feat: virtual server add source step

[a-effort]

Stacked on #130, which adds the shared status indicator this uses. Please review that one first; this PR targets its branch so the diff stays readable.

The source picker now uses the shared derivation from #130. A source reads the same here as on the servers page, including OAuth sources the caller has not authorized yet. Auth note: this version includes a popover vs connecting to the OAuth authorize flow (IBM/mcp-context-forge#6859), because no authorize handler is wired into the picker.

Sources stay selectable in every state and components discovered from a source remain in the catalog when it goes unreachable, so a virtual server built from them still resolves. The health loop takes up to three intervals to mark a source unreachable, so this approach enables the user to move forward and fix any issues later, if there are any.

Tools, resources and prompts now fail independently, each with its own message (popover).

131.mp4

Part of IBM/mcp-context-forge#6404

[Copilot]

🟡 Changes recommended

OAuth status loading fails once the accumulated server list exceeds the API’s 100-ID limit.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Uses shared MCP availability states throughout virtual-server source selection and improves component-loading feedback.

Changes:

• Adds shared OAuth status loading and availability-aware empty states.
• Keeps unavailable sources selectable while warning about empty sources.
• Adds independent component errors, retries, and source-attributed creation errors.

File summaries

File	Description
src/types/server.ts	Removes the obsolete status type.
src/pages/Servers.tsx	Adopts the shared OAuth-status hook.
src/pages/CreateServer.tsx	Adds shared statuses, retries, and attributed errors.
src/pages/CreateServer.test.tsx	Updates status and error tests.
src/lib/serverStatus.ts	Adds availability-specific empty-state messages.
src/lib/serverStatus.test.ts	Validates presentation message IDs.
src/hooks/useOAuthTokenStatuses.ts	Centralizes OAuth token-status loading.
src/components/gateways/SourceSelection.tsx	Adds shared statuses and empty-source warnings.
src/components/gateways/SourceSelection.test.tsx	Tests selection, warnings, and source names.
src/i18n/locales/en-US/mcpServer.json	Updates English status messages.
src/i18n/locales/en-US/gateways.json	Adds English source and loading messages.
src/i18n/locales/es-ES/mcpServer.json	Updates Spanish status messages.
src/i18n/locales/es-ES/gateways.json	Adds Spanish source and loading messages.
src/i18n/locales/pt-BR/mcpServer.json	Updates Portuguese status messages.
src/i18n/locales/pt-BR/gateways.json	Adds Portuguese source and loading messages.

Review details

• Files reviewed: 15/15 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[a-effort]

LLM review feedback:

Reviewed the diff and the Copilot thread.

The Copilot comment about the 100-ID cap is resolved correctly — the fix belongs in getOAuthStatus itself rather than in the hook, so callers pass the full list and batching is handled once.

Extracting useOAuthTokenStatuses was the right call. The versioned-request pattern needed to live in a hook rather than inlined in the page, and Servers.tsx is cleaner for it.

The idsKey join as a memo dependency avoids array reference churn without needing a deep-equality comparison.

SourceComponentsError wrapping the per-server fetch failure is a clean way to attribute errors without surfacing them as unattributed strings at the creation level.

Per-list independent errors with partial success (components still render when only some lists fail) is better than the previous single componentError. The retry wiring is straightforward.

The emptySelectedSources warning being non-blocking is correct per the stated intent.

The race condition test in useOAuthTokenStatuses.test.ts covers the stale-result scenario that motivated the versioning.

[marekdano]

Findings

🟡 Medium — Silent partial failure on multi-source component fetch

File: src/pages/CreateServer.tsx:229

getComponentsForSelectedMCPServers wraps each source's component-fetch failure in a SourceComponentsError, but since the fetches run under Promise.all, it rejects on the first source to fail — any other failing sources are never surfaced.

Failure scenario: User selects two unreachable sources, A and B, and clicks Submit/Skip. Both component fetches reject, but Promise.all settles with whichever rejects first (say A). The UI shows only "A: <error>" — there's no indication B also failed to contribute components to the new virtual server.

Suggested fix: Use Promise.allSettled and aggregate all failing sources into the error message.

---

🟢 Low — Stale id can lose its friendly name on submit

File: src/components/gateways/SourceSelection.tsx:144

toggleMCPServerSelection builds namesById only from the current availableMCPServers. If that list is refetched and a previously selected id drops out before submit, selectedSourceIds still holds the stale id, but namesById has no entry for it.

Failure scenario: User selects a source; the sources list refetches and that source's id is no longer present in availableMCPServers (e.g. reassigned/removed upstream). The id stays in selectedMCPServerIds. On submit, if that source's component fetch fails, getCreateServerError falls back to showing the raw id instead of the source's friendly name.

Suggested fix: Edge case, minor UX regression only — low priority, but worth tracking namesById as accumulated state rather than deriving fresh from the latest fetch.

[a-effort]

Both fixed in b0a9a01.

getComponentsForSelectedMCPServers now uses Promise.allSettled and collects every rejected source, so the error names all of them rather than whichever failed first. SourceComponentsError carries the list and getCreateServerError joins them.

SourceSelection keeps each source's name from when it was selected instead of deriving the map from the current list, so an id that drops out still reports by name.

[marekdano]

The PR looks good now!

LGTM 🚀

[gcgoncalves]

Since you'll have to sort out the merge conflicts anyway, here are a minor a11y suggestion on src/components/servers/ServerStatusIndicator.tsx:

  <PopoverContent
    align="end"
    className="w-auto max-w-xs p-3"
    aria-label={intl.formatMessage(
      { id: "mcpServer.status.trigger" },
      { name: server.name, status: fullLabel },
    )}
  >
    <ServerStatusDetail ... />
  </PopoverContent>

Adding a label to popover content to match WCAG rules (let's screen readers know the popup purpose)

[a-effort]

Suggest holding this until #150 merges, then rebasing on top of it.

#150 adds useOAuthStatuses, which covers what useOAuthTokenStatuses does here and also handles request cancellation, versioning per id so one refresh cannot overwrite another, explicit loading and unavailable states, a retry path, and servers whose grant type is not authorization_code.

It also rewrites SourceSelection to drop the local status helpers and use ServerStatusIndicator and that hook instead, which is most of what this PR changes in that file.

If this merges first, we end up with two hooks under nearly the same name doing the same job, and #150 has to resolve against it.

This branch needs a rebase regardless, since #130 squash-merged and main now carries that content under a different commit. Rebasing once on top of #150 is less work than rebasing onto main now and repeating it afterwards.

The parts that do not overlap #150 carry over unchanged: the empty state strings for sources with no components, the active voice wording, and naming every failing source while keeping the names of dropped ones.

cc @vishu-bh, since the hook overlap sits mostly on your side.

[a-effort]

@gcgoncalves , good call re the popover A11Y improvement - ty!

Added the fix to #153, which owns that popover now and created IBM/mcp-context-forge#6989 to improve this for other popovers, also.

[marekdano]

@a-effort - please look at the failing Playwright tests.