lael-labs/executor

apps/cloud/src/routes/org.tsx+23−18

 import { useReducer, useState } from "react";
 import { Exit } from "effect";
 import { createFileRoute, Link } from "@tanstack/react-router";
-import { useAtomValue, useAtomSet, useAtomRefresh, Result } from "@effect-atom/atom-react";
+import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";
 import { useCustomer } from "autumn-js/react";
 import { toast } from "sonner";
+import {
+  orgMemberWriteKeys,
+  orgDomainWriteKeys,
+  orgInfoWriteKeys,
+} from "@executor/react/api/reactivity-keys";
 import {
   Dialog,
   DialogContent,
   deleteDomain,
   updateOrgName,
 } from "../web/org-atoms";
-import { authAtom, useAuth } from "../web/auth";
+import { useAuth } from "../web/auth";
 export const Route = createFileRoute("/org")({
   component: OrgPage,
   const membersResult = useAtomValue(orgMembersAtom);
   const rolesResult = useAtomValue(orgRolesAtom);
   const domainsResult = useAtomValue(orgDomainsAtom);
-  const refreshMembers = useAtomRefresh(orgMembersAtom);
-  const refreshDomains = useAtomRefresh(orgDomainsAtom);
   const doRemove = useAtomSet(removeMember, { mode: "promiseExit" });
   const doUpdateRole = useAtomSet(updateMemberRole, { mode: "promiseExit" });
   const doDeleteDomain = useAtomSet(deleteDomain, { mode: "promiseExit" });
   });
   const handleRemove = async (membershipId: string, name: string) => {
-    const exit = await doRemove({ path: { membershipId } });
+    const exit = await doRemove({ path: { membershipId }, reactivityKeys: orgMemberWriteKeys });
     if (Exit.isSuccess(exit)) {
       toast.success(`Removed ${name}`);
-      refreshMembers();
     } else {
       toast.error("Failed to remove member");
     }
   };
   const handleChangeRole = async (membershipId: string, roleSlug: string, roleName: string) => {
-    const exit = await doUpdateRole({ path: { membershipId }, payload: { roleSlug } });
+    const exit = await doUpdateRole({
+      path: { membershipId },
+      payload: { roleSlug },
+      reactivityKeys: orgMemberWriteKeys,
+    });
     if (Exit.isSuccess(exit)) {
       toast.success(`Role changed to ${roleName}`);
-      refreshMembers();
     } else {
       toast.error("Failed to change role");
     }
   };
-  const refreshAuth = useAtomRefresh(authAtom);
   const handleSaveName = async () => {
     const trimmed = editName.trim();
     if (!trimmed || trimmed === orgName) {
       return;
     }
     setSavingName(true);
-    const exit = await doUpdateOrgName({ payload: { name: trimmed } });
+    const exit = await doUpdateOrgName({
+      payload: { name: trimmed },
+      reactivityKeys: orgInfoWriteKeys,
+    });
     if (Exit.isSuccess(exit)) {
       toast.success("Organization name updated");
-      refreshAuth();
     } else {
       toast.error("Failed to update organization name");
       setEditName(orgName);
   };
   const handleDeleteDomain = async (domainId: string, domain: string) => {
-    const exit = await doDeleteDomain({ path: { domainId } });
+    const exit = await doDeleteDomain({
+      path: { domainId },
+      reactivityKeys: orgDomainWriteKeys,
+    });
     if (Exit.isSuccess(exit)) {
       toast.success(`Removed ${domain}`);
-      refreshDomains();
     } else {
       toast.error("Failed to remove domain");
     }
   };
   const handleAddDomain = async () => {
-    const exit = await doGetVerificationLink({});
+    const exit = await doGetVerificationLink({ reactivityKeys: orgDomainWriteKeys });
     if (Exit.isSuccess(exit)) {
       window.open(exit.value.link, "_blank");
     } else {
         <InviteDialog
           open={inviteOpen}
           onOpenChange={setInviteOpen}
-          onInvited={refreshMembers}
           roles={roles}
         />
       </div>
 function InviteDialog(props: {
   open: boolean;
   onOpenChange: (v: boolean) => void;
-  onInvited: () => void;
   roles: readonly { slug: string; name: string }[];
 }) {
   const [state, dispatch] = useReducer(inviteReducer, initialInviteState);
         email: state.email.trim(),
         ...(state.roleSlug ? { roleSlug: state.roleSlug } : {}),
       },
+      reactivityKeys: orgMemberWriteKeys,
     });
     if (Exit.isSuccess(exit)) {
       toast.success(`Invitation sent to ${state.email.trim()}`);
       dispatch({ type: "reset" });
       props.onOpenChange(false);
-      props.onInvited();
     } else {
       dispatch({ type: "error", message: "Failed to send invitation" });
     }

apps/cloud/src/web/auth.tsx+6−1

 import React, { createContext, useContext } from "react";
 import { Atom } from "@effect-atom/atom";
 import { useAtomValue, Result } from "@effect-atom/atom-react";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { CloudApiClient } from "./client";
 export const authAtom = CloudApiClient.query("cloudAuth", "me", {
   timeToLive: "5 minutes",
+  reactivityKeys: [ReactivityKey.auth],
 });
 export const organizationsAtom = Atom.refreshOnWindowFocus(
-  CloudApiClient.query("cloudAuth", "organizations", { timeToLive: "1 minute" }),
+  CloudApiClient.query("cloudAuth", "organizations", {
+    timeToLive: "1 minute",
+    reactivityKeys: [ReactivityKey.auth],
+  }),
 );
 export const switchOrganization = CloudApiClient.mutation("cloudAuth", "switchOrganization");

apps/cloud/src/web/components/create-organization-form.tsx+2−1

 import { useState } from "react";
 import { useAtomSet } from "@effect-atom/atom-react";
+import { authWriteKeys } from "@executor/react/api/reactivity-keys";
 import { Input } from "@executor/react/components/input";
 import { Label } from "@executor/react/components/label";
     }
     setCreating(true);
     setError(null);
-    const exit = await doCreate({ payload: { name: trimmed } });
+    const exit = await doCreate({ payload: { name: trimmed }, reactivityKeys: authWriteKeys });
     setCreating(false);
     if (exit._tag === "Success") {
       options.onSuccess(exit.value);

apps/cloud/src/web/org-atoms.ts+4−0

 import { Atom } from "@effect-atom/atom";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { CloudApiClient } from "./client";
 export const orgMembersAtom = Atom.refreshOnWindowFocus(
   CloudApiClient.query("org", "listMembers", {
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.orgMembers],
   }),
 );
 export const orgRolesAtom = CloudApiClient.query("org", "listRoles", {
   timeToLive: "5 minutes",
+  reactivityKeys: [ReactivityKey.orgMembers],
 });
 export const inviteMember = CloudApiClient.mutation("org", "invite");
 export const orgDomainsAtom = Atom.refreshOnWindowFocus(
   CloudApiClient.query("org", "listDomains", {
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.orgDomains],
   }),
 );

