = refreshedUnder.get(queryClient);
+  refreshedUnder.set(queryClient, credential);
+  if (previous === credential || (previous == null && credential === 'server')) {
+    return;
+  }
+  queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+}
+
 /**
  * Whether the signed-in user has connected their own account. Asked only when the deployment
  * offers connecting one, and again when the window regains focus; a sign-in in progress is
@@ -24,19 +53,16 @@ export const usePullRequestConnectionQuery = () => {
     },
   );
 
-  const connected = query.data?.connected;
-  const previous = useRef(connected);
+  const { data } = query;
   useEffect(() => {
-    if (previous.current != null && connected != null && previous.current !== connected) {
-      queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+    if (data != null) {
+      syncPullRequestConnection(queryClient, data);
     }
-    previous.current = connected ?? previous.current;
-  }, [connected, queryClient]);
+  }, [data, queryClient]);
 
   return query;
 };
 
-/** Starts the provider's sign-in; the caller navigates a window it opened to the returned url. */
 /**
  * The same status for what contains the Settings row, so an app the server no longer has hides
  * the whole section, and a later answer that it has one again brings the section back. It shares
@@ -55,6 +81,7 @@ export const usePullRequestConnectionStatus = () => {
   ).data;
 };
 
+/** Starts the provider's sign-in; the caller navigates a window it opened to the returned url. */
 export const useConnectPullRequestAccountMutation = () =>
   useMutation<TPullRequestConnectStart, unknown, void>({
     mutationKey: [MutationKeys.connectPullRequestAccount],
@@ -72,6 +99,8 @@ export const useDisconnectPullRequestAccountMutation = () => {
         (current) => (current == null ? current : { ...current, connected: false }),
       );
       queryClient.invalidateQueries([QueryKeys.pullRequestConnection]);
+      /** A disconnect always leaves the server's token, whatever this app saw before. */
+      refreshedUnder.set(queryClient, 'server');
       queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
     },
   });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 73028e3fbca..e0f581c33f0 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -1,6 +1,7 @@
 import { QueryKeys, dataService } from 'librechat-data-provider';
 import type { TPullRequestConnection } from 'librechat-data-provider';
 import type { QueryClient } from '@tanstack/react-query';
+import { syncPullRequestConnection } from './connection';
 
 /** How often the status is asked while the sign-in window is still open. */
 export const PULL_REQUEST_CONNECT_POLL_MS = 2000;
@@ -20,7 +21,8 @@ const watches = new WeakMap<QueryClient, Watch>();
  *   ask. The flow may still finish in a window this one lost track of, so until it expires the
  *   status is asked again whenever this window regains focus, and never on a timer.
  * - At `expiresAt` the server's signed state is no longer accepted, so watching ends.
- * - Seeing the account connected ends watching and refetches every cached pull request.
+ * - Seeing the account connected ends watching and refetches every cached pull request, once,
+ *   through the same check a mounted status row uses.
  *
  * A failed status read is not an answer, so watching continues; the row shows the failure.
  * Returns a function that ends the watch.
@@ -51,7 +53,7 @@ export function watchPullRequestSignIn(
       return;
     }
     stop();
-    queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+    syncPullRequestConnection(queryClient, status);
   };
 
   const tick = () => {

From 85a51eb075893f7039fcfa862e8e7bf94a92c011 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:23:35 +0200
Subject: [PATCH 08/30] fix: Record Every Status the Sign-In Watch Reads

---
 .../src/data-provider/PullRequest/signIn.test.ts   | 14 ++++++++++++++
 client/src/data-provider/PullRequest/signIn.ts     |  7 +++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index b1a6f3dbad8..04768aeb738 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -111,6 +111,20 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it('refreshes pull requests when the account it watches turns out disconnected', async () => {
+    const { client, invalidate, popup } = setup();
+    mockGetConnection.mockResolvedValueOnce(connection(true));
+    watch(client, { popup: { closed: true }, expiresAt: Date.now() + 10 * MINUTE });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(invalidate).toHaveBeenCalledTimes(1);
+
+    /** Removed elsewhere while this window still watches a new sign-in. */
+    mockGetConnection.mockResolvedValue(connection(false));
+    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(invalidate).toHaveBeenCalledTimes(2);
+  });
+
   it('keeps watching through a failed status read', async () => {
     const { client, invalidate, popup } = setup();
     mockGetConnection.mockRejectedValueOnce(new Error('500'));
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index e0f581c33f0..c3aad4a52bf 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -49,11 +49,14 @@ export function watchPullRequestSignIn(
     } catch {
       return;
     }
-    if (stopped || !status.connected) {
+    if (stopped) {
       return;
     }
-    stop();
+    /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */
     syncPullRequestConnection(queryClient, status);
+    if (status.connected) {
+      stop();
+    }
   };
 
   const tick = () => {

From 7466b50b880400ce76bbd5aece55f57684bf9a61 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:58:40 +0200
Subject: [PATCH 09/30] fix: Keep Watching a Severed Sign-In Through Its
 Landing Page and End Watches With the Session

---
 .../Nav/Settings/ConnectedAccounts.tsx        |   1 -
 .../__tests__/ConnectedAccounts.spec.tsx      |  38 +---
 client/src/components/OAuth/OAuthSuccess.tsx  |  18 +-
 .../OAuth/__tests__/OAuthSuccess.spec.tsx     |  30 ++++
 .../PullRequest/connection.test.tsx           |  32 ++++
 .../data-provider/PullRequest/connection.ts   |  23 ++-
 .../src/data-provider/PullRequest/queries.ts  |   8 +-
 .../data-provider/PullRequest/signIn.test.ts  | 170 +++++++++++-------
 .../src/data-provider/PullRequest/signIn.ts   |  77 +++++---
 9 files changed, 259 insertions(+), 138 deletions(-)
 create mode 100644 client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index a228b2eb350..e3055f7b79e 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -112,7 +112,6 @@ export default function ConnectedAccounts() {
         popup.location.href = url;
         keepFocus.current = true;
         watchPullRequestSignIn(queryClient, {
-          popup,
           expiresAt: Date.now() + (expiresInSeconds ?? DEFAULT_CONNECT_FLOW_SECONDS) * 1000,
         });
       },
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index c9d849e7a50..70ef702dd24 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -5,7 +5,7 @@ import { QueryKeys } from 'librechat-data-provider';
 import { render, screen, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
-import { stopPullRequestSignIn } from '~/data-provider/PullRequest/signIn';
+import { stopPullRequestSignIns } from '~/data-provider/PullRequest/signIn';
 import ConnectedAccounts from '../ConnectedAccounts';
 
 const mockGetConnection = jest.fn();
@@ -47,12 +47,8 @@ const connection = (connected: boolean): TPullRequestConnection => ({
 /** Rejections are part of these tests; keep React Query from logging each one. */
 const logger = { log: () => undefined, warn: () => undefined, error: () => undefined };
 
-/** A sign-in watch outlives the row, so each test ends the one it started. */
-const clients: QueryClient[] = [];
-
 const renderRow = () => {
   const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
-  clients.push(client);
   const invalidate = jest.spyOn(client, 'invalidateQueries');
   const { unmount } = render(
     <QueryClientProvider client={client}>
@@ -62,12 +58,7 @@ const renderRow = () => {
   return { client, invalidate, unmount };
 };
 
-const fakeWindow = () => ({
-  opener: {} as unknown,
-  closed: false,
-  location: { href: '' },
-  close: jest.fn(),
-});
+const fakeWindow = () => ({ opener: {} as unknown, location: { href: '' }, close: jest.fn() });
 
 describe('ConnectedAccounts', () => {
   let openSpy: jest.SpyInstance;
@@ -81,7 +72,8 @@ describe('ConnectedAccounts', () => {
   });
 
   afterEach(() => {
-    clients.splice(0).forEach(stopPullRequestSignIn);
+    /** A sign-in watch outlives the row, so each test ends the one it started. */
+    stopPullRequestSignIns();
     openSpy.mockRestore();
   });
 
@@ -221,28 +213,6 @@ describe('ConnectedAccounts', () => {
     await waitFor(() => expect(popup.close).toHaveBeenCalledTimes(1));
   });
 
-  it('stops asking once the sign-in window is closed without finishing', async () => {
-    const popup = fakeWindow();
-    openSpy.mockReturnValue(popup as unknown as Window);
-    mockGetConnection.mockResolvedValue(connection(false));
-    mockConnect.mockResolvedValue({ url: 'https://github.com/login/oauth/authorize?x=1' });
-    renderRow();
-
-    await userEvent.click(
-      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
-    );
-    await waitFor(() => expect(popup.location.href).not.toBe(''));
-    popup.closed = true;
-    /** The next tick asks one last time; nothing after it. */
-    await new Promise((resolve) => setTimeout(resolve, 2500));
-    const settled = mockGetConnection.mock.calls.length;
-    await new Promise((resolve) => setTimeout(resolve, 2500));
-    expect(mockGetConnection).toHaveBeenCalledTimes(settled);
-    expect(
-      screen.getByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
-    ).toBeInTheDocument();
-  }, 10000);
-
   it('refreshes pull requests when the sign-in finishes after Settings closed', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);
diff --git a/client/src/components/OAuth/OAuthSuccess.tsx b/client/src/components/OAuth/OAuthSuccess.tsx
index fdda4f3217c..67c0aa1e72d 100644
--- a/client/src/components/OAuth/OAuthSuccess.tsx
+++ b/client/src/components/OAuth/OAuthSuccess.tsx
@@ -1,5 +1,6 @@
 import React, { useEffect, useState } from 'react';
 import { useSearchParams } from 'react-router-dom';
+import { announceOAuthSettled } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 
 export default function OAuthSuccess() {
@@ -8,6 +9,11 @@ export default function OAuthSuccess() {
   const [secondsLeft, setSecondsLeft] = useState(3);
   const serverName = searchParams.get('serverName');
 
+  useEffect(() => {
+    /** Reaches the window that started the sign-in even when the provider severed the popup. */
+    announceOAuthSettled();
+  }, []);
+
   useEffect(() => {
     const countdown = setInterval(() => {
       setSecondsLeft((prev) => {
@@ -24,19 +30,19 @@ export default function OAuthSuccess() {
   }, []);
 
   return (
-    <div className="flex min-h-screen items-center justify-center bg-surface-secondary p-8">
-      <div className="w-full max-w-md rounded-xl bg-surface-primary p-8 text-center shadow-lg">
-        <h1 className="mb-4 text-3xl font-bold text-text-primary">
+    <div className="bg-surface-secondary flex min-h-screen items-center justify-center p-8">
+      <div className="bg-surface-primary w-full max-w-md rounded-xl p-8 text-center shadow-lg">
+        <h1 className="text-text-primary mb-4 text-3xl font-bold">
           {localize('com_ui_oauth_success_title') || 'Authentication Successful'}
         </h1>
-        <p className="mb-2 text-sm text-text-secondary">
+        <p className="text-text-secondary mb-2 text-sm">
           {localize('com_ui_oauth_success_description') ||
             'Your authentication was successful. This window will close in'}{' '}
-          <span className="font-medium text-accent-primary">{secondsLeft}</span>{' '}
+          <span className="text-accent-primary font-medium">{secondsLeft}</span>{' '}
           {localize('com_ui_seconds') || 'seconds'}.
         </p>
         {serverName && (
-          <p className="mt-4 text-xs text-text-tertiary">
+          <p className="text-text-tertiary mt-4 text-xs">
             {localize('com_ui_oauth_connected_to') || 'Connected to'}:{' '}
             <span className="font-medium">{serverName}</span>
           </p>
diff --git a/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx b/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx
new file mode 100644
index 00000000000..df716412394
--- /dev/null
+++ b/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx
@@ -0,0 +1,30 @@
+import React from 'react';
+import { render } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import OAuthSuccess from '../OAuthSuccess';
+
+const mockAnnounce = jest.fn();
+
+jest.mock('~/data-provider', () => ({
+  announceOAuthSettled: () => mockAnnounce(),
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+describe('OAuthSuccess', () => {
+  it('announces the settled sign-in once, for a window the provider severed from this one', () => {
+    const { rerender } = render(
+      <MemoryRouter initialEntries={['/oauth/success?serverName=GitHub']}>
+        <OAuthSuccess />
+      </MemoryRouter>,
+    );
+    rerender(
+      <MemoryRouter initialEntries={['/oauth/success?serverName=GitHub']}>
+        <OAuthSuccess />
+      </MemoryRouter>,
+    );
+    expect(mockAnnounce).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 9551846fa94..9e367bb2bcd 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -4,6 +4,7 @@ import { act, renderHook, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
 import {
+  resetPullRequestCredentials,
   usePullRequestConnectionQuery,
   useDisconnectPullRequestAccountMutation,
 } from './connection';
@@ -122,6 +123,37 @@ describe('pull request connection hooks', () => {
     await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
   });
 
+  it('refetches cached pull requests when the deployment moves a disconnected user to another provider', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(false));
+    const { wrapper, invalidate } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(result.current.data?.connected).toBe(false));
+    expect(invalidate).not.toHaveBeenCalled();
+
+    mockGetConnection.mockResolvedValueOnce({ ...connection(false), provider: 'gitlab' });
+    await act(async () => {
+      await result.current.refetch();
+    });
+    await waitFor(() =>
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+    );
+  });
+
+  it('starts over with the next session, so its first status follows the first-status rule', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    const { wrapper, invalidate } = setup();
+    const first = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
+    first.unmount();
+
+    resetPullRequestCredentials();
+    const second = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await act(async () => {
+      await second.result.current.refetch();
+    });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
+  });
+
   it('marks the account disconnected and refetches the status and pull requests', async () => {
     mockDisconnect.mockResolvedValue(undefined);
     const { client, wrapper, invalidate } = setup();
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 5fb09e899ab..07d639a753b 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -5,12 +5,20 @@ import type { TPullRequestConnectStart, TPullRequestConnection } from 'librechat
 import type { QueryClient } from '@tanstack/react-query';
 import { useGetStartupConfig } from '../Endpoints';
 
-/** The credential the server looks this user's pull requests up with, as the status shows it. */
+/**
+ * The credential the server looks this user's pull requests up with, as the status shows it:
+ * the user's own account or the server's token, on the provider the deployment now uses.
+ */
 const credentialOf = (status: TPullRequestConnection): string =>
-  status.connected ? `user:${status.provider ?? ''}` : 'server';
+  `${status.connected ? 'user' : 'server'}:${status.provider ?? ''}`;
 
 /** Per app, the credential its cached pull requests were last refreshed under. */
-const refreshedUnder = new WeakMap<QueryClient, string>();
+const refreshedUnder = new Map<QueryClient, string>();
+
+/** Forgets every app's credential with the session, so the next one starts from its own. */
+export function resetPullRequestCredentials(): void {
+  refreshedUnder.clear();
+}
 
 /**
  * Refetches every cached pull request when a status shows a different credential than the one
@@ -27,7 +35,7 @@ export function syncPullRequestConnection(
   const credential = credentialOf(status);
   const previous = refreshedUnder.get(queryClient);
   refreshedUnder.set(queryClient, credential);
-  if (previous === credential || (previous == null && credential === 'server')) {
+  if (previous === credential || (previous == null && !status.connected)) {
     return;
   }
   queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
@@ -94,13 +102,16 @@ export const useDisconnectPullRequestAccountMutation = () => {
     mutationKey: [MutationKeys.disconnectPullRequestAccount],
     mutationFn: () => dataService.disconnectPullRequestAccount(),
     onSuccess: () => {
-      queryClient.setQueryData<TPullRequestConnection>(
+      const status = queryClient.setQueryData<TPullRequestConnection>(
         [QueryKeys.pullRequestConnection],
         (current) => (current == null ? current : { ...current, connected: false }),
       );
       queryClient.invalidateQueries([QueryKeys.pullRequestConnection]);
       /** A disconnect always leaves the server's token, whatever this app saw before. */
-      refreshedUnder.set(queryClient, 'server');
+      refreshedUnder.set(
+        queryClient,
+        credentialOf({ configured: true, provider: status?.provider, connected: false }),
+      );
       queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
     },
   });
diff --git a/client/src/data-provider/PullRequest/queries.ts b/client/src/data-provider/PullRequest/queries.ts
index 16e135194c7..1370c6bd3cd 100644
--- a/client/src/data-provider/PullRequest/queries.ts
+++ b/client/src/data-provider/PullRequest/queries.ts
@@ -9,7 +9,9 @@ import {
 import type { TConversationPullRequestResponse } from 'librechat-data-provider';
 import type { UseQueryOptions } from '@tanstack/react-query';
 import { createBatchFetcher, createPullRequestBatcher } from './batch';
+import { resetPullRequestCredentials } from './connection';
 import { useGetStartupConfig } from '../Endpoints';
+import { stopPullRequestSignIns } from './signIn';
 import store from '~/store';
 
 const SETTLED_REFRESH_MS = 60_000;
@@ -90,13 +92,17 @@ const batcherFor = (userId: string): RowBatcher => {
 };
 
 /**
- * Ends the row queue with the session. Called wherever the session's client state is cleared, so
+ * Ends the row queue, any account sign-in watch and the record of which credential cached pull
+ * requests were fetched with, with the session. Called wherever the session's client state is cleared, so
  * signing back in as the same account starts a fresh queue and neither waits behind, nor sends,
  * anything the previous session left.
  */
 export const endPullRequestSession = (): void => {
   rowBatcher?.batcher.dispose();
   rowBatcher = undefined;
+  /** A sign-in watch left running would ask for, and cache, the next user's connection. */
+  stopPullRequestSignIns();
+  resetPullRequestCredentials();
 };
 
 /**
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 04768aeb738..f398073eb3e 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -1,7 +1,13 @@
 import { QueryKeys } from 'librechat-data-provider';
 import { QueryClient } from '@tanstack/react-query';
 import type { TPullRequestConnection } from 'librechat-data-provider';
-import { PULL_REQUEST_CONNECT_POLL_MS, watchPullRequestSignIn } from './signIn';
+import {
+  PULL_REQUEST_CONNECT_POLL_MS,
+  announceOAuthSettled,
+  stopPullRequestSignIns,
+  watchPullRequestSignIn,
+} from './signIn';
+import { endPullRequestSession } from './queries';
 
 const mockGetConnection = jest.fn();
 
@@ -16,6 +22,28 @@ jest.mock('librechat-data-provider', () => {
   };
 });
 
+/** jsdom has no BroadcastChannel; this one delivers between instances of one name, as tabs do. */
+class FakeBroadcastChannel {
+  static open = new Set<FakeBroadcastChannel>();
+  private listeners = new Set<(event: MessageEvent) => void>();
+  constructor(readonly name: string) {
+    FakeBroadcastChannel.open.add(this);
+  }
+  addEventListener(_type: 'message', listener: (event: MessageEvent) => void) {
+    this.listeners.add(listener);
+  }
+  postMessage(data: unknown) {
+    for (const other of FakeBroadcastChannel.open) {
+      if (other !== this && other.name === this.name) {
+        other.listeners.forEach((listener) => listener({ data } as MessageEvent));
+      }
+    }
+  }
+  close() {
+    FakeBroadcastChannel.open.delete(this);
+  }
+}
+
 const connection = (connected: boolean): TPullRequestConnection => ({
   configured: true,
   provider: 'github',
@@ -29,18 +57,23 @@ const setup = () => {
     logger: { log: () => undefined, warn: () => undefined, error: () => undefined },
   });
   const invalidate = jest.spyOn(client, 'invalidateQueries');
-  const popup = { closed: false };
-  return { client, invalidate, popup };
+  return { client, invalidate };
 };
 
