Add GitHub and Bitbucket OAuth login and list every accessible repo.

Sign in from Settings (GitHub device flow, Bitbucket authorization code), keep PATs as a fallback, and pick from the account's repositories on the Pull requests tab.

Co-authored-by: zord.lack.net <zord.lack.net@gmail.com>

Author: cursoragent

README.md

@@ -43,13 +43,17 @@ Toggle **This review** (impact subgraph) vs **Indexed architecture** (the repo m
 
 ### Pull requests
 
-GitHub and Bitbucket via API tokens from Settings. Pick a PR and jump to a branch-range review.
+GitHub and Bitbucket via **Sign in** (OAuth) or a token in Settings. After connecting, **My repos** lists every repository the account can access. Pick one and jump to a branch-range review. Review still runs against a **local clone** — if that clone is already a Loadpath workspace, selecting the remote repo fills the local path from `git remote`.
 
 ![Pull requests](docs/screenshots/pull-requests.png)
 
 ### Settings
 
-GitHub / Bitbucket tokens; AI providers (Anthropic, OpenAI, Grok/xAI, DeepSeek, Cursor-compatible, Ollama). Residual analysis only — Loadpath does not comment every hunk.
+GitHub / Bitbucket **OAuth sign-in** (or a classic PAT / app password); AI providers (Anthropic, OpenAI, Grok/xAI, DeepSeek, Cursor-compatible, Ollama). Residual analysis only — Loadpath does not comment every hunk.
+
+GitHub uses device flow (`repo read:user read:org`). Create an OAuth App, enable Device Flow, then set `LOADPATH_GITHUB_CLIENT_ID` or paste the client ID in Settings.
+
+Bitbucket uses authorization code. Create an OAuth consumer whose callback is `http://127.0.0.1:7345/api/oauth/bitbucket/callback` (or your `--public-url`), then set `LOADPATH_BITBUCKET_CLIENT_ID` / `LOADPATH_BITBUCKET_CLIENT_SECRET` or paste the key and secret in Settings. Access tokens are refreshed automatically.
 
 ![Settings](docs/screenshots/settings.png)
 
@@ -140,7 +144,7 @@ MCP URL: `https://your-tunnel.example/mcp` (or `http://127.0.0.1:7345/mcp` on th
 
 **Cursor / Claude / ChatGPT / Gemini (HTTP + OAuth)** — add that MCP URL in the host’s connectors. The first connect opens a consent page on the Loadpath machine. Tokens stay in `~/.loadpath/oauth.json`.
 
-Tools: `list_workspaces`, `init_repo`, `index_repo`, `architecture`, `review`, `detect_repo`, `list_pull_requests`, `post_review_comment`. `review` returns the load-path brief (confidence, sinks, reviewers) — not hunk comments.
+Tools: `list_workspaces`, `init_repo`, `index_repo`, `architecture`, `review`, `detect_repo`, `list_pull_requests`, `list_remote_repositories`, `post_review_comment`. `review` returns the load-path brief (confidence, sinks, reviewers) — not hunk comments.
 
 Put `loadpath.yml` at the repo root (see [`loadpath.yml.example`](loadpath.yml.example) and [`fixtures/demo_monorepo/loadpath.yml`](fixtures/demo_monorepo/loadpath.yml)). The tool is opinionated about *your* architecture, not a generic module graph.
 

desktop/urls.mjs

@@ -8,11 +8,13 @@ export function isAllowedExternalUrl(url) {
   if (parsed.protocol !== "https:") return false;
   if (parsed.username || parsed.password) return false;
   const host = parsed.hostname.toLowerCase();
-  return (
+    return (
     host === "github.com" ||
     host.endsWith(".github.com") ||
     host === "bitbucket.org" ||
-    host.endsWith(".bitbucket.org")
+    host.endsWith(".bitbucket.org") ||
+    host === "id.atlassian.com" ||
+    host.endsWith(".atlassian.com")
   );
 }
 

desktop/urls.test.mjs

@@ -7,6 +7,7 @@ describe("isAllowedExternalUrl", () => {
   it("allows GitHub and Bitbucket https PR links", () => {
     assert.equal(isAllowedExternalUrl("https://github.com/acme/demo/pull/12"), true);
     assert.equal(isAllowedExternalUrl("https://bitbucket.org/acme/demo/pull-requests/3"), true);
+    assert.equal(isAllowedExternalUrl("https://id.atlassian.com/login"), true);
   });
 
   it("rejects credentials, other hosts, and non-https schemes", () => {

src/loadpath/mcp/server.py

@@ -67,6 +67,10 @@ def _register_tools(mcp: MCPServer) -> None:
         name="list_pull_requests",
         description="List GitHub or Bitbucket pull requests using tokens stored in Loadpath settings.",
     )(tools.list_pull_requests)
+    mcp.tool(
+        name="list_remote_repositories",
+        description="List GitHub or Bitbucket repositories the signed-in account can access.",
+    )(tools.list_remote_repositories)
     mcp.tool(
         name="post_review_comment",
         description="Upsert the single Loadpath markdown brief on a pull request (updated in place).",

src/loadpath/mcp/tools.py

@@ -8,7 +8,7 @@
 from loadpath.detect import detect_layout, write_draft_config
 from loadpath.index import index_repo
 from loadpath.mcp.compact import compact_architecture, compact_review
-from loadpath.providers.scm import provider_for
+from loadpath.providers.scm import attach_local_paths, provider_for
 from loadpath.review.engine import run_review
 from loadpath.review.render import render_markdown
 from loadpath.settings import AppSettings, register_workspace
@@ -137,6 +137,23 @@ def list_pull_requests(
     return {"pull_requests": [p.to_dict() for p in prs]}
 
 
+def list_remote_repositories(provider: str) -> dict[str, Any]:
+    """List GitHub or Bitbucket repositories the saved token can access."""
+    settings = AppSettings.load()
+    token = settings.github_token if provider == "github" else settings.bitbucket_token
+    username = settings.bitbucket_username
+    if not token:
+        return {"error": f"No {provider} token configured in Loadpath settings"}
+    try:
+        scm = provider_for(provider, token, username=username)
+        repos = scm.list_repositories()
+        profile = scm.current_user()
+    except Exception as exc:  # noqa: BLE001
+        return {"error": str(exc)}
+    attach_local_paths(repos, [w.path for w in settings.workspaces])
+    return {"provider": provider, "user": profile, "repos": [r.to_dict() for r in repos]}
+
+
 def post_review_comment(
     provider: str,
     repo: str,

src/loadpath/providers/__init__.py

@@ -1,3 +1,19 @@
-from loadpath.providers.scm import BitbucketProvider, GitHubProvider, PullRequest, provider_for
+from loadpath.providers.scm import (
+    BitbucketProvider,
+    GitHubProvider,
+    PullRequest,
+    RemoteRepo,
+    attach_local_paths,
+    parse_remote_url,
+    provider_for,
+)
 
-__all__ = ["BitbucketProvider", "GitHubProvider", "PullRequest", "provider_for"]
+__all__ = [
+    "BitbucketProvider",
+    "GitHubProvider",
+    "PullRequest",
+    "RemoteRepo",
+    "attach_local_paths",
+    "parse_remote_url",
+    "provider_for",
+]