Desktop plugin OAuth reconciliation can uninstall after a connection-state query error

Version and platform

Inspected macOS desktop client bundle asset webview/assets/app-initial-cadb12d4a15e.js (SHA-256 73594359b28d81b6fcc9a52aac808f6a2e9fc32ced661adb3e23d297827b9285), ChatGPT/Codex host 26.901.51231 (8109). Subscription details omitted: the reproduction uses extracted client functions with mocked service responses, not an account-specific operation.

Actual

In the pending plugin OAuth reconciliation flow, an exception while querying connection state can fall through into installation rollback/uninstall. Failure to query does not establish that OAuth is unconnected. The extracted actual functions reproduce an uninstall call on a simulated query failure.

Reproduction and expected

1. Create a synthetic pending connection record in an isolated function harness.
2. Make the connection-state query throw a transient error.
3. Observe the rollback/uninstall mock called by the original code.

Expected: retain the pending record after an unknown query result and allow existing later reconciliation to determine connected/unconnected. A later confirmed unconnected result can use the existing rollback behavior.

Candidate and validation

A one-return candidate in the query-error catch prevents fall-through. Eight scenarios per original/candidate were checked: connected, unconnected, query error, account change, request change, repeated coordination, query-error then connected, and query-error then unconnected. The last two candidate cases query again and result in respectively zero/one uninstall calls. Existing account/request identity guards remain intact. An independent review reran the initial six scenarios; the two recovery cases were additionally checked locally.

This is actual-function isolation evidence. No real OAuth flow, account mutation, plugin uninstall, signed application change or actual focus/visibility event integration is claimed. Only synthetic records and service mocks were used.

Start with webview/assets/app-initial-cadb12d4a15e.js and the extracted pending OAuth reconciliation functions, then run the isolated harness with the eight scenarios described. Done means a transient connection-state query error retains the pending record without uninstalling, while later confirmed connected or unconnected results preserve the existing reconciliation behavior.