fix(search): close Slack and desktop source-connect review gaps

[waleedlatif1]

Summary

Follow-ups to the release review for the Slack Search, managed Slack, and desktop source-connect paths.

Fixed

• Slack Search OAuth start ignored cancellation (release review: hooks/queries/slack-search.ts). The browser branch of useStartSlackSearchOAuth dropped the signal the mutation accepts, so closing or unmounting the wizard could not cancel an in-flight start. It is now forwarded to requestJson, matching the desktop branch and the personal-search hook.
• Signed-out managed Slack callback showed the generic failure (release review: app/credential-groups/slack-complete/page.tsx). The managed-users callback redirected with reason=unauthenticated, but the completion page and the desktop handoff (lib/desktop/source-browser.ts, lib/desktop/source-connect.ts) only recognize signin_required. The callback now sends signin_required, so a signed-out user gets the sign-in-and-restart guidance. The only other 'unauthenticated' consumer (hooks/mcp/use-mcp-oauth-popup.ts) belongs to the MCP popup and is unaffected.
• Desktop source-connect parsed up to the global JSON limit (release review: app/api/desktop/source-connect/route.ts). The route parsed bodies up to the default 50 MiB before the use case applied its 32 KiB ticket limit. It now sets parseOptions.maxBodyBytes: 64 * 1024, so oversized bodies get a 413 at the parser. Valid requests are well under that limit and behave the same.

Not changed

• Zoom rollout skips workspaces without an organization (lib/sim-search/live/provider-rollout.ts). Not a real issue. Every Zoom Search path runs through connected accounts (credential groups). resolveCredentialGroupsAvailability in lib/credential-groups/availability.ts returns feature_disabled for any scope without an organization, so evaluating the Zoom flag globally for those workspaces could never enable anything.
• Desktop connect can start twice before inventory reflects completion (hooks/use-search-integration-connection.ts). Not a real issue. On desktop, mutateAsync resolves only after OAuth completes. isPending guards the click while it is in flight. TanStack Query awaits the mutation's onSettled before it resolves mutateAsync (query-core Mutation.execute), and that onSettled awaits the inventory invalidation. So by the time the click guard is released, connected already reflects the new account.
• The Zoom approval recheck, bounded MCP serialization, and ZOOM_SEARCH in .env.example are handled in fix(search): recheck Zoom approval and bound MCP serialization #8496 and are left out here to avoid overlap.

Type of Change

• Bug fix

Testing

• Three new regression tests: the signed-out managed Slack callback redirects with signin_required, a 256 KiB source-connect body gets a 413, and aborting the signal rejects an in-flight browser Slack OAuth start.
• With each source fix reverted, its test fails. Restored, all three pass.
• bun run lint, bun run type-check (apps/sim), bun run check:audits (52/52)
• Manual desktop and Slack sign-in run-through (not performed)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 1, 2026 1:27am UTC

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Fixes auth checks and request handling in Slack and desktop integrations.

The PR appears safe to merge; no actionable new failure or outstanding previous finding remains.

Summary

This PR closes three source-connect gaps:

• Forwards cancellation to browser Slack Search OAuth starts.
• Gives signed-out managed Slack callbacks the reason recognized by recovery screens.
• Caps desktop source-connect parsing at 64 KiB and adds regression tests.

_{Reviews (2) · Last reviewed commit: "fix(search): close Slack and desktop sou..."}

[waleedlatif1]

@greptile

[waleedlatif1]

Closing as superseded: #8497 already merged the same three fixes (Slack search abort signal, source-connect body limit, managed-callback sign-in reason) with tests, plus the desktop double-connect guard.