feat(mcp): add OAuth DCR UI support

[pratistha19]

Description

Fix OAuth callback postMessage handling, clean up sub-agent UI, and resolve duplicate endpoint / hardcoded URL issues.

Changes

• InterruptBanner.tsx: Remove event.origin check on postMessage listener — callback popup may originate from a different host behind a proxy; PKCE + state parameter provide the security guarantee instead
• SubAgentIndicator.tsx: Remove HITL approve/reject/always-allow buttons from sub-agent cards — approval is handled at the interrupt banner level, not per-tool-call
• ChatMessagesView.tsx: Remove unused pendingInterrupt/onInterruptResume/onAlwaysAllow props from SubAgentIndicator
• StreamingManager.ts: Fix resume: pass original message when no decisions instead of sending empty decisions array
• api.router.ts: Remove duplicate /version endpoint, consolidate into single one with buildHash/buildTime/environment
• settings.ts: Generic error message for missing config file instead of hardcoded /opt/app-root/src/config
• index.html: Change apiUrl from "http://localhost:5002" to "" (relative) — works on all environments without hardcoded host
• vite.config.ts: Fix dev proxy target from port 8080 to 5003 (correct Fastify server port)
• package-lock.json: Version bump to 0.1.0, add remark-gfm dependency

Summary by CodeRabbit

• Bug Fixes

  • Improved chat continuation so resuming without decisions correctly preserves the original request.
  • Simplified delegated-task status indicators for a clearer, consistent processing display.
  • Improved configuration error messages with clearer guidance for deployment setup.

• Deployment

  • Updated application configuration to support deployment behind the configured server environment rather than relying on local development addresses.

• Release

  • Updated the application version to 0.1.0.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 62223b9b-0fb3-4aec-a7fa-c618d20bc3a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR removes sub-agent approval controls, changes resume payload behavior, removes MCP OAuth origin validation, updates frontend proxy and API configuration, revises configuration guidance, and bumps the package version.

Changes

Integration and runtime updates

Layer / File(s)	Summary
Runtime configuration and deployment endpoints index.html, vite.config.ts, src/server/utils/settings.ts, package.json	The frontend uses a relative API URL. Development proxies target port 5003. Configuration errors reference ConfigMap or volume mounting. The package version is 0.1.0.
Sub-agent approval removal and resume handling src/frontend/components/SubAgentIndicator.tsx, src/frontend/components/ChatMessagesView.tsx, src/frontend/components/__tests__/accessibility.test.tsx, src/frontend/lib/streaming/StreamingManager.ts	SubAgentIndicator no longer tracks or renders interrupt approval controls. Its caller no longer passes approval callbacks. Related accessibility tests were removed. Resume requests use the original message when decisions are absent.
MCP OAuth message handling src/frontend/components/InterruptBanner.tsx	MCP OAuth completion messages are handled without checking window.location.origin.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• redhat-data-and-ai/template-ui#108 — The issue covers the OAuth handling, sub-agent UI cleanup, resume flow, and deployment URL changes in this PR.

Suggested reviewers: np-compete, anish701

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies OAuth DCR UI support, which is the primary purpose of the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[NP-compete]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[NP-compete]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.