Fix OAuth authorize 500: encode login next URL as JS, not HTML

[thorwhalen]

Symptom

Completing the OAuth login for a remote MCP connector (Claude.ai) returned HTTP 500 at /auth/oauth/authorize right after sign-in — the browser saved the plain-text Internal Server Error body as an authorize.txt download.

Root cause

The sign-in page threads the post-login destination back through inline JS as const NEXT = "...", but built that literal with html.escape(). Inside a <script> element the browser does not decode HTML entities, so every & in the destination became a literal &. For a multi-parameter next (the OAuth /authorize URL), the post-login redirect parsed ?response_type=code&client_id=X&redirect_uri=Y as params response_type, amp;client_id, amp;redirect_uri — so client_id arrived empty. The file-backed client store then resolved the empty key to its own root directory (IsADirectoryError) → 500.

A plain-path next (no &) hid this for normal app logins; the MCP OAuth flow is the first multi-param next to exercise it.

Fix

• pages.py: new _js_string() encodes next_url as a proper JS string literal (JSON-encoded, with &/</> as \uXXXX so it's inert in the HTML tokenizer but decodes back at runtime). Applied to both the standard and shared login pages.
• oauth_server.py: defense-in-depth — a blank/missing client_id short-circuits to the clean 400 "unknown client" page instead of hitting the store and 500ing.
• Tests: new test_pages.py (JS-encoding preserves query params, no </script> breakout, no HTML-escaping into JS) + a blank-client_id 400 regression in test_oauth_server.py. Suite 195 → 200 passing.

https://claude.ai/code/session_01Gw5RPgrQhC88Hc3DyACYWF