apps/cloud/src/web/pages/onboarding.tsx+5−10

-import { useAtomRefresh } from "@effect-atom/atom-react";
 import { Button } from "@executor/react/components/button";
 import { AUTH_PATHS } from "../../auth/api";
-import { authAtom, useAuth } from "../auth";
+import { useAuth } from "../auth";
 import {
   CreateOrganizationFields,
   useCreateOrganizationForm,
 export const OnboardingPage = () => {
   const auth = useAuth();
-  const refreshAuth = useAtomRefresh(authAtom);
   const suggestedName =
     auth.status === "authenticated" &&
   const form = useCreateOrganizationForm({
     defaultName: suggestedName,
-    // On success: the server set a new cookie with the new org; refetch /me
+    // The server sets a cookie for the new (or cleared) org on both success and
-    // so AuthGate routes into Shell.
+    // failure. The authWriteKeys passed at the mutation site auto-invalidate
-    // On failure: the server may have cleared the cookie because the current
+    // authAtom so AuthGate re-routes into Shell or LoginPage as appropriate.
-    // session was too stale to attach the new org. Refetch /me regardless so
+    onSuccess: () => {},
-    // AuthGate can route to LoginPage if that's the case.
-    onSuccess: () => refreshAuth(),
-    onFailure: () => refreshAuth(),
   });
   return (

apps/cloud/src/web/shell.tsx+2−2

@@ -1,7 +1,7 @@
1	import { Link, Outlet, useLocation } from "@tanstack/react-router";	1	import { Link, Outlet, useLocation } from "@tanstack/react-router";
2	import { useEffect, useRef, useState } from "react";	2	import { useEffect, useRef, useState } from "react";
3	import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";	3	import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";
4	import { sourcesAtom } from "@executor/react/api/atoms";	4	import { useSourcesWithPending } from "@executor/react/api/optimistic";
5	import { useScope } from "@executor/react/api/scope-context";	5	import { useScope } from "@executor/react/api/scope-context";
6	import { Button } from "@executor/react/components/button";	6	import { Button } from "@executor/react/components/button";
7	import { Skeleton } from "@executor/react/components/skeleton";	7	import { Skeleton } from "@executor/react/components/skeleton";
@@ -66,7 +66,7 @@ function NavItem(props: { to: string; label: string; active: boolean; onNavigate · 58 unmodified lines
66		66
67	function SourceList(props: { pathname: string; onNavigate?: () => void }) {	67	function SourceList(props: { pathname: string; onNavigate?: () => void }) {
68	const scopeId = useScope();	68	const scopeId = useScope();
69	const sources = useAtomValue(sourcesAtom(scopeId));	69	const sources = useSourcesWithPending(scopeId);
70		70
71	return Result.match(sources, {	71	return Result.match(sources, {
72	onInitial: () => (	72	onInitial: () => (

apps/local/src/web/shell.tsx+3−2

 import { Link, Outlet, useLocation } from "@tanstack/react-router";
 import { useCallback, useEffect, useRef, useState } from "react";
-import { useAtomRefresh, useAtomValue, Result } from "@effect-atom/atom-react";
+import { useAtomRefresh, Result } from "@effect-atom/atom-react";
 import { sourcesAtom, toolsAtom } from "@executor/react/api/atoms";
+import { useSourcesWithPending } from "@executor/react/api/optimistic";
 import { useScope, useScopeInfo } from "@executor/react/api/scope-context";
 import { Button } from "@executor/react/components/button";
 import { SourceFavicon } from "@executor/react/components/source-favicon";
 function SourceList(props: { pathname: string; onNavigate?: () => void }) {
   const scopeId = useScope();
-  const sources = useAtomValue(sourcesAtom(scopeId));
+  const sources = useSourcesWithPending(scopeId);
   return Result.match(sources, {
     onInitial: () => (

package.json+2−1

     "typecheck": "turbo run typecheck",
     "typecheck:slow": "turbo run typecheck:slow",
     "ci": "bun run lint && bun run typecheck && bun run test",
-    "lint": "oxlint -c .oxlintrc.jsonc . --deny-warnings",
+    "lint": "oxlint -c .oxlintrc.jsonc . --deny-warnings && bun run lint:reactivity-keys",
+    "lint:reactivity-keys": "bun run scripts/check-reactivity-keys.ts",
     "lint:fix": "oxlint -c .oxlintrc.jsonc --fix .",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",

packages/plugins/google-discovery/src/react/AddGoogleDiscoverySource.tsx+17−5

 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { useAtomSet, useAtomValue, useAtomRefresh, Result } from "@effect-atom/atom-react";
+import { useAtomSet, useAtomValue, Result } from "@effect-atom/atom-react";
 import {
   openOAuthPopup,
 } from "@executor/plugin-oauth2/react";
 import { secretsAtom, setSecret } from "@executor/react/api/atoms";
+import { usePendingSources } from "@executor/react/api/optimistic";
+import { secretWriteKeys, sourceWriteKeys } from "@executor/react/api/reactivity-keys";
 import { useScope } from "@executor/react/api/scope-context";
 import { SecretPicker, type SecretPickerSecret } from "@executor/react/plugins/secret-picker";
 import { SecretId } from "@executor/sdk";
   const [error, setError] = useState<string | null>(null);
   const scopeId = useScope();
   const doSet = useAtomSet(setSecret, { mode: "promise" });
-  const refreshSecrets = useAtomRefresh(secretsAtom(scopeId));
   const handleSave = async () => {
     if (!secretId.trim() || !secretValue.trim()) return;
           name: secretName.trim() || secretId.trim(),
           value: secretValue.trim(),
         },
+        reactivityKeys: [...secretWriteKeys],
       });
-      refreshSecrets();
       props.onCreated(secretId.trim());
     } catch (e) {
       setError(e instanceof Error ? e.message : "Failed to save secret");
   const doAdd = useAtomSet(addGoogleDiscoverySource, { mode: "promise" });
   const doStartOAuth = useAtomSet(startGoogleDiscoveryOAuth, { mode: "promise" });
   const secrets = useAtomValue(secretsAtom(scopeId));
+  const { beginAdd } = usePendingSources();
   const canUseOAuth = useMemo(() => (probe?.scopes.length ?? 0) > 0, [probe]);
   const secretList: readonly SecretPickerSecret[] = Result.match(secrets, {
     if (!probe) return;
     setAdding(true);
     setError(null);
+    const displayName = identity.name.trim() || probe.name;
+    const namespace = slugifyNamespace(identity.namespace) || probe.name;
+    const placeholder = beginAdd({
+      id: namespace,
+      name: displayName,
+      kind: "google-discovery",
+    });
     try {
       await doAdd({
         path: { scopeId },
         payload: {
-          name: identity.name.trim() || probe.name,
+          name: displayName,
           discoveryUrl: discoveryUrl.trim(),
           namespace: slugifyNamespace(identity.namespace) || undefined,
           auth:
               ? (oauthAuth ?? { kind: "none" as const })
               : { kind: "none" as const },
         },
+        reactivityKeys: [...sourceWriteKeys],
       });
       props.onComplete();
     } catch (e) {
       setError(e instanceof Error ? e.message : "Failed to add source");
       setAdding(false);
+    } finally {
+      placeholder.done();
     }
-  }, [probe, doAdd, identity, discoveryUrl, authKind, oauthAuth, props, scopeId]);
+  }, [probe, doAdd, identity, discoveryUrl, authKind, oauthAuth, props, scopeId, beginAdd]);
   const addDisabled =
     !probe || adding || (authKind === "oauth2" && (!canUseOAuth || oauthAuth === null));

