Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/ai-engine/src/stream.ts`:
- Around line 63-71: The current chat_auth_request event type (type:
'chat_auth_request') makes failureMessage optional even when status is 'failed';
change the type into a discriminated union on the status field so that when
status === 'failed' failureMessage is required and when status is 'pending' |
'completed' failureMessage is absent/optional. Update the definition in
packages/ai-engine/src/stream.ts (the object with type: 'chat_auth_request',
messageId, mcpServerId, mcpServerLabel, authUrl, status, failureMessage) to
split into at least two interfaces/unions keyed by status and adjust any code
that references this event type to use the new union.

In `@packages/frontend/src/components/chat/auth-request-card.test.tsx`:
- Around line 30-37: The test currently creates a spy on window.open (openSpy)
and restores it inside the test body, which can leak if the test fails; change
the setup so window.open is spied in the test but its restoration is done in a
shared afterEach teardown: create the spy (vi.spyOn(window,
'open').mockImplementation(() => null)) in the test or a beforeEach, and move
the cleanup to an afterEach that calls openSpy.mockRestore() (or call
vi.restoreAllMocks()) to ensure the mock is always removed; reference the
openSpy/window.open usage in the test that renders AuthRequestCard and fires the
click.

In `@packages/frontend/src/components/chat/auth-request-card.tsx`:
- Around line 55-62: The message embeds block.mcpServerId in free text which
lets the model pick the wrong tool; change the send path so mcpServerId is sent
as a structured field/action instead of natural language: update the call site
that invokes sendChatMessage (in auth-request-card.tsx) to include a dedicated
payload or action property (e.g., { type: "complete_authentication",
mcpServerId: block.mcpServerId, url: trimmed, label: block.mcpServerLabel }) so
the agent receives an explicit mcpServerId the chat runner
(packages/ai-engine/src/chat-runner.ts) can match to pending blocks rather than
parsing it from the message body.
- Around line 15-27: The isLikelyCallbackUrl function currently accepts URLs
that include credentials (e.g. http://user:pass@localhost:54801/...), so update
isLikelyCallbackUrl to reject any URL with non-empty URL.username or
URL.password by checking u.username === '' && u.password === '' before returning
true; keep the existing protocol, host, and searchParams checks (function name:
isLikelyCallbackUrl) so credentialed callback URLs are not considered valid and
thus won't reach sendChatMessage.

In `@packages/frontend/src/lib/store.ts`:
- Around line 414-439: The code currently updates the first matching pending
auth_request by iterating messages/blocks forwards; change the traversal so you
locate and update the latest pending one by scanning messages and each
message.blocks from the end toward the start (i.e., reverse order) and stop
after the first match. In the implementation around updatedMessages/messages.map
and the inner m.blocks.map (and the b checks for b.type==='auth_request' &&
b.mcpServerId===evt.mcpServerId && b.status==='pending'), iterate blocks in
reverse (or find lastIndex) to set status/failureMessage on that single latest
block, then rebuild the blocks array preserving original order and mark
messageUpdated so you replace only the affected message.

---

Nitpick comments:
In `@packages/frontend/src/components/chat/auth-request-card.test.tsx`:
- Around line 68-77: Test suite for AuthRequestCard lacks a positive case
verifying IPv6 loopback (::1) is accepted; add a unit test in
packages/frontend/src/components/chat/auth-request-card.test.tsx that mirrors
the existing negative case but sets the input value to an IPv6 loopback callback
(e.g. "http://[::1]:3000/callback?code=AAA&state=xyz"), ensure
useCanvasStore.setState({ sendChatMessage: vi.fn() } as never) and
render(<AuthRequestCard block={pendingBlock} />) as in the other test, then
assert the submit button (screen.getByRole('button', { name: /^認証完了$/ })) is
enabled (disabled === false) to confirm AuthRequestCard allows ::1 hosts.

In `@packages/frontend/src/lib/store.ts`:
- Around line 385-470: The chat_auth_request handling is too large in
store.ts—extract it into a dedicated helper (e.g. applyAuthRequestEvent) or a
small module that receives (evt, currentMessages) and returns updated messages;
move the logic that inspects evt.status ('pending' | 'completed' | 'failed'),
searches/updates auth_request blocks by mcpServerId/status, appends failed
entries by evt.messageId when no pending exists, and preserves existing block
fields (mcpServerLabel, authUrl, failureMessage) into that helper; update the
store code to call get().chatThreadMessages, pass them and evt to
applyAuthRequestEvent, then call set({ chatThreadMessages: result }) and keep
the public behavior identical (use the same symbols: evt, chatThreadMessages,
blocks, mcpServerId, status, failureMessage).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/ai-engine/src/chat-runner.ts`:
- Around line 373-383: runOAuthCallback currently delegates to runUserTurn which
persists the raw callback text to history and allows normal tool/model flow;
instead implement an ephemeral OAuth-only execution path: replace the yield*
this.runUserTurn(text, []) call in runOAuthCallback with logic that emits the
user-facing event(s) without saving to conversation history and then invokes
only the whitelist tool named `mcp__${mcpServerId}__complete_authentication`
(reject/ignore any other tool/model actions). Use or add a helper such as an
ephemeral runner (e.g., runEphemeralTurn/runOAuthTurn) or inline the behavior to
mark messages as non-persistent and constrain tool execution to that single tool
name so callback `code`/`state` are never stored and no other MCP server
completions can run.

In `@packages/ai-engine/src/server.ts`:
- Around line 51-55: ChatOAuthCallbackSchema's callbackUrl currently uses
z.string().url() which is too permissive; update the schema to validate
callbackUrl more strictly to match the front-end rules: ensure the URL scheme is
either http or https, reject URLs with username/password (no credentials),
restrict the host to loopback addresses (localhost, 127.0.0.1, ::1 / [::1]), and
require that the query string contains both code and state parameters. Implement
this by replacing the simple .url() check on callbackUrl in
ChatOAuthCallbackSchema with a custom zod refinement or parsed-URL validator
that parses the URL, checks the protocol, hostname, absence of auth, and
presence of code and state query params while preserving the existing type
shape.