-/** Every interval tick plus the reads it starts. */
 const pass = (ms: number) => jest.advanceTimersByTimeAsync(ms);
+const focus = async () => {
+  window.dispatchEvent(new Event('focus'));
+  await pass(0);
+};
 
 describe('watchPullRequestSignIn', () => {
-  const stops: Array<() => void> = [];
-  const watch = (...args: Parameters<typeof watchPullRequestSignIn>) => {
-    stops.push(watchPullRequestSignIn(...args));
-  };
+  beforeAll(() => {
+    (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = FakeBroadcastChannel;
+  });
+
+  afterAll(() => {
+    delete (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel;
+  });
 
   beforeEach(() => {
     jest.useFakeTimers();
@@ -49,100 +82,109 @@ describe('watchPullRequestSignIn', () => {
   });
 
   afterEach(() => {
-    stops.splice(0).forEach((stop) => stop());
+    stopPullRequestSignIns();
     jest.useRealTimers();
   });
 
-  it('asks while the window is open, then refreshes pull requests once connected', async () => {
-    const { client, invalidate, popup } = setup();
-    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+  it('refreshes pull requests and stops once the account shows connected', async () => {
+    const { client, invalidate } = setup();
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
 
-    await pass(PULL_REQUEST_CONNECT_POLL_MS * 2);
-    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
     expect(invalidate).not.toHaveBeenCalled();
 
     mockGetConnection.mockResolvedValue(connection(true));
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    await focus();
     expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
     expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
 
-    await pass(PULL_REQUEST_CONNECT_POLL_MS * 5);
-    window.dispatchEvent(new Event('focus'));
-    await pass(0);
-    expect(mockGetConnection).toHaveBeenCalledTimes(3);
+    const asked = mockGetConnection.mock.calls.length;
+    await pass(5 * MINUTE);
+    await focus();
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
-  it('stops asking on a timer once the window is closed, after one last ask', async () => {
-    const { client, popup } = setup();
-    watch(client, { popup, expiresAt: Date.now() + 60 * MINUTE });
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
-    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+  it('asks at once when the sign-in page announces it settled, however the popup reads', async () => {
+    const { client, invalidate } = setup();
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    mockGetConnection.mockResolvedValue(connection(true));
 
-    popup.closed = true;
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
-    expect(mockGetConnection).toHaveBeenCalledTimes(2);
-    await pass(10 * MINUTE);
-    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+    /** Before any timer is due: only the announcement can explain this ask. */
+    announceOAuthSettled();
+    await pass(0);
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
   });
 
-  it('still notices a sign-in finished after its window closed, when this window is focused', async () => {
-    const { client, invalidate, popup } = setup();
-    popup.closed = true;
-    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
-    const asked = mockGetConnection.mock.calls.length;
+  it('backs off asking on a timer, so a sign-in left open costs few requests', async () => {
+    const { client } = setup();
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 60 * MINUTE });
 
-    mockGetConnection.mockResolvedValue(connection(true));
-    window.dispatchEvent(new Event('focus'));
-    await pass(0);
-    expect(mockGetConnection).toHaveBeenCalledTimes(asked + 1);
-    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    await pass(15_000);
+    /** Responsive while a sign-in is likely: 2, 6 and 14 seconds in. */
+    expect(mockGetConnection).toHaveBeenCalledTimes(3);
+    await pass(60 * MINUTE - 15_000);
+    /** At most one ask per 30 seconds after that: about 120 in an hour, not 1,800. */
+    expect(mockGetConnection.mock.calls.length).toBeLessThanOrEqual(122);
   });
 
-  it('stops watching, focus included, when the flow expires', async () => {
-    const { client, popup } = setup();
-    watch(client, { popup, expiresAt: Date.now() + 1 * MINUTE });
+  it('stops watching, focus and announcements included, when the flow expires', async () => {
+    const { client } = setup();
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 1 * MINUTE });
     await pass(1 * MINUTE);
     const asked = mockGetConnection.mock.calls.length;
 
     await pass(5 * MINUTE);
-    window.dispatchEvent(new Event('focus'));
+    await focus();
+    announceOAuthSettled();
     await pass(0);
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it('keeps watching through a failed status read', async () => {
+    const { client, invalidate } = setup();
+    mockGetConnection.mockRejectedValueOnce(new Error('500'));
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+
+    mockGetConnection.mockResolvedValue(connection(true));
+    await focus();
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
   it('refreshes pull requests when the account it watches turns out disconnected', async () => {
-    const { client, invalidate, popup } = setup();
+    const { client, invalidate } = setup();
     mockGetConnection.mockResolvedValueOnce(connection(true));
-    watch(client, { popup: { closed: true }, expiresAt: Date.now() + 10 * MINUTE });
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    await focus();
     expect(invalidate).toHaveBeenCalledTimes(1);
 
     /** Removed elsewhere while this window still watches a new sign-in. */
     mockGetConnection.mockResolvedValue(connection(false));
-    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    await focus();
     expect(invalidate).toHaveBeenCalledTimes(2);
   });
 
-  it('keeps watching through a failed status read', async () => {
-    const { client, invalidate, popup } = setup();
-    mockGetConnection.mockRejectedValueOnce(new Error('500'));
-    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+  it('replaces the watch on an earlier sign-in when another starts', async () => {
+    const { client } = setup();
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
 
-    mockGetConnection.mockResolvedValue(connection(true));
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
-    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    await focus();
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
   });
 
-  it('replaces the watch on an earlier sign-in when another starts', async () => {
-    const { client, popup } = setup();
-    const first = { closed: false };
-    watch(client, { popup: first, expiresAt: Date.now() + 10 * MINUTE });
-    watch(client, { popup, expiresAt: Date.now() + 10 * MINUTE });
+  it('ends every watch with the session, so none asks for the next user', async () => {
+    const { client } = setup();
+    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
 
-    await pass(PULL_REQUEST_CONNECT_POLL_MS);
-    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+    endPullRequestSession();
+    await pass(10 * MINUTE);
+    await focus();
+    announceOAuthSettled();
+    await pass(0);
+    expect(mockGetConnection).not.toHaveBeenCalled();
   });
 });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index c3aad4a52bf..0343ebb82c3 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -3,36 +3,55 @@ import type { TPullRequestConnection } from 'librechat-data-provider';
 import type { QueryClient } from '@tanstack/react-query';
 import { syncPullRequestConnection } from './connection';
 
-/** How often the status is asked while the sign-in window is still open. */
+/** First wait between status asks while a sign-in is watched; each wait doubles from here. */
 export const PULL_REQUEST_CONNECT_POLL_MS = 2000;
+/** Longest wait between status asks, so a sign-in left open costs a few requests a minute. */
+export const PULL_REQUEST_CONNECT_POLL_MAX_MS = 30_000;
+/** Same-origin pages that end an OAuth sign-in announce it here. */
+export const OAUTH_SETTLED_CHANNEL = 'librechat:oauth-settled';
 
 type Watch = { stop: () => void };
 
 /** One sign-in per app at a time: starting another replaces the watch on the first. */
-const watches = new WeakMap<QueryClient, Watch>();
+const watches = new Map<QueryClient, Watch>();
+
+/**
+ * Announces, from the page an OAuth sign-in lands on, that it has settled. The page shares this
+ * app's origin, so the announcement reaches the window that started the sign-in even when the
+ * provider's pages severed the popup from it (a cross-origin opener policy makes the retained
+ * window handle read as closed while the sign-in is still open).
+ */
+export function announceOAuthSettled(): void {
+  if (typeof BroadcastChannel === 'undefined') {
+    return;
+  }
+  const channel = new BroadcastChannel(OAUTH_SETTLED_CHANNEL);
+  channel.postMessage('settled');
+  channel.close();
+}
 
 /**
  * Watches a sign-in started from this window until the account is connected, outside any
  * component, so closing Settings mid-flow still refreshes what was fetched with the old token.
  *
- * - While the sign-in window is open, the status is asked on an interval, because the provider can
- *   finish without this window ever regaining focus.
- * - Once that window is closed (finished, denied or cancelled) the interval stops after one last
- *   ask. The flow may still finish in a window this one lost track of, so until it expires the
- *   status is asked again whenever this window regains focus, and never on a timer.
+ * - The landing page's announcement asks the status at once; it is the signal that survives the
+ *   provider severing the popup, so the popup handle is not consulted at all.
+ * - Without it (an older page, no BroadcastChannel) the status is asked on a timer that starts at
+ *   2 seconds and doubles to 30, and whenever this window regains focus.
  * - At `expiresAt` the server's signed state is no longer accepted, so watching ends.
- * - Seeing the account connected ends watching and refetches every cached pull request, once,
- *   through the same check a mounted status row uses.
+ * - Seeing the account connected ends watching. Every answer goes through the same check a
+ *   mounted status row uses, so a change of credential refetches cached pull requests once.
  *
  * A failed status read is not an answer, so watching continues; the row shows the failure.
- * Returns a function that ends the watch.
+ * Returns a function that ends the watch; ending the session ends every watch.
  */
 export function watchPullRequestSignIn(
   queryClient: QueryClient,
-  { popup, expiresAt }: { popup: Pick<Window, 'closed'>; expiresAt: number },
+  { expiresAt }: { expiresAt: number },
 ): () => void {
   watches.get(queryClient)?.stop();
-  let interval: ReturnType<typeof setInterval> | undefined;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let wait = PULL_REQUEST_CONNECT_POLL_MS;
   let stopped = false;
 
   const check = async (): Promise<void> => {
@@ -59,21 +78,25 @@ export function watchPullRequestSignIn(
     }
   };
 
-  const tick = () => {
-    if (popup.closed) {
-      clearInterval(interval);
-      interval = undefined;
-    }
-    void check();
+  const schedule = () => {
+    timer = setTimeout(() => {
+      void check();
+      wait = Math.min(wait * 2, PULL_REQUEST_CONNECT_POLL_MAX_MS);
+      schedule();
+    }, wait);
   };
-  const onFocus = () => void check();
+  const onSignal = () => void check();
+  const channel =
+    typeof BroadcastChannel === 'undefined' ? null : new BroadcastChannel(OAUTH_SETTLED_CHANNEL);
+  channel?.addEventListener('message', onSignal);
   const expiry = setTimeout(() => stop(), Math.max(0, expiresAt - Date.now()));
 
   function stop() {
     stopped = true;
-    clearInterval(interval);
+    clearTimeout(timer);
     clearTimeout(expiry);
-    window.removeEventListener('focus', onFocus);
+    window.removeEventListener('focus', onSignal);
+    channel?.close();
     if (watches.get(queryClient) === watch) {
       watches.delete(queryClient);
     }
@@ -81,12 +104,14 @@ export function watchPullRequestSignIn(
 
   const watch: Watch = { stop };
   watches.set(queryClient, watch);
-  interval = setInterval(tick, PULL_REQUEST_CONNECT_POLL_MS);
-  window.addEventListener('focus', onFocus);
+  schedule();
+  window.addEventListener('focus', onSignal);
   return stop;
 }
 
-/** Ends the sign-in watch of an app, if one is running. */
-export function stopPullRequestSignIn(queryClient: QueryClient): void {
-  watches.get(queryClient)?.stop();
+/** Ends every sign-in watch, as the session ending does: none may ask for the next user. */
+export function stopPullRequestSignIns(): void {
+  for (const watch of [...watches.values()]) {
+    watch.stop();
+  }
 }

From 483418c34c71f00128d0e0cb7090e6624ccae989 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:04:27 +0200
Subject: [PATCH 10/30] fix: Drop a Sign-In Begun Before the Session Ended

---
 .../Nav/Settings/ConnectedAccounts.tsx        |  8 +++
 .../__tests__/ConnectedAccounts.spec.tsx      | 21 ++++++
 .../data-provider/PullRequest/signIn.test.ts  | 65 ++++++++++++++++---
 .../src/data-provider/PullRequest/signIn.ts   | 14 +++-
 4 files changed, 97 insertions(+), 11 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index e3055f7b79e..8f0098fb06a 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -25,6 +25,7 @@ import {
   useConnectPullRequestAccountMutation,
   useDisconnectPullRequestAccountMutation,
   watchPullRequestSignIn,
+  pullRequestSignInSession,
 } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 
@@ -107,11 +108,18 @@ export default function ConnectedAccounts() {
      * sign-in page (or closed) when Settings is closed before the server answers. The watch on the
      * sign-in lives outside this row for the same reason.
      */
+    const startedIn = pullRequestSignInSession();
     connectMutation.mutateAsync().then(
       ({ url, expiresInSeconds }) => {
+        /** Signed out meanwhile: the sign-in belongs to a session that is over. */
+        if (startedIn !== pullRequestSignInSession()) {
+          popup.close();
+          return;
+        }
         popup.location.href = url;
         keepFocus.current = true;
         watchPullRequestSignIn(queryClient, {
+          startedIn,
           expiresAt: Date.now() + (expiresInSeconds ?? DEFAULT_CONNECT_FLOW_SECONDS) * 1000,
         });
       },
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 70ef702dd24..220eedfe0ee 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -6,6 +6,7 @@ import { render, screen, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
 import { stopPullRequestSignIns } from '~/data-provider/PullRequest/signIn';
+import { endPullRequestSession } from '~/data-provider/PullRequest/queries';
 import ConnectedAccounts from '../ConnectedAccounts';
 
 const mockGetConnection = jest.fn();
@@ -195,6 +196,26 @@ describe('ConnectedAccounts', () => {
     expect(popup.close).not.toHaveBeenCalled();
   });
 
+  it('closes the window instead of signing in when the session ends first', async () => {
+    const popup = fakeWindow();
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    let answer: (value: { url: string }) => void = () => undefined;
+    mockConnect.mockReturnValueOnce(new Promise((resolve) => (answer = resolve)));
+    const { unmount } = renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(mockConnect).toHaveBeenCalledTimes(1));
+    unmount();
+    endPullRequestSession();
+    answer({ url: 'https://github.com/login/oauth/authorize?x=1' });
+
+    await waitFor(() => expect(popup.close).toHaveBeenCalledTimes(1));
+    expect(popup.location.href).toBe('');
+  });
+
   it('closes the window when the connection fails after Settings closed', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index f398073eb3e..5184a2ebc58 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -5,6 +5,7 @@ import {
   PULL_REQUEST_CONNECT_POLL_MS,
   announceOAuthSettled,
   stopPullRequestSignIns,
+  pullRequestSignInSession,
   watchPullRequestSignIn,
 } from './signIn';
 import { endPullRequestSession } from './queries';
@@ -29,9 +30,11 @@ class FakeBroadcastChannel {
   constructor(readonly name: string) {
     FakeBroadcastChannel.open.add(this);
   }
+
   addEventListener(_type: 'message', listener: (event: MessageEvent) => void) {
     this.listeners.add(listener);
   }
+
   postMessage(data: unknown) {
     for (const other of FakeBroadcastChannel.open) {
       if (other !== this && other.name === this.name) {
@@ -39,6 +42,7 @@ class FakeBroadcastChannel {
       }
     }
   }
+
   close() {
     FakeBroadcastChannel.open.delete(this);
   }
@@ -88,7 +92,10 @@ describe('watchPullRequestSignIn', () => {
 
   it('refreshes pull requests and stops once the account shows connected', async () => {
     const { client, invalidate } = setup();
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
 
     await pass(PULL_REQUEST_CONNECT_POLL_MS);
     expect(mockGetConnection).toHaveBeenCalledTimes(1);
@@ -107,7 +114,10 @@ describe('watchPullRequestSignIn', () => {
 
   it('asks at once when the sign-in page announces it settled, however the popup reads', async () => {
     const { client, invalidate } = setup();
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
     mockGetConnection.mockResolvedValue(connection(true));
 
     /** Before any timer is due: only the announcement can explain this ask. */
@@ -119,7 +129,10 @@ describe('watchPullRequestSignIn', () => {
 
   it('backs off asking on a timer, so a sign-in left open costs few requests', async () => {
     const { client } = setup();
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 60 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 60 * MINUTE,
+    });
 
     await pass(15_000);
     /** Responsive while a sign-in is likely: 2, 6 and 14 seconds in. */
@@ -131,7 +144,10 @@ describe('watchPullRequestSignIn', () => {
 
   it('stops watching, focus and announcements included, when the flow expires', async () => {
     const { client } = setup();
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 1 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 1 * MINUTE,
+    });
     await pass(1 * MINUTE);
     const asked = mockGetConnection.mock.calls.length;
 
@@ -145,7 +161,10 @@ describe('watchPullRequestSignIn', () => {
   it('keeps watching through a failed status read', async () => {
     const { client, invalidate } = setup();
     mockGetConnection.mockRejectedValueOnce(new Error('500'));
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
     await pass(PULL_REQUEST_CONNECT_POLL_MS);
 
     mockGetConnection.mockResolvedValue(connection(true));
@@ -156,21 +175,33 @@ describe('watchPullRequestSignIn', () => {
   it('refreshes pull requests when the account it watches turns out disconnected', async () => {
     const { client, invalidate } = setup();
     mockGetConnection.mockResolvedValueOnce(connection(true));
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
     await focus();
     expect(invalidate).toHaveBeenCalledTimes(1);
 
     /** Removed elsewhere while this window still watches a new sign-in. */
     mockGetConnection.mockResolvedValue(connection(false));
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
     await focus();
     expect(invalidate).toHaveBeenCalledTimes(2);
   });
 
   it('replaces the watch on an earlier sign-in when another starts', async () => {
     const { client } = setup();
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
 
     await focus();
     expect(mockGetConnection).toHaveBeenCalledTimes(1);
@@ -178,7 +209,10 @@ describe('watchPullRequestSignIn', () => {
 
   it('ends every watch with the session, so none asks for the next user', async () => {
     const { client } = setup();
-    watchPullRequestSignIn(client, { expiresAt: Date.now() + 10 * MINUTE });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
 
     endPullRequestSession();
     await pass(10 * MINUTE);
@@ -187,4 +221,15 @@ describe('watchPullRequestSignIn', () => {
     await pass(0);
     expect(mockGetConnection).not.toHaveBeenCalled();
   });
+
+  it('does not start a watch for a sign-in begun in a session that has since ended', async () => {
+    const { client } = setup();
+    const startedIn = pullRequestSignInSession();
+    endPullRequestSession();
+    watchPullRequestSignIn(client, { startedIn, expiresAt: Date.now() + 10 * MINUTE });
+
+    await pass(10 * MINUTE);
+    await focus();
+    expect(mockGetConnection).not.toHaveBeenCalled();
+  });
 });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 0343ebb82c3..55deff2d17a 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -14,6 +14,13 @@ type Watch = { stop: () => void };
 
