From 95b45f1acde8e5ede75da8aab7dc9477fe0b7d81 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 16 Sep 2026 11:05:11 +0200
Subject: [PATCH] fix: withhold the MCP URL until a workspace is picked

With no persisted workspace the store starts undefined, so opening the drawer from
/user/workspaces before choosing one rendered a copyable
`/api/mcp/w/undefined/mcp`. It reads like a real URL and a client pointed at it
would never connect. The panel now asks for a workspace instead, matching the guard
the token branch already has on its generate button.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../components/settings/CreateToken.svelte    | 27 ++++++++++++-------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index 259c7eae2e..1db9bda07b 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -164,12 +164,17 @@
 	const scopeWorkspaceId = $derived(
 		isAllWorkspaces ? $workspaceStore || '' : newTokenWorkspace || $workspaceStore || ''
 	)
+	// Undefined wherever the workspace is: `/api/mcp/w/undefined/mcp` reads like a real URL
+	// and is copyable, so the OAuth panel withholds it rather than showing a broken one. The
+	// token branch guards the same case by disabling its generate button.
 	const mcpUrl = $derived(
 		isAllWorkspaces
 			? `${window.location.origin}/api/mcp/gateway`
-			: `${window.location.origin}/api/mcp/w/${newTokenWorkspace}/mcp`
+			: newTokenWorkspace
+				? `${window.location.origin}/api/mcp/w/${newTokenWorkspace}/mcp`
+				: undefined
 	)
-	const mcpBaseUrl = $derived(`${mcpUrl}?token=`)
+	const mcpBaseUrl = $derived(`${mcpUrl ?? ''}?token=`)
 
 	$effect(() => {
 		const requestedMcpMode = mcpOnly || openWithMcpMode
@@ -254,14 +259,18 @@
 				</div>
 			{/if}
 
-			<CopyableCodeBlock code={mcpUrl} language={shell} wrap />
+			{#if mcpUrl}
+				<CopyableCodeBlock code={mcpUrl} language={shell} wrap />
 
-			<div class="mt-2">
-				<Alert type="info" title="This instance requires MCP clients to sign in" size="xs">
-					Paste this URL into your client. It opens a Windmill page where you approve the access it
-					asks for, and no token needs to be copied around.
-				</Alert>
-			</div>
+				<div class="mt-2">
+					<Alert type="info" title="This instance requires MCP clients to sign in" size="xs">
+						Paste this URL into your client. It opens a Windmill page where you approve the access
+						it asks for, and no token needs to be copied around.
+					</Alert>
+				</div>
+			{:else}
+				<p class="text-xs text-tertiary">Pick a workspace to get its MCP URL.</p>
+			{/if}
 
 			{#if !mcpOnly}
 				<div class="mt-4 flex justify-end gap-2 flex-row">