From 95a61b9ab6d440b9408ac7b782d26176aeafaed1 Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Mon, 26 Oct 2026 19:46:18 +0530
Subject: [PATCH 1/9] Implement Table Row Linking

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)
---
 ui/src/components/DataTable/ClientTable.tsx | 26 ++++++++++++++++----
 ui/src/pages/Reviews/Reviews.tsx            | 27 +++++++++++++++------
 2 files changed, 40 insertions(+), 13 deletions(-)

diff --git a/ui/src/components/DataTable/ClientTable.tsx b/ui/src/components/DataTable/ClientTable.tsx
index ee4d4347..14a55dec 100644
--- a/ui/src/components/DataTable/ClientTable.tsx
+++ b/ui/src/components/DataTable/ClientTable.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import { flexRender, Table } from '@tanstack/react-table';
 import { motion, AnimatePresence } from 'framer-motion';
+import { Link } from 'react-router-dom';
 import { Button, Icons, Spinner } from '../UIPrimitives';
 import { DataTablePaginationControls, DataTableEmptyState } from './DataTable';
 
@@ -33,6 +34,9 @@ export interface ClientTableProps<TData> {
    * activation to each row when set; omit for pages that only expose
    * actions via explicit buttons. */
   onRowClick?: (row: TData) => void;
+  /** Makes each cell a real link to this URL, so right-click "Open in new tab"
+   * and middle/Ctrl-click work. Columns with their own links opt out via meta.rowLink = false. */
+  getRowHref?: (row: TData) => string;
   /** Override for the pagination footer's "total rows" count. Needed for
    * server-side (manualPagination/manualFiltering) tables, where the
    * table instance only ever holds one page's worth of data -
@@ -61,6 +65,7 @@ export function ClientTable<TData>({
   empty,
   pageSizeOptions,
   onRowClick,
+  getRowHref,
   manualTotal,
 }: ClientTableProps<TData>) {
   // Show loading until the first rows arrive, even when filters keep isEmpty false.
@@ -162,11 +167,22 @@ export function ClientTable<TData>({
                 }
                 tabIndex={onRowClick ? 0 : undefined}
               >
-                {row.getVisibleCells().map((cell) => (
-                  <td key={cell.id} className="px-6 py-2.5 align-middle min-h-[52px]">
-                    {flexRender(cell.column.columnDef.cell, cell.getContext())}
-                  </td>
-                ))}
+                {row.getVisibleCells().map((cell) => {
+                  const content = flexRender(cell.column.columnDef.cell, cell.getContext());
+                  const meta = cell.column.columnDef.meta as { rowLink?: boolean } | undefined;
+                  return (
+                    <td key={cell.id} className="px-6 py-2.5 align-middle min-h-[52px]">
+                      {getRowHref && meta?.rowLink !== false ? (
+                        // Stop the row's onClick so it doesn't navigate a second time.
+                        <Link to={getRowHref(row.original)} onClick