 /** One sign-in per app at a time: starting another replaces the watch on the first. */
 const watches = new Map<QueryClient, Watch>();
+/** Counts ended sessions, so work started in one session can tell it has ended. */
+let session = 0;
+
+/** The current session; a sign-in started now is watched only while this stays current. */
+export function pullRequestSignInSession(): number {
+  return session;
+}
 
 /**
  * Announces, from the page an OAuth sign-in lands on, that it has settled. The page shares this
@@ -47,8 +54,12 @@ export function announceOAuthSettled(): void {
  */
 export function watchPullRequestSignIn(
   queryClient: QueryClient,
-  { expiresAt }: { expiresAt: number },
+  { expiresAt, startedIn }: { expiresAt: number; startedIn: number },
 ): () => void {
+  /** Started before the session ended: nothing to watch for whoever signs in next. */
+  if (startedIn !== session) {
+    return () => undefined;
+  }
   watches.get(queryClient)?.stop();
   let timer: ReturnType<typeof setTimeout> | undefined;
   let wait = PULL_REQUEST_CONNECT_POLL_MS;
@@ -111,6 +122,7 @@ export function watchPullRequestSignIn(
 
 /** Ends every sign-in watch, as the session ending does: none may ask for the next user. */
 export function stopPullRequestSignIns(): void {
+  session += 1;
   for (const watch of [...watches.values()]) {
     watch.stop();
   }

From cc3064f601e27a75eacd34f8fff56b2a3b91e58b Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:26:13 +0200
Subject: [PATCH 11/30] fix: Keep a Surviving Grant Removable and Tie a Sign-In
 Watch to Its Own Flow

---
 .../Nav/Settings/ConnectedAccounts.tsx        |  8 +++++--
 .../__tests__/ConnectedAccounts.spec.tsx      | 12 +++++++++++
 .../Nav/Settings/__tests__/context.spec.tsx   |  6 ++++++
 .../src/components/Nav/Settings/context.tsx   |  4 +++-
 .../PullRequest/connection.test.tsx           | 13 ++++++++++++
 .../data-provider/PullRequest/connection.ts   |  7 +++++--
 .../data-provider/PullRequest/signIn.test.ts  | 21 +++++++++++++++++++
 .../src/data-provider/PullRequest/signIn.ts   | 12 +++++++----
 8 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 8f0098fb06a..da180599fe5 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -80,9 +80,12 @@ export default function ConnectedAccounts() {
   /**
    * The server is the authority: an app it no longer has is nothing to connect to, and once the
    * status loads its provider is the one a connection goes to, whatever the cached startup says.
+   * A grant still stored stays removable after the app is turned off, or turning it back on would
+   * revive it.
    */
+  const revocable = status.data?.connected === true;
   const provider = status.data?.provider ?? startupConfig?.pullRequestsConnect;
-  if (provider == null || status.data?.configured === false) {
+  if (provider == null || (!revocable && status.data?.configured === false)) {
     return null;
   }
 
@@ -110,7 +113,7 @@ export default function ConnectedAccounts() {
      */
     const startedIn = pullRequestSignInSession();
     connectMutation.mutateAsync().then(
-      ({ url, expiresInSeconds }) => {
+      ({ url, expiresInSeconds, flowId }) => {
         /** Signed out meanwhile: the sign-in belongs to a session that is over. */
         if (startedIn !== pullRequestSignInSession()) {
           popup.close();
@@ -120,6 +123,7 @@ export default function ConnectedAccounts() {
         keepFocus.current = true;
         watchPullRequestSignIn(queryClient, {
           startedIn,
+          flowId,
           expiresAt: Date.now() + (expiresInSeconds ?? DEFAULT_CONNECT_FLOW_SECONDS) * 1000,
         });
       },
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 220eedfe0ee..68f0779178e 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -97,6 +97,18 @@ describe('ConnectedAccounts', () => {
     expect(screen.queryByRole('button')).not.toBeInTheDocument();
   });
 
+  it('keeps Disconnect for a grant that outlives a turned-off app', async () => {
+    mockGetConnection.mockResolvedValue({ configured: false, connected: true });
+    renderRow();
+
+    expect(
+      await screen.findByRole('button', {
+        name: 'com_ui_pr_account_disconnect_aria:com_ui_pr_provider_github',
+      }),
+    ).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /com_ui_pr_account_connect_aria/ })).toBeNull();
+  });
+
   it('shows a checking status and no action while the connection loads', () => {
     mockGetConnection.mockReturnValue(new Promise(() => undefined));
     renderRow();
diff --git a/client/src/components/Nav/Settings/__tests__/context.spec.tsx b/client/src/components/Nav/Settings/__tests__/context.spec.tsx
index 16b84ab78bb..0636b7a21c8 100644
--- a/client/src/components/Nav/Settings/__tests__/context.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/context.spec.tsx
@@ -100,6 +100,12 @@ describe('useSettingsContext connected accounts', () => {
     expect(hasConnect()).toBe(false);
   });
 
+  it('keeps the section while a stored grant outlives its app', () => {
+    mockStartup = { pullRequestsConnect: 'github' };
+    mockConnection = { configured: false, connected: true };
+    expect(hasConnect()).toBe(true);
+  });
+
   it('never offers the section when the deployment advertises no app', () => {
     mockConnection = { configured: true, provider: 'github', connected: false };
     expect(hasConnect()).toBe(false);
diff --git a/client/src/components/Nav/Settings/context.tsx b/client/src/components/Nav/Settings/context.tsx
index 894e658ce76..157cc20dd6d 100644
--- a/client/src/components/Nav/Settings/context.tsx
+++ b/client/src/components/Nav/Settings/context.tsx
@@ -41,8 +41,10 @@ export function useSettingsContext(): SettingsContextValue {
   const emailEnabled = startupConfig?.emailEnabled === true;
   const allowEmailChange = startupConfig?.allowEmailChange === true;
   const passkeyLoginEnabled = startupConfig?.passkeyLoginEnabled === true;
+  /** Also while a stored grant outlives its app, so it can still be disconnected. */
   const hasPullRequestConnect =
-    startupConfig?.pullRequestsConnect != null && pullRequestConnection?.configured !== false;
+    pullRequestConnection?.connected === true ||
+    (startupConfig?.pullRequestsConnect != null && pullRequestConnection?.configured !== false);
   const twoFactorPolicyProvider = user != null && isTwoFactorPolicyProvider(user.provider);
   const twoFactorEnabled = user?.twoFactorEnabled === true;
   const allowAccountDeletion = startupConfig?.allowAccountDeletion !== false;
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 9e367bb2bcd..5ba17ecdaba 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -154,6 +154,19 @@ describe('pull request connection hooks', () => {
     await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
   });
 
+  it('refetches cached pull requests when another sign-in replaces the grant', async () => {
+    mockGetConnection.mockResolvedValueOnce({ ...connection(true), flowId: 'flow-a' });
+    const { wrapper, invalidate } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
+
+    mockGetConnection.mockResolvedValueOnce({ ...connection(true), flowId: 'flow-b' });
+    await act(async () => {
+      await result.current.refetch();
+    });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
+  });
+
   it('marks the account disconnected and refetches the status and pull requests', async () => {
     mockDisconnect.mockResolvedValue(undefined);
     const { client, wrapper, invalidate } = setup();
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 07d639a753b..e08c36737f0 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -7,10 +7,13 @@ import { useGetStartupConfig } from '../Endpoints';
 
 /**
  * The credential the server looks this user's pull requests up with, as the status shows it:
- * the user's own account or the server's token, on the provider the deployment now uses.
+ * the user's own account (the grant a given sign-in produced, when the server names it) or the
+ * server's token, on the provider the deployment now uses.
  */
 const credentialOf = (status: TPullRequestConnection): string =>
-  `${status.connected ? 'user' : 'server'}:${status.provider ?? ''}`;
+  status.connected
+    ? `user:${status.provider ?? ''}:${status.flowId ?? ''}`
+    : `server:${status.provider ?? ''}`;
 
 /** Per app, the credential its cached pull requests were last refreshed under. */
 const refreshedUnder = new Map<QueryClient, string>();
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 5184a2ebc58..e4cb91f92ff 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -158,6 +158,27 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it("keeps watching when another flow's grant shows up, and stops on its own", async () => {
+    const { client, invalidate } = setup();
+    mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+      flowId: 'flow-b',
+    });
+    announceOAuthSettled();
+    await pass(0);
+    expect(invalidate).toHaveBeenCalledTimes(1);
+
+    /** Still watching: the second sign-in replacing the first grant is a change. */
+    mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-b' });
+    await focus();
+    expect(invalidate).toHaveBeenCalledTimes(2);
+    const asked = mockGetConnection.mock.calls.length;
+    await pass(5 * MINUTE);
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  });
+
   it('keeps watching through a failed status read', async () => {
     const { client, invalidate } = setup();
     mockGetConnection.mockRejectedValueOnce(new Error('500'));
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 55deff2d17a..c65615956ac 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -46,15 +46,18 @@ export function announceOAuthSettled(): void {
  * - Without it (an older page, no BroadcastChannel) the status is asked on a timer that starts at
  *   2 seconds and doubles to 30, and whenever this window regains focus.
  * - At `expiresAt` the server's signed state is no longer accepted, so watching ends.
- * - Seeing the account connected ends watching. Every answer goes through the same check a
- *   mounted status row uses, so a change of credential refetches cached pull requests once.
+ * - Seeing the grant this sign-in produced ends watching. A server that names grants by the flow
+ *   behind them lets another flow's grant (a second tab, an earlier click) be told apart, and that
+ *   one does not end this watch; an older server's connected status does. Every answer goes
+ *   through the same check a mounted status row uses, so a change of credential, a replaced grant
+ *   included, refetches cached pull requests once.
  *
  * A failed status read is not an answer, so watching continues; the row shows the failure.
  * Returns a function that ends the watch; ending the session ends every watch.
  */
 export function watchPullRequestSignIn(
   queryClient: QueryClient,
-  { expiresAt, startedIn }: { expiresAt: number; startedIn: number },
+  { expiresAt, startedIn, flowId }: { expiresAt: number; startedIn: number; flowId?: string },
 ): () => void {
   /** Started before the session ended: nothing to watch for whoever signs in next. */
   if (startedIn !== session) {
@@ -84,7 +87,8 @@ export function watchPullRequestSignIn(
     }
     /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */
     syncPullRequestConnection(queryClient, status);
-    if (status.connected) {
+    const ours = flowId == null || status.flowId == null || status.flowId === flowId;
+    if (status.connected && ours) {
       stop();
     }
   };

From d07ef6b7b9d3ed9e6d78957b7386181d5a389434 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:30:36 +0200
Subject: [PATCH 12/30] fix: Ask for the Pull Request Account Wherever Pull
 Requests Are On

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 10 ++++++--
 .../__tests__/ConnectedAccounts.spec.tsx      | 23 +++++++++++++++++++
 .../Nav/Settings/__tests__/context.spec.tsx   |  6 +++++
 .../PullRequest/connection.test.tsx           | 13 +++++++++--
 .../data-provider/PullRequest/connection.ts   | 22 ++++++++++++++----
 5 files changed, 65 insertions(+), 9 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index da180599fe5..8976c30ead4 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -38,6 +38,12 @@ const PROVIDERS: Record<
   bitbucket: { Icon: ExternalLink, name: 'com_ui_pr_provider_bitbucket' },
 };
 
+/** A grant whose app the server no longer has, so no provider is named for it. */
+const UNNAMED_PROVIDER: (typeof PROVIDERS)[PullRequestProvider] = {
+  Icon: ExternalLink,
+  name: 'com_ui_settings_label_pull_request_account',
+};
+
 type ConnectError = 'com_ui_pr_account_connect_error' | 'com_ui_pr_account_popup_blocked';
 
 /** How long a started sign-in is watched for when the server does not say how long it lasts. */
@@ -85,11 +91,11 @@ export default function ConnectedAccounts() {
    */
   const revocable = status.data?.connected === true;
   const provider = status.data?.provider ?? startupConfig?.pullRequestsConnect;
-  if (provider == null || (!revocable && status.data?.configured === false)) {
+  if (!revocable && (provider == null || status.data?.configured === false)) {
     return null;
   }
 
-  const { Icon, name: nameKey } = PROVIDERS[provider];
+  const { Icon, name: nameKey } = provider != null ? PROVIDERS[provider] : UNNAMED_PROVIDER;
   const name = localize(nameKey);
   const labelId = `${rowId}-label`;
   const descriptionId = `${rowId}-description`;
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 68f0779178e..a5a9f373c14 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -89,6 +89,29 @@ describe('ConnectedAccounts', () => {
     expect(mockGetConnection).not.toHaveBeenCalled();
   });
 
+  it('offers Disconnect for a grant whose app is gone from a deployment with pull requests on', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    mockGetConnection.mockResolvedValue({ configured: false, connected: true });
+    renderRow();
+
+    expect(
+      await screen.findByRole('button', {
+        name: 'com_ui_pr_account_disconnect_aria:com_ui_settings_label_pull_request_account',
+      }),
+    ).toBeInTheDocument();
+  });
+
+  it('renders nothing for a deployment with pull requests on and nothing to disconnect', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    mockGetConnection.mockResolvedValue({ configured: false, connected: false });
+    const { client } = renderRow();
+    await waitFor(() => expect(mockGetConnection).toHaveBeenCalled());
+    await waitFor(() =>
+      expect(client.getQueryData([QueryKeys.pullRequestConnection])).toBeDefined(),
+    );
+    expect(screen.queryByRole('button')).not.toBeInTheDocument();
+  });
+
   it('renders nothing once the server says no app is configured', async () => {
     mockGetConnection.mockResolvedValue({ configured: false, connected: false });
     renderRow();
diff --git a/client/src/components/Nav/Settings/__tests__/context.spec.tsx b/client/src/components/Nav/Settings/__tests__/context.spec.tsx
index 0636b7a21c8..08cf15a0236 100644
--- a/client/src/components/Nav/Settings/__tests__/context.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/context.spec.tsx
@@ -106,6 +106,12 @@ describe('useSettingsContext connected accounts', () => {
     expect(hasConnect()).toBe(true);
   });
 
+  it('offers the section for a surviving grant when no app is advertised any more', () => {
+    mockStartup = { pullRequestsEnabled: true };
+    mockConnection = { configured: false, connected: true };
+    expect(hasConnect()).toBe(true);
+  });
+
   it('never offers the section when the deployment advertises no app', () => {
     mockConnection = { configured: true, provider: 'github', connected: false };
     expect(hasConnect()).toBe(false);
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 5ba17ecdaba..95784d18c77 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -53,14 +53,23 @@ describe('pull request connection hooks', () => {
     mockDisconnect.mockReset();
   });
 
-  it('never asks a deployment that offers no account to connect', () => {
-    mockStartup.current = { pullRequestsEnabled: true };
+  it('never asks a deployment with pull requests off', () => {
+    mockStartup.current = {};
     const { wrapper } = setup();
     const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
     expect(result.current.fetchStatus).toBe('idle');
     expect(mockGetConnection).not.toHaveBeenCalled();
   });
 
+  it('asks a deployment with pull requests on that no longer offers an app', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    mockGetConnection.mockResolvedValueOnce({ configured: false, connected: true });
+    const { wrapper } = setup();
+    const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
+    await waitFor(() => expect(result.current.data?.connected).toBe(true));
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+  });
+
   it('refetches cached pull requests once a connection made elsewhere shows up', async () => {
     mockGetConnection.mockResolvedValueOnce(connection(false));
     const { wrapper, invalidate } = setup();
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index e08c36737f0..81a74f340f2 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -1,7 +1,11 @@
 import { useEffect } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { MutationKeys, QueryKeys, dataService } from 'librechat-data-provider';
-import type { TPullRequestConnectStart, TPullRequestConnection } from 'librechat-data-provider';
+import type {
+  TStartupConfig,
+  TPullRequestConnectStart,
+  TPullRequestConnection,
+} from 'librechat-data-provider';
 import type { QueryClient } from '@tanstack/react-query';
 import { useGetStartupConfig } from '../Endpoints';
 
@@ -45,8 +49,16 @@ export function syncPullRequestConnection(
 }
 
 /**
- * Whether the signed-in user has connected their own account. Asked only when the deployment
- * offers connecting one, and again when the window regains focus; a sign-in in progress is
+ * Whether asking for the connection can find anything: on any deployment with pull requests on,
+ * not only one advertising an app to connect, because a grant made before the app was turned off
+ * must still be found to be disconnected.
+ */
+const isConnectionKnowable = (startupConfig?: Partial<TStartupConfig>): boolean =>
+  startupConfig?.pullRequestsEnabled === true || startupConfig?.pullRequestsConnect != null;
+
+/**
+ * Whether the signed-in user has connected their own account. Asked on a deployment with pull
+ * requests on, and again when the window regains focus; a sign-in in progress is
  * watched by `watchPullRequestSignIn`, which outlives this hook. A change in either direction
  * swaps the token the server looks pull requests up with, so every cached pull request is
  * refetched.
@@ -58,7 +70,7 @@ export const usePullRequestConnectionQuery = () => {
     [QueryKeys.pullRequestConnection],
     () => dataService.getPullRequestConnection(),
     {
-      enabled: startupConfig?.pullRequestsConnect != null,
+      enabled: isConnectionKnowable(startupConfig),
       retry: false,
       refetchOnWindowFocus: true,
     },
@@ -85,7 +97,7 @@ export const usePullRequestConnectionStatus = () => {
     [QueryKeys.pullRequestConnection],
     () => dataService.getPullRequestConnection(),
     {
-      enabled: startupConfig?.pullRequestsConnect != null,
+      enabled: isConnectionKnowable(startupConfig),
       retry: false,
       refetchOnWindowFocus: true,
     },

From a4e8fca5b18758cfc4a728539edb6d7ea495b08c Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:54:56 +0200
Subject: [PATCH 13/30] fix: Refresh Pull Requests on a Session's First Status
 and End a Failed Sign-In's Watch