packages/plugins/google-discovery/src/react/atoms.ts+2−0

 import type { ScopeId } from "@executor/sdk";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { GoogleDiscoveryClient } from "./client";
 export const googleDiscoverySourceAtom = (scopeId: ScopeId, namespace: string) =>
   GoogleDiscoveryClient.query("googleDiscovery", "getSource", {
     path: { scopeId, namespace },
     timeToLive: "15 seconds",
+    reactivityKeys: [ReactivityKey.sources, ReactivityKey.tools],
   });
 export const probeGoogleDiscovery = GoogleDiscoveryClient.mutation(

packages/plugins/graphql/src/react/AddGraphqlSource.tsx+30−11

 import { useAtomSet } from "@effect-atom/atom-react";
 import { useScope } from "@executor/react/api/scope-context";
+import { sourceWriteKeys } from "@executor/react/api/reactivity-keys";
+import { usePendingSources } from "@executor/react/api/optimistic";
 import { HeadersList } from "@executor/react/plugins/headers-list";
 import { type HeaderState } from "@executor/react/plugins/secret-header-auth";
 import {
   const scopeId = useScope();
   const doAdd = useAtomSet(addGraphqlSource, { mode: "promise" });
+  const { beginAdd } = usePendingSources();
   const secretList = useSecretPickerSecrets();
   const headersValid = headers.every((header) => header.name.trim() && header.secretId);
   const handleAdd = async () => {
     setAdding(true);
     setAddError(null);
-    try {
+    const headerMap: Record<string, HeaderValue> = {};
-      const headerMap: Record<string, HeaderValue> = {};
+    for (const header of headers) {
-      for (const header of headers) {
+      const name = header.name.trim();
-        const name = header.name.trim();
+      if (name && header.secretId) {
-        if (name && header.secretId) {
+        headerMap[name] = {
-          headerMap[name] = {
+          secretId: header.secretId,
-            secretId: header.secretId,
+          ...(header.prefix ? { prefix: header.prefix } : {}),
-            ...(header.prefix ? { prefix: header.prefix } : {}),
+        };
-          };
-        }
       }
+    }
+    const trimmedEndpoint = endpoint.trim();
+    const namespace =
+      slugifyNamespace(identity.namespace) ||
+      slugifyNamespace(displayNameFromUrl(trimmedEndpoint) ?? "") ||
+      "graphql";
+    const displayName =
+      identity.name.trim() || displayNameFromUrl(trimmedEndpoint) || namespace;
+    const placeholder = beginAdd({
+      id: namespace,
+      name: displayName,
+      kind: "graphql",
+      url: trimmedEndpoint || undefined,
+    });
+    try {
       await doAdd({
         path: { scopeId },
         payload: {
-          endpoint: endpoint.trim(),
+          endpoint: trimmedEndpoint,
           name: identity.name.trim() || undefined,
           namespace: slugifyNamespace(identity.namespace) || undefined,
           ...(Object.keys(headerMap).length > 0 ? { headers: headerMap } : {}),
         },
+        reactivityKeys: sourceWriteKeys,
       });
       props.onComplete();
     } catch (e) {
       setAddError(e instanceof Error ? e.message : "Failed to add source");
       setAdding(false);
+    } finally {
+      placeholder.done();
     }
   };

packages/plugins/graphql/src/react/EditGraphqlSource.tsx+3−3

 import { useState } from "react";
-import { useAtomValue, useAtomSet, useAtomRefresh, Result } from "@effect-atom/atom-react";
+import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";
 import { graphqlSourceAtom, updateGraphqlSource } from "./atoms";
 import { useScope } from "@executor/react/api/scope-context";
+import { sourceWriteKeys } from "@executor/react/api/reactivity-keys";
 import { useSecretPickerSecrets } from "@executor/react/plugins/use-secret-picker-secrets";
 import {
   headerValueToState,
 }) {
   const scopeId = useScope();
   const doUpdate = useAtomSet(updateGraphqlSource, { mode: "promise" });
-  const refreshSource = useAtomRefresh(graphqlSourceAtom(scopeId, props.sourceId));
   const secretList = useSecretPickerSecrets();
   const identity = useSourceIdentity({
           endpoint: endpoint.trim() || undefined,
           headers: headersFromState(headers),
         },
+        reactivityKeys: sourceWriteKeys,
       });
-      refreshSource();
       setDirty(false);
       props.onSave();
     } catch (e) {

packages/plugins/graphql/src/react/atoms.ts+2−0

 import type { ScopeId } from "@executor/sdk";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { GraphqlClient } from "./client";
 // ---------------------------------------------------------------------------
   GraphqlClient.query("graphql", "getSource", {
     path: { scopeId, namespace },
     timeToLive: "15 seconds",
+    reactivityKeys: [ReactivityKey.sources, ReactivityKey.tools],
   });
 // ---------------------------------------------------------------------------

