fix(web): revoke confirm and expiry display for MCP/agent tokens

[Kathircpe]

Summary

Aligns MCP Tokens (Settings → MCP Tokens) with agent tokens (Add Connection → Via Agent): same !confirm() revoke guard and explicit Expires <date> in both token lists.

Changes

• McpTokensPanel: add !confirm() revoke guard matching agent pattern
• Show explicit Expires date in MCP + agent token rows (Created · Expires · Last used)
• Tests: confirm accept calls revoke, cancel skips revoke

Checklist

• Unit / integration tests added
• Docs added / updated
• Roborev review passed — run roborev review --branch or /roborev-review-branch in Claude Code (internal)
• Competitive analysis done / discussed (internal)
• Blog post about it discussed (internal)

Summary by CodeRabbit

• New Features

  • Agent and MCP token listings now display each token’s expiration date alongside creation and last-used dates.
  • Revoking an MCP token now requires confirmation before proceeding.

• Bug Fixes

  • Cancelling the revocation confirmation now correctly prevents the token from being revoked.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5cfc3a70-094f-4154-9c09-73b003a7a7ee

📥 Commits

Reviewing files that changed from the base of the PR and between a35fed9 and 6260516.

📒 Files selected for processing (3)

• apps/web/src/components/ConnectionSelector.tsx
• apps/web/src/components/pages/settings/McpTokensPanel.test.tsx
• apps/web/src/components/pages/settings/McpTokensPanel.tsx

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds expiration dates to agent and MCP token metadata. MCP token revocation now requires confirmation, with tests covering accepted and cancelled confirmations.

Changes

Token management

Layer / File(s)	Summary
Token expiration metadata apps/web/src/components/ConnectionSelector.tsx, apps/web/src/components/pages/settings/McpTokensPanel.tsx	Agent and MCP token entries display expiration dates with creation and last-used dates.
MCP revoke confirmation apps/web/src/components/pages/settings/McpTokensPanel.tsx, apps/web/src/components/pages/settings/McpTokensPanel.test.tsx	Revocation now requires confirmation. Tests verify both confirmed and cancelled revocations.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: jamby77

Merge Risk: ⚪ Minimal · up to 62605

The change adds token expiry displays and confirmation before MCP token revocation, with no unresolved merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description includes the required Summary, Changes, and Checklist sections. It clearly describes the revoke confirmation, expiry display, and tests. The checklist accurately marks tests as added; …
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: revoke confirmation and expiry display for MCP and agent tokens.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

apps/web/src/components/ConnectionSelector.tsx

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

apps/web/src/components/pages/settings/McpTokensPanel.test.tsx

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

apps/web/src/components/pages/settings/McpTokensPanel.tsx

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Kathircpe]

LGTM

[KIvanow]

LGTM. Confirmed the expiresAt render is type-safe (non-nullable number on the shared TokenListItem) and ran the suite locally: all 15 tests pass including the two new confirm-accept/cancel cases. Nice consistency fix.