@desplega.ai/agent-swarm 1.119.6 → 1.121.0

package/src/http/mcp-bridge.ts

@@ -11,8 +11,11 @@ let _bridgeServer: McpServer | null = null;
 function getBridgeServer(): McpServer {
   if (!_bridgeServer) {
     // Always full tool surface: the bridge is how scripts reach every SDK
-    // tool, including when SCRIPTS_ONLY_MCP trims the external MCP server.
-    _bridgeServer = createServer({ scriptsOnly: false });
+    // tool, including when SCRIPTS_ONLY_MCP trims the external MCP server or
+    // CAPABILITIES trims the externally exposed tool groups. Capability flags
+    // shape the agents' MCP tool list, not what scripts can do — the scripts
+    // surface is governed by SDK_ALLOWLIST instead.
+    _bridgeServer = createServer({ scriptsOnly: false, fullSurface: true });
   }
   return _bridgeServer;
 }

package/src/http/mcp-oauth.ts

@@ -6,7 +6,6 @@ import {
   applyMcpOAuthRefresh,
   consumeMcpOAuthPending,
   deleteMcpOAuthToken,
-  gcMcpOAuthPending,
   getMcpOAuthToken,
   insertMcpOAuthPending,
   setMcpServerAuthMethod,
@@ -407,6 +406,103 @@ async function prepareAuthorizeFlow(
   return built.url;
 }
 
+// ─── Callback completion (shared with the static /api/oauth/callback route) ──
+
+interface OAuthCallbackParams {
+  code?: string;
+  state?: string;
+  error?: string;
+  error_description?: string;
+}
+
+/**
+ * Complete an MCP-flow OAuth callback: consume the `mcp` pending row, exchange
+ * the code, upsert the token, and flip `authMethod=oauth`. Shared by the legacy
+ * `/api/mcp-oauth/callback` route and the unified `/api/oauth/callback` route.
+ * Returns false (without writing a response) when no `mcp` pending row matches
+ * `state`, so the unified handler can report a single invalid-state error.
+ */
+export async function completeMcpOAuthCallback(
+  res: ServerResponse,
+  query: OAuthCallbackParams,
+): Promise<boolean> {
+  const state = query.state;
+  if (!state) return false;
+  const pending = consumeMcpOAuthPending(state);
+  if (!pending) return false;
+
+  const dashboardBaseUrl = pending.finalRedirect ?? defaultFinalRedirect(pending.mcpServerId);
+
+  if (query.error) {
+    const target = new URL(dashboardBaseUrl);
+    target.searchParams.set("oauth", "error");
+    target.searchParams.set("error", query.error);
+    if (query.error_description) {
+      target.searchParams.set("error_description", query.error_description);
+    }
+    res.writeHead(302, { Location: target.toString() });
+    res.end();
+    return true;
+  }
+
+  if (!query.code) {
+    jsonError(res, "Missing authorization code", 400);
+    return true;
+  }
+
+  try {
+    const tokens = await exchangeCodeForTokens({
+      tokenUrl: pending.tokenUrl,
+      clientId: pending.dcrClientId ?? "",
+      clientSecret: pending.dcrClientSecret ?? undefined,
+      redirectUri: pending.redirectUri,
+      code: query.code,
+      codeVerifier: pending.codeVerifier,
+      resource: pending.resourceUrl,
+    });
+    const existing = getMcpOAuthToken(pending.mcpServerId, pending.userId);
+    const clientSource =
+      existing?.clientSource ??
+      (pending.dcrClientId ? ("dcr" as const) : ("preregistered" as const));
+
+    upsertMcpOAuthToken({
+      mcpServerId: pending.mcpServerId,
+      userId: pending.userId,
+      accessToken: tokens.access_token,
+      ...(tokens.refresh_token != null ? { refreshToken: tokens.refresh_token } : {}),
+      tokenType: tokens.token_type ?? "Bearer",
+      expiresAt: computeExpiresAt(tokens.expires_in),
+      scope: tokens.scope ?? pending.scopes ?? null,
+      resourceUrl: pending.resourceUrl,
+      authorizationServerIssuer: pending.authorizationServerIssuer,
+      authorizeUrl: pending.authorizeUrl,
+      tokenUrl: pending.tokenUrl,
+      revocationUrl: pending.revocationUrl,
+      dcrClientId: pending.dcrClientId,
+      dcrClientSecret: pending.dcrClientSecret,
+      clientSource,
+      lastRefreshedAt: new Date().toISOString(),
+    });
+
+    // Flip authMethod=oauth so resolveSecrets picks this up.
+    setMcpServerAuthMethod(pending.mcpServerId, "oauth");
+
+    const target = new URL(dashboardBaseUrl);
+    target.searchParams.set("oauth", "success");
+    res.writeHead(302, { Location: target.toString() });
+    res.end();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error("[mcp-oauth] callback exchange failed:", message);
+    const target = new URL(dashboardBaseUrl);
+    target.searchParams.set("oauth", "error");
+    target.searchParams.set("error_description", message);
+    res.writeHead(302, { Location: target.toString() });
+    res.end();
+  }
+  return true;
+}
+
 // ─── Handler ─────────────────────────────────────────────────────────────────
 