packages/plugins/mcp/src/react/AddMcpSource.tsx+55−29

@@ -35,6 +35,8 @@ import { · 34 unmodified lines
35	import { useSecretPickerSecrets } from "@executor/react/plugins/use-secret-picker-secrets";	35	import { useSecretPickerSecrets } from "@executor/react/plugins/use-secret-picker-secrets";
36		36
37	type RemoteAuthMode = "none" \| "header" \| "oauth2";	37	type RemoteAuthMode = "none" \| "header" \| "oauth2";
		38	import { sourceWriteKeys } from "@executor/react/api/reactivity-keys";
		39	import { usePendingSources } from "@executor/react/api/optimistic";
38	import { probeMcpEndpoint, addMcpSource, startMcpOAuth } from "./atoms";	40	import { probeMcpEndpoint, addMcpSource, startMcpOAuth } from "./atoms";
39	import { mcpPresets, type McpPreset } from "../sdk/presets";	41	import { mcpPresets, type McpPreset } from "../sdk/presets";
40		42
@@ -330,6 +332,7 @@ export default function AddMcpSource(props: { · 289 unmodified lines
330	const doProbe = useAtomSet(probeMcpEndpoint, { mode: "promise" });	332	const doProbe = useAtomSet(probeMcpEndpoint, { mode: "promise" });
331	const doAdd = useAtomSet(addMcpSource, { mode: "promise" });	333	const doAdd = useAtomSet(addMcpSource, { mode: "promise" });
332	const doStartOAuth = useAtomSet(startMcpOAuth, { mode: "promise" });	334	const doStartOAuth = useAtomSet(startMcpOAuth, { mode: "promise" });
		335	const { beginAdd } = usePendingSources();
333	const secretList = useSecretPickerSecrets();	336	const secretList = useSecretPickerSecrets();
334		337
335	const [remoteAuthMode, setRemoteAuthMode] = useState<RemoteAuthMode>("none");	338	const [remoteAuthMode, setRemoteAuthMode] = useState<RemoteAuthMode>("none");
@@ -462,42 +465,51 @@ export default function AddMcpSource(props: { · 126 unmodified lines
462	const handleAddRemote = useCallback(async () => {	465	const handleAddRemote = useCallback(async () => {
463	if (!probe) return;	466	if (!probe) return;
464	dispatch({ type: "add-start" });	467	dispatch({ type: "add-start" });
465	try {	468	const headerAuth = remoteAuthHeaders[0];
466	const headerAuth = remoteAuthHeaders[0];	469	const auth =
467	const auth =	470	remoteAuthMode === "header" && headerAuth?.secretId
468	remoteAuthMode === "header" && headerAuth?.secretId	471	? {
		472	kind: "header" as const,
		473	headerName: headerAuth.name.trim(),
		474	secretId: headerAuth.secretId,
		475	...(headerAuth.prefix ? { prefix: headerAuth.prefix } : {}),
		476	}
		477	: remoteAuthMode === "oauth2" && tokens
469	? {	478	? {
470	kind: "header" as const,	479	kind: "oauth2" as const,
471	headerName: headerAuth.name.trim(),	480	accessTokenSecretId: tokens.accessTokenSecretId,
472	secretId: headerAuth.secretId,	481	refreshTokenSecretId: tokens.refreshTokenSecretId,
473	...(headerAuth.prefix ? { prefix: headerAuth.prefix } : {}),	482	tokenType: tokens.tokenType,
		483	expiresAt: tokens.expiresAt,
		484	scope: tokens.scope,
474	}	485	}
475	: remoteAuthMode === "oauth2" && tokens	486	: { kind: "none" as const };
476	? {	487	const headers = Object.fromEntries(
477	kind: "oauth2" as const,	488	remoteHeaders
478	accessTokenSecretId: tokens.accessTokenSecretId,	489	.map((header) => [header.name.trim(), header.value.trim()] as const)
479	refreshTokenSecretId: tokens.refreshTokenSecretId,	490	.filter(([name, value]) => name && value),
480	tokenType: tokens.tokenType,	491	);
481	expiresAt: tokens.expiresAt,	492	const displayName = remoteIdentity.name.trim() \|\| probe.serverName \|\| probe.name;
482	scope: tokens.scope,	493	const slugNamespace = slugifyNamespace(remoteIdentity.namespace);
483	}	494	const placeholderId = slugNamespace \|\| `pending:${crypto.randomUUID()}`;
484	: { kind: "none" as const };	495	const placeholder = beginAdd({
485	const headers = Object.fromEntries(	496	id: placeholderId,
486	remoteHeaders	497	name: displayName,
487	.map((header) => [header.name.trim(), header.value.trim()] as const)	498	kind: "mcp",
488	.filter(([name, value]) => name && value),	499	url: state.url.trim(),
489	);	500	});
490		501	try {
491	await doAdd({	502	await doAdd({
492	path: { scopeId },	503	path: { scopeId },
493	payload: {	504	payload: {
494	transport: "remote" as const,	505	transport: "remote" as const,
495	name: remoteIdentity.name.trim() \|\| probe.serverName \|\| probe.name,	506	name: displayName,
496	namespace: slugifyNamespace(remoteIdentity.namespace) \|\| undefined,	507	namespace: slugNamespace \|\| undefined,
497	endpoint: state.url.trim(),	508	endpoint: state.url.trim(),
498	auth,	509	auth,
499	...(Object.keys(headers).length > 0 ? { headers } : {}),	510	...(Object.keys(headers).length > 0 ? { headers } : {}),
500	},	511	},
		512	reactivityKeys: sourceWriteKeys,
501	});	513	});
502	props.onComplete();	514	props.onComplete();
503	} catch (e) {	515	} catch (e) {
@@ -505,6 +517,8 @@ export default function AddMcpSource(props: { · 1 unmodified line
505	type: "add-fail",	517	type: "add-fail",
506	error: e instanceof Error ? e.message : "Failed to add source",	518	error: e instanceof Error ? e.message : "Failed to add source",
507	});	519	});
		520	} finally {
		521	placeholder.done();
508	}	522	}
509	}, [	523	}, [
510	probe,	524	probe,
@@ -517,6 +531,7 @@ export default function AddMcpSource(props: { · 6 unmodified lines
517	doAdd,	531	doAdd,
518	props,	532	props,
519	scopeId,	533	scopeId,
		534	beginAdd,
520	]);	535	]);
521		536
522	// ---- Stdio actions ----	537	// ---- Stdio actions ----
@@ -549,24 +564,35 @@ export default function AddMcpSource(props: { · 26 unmodified lines
549	if (!cmd) return;	564	if (!cmd) return;
550	setStdioAdding(true);	565	setStdioAdding(true);
551	setStdioError(null);	566	setStdioError(null);
		567	const displayName = stdioIdentity.name.trim() \|\| cmd;
		568	const slugNamespace = slugifyNamespace(stdioIdentity.namespace);
		569	const placeholderId = slugNamespace \|\| `pending:${crypto.randomUUID()}`;
		570	const placeholder = beginAdd({
		571	id: placeholderId,
		572	name: displayName,
		573	kind: "mcp",
		574	});
552	try {	575	try {
553	await doAdd({	576	await doAdd({
554	path: { scopeId },	577	path: { scopeId },
555	payload: {	578	payload: {
556	transport: "stdio" as const,	579	transport: "stdio" as const,
557	name: stdioIdentity.name.trim() \|\| cmd,	580	name: displayName,
558	namespace: slugifyNamespace(stdioIdentity.namespace) \|\| undefined,	581	namespace: slugNamespace \|\| undefined,
559	command: cmd,	582	command: cmd,
560	args: parseStdioArgs(stdioArgs),	583	args: parseStdioArgs(stdioArgs),
561	env: parseStdioEnv(stdioEnv),	584	env: parseStdioEnv(stdioEnv),
562	},	585	},
		586	reactivityKeys: sourceWriteKeys,
563	});	587	});
564	props.onComplete();	588	props.onComplete();
565	} catch (e) {	589	} catch (e) {
566	setStdioError(e instanceof Error ? e.message : "Failed to add source");	590	setStdioError(e instanceof Error ? e.message : "Failed to add source");
567	setStdioAdding(false);	591	setStdioAdding(false);
		592	} finally {
		593	placeholder.done();
568	}	594	}
569	}, [stdioCommand, stdioArgs, stdioEnv, stdioIdentity, doAdd, scopeId, props]);	595	}, [stdioCommand, stdioArgs, stdioEnv, stdioIdentity, doAdd, scopeId, props, beginAdd]);
570		596
571	// ---- Render ----	597	// ---- Render ----
572		598

packages/plugins/mcp/src/react/EditMcpSource.tsx+3−3

 import { useState } from "react";
-import { useAtomValue, useAtomSet, useAtomRefresh, Result } from "@effect-atom/atom-react";
+import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";
 import { mcpSourceAtom, updateMcpSource } from "./atoms";
 import { useScope } from "@executor/react/api/scope-context";
+import { sourceWriteKeys } from "@executor/react/api/reactivity-keys";
 import {
   SourceIdentityFields,
   useSourceIdentity,
 }) {
   const scopeId = useScope();
   const doUpdate = useAtomSet(updateMcpSource, { mode: "promise" });
-  const refreshSource = useAtomRefresh(mcpSourceAtom(scopeId, props.sourceId));
   const identity = useSourceIdentity({
     fallbackName: props.initial.name,
           endpoint: endpoint.trim() || undefined,
           headers: headersObj,
         },
+        reactivityKeys: sourceWriteKeys,
       });
-      refreshSource();
       setDirty(false);
       props.onSave();
     } catch (e) {

