fix(config): open the oauth-url link in the browser and print it unwrapped (SUPPORT-17391)

[ZoraJel]

Summary

SUPPORT-17391: config oauth-url prints a ~200-char URL, so it fits no terminal row, and the wrapped copy is what users actually follow. Two layers truncate it — Rich inserted real newlines at the console width, and terminals/chat renderers autodetect URLs per visual row — and both lose the config id in the trailing #/<component>/<config> fragment while keeping token/sapiUrl. The wizard therefore authenticates and then 404s on the configuration, reporting Failed to load config data. Please contact us on support@keboola.com, which reads like a broken OAuth flow.

Nothing printed can fix a renderer we don't control, so the command opens the link itself and keeps the text as a copy fallback:

-formatter.console.print(f"  [link]{result['url']}[/link]")   # style tag, not a hyperlink; hard-wrapped
+formatter.console.print(url, soft_wrap=True, highlight=False, markup=False)
+if _should_open(no_open=no_open, is_terminal=formatter.console.is_terminal) and open_browser(url):
+    ...  # "Opened in your default browser"

_should_open is interactive-only: --json returns before it, a non-terminal stdout (pipe, CI, serve) never opens a window, and --no-open opts out when authorizing on another machine. JSON output is unchanged.

auth.environment.open_browser gains the WSL branch it lacked. webbrowser keys its Windows handling off sys.platform == "win32", which is linux inside WSL, so it either resolved no handler (→ False, no browser) or opened a Linux-side browser with a separate profile that shares none of the logins the flow needs. wslview was already probed here for the login-flow heuristics but never used to open anything:

if _env_flag_set("WSL_INTEROP") and _wslview_is_working():
    return _open_via_wslview(url)   # synchronous: the exit status is the answer

Skill docs: a new references/oauth-workflow.md (generate → consent → verify oauth_api.version bumped) whose reporting rule is the other half of the fix — an agent answering in chat must echo the URL in a fenced code block, never as inline prose, because that is the surface where per-row link detection truncates it. Plus the oauth-url row in commands-reference.md and a gotchas entry recording the symptom.

Unchanged on purpose: the 1 h token TTL (the UI mints 48 h) and the absence of a config preflight before minting.

Release Notes

Justification, description

kbagent config oauth-url handed out a link that terminals and chat renderers truncate at the first visual row, dropping the configuration id and failing in the browser with "Failed to load config data". The command now opens the link in the default browser itself (interactive use only; --no-open to suppress) and prints the complete URL unwrapped. Includes a WSL fix so the Windows-side default browser is used instead of none, and a skill workflow telling agents to echo the URL in a fenced code block.

Plans for Customer Communication

N/A

Impact Analysis

config oauth-url in interactive human mode now opens a browser window as a side effect. --json and non-terminal stdout are unaffected, so scripted, piped and server callers see no change; the response payload is identical.

Deployment Plan

Ships with the next kbagent release.

Rollback Plan

Revert the commits; --no-open reproduces the previous behavior in the meantime.

Post-Release Support Plan

N/A

Link to Devin session: https://app.devin.ai/sessions/e0d8eb25504b4b7cb6b1f9c354d448e3
Open in Devin Desktop: https://app.devin.ai/desktop/session/e0d8eb25504b4b7cb6b1f9c354d448e3?variant=devin
Requested by: @ZoraJel

Update 2026-10-10

• Merged main (0.98.0). make check passes.
• The command waits up to 2 s for the browser opener before it exits, like data-app password --open. Before, the process could exit before the opener thread ran, and the command reported an open that did not happen. A new test covers a slow opener.
• --json output has a new key, browser_opened. It is always false, because --json never opens a browser. The other keys are unchanged. This replaces "JSON output is unchanged" above.
• oauth-workflow.md and the SKILL.md row: the agent tells the user that the link is open only when browser_opened is true. The agent verifies the authorization by a higher configuration version, not by oauth_api.version.
• The WSL open through wslview runs on the same background thread as the webbrowser open and follows the caller's wait. auth login does not wait, as before this PR. config oauth-url waits up to 2 s. Like the webbrowser path, open_browser returns true when the open started, not when the browser accepted the URL.
• [--no-open] is in the config oauth-url line of context.py and CLAUDE.md. tests/test_oauth_workflow_doc.py checks the verify step of oauth-workflow.md.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[keboola-pr-reviewer-bot]

Verdict: auto_approve (risk 2/5) · profile keboola-mcp-server

Well-tested CLI bug fix for oauth-url URL truncation; auto-opens the browser only in interactive human mode, fully gated and reversible.

Impact flags: possible rollback re-introduction — see Check Run summary.

Concerns:

• CLAUDE.md: config oauth-url command list entry not updated with new --no-open flag (convention #17 drift)

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session

[soustruh]

Review of the diff against main. Two non-blocking findings and one low-severity note. No blocking findings.

Checked and fine:

• The open is interactive-only: --json returns before it, a non-terminal stdout never opens, and --no-open opts out. browser_opened is always false under --json.
• The URL is printed with soft_wrap=True, markup=False, so it is not wrapped and a literal [ in it is not read as markup.
• The vNEXT tags in oauth-workflow.md, SKILL.md, commands-reference.md and gotchas.md match the code. The related tests fail on regression. The affected test files pass locally (138 passed).

Non-blocking:

• src/keboola_agent_cli/commands/context.py:577 and CLAUDE.md:558 still list config oauth-url without --no-open. These are two of the silent-drift places in the plugin synchronization map. Add [--no-open] to both.
• The new WSL branch in open_browser also runs for auth login (via auth_service, default wait_seconds=0). Before, the open was fire-and-forget on a thread. Now it is synchronous, up to 10 s, before the login loop starts polling. See the inline comment.

Low severity:

• data-app password --open is opt-in, and config oauth-url opens by default with --no-open to opt out. The interactive-only gate makes this defensible, but the two commands now differ for the same action.
• Wording: the new docstring and docs use "mint" as a verb ("Mints a short-lived ...", "The minted token") in _config_oauth.py and oauth-workflow.md. "Generates" or "created" is plainer.

Dismissing prior approval — a new commit was pushed and this review was for an earlier SHA. Run @keboola-pr-reviewer-bot review to get a fresh verdict.

[keboola-pr-reviewer-bot]

New commit on d2ef6fe — dismissed 1 stale bot approval. Comment @keboola-pr-reviewer-bot review when you want a fresh review.

[keboola-pr-reviewer-bot]

Verdict: auto_approve (risk 2/5) · profile keboola-mcp-server

Well-tested UX fix: config oauth-url now opens the link interactively and prints it unwrapped, plus a WSL browser-open fix.

[zajca]

Actionable findings from the automated review.

Dismissing prior approval — a new commit was pushed and this review was for an earlier SHA. Run @keboola-pr-reviewer-bot review to get a fresh verdict.

[keboola-pr-reviewer-bot]

New commit on 7ca73e1 — dismissed 1 stale bot approval. Comment @keboola-pr-reviewer-bot review when you want a fresh review.