Connect LocalThought platforms without pasting tenant secrets

[michielbdejong]

GitHub Issues and the other LocalThought integrations previously required pasting a tenant secret before authorization. The hub now redirects with the selected platform and a PKCE challenge, then redeems a one-time handoff after Google/provider authorization. No tenant secret is entered, received or saved by the browser flow.

Preserve actor, drive, platform and callback-state validation; consume pending verifiers before redemption; clear expired/denied attempts and require reconnecting after an uncertain exchange. Both the integration catalog and Devonian issue tracker use the same new handshake, while existing rotating proxy credentials remain unchanged. Update the HTTP fixture, browser journeys, generated locale catalogs, README and coverage map. Apply the existing Calendar and demo spacing fixes and two Rust formatting fixes required by CI.

Companion proxy: localthought/integration-proxy#39, with follow-ups #40 (concurrent schema initialization), #41 (Chrome consent Origin), and #42 (GitHub pagination). All merged after green CI and deployed in Heroku v54 (3f674ebe).

Validation: 39 LocalThought unit tests and the Node HTTP fixture contract test pass; workspace package builds, data-browser typecheck and production Vite build pass. Full data-browser lint and formatting pass. A matching WASM build and the complete no-paste browser mock journey passed: consent, PKCE redemption, paginated fetch, review, OPFS apply and reload. Live verification follows the authorized merge into localthought/atomic-server feat/heroku and deployment of both revisions.

Live preflight (2026-09-10): this frontend at localhost:6747 connected through deployed localthought.io and real GitHub OAuth without secret entry, redeemed the handoff, cleared the callback URL, fetched both pages plus comments from public localthought/integration-proxy, reviewed/applied 46 records, and showed 43 issue rows after reload. Proxy v54 (3f674ebe) contains the consent-origin correction PR41 and canonical-pagination correction PR42, both merged after green CI. Final localthought.ai verification follows this PR merge and deployment. Full browser workspace lint and 647 library unit tests also pass.

CI feature correction: run clippy with light,wasm-plugins, matching Rust tests and the deployed server. The old light-only invocation failed on this branch’s plugin-dependent handlers. Native all-target clippy passes with the corrected feature set, reusing separately built frontend assets and skipping embedded-runtime generation for this static preflight. Hosted CI still builds and tests the actual runtime.

The Node MCP host uses the library’s CommonJS entry so Node can resolve its rrule dependency correctly. The full data-browser test command passes: 854 Vitest tests and 2 real stdio MCP integration tests. CI server builds also enable wasm-plugins, required by the branch’s plugin handlers.

Clean-install certification: esbuild is now a direct workspace development dependency rather than an assumed transitive executable. A fresh pnpm 10.15.1 frozen install passes certification for Clockify, GitHub Issues, MT940, Notion and Pets. Failed certification summaries include the check and command/validation error.

Merged with explicit approval to proceed without green CI on 2026-09-10. The remaining hosted failure is the integration certification harness under its Linux filesystem layout (bundle comparisons and fixture tests), despite all five passing locally. Upstream squash add0ea4 is included in localthought/atomic-server feat/heroku merge1cc561f1. The feat/heroku push triggers its configured automatic deployment. At the user’s request, live deployment verification and the production test were handed back to the user; the new AtomicServer release was not verified by this task.