packages/plugins/mcp/src/react/atoms.ts+2−0

 import type { ScopeId } from "@executor/sdk";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { McpClient } from "./client";
 // ---------------------------------------------------------------------------
   McpClient.query("mcp", "getSource", {
     path: { scopeId, namespace },
     timeToLive: "15 seconds",
+    reactivityKeys: [ReactivityKey.sources, ReactivityKey.tools],
   });
 // ---------------------------------------------------------------------------

packages/plugins/onepassword/src/react/OnePasswordSettings.tsx+4−6

 import { useState } from "react";
-import { useAtomSet, useAtomValue, useAtomRefresh } from "@effect-atom/atom-react";
+import { useAtomSet, useAtomValue } from "@effect-atom/atom-react";
 import { Result } from "@effect-atom/atom-react";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { useScope } from "@executor/react/api/scope-context";
 import { Button } from "@executor/react/components/button";
 import { Input } from "@executor/react/components/input";
   const scopeId = useScope();
   const doConfigure = useAtomSet(configureOnePassword, { mode: "promise" });
-  const refreshConfig = useAtomRefresh(onepasswordConfigAtom(scopeId));
   const reset = () => {
     if (!isEdit) {
       await doConfigure({
         path: { scopeId },
         payload: { auth, vaultId: vaultId.trim(), name: vaultName.trim() || "1Password" },
+        reactivityKeys: [ReactivityKey.secrets],
       });
       props.onOpenChange(false);
-      refreshConfig();
       reset();
     } catch (e) {
       setError(e instanceof Error ? e.message : "Failed to save configuration");
   const scopeId = useScope();
   const configResult = useAtomValue(onepasswordConfigAtom(scopeId));
   const doRemove = useAtomSet(removeOnePasswordConfig, { mode: "promise" });
-  const refreshConfig = useAtomRefresh(onepasswordConfigAtom(scopeId));
   const handleRemove = async () => {
     try {
-      await doRemove({ path: { scopeId } });
+      await doRemove({ path: { scopeId }, reactivityKeys: [ReactivityKey.secrets] });
-      refreshConfig();
     } catch {
       /* TODO: toast */
     }

packages/plugins/onepassword/src/react/atoms.ts+6−0

 import type { ScopeId } from "@executor/sdk";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { OnePasswordClient } from "./client";
+export const onepasswordWriteKeys = [ReactivityKey.secrets] as const;
 // ---------------------------------------------------------------------------
 // Query atoms
 // ---------------------------------------------------------------------------
   OnePasswordClient.query("onepassword", "getConfig", {
     path: { scopeId },
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.secrets],
   });
 export const onepasswordStatusAtom = (scopeId: ScopeId) =>
   OnePasswordClient.query("onepassword", "status", {
     path: { scopeId },
     timeToLive: "15 seconds",
+    reactivityKeys: [ReactivityKey.secrets],
   });
 // ---------------------------------------------------------------------------
     path: { scopeId },
     urlParams: { authKind, account },
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.secrets],
   });
 // ---------------------------------------------------------------------------

packages/plugins/openapi/src/react/AddOpenApiSource.tsx+18−0

 import { SecretPicker } from "@executor/react/plugins/secret-picker";
 import { useScope } from "@executor/react/api/scope-context";
+import { sourceWriteKeys } from "@executor/react/api/reactivity-keys";
+import { usePendingSources } from "@executor/react/api/optimistic";
 import { HeadersList } from "@executor/react/plugins/headers-list";
 import {
   matchPresetKey,
   const doPreview = useAtomSet(previewOpenApiSpec, { mode: "promise" });
   const doAdd = useAtomSet(addOpenApiSpec, { mode: "promise" });
   const doStartOAuth = useAtomSet(startOpenApiOAuth, { mode: "promise" });
+  const { beginAdd } = usePendingSources();
   const secretList = useSecretPickerSecrets();
   // Keep the latest handleAnalyze in a ref so the debounced effect doesn't
   const handleAdd = async () => {
     setAdding(true);
     setAddError(null);
+    const namespace =
+      slugifyNamespace(identity.namespace) ||
+      (preview ? Option.getOrElse(preview.title, () => "openapi") : "openapi");
+    const displayName =
+      identity.name.trim() ||
+      (preview ? Option.getOrElse(preview.title, () => namespace) : namespace);
+    const placeholder = beginAdd({
+      id: namespace,
+      name: displayName,
+      kind: "openapi",
+      url: resolvedBaseUrl || undefined,
+    });
     try {
       await doAdd({
         path: { scopeId },
           ...(hasHeaders ? { headers: allHeaders } : {}),
           ...(oauth2Auth ? { oauth2: oauth2Auth } : {}),
         },
+        reactivityKeys: sourceWriteKeys,
       });
       props.onComplete();
     } catch (e) {
       setAddError(e instanceof Error ? e.message : "Failed to add source");
       setAdding(false);
+    } finally {
+      placeholder.done();
     }
   };

packages/plugins/openapi/src/react/EditOpenApiSource.tsx+3−3

 import { useState } from "react";
-import { useAtomValue, useAtomSet, useAtomRefresh, Result } from "@effect-atom/atom-react";
+import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";
 import { openApiSourceAtom, updateOpenApiSource } from "./atoms";
 import { useScope } from "@executor/react/api/scope-context";
+import { sourceWriteKeys } from "@executor/react/api/reactivity-keys";
 import { useSecretPickerSecrets } from "@executor/react/plugins/use-secret-picker-secrets";
 import {
   headerValueToState,
 }) {
   const scopeId = useScope();
   const doUpdate = useAtomSet(updateOpenApiSource, { mode: "promise" });
-  const refreshSource = useAtomRefresh(openApiSourceAtom(scopeId, props.sourceId));
   const secretList = useSecretPickerSecrets();
   const identity = useSourceIdentity({
           baseUrl: baseUrl.trim() || undefined,
           headers: headersFromState(headers),
         },
+        reactivityKeys: sourceWriteKeys,
       });
-      refreshSource();
       setDirty(false);
       props.onSave();
     } catch (e) {

packages/plugins/openapi/src/react/atoms.ts+2−0

 import type { ScopeId } from "@executor/sdk";
+import { ReactivityKey } from "@executor/react/api/reactivity-keys";
 import { OpenApiClient } from "./client";
 // ---------------------------------------------------------------------------
   OpenApiClient.query("openapi", "getSource", {
     path: { scopeId, namespace },
     timeToLive: "15 seconds",
+    reactivityKeys: [ReactivityKey.sources, ReactivityKey.tools],
   });
 // ---------------------------------------------------------------------------