---
 .../__tests__/ConnectedAccounts.spec.tsx      |  7 ++-
 client/src/components/OAuth/OAuthError.tsx    | 21 +++++---
 client/src/components/OAuth/OAuthSuccess.tsx  |  5 +-
 .../OAuth/__tests__/OAuthError.spec.tsx       | 36 +++++++++++++
 .../OAuth/__tests__/OAuthSuccess.spec.tsx     |  7 +--
 .../PullRequest/connection.test.tsx           | 30 ++++++-----
 .../data-provider/PullRequest/connection.ts   |  9 ++--
 .../data-provider/PullRequest/signIn.test.ts  | 54 ++++++++++++++++---
 .../src/data-provider/PullRequest/signIn.ts   | 34 +++++++++---
 9 files changed, 158 insertions(+), 45 deletions(-)
 create mode 100644 client/src/components/OAuth/__tests__/OAuthError.spec.tsx

diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index a5a9f373c14..dfa7b373598 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -281,13 +281,16 @@ describe('ConnectedAccounts', () => {
     );
     await waitFor(() => expect(popup.location.href).not.toBe(''));
     unmount();
+    const before = invalidate.mock.calls.length;
     mockGetConnection.mockResolvedValue(connection(true));
 
     await waitFor(
-      () => expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+      () =>
+        expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true)),
       { timeout: 5000 },
     );
-    expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
+    expect(invalidate.mock.calls.length).toBeGreaterThan(before);
+    expect(invalidate).toHaveBeenLastCalledWith([QueryKeys.conversationPullRequest]);
   }, 10000);
 
   it('closes the opened window and explains when the connection cannot start', async () => {
diff --git a/client/src/components/OAuth/OAuthError.tsx b/client/src/components/OAuth/OAuthError.tsx
index 64820dcc21c..6d00e4f8058 100644
--- a/client/src/components/OAuth/OAuthError.tsx
+++ b/client/src/components/OAuth/OAuthError.tsx
@@ -1,12 +1,19 @@
-import React from 'react';
+import React, { useEffect } from 'react';
 import { Button } from '@librechat/client';
 import { useSearchParams } from 'react-router-dom';
+import { announceOAuthSettled } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 
 export default function OAuthError() {
   const localize = useLocalize();
   const [searchParams] = useSearchParams();
   const error = searchParams.get('error') || 'unknown_error';
+  const flowId = searchParams.get('flow') ?? undefined;
+
+  useEffect(() => {
+    /** Ends the watch on this sign-in in the window that started it, which no longer polls. */
+    announceOAuthSettled({ outcome: 'failed', flowId });
+  }, [flowId]);
 
   const getErrorMessage = (error: string): string => {
     switch (error) {
@@ -36,12 +43,12 @@ export default function OAuthError() {
   };
 
   return (
-    <div className="flex min-h-screen items-center justify-center bg-surface-secondary p-8">
-      <div className="w-full max-w-md rounded-lg bg-surface-primary p-8 text-center shadow-lg">
+    <div className="bg-surface-secondary flex min-h-screen items-center justify-center p-8">
+      <div className="bg-surface-primary w-full max-w-md rounded-lg p-8 text-center shadow-lg">
         <div className="mb-4 flex justify-center">
-          <div className="flex h-12 w-12 items-center justify-center rounded-full bg-status-error-subtle">
+          <div className="bg-status-error-subtle flex h-12 w-12 items-center justify-center rounded-full">
             <svg
-              className="h-6 w-6 text-status-error"
+              className="text-status-error h-6 w-6"
               fill="none"
               viewBox="0 0 24 24"
               stroke="currentColor"
@@ -56,10 +63,10 @@ export default function OAuthError() {
             </svg>
           </div>
         </div>
-        <h1 className="mb-4 text-3xl font-bold text-text-primary">
+        <h1 className="text-text-primary mb-4 text-3xl font-bold">
           {localize('com_ui_oauth_error_title') || 'Authentication Failed'}
         </h1>
-        <p className="mb-6 text-sm text-text-secondary">{getErrorMessage(error)}</p>
+        <p className="text-text-secondary mb-6 text-sm">{getErrorMessage(error)}</p>
         <Button
           variant="default"
           onClick={() => window.close()}
diff --git a/client/src/components/OAuth/OAuthSuccess.tsx b/client/src/components/OAuth/OAuthSuccess.tsx
index 67c0aa1e72d..c1d19fd7cac 100644
--- a/client/src/components/OAuth/OAuthSuccess.tsx
+++ b/client/src/components/OAuth/OAuthSuccess.tsx
@@ -8,11 +8,12 @@ export default function OAuthSuccess() {
   const [searchParams] = useSearchParams();
   const [secondsLeft, setSecondsLeft] = useState(3);
   const serverName = searchParams.get('serverName');
+  const flowId = searchParams.get('flow') ?? undefined;
 
   useEffect(() => {
     /** Reaches the window that started the sign-in even when the provider severed the popup. */
-    announceOAuthSettled();
-  }, []);
+    announceOAuthSettled({ outcome: 'succeeded', flowId });
+  }, [flowId]);
 
   useEffect(() => {
     const countdown = setInterval(() => {
diff --git a/client/src/components/OAuth/__tests__/OAuthError.spec.tsx b/client/src/components/OAuth/__tests__/OAuthError.spec.tsx
new file mode 100644
index 00000000000..74620c1981a
--- /dev/null
+++ b/client/src/components/OAuth/__tests__/OAuthError.spec.tsx
@@ -0,0 +1,36 @@
+import React from 'react';
+import { render } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import OAuthError from '../OAuthError';
+
+const mockAnnounce = jest.fn();
+
+jest.mock('~/data-provider', () => ({
+  announceOAuthSettled: (settlement: unknown) => mockAnnounce(settlement),
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+const renderAt = (path: string) =>
+  render(
+    <MemoryRouter initialEntries={[path]}>
+      <OAuthError />
+    </MemoryRouter>,
+  );
+
+describe('OAuthError', () => {
+  beforeEach(() => mockAnnounce.mockReset());
+
+  it('announces the failed sign-in with the flow it names', () => {
+    renderAt('/oauth/error?error=callback_failed&flow=flow-a');
+    expect(mockAnnounce).toHaveBeenCalledTimes(1);
+    expect(mockAnnounce).toHaveBeenCalledWith({ outcome: 'failed', flowId: 'flow-a' });
+  });
+
+  it('announces a failure without a flow when the redirect names none', () => {
+    renderAt('/oauth/error?error=invalid_state');
+    expect(mockAnnounce).toHaveBeenCalledWith({ outcome: 'failed', flowId: undefined });
+  });
+});
diff --git a/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx b/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx
index df716412394..0e99b904121 100644
--- a/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx
+++ b/client/src/components/OAuth/__tests__/OAuthSuccess.spec.tsx
@@ -6,7 +6,7 @@ import OAuthSuccess from '../OAuthSuccess';
 const mockAnnounce = jest.fn();
 
 jest.mock('~/data-provider', () => ({
-  announceOAuthSettled: () => mockAnnounce(),
+  announceOAuthSettled: (settlement: unknown) => mockAnnounce(settlement),
 }));
 
 jest.mock('~/hooks', () => ({
@@ -16,15 +16,16 @@ jest.mock('~/hooks', () => ({
 describe('OAuthSuccess', () => {
   it('announces the settled sign-in once, for a window the provider severed from this one', () => {
     const { rerender } = render(
-      <MemoryRouter initialEntries={['/oauth/success?serverName=GitHub']}>
+      <MemoryRouter initialEntries={['/oauth/success?serverName=GitHub&flow=flow-a']}>
         <OAuthSuccess />
       </MemoryRouter>,
     );
     rerender(
-      <MemoryRouter initialEntries={['/oauth/success?serverName=GitHub']}>
+      <MemoryRouter initialEntries={['/oauth/success?serverName=GitHub&flow=flow-a']}>
         <OAuthSuccess />
       </MemoryRouter>,
     );
     expect(mockAnnounce).toHaveBeenCalledTimes(1);
+    expect(mockAnnounce).toHaveBeenCalledWith({ outcome: 'succeeded', flowId: 'flow-a' });
   });
 });
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 95784d18c77..606067cb7e1 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -74,17 +74,15 @@ describe('pull request connection hooks', () => {
     mockGetConnection.mockResolvedValueOnce(connection(false));
     const { wrapper, invalidate } = setup();
     const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
-    await waitFor(() => expect(result.current.data?.connected).toBe(false));
-    expect(invalidate).not.toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
 
     mockGetConnection.mockResolvedValueOnce(connection(true));
     await act(async () => {
       await result.current.refetch();
     });
 
-    await waitFor(() =>
-      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
-    );
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
+    expect(invalidate).toHaveBeenLastCalledWith([QueryKeys.conversationPullRequest]);
   });
 
   it('refetches cached pull requests when the first status shows the user connected', async () => {
@@ -97,12 +95,19 @@ describe('pull request connection hooks', () => {
     expect(invalidate).toHaveBeenCalledTimes(1);
   });
 
-  it('leaves cached pull requests alone when the first status shows the server token', async () => {
-    mockGetConnection.mockResolvedValueOnce(connection(false));
+  it('refetches cached pull requests once on a first status showing the server token', async () => {
+    mockGetConnection.mockResolvedValue(connection(false));
     const { wrapper, invalidate } = setup();
     const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
-    await waitFor(() => expect(result.current.data?.connected).toBe(false));
-    expect(invalidate).not.toHaveBeenCalled();
+    await waitFor(() =>
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+    );
+    expect(invalidate).toHaveBeenCalledTimes(1);
+
+    await act(async () => {
+      await result.current.refetch();
+    });
+    expect(invalidate).toHaveBeenCalledTimes(1);
   });
 
   it('refreshes pull requests once per change, not on every Settings visit', async () => {
@@ -136,16 +141,13 @@ describe('pull request connection hooks', () => {
     mockGetConnection.mockResolvedValueOnce(connection(false));
     const { wrapper, invalidate } = setup();
     const { result } = renderHook(() => usePullRequestConnectionQuery(), { wrapper });
-    await waitFor(() => expect(result.current.data?.connected).toBe(false));
-    expect(invalidate).not.toHaveBeenCalled();
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
 
     mockGetConnection.mockResolvedValueOnce({ ...connection(false), provider: 'gitlab' });
     await act(async () => {
       await result.current.refetch();
     });
-    await waitFor(() =>
-      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
-    );
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
   });
 
   it('starts over with the next session, so its first status follows the first-status rule', async () => {
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 81a74f340f2..472a48d394f 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -30,10 +30,9 @@ export function resetPullRequestCredentials(): void {
 /**
  * Refetches every cached pull request when a status shows a different credential than the one
  * they were last refreshed under: connecting, disconnecting, or a connection moving to another
- * provider. The first status an app sees refreshes them only when it shows the user's own
- * account, since anything fetched before it may have used the server's token; one showing the
- * server's token, the common case, costs nothing. Every path that learns the status goes
- * through here, so a change refetches pull requests once.
+ * provider. The first status of a session always refreshes them once, whatever it says, since
+ * pull requests fetched before it may have used a grant this app never saw. Every path that
+ * learns the status goes through here, so a change refetches pull requests once.
  */
 export function syncPullRequestConnection(
   queryClient: QueryClient,
@@ -42,7 +41,7 @@ export function syncPullRequestConnection(
   const credential = credentialOf(status);
   const previous = refreshedUnder.get(queryClient);
   refreshedUnder.set(queryClient, credential);
-  if (previous === credential || (previous == null && !status.connected)) {
+  if (previous === credential) {
     return;
   }
   queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index e4cb91f92ff..491c7a9499a 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -99,11 +99,13 @@ describe('watchPullRequestSignIn', () => {
 
     await pass(PULL_REQUEST_CONNECT_POLL_MS);
     expect(mockGetConnection).toHaveBeenCalledTimes(1);
-    expect(invalidate).not.toHaveBeenCalled();
+    /** The session's first status. */
+    expect(invalidate).toHaveBeenCalledTimes(1);
 
     mockGetConnection.mockResolvedValue(connection(true));
     await focus();
-    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    expect(invalidate).toHaveBeenCalledTimes(2);
+    expect(invalidate).toHaveBeenLastCalledWith([QueryKeys.conversationPullRequest]);
     expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
 
     const asked = mockGetConnection.mock.calls.length;
@@ -121,7 +123,7 @@ describe('watchPullRequestSignIn', () => {
     mockGetConnection.mockResolvedValue(connection(true));
 
     /** Before any timer is due: only the announcement can explain this ask. */
-    announceOAuthSettled();
+    announceOAuthSettled({ outcome: 'succeeded' });
     await pass(0);
     expect(mockGetConnection).toHaveBeenCalledTimes(1);
     expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
@@ -153,7 +155,7 @@ describe('watchPullRequestSignIn', () => {
 
     await pass(5 * MINUTE);
     await focus();
-    announceOAuthSettled();
+    announceOAuthSettled({ outcome: 'succeeded' });
     await pass(0);
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
@@ -166,7 +168,7 @@ describe('watchPullRequestSignIn', () => {
       expiresAt: Date.now() + 10 * MINUTE,
       flowId: 'flow-b',
     });
-    announceOAuthSettled();
+    announceOAuthSettled({ outcome: 'succeeded' });
     await pass(0);
     expect(invalidate).toHaveBeenCalledTimes(1);
 
@@ -238,7 +240,7 @@ describe('watchPullRequestSignIn', () => {
     endPullRequestSession();
     await pass(10 * MINUTE);
     await focus();
-    announceOAuthSettled();
+    announceOAuthSettled({ outcome: 'succeeded' });
     await pass(0);
     expect(mockGetConnection).not.toHaveBeenCalled();
   });
@@ -253,4 +255,44 @@ describe('watchPullRequestSignIn', () => {
     await focus();
     expect(mockGetConnection).not.toHaveBeenCalled();
   });
+
+  describe('a failed sign-in', () => {
+    const watchFlow = (client: QueryClient, flowId?: string) =>
+      watchPullRequestSignIn(client, {
+        startedIn: pullRequestSignInSession(),
+        expiresAt: Date.now() + 60 * MINUTE,
+        flowId,
+      });
+
+    const askedAfter = async (ms: number) => {
+      const before = mockGetConnection.mock.calls.length;
+      await pass(ms);
+      return mockGetConnection.mock.calls.length - before;
+    };
+
+    it('ends the watch on the flow it names', async () => {
+      watchFlow(setup().client, 'flow-a');
+      announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
+      expect(await askedAfter(10 * MINUTE)).toBe(0);
+    });
+
+    it('leaves the watch on another flow running', async () => {
+      watchFlow(setup().client, 'flow-b');
+      announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
+      expect(await askedAfter(10 * MINUTE)).toBeGreaterThan(0);
+    });
+
+    it('ends the only watch when the failure names no flow', async () => {
+      watchFlow(setup().client, 'flow-a');
+      announceOAuthSettled({ outcome: 'failed' });
+      expect(await askedAfter(10 * MINUTE)).toBe(0);
+    });
+
+    it('ends none of several watches when the failure names no flow', async () => {
+      watchFlow(setup().client, 'flow-a');
+      watchFlow(setup().client, 'flow-b');
+      announceOAuthSettled({ outcome: 'failed' });
+      expect(await askedAfter(10 * MINUTE)).toBeGreaterThan(0);
+    });
+  });
 });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index c65615956ac..7d89b0d10ab 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -12,6 +12,15 @@ export const OAUTH_SETTLED_CHANNEL = 'librechat:oauth-settled';
 
 type Watch = { stop: () => void };
 
+/** What a landing page says about the sign-in it ends, and which one when it knows. */
+export type OAuthSettlement = { outcome: 'succeeded' | 'failed'; flowId?: string };
+
+const isSettlement = (value: unknown): value is OAuthSettlement =>
+  typeof value === 'object' &&
+  value !== null &&
+  ((value as OAuthSettlement).outcome === 'succeeded' ||
+    (value as OAuthSettlement).outcome === 'failed');
+
 /** One sign-in per app at a time: starting another replaces the watch on the first. */
 const watches = new Map<QueryClient, Watch>();
 /** Counts ended sessions, so work started in one session can tell it has ended. */
@@ -23,17 +32,17 @@ export function pullRequestSignInSession(): number {
 }
 
 /**
- * Announces, from the page an OAuth sign-in lands on, that it has settled. The page shares this
- * app's origin, so the announcement reaches the window that started the sign-in even when the
+ * Announces, from the page an OAuth sign-in lands on, how it settled. The page shares this app's
+ * origin, so the announcement reaches the window that started the sign-in even when the
  * provider's pages severed the popup from it (a cross-origin opener policy makes the retained
  * window handle read as closed while the sign-in is still open).
  */
-export function announceOAuthSettled(): void {
+export function announceOAuthSettled(settlement: OAuthSettlement): void {
   if (typeof BroadcastChannel === 'undefined') {
     return;
   }
   const channel = new BroadcastChannel(OAUTH_SETTLED_CHANNEL);
-  channel.postMessage('settled');
+  channel.postMessage(settlement);
   channel.close();
 }
 
@@ -42,7 +51,9 @@ export function announceOAuthSettled(): void {
  * component, so closing Settings mid-flow still refreshes what was fetched with the old token.
  *
  * - The landing page's announcement asks the status at once; it is the signal that survives the
- *   provider severing the popup, so the popup handle is not consulted at all.
+ *   provider severing the popup, so the popup handle is not consulted at all. A failure ends the
+ *   watch when it names this sign-in's flow, or, naming none, when this is the only sign-in being
+ *   watched, since a page that cannot say which flow failed cannot be matched more closely.
  * - Without it (an older page, no BroadcastChannel) the status is asked on a timer that starts at
  *   2 seconds and doubles to 30, and whenever this window regains focus.
  * - At `expiresAt` the server's signed state is no longer accepted, so watching ends.
@@ -101,9 +112,20 @@ export function watchPullRequestSignIn(
     }, wait);
   };
   const onSignal = () => void check();
+  const onSettled = (event: MessageEvent) => {
+    const settlement: unknown = event.data;
+    if (!isSettlement(settlement) || settlement.outcome === 'succeeded') {
+      void check();
+      return;
+    }
+    const mine = settlement.flowId != null ? settlement.flowId === flowId : watches.size === 1;
+    if (mine) {
+      stop();
+    }
+  };
   const channel =
     typeof BroadcastChannel === 'undefined' ? null : new BroadcastChannel(OAUTH_SETTLED_CHANNEL);
-  channel?.addEventListener('message', onSignal);
+  channel?.addEventListener('message', onSettled);
   const expiry = setTimeout(() => stop(), Math.max(0, expiresAt - Date.now()));
 
   function stop() {

From 44e31adb4b8a8c942c2bce4c4b04be87dd74b5ac Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:00:10 +0200
Subject: [PATCH 14/30] fix: Ignore an OAuth Failure That Names No Sign-In Flow

---
 client/src/data-provider/PullRequest/signIn.test.ts | 9 ++++-----
 client/src/data-provider/PullRequest/signIn.ts      | 8 ++++----
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 491c7a9499a..132c2fc5711 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -282,15 +282,14 @@ describe('watchPullRequestSignIn', () => {
       expect(await askedAfter(10 * MINUTE)).toBeGreaterThan(0);
     });
 
-    it('ends the only watch when the failure names no flow', async () => {
+    it('ignores a failure that names no flow, such as another OAuth sign-in', async () => {
       watchFlow(setup().client, 'flow-a');
       announceOAuthSettled({ outcome: 'failed' });
-      expect(await askedAfter(10 * MINUTE)).toBe(0);
+      expect(await askedAfter(10 * MINUTE)).toBeGreaterThan(0);
     });
 