 export async function handleMcpOAuth(
@@ -420,85 +516,13 @@ export async function handleMcpOAuth(
     const parsed = await callbackRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
 
-    const state = parsed.query.state;
-    if (!state) {
+    if (!parsed.query.state) {
       jsonError(res, "Missing state parameter", 400);
       return true;
     }
-    const pending = consumeMcpOAuthPending(state);
-    if (!pending) {
+    const handled = await completeMcpOAuthCallback(res, parsed.query);
+    if (!handled) {
       jsonError(res, "Invalid or expired OAuth state", 400);
-      return true;
-    }
-
-    const dashboardBaseUrl = pending.finalRedirect ?? defaultFinalRedirect(pending.mcpServerId);
-
-    if (parsed.query.error) {
-      const target = new URL(dashboardBaseUrl);
-      target.searchParams.set("oauth", "error");
-      target.searchParams.set("error", parsed.query.error);
-      if (parsed.query.error_description) {
-        target.searchParams.set("error_description", parsed.query.error_description);
-      }
-      res.writeHead(302, { Location: target.toString() });
-      res.end();
-      return true;
-    }
-
-    if (!parsed.query.code) {
-      jsonError(res, "Missing authorization code", 400);
-      return true;
-    }
-
-    try {
-      const tokens = await exchangeCodeForTokens({
-        tokenUrl: pending.tokenUrl,
-        clientId: pending.dcrClientId ?? "",
-        clientSecret: pending.dcrClientSecret ?? undefined,
-        redirectUri: pending.redirectUri,
-        code: parsed.query.code,
-        codeVerifier: pending.codeVerifier,
-        resource: pending.resourceUrl,
-      });
-      const existing = getMcpOAuthToken(pending.mcpServerId, pending.userId);
-      const clientSource =
-        existing?.clientSource ??
-        (pending.dcrClientId ? ("dcr" as const) : ("preregistered" as const));
-
-      upsertMcpOAuthToken({
-        mcpServerId: pending.mcpServerId,
-        userId: pending.userId,
-        accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token ?? null,
-        tokenType: tokens.token_type ?? "Bearer",
-        expiresAt: computeExpiresAt(tokens.expires_in),
-        scope: tokens.scope ?? pending.scopes ?? null,
-        resourceUrl: pending.resourceUrl,
-        authorizationServerIssuer: pending.authorizationServerIssuer,
-        authorizeUrl: pending.authorizeUrl,
-        tokenUrl: pending.tokenUrl,
-        revocationUrl: pending.revocationUrl,
-        dcrClientId: pending.dcrClientId,
-        dcrClientSecret: pending.dcrClientSecret,
-        clientSource,
-        lastRefreshedAt: new Date().toISOString(),
-      });
-
-      // Flip authMethod=oauth so resolveSecrets picks this up.
-      setMcpServerAuthMethod(pending.mcpServerId, "oauth");
-
-      const target = new URL(dashboardBaseUrl);
-      target.searchParams.set("oauth", "success");
-      res.writeHead(302, { Location: target.toString() });
-      res.end();
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      console.error("[mcp-oauth] callback exchange failed:", message);
-      const target = new URL(dashboardBaseUrl);
-      target.searchParams.set("oauth", "error");
-      target.searchParams.set("error_description", message);
-      res.writeHead(302, { Location: target.toString() });
-      res.end();
     }
     return true;
   }
@@ -639,6 +663,7 @@ export async function handleMcpOAuth(
         refreshToken: refreshed.refresh_token ?? undefined,
         expiresAt: computeExpiresAt(refreshed.expires_in),
         scope: refreshed.scope ?? null,
+        expectedTokenVersion: existing.tokenVersion,
       });
       json(res, {
         ok: true,
@@ -764,31 +789,8 @@ export async function handleMcpOAuth(
   return false;
 }
 