packages/react/src/api/atoms.tsx+11−1

 import { Atom } from "@effect-atom/atom-react";
 import { ExecutorApiClient } from "./client";
+import { ReactivityKey } from "./reactivity-keys";
 // ---------------------------------------------------------------------------
 // Scope — fetched from the server
 export const scopeAtom = ExecutorApiClient.query("scope", "info", {
   timeToLive: "5 minutes",
+  reactivityKeys: [ReactivityKey.scope],
 });
 // ---------------------------------------------------------------------------
   ExecutorApiClient.query("tools", "list", {
     path: { scopeId },
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.tools],
   });
 /** Tools for a specific source */
   ExecutorApiClient.query("sources", "tools", {
     path: { scopeId, sourceId },
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.tools],
   });
 export const toolSchemaAtom = (scopeId: ScopeId, toolId: ToolId) =>
   ExecutorApiClient.query("tools", "schema", {
     path: { scopeId, toolId },
     timeToLive: "1 minute",
+    reactivityKeys: [ReactivityKey.tools],
   });
 export const sourcesAtom = (scopeId: ScopeId) =>
   ExecutorApiClient.query("sources", "list", {
     path: { scopeId },
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.sources],
   });
 /** Single source by id — derived from the sources list */
   ExecutorApiClient.query("secrets", "list", {
     path: { scopeId },
     timeToLive: "30 seconds",
+    reactivityKeys: [ReactivityKey.secrets],
   });
 export const secretStatusAtom = (scopeId: ScopeId, secretId: SecretId) =>
   ExecutorApiClient.query("secrets", "status", {
     path: { scopeId, secretId },
     timeToLive: "15 seconds",
+    reactivityKeys: [ReactivityKey.secrets],
   });
 // ---------------------------------------------------------------------------
-// Mutation atoms
+// Mutation atoms — reactivityKeys must be passed at call site (effect-atom
+// does not accept them at definition time). See `reactivity-keys.tsx` for the
+// canonical key arrays.
 // ---------------------------------------------------------------------------
 export const setSecret = ExecutorApiClient.mutation("secrets", "set");

packages/react/src/api/optimistic.tsx+143−0

@@ -0,0 +1,143 @@
	1	import * as React from "react";
	2	import { Atom, Result, useAtomSet, useAtomValue } from "@effect-atom/atom-react";
	3	import type { ScopeId } from "@executor/sdk";
	4
	5	import { sourcesAtom } from "./atoms";
	6
	7	/**
	8	* Client-only optimistic-update layer.
	9	*
	10	* Mutations that add a row return only after the server roundtrip. The
	11	* `pendingResourceAtom` family lets a UI insert a placeholder before the
	12	* mutation resolves so the sidebar/list updates instantly. Once the server
	13	* returns and reactivity refetches the canonical list, callers should remove
	14	* the placeholder (the dedupe in `mergePending` filters it anyway, but
	15	* explicit removal keeps the pending set bounded on errors).
	16	*
	17	* Resource keys (`"sources"`, `"secrets"`, …) match the strings in
	18	* `ReactivityKey` but are intentionally not coupled — pending state is purely
	19	* client-side.
	20	*/
	21
	22	export const PendingResource = {
	23	sources: "sources",
	24	} as const;
	25
	26	export interface PendingEntry<T> {
	27	readonly id: string;
	28	readonly value: T;
	29	}
	30
	31	const pendingFamily = Atom.family((_resource: string) =>
	32	Atom.make<ReadonlyArray<PendingEntry<unknown>>>([]),
	33	);
	34
	35	const atomFor = <T,>(resource: string) =>
	36	pendingFamily(resource) as ReturnType<typeof pendingFamily> & {
	37	readonly __t?: T;
	38	};
	39
	40	export const usePendingResource = <T,>(resource: string) => {
	41	const atom = atomFor<T>(resource);
	42	const pending = useAtomValue(atom) as ReadonlyArray<PendingEntry<T>>;
	43	const setPending = useAtomSet(atom);
	44
	45	const add = React.useCallback(
	46	(entry: PendingEntry<T>) =>
	47	setPending((prev) => [...(prev as ReadonlyArray<PendingEntry<T>>), entry]),
	48	[setPending],
	49	);
	50
	51	const remove = React.useCallback(
	52	(id: string) =>
	53	setPending((prev) =>
	54	(prev as ReadonlyArray<PendingEntry<T>>).filter((p) => p.id !== id),
	55	),
	56	[setPending],
	57	);
	58
	59	const clear = React.useCallback(() => setPending([]), [setPending]);
	60
	61	return { pending, add, remove, clear };
	62	};
	63
	64	/**
	65	* Merges pending entries with a server-loaded list. Pending entries whose id
	66	* already exists on the server are dropped so we never double-render a row
	67	* once the canonical version arrives.
	68	*/
	69	export const mergePending = <T, R>(
	70	pending: ReadonlyArray<PendingEntry<T>>,
	71	server: ReadonlyArray<R>,
	72	serverId: (row: R) => string,
	73	fromPending: (entry: PendingEntry<T>) => R,
	74	): ReadonlyArray<R> => {
	75	if (pending.length === 0) return server;
	76	const seen = new Set(server.map(serverId));
	77	const extras = pending.filter((p) => !seen.has(p.id)).map(fromPending);
	78	if (extras.length === 0) return server;
	79	return [...extras, ...server];
	80	};
	81
	82	// ---------------------------------------------------------------------------
	83	// Sources — convenience wrappers used by sidebar/list views and add forms.
	84	// Pending entries are global (not per-scope) because the user only sees one
	85	// scope at a time; this keeps the add-form code free of scope plumbing.
	86	// ---------------------------------------------------------------------------
	87
	88	export interface PendingSource {
	89	readonly name: string;
	90	readonly kind: string;
	91	readonly url?: string;
	92	}
	93
	94	/**
	95	* Sidebar/list helper. Reads `sourcesAtom(scopeId)` and merges any pending
	96	* placeholder rows on top so the UI updates instantly when an add form pushes
	97	* a placeholder.
	98	*/
	99	export const useSourcesWithPending = (scopeId: ScopeId) => {
	100	const result = useAtomValue(sourcesAtom(scopeId));
	101	const { pending } = usePendingResource<PendingSource>(PendingResource.sources);
	102	return React.useMemo(
	103	() =>
	104	Result.map(result, (sources) =>
	105	mergePending(
	106	pending,
	107	sources,
	108	(s) => s.id,
	109	(p) => ({
	110	id: p.id,
	111	name: p.value.name,
	112	kind: p.value.kind,
	113	url: p.value.url,
	114	// The placeholder cannot be removed/refreshed/edited until the
	115	// server confirms it, so disable those affordances.
	116	canRemove: false,
	117	canRefresh: false,
	118	canEdit: false,
	119	}),
	120	),
	121	),
	122	[result, pending],
	123	);
	124	};
	125
	126	/**
	127	* Hook for an add form. Returns helpers to push and clear a pending source
	128	* placeholder. On submit:
	129	* const placeholder = beginAdd({ id: namespace, name, kind });
	130	* try { await doAdd(...); } finally { placeholder.done(); }
	131	*/
	132	export const usePendingSources = () => {
	133	const { add, remove } = usePendingResource<PendingSource>(PendingResource.sources);
	134	return React.useMemo(
	135	() => ({
	136	beginAdd: (entry: { id: string } & PendingSource) => {
	137	add({ id: entry.id, value: { name: entry.name, kind: entry.kind, url: entry.url } });
	138	return { done: () => remove(entry.id) };
	139	},
	140	}),
	141	[add, remove],
	142	);
	143	};