-    it('ends none of several watches when the failure names no flow', async () => {
-      watchFlow(setup().client, 'flow-a');
-      watchFlow(setup().client, 'flow-b');
+    it('ignores a failure when its own server names no flow either', async () => {
+      watchFlow(setup().client);
       announceOAuthSettled({ outcome: 'failed' });
       expect(await askedAfter(10 * MINUTE)).toBeGreaterThan(0);
     });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 7d89b0d10ab..1a1146b569c 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -52,8 +52,8 @@ export function announceOAuthSettled(settlement: OAuthSettlement): void {
  *
  * - The landing page's announcement asks the status at once; it is the signal that survives the
  *   provider severing the popup, so the popup handle is not consulted at all. A failure ends the
- *   watch when it names this sign-in's flow, or, naming none, when this is the only sign-in being
- *   watched, since a page that cannot say which flow failed cannot be matched more closely.
+ *   watch only when it names this sign-in's flow: the server names it on every failure after the
+ *   flow is bound, so one naming none belongs to another sign-in or never reached this one.
  * - Without it (an older page, no BroadcastChannel) the status is asked on a timer that starts at
  *   2 seconds and doubles to 30, and whenever this window regains focus.
  * - At `expiresAt` the server's signed state is no longer accepted, so watching ends.
@@ -118,8 +118,8 @@ export function watchPullRequestSignIn(
       void check();
       return;
     }
-    const mine = settlement.flowId != null ? settlement.flowId === flowId : watches.size === 1;
-    if (mine) {
+    /** A failure naming no flow is another sign-in's (an MCP server's, say): ours always name it. */
+    if (settlement.flowId != null && settlement.flowId === flowId) {
       stop();
     }
   };

From 6c05b1639ec5c3598cb3dfdc267f6d462dd6f52d Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:22:34 +0200
Subject: [PATCH 15/30] fix: Start No Sign-In for a Window Closed Before the
 Server Answered

---
 .../Nav/Settings/ConnectedAccounts.tsx        |  7 ++++++
 .../__tests__/ConnectedAccounts.spec.tsx      | 22 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 8976c30ead4..dd5e2e285f1 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -125,6 +125,13 @@ export default function ConnectedAccounts() {
           popup.close();
           return;
         }
+        /**
+         * Closed while the server answered: the user cancelled, and nothing will sign in. Still the
+         * blank page this window opened, so unlike after navigating, `closed` can be trusted here.
+         */
+        if (popup.closed) {
+          return;
+        }
         popup.location.href = url;
         keepFocus.current = true;
         watchPullRequestSignIn(queryClient, {
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index dfa7b373598..c41664a3e78 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -231,6 +231,28 @@ describe('ConnectedAccounts', () => {
     expect(popup.close).not.toHaveBeenCalled();
   });
 
+  it('starts nothing when the window is closed before the server answers', async () => {
+    const popup = { ...fakeWindow(), closed: false };
+    openSpy.mockReturnValue(popup as unknown as Window);
+    mockGetConnection.mockResolvedValue(connection(false));
+    let answer: (value: { url: string }) => void = () => undefined;
+    mockConnect.mockReturnValueOnce(new Promise((resolve) => (answer = resolve)));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ }),
+    );
+    await waitFor(() => expect(mockConnect).toHaveBeenCalledTimes(1));
+    popup.closed = true;
+    const asked = mockGetConnection.mock.calls.length;
+    answer({ url: 'https://github.com/login/oauth/authorize?x=1' });
+
+    /** Past the first poll: a watch started anyway would have asked by now. */
+    await new Promise((resolve) => setTimeout(resolve, 2500));
+    expect(popup.location.href).toBe('');
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  }, 10000);
+
   it('closes the window instead of signing in when the session ends first', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);

From 3a67b572e3a3366b4968df816d45df6ce366f33e Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:25:43 +0200
Subject: [PATCH 16/30] fix: Keep a Known Grant Removable While the Status
 Check Fails

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 19 +++++++++++++------
 .../__tests__/ConnectedAccounts.spec.tsx      | 17 +++++++++++++++++
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index dd5e2e285f1..7d3eb3b16a3 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -170,12 +170,15 @@ export default function ConnectedAccounts() {
   let statusContent = <Chip tone="neutral">{localize('com_ui_pr_account_checking')}</Chip>;
   let action = <Skeleton className="h-9 w-24" aria-hidden="true" />;
 
-  if (status.isError) {
-    statusContent = (
-      <span className="text-text-destructive text-xs">
-        {localize('com_ui_pr_account_status_error')}
-      </span>
-    );
+  const statusError = (
+    <span className="text-text-destructive text-xs">
+      {localize('com_ui_pr_account_status_error')}
+    </span>
+  );
+
+  /** A grant known to be removable stays removable while a later status check fails. */
+  if (status.isError && !revocable) {
+    statusContent = statusError;
     action = (
       <Button
         ref={bindAction}
@@ -226,6 +229,10 @@ export default function ConnectedAccounts() {
     );
   }
 
+  if (status.isError && revocable) {
+    statusContent = statusError;
+  }
+
   return (
     <AlertDialog
       open={confirmOpen}
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index c41664a3e78..42168bc496f 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -459,6 +459,23 @@ describe('ConnectedAccounts', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(2);
   });
 
+  it('keeps Disconnect for a known grant when a later status check fails', async () => {
+    mockGetConnection.mockResolvedValueOnce(connection(true));
+    const { client } = renderRow();
+    await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ });
+
+    mockGetConnection.mockRejectedValueOnce(new Error('500'));
+    await client.refetchQueries([QueryKeys.pullRequestConnection]);
+
+    await waitFor(() =>
+      expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_status_error'),
+    );
+    expect(
+      screen.getByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    ).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: 'com_ui_retry' })).toBeNull();
+  });
+
   it('keeps the retry button named while a failed refresh is retried', async () => {
     mockGetConnection.mockResolvedValueOnce(connection(false));
     const { client } = renderRow();

From 91af4d1e446292dd20ee5a8f8a9c70ebdc20c038 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:28:56 +0200
Subject: [PATCH 17/30] fix: Name a Grant Without a Current App Only as an
 Account

---
 client/src/components/Nav/Settings/ConnectedAccounts.tsx      | 4 +++-
 .../Nav/Settings/__tests__/ConnectedAccounts.spec.tsx         | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 7d3eb3b16a3..dd03712306b 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -90,7 +90,9 @@ export default function ConnectedAccounts() {
    * revive it.
    */
   const revocable = status.data?.connected === true;
-  const provider = status.data?.provider ?? startupConfig?.pullRequestsConnect;
+  /** The startup config only until the status loads: after that a grant whose app is gone may
+   *  belong to any provider, so the row names it only as an account. */
+  const provider = status.data != null ? status.data.provider : startupConfig?.pullRequestsConnect;
   if (!revocable && (provider == null || status.data?.configured === false)) {
     return null;
   }
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 42168bc496f..51b2cdfdad6 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -126,7 +126,7 @@ describe('ConnectedAccounts', () => {
 
     expect(
       await screen.findByRole('button', {
-        name: 'com_ui_pr_account_disconnect_aria:com_ui_pr_provider_github',
+        name: 'com_ui_pr_account_disconnect_aria:com_ui_settings_label_pull_request_account',
       }),
     ).toBeInTheDocument();
     expect(screen.queryByRole('button', { name: /com_ui_pr_account_connect_aria/ })).toBeNull();

From 26441a416ecad93c8b1b3eadfee7c60e7680ad50 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 07:01:47 +0200
Subject: [PATCH 18/30] fix: Keep the Pull Request Account Row Readable on a
 Phone

---
 .../components/Nav/Settings/ConnectedAccounts.tsx  | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index dd03712306b..0cc5f5f97e0 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -258,16 +258,18 @@ export default function ConnectedAccounts() {
             <Icon className="h-5 w-5" />
           </span>
           <div className="min-w-0 flex-1">
-            <p id={labelId} className="text-text-primary text-sm font-medium">
-              {name}
-            </p>
+            {/** The status sits beside the name, not in the row, so the description keeps the
+             *  column's width on a phone. */}
+            <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+              <p id={labelId} className="text-text-primary text-sm font-medium">
+                {name}
+              </p>
+              <div role="status">{statusContent}</div>
+            </div>
             <p id={descriptionId} className="text-text-secondary text-xs">
               {localize('com_ui_pr_account_description')}
             </p>
           </div>
-          <div role="status" className="shrink-0">
-            {statusContent}
-          </div>
           <div className="shrink-0">{action}</div>
         </div>
         {connectError != null && (

From 1d59756b8619701181db302545416452c77f8594 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 07:08:39 +0200
Subject: [PATCH 19/30] fix: Show a Grant Whose App Is Off as Not in Use

---
 .../components/Nav/Settings/ConnectedAccounts.tsx   | 12 ++++++++++--
 .../Settings/__tests__/ConnectedAccounts.spec.tsx   | 13 +++++++++++++
 client/src/locales/en/translation.json              |  2 ++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 0cc5f5f97e0..e03039e64c3 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -90,6 +90,8 @@ export default function ConnectedAccounts() {
    * revive it.
    */
   const revocable = status.data?.connected === true;
+  /** A grant whose app is turned off: kept until removed, but no lookup uses it. */
+  const unused = revocable && status.data?.configured === false;
   /** The startup config only until the status loads: after that a grant whose app is gone may
    *  belong to any provider, so the row names it only as an account. */
   const provider = status.data != null ? status.data.provider : startupConfig?.pullRequestsConnect;
@@ -195,7 +197,11 @@ export default function ConnectedAccounts() {
       </Button>
     );
   } else if (status.data?.connected === true) {
-    statusContent = <Chip tone="success">{localize('com_ui_pr_account_connected')}</Chip>;
+    statusContent = unused ? (
+      <Chip tone="neutral">{localize('com_ui_pr_account_not_in_use')}</Chip>
+    ) : (
+      <Chip tone="success">{localize('com_ui_pr_account_connected')}</Chip>
+    );
     action = (
       <AlertDialogTrigger asChild>
         <Button
@@ -267,7 +273,9 @@ export default function ConnectedAccounts() {
               <div role="status">{statusContent}</div>
             </div>
             <p id={descriptionId} className="text-text-secondary text-xs">
-              {localize('com_ui_pr_account_description')}
+              {localize(
+                unused ? 'com_ui_pr_account_unused_description' : 'com_ui_pr_account_description',
+              )}
             </p>
           </div>
           <div className="shrink-0">{action}</div>
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 51b2cdfdad6..b598c9598c7 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -130,6 +130,19 @@ describe('ConnectedAccounts', () => {
       }),
     ).toBeInTheDocument();
     expect(screen.queryByRole('button', { name: /com_ui_pr_account_connect_aria/ })).toBeNull();
+    /** No lookup uses a grant whose app is off, so it is not shown as in use. */
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_not_in_use');
+    expect(screen.queryByText('com_ui_pr_account_connected')).toBeNull();
+    expect(screen.getByText('com_ui_pr_account_unused_description')).toBeInTheDocument();
+    expect(screen.queryByText('com_ui_pr_account_description')).toBeNull();
+  });
+
+  it('shows the success status and lookup copy for a grant the current app uses', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    renderRow();
+    await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ });
+    expect(screen.getByRole('status')).toHaveTextContent('com_ui_pr_account_connected');
+    expect(screen.getByText('com_ui_pr_account_description')).toBeInTheDocument();
   });
 
   it('shows a checking status and no action while the connection loads', () => {
diff --git a/client/src/locales/en/translation.json b/client/src/locales/en/translation.json
index fe80c258b5f..8beb89ebffd 100644
--- a/client/src/locales/en/translation.json
+++ b/client/src/locales/en/translation.json
@@ -11,8 +11,10 @@
   "com_ui_pr_account_disconnect_error": "Couldn't disconnect. Try again.",
   "com_ui_pr_account_disconnect_title": "Disconnect {{0}}?",
   "com_ui_pr_account_not_connected": "Not connected",
+  "com_ui_pr_account_not_in_use": "Not in use",
   "com_ui_pr_account_popup_blocked": "Your browser blocked the sign-in window. Allow pop-ups and try again.",
   "com_ui_pr_account_status_error": "Couldn't check the connection",
+  "com_ui_pr_account_unused_description": "Pull requests no longer use this account. Disconnect it to remove it.",
   "com_ui_pr_additions": "{{0}} lines added",
   "com_ui_pr_checks": "Checks: {{0}}",
   "com_ui_pr_checks_failing": "Failing",

From cc4a4fc85eaf435b2876df25e67bb0a2c73557b3 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 07:27:41 +0200
Subject: [PATCH 20/30] fix: Apply a Sign-In Status Asked For Before the Flow
 Expired

---
 .../data-provider/PullRequest/signIn.test.ts  | 34 +++++++++++++++++++
 .../src/data-provider/PullRequest/signIn.ts   |  5 ++-
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 132c2fc5711..fb9d68a045c 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -245,6 +245,40 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).not.toHaveBeenCalled();
   });
 
+  it('applies an answer asked for just before the flow expired', async () => {
+    const { client, invalidate } = setup();
+    let answer: (status: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockReturnValue(new Promise((resolve) => (answer = resolve)));
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 1 * MINUTE,
+    });
+    await pass(1 * MINUTE - 1);
+    announceOAuthSettled({ outcome: 'succeeded' });
+    await pass(1);
+    expect(invalidate).not.toHaveBeenCalled();
+    answer(connection(true));
+    await pass(0);
+    expect(invalidate).toHaveBeenCalled();
+  });
+
+  it('discards an answer that arrives after the session ended', async () => {
+    const { client, invalidate } = setup();
+    let answer: (status: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockReturnValue(new Promise((resolve) => (answer = resolve)));
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
+    announceOAuthSettled({ outcome: 'succeeded' });
+    await pass(0);
+    endPullRequestSession();
+    invalidate.mockClear();
+    answer(connection(true));
+    await pass(0);
+    expect(invalidate).not.toHaveBeenCalled();
+  });
+
   it('does not start a watch for a sign-in begun in a session that has since ended', async () => {
     const { client } = setup();
     const startedIn = pullRequestSignInSession();
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 1a1146b569c..5c554f0cbeb 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -93,7 +93,10 @@ export function watchPullRequestSignIn(
     } catch {
       return;
     }
-    if (stopped) {
+    /** An answer already asked for still counts once the watch expires or is replaced, since a
+     *  sign-in that landed just before expiry must refresh pull requests; only a session that
+     *  ended in between discards it, as it would apply to whoever signs in next. */
+    if (startedIn !== session) {
       return;
     }
     /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */

From 24b4966c5d27ab1c0205f54a578ef8b43c1a8c54 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 14:44:19 +0200
Subject: [PATCH 21/30] fix: Keep Focus When Removing the Last Pull Request
 Grant and Reuse Its Status

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 14 +++++-
 .../__tests__/ConnectedAccounts.spec.tsx      | 50 +++++++++++++++++++
 .../data-provider/PullRequest/connection.ts   |  3 ++
 3 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index e03039e64c3..54b30e85b83 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -66,6 +66,9 @@ export default function ConnectedAccounts() {
   const [connectError, setConnectError] = useState<ConnectError | null>(null);
   const [disconnectFailed, setDisconnectFailed] = useState(false);
   const actionRef = useRef<HTMLButtonElement | null>(null);
+  const groupRef = useRef<HTMLDivElement | null>(null);
+  /** Where focus goes when a disconnect removes the row along with its trigger. */
+  const fallbackRef = useRef<HTMLElement | null>(null);
   const keepFocus = useRef(false);
 
   /**
@@ -153,6 +156,9 @@ export default function ConnectedAccounts() {
 
   const disconnect = () => {
     setDisconnectFailed(false);
+    /** Taken before the request: removing a grant whose app is off removes this row too. */
+    fallbackRef.current =
+      groupRef.current?.closest<HTMLElement>('[role="tabpanel"], [role="dialog"]') ?? null;
     disconnectMutation.mutate(undefined, {
       onSuccess: () => {
         keepFocus.current = true;
@@ -254,6 +260,7 @@ export default function ConnectedAccounts() {
       }}
     >
       <div
+        ref={groupRef}
         role="group"
         aria-labelledby={labelId}
         aria-describedby={descriptionId}
@@ -291,7 +298,12 @@ export default function ConnectedAccounts() {
         className="w-11/12 max-w-md"
         onCloseAutoFocus={(event) => {
           event.preventDefault();
-          actionRef.current?.focus();
+          const action = actionRef.current;
+          if (action?.isConnected === true) {
+            action.focus();
+          } else {
+            fallbackRef.current?.focus();
+          }
         }}
       >
         <AlertDialogHeader>
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index b598c9598c7..43614fa0aba 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -5,6 +5,7 @@ import { QueryKeys } from 'librechat-data-provider';
 import { render, screen, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
+import { usePullRequestConnectionStatus } from '~/data-provider/PullRequest/connection';
 import { stopPullRequestSignIns } from '~/data-provider/PullRequest/signIn';
 import { endPullRequestSession } from '~/data-provider/PullRequest/queries';
 import ConnectedAccounts from '../ConnectedAccounts';
@@ -59,6 +60,26 @@ const renderRow = () => {
   return { client, invalidate, unmount };
 };
 
+/** Settings as the registry shows the row: inside a tab panel, only while the status allows it. */
+function SettingsPanel() {
+  const status = usePullRequestConnectionStatus();
+  return (
+    <div role="tabpanel" tabIndex={-1}>
+      {status?.connected === true && <ConnectedAccounts />}
+    </div>
+  );
+}
+
+const renderPanel = () => {
+  const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={client}>
+      <SettingsPanel />
+    </QueryClientProvider>,
+  );
+  return { client };
+};
+
 const fakeWindow = () => ({ opener: {} as unknown, location: { href: '' }, close: jest.fn() });
 
 describe('ConnectedAccounts', () => {
@@ -386,6 +407,35 @@ describe('ConnectedAccounts', () => {
     await waitFor(() => expect(connect).toHaveFocus());
   });
 
+  it('asks for the status once when Settings reveals a grant whose app is off', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    mockGetConnection.mockResolvedValue({ configured: false, connected: true });
+    renderPanel();
+
+    expect(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    ).toBeInTheDocument();
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+  });
+
+  it('moves focus to the panel when disconnecting removes the last row', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    mockGetConnection.mockResolvedValue({ configured: false, connected: true });
+    mockDisconnect.mockResolvedValue(undefined);
+    renderPanel();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    await screen.findByRole('alertdialog');
+    mockGetConnection.mockResolvedValue({ configured: false, connected: false });
+    await userEvent.click(screen.getByRole('button', { name: 'com_ui_pr_account_disconnect' }));
+
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument());
+    expect(screen.queryByRole('group')).toBeNull();
+    await waitFor(() => expect(screen.getByRole('tabpanel')).toHaveFocus());
+  });
+
   it('cannot be cancelled or dismissed once the disconnect is sent', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     let settle: () => void = () => undefined;
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 472a48d394f..39fbaa21d44 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -72,6 +72,9 @@ export const usePullRequestConnectionQuery = () => {
       enabled: isConnectionKnowable(startupConfig),
       retry: false,
       refetchOnWindowFocus: true,
+      /** The row renders inside Settings, whose visibility check (`usePullRequestConnectionStatus`)
+       *  asks as Settings mounts; the row reuses that answer instead of asking again. */
+      refetchOnMount: false,
     },
   );
 

