**10 issues found across 9 files (changes from recent commits).**

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P1: Do not include `configuration_scopes` in the connection install payload; this can overwrite/drop backend-populated registry scopes. (Based on your team's feedback about excluding `configuration_scopes` from connection create/install payloads.) [FEEDBACK_USED] P1: `fetch` does not throw on HTTP error responses. If saving the OAuth token fails server-side, the card will still show success. Check `response.ok` and throw on failure. P1: `fetch` does not throw on HTTP error responses (4xx/5xx). If the token save fails server-side, the card will incorrectly show "Authenticated". Check `response.ok` and throw on failure. P2: Duplicate matching should use the canonical connection slug, not `connection_url`/`app_name` equality, to avoid misidentifying unrelated connections as duplicates. (Based on your team's feedback about using `getConnectionSlug()` as the canonical identifier for sibling connection matching.) [FEEDBACK_USED] P1: Do not let install input override `configuration_scopes`; use backend-fetched scopes so auth requirements and stored scopes stay consistent. (Based on your team's feedback about not setting `configuration_scopes` from create/install payloads because it can drop registry scopes.) [FEEDBACK_USED] P2: Do not pass `configuration_scopes` through install input; it can override backend-discovered scopes during connection creation. (Based on your team's feedback about not sending configuration_scopes in creation/install payloads.) [FEEDBACK_USED] P2: The success invalidation targets `KEYS.connections(...)`, but connection lists are cached under collection query keys, so installs may not refresh `useConnections()` data. P2: Handle `result.is_existing` in the create flow before navigating; otherwise duplicate installs can navigate using `newId` for a connection that was not created. P1: Do not send `configuration_scopes` in the install payload; it can overwrite backend-populated scopes and produce incorrect auth scope state. (Based on your team's feedback about excluding `configuration_scopes` from create/install payloads.) [FEEDBACK_USED] P1: Do not send `configuration_scopes` in the install payload; it can override MCP-fetched scopes and store incorrect auth scope state. (Based on your team's feedback about avoiding `configuration_scopes` in creation/install payloads.) [FEEDBACK_USED] ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review.}