From d22c675ee5b65e0674de2ec35f97a0ef5fde2bd9 Mon Sep 17 00:00:00 2001
From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>
Date: Mon, 9 Nov 2026 12:07:47 -0800
Subject: [PATCH] Forward v2's OAuth client metadata document from executor.sh

---
 apps/cloud/src/edge/marketing.test.ts     |  6 +++---
 apps/cloud/src/edge/marketing.ts          |  6 ++++--
 apps/cloud/src/edge/v2-edge-contract.json | 11 ++++++-----
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/apps/cloud/src/edge/marketing.test.ts b/apps/cloud/src/edge/marketing.test.ts
index 14d3c29dd1..1f8e31d706 100644
--- a/apps/cloud/src/edge/marketing.test.ts
+++ b/apps/cloud/src/edge/marketing.test.ts
@@ -91,6 +91,7 @@ describe("marketingProxyRequest", () => {
 describe("isV2Path", () => {
   const forwarded = [
     "/.well-known/oauth-authorization-server/api/auth",
+    "/oauth/client-metadata.json",
     "/api/auth/callback/google",
     "/api/auth/callback/github",
     "/git/acme/tools/info/refs",
@@ -117,10 +118,9 @@ describe("isV2Path", () => {
     "/.well-known/oauth-authorization-server/api/auth/extra",
     "/.well-known/oauth-protected-resource/mcp",
     "/oauth/client-id-metadata.json",
-    // v2 does not serve OpenID configuration on executor.sh, and its client
-    // metadata document's move to executor.sh is pending.
+    // v2 does not serve OpenID configuration on executor.sh.
     "/api/auth/.well-known/openid-configuration",
-    "/oauth/client-metadata.json",
+    "/oauth/client-metadata.json/extra",
     // Git remotes need a path under /git/.
     "/git",
     "/gitlab/acme/tools/info/refs",
diff --git a/apps/cloud/src/edge/marketing.ts b/apps/cloud/src/edge/marketing.ts
index 72e628a89b..7ef91d2c14 100644
--- a/apps/cloud/src/edge/marketing.ts
+++ b/apps/cloud/src/edge/marketing.ts
@@ -68,12 +68,14 @@ const matchesPathPattern = (pathname: string, pattern: string): boolean =>
   pattern.endsWith("/*") ? pathname.startsWith(pattern.slice(0, -1)) : pathname === pattern;
 
 /** Path patterns v2 answers on `executor.sh`. `/git/*` never matches
- *  `/gitlab/...`. v2's outbound OAuth client metadata document stays off this
- *  list: its move to `executor.sh` is pending, and v1's own document
+ *  `/gitlab/...`. v1's own client metadata document
  *  (`/oauth/client-id-metadata.json`) stays with v1. */
 const V2_PATHS: ReadonlyArray<string> = [
   // Sign-in issuer metadata for the issuer `https://executor.sh/api/auth`.
   "/.well-known/oauth-authorization-server/api/auth",
+  // v2's outbound OAuth client metadata document: its connected-account
+  // sign-ins name it as their client ID, beside their callback on this origin.
+  "/oauth/client-metadata.json",
   "/git/*",
   "/.well-known/agent-skills/*",
 ];
diff --git a/apps/cloud/src/edge/v2-edge-contract.json b/apps/cloud/src/edge/v2-edge-contract.json
index 8ad182e0e2..5af17e08ae 100644
--- a/apps/cloud/src/edge/v2-edge-contract.json
+++ b/apps/cloud/src/edge/v2-edge-contract.json
@@ -10,6 +10,7 @@
     "/.well-known/oauth-authorization-server/api/auth",
     "/api/auth/callback/<provider>",
     "/api/oauth/callback, when state starts with x2.",
+    "/oauth/client-metadata.json",
     "/git/*",
     "/ (without a v1 session)",
     "/home",
@@ -56,6 +57,11 @@
       "target": "/api/oauth/callback?code=c&state=x2.abc",
       "forwards": true
     },
+    {
+      "method": "GET",
+      "target": "/oauth/client-metadata.json",
+      "forwards": true
+    },
     {
       "method": "GET",
       "target": "/git/acme/site.git/info/refs?service=git-upload-pack",
@@ -241,11 +247,6 @@
       "target": "/api/oauth/callback?code=c",
       "forwards": false
     },
-    {
-      "method": "GET",
-      "target": "/oauth/client-metadata.json",
-      "forwards": false
-    },
     {
       "method": "GET",
       "target": "/oauth/client-id-metadata.json",