-// ─── Pending garbage collector ───────────────────────────────────────────────
-
-let gcTimer: ReturnType<typeof setInterval> | null = null;
-
-export function startMcpOAuthPendingGc(intervalMs = 5 * 60 * 1000): void {
-  if (gcTimer) return;
-  gcTimer = setInterval(() => {
-    try {
-      const removed = gcMcpOAuthPending();
-      if (removed > 0) {
-        console.debug(`[mcp-oauth] GC removed ${removed} expired pending session(s)`);
-      }
-    } catch (err) {
-      console.error("[mcp-oauth] GC failed:", err);
-    }
-  }, intervalMs);
-  if (typeof gcTimer?.unref === "function") gcTimer.unref();
-}
-
-export function stopMcpOAuthPendingGc(): void {
-  if (gcTimer) {
-    clearInterval(gcTimer);
-    gcTimer = null;
-  }
-}
+// Pending garbage collection now runs through the unified GC in
+// `oauth-callback.ts` (`startOAuthPendingGc`), which sweeps all flows.
 
 // Expose internal helpers for the resolveSecrets extension in mcp-servers.ts.
 export { ensureMcpToken };

package/src/http/oauth-callback.ts

@@ -0,0 +1,332 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { z } from "zod";
+import { gcMcpOAuthPending } from "@/be/db-queries/mcp-oauth";
+import {
+  consumeOAuthPending,
+  gcOAuthPending,
+  getOAuthAppById,
+  updateAuthorizationIdentity,
+  upsertAuthorization,
+} from "@/be/db-queries/oauth";
+import { resolveAndStoreJiraCloudId } from "@/jira/oauth";
+import { captureLinearAppUserId } from "@/linear/oauth";
+import { oauthAppRowToProviderConfig } from "@/oauth/ensure-token";
+import { captureIdentity } from "@/oauth/identity-capture";
+import { exchangeAuthorizationCode } from "@/oauth/wrapper";
+import { getPublicMcpBaseUrl } from "@/utils/constants";
+import { registerVolatileSecret, scrubSecrets } from "@/utils/secret-scrubber";
+import { completeMcpOAuthCallback } from "./mcp-oauth";
+import { route } from "./route-def";
+import { json, jsonError } from "./utils";
+
+// ─── The single static callback + redirect-uri display ───────────────────────
+
+/** The constant, state-keyed OAuth redirect target for all flows. */
+export function staticOAuthCallbackUri(): string {
+  return `${getPublicMcpBaseUrl()}/api/oauth/callback`;
+}
+
+const callbackRoute = route({
+  method: "get",
+  path: "/api/oauth/callback",
+  pattern: ["api", "oauth", "callback"],
+  operationId: "oauth_static_callback",
+  summary: "Single static OAuth redirect target (state-keyed, all flows)",
+  tags: ["OAuth"],
+  auth: { apiKey: false },
+  query: z.object({
+    code: z.string().optional(),
+    state: z.string().optional(),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+  }),
+  responses: {
+    200: { description: "OAuth authorization completed" },
+    302: { description: "Redirect back to the final destination" },
+    400: { description: "Missing or invalid OAuth callback parameters" },
+    404: { description: "OAuth app not configured" },
+    502: { description: "Token exchange failed" },
+  },
+});
+
+const redirectUriRoute = route({
+  method: "get",
+  path: "/api/oauth/redirect-uri",
+  pattern: ["api", "oauth", "redirect-uri"],
+  operationId: "oauth_redirect_uri",
+  summary: "The static OAuth callback URL to register with providers (pre-creation display)",
+  tags: ["OAuth"],
+  responses: {
+    200: { description: "{ redirectUri: string }" },
+  },
+});
+
+interface OAuthCallbackParams {
+  code?: string;
+  state?: string;
+  error?: string;
+  error_description?: string;
+}
+
+/** Escape a value for safe interpolation into the success HTML page. */
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function sendAuthorizedHtml(res: ServerResponse, provider: string, label: string): void {
+  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(`<!DOCTYPE html>
+<html>
+<head><title>OAuth Authorized</title></head>
+<body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0;">
+  <main style="text-align: center;">
+    <h1>${escapeHtml(provider)} authorized</h1>
+    <p>Connected the "${escapeHtml(label)}" authorization. You can close this tab.</p>
+  </main>
+</body>
+</html>`);
+}
+
+/**
+ * 302 to a caller-supplied `finalRedirect`. Rejects non-http(s) schemes
+ * (javascript:/data:) so the redirect target can never carry script; an origin