From 8a31140cfa8587af289c38872e2c8f4e2575ba6b Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:16:22 +0200
Subject: [PATCH 22/30] fix: Resync Pull Request Credentials After Failed
 Sign-Ins and Disconnects

---
 .../__tests__/ConnectedAccounts.spec.tsx      | 25 ++++++++++++++
 .../PullRequest/connection.test.tsx           | 33 ++++++++++++++++++-
 .../data-provider/PullRequest/connection.ts   | 20 +++++++++--
 .../data-provider/PullRequest/signIn.test.ts  | 12 +++++++
 .../src/data-provider/PullRequest/signIn.ts   |  4 ++-
 5 files changed, 90 insertions(+), 4 deletions(-)

diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 43614fa0aba..87b6f696510 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -476,6 +476,31 @@ describe('ConnectedAccounts', () => {
     expect(screen.getByRole('alertdialog')).toBeInTheDocument();
   });
 
+  it('asks for the status again when a disconnect fails, since the grant may be gone', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    mockDisconnect.mockRejectedValue(new Error('500'));
+    const { invalidate } = renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    const asked = mockGetConnection.mock.calls.length;
+    invalidate.mockClear();
+    mockGetConnection.mockResolvedValue(connection(false));
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' }),
+    );
+
+    expect(await screen.findByRole('alert')).toHaveTextContent(
+      'com_ui_pr_account_disconnect_error',
+    );
+    await waitFor(() => expect(mockGetConnection.mock.calls.length).toBeGreaterThan(asked));
+    /** The server had ended the connection: pull requests follow the server's token. */
+    await waitFor(() =>
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
+    );
+  });
+
   it('keeps the confirmation button named while the disconnect is in flight', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     let settle: () => void = () => undefined;
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 606067cb7e1..acc306bf948 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -1,9 +1,10 @@
 import React from 'react';
 import { QueryKeys } from 'librechat-data-provider';
 import { act, renderHook, waitFor } from '@testing-library/react';
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { QueryClient, QueryObserver, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
 import {
+  syncPullRequestConnection,
   resetPullRequestCredentials,
   usePullRequestConnectionQuery,
   useDisconnectPullRequestAccountMutation,
@@ -178,6 +179,36 @@ describe('pull request connection hooks', () => {
     await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
   });
 
+  it('restarts a pull request still on its first load when the credential changes', async () => {
+    const { client } = setup();
+    syncPullRequestConnection(client, connection(false));
+    const loads: Array<(value: unknown) => void> = [];
+    const queryFn = jest.fn(() => new Promise((resolve) => loads.push(resolve)));
+    const observer = new QueryObserver(client, {
+      queryKey: [QueryKeys.conversationPullRequest, 'convo'],
+      queryFn,
+    });
+    const unsubscribe = observer.subscribe(() => undefined);
+    try {
+      await waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1));
+      /** Connected while the first load, under the server's token, is still running. */
+      syncPullRequestConnection(client, { ...connection(true), flowId: 'flow-a' });
+      await waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2));
+      /** The cancelled load answers last, and does not replace the answer under the new token. */
+      loads[1]('new');
+      await waitFor(() =>
+        expect(client.getQueryData([QueryKeys.conversationPullRequest, 'convo'])).toBe('new'),
+      );
+      loads[0]('old');
+      await act(async () => {
+        await Promise.resolve();
+      });
+      expect(client.getQueryData([QueryKeys.conversationPullRequest, 'convo'])).toBe('new');
+    } finally {
+      unsubscribe();
+    }
+  });
+
   it('marks the account disconnected and refetches the status and pull requests', async () => {
     mockDisconnect.mockResolvedValue(undefined);
     const { client, wrapper, invalidate } = setup();
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 39fbaa21d44..6721cf6c108 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -22,6 +22,17 @@ const credentialOf = (status: TPullRequestConnection): string =>
 /** Per app, the credential its cached pull requests were last refreshed under. */
 const refreshedUnder = new Map<QueryClient, string>();
 
+/**
+ * Refetches every cached pull request under the credential the server now uses. In-flight loads
+ * are cancelled first: an invalidation alone joins a first load that is still running, so one
+ * that started with the old credential would land afterwards and stand.
+ */
+function refetchPullRequests(queryClient: QueryClient): void {
+  void queryClient
+    .cancelQueries([QueryKeys.conversationPullRequest])
+    .then(() => queryClient.invalidateQueries([QueryKeys.conversationPullRequest]));
+}
+
 /** Forgets every app's credential with the session, so the next one starts from its own. */
 export function resetPullRequestCredentials(): void {
   refreshedUnder.clear();
@@ -44,7 +55,7 @@ export function syncPullRequestConnection(
   if (previous === credential) {
     return;
   }
-  queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+  refetchPullRequests(queryClient);
 }
 
 /**
@@ -129,7 +140,12 @@ export const useDisconnectPullRequestAccountMutation = () => {
         queryClient,
         credentialOf({ configured: true, provider: status?.provider, connected: false }),
       );
-      queryClient.invalidateQueries([QueryKeys.conversationPullRequest]);
+      refetchPullRequests(queryClient);
+    },
+    /** A failed request may still have ended the connection (the server fences the grant before
+     *  removing it), so the status is asked again and a change refetches pull requests. */
+    onError: () => {
+      queryClient.invalidateQueries([QueryKeys.pullRequestConnection]);
     },
   });
 };
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index fb9d68a045c..7fd3a979371 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -310,6 +310,18 @@ describe('watchPullRequestSignIn', () => {
       expect(await askedAfter(10 * MINUTE)).toBe(0);
     });
 
+    it('reads the status once before ending, since the grant may have been stored', async () => {
+      const { client, invalidate } = setup();
+      watchFlow(client, 'flow-a');
+      mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
+      const before = mockGetConnection.mock.calls.length;
+      announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
+      await pass(0);
+      expect(mockGetConnection.mock.calls.length - before).toBe(1);
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+      expect(await askedAfter(10 * MINUTE)).toBe(0);
+    });
+
     it('leaves the watch on another flow running', async () => {
       watchFlow(setup().client, 'flow-b');
       announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 5c554f0cbeb..139803c51cf 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -123,7 +123,9 @@ export function watchPullRequestSignIn(
     }
     /** A failure naming no flow is another sign-in's (an MCP server's, say): ours always name it. */
     if (settlement.flowId != null && settlement.flowId === flowId) {
-      stop();
+      /** The server can store the grant and still report the flow failed (a check after storing
+       *  could not finish), so the status is read once more before the watch ends. */
+      void check().finally(stop);
     }
   };
   const channel =

From bc22099fc05e3ce853fa6f0368fc3e5181ab6a6a Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:46:57 +0200
Subject: [PATCH 23/30] fix: Ask for the Connection Status Afresh Once a
 Sign-In Settles

---
 .../data-provider/PullRequest/signIn.test.ts  | 30 +++++++++++++++++--
 .../src/data-provider/PullRequest/signIn.ts   | 11 +++++--
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 7fd3a979371..636bf7063c6 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -129,6 +129,31 @@ describe('watchPullRequestSignIn', () => {
     expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
   });
 
+  it('asks again after the announcement instead of joining a request sent before it', async () => {
+    const { client, invalidate } = setup();
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 10 * MINUTE,
+    });
+    /** A focus asks while the callback has not stored the grant yet; that answer is slow. */
+    let answerEarly: (status: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockImplementationOnce(
+      () => new Promise((resolve) => (answerEarly = resolve)),
+    );
+    await focus();
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+
+    mockGetConnection.mockResolvedValue(connection(true));
+    invalidate.mockClear();
+    announceOAuthSettled({ outcome: 'succeeded' });
+    await pass(0);
+    answerEarly(connection(false));
+    await pass(0);
+    expect(mockGetConnection).toHaveBeenCalledTimes(2);
+    expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
   it('backs off asking on a timer, so a sign-in left open costs few requests', async () => {
     const { client } = setup();
     watchPullRequestSignIn(client, {
@@ -304,10 +329,11 @@ describe('watchPullRequestSignIn', () => {
       return mockGetConnection.mock.calls.length - before;
     };
 
-    it('ends the watch on the flow it names', async () => {
+    it('ends the watch on the flow it names, after one last read', async () => {
       watchFlow(setup().client, 'flow-a');
       announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
-      expect(await askedAfter(10 * MINUTE)).toBe(0);
+      /** The read the failure itself asks for, and none after it. */
+      expect(await askedAfter(10 * MINUTE)).toBe(1);
     });
 
     it('reads the status once before ending, since the grant may have been stored', async () => {
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 139803c51cf..d348e20b32f 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -79,12 +79,17 @@ export function watchPullRequestSignIn(
   let wait = PULL_REQUEST_CONNECT_POLL_MS;
   let stopped = false;
 
-  const check = async (): Promise<void> => {
+  /** `fresh` for a check after the sign-in page settled: a request already in flight may have been
+   *  sent before the callback stored the grant, and asking now would only join it. */
+  const check = async (fresh = false): Promise<void> => {
     if (stopped) {
       return;
     }
     let status: TPullRequestConnection;
     try {
+      if (fresh) {
+        await queryClient.cancelQueries([QueryKeys.pullRequestConnection]);
+      }
       status = await queryClient.fetchQuery<TPullRequestConnection>(
         [QueryKeys.pullRequestConnection],
         () => dataService.getPullRequestConnection(),
@@ -118,14 +123,14 @@ export function watchPullRequestSignIn(
   const onSettled = (event: MessageEvent) => {
     const settlement: unknown = event.data;
     if (!isSettlement(settlement) || settlement.outcome === 'succeeded') {
-      void check();
+      void check(true);
       return;
     }
     /** A failure naming no flow is another sign-in's (an MCP server's, say): ours always name it. */
     if (settlement.flowId != null && settlement.flowId === flowId) {
       /** The server can store the grant and still report the flow failed (a check after storing
        *  could not finish), so the status is read once more before the watch ends. */
-      void check().finally(stop);
+      void check(true).finally(stop);
     }
   };
   const channel =

From 50298e1243705c23d7cb30802d6639898f70b50a Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:51:40 +0200
Subject: [PATCH 24/30] fix: Resync Pull Requests From the Settings Visibility
 Status

---
 .../PullRequest/connection.test.tsx             | 17 +++++++++++++++++
 .../src/data-provider/PullRequest/connection.ts | 15 ++++++++++++---
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index acc306bf948..8cb19a6dc70 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -7,6 +7,7 @@ import {
   syncPullRequestConnection,
   resetPullRequestCredentials,
   usePullRequestConnectionQuery,
+  usePullRequestConnectionStatus,
   useDisconnectPullRequestAccountMutation,
 } from './connection';
 
@@ -111,6 +112,22 @@ describe('pull request connection hooks', () => {
     expect(invalidate).toHaveBeenCalledTimes(1);
   });
 
+  it('refetches cached pull requests from the visibility status alone, with the row hidden', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    mockGetConnection.mockResolvedValue({ configured: false, connected: true });
+    const { client, wrapper, invalidate } = setup();
+    renderHook(() => usePullRequestConnectionStatus(), { wrapper });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
+
+    /** Disconnected in another tab: the section hides, and only this observer sees it. */
+    mockGetConnection.mockResolvedValue({ configured: false, connected: false });
+    await act(async () => {
+      await client.refetchQueries([QueryKeys.pullRequestConnection]);
+    });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
+    expect(invalidate).toHaveBeenLastCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
   it('refreshes pull requests once per change, not on every Settings visit', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     const { wrapper, invalidate } = setup();
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 6721cf6c108..5658cf54361 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -102,11 +102,12 @@ export const usePullRequestConnectionQuery = () => {
 /**
  * The same status for what contains the Settings row, so an app the server no longer has hides
  * the whole section, and a later answer that it has one again brings the section back. It shares
- * the row's query and leaves refetching pull requests on a change to the row.
+ * the row's query.
  */
 export const usePullRequestConnectionStatus = () => {
+  const queryClient = useQueryClient();
   const { data: startupConfig } = useGetStartupConfig();
-  return useQuery<TPullRequestConnection>(
+  const { data } = useQuery<TPullRequestConnection>(
     [QueryKeys.pullRequestConnection],
     () => dataService.getPullRequestConnection(),
     {
@@ -114,7 +115,15 @@ export const usePullRequestConnectionStatus = () => {
       retry: false,
       refetchOnWindowFocus: true,
     },
-  ).data;
+  );
+  /** Synced here too: a status that hides the row (a grant removed while its app is off) must
+   *  still refetch pull requests looked up with that grant. A status already synced is a no-op. */
+  useEffect(() => {
+    if (data != null) {
+      syncPullRequestConnection(queryClient, data);
+    }
+  }, [data, queryClient]);
+  return data;
 };
 
 /** Starts the provider's sign-in; the caller navigates a window it opened to the returned url. */

From 44b9b55dc0eed052301bfc2e44900eb67ab19daa Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 18:31:36 +0200
Subject: [PATCH 25/30] fix: Reconcile Pull Request Credentials Until a Status
 Read Succeeds

---
 .../PullRequest/connection.test.tsx           | 45 +++++++++++++++++++
 .../data-provider/PullRequest/connection.ts   | 42 ++++++++++++++---
 .../data-provider/PullRequest/signIn.test.ts  | 17 +++++++
 .../src/data-provider/PullRequest/signIn.ts   | 11 +++--
 4 files changed, 107 insertions(+), 8 deletions(-)

diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 8cb19a6dc70..11093a15283 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -242,4 +242,49 @@ describe('pull request connection hooks', () => {
     expect(invalidate).toHaveBeenCalledWith([QueryKeys.pullRequestConnection]);
     expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
   });
+
+  it('reads the status after a failed disconnect even with Settings closed', async () => {
+    mockDisconnect.mockRejectedValue(new Error('500'));
+    const { client, wrapper, invalidate } = setup();
+    /** Pull requests were last refreshed under the user's own grant. */
+    syncPullRequestConnection(client, { ...connection(true), flowId: 'flow-a' });
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(1));
+    /** No status observer is mounted: only the mutation is. */
+    const { result } = renderHook(() => useDisconnectPullRequestAccountMutation(), { wrapper });
+    mockGetConnection.mockResolvedValue(connection(false));
+
+    await act(async () => {
+      await result.current.mutateAsync().catch(() => undefined);
+    });
+
+    await waitFor(() => expect(mockGetConnection).toHaveBeenCalledTimes(1));
+    await waitFor(() => expect(invalidate).toHaveBeenCalledTimes(2));
+    expect(invalidate).toHaveBeenLastCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
+  it('leaves the next session alone when a disconnect answers after the session ended', async () => {
+    let answer: (value?: unknown) => void = () => undefined;
+    mockDisconnect.mockImplementation(() => new Promise((resolve) => (answer = resolve)));
+    const { client, wrapper, invalidate } = setup();
+    const { result } = renderHook(() => useDisconnectPullRequestAccountMutation(), { wrapper });
+
+    let pending: Promise<void> = Promise.resolve();
+    act(() => {
+      pending = result.current.mutateAsync();
+    });
+    await waitFor(() => expect(mockDisconnect).toHaveBeenCalledTimes(1));
+    /** Signed out, and the next user's status is cached, before the old disconnect answers. */
+    resetPullRequestCredentials();
+    client.setQueryData([QueryKeys.pullRequestConnection], connection(true));
+    invalidate.mockClear();
+    await act(async () => {
+      answer();
+      await pending;
+    });
+
+    expect(
+      client.getQueryData<TPullRequestConnection>([QueryKeys.pullRequestConnection])?.connected,
+    ).toBe(true);
+    expect(invalidate).not.toHaveBeenCalled();
+  });
 });
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 5658cf54361..a9d1cb46024 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -33,9 +33,30 @@ function refetchPullRequests(queryClient: QueryClient): void {
     .then(() => queryClient.invalidateQueries([QueryKeys.conversationPullRequest]));
 }
 
+/** Counts sessions, so work a session started does not touch the next one's cache. */
+let epoch = 0;
+
 /** Forgets every app's credential with the session, so the next one starts from its own. */
 export function resetPullRequestCredentials(): void {
   refreshedUnder.clear();
+  epoch += 1;
+}
+
+/**
+ * Reads the status afresh and syncs pull requests to it, with or without Settings open: an
+ * invalidation alone refetches only a status something is still watching. A request already in
+ * flight is cancelled first, since it may have been sent before the change it must observe.
+ */
+async function reconcileConnection(queryClient: QueryClient, startedIn: number): Promise<void> {
+  await queryClient.cancelQueries([QueryKeys.pullRequestConnection]);
+  const status = await queryClient.fetchQuery<TPullRequestConnection>(
+    [QueryKeys.pullRequestConnection],
+    () => dataService.getPullRequestConnection(),
+    { staleTime: 0, retry: false },
+  );
+  if (startedIn === epoch) {
+    syncPullRequestConnection(queryClient, status);
+  }
 }
 
 /**
@@ -135,10 +156,15 @@ export const useConnectPullRequestAccountMutation = () =>
 
 export const useDisconnectPullRequestAccountMutation = () => {
   const queryClient = useQueryClient();
-  return useMutation<void, unknown, void>({
+  return useMutation<void, unknown, void, number>({
     mutationKey: [MutationKeys.disconnectPullRequestAccount],
     mutationFn: () => dataService.disconnectPullRequestAccount(),
-    onSuccess: () => {
+    /** The session the disconnect was sent in: an answer after it ended belongs to nobody here. */
+    onMutate: () => epoch,
+    onSuccess: (_data, _variables, startedIn) => {
+      if (startedIn !== epoch) {
+        return;
+      }
       const status = queryClient.setQueryData<TPullRequestConnection>(
         [QueryKeys.pullRequestConnection],
         (current) => (current == null ? current : { ...current, connected: false }),
@@ -152,9 +178,15 @@ export const useDisconnectPullRequestAccountMutation = () => {
       refetchPullRequests(queryClient);
     },
     /** A failed request may still have ended the connection (the server fences the grant before
-     *  removing it), so the status is asked again and a change refetches pull requests. */
-    onError: () => {
-      queryClient.invalidateQueries([QueryKeys.pullRequestConnection]);
+     *  removing it), so the status is asked again and a change refetches pull requests. A status
+     *  read that fails too leaves the status invalidated for the next look at it. */
+    onError: (_error, _variables, startedIn) => {
+      if (startedIn == null || startedIn !== epoch) {
+        return;
+      }
+      reconcileConnection(queryClient, startedIn).catch(() =>
+        queryClient.invalidateQueries([QueryKeys.pullRequestConnection]),
+      );
     },
   });
 };
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 636bf7063c6..ec109f21f9b 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -348,6 +348,23 @@ describe('watchPullRequestSignIn', () => {
       expect(await askedAfter(10 * MINUTE)).toBe(0);
     });
 
