test(mship): cover the announcement surviving an early popup release

The success toast is gated on the launched-attempt ref rather than the window
handle; nothing pinned that. Adds the regression test, and trims the comment
duplication the fix left behind.

Author: waleedlatif1

apps/sim/app/oauth/chat-complete/chat-complete-handoff.tsx

@@ -26,24 +26,19 @@ function sanitizeReturnTo(raw: string | null): string | null {
 /**
  * Behavior half of the chat OAuth return leg: publishes the verdict to the
  * attempt record — which the chat tab's chip picks up over its storage
- * listener — then closes the window. Renders nothing, so the page's frame is
- * plain server-rendered markup that paints before this hydrates.
+ * listener — then closes the window. Renders nothing, so the page's frame
+ * paints as server markup before this hydrates.
  *
- * Reaching this page IS the verdict. Better Auth routes a flow here only as
- * its success `callbackURL`, sending failures to `onAPIError.errorURL`
- * (`/oauth-error`) or back here with an `error` code, so the server has
- * already decided by the time this runs. That is a strictly better signal than
- * the credential diffing the generic-page return does: re-authorizing an
- * already-linked account updates the account row instead of creating one, so
- * no new credential appears and a diff would call a perfectly good connect a
- * failure.
+ * Reaching this page IS the verdict: Better Auth routes a flow here only as its
+ * success `callbackURL`, sending failures to `/oauth-error` or back here with
+ * an `error` code. That beats diffing the credential list, which calls a
+ * re-authorized account a failure — that path updates the existing account row
+ * and creates nothing for a diff to find.
  *
- * A window the browser refuses to close redirects on to the chat surface
- * instead. That is the popup-blocked path: the anchor's `target='_blank'`
- * opens this leg in a new tab, which no script may close. That URL
- * deliberately carries no attempt id — the verdict is already published, and
- * the destination's return router would otherwise re-decide it by the very
- * diff this page exists to avoid.
+ * A window the browser refuses to close redirects to the chat instead (the
+ * popup-blocked path opens this leg in a tab, which no script may close). That
+ * URL carries no attempt id on purpose: the verdict is already published, and
+ * the destination would otherwise re-decide it by the very diff above.
  */
 export function ChatCompleteHandoff() {
   const ranRef = useRef(false)

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.test.tsx

@@ -582,6 +582,47 @@ describe('CredentialDisplay link tag', () => {
     act(() => root.unmount())
   })
 
+  it('still announces the connection when the watcher released the popup first', async () => {
+    // The watcher drops the window handle as soon as it stops being observable,
+    // which routinely happens before React applies the storage-driven verdict.
+    // The announcement has to survive that, so it cannot be gated on the handle.
+    vi.useFakeTimers()
+    const toastSuccess = vi.spyOn(toast, 'success').mockImplementation(() => '')
+    const popup = { focus: vi.fn(), closed: false }
+    const openSpy = vi
+      .spyOn(window, 'open')
+      .mockReturnValue(popup as unknown as ReturnType<typeof window.open>)
+    const { container, root } = renderCredentialLink({
+      type: 'link',
+      provider: 'google-email',
+      value:
+        'https://sim.test/api/auth/oauth2/authorize?providerId=google-email&callbackURL=https%3A%2F%2Fsim.test%2Fworkspace%2Fworkspace-1%2Fchat%2Fchat-1',
+    })
+
+    await act(async () => {
+      container
+        .querySelector('a')
+        ?.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true }))
+    })
+    const attemptId = new URL(
+      new URL(openSpy.mock.calls[0][0] as string).searchParams.get('callbackURL') ?? ''
+    ).searchParams.get('oauthAttempt') as string
+
+    popup.closed = true
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(2000)
+    })
+    await act(async () => {
+      setOAuthChatAttemptStatus(attemptId, 'connected')
+    })
+
+    expect(toastSuccess).toHaveBeenCalledWith('Gmail connected successfully.')
+    vi.useRealTimers()
+    openSpy.mockRestore()
+    toastSuccess.mockRestore()
+    act(() => root.unmount())
+  })
+
   it('focuses the live popup instead of starting a rival attempt on a repeat click', async () => {
     const toastSuccess = vi.spyOn(toast, 'success').mockImplementation(() => '')
     const popup = {

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/use-oauth-chip-connection.ts

@@ -406,9 +406,6 @@ export function useOAuthChipConnection({
     const launchedAttemptId = launchedAttemptIdRef.current
     if (connectionStatus !== 'connected' || !launchedAttemptId) return
     const attempt = readOAuthChatAttempt(launchedAttemptId)
-    // Tracked separately from `popupRef`, which the watcher clears the moment
-    // the window looks finished — often before React has applied the
-    // storage-driven verdict, which would swallow the announcement.
     launchedAttemptIdRef.current = null
     popupRef.current = null
     // The verdict settles the label, but the lock also waits on the credential