The /oauth/authorize consent page speaks the home page's language #9808

/oauth/authorize now uses plain headed sections instead of cards. I changed markup only. src/http/oauth.ts is untouched, so validation, PKCE and the redirect check stay as they were.

• Markup: the consent page and the sign-in-only consent page each use a <section class="settings-block"> with an <h2> ("Allow this connection" and "Sign in"). The can't-connect page does the same with "Nothing was granted". The client name, return host, token kind, name field and lifetime read as before.
• No separate "done" card: the code has no third card block. The finished step is a redirect, so there was nothing to change there.
• New test: test/oauth-page-shape.test.ts checks the headings and that no .card class appears on the consent and can't-connect pages. It also checks that a bad redirect_uri is shown with a 400 and no Location. I didn't run it against main to confirm it fails there, but the headings it requires don't exist on main.
• Docs: I recorded the shape in docs/design/areas/settings.md.
• Checks run:

- bun scripts/gate.ts, bun x tsc --noEmit, bun scripts/design-lint.ts and test/mcp-size.test.ts are clean. - test/oauth-flow.test.ts, test/oauth-boundary.test.ts and the new test pass. - The one failure is in test/oauth-connect-browser.test.ts, because chromium won't start in this sandbox. That is unrelated to the change, and the forge's check runs it.

• Not run: I only ran the four oauth test files, test/mcp-size.test.ts and the design-lint test. The forge runs the full suite on push.
• Left out: I didn't touch the fieldset/legend groups inside the form, since they are form structure and not cards.

To try it, sign in, open /oauth/authorize with a registered client's query, and compare it with a bad redirect_uri. The preview for this pull shows both.

🤖 Generated with Claude Code

Closes #9799

/oauth/authorize now uses plain headed sections instead of cards. I changed markup only. src/http/oauth.ts is untouched, so validation, PKCE and the redirect check stay as they were.

• Markup: the consent page and the sign-in-only consent page each use a <section class="settings-block"> with an <h2> ("Allow this connection" and "Sign in"). The can't-connect page does the same with "Nothing was granted". The client name, return host, token kind, name field and lifetime read as before.
• No separate "done" card: the code has no third card block. The finished step is a redirect, so there was nothing to change there.
• New test: test/oauth-page-shape.test.ts checks the headings and that no .card class appears on the consent and can't-connect pages. It also checks that a bad redirect_uri is shown with a 400 and no Location. I didn't run it against main to confirm it fails there, but the headings it requires don't exist on main.
• Docs: I recorded the shape in docs/design/areas/settings.md.
• Checks run:

- bun scripts/gate.ts, bun x tsc --noEmit, bun scripts/design-lint.ts and test/mcp-size.test.ts are clean. - test/oauth-flow.test.ts, test/oauth-boundary.test.ts and the new test pass. - The one failure is in test/oauth-connect-browser.test.ts, because chromium won't start in this sandbox. That is unrelated to the change, and the forge's check runs it.

• Not run: I only ran the four oauth test files, test/mcp-size.test.ts and the design-lint test. The forge runs the full suite on push.
• Left out: I didn't touch the fieldset/legend groups inside the form, since they are form structure and not cards.

To try it, sign in, open /oauth/authorize with a registered client's query, and compare it with a bad redirect_uri. The preview for this pull shows both.

🤖 Generated with Claude Code

The gate failed because no commit on the pull had a Try: line. I added an empty commit with one and pushed it. bun scripts/gate.ts now exits 0 locally. I didn't rerun the tests, since the pull's code hasn't changed since the first push.

The new commit's line reads: "Try: open /oauth/authorize on the preview with a registered client's query, then again with a bad redirect_uri".

The pull itself is as before: /oauth/authorize uses headed sections instead of cards, with no change to validation, PKCE or the redirect check.

To try it, open /oauth/authorize on the preview with a registered client's query, then again with a bad redirect_uri. The first shows the consent page. The second shows the can't-connect page and is not redirected.

🤖 Generated with Claude Code

I merged main into the branch and pushed. The only conflict was in docs/design/areas/settings.md: both sides had appended a paragraph. I kept both, so the /oauth/authorize paragraph and the new Settings › Trusted paragraph (#9792) are each there in full.

After the merge, bun scripts/gate.ts and bun scripts/design-lint.ts are clean. test/oauth-page-shape.test.ts and test/oauth-flow.test.ts pass (23 tests). I didn't re-run the full suite or tsc; the forge's check will on this push.

The pull itself is unchanged: /oauth/authorize uses headed sections instead of cards, with no change to validation, PKCE or the redirect check.

To try it, open /oauth/authorize on the preview with a registered client's query, then again with a bad redirect_uri.

🤖 Generated with Claude Code

The three consent-page fixes are pushed; the type check, design lint and the two OAuth test files (oauth-page-shape, oauth-flow) pass. I did not run scripts/gate.ts or the full suite; the forge's check runs those.

• Sign-in-only page test: test/oauth-page-shape.test.ts now renders the sign-in-only page, using scope=openid profile. It checks the heading and the sign-in text, and that there is no .card and no token grant form.
• Duplicate headings:

- The can't-connect page no longer has "Nothing was granted". It keeps the head and the message, and its test now asserts that heading is gone. - "Sign in" became "What it learns". - "Allow this connection" became "What it gets". - I kept an h2 on those two pages because I wasn't sure the design lint allows a section with no heading.

• Re-indent: the <form> bodies in src/web/pages/oauth.ts now sit one level inside their <section>. That is why the diff is about 95 lines.

Behaviour is unchanged.

I merged main into the branch and pushed it. The only conflict was docs/design/areas/settings.md.

I kept both sides: the new Settings › Telemetry paragraph from main, and my /oauth/authorize paragraph. I also corrected my paragraph, which still named the old headings. It now says "What it gets" and "What it learns", and that the can't-connect part is the message alone.

The type check and design lint pass, and so does test/oauth-page-shape.test.ts (3 tests). I did not run the full suite, and I did not re-run scripts/gate.ts; the forge's check runs both.

I merged main into the branch again and pushed it. The only conflict was docs/design/areas/settings.md, and I kept both sides. That file now holds my /oauth/authorize paragraph and the new Settings › Cloud paragraph from main.

The type check and design lint pass, and so does test/oauth-page-shape.test.ts (3 tests). I did not run the full suite, and I did not re-run scripts/gate.ts; the forge's check runs both.