packages/react/src/api/reactivity-keys.tsx+57−0

@@ -0,0 +1,57 @@
	1	/**
	2	* Canonical reactivity keys for query/mutation invalidation.
	3	*
	4	* effect-atom's `Reactivity` service refreshes any query whose `reactivityKeys`
	5	* overlap with a completed mutation's `reactivityKeys`. The Reactivity instance
	6	* is shared across the global Atom registry, so keys interop across plugin
	7	* clients (`McpClient`, `OpenApiClient`, `ExecutorApiClient`, …).
	8	*
	9	* Conventions:
	10	* - Every query that reads a server resource sets `reactivityKeys` at the
	11	* query atom's definition site.
	12	* - Every mutation passes `reactivityKeys` at the call site (mutations don't
	13	* accept the option at definition time — see effect-atom AtomHttpApi).
	14	* - Use the constants below; do not invent ad-hoc string keys at call sites.
	15	*
	16	* Per-scope precision is intentionally dropped: a mutation in one scope
	17	* invalidating another scope's queries is harmless (users see one scope at a
	18	* time) and keeps the convention ergonomic.
	19	*/
	20	export const ReactivityKey = {
	21	sources: "sources",
	22	tools: "tools",
	23	secrets: "secrets",
	24	scope: "scope",
	25	// cloud-only resources
	26	orgMembers: "org:members",
	27	orgDomains: "org:domains",
	28	orgInfo: "org:info",
	29	auth: "auth",
	30	} as const;
	31
	32	/** Mutations that add/remove/refresh a source also affect tool listings. */
	33	export const sourceWriteKeys = [ReactivityKey.sources, ReactivityKey.tools] as const;
	34
	35	/** Mutations that mint or revoke secrets. */
	36	export const secretWriteKeys = [ReactivityKey.secrets] as const;
	37
	38	/** Mutations that change scope membership/info. */
	39	export const scopeWriteKeys = [ReactivityKey.scope] as const;
	40
	41	/** Cloud-only: org membership mutations. */
	42	export const orgMemberWriteKeys = [ReactivityKey.orgMembers] as const;
	43
	44	/** Cloud-only: org domain mutations. */
	45	export const orgDomainWriteKeys = [ReactivityKey.orgDomains] as const;
	46
	47	/** Cloud-only: org info mutations (name, etc.) — also touches scope/auth. */
	48	export const orgInfoWriteKeys = [ReactivityKey.orgInfo, ReactivityKey.auth] as const;
	49
	50	/** Cloud-only: auth mutations (org switch/create) — invalidate everything user-visible. */
	51	export const authWriteKeys = [
	52	ReactivityKey.auth,
	53	ReactivityKey.orgInfo,
	54	ReactivityKey.orgMembers,
	55	ReactivityKey.orgDomains,
	56	ReactivityKey.scope,
	57	] as const;

packages/react/src/pages/secrets.tsx+4−5

 import { useState, Suspense } from "react";
-import { useAtomValue, useAtomSet, useAtomRefresh, Result } from "@effect-atom/atom-react";
+import { useAtomValue, useAtomSet, Result } from "@effect-atom/atom-react";
 import { secretsAtom, setSecret, removeSecret } from "../api/atoms";
+import { secretWriteKeys } from "../api/reactivity-keys";
 import type { SecretProviderPlugin } from "../plugins/secret-provider-plugin";
 import { SecretId } from "@executor/sdk";
 import { useScope } from "../hooks/use-scope";
   const scopeId = useScope();
   const doSet = useAtomSet(setSecret, { mode: "promise" });
-  const refresh = useAtomRefresh(secretsAtom(scopeId));
   const reset = () => {
     setId("");
           value: value.trim(),
           provider: provider === "auto" ? undefined : provider,
         },
+        reactivityKeys: secretWriteKeys,
       });
       reset();
       props.onOpenChange(false);
-      refresh();
     } catch (e) {
       setError(e instanceof Error ? e.message : "Failed to save secret");
       setSaving(false);
   const scopeId = useScope();
   const secrets = useAtomValue(secretsAtom(scopeId));
   const doRemove = useAtomSet(removeSecret, { mode: "promise" });
-  const refresh = useAtomRefresh(secretsAtom(scopeId));
   const handleRemove = async (secretId: string) => {
     try {
           scopeId,
           secretId: SecretId.make(secretId),
         },
+        reactivityKeys: secretWriteKeys,
       });
-      refresh();
     } catch {
       // TODO: toast
     }

packages/react/src/pages/source-detail.tsx+3−5

   removeSource,
   refreshSource,
 } from "../api/atoms";
+import { sourceWriteKeys } from "../api/reactivity-keys";
 import { ToolTree } from "../components/tool-tree";
 import { ToolDetail, ToolDetailEmpty } from "../components/tool-detail";
 import type { ToolSummary } from "../components/tool-tree";
     try {
       await doRemove({
         path: { scopeId, sourceId: namespace },
+        reactivityKeys: sourceWriteKeys,
       });
-      refreshSources();
       void navigate({ to: "/" });
     } catch {
       setDeleting(false);
     try {
       await doRefresh({
         path: { scopeId, sourceId: namespace },
+        reactivityKeys: sourceWriteKeys,
       });
-      refreshTools();
-      refreshSources();
     } finally {
       setRefreshing(false);
     }
   const handleEditSave = () => {
     setEditing(false);
-    refreshSources();
-    refreshTools();
   };
   return (

packages/react/src/pages/sources-add.tsx+0−6

 import { Suspense } from "react";
 import { Link, useNavigate } from "@tanstack/react-router";
 import type { SourcePlugin } from "../plugins/source-plugin";
-import { useAtomRefresh } from "@effect-atom/atom-react";
-import { sourcesAtom } from "../api/atoms";
-import { useScope } from "../hooks/use-scope";
 // ---------------------------------------------------------------------------
 // Page
   sourcePlugins: readonly SourcePlugin[];
 }) {
   const { pluginKey, url, preset, namespace, sourcePlugins } = props;
-  const scopeId = useScope();
-  const refreshSources = useAtomRefresh(sourcesAtom(scopeId));
   const navigate = useNavigate();
   const plugin = sourcePlugins.find((p) => p.key === pluginKey);
             initialPreset={preset}
             initialNamespace={namespace}
             onComplete={() => {
-              refreshSources();
               void navigate({ to: "/" });
             }}
             onCancel={() => {