+    it('keeps watching when the read after a failure fails, until one succeeds', async () => {
+      const { client, invalidate } = setup();
+      watchFlow(client, 'flow-a');
+      mockGetConnection.mockRejectedValueOnce(new Error('offline'));
+      announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
+      await pass(0);
+      expect(mockGetConnection).toHaveBeenCalledTimes(1);
+
+      /** The server had stored the grant: the next read that succeeds syncs it, then the watch ends. */
+      mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
+      invalidate.mockClear();
+      await focus();
+      expect(mockGetConnection).toHaveBeenCalledTimes(2);
+      expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+      expect(await askedAfter(10 * MINUTE)).toBe(0);
+    });
+
     it('leaves the watch on another flow running', async () => {
       watchFlow(setup().client, 'flow-b');
       announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index d348e20b32f..3c0ad796070 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -78,6 +78,9 @@ export function watchPullRequestSignIn(
   let timer: ReturnType<typeof setTimeout> | undefined;
   let wait = PULL_REQUEST_CONNECT_POLL_MS;
   let stopped = false;
+  /** This flow's sign-in page reported a failure: the next status read that succeeds ends the
+   *  watch, whatever it says, since the server may have stored the grant before failing. */
+  let failed = false;
 
   /** `fresh` for a check after the sign-in page settled: a request already in flight may have been
    *  sent before the callback stored the grant, and asking now would only join it. */
@@ -107,7 +110,7 @@ export function watchPullRequestSignIn(
     /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */
     syncPullRequestConnection(queryClient, status);
     const ours = flowId == null || status.flowId == null || status.flowId === flowId;
-    if (status.connected && ours) {
+    if (failed || (status.connected && ours)) {
       stop();
     }
   };
@@ -129,8 +132,10 @@ export function watchPullRequestSignIn(
     /** A failure naming no flow is another sign-in's (an MCP server's, say): ours always name it. */
     if (settlement.flowId != null && settlement.flowId === flowId) {
       /** The server can store the grant and still report the flow failed (a check after storing
-       *  could not finish), so the status is read once more before the watch ends. */
-      void check(true).finally(stop);
+       *  could not finish), so the watch ends only on a status read that succeeds; a failed one
+       *  leaves it to the timer, focus and expiry like any other. */
+      failed = true;
+      void check(true);
     }
   };
   const channel =

From 9500dc076db43d9852d66114d6bcde4d4e98165d Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 18:48:29 +0200
Subject: [PATCH 26/30] fix: Keep Pull Request Sign-In State Accurate Across
 Failures and Account Switches

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 14 ++++-
 .../__tests__/ConnectedAccounts.spec.tsx      | 31 ++++++++--
 .../src/data-provider/PullRequest/queries.ts  | 18 ++++++
 .../data-provider/PullRequest/signIn.test.ts  | 60 ++++++++++++++++++-
 .../src/data-provider/PullRequest/signIn.ts   | 23 ++++++-
 client/src/hooks/AuthContext.tsx              |  3 +
 .../src/hooks/__tests__/AuthContext.spec.tsx  |  1 +
 7 files changed, 141 insertions(+), 9 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 54b30e85b83..78978b46be3 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useId, useRef, useState } from 'react';
+import { useCallback, useEffect, useId, useRef, useState } from 'react';
 import { ExternalLink, Gitlab } from 'lucide-react';
 import { useQueryClient } from '@tanstack/react-query';
 import {
@@ -86,6 +86,18 @@ export default function ConnectedAccounts() {
     }
   }, []);
 
+  /** A disconnect that failed may still have ended the connection: once the status read after it
+   *  says so, the confirmation closes as on success, and focus moves on the same way. */
+  const disconnected = status.data?.connected === false;
+  useEffect(() => {
+    if (!confirmOpen || !disconnectFailed || !disconnected) {
+      return;
+    }
+    keepFocus.current = true;
+    setConfirmOpen(false);
+    setDisconnectFailed(false);
+  }, [confirmOpen, disconnectFailed, disconnected]);
+
   /**
    * The server is the authority: an app it no longer has is nothing to connect to, and once the
    * status loads its provider is the one a connection goes to, whatever the cached startup says.
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 87b6f696510..ad9757375ba 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -476,7 +476,7 @@ describe('ConnectedAccounts', () => {
     expect(screen.getByRole('alertdialog')).toBeInTheDocument();
   });
 
-  it('asks for the status again when a disconnect fails, since the grant may be gone', async () => {
+  it('closes the confirmation when a failed disconnect had ended the connection after all', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     mockDisconnect.mockRejectedValue(new Error('500'));
     const { invalidate } = renderRow();
@@ -486,21 +486,42 @@ describe('ConnectedAccounts', () => {
     );
     const asked = mockGetConnection.mock.calls.length;
     invalidate.mockClear();
+    /** The server fenced the grant before the request failed. */
     mockGetConnection.mockResolvedValue(connection(false));
     await userEvent.click(
       await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' }),
     );
 
-    expect(await screen.findByRole('alert')).toHaveTextContent(
-      'com_ui_pr_account_disconnect_error',
-    );
     await waitFor(() => expect(mockGetConnection.mock.calls.length).toBeGreaterThan(asked));
-    /** The server had ended the connection: pull requests follow the server's token. */
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument());
+    const connect = await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ });
+    await waitFor(() => expect(connect).toHaveFocus());
+    /** Pull requests follow the server's token now. */
     await waitFor(() =>
       expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]),
     );
   });
 
+  it('keeps the error when the status read after a failed disconnect still shows the grant', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    mockDisconnect.mockRejectedValue(new Error('500'));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    const asked = mockGetConnection.mock.calls.length;
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' }),
+    );
+
+    await waitFor(() => expect(mockGetConnection.mock.calls.length).toBeGreaterThan(asked));
+    expect(await screen.findByRole('alert')).toHaveTextContent(
+      'com_ui_pr_account_disconnect_error',
+    );
+    expect(screen.getByRole('alertdialog')).toBeInTheDocument();
+  });
+
   it('keeps the confirmation button named while the disconnect is in flight', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     let settle: () => void = () => undefined;
diff --git a/client/src/data-provider/PullRequest/queries.ts b/client/src/data-provider/PullRequest/queries.ts
index 1370c6bd3cd..a8fbee98588 100644
--- a/client/src/data-provider/PullRequest/queries.ts
+++ b/client/src/data-provider/PullRequest/queries.ts
@@ -97,6 +97,24 @@ const batcherFor = (userId: string): RowBatcher => {
  * signing back in as the same account starts a fresh queue and neither waits behind, nor sends,
  * anything the previous session left.
  */
+/** The account the pull request session belongs to. */
+let sessionOwner: string | undefined;
+
+/**
+ * Records who signed in, and ends the pull request session when it is a different account than
+ * the last one: an account switch without a logout passes no teardown, and the sign-in watch,
+ * credential record and queued lookups would otherwise carry over to the next account.
+ */
+export const setPullRequestSessionOwner = (userId?: string | null): void => {
+  if (!userId) {
+    return;
+  }
+  if (sessionOwner !== undefined && sessionOwner !== userId) {
+    endPullRequestSession();
+  }
+  sessionOwner = userId;
+};
+
 export const endPullRequestSession = (): void => {
   rowBatcher?.batcher.dispose();
   rowBatcher = undefined;
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index ec109f21f9b..df3152c9a48 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -3,12 +3,13 @@ import { QueryClient } from '@tanstack/react-query';
 import type { TPullRequestConnection } from 'librechat-data-provider';
 import {
   PULL_REQUEST_CONNECT_POLL_MS,
+  PULL_REQUEST_SETTLED_GRACE_MS,
   announceOAuthSettled,
   stopPullRequestSignIns,
   pullRequestSignInSession,
   watchPullRequestSignIn,
 } from './signIn';
-import { endPullRequestSession } from './queries';
+import { endPullRequestSession, setPullRequestSessionOwner } from './queries';
 
 const mockGetConnection = jest.fn();
 
@@ -185,6 +186,63 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it('keeps reading past expiry after its own sign-in settled, until a read succeeds', async () => {
+    const { client, invalidate } = setup();
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 1 * MINUTE,
+      flowId: 'flow-a',
+    });
+    await pass(59_000);
+    /** Settled just before expiry, and the read it prompts fails. */
+    mockGetConnection.mockRejectedValue(new Error('offline'));
+    announceOAuthSettled({ outcome: 'succeeded', flowId: 'flow-a' });
+    await pass(2_000);
+
+    mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
+    invalidate.mockClear();
+    await focus();
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    const asked = mockGetConnection.mock.calls.length;
+    await pass(PULL_REQUEST_SETTLED_GRACE_MS);
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  });
+
+  it('gives up a settled sign-in whose status cannot be read once the grace passes', async () => {
+    const { client } = setup();
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 1 * MINUTE,
+      flowId: 'flow-a',
+    });
+    mockGetConnection.mockRejectedValue(new Error('offline'));
+    announceOAuthSettled({ outcome: 'succeeded', flowId: 'flow-a' });
+    await pass(1 * MINUTE + PULL_REQUEST_SETTLED_GRACE_MS);
+    const asked = mockGetConnection.mock.calls.length;
+    await pass(10 * MINUTE);
+    await focus();
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  });
+
+  it('ends the watch when another account signs in without a logout', async () => {
+    const { client } = setup();
+    setPullRequestSessionOwner('first');
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 60 * MINUTE,
+      flowId: 'flow-a',
+    });
+    setPullRequestSessionOwner('first');
+    await focus();
+    const asked = mockGetConnection.mock.calls.length;
+    expect(asked).toBeGreaterThan(0);
+
+    setPullRequestSessionOwner('second');
+    await pass(10 * MINUTE);
+    await focus();
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  });
+
   it("keeps watching when another flow's grant shows up, and stops on its own", async () => {
     const { client, invalidate } = setup();
     mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index 3c0ad796070..b9be17c237e 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -7,6 +7,8 @@ import { syncPullRequestConnection } from './connection';
 export const PULL_REQUEST_CONNECT_POLL_MS = 2000;
 /** Longest wait between status asks, so a sign-in left open costs a few requests a minute. */
 export const PULL_REQUEST_CONNECT_POLL_MAX_MS = 30_000;
+/** How long a settled sign-in keeps retrying its status read after the flow expired. */
+export const PULL_REQUEST_SETTLED_GRACE_MS = 2 * 60_000;
 /** Same-origin pages that end an OAuth sign-in announce it here. */
 export const OAUTH_SETTLED_CHANNEL = 'librechat:oauth-settled';
 
@@ -81,6 +83,9 @@ export function watchPullRequestSignIn(
   /** This flow's sign-in page reported a failure: the next status read that succeeds ends the
    *  watch, whatever it says, since the server may have stored the grant before failing. */
   let failed = false;
+  /** This flow's sign-in page settled, so the server may hold a new grant: the watch outlives the
+   *  flow's expiry, for a bounded grace, until a status read after it succeeds. */
+  let settled = false;
 
   /** `fresh` for a check after the sign-in page settled: a request already in flight may have been
    *  sent before the callback stored the grant, and asking now would only join it. */
@@ -110,7 +115,7 @@ export function watchPullRequestSignIn(
     /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */
     syncPullRequestConnection(queryClient, status);
     const ours = flowId == null || status.flowId == null || status.flowId === flowId;
-    if (failed || (status.connected && ours)) {
+    if (failed || settled || (status.connected && ours)) {
       stop();
     }
   };
@@ -126,6 +131,9 @@ export function watchPullRequestSignIn(
   const onSettled = (event: MessageEvent) => {
     const settlement: unknown = event.data;
     if (!isSettlement(settlement) || settlement.outcome === 'succeeded') {
+      if (isSettlement(settlement) && flowId != null && settlement.flowId === flowId) {
+        settled = true;
+      }
       void check(true);
       return;
     }
@@ -135,13 +143,24 @@ export function watchPullRequestSignIn(
        *  could not finish), so the watch ends only on a status read that succeeds; a failed one
        *  leaves it to the timer, focus and expiry like any other. */
       failed = true;
+      settled = true;
       void check(true);
     }
   };
   const channel =
     typeof BroadcastChannel === 'undefined' ? null : new BroadcastChannel(OAUTH_SETTLED_CHANNEL);
   channel?.addEventListener('message', onSettled);
-  const expiry = setTimeout(() => stop(), Math.max(0, expiresAt - Date.now()));
+  let expiry: ReturnType<typeof setTimeout> = setTimeout(
+    () => {
+      if (!settled) {
+        stop();
+        return;
+      }
+      /** Settled but not yet read back: keep retrying for a bounded grace, then give up. */
+      expiry = setTimeout(() => stop(), PULL_REQUEST_SETTLED_GRACE_MS);
+    },
+    Math.max(0, expiresAt - Date.now()),
+  );
 
   function stop() {
     stopped = true;
diff --git a/client/src/hooks/AuthContext.tsx b/client/src/hooks/AuthContext.tsx
index 640febf32d0..5974ab19130 100644
--- a/client/src/hooks/AuthContext.tsx
+++ b/client/src/hooks/AuthContext.tsx
@@ -41,6 +41,7 @@ import {
   useGetUserQuery,
   endPullRequestSession,
   useLoginUserMutation,
+  setPullRequestSessionOwner,
   useLogoutUserMutation,
   useRefreshTokenMutation,
 } from '~/data-provider';
@@ -124,6 +125,7 @@ const AuthContextProvider = ({
           setQueriesEnabled(true);
           /** A different account signing in without a logout must not inherit cached audio. */
           setTTSCacheOwner(user?.id);
+          setPullRequestSessionOwner(user?.id);
           /**
            * Any accepted full-auth response supersedes a staged enrollment, whichever path minted
            * it. The setup endpoints trust the stored bearer independently of the session, so a
@@ -265,6 +267,7 @@ const AuthContextProvider = ({
       setQueriesEnabled(true);
       openFileDeletionRetention();
       setTTSCacheOwner(authenticatedUser.id);
+      setPullRequestSessionOwner(authenticatedUser.id);
       navigate(redirect, { replace: true });
     },
     [navigate, setQueriesEnabled, setUser],
diff --git a/client/src/hooks/__tests__/AuthContext.spec.tsx b/client/src/hooks/__tests__/AuthContext.spec.tsx
index f2d35f7618e..05a02bbd37f 100644
--- a/client/src/hooks/__tests__/AuthContext.spec.tsx
+++ b/client/src/hooks/__tests__/AuthContext.spec.tsx
@@ -88,6 +88,7 @@ jest.mock('~/data-provider', () => ({
   })),
   useGetRole: jest.fn(() => ({ data: null })),
   endPullRequestSession: jest.fn(() => mockEndPullRequestSession()),
+  setPullRequestSessionOwner: jest.fn(),
   useListRoles: jest.fn(() => ({ data: undefined })),
 }));
 

From d2980387804decef04bc168cbb9a0ae85650e7ac Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 18:59:00 +0200
Subject: [PATCH 27/30] fix: Drop Replaced Sign-In Answers and Reset Status
 When the Account Changes

---
 .../PullRequest/connection.test.tsx           | 10 +++++++++
 .../data-provider/PullRequest/connection.ts   |  5 +++++
 .../data-provider/PullRequest/signIn.test.ts  | 22 +++++++++++++++++++
 .../src/data-provider/PullRequest/signIn.ts   | 10 +++++----
 4 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index 11093a15283..e00f749e09d 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -262,6 +262,16 @@ describe('pull request connection hooks', () => {
     expect(invalidate).toHaveBeenLastCalledWith([QueryKeys.conversationPullRequest]);
   });
 
+  it("resets the leaving account's cached status when the session ends", async () => {
+    const { client } = setup();
+    client.setQueryData([QueryKeys.pullRequestConnection], connection(true));
+    syncPullRequestConnection(client, connection(true));
+    resetPullRequestCredentials();
+    await waitFor(() =>
+      expect(client.getQueryData([QueryKeys.pullRequestConnection])).toBeUndefined(),
+    );
+  });
+
   it('leaves the next session alone when a disconnect answers after the session ended', async () => {
     let answer: (value?: unknown) => void = () => undefined;
     mockDisconnect.mockImplementation(() => new Promise((resolve) => (answer = resolve)));
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index a9d1cb46024..51b33d251b0 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -38,6 +38,11 @@ let epoch = 0;
 
 /** Forgets every app's credential with the session, so the next one starts from its own. */
 export function resetPullRequestCredentials(): void {
+  /** The status cached for the account that is leaving is not the next one's: an account switch
+   *  without a logout keeps the query cache, so it is reset (and refetched where watched). */
+  for (const queryClient of refreshedUnder.keys()) {
+    void queryClient.resetQueries([QueryKeys.pullRequestConnection]);
+  }
   refreshedUnder.clear();
   epoch += 1;
 }
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index df3152c9a48..79365b8c7b2 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -224,6 +224,28 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it("drops a replaced watch's late answer, leaving the new watch to speak", async () => {
+    const { client, invalidate } = setup();
+    let answerA: (status: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockImplementationOnce(() => new Promise((resolve) => (answerA = resolve)));
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 60 * MINUTE,
+      flowId: 'flow-a',
+    });
+    await focus();
+    /** Flow B replaces A while A's read is still out. */
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 60 * MINUTE,
+      flowId: 'flow-b',
+    });
+    invalidate.mockClear();
+    answerA({ ...connection(true), flowId: 'flow-a' });
+    await pass(0);
+    expect(invalidate).not.toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
   it('ends the watch when another account signs in without a logout', async () => {
     const { client } = setup();
     setPullRequestSessionOwner('first');
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index b9be17c237e..e29766198c7 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -106,10 +106,12 @@ export function watchPullRequestSignIn(
     } catch {
       return;
     }
-    /** An answer already asked for still counts once the watch expires or is replaced, since a
-     *  sign-in that landed just before expiry must refresh pull requests; only a session that
-     *  ended in between discards it, as it would apply to whoever signs in next. */
-    if (startedIn !== session) {
+    /** An answer already asked for still counts once the watch expires, since a sign-in that
+     *  landed just before expiry must refresh pull requests. It is discarded once another sign-in
+     *  replaced this watch, whose own reads now speak for the connection, or once the session
+     *  ended, as it would apply to whoever signs in next. */
+    const current = watches.get(queryClient);
+    if (startedIn !== session || (current != null && current !== watch)) {
       return;
     }
     /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */

From 63967db2b61f6ee3669b073bb1c576d7d5c931d3 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 19:12:08 +0200
Subject: [PATCH 28/30] fix: Reset Unwatched Connection Status and Keep Focus
 When a Retry Hides the Row

---
 .../Nav/Settings/ConnectedAccounts.tsx        |  9 ++++++
 .../__tests__/ConnectedAccounts.spec.tsx      | 31 +++++++++++++++++++
 .../PullRequest/connection.test.tsx           | 20 ++++++++++++
 .../data-provider/PullRequest/connection.ts   |  8 ++++-
 4 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 78978b46be3..6799525f50b 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -182,10 +182,19 @@ export default function ConnectedAccounts() {
 
   const retry = () => {
     keepFocus.current = true;
+    /** Taken before the request: an answer that the app is gone hides this row, Retry with it. */
+    const fallback = groupRef.current?.closest<HTMLElement>('[role="tabpanel"], [role="dialog"]');
     status.refetch().then((result) => {
       if (result.isError) {
         keepFocus.current = false;
       }
+      /** After React has applied the answer: focus left on nothing goes to the panel. */
+      setTimeout(() => {
+        const lost = document.activeElement == null || document.activeElement === document.body;
+        if (groupRef.current == null && lost) {
+          fallback?.focus();
+        }
+      }, 0);
     });
   };
 
