fix(mcp): make needs-auth hint accessible

[adiarora06]

Problem / Motivation

The authorization-status explanation was stored only in a native title on a non-focusable badge, so keyboard, touch, and assistive-technology users could not reliably reach it.

Why it matters

This is the only default-reachable explanation of the OAuth probe limitation. Without it, the status badge gives users no accessible way to learn whether sign-in is required, present but unverifiable, or unknown.

What changed (motivation → approach → change)

Keep the evidence-based status label and tone from current main, but move every needs_auth explanation into the repository's focusable InfoTip helper. Keyboard, touch, pointer, and assistive-technology users now share one help affordance for the needs-auth hint.

Since this branch was cut, main gave the ok status its own hover hint ("Online" is a host check) delivered via the badge title and pinned by a test. The badge therefore keeps its title for every status except needs_auth, where InfoTip is the sole affordance — the title is suppressed only where the InfoTip replaces it, not removed unconditionally.

Tests

• Updated McpTab.test.tsx for unknown, sign-in-required, and signed-in authorization states.
• Verified the needs_auth badge carries no duplicate native title and the InfoTip exposes the correct explanation; other statuses keep their title hints (main's "Online is a host check" test passes unchanged).
• npm exec -- vitest run src/test/McpTab.test.tsx (28 passed).

Manual verification

Verified the production component preserves current-main authorization labels while rendering the focusable help control only for needs_auth states.

Screenshots / video

Related Issues

Fixes #3626

Pattern harvest

Not generalizable: the fix relocates one status hint to the repo's existing InfoTip affordance; no reusable rule emerges beyond the already-documented "hover-only title is not an accessible affordance", which #3626 tracks.

Checklist

• At most two commits (one is the norm), with a Conventional Commits title (feat|fix|docs|refactor|perf|test|chore|ci|build|revert: ...)
• Existing tests pass and new tests added for new functionality
• Self-review completed; code follows project style guidelines
• Documentation updated (N/A — no documentation surface changed)
• No secrets, credentials, or internal references in the diff

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[github-actions]

GPT 5.6 Review (fork) — ✅ no blocking findings

Reviewed d502969fa2cf6855401fa6b00a1b78d7f036ee1d via the fork AI-review pipeline; updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] d502969

[github-actions]

Design Review (Fable 5, fork) — ✅ PASS

Design-level review of d502969fa2cf6855401fa6b00a1b78d7f036ee1d via the fork AI-review pipeline — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

Real accessibility gap, fixed at the root by relocating the hint onto the repo's existing focusable InfoTip affordance — proportionate and well-scoped.

Suggestions

• The ok status's host-check caveat still rides a hover-only title — the identical reachability gap this PR names — so file a follow-up to migrate it to the same InfoTip pattern rather than leaving the panel with two hint affordances permanently.

[DESIGN-REVIEWED] d502969

[github-actions]

Opus 4.8 Review (fork) — ✅ no blocking findings

Reviewed d502969fa2cf6855401fa6b00a1b78d7f036ee1d via the fork AI-review pipeline; updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] d502969

[github-actions]

UX Review (Fable 5, fork) — ✅ PASS

UX-level review of d502969fa2cf6855401fa6b00a1b78d7f036ee1d via the fork AI-review pipeline — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

UX-Verdict: PASS

Moves a decision-critical hint from an unreachable hover title to the product's established, focusable InfoTip — strictly widens who can read it, with correct layering intact.

[UX-REVIEWED] d502969

[github-actions]

First Principles Review (Fable 5, fork) — 🟡 CONCERNS

Premise-level review of d502969fa2cf6855401fa6b00a1b78d7f036ee1d via the fork AI-review pipeline — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

All evidence gathered. The fix uses the repo's existing InfoTip (71 usage sites), the screenshot follows the documented temp-screenshots/ convention, and mcpStatusHint in the base matches every claim in the diff comment. The one depth issue: the same root cause — a badge whose only explanation lives in a hover-only title — has three unfixed siblings in the very same file, only one of which the description declares.

First-Principles-Verdict: CONCERNS

The needs-auth fix earns its place, but the same hover-only-title root cause survives on three sibling badges in this same file.

What this change ships

Intent: make the needs-auth status explanation reachable by keyboard, touch, and assistive technology (#3626) — a FIX.

1. Needs-auth explanation now opens from a focusable, tappable "?" beside the badge — justified (reported defect needs_auth 'Not verified' hint is hover-only (inaccessible on keyboard/touch/AT) #3626).
2. Needs-auth badge loses its hover tooltip; hover moves onto the "?" — declared, part of the fix.
3. A visible "?" glyph appears in needs-auth rows — declared (screenshot).
4. All other statuses keep their title hover hints — declared, symptom-level for the ok case.
5. One screenshot under temp-screenshots/ — sanctioned by the PR-template convention.

Watch

• Point patch with counted siblings: grepping title={ in website/src/pages/overview/McpTab.tsx finds 3 more non-focusable badges whose explanation exists ONLY in a hover title — the declared badge (line 582), the ok host-check caveat (line 586), and the probe-failing badge (line 604). The description declares only the ok one, and its stated reason for leaving it — "main gave the ok status its own hover hint … pinned by a test" — is an earlier choice, not a constraint; the exact argument that justified this fix ("the only default-reachable explanation") applies to it verbatim. Fine to defer, but the deferral currently covers one sibling of three.

[FIRST-PRINCIPLES-REVIEWED] d502969

[adiarora06]

Rebased onto current main. The conflict was substantive rather than mechanical, so noting how it was resolved: upstream restructured this cell to render the "declared" case as a proper Badge variant="warn" ("Declared") instead of the small unverified text span this branch was built against. I kept upstream's structure — it's the better treatment, and its rationale (colour carries the meaning in a peripheral scan, not 11px text beside a green badge) supersedes what this branch did there.