+ * allowlist is out of scope for step-4 (noted for a follow-up). Falls back to a
+ * plain error page when the target is unsafe.
+ */
+function redirectWith(res: ServerResponse, base: string, params: Record<string, string>): void {
+  let target: URL;
+  try {
+    target = new URL(base);
+  } catch {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("Invalid redirect target.");
+    return;
+  }
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("Unsupported redirect scheme.");
+    return;
+  }
+  for (const [key, value] of Object.entries(params)) target.searchParams.set(key, value);
+  res.writeHead(302, { Location: target.toString() });
+  res.end();
+}
+
+/**
+ * Provider-specific post-processing for a completed `flow='tracker'`
+ * authorization, folded onto the unified callback from the retired dedicated
+ * tracker callbacks:
+ *
+ * - **jira**: resolve the workspace `cloudId`/`siteUrl` into `oauth_apps`
+ *   metadata. Required for the Jira REST API — failures propagate to the caller.
+ * - **linear**: capture the bot `appUserId` (best-effort — swallowed here so it
+ *   never fails the OAuth callback).
+ */
+async function runTrackerCallbackPostProcess(provider: string, accessToken: string): Promise<void> {
+  if (provider === "jira") {
+    await resolveAndStoreJiraCloudId(accessToken);
+    return;
+  }
+  if (provider === "linear") {
+    try {
+      await captureLinearAppUserId(accessToken);
+    } catch (err) {
+      console.warn(
+        scrubSecrets(
+          `[Linear] Failed to capture appUserId during OAuth completion (non-fatal): ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        ),
+      );
+    }
+  }
+}
+
+/**
+ * Complete a generic/tracker OAuth callback: consume the pending row, exchange
+ * the code against the app's token endpoint, upsert the `(appId, label)`
+ * authorization, and capture account identity (best-effort). Returns
+ * `{ handled: false }` (without writing a response) when no generic/tracker
+ * pending row matches `state`, so callers can fall through to the MCP flow.
+ */
+export async function completeGenericOAuthCallback(
+  res: ServerResponse,
+  query: OAuthCallbackParams,
+): Promise<{ handled: boolean }> {
+  const state = query.state;
+  if (!state) return { handled: false };
+
+  const pending = consumeOAuthPending(state);
+  if (!pending) return { handled: false };
+
+  const app = getOAuthAppById(pending.appId);
+  if (!app) {
+    if (pending.finalRedirect) {
+      redirectWith(res, pending.finalRedirect, { oauth: "error", error: "app_not_found" });
+    } else {
+      jsonError(res, "OAuth app is no longer configured", 404);
+    }
+    return { handled: true };
+  }
+
+  if (query.error) {
+    const description = query.error_description ?? query.error;
+    if (pending.finalRedirect) {
+      redirectWith(res, pending.finalRedirect, {
+        oauth: "error",
+        error: query.error,
+        error_description: description,
+      });
+    } else {
+      jsonError(res, description, 400);
+    }
+    return { handled: true };
+  }
+
+  if (!query.code) {
+    if (pending.finalRedirect) {
+      redirectWith(res, pending.finalRedirect, { oauth: "error", error: "missing_code" });
+    } else {
+      jsonError(res, "Missing authorization code", 400);
+    }
+    return { handled: true };
+  }
+
+  try {
+    const config = oauthAppRowToProviderConfig(app);
+    const tokens = await exchangeAuthorizationCode(config, {
+      code: query.code,
+      codeVerifier: pending.codeVerifier,
+      redirectUri: pending.redirectUri,
+    });
+    // No `expires_in` means the provider issued a non-expiring token (e.g. the
+    // GitHub OAuth preset, which returns a long-lived token and no refresh
+    // token). Store NULL — a fabricated expiry would later drive the sweep /
+    // resolveOAuthBindingToken to mark the authorization refresh-failed (no
+    // refresh token to rotate) while the token is still perfectly valid. NULL
+    // means "does not expire / never proactively refresh" throughout.
+    const expiresAt = tokens.expiresIn
+      ? new Date(Date.now() + tokens.expiresIn * 1000).toISOString()
+      : null;
+
+    const authorization = upsertAuthorization({
+      appId: pending.appId,
+      label: pending.label,