packages/react/src/pages/sources.tsx+4−3

 import { useState, useCallback, useMemo } from "react";
 import { Link, useNavigate } from "@tanstack/react-router";
-import { Result, useAtomValue, useAtomSet } from "@effect-atom/atom-react";
+import { Result, useAtomSet } from "@effect-atom/atom-react";
-import { sourcesAtom, detectSource } from "../api/atoms";
+import { detectSource } from "../api/atoms";
+import { useSourcesWithPending } from "../api/optimistic";
 import { useScope } from "../hooks/use-scope";
 import type { SourcePlugin, SourcePreset } from "../plugins/source-plugin";
 import { McpInstallCard } from "../components/mcp-install-card";
   const [error, setError] = useState<string | null>(null);
   const scopeId = useScope();
-  const sources = useAtomValue(sourcesAtom(scopeId));
+  const sources = useSourcesWithPending(scopeId);
   const doDetect = useAtomSet(detectSource, { mode: "promise" });
   const navigate = useNavigate();

packages/react/src/plugins/secret-header-auth.tsx+4−4

 import { useId, useState } from "react";
-import { useAtomRefresh, useAtomSet } from "@effect-atom/atom-react";
+import { useAtomSet } from "@effect-atom/atom-react";
-import { secretsAtom, setSecret, resolveSecret } from "../api/atoms";
+import { setSecret, resolveSecret } from "../api/atoms";
+import { secretWriteKeys } from "../api/reactivity-keys";
 import { useScope } from "../api/scope-context";
 import { Button } from "../components/button";
 import { Field, FieldError, FieldGroup, FieldLabel } from "../components/field";
   const [error, setError] = useState<string | null>(null);
   const scopeId = useScope();
   const doSet = useAtomSet(setSecret, { mode: "promise" });
-  const refreshSecrets = useAtomRefresh(secretsAtom(scopeId));
   const secretIdInputId = useId();
   const secretNameInputId = useId();
   const secretValueInputId = useId();
           name: `${secretName.trim() || secretId.trim()} (Auth header: ${props.headerName})`,
           value: secretValue.trim(),
         },
+        reactivityKeys: secretWriteKeys,
       });
-      refreshSecrets();
       props.onCreated(secretId.trim());
     } catch (e) {
       setError(e instanceof Error ? e.message : "Failed to save secret");

scripts/check-reactivity-keys.ts+124−0

@@ -0,0 +1,124 @@
	1	#!/usr/bin/env bun
	2	// Fail CI when a frontend file calls a mutation via `useAtomSet(<atom>, { mode: "promise" })`
	3	// without ever passing `reactivityKeys` in the corresponding call args.
	4	//
	5	// The check is intentionally coarse: per-file we count `useAtomSet(...)` sites
	6	// and `reactivityKeys` mentions. A file with N mutation sites must mention
	7	// `reactivityKeys` at least N times. Read-only mutations (probes, previews,
	8	// auth-flow starts) are allow-listed so the convention can be locked in
	9	// without false positives.
	10	//
	11	// Run: `bun run scripts/check-reactivity-keys.ts`
	12	// Exits 1 with a punch list when violations exist.
	13
	14	import { Glob } from "bun";
	15
	16	const ROOTS = ["packages", "apps"];
	17
	18	// Mutations that intentionally do not invalidate any cached query (probes,
	19	// previews, OAuth-flow kickoffs that just open a window).
	20	const READ_ONLY_MUTATIONS = new Set<string>([
	21	"probeMcpEndpoint",
	22	"startMcpOAuth",
	23	"probeGoogleDiscovery",
	24	"startGoogleDiscoveryOAuth",
	25	"previewOpenApiSpec",
	26	"startOpenApiOAuth",
	27	"resolveSecret",
	28	"detectSource",
	29	"getDomainVerificationLink",
	30	]);
	31
	32	interface Violation {
	33	readonly file: string;
	34	readonly line: number;
	35	readonly mutationVar: string;
	36	}
	37
	38	const violations: Violation[] = [];
	39
	40	const useAtomSetRegex = /useAtomSet$\s([A-Za-z_][\w])\s,\s\{\smode:\s"promise"\s\}\s$/g;
	41
	42	for (const root of ROOTS) {
	43	const glob = new Glob(`${root}/*/.{ts,tsx}`);
	44	for await (const path of glob.scan({ cwd: import.meta.dir + "/.." })) {
	45	if (path.includes("node_modules") \|\| path.includes(".test.") \|\| path.endsWith(".d.ts")) continue;
	46	const file = Bun.file(`${import.meta.dir}/../${path}`);
	47	const text = await file.text();
	48	if (!text.includes("useAtomSet")) continue;
	49
	50	const lines = text.split("\n");
	51	let cursor = 0;
	52	for (const line of lines) {
	53	cursor++;
	54	useAtomSetRegex.lastIndex = 0;
	55	const match = useAtomSetRegex.exec(line);
	56	if (!match) continue;
	57	const mutationVar = match[1] ?? "<unknown>";
	58	// The variable being declared from useAtomSet is what the file later awaits.
	59	// Find the binding name to look up the await call.
	60	const bindingMatch = line.match(/const\s+(\w+)\s=\suseAtomSet/);
	61	const binding = bindingMatch?.[1];
	62
	63	if (READ_ONLY_MUTATIONS.has(mutationVar)) continue;
	64	if (!binding) continue;
	65
	66	// Look for `await <binding>(...)` calls in the rest of the file and
	67	// check whether the args object contains `reactivityKeys`. We scan
	68	// line-by-line and grow a brace-aware window once we see the call.
	69	const callRegex = new RegExp(`await\\s+${binding}\\s*\\(`);
	70	let i = cursor;
	71	while (i < lines.length) {
	72	const l = lines[i] ?? "";
	73	if (callRegex.test(l)) {
	74	// Extract the args block from the opening paren until balanced close.
	75	let depth = 0;
	76	let started = false;
	77	let argText = "";
	78	let j = i;
	79	while (j < lines.length) {
	80	const cur = lines[j] ?? "";
	81	for (const ch of cur) {
	82	if (ch === "(") {
	83	depth++;
	84	started = true;
	85	continue;
	86	}
	87	if (started && ch === ")") {
	88	depth--;
	89	if (depth === 0) break;
	90	}
	91	if (started) argText += ch;
	92	}
	93	if (started && depth === 0) break;
	94	j++;
	95	if (j - i > 60) break; // bail on runaway
	96	}
	97	if (!argText.includes("reactivityKeys")) {
	98	violations.push({ file: path, line: i + 1, mutationVar });
	99	}
	100	break;
	101	}
	102	i++;
	103	if (i - cursor > 80) break; // give up on this site if the await is far away
	104	}
	105	}
	106	}
	107	}
	108
	109	if (violations.length === 0) {
	110	console.log("✓ reactivityKeys check passed");
	111	process.exit(0);
	112	}
	113
	114	console.error(`✗ reactivityKeys check failed — ${violations.length} mutation call(s) missing reactivityKeys:\n`);
	115	for (const v of violations) {
	116	console.error(` ${v.file}:${v.line} — ${v.mutationVar}`);
	117	}
	118	console.error(
	119	`\nEvery write mutation must pass reactivityKeys at the call site.\n` +
	120	`See packages/react/src/api/reactivity-keys.tsx for canonical key arrays.\n` +
	121	`If this mutation truly is read-only (probe/preview/OAuth-start), add it to\n` +
	122	`the READ_ONLY_MUTATIONS allowlist in scripts/check-reactivity-keys.ts.`,
	123	);
	124	process.exit(1);