Continue ChatGPT OAuth through Libretto onboarding

[Mochael]

Routes ChatGPT OAuth through the same Libretto sign-in and sign-up experience used by the Chrome extension. The page now preserves Better Auth OAuth requests through email, Google, and GitHub authentication, and a continuation page resumes OAuth after email verification and workspace onboarding.

Depends on saffron-health/libretto-cloud#231.

Validation:

• pnpm --dir apps/website build
• pnpm lint
• Live Chrome check of sign-in/sign-up, Google, GitHub, and email controls through the ChatGPT connector flow

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
libretto	Ready	Preview	Aug 5, 2026 12:19am
libretto-docs	Ready	Preview	Aug 5, 2026 12:19am

[github-actions]

I’ll verify GitHub access first with the two required gh calls. If either fails, I’ll stop without using local fallbacks.
GitHub access is available. There is no specs/*.md in the changed file list, so I’m delegating goal inference from the PR diff before reviewing the implementation file by file.
The delegated goal-inference task failed due an agent model configuration error, not a GitHub API failure. I’ll continue the review from the required gh diff data directly rather than using local git fallbacks.
gh pr diff 540 -- <file> is not accepted by this installed gh version, so I’m using the full GitHub PR diff from gh pr diff 540 and reviewing each file’s hunks from that output.
I have the full PR diff. I’m checking nearby existing auth and onboarding code now to verify the new OAuth continuation path integrates with current behavior.
The local checkout already contains the PR changes, so I can use file reads for exact line numbers while still basing changed-file scope on gh pr diff 540.
I’m checking the shared post-verification redirect helper next because the new continuation page relies on existing returnTo handling through email verification and onboarding.
The main uncertainty is the backend contract for the new oauth_query and /oauth2/continue flow. I’m inspecting the dependent cloud PR read-only to distinguish real defects from assumptions.

OpenCode Review

📋 Detailed Review

Spec Analysis

No spec file exists. Inferred goals: preserve ChatGPT/Better Auth OAuth query state through website sign-in, sign-up, social auth, email verification, and workspace onboarding, then resume OAuth via /oauth/continue.

Changed Files

• apps/website/src/OAuthContinuePage.tsx: Adds a continuation page that checks auth status, routes to verification/onboarding, then posts OAuth continuation.
• apps/website/src/SignInPage.tsx: Detects OAuth query params and passes oauth_query through email and social auth calls.
• apps/website/src/routes/oauth.continue.tsx: Adds the TanStack route for /oauth/continue.
• apps/website/src/routeTree.gen.ts: Generated route tree update for /oauth/continue.

Simplicity Assessment

• apps/website/src/SignInPage.tsx:78-82 and apps/website/src/SignInPage.tsx:195-198 add a separate already-signed-in OAuth branch that bypasses the new continuation route. This branch could be removed or changed to route to /oauth/continue?${oauthQuery}, letting one page own the email/workspace checks.
• apps/website/src/OAuthContinuePage.tsx:23-37 is direct and small; the new page uses existing returnTo helpers rather than adding extra state machinery.

Correctness Assessment

• apps/website/src/SignInPage.tsx:192-199 treats any existing cloud session as ready for OAuth and redirects straight to /api/auth/oauth2/authorize via oauthAuthorizeUrl at apps/website/src/SignInPage.tsx:78-82. getCloudSession() does not prove the user has a verified email or workspace, so signed-in users who still need verification or onboarding skip the new /oauth/continue checks in apps/website/src/OAuthContinuePage.tsx:24-31.

Summary

The implementation covers the intended new continuation route and passes OAuth state through the main auth calls. One signed-in-but-not-onboarded path bypasses that continuation route, which undermines the PR’s stated ChatGPT OAuth onboarding goal.

Required Actions

• apps/website/src/SignInPage.tsx:192-199: Route existing-session OAuth requests through /oauth/continue instead of directly to /api/auth/oauth2/authorize. Failure mode: a signed-in user with unverified email or no workspace skips verification/onboarding checks. User impact: the ChatGPT connector flow can fail or land on a raw auth error instead of completing Libretto onboarding. This blocks merge because continuing OAuth through email verification and workspace onboarding is the core behavior of this PR.

Suggestions

None

github run