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index ad9757375ba..043615ad940 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -70,6 +70,20 @@ function SettingsPanel() {
   );
 }
 
+/** Settings with its own visibility rule (context.tsx): the row shows for a known grant, or while
+ *  the startup config offers an app and the server has not said there is none. */
+function ConfigPanel() {
+  const status = usePullRequestConnectionStatus();
+  const shown =
+    status?.connected === true ||
+    (mockStartup.current?.pullRequestsConnect != null && status?.configured !== false);
+  return (
+    <div role="tabpanel" tabIndex={-1}>
+      {shown && <ConnectedAccounts />}
+    </div>
+  );
+}
+
 const renderPanel = () => {
   const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
   render(
@@ -436,6 +450,23 @@ describe('ConnectedAccounts', () => {
     await waitFor(() => expect(screen.getByRole('tabpanel')).toHaveFocus());
   });
 
+  it('moves focus to the panel when a retry finds the app gone and hides the row', async () => {
+    mockGetConnection.mockRejectedValueOnce(new Error('500'));
+    const client = new QueryClient({ logger, defaultOptions: { queries: { retry: false } } });
+    render(
+      <QueryClientProvider client={client}>
+        <ConfigPanel />
+      </QueryClientProvider>,
+    );
+
+    const retry = await screen.findByRole('button', { name: 'com_ui_retry' });
+    mockGetConnection.mockResolvedValue({ configured: false, connected: false });
+    await userEvent.click(retry);
+
+    await waitFor(() => expect(screen.queryByRole('group')).toBeNull());
+    await waitFor(() => expect(screen.getByRole('tabpanel')).toHaveFocus());
+  });
+
   it('cannot be cancelled or dismissed once the disconnect is sent', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     let settle: () => void = () => undefined;
diff --git a/client/src/data-provider/PullRequest/connection.test.tsx b/client/src/data-provider/PullRequest/connection.test.tsx
index e00f749e09d..6306da81019 100644
--- a/client/src/data-provider/PullRequest/connection.test.tsx
+++ b/client/src/data-provider/PullRequest/connection.test.tsx
@@ -272,6 +272,26 @@ describe('pull request connection hooks', () => {
     );
   });
 
+  it('resets a status that arrived after Settings closed when the account changes', async () => {
+    mockStartup.current = { pullRequestsEnabled: true };
+    let answer: (status: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockImplementationOnce(() => new Promise((resolve) => (answer = resolve)));
+    const { client, wrapper } = setup();
+    const { unmount } = renderHook(() => usePullRequestConnectionStatus(), { wrapper });
+    await waitFor(() => expect(mockGetConnection).toHaveBeenCalledTimes(1));
+    /** Settings closes before the first status arrives; the answer is cached with no observer. */
+    unmount();
+    await act(async () => {
+      answer(connection(true));
+    });
+    expect(client.getQueryData([QueryKeys.pullRequestConnection])).toEqual(connection(true));
+
+    resetPullRequestCredentials();
+    await waitFor(() =>
+      expect(client.getQueryData([QueryKeys.pullRequestConnection])).toBeUndefined(),
+    );
+  });
+
   it('leaves the next session alone when a disconnect answers after the session ended', async () => {
     let answer: (value?: unknown) => void = () => undefined;
     mockDisconnect.mockImplementation(() => new Promise((resolve) => (answer = resolve)));
diff --git a/client/src/data-provider/PullRequest/connection.ts b/client/src/data-provider/PullRequest/connection.ts
index 51b33d251b0..831b8ecb9e5 100644
--- a/client/src/data-provider/PullRequest/connection.ts
+++ b/client/src/data-provider/PullRequest/connection.ts
@@ -33,6 +33,10 @@ function refetchPullRequests(queryClient: QueryClient): void {
     .then(() => queryClient.invalidateQueries([QueryKeys.conversationPullRequest]));
 }
 
+/** Every app that has asked for the status, so the session reset reaches its cache even when no
+ *  answer was ever synced there (Settings closed before the first status arrived). */
+const statusClients = new Set<QueryClient>();
+
 /** Counts sessions, so work a session started does not touch the next one's cache. */
 let epoch = 0;
 
@@ -40,7 +44,7 @@ let epoch = 0;
 export function resetPullRequestCredentials(): void {
   /** The status cached for the account that is leaving is not the next one's: an account switch
    *  without a logout keeps the query cache, so it is reset (and refetched where watched). */
-  for (const queryClient of refreshedUnder.keys()) {
+  for (const queryClient of new Set([...statusClients, ...refreshedUnder.keys()])) {
     void queryClient.resetQueries([QueryKeys.pullRequestConnection]);
   }
   refreshedUnder.clear();
@@ -101,6 +105,7 @@ const isConnectionKnowable = (startupConfig?: Partial<TStartupConfig>): boolean
  */
 export const usePullRequestConnectionQuery = () => {
   const queryClient = useQueryClient();
+  statusClients.add(queryClient);
   const { data: startupConfig } = useGetStartupConfig();
   const query = useQuery<TPullRequestConnection>(
     [QueryKeys.pullRequestConnection],
@@ -132,6 +137,7 @@ export const usePullRequestConnectionQuery = () => {
  */
 export const usePullRequestConnectionStatus = () => {
   const queryClient = useQueryClient();
+  statusClients.add(queryClient);
   const { data: startupConfig } = useGetStartupConfig();
   const { data } = useQuery<TPullRequestConnection>(
     [QueryKeys.pullRequestConnection],

From 4e81e14aa29cd3a40b3c52ac7716c97f0b392ef0 Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 19:24:48 +0200
Subject: [PATCH 29/30] fix: Hear Late Sign-In Settlements and Explain Connect
 Failures After Settings Closes

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 15 +++++++++++
 .../__tests__/ConnectedAccounts.spec.tsx      |  6 +++--
 .../data-provider/PullRequest/signIn.test.ts  | 19 ++++++++++++++
 .../src/data-provider/PullRequest/signIn.ts   | 26 ++++++++++++++++---
 4 files changed, 61 insertions(+), 5 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index 6799525f50b..e9a9a13616f 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useId, useRef, useState } from 'react';
 import { ExternalLink, Gitlab } from 'lucide-react';
+import { apiBaseUrl } from 'librechat-data-provider';
 import { useQueryClient } from '@tanstack/react-query';
 import {
   AlertDialog,
@@ -70,6 +71,14 @@ export default function ConnectedAccounts() {
   /** Where focus goes when a disconnect removes the row along with its trigger. */
   const fallbackRef = useRef<HTMLElement | null>(null);
   const keepFocus = useRef(false);
+  /** Whether the row is still shown, so a failure after Settings closed is reported elsewhere. */
+  const mounted = useRef(true);
+  useEffect(() => {
+    mounted.current = true;
+    return () => {
+      mounted.current = false;
+    };
+  }, []);
 
   /**
    * Callback ref, so a replacement button takes focus as it mounts after an action, but only
@@ -160,6 +169,12 @@ export default function ConnectedAccounts() {
         });
       },
       () => {
+        /** With Settings closed the row cannot explain the failure, so the window it opened does,
+         *  on the sign-in error page. */
+        if (!mounted.current) {
+          popup.location.href = `${apiBaseUrl()}/oauth/error?error=connect_failed`;
+          return;
+        }
         popup.close();
         setConnectError('com_ui_pr_account_connect_error');
       },
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 043615ad940..4e8d3303f35 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -321,7 +321,7 @@ describe('ConnectedAccounts', () => {
     expect(popup.location.href).toBe('');
   });
 
-  it('closes the window when the connection fails after Settings closed', async () => {
+  it('shows the sign-in error page in the window when the connection fails after Settings closed', async () => {
     const popup = fakeWindow();
     openSpy.mockReturnValue(popup as unknown as Window);
     mockGetConnection.mockResolvedValue(connection(false));
@@ -336,7 +336,9 @@ describe('ConnectedAccounts', () => {
     unmount();
     fail(new Error('500'));
 
-    await waitFor(() => expect(popup.close).toHaveBeenCalledTimes(1));
+    /** The row is gone, so the window explains the failure instead of vanishing. */
+    await waitFor(() => expect(popup.location.href).toBe('/oauth/error?error=connect_failed'));
+    expect(popup.close).not.toHaveBeenCalled();
   });
 
   it('refreshes pull requests when the sign-in finishes after Settings closed', async () => {
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 79365b8c7b2..8c05b1dc76b 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -208,6 +208,25 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it('still reads a settlement announced just after the flow expired', async () => {
+    const { client, invalidate } = setup();
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 1 * MINUTE,
+      flowId: 'flow-a',
+    });
+    await pass(1 * MINUTE + 10_000);
+    /** The callback was accepted just before expiry and announces only now. */
+    mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
+    invalidate.mockClear();
+    announceOAuthSettled({ outcome: 'succeeded', flowId: 'flow-a' });
+    await pass(PULL_REQUEST_CONNECT_POLL_MS);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+    const asked = mockGetConnection.mock.calls.length;
+    await pass(10 * MINUTE);
+    expect(mockGetConnection).toHaveBeenCalledTimes(asked);
+  });
+
   it('gives up a settled sign-in whose status cannot be read once the grace passes', async () => {
     const { client } = setup();
     watchPullRequestSignIn(client, {
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index e29766198c7..fb01ad87da0 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -135,6 +135,10 @@ export function watchPullRequestSignIn(
     if (!isSettlement(settlement) || settlement.outcome === 'succeeded') {
       if (isSettlement(settlement) && flowId != null && settlement.flowId === flowId) {
         settled = true;
+        resume();
+      }
+      if (lapsed) {
+        return;
       }
       void check(true);
       return;
@@ -146,24 +150,40 @@ export function watchPullRequestSignIn(
        *  leaves it to the timer, focus and expiry like any other. */
       failed = true;
       settled = true;
+      resume();
       void check(true);
     }
   };
   const channel =
     typeof BroadcastChannel === 'undefined' ? null : new BroadcastChannel(OAUTH_SETTLED_CHANNEL);
   channel?.addEventListener('message', onSettled);
+  /** Past the flow's expiry, unsettled: no more polling, but the sign-in page may still announce
+   *  a callback the server accepted just before expiry, so the channel stays open for the grace. */
+  let lapsed = false;
   let expiry: ReturnType<typeof setTimeout> = setTimeout(
     () => {
       if (!settled) {
-        stop();
-        return;
+        lapsed = true;
+        clearTimeout(timer);
+        window.removeEventListener('focus', onSignal);
       }
-      /** Settled but not yet read back: keep retrying for a bounded grace, then give up. */
+      /** Settled but not yet read back, or not settled yet: a bounded grace, then give up. */
       expiry = setTimeout(() => stop(), PULL_REQUEST_SETTLED_GRACE_MS);
     },
     Math.max(0, expiresAt - Date.now()),
   );
 
+  /** A settlement announced during the grace resumes reading until a read succeeds. */
+  const resume = () => {
+    if (!lapsed || stopped) {
+      return;
+    }
+    lapsed = false;
+    wait = PULL_REQUEST_CONNECT_POLL_MS;
+    schedule();
+    window.addEventListener('focus', onSignal);
+  };
+
   function stop() {
     stopped = true;
     clearTimeout(timer);

From e223d57e4ea75f84f8e9f29003ba5c5636ffca1d Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 12 Oct 2026 19:42:11 +0200
Subject: [PATCH 30/30] fix: Listen Until a Sign-In Settles and Keep Focus
 After a Dismissed Disconnect

---
 .../Nav/Settings/ConnectedAccounts.tsx        | 14 ++++++++++
 .../__tests__/ConnectedAccounts.spec.tsx      | 27 ++++++++++++++++++-
 .../data-provider/PullRequest/signIn.test.ts  | 23 ++++++++++++++++
 .../src/data-provider/PullRequest/signIn.ts   | 18 ++++++++++---
 4 files changed, 77 insertions(+), 5 deletions(-)

diff --git a/client/src/components/Nav/Settings/ConnectedAccounts.tsx b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
index e9a9a13616f..3dc0c953eed 100644
--- a/client/src/components/Nav/Settings/ConnectedAccounts.tsx
+++ b/client/src/components/Nav/Settings/ConnectedAccounts.tsx
@@ -77,6 +77,15 @@ export default function ConnectedAccounts() {
     mounted.current = true;
     return () => {
       mounted.current = false;
+      /** A status that hides the row while a handoff is armed takes the focused button with it. */
+      if (keepFocus.current) {
+        const fallback = fallbackRef.current;
+        setTimeout(() => {
+          if (document.activeElement == null || document.activeElement === document.body) {
+            fallback?.focus();
+          }
+        }, 0);
+      }
     };
   }, []);
 
@@ -291,6 +300,11 @@ export default function ConnectedAccounts() {
         if (!open && disconnectMutation.isLoading) {
           return;
         }
+        /** Dismissed after a failed disconnect whose status read is still out: that read may
+         *  replace or hide the trigger focus returns to, so the handoff stays armed. */
+        if (!open && disconnectFailed) {
+          keepFocus.current = true;
+        }
         setConfirmOpen(open);
         setDisconnectFailed(false);
       }}
diff --git a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
index 4e8d3303f35..c2c3f86450e 100644
--- a/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
+++ b/client/src/components/Nav/Settings/__tests__/ConnectedAccounts.spec.tsx
@@ -2,7 +2,7 @@ import React from 'react';
 import '@testing-library/jest-dom';
 import userEvent from '@testing-library/user-event';
 import { QueryKeys } from 'librechat-data-provider';
-import { render, screen, waitFor } from '@testing-library/react';
+import { act, render, screen, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { TPullRequestConnection, TStartupConfig } from 'librechat-data-provider';
 import { usePullRequestConnectionStatus } from '~/data-provider/PullRequest/connection';
@@ -535,6 +535,31 @@ describe('ConnectedAccounts', () => {
     );
   });
 
+  it('hands focus on when a dismissed failed disconnect turns out to have ended the connection', async () => {
+    mockGetConnection.mockResolvedValue(connection(true));
+    mockDisconnect.mockRejectedValue(new Error('500'));
+    renderRow();
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: /com_ui_pr_account_disconnect_aria/ }),
+    );
+    /** The status read after the failure is slow. */
+    let answer: (status: TPullRequestConnection) => void = () => undefined;
+    mockGetConnection.mockImplementation(() => new Promise((resolve) => (answer = resolve)));
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'com_ui_pr_account_disconnect' }),
+    );
+    expect(await screen.findByRole('alert')).toHaveTextContent(
+      'com_ui_pr_account_disconnect_error',
+    );
+    await userEvent.click(screen.getByRole('button', { name: 'com_ui_cancel' }));
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument());
+
+    act(() => answer(connection(false)));
+    const connect = await screen.findByRole('button', { name: /com_ui_pr_account_connect_aria/ });
+    await waitFor(() => expect(connect).toHaveFocus());
+  });
+
   it('keeps the error when the status read after a failed disconnect still shows the grant', async () => {
     mockGetConnection.mockResolvedValue(connection(true));
     mockDisconnect.mockRejectedValue(new Error('500'));
diff --git a/client/src/data-provider/PullRequest/signIn.test.ts b/client/src/data-provider/PullRequest/signIn.test.ts
index 8c05b1dc76b..3ac218dfc7a 100644
--- a/client/src/data-provider/PullRequest/signIn.test.ts
+++ b/client/src/data-provider/PullRequest/signIn.test.ts
@@ -227,6 +227,29 @@ describe('watchPullRequestSignIn', () => {
     expect(mockGetConnection).toHaveBeenCalledTimes(asked);
   });
 
+  it('still hears a failure that settles after the grant already showed connected', async () => {
+    const { client, invalidate } = setup();
+    watchPullRequestSignIn(client, {
+      startedIn: pullRequestSignInSession(),
+      expiresAt: Date.now() + 60 * MINUTE,
+      flowId: 'flow-a',
+    });
+    /** A poll sees the grant the callback stored before its final check. */
+    mockGetConnection.mockResolvedValue({ ...connection(true), flowId: 'flow-a' });
+    await focus();
+    const polled = mockGetConnection.mock.calls.length;
+    await pass(10 * MINUTE);
+    expect(mockGetConnection).toHaveBeenCalledTimes(polled);
+
+    /** The callback then removes it and lands on the error page for this flow. */
+    mockGetConnection.mockResolvedValue(connection(false));
+    invalidate.mockClear();
+    announceOAuthSettled({ outcome: 'failed', flowId: 'flow-a' });
+    await pass(0);
+    expect(mockGetConnection).toHaveBeenCalledTimes(polled + 1);
+    expect(invalidate).toHaveBeenCalledWith([QueryKeys.conversationPullRequest]);
+  });
+
   it('gives up a settled sign-in whose status cannot be read once the grace passes', async () => {
     const { client } = setup();
     watchPullRequestSignIn(client, {
diff --git a/client/src/data-provider/PullRequest/signIn.ts b/client/src/data-provider/PullRequest/signIn.ts
index fb01ad87da0..c7ebe9774bf 100644
--- a/client/src/data-provider/PullRequest/signIn.ts
+++ b/client/src/data-provider/PullRequest/signIn.ts
@@ -117,8 +117,13 @@ export function watchPullRequestSignIn(
     /** Every answer, so an account removed elsewhere mid-flow also refreshes pull requests. */
     syncPullRequestConnection(queryClient, status);
     const ours = flowId == null || status.flowId == null || status.flowId === flowId;
-    if (failed || settled || (status.connected && ours)) {
+    if (failed || settled) {
       stop();
+    } else if (status.connected && ours) {
+      /** Connected, but the sign-in page has not settled: the callback can still fail after
+       *  storing (a disconnect racing it, say), so polling ends while the channel keeps
+       *  listening until it settles or the grace passes. */
+      quiet();
     }
   };
 
@@ -163,9 +168,7 @@ export function watchPullRequestSignIn(
   let expiry: ReturnType<typeof setTimeout> = setTimeout(
     () => {
       if (!settled) {
-        lapsed = true;
-        clearTimeout(timer);
-        window.removeEventListener('focus', onSignal);
+        quiet();
       }
       /** Settled but not yet read back, or not settled yet: a bounded grace, then give up. */
       expiry = setTimeout(() => stop(), PULL_REQUEST_SETTLED_GRACE_MS);
@@ -173,6 +176,13 @@ export function watchPullRequestSignIn(
     Math.max(0, expiresAt - Date.now()),
   );
 
+  /** Stops polling and focus checks, keeping the announcement channel open. */
+  function quiet() {
+    lapsed = true;
+    clearTimeout(timer);
+    window.removeEventListener('focus', onSignal);
+  }
+
   /** A settlement announced during the grace resumes reading until a read succeeds. */
   const resume = () => {
     if (!lapsed || stopped) {