fix(web): MCP app permission prompts no longer overflow the screen

[juliusmarminge]

Problem

When an MCP App asks to run a non-read-only tool, T3 shows a confirmation with the full tool arguments as the dialog description (McpAppFrame → requestConfirmDialog). Nothing bounded that text's height, so a large payload — an Excalidraw document passed to export_to_excalidraw, say — grew the dialog past the viewport. The text spilled out of the card and Cancel/Confirm ended up far off screen (measured on base: the Cancel button's bottom sits at y=2762 in an 800px-tall viewport), leaving no visible way to answer the prompt.

Fix

In the shared alert dialog (apps/web/src/components/ui/alert-dialog.tsx), which every confirm prompt renders through:

• The description wraps anywhere and scrolls within a capped region (max-h-[min(24rem,60dvh)], overflow-y-auto, overscroll-contain, selectable text), so the full payload stays inspectable without growing the dialog.
• The header gets min-h-0 so it can shrink inside the popup's existing height cap on short viewports, and the title is shrink-0 so it stays put while the description scrolls.
• Short descriptions render exactly as before; every other alert dialog (merge PR, delete action, …) gains the same overflow safety.

Surfaces: web and desktop share this dialog. Mobile shows MCP app prompts through the OS alert, which already scrolls its message and pins its actions, so no mobile change was needed. The prompt's message format is unchanged — nothing is truncated.

Evidence

Same 12k-character Excalidraw-shaped payload, same 1280×800 viewport, captures cropped identically. Reproduced in the dev app by requesting the same confirmation McpAppFrame sends for export_to_excalidraw.

Before — text overflows the card, actions off screen:

After — payload scrolls in place (2,620px of content in the 384px region), actions always visible:

Verification

• New alert-dialog.test.tsx keeps a 4,000-character payload fully rendered, in a bounded scroll region ahead of the footer; it fails on base and passes with the fix.
• vp test run apps/web/src/components/ui/alert-dialog.test.tsx apps/web/src/confirmDialog.test.ts — 6 passed.
• tsc --noEmit in apps/web — clean. vp lint on touched files — clean.
• Verified live in the dev app at base and head (screenshots above); description scroll measured end-to-end at head.

restful-walrus-ultra via Muse Code in T3 Code

---

[macroscopeapp]

Approvability

Verdict: Approved at 603f585

Macroscope's review found this PR approvable — This is a focused UI bug fix that bounds long alert descriptions and keeps existing dialog actions reachable, with a dedicated regression test. Its production impact is limited to presentation of unusually long content in the shared alert component.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: b789c106-b453-4626-afc2-7090491be924

---

📥 Commits

Reviewing files that changed from the base of the PR and between 75c439f and 603f585.

---

📒 Files selected for processing (2)

• apps/web/src/components/ui/alert-dialog.test.tsx
• apps/web/src/components/ui/alert-dialog.tsx

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The alert dialog now constrains long descriptions, enables scrolling and text selection, and adjusts header and title sizing. A server-rendered test checks that long content remains in the markup and appears before the footer action.

Changes

Alert dialog layout

Layer / File(s)	Summary
Long-description layout and rendering apps/web/src/components/ui/alert-dialog.tsx, apps/web/src/components/ui/alert-dialog.test.tsx	The header adds min-h-0, and the title adds shrink-0. The description adds a height cap, vertical scrolling with contained overscroll, text selection, and anywhere wrapping. A server-rendered test checks long-payload inclusion, expected classes, and description-before-footer order.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

---

Merge Risk: ⚪ Minimal · up to 603f5

The permission dialog’s long content is constrained without pushing its actions off screen. No actionable merge risk remains after normal checks.

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the primary fix: preventing MCP app permission prompts from overflowing the screen.
Description check		The description covers the problem, fix, affected surfaces, evidence, focused tests, type checking, linting, and agent attribution. It does not include a separate Scope and approval section, but it ex…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	+24 B (+0.5%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+24 B (+2.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	+41 B (+0.2%)	29.3 KiB	✅
Claude	Live turn messages	1	2	+1 (+100.0%)	8	✅

Baseline: 75c439f · PR result: 603f585 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.