Support hosted OAuth callback handoff for all connectors

[mohammedahmed18]

Summary

• Add hosted OAuth callback handoff for Notion, Google Docs, Google Calendar, Gmail, and Slack while keeping local loopback listeners and local credential storage.
• Teach CLI and desktop broker flows to opt into hosted callback handoff, listen on local redirect_uri, and exchange with hosted exchange_redirect_uri when returned by the broker.
• Keep older broker clients on the direct loopback flow unless they send hosted_callback_handoff: true, and cover that compatibility path for every OAuth connector.
• Update Worker config and docs so loopback allowlists and hosted provider callbacks are separate for every OAuth connector.

Test Plan

• npm --prefix apps/oauth-service run check
• cargo fmt --check
• git diff --check
• cargo test -p locality-connector oauth_broker::tests
• cargo test -p locality-notion oauth::tests
• cargo test -p locality-google-docs oauth
• cargo test -p locality-google-calendar oauth
• cargo test -p locality-gmail oauth
• cargo test -p locality-slack oauth
• cargo test -p loc-cli broker_oauth_command_flow_splits_local_listener_and_hosted_exchange_redirects
• cargo check -p loc-cli -p locality-desktop -p locality-google-docs -p locality-gmail
• make check-oauth-service
• make docs-validate
• make docs-broken-links
• Local Worker smoke for Google Docs and Slack hosted start responses
• CLI no-browser smoke for Google Docs hosted redirect URL
• Final code review subagent
• Follow-up compatibility review subagent

Deployment Gate

Before deploying/enabling hosted callbacks, register the per-connector HTTPS callback URLs in the provider apps. The Google OAuth app must include the Google Docs, Google Calendar, and Gmail callback paths. This external dashboard registration was not verified locally.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Jul 29, 2026 8:13pm

[github-actions]

Codex review

No high-confidence issues found.

[mohammedahmed18]

Fixed the Codex review issue in 7419a3c. Hosted callback handoff now requires an explicit hosted_callback_handoff: true start request, so older clients that only send redirect_uri stay on the direct loopback flow and do not receive hosted callback fields. Added the old-client compatibility test across the hosted connector matrix.