What this PR actually contributes is unchanged and still needed: upstream's needs_auth badge carries its hint in title only, which is exactly the hover-only gap #3626 reports — unreachable by keyboard, touch, and AT. The InfoTip is re-applied alongside upstream's badge (the badge keeps its title for pointer users), scoped to needs_auth only, since that hint is the sole default-reachable explanation of the OAuth probe limitation while every other status's hint is advisory detail.

tsc --noEmit and eslint clean. Still marked draft — say the word and I'll mark it ready.

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[bolichen97]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[bolichen97]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[iamwhatever]

👋 Hi! This PR is currently in draft status. Workflow runs won't be auto-approved until it's marked as ready for review.

When you're ready, click "Ready for review" and the workflows will be approved on the next cycle automatically.

[NicholasRBowers]

🤖 Kiro Crew [operator: NicholasRBowers#a942f9ca]: This PR has been inactive for 7+ days with failing CI. I've assessed the blockers and they appear resolvable — I'll push fixes directly to this branch as a co-author.

Assessment: The CI reds are from an Aug-27 run on a stale base — the backend shard failures live in test/test_session_storage.py, which this frontend-only diff (McpTab tooltip accessibility) cannot reach. Plan: rebase onto current main, re-run the matrix, and fix any E2E locator fallout from the changed tooltip markup.

If you'd prefer I don't touch this PR, add the pr-no-autofix label.

[NicholasRBowers]

🤖 Kiro Crew [operator: NicholasRBowers#a942f9ca]

Drive-to-green update — head is now bd71dce121189a7d1425195e4ca42ff9dfe0853b:

1. Rebased onto current main (b2320e02c). The Backend Tests / Coverage Gate reds on the old head were base drift: the failing test_session_storage.py forged-dir test was fixed upstream (refs Broken on main: test_both_sites_escape_without_touching_the_filesystem TypeErrors across CI shards #6425) after this branch was cut. The frontend-only diff cannot reach those tests.
2. Restored the badge title for non-needs_auth statuses (website/src/pages/overview/McpTab.tsx). Since this branch was cut, main gave the ok status a host-check hint delivered via the badge title, pinned by the test "explains that Online is a host check…" — which the branch's unconditional title removal broke. The PR's intent is unchanged: needs_auth still renders its hint solely through the focusable InfoTip and carries no title; every other status now keeps whatever hint mcpStatusHint returns (today only ok).
3. Re-pinned the screenshot URL in the PR body to the new head and added the ## Pattern harvest section the PR Hygiene gate now requires.

Local gates: tsc -b clean; full vitest run 28471 passed with the one McpTab failure fixed and re-verified (28/28 in the file). The backend tree is byte-identical to origin/main after rebase. No Playwright spec references the MCP badges, so the stale E2E reds are expected to clear with the rebase.

Original fix by Adi Arora (@adiarora06) — authorship preserved on the commit.

[NicholasRBowers]

🤖 Kiro Crew [operator: NicholasRBowers#a942f9ca]

Round 2 — rebase-only push, head is now d502969fa2cf6855401fa6b00a1b78d7f036ee1d (diff unchanged). Triage of the three reds on bd71dce1:

1. Backend Tests (Windows) (1) — test_autonudge_stop_auth.py failures ("monitor_update cannot apply legacy fields to a structured monitor") were mid-flight main drift: the merge ref caught main between the structured-monitor landing (feat: expose session monitors to agents #5184) and its same-day fix (fix(autonudge): treat a merged subject as terminal when a paused loop's cap is raised #8201). All 50 tests in that file pass locally on current main tip (711544f3d); this PR has zero backend delta.
2. PR Hygiene — the run evaluated the event payload frozen at push time, before the body edit that added the ## Pattern harvest section. The fresh push carries the updated body.
3. Dependency Audit — npm audit timed out after 120s against the registry; infra flake, no dependency change in this PR.

No code change in this round; frontend gates re-verified after the rebase (tsc -b clean, McpTab.test.tsx 28/28). Screenshot URL re-pinned to the new head.

[NicholasRBowers]

🤖 Kiro Crew [operator: NicholasRBowers#a942f9ca]

• Point patch with counted siblings — hover-only title survives on 3 sibling badges in McpTab.tsx — disposition: accepted-and-deferred to a11y(mcp): three McpTab badges still carry hover-only title hints #8359 (label deferred-finding, assigned, Due: 2026-09-18).

The finding is legitimate: the declared badge, the ok host-check caveat, and the probe-failing badge each keep an explanation reachable only by hover, and the #3626 argument applies to them verbatim. It is deferred rather than fixed here because this is a drive-to-green pass on a contributor's PR whose mandate is to preserve the original scope (the reported needs_auth defect); widening the diff to three more badges — including updating the main-side test that pins the ok title — is a follow-up-sized change, now tracked in #8359.

[iamwhatever]

Tier 1 auto-approve: fix (3 files). Criteria: no conflict, no requested changes, security path denylist clean, design-doc gate clean, SAST annotations clean, security checklist all-NO, AI reviewers green. Category: replaces the hover-only native title hint on the MCP needs_auth badge with a focusable/tappable InfoTip so the OAuth-probe explanation is reachable by keyboard, touch and AT (#3626) -- presentation-only, no auth logic touched. CodeQL is not applicable on this fork PR (default-setup emits no check-run); SAST coverage is Semgrep only, latest run success with 0 annotations.