+      accessToken: tokens.accessToken,
+      ...(tokens.refreshToken != null ? { refreshToken: tokens.refreshToken } : {}),
+      ...(tokens.tokenType ? { tokenType: tokens.tokenType } : {}),
+      expiresAt,
+      ...(tokens.scope != null ? { scope: tokens.scope } : {}),
+      ...(pending.userId ? { userId: pending.userId, connectedByUserId: pending.userId } : {}),
+      status: "active",
+    });
+
+    const identity = await captureIdentity({
+      userinfoUrl: app.userinfoUrl,
+      accessToken: tokens.accessToken,
+      idToken: tokens.idToken,
+    });
+    if (identity) {
+      updateAuthorizationIdentity(authorization.id, {
+        accountEmail: identity.accountEmail,
+        identityJson: identity.identityJson,
+      });
+    }
+
+    // Tracker (Linear/Jira) flows fold onto this unified handler; run the
+    // provider-specific post-exchange step that used to live in the dedicated
+    // tracker callbacks. Jira cloudId resolution is REQUIRED (jiraFetch depends
+    // on it) so a failure surfaces via the outer catch; Linear appUserId
+    // capture is best-effort and swallowed inside the helper.
+    if (pending.flow === "tracker") {
+      await runTrackerCallbackPostProcess(app.provider, tokens.accessToken);
+    }
+
+    if (pending.finalRedirect) {
+      redirectWith(res, pending.finalRedirect, { oauth: "success" });
+    } else {
+      sendAuthorizedHtml(res, app.provider, pending.label);
+    }
+  } catch (err) {
+    const rawMessage = err instanceof Error ? err.message : String(err);
+    // The provider token-endpoint body can echo back secrets — scrub before it
+    // reaches the log AND the browser/finalRedirect. The posted client_secret
+    // and PKCE code verifier are DB-sourced (not in scrubSecrets' env/shape
+    // cache), so register them as volatile first, like ensure-token.ts does.
+    if (app.clientSecret) registerVolatileSecret(app.clientSecret, "oauth-client-secret");
+    if (pending.codeVerifier) registerVolatileSecret(pending.codeVerifier, "oauth-code-verifier");
+    const message = scrubSecrets(rawMessage);
+    console.warn(`[oauth] callback exchange failed for ${app.provider}: ${message}`);
+    if (pending.finalRedirect) {
+      redirectWith(res, pending.finalRedirect, { oauth: "error", error_description: message });
+    } else {
+      jsonError(res, `Token exchange failed: ${message}`, 502);
+    }
+  }
+  return { handled: true };
+}
+
+// ─── Handler ─────────────────────────────────────────────────────────────────
+
+export async function handleOAuthCallback(
+  req: IncomingMessage,
+  res: ServerResponse,
+  pathSegments: string[],
+  queryParams: URLSearchParams,
+): Promise<boolean> {
+  if (redirectUriRoute.match(req.method, pathSegments)) {
+    json(res, { redirectUri: staticOAuthCallbackUri() });
+    return true;
+  }
+
+  if (!callbackRoute.match(req.method, pathSegments)) return false;
+
+  const parsed = await callbackRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed) return true;
+
+  if (!parsed.query.state) {
+    jsonError(res, "Missing state parameter", 400);
+    return true;
+  }
+
+  const generic = await completeGenericOAuthCallback(res, parsed.query);
+  if (generic.handled) return true;
+
+  // Not a generic/tracker pending — try the MCP flow (same static callback).
+  const mcpHandled = await completeMcpOAuthCallback(res, parsed.query);
+  if (!mcpHandled) {
+    jsonError(res, "Invalid or expired OAuth state", 400);
+  }
+  return true;
+}
+
+// ─── Unified pending garbage collector (all flows) ───────────────────────────
+
+let gcTimer: ReturnType<typeof setInterval> | null = null;
+
+export function startOAuthPendingGc(intervalMs = 5 * 60 * 1000): void {
+  if (gcTimer) return;
+  gcTimer = setInterval(() => {
+    try {
+      const removed = gcOAuthPending() + gcMcpOAuthPending();
+      if (removed > 0) {
+        console.debug(`[oauth] GC removed ${removed} expired pending session(s)`);
+      }
+    } catch (err) {
+      console.error("[oauth] pending GC failed:", err);
+    }
+  }, intervalMs);
+  if (typeof gcTimer?.unref === "function") gcTimer.unref();
+}
+
+export function stopOAuthPendingGc(): void {
+  if (gcTimer) {
+    clearInterval(gcTimer);
+    gcTimer = null;
+  }
+}

package/src/http/oauth-generic.ts

@@ -1,18 +1,23 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
-import { getOAuthProviderConfig } from "@/be/oauth-credential-bindings";
-import { exchangeCode } from "@/oauth/wrapper";
+import { completeGenericOAuthCallback } from "./oauth-callback";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
-const DEDICATED_CALLBACK_PROVIDERS = new Set(["linear"]);
-
+/**
+ * Legacy per-provider OAuth redirect target. Retained as a thin compatibility
+ * wrapper over the unified, state-keyed callback: everything routes through
+ * {@link completeGenericOAuthCallback} by `state`, so the `{provider}` path
+ * param is now purely cosmetic. New apps use the single static
+ * `/api/oauth/callback` instead. The old linear/jira 409 asymmetry is gone —
+ * tracker flows resolve through the same handler.
+ */
 const genericOAuthCallbackRoute = route({
   method: "get",
   path: "/api/oauth/{provider}/callback",
   pattern: ["api", "oauth", null, "callback"],
   operationId: "oauth_generic_callback",
-  summary: "Generic OAuth redirect target for script credential bindings",
+  summary: "Legacy per-provider OAuth redirect target (delegates to the static callback)",
   tags: ["OAuth"],
   auth: { apiKey: false },
   params: z.object({
@@ -32,25 +37,10 @@ const genericOAuthCallbackRoute = route({
     200: { description: "OAuth authorization completed" },
     400: { description: "Missing or invalid OAuth callback parameters" },
     404: { description: "OAuth app not configured" },
-    409: { description: "Provider has a dedicated OAuth callback" },
     502: { description: "Token exchange failed" },
   },
 });
 
-function sendAuthorizedHtml(res: ServerResponse, provider: string): void {
-  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-  res.end(`<!DOCTYPE html>
-<html>
-<head><title>OAuth Authorized</title></head>
-<body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0;">
-  <main style="text-align: center;">
-    <h1>${provider} authorized</h1>
-    <p>You can close this tab.</p>
-  </main>
-</body>
-</html>`);
-}
-
 export async function handleGenericOAuth(
   req: IncomingMessage,
   res: ServerResponse,
@@ -62,44 +52,14 @@ export async function handleGenericOAuth(
   const parsed = await genericOAuthCallbackRoute.parse(req, res, pathSegments, queryParams);
   if (!parsed) return true;
 
-  const { provider } = parsed.params;
-  if (DEDICATED_CALLBACK_PROVIDERS.has(provider)) {
-    jsonError(
-      res,
-      "Provider linear uses the dedicated OAuth flow at /api/trackers/linear/authorize and /api/trackers/linear/callback.",
-      409,
-    );
-    return true;
-  }
-
-  if (parsed.query.error) {
-    jsonError(res, parsed.query.error_description ?? parsed.query.error, 400);
-    return true;
-  }
-
-  if (!parsed.query.code || !parsed.query.state) {
+  if (!parsed.query.state) {
     jsonError(res, "Missing code or state parameter", 400);
     return true;
   }
 
-  const config = getOAuthProviderConfig(provider);
-  if (!config) {
-    jsonError(res, `OAuth app ${provider} is not configured`, 404);
-    return true;
-  }
-
-  try {
-    await exchangeCode(config, parsed.query.code, parsed.query.state);
-    sendAuthorizedHtml(res, provider);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    const status = message.includes("Invalid or expired OAuth state") ? 400 : 502;
-    jsonError(
-      res,
-      status === 400 ? "Invalid or expired OAuth state" : `Token exchange failed: ${message}`,
-      status,
-    );
+  const { handled } = await completeGenericOAuthCallback(res, parsed.query);
+  if (!handled) {
+    jsonError(res, "Invalid or expired OAuth state", 400);
   }
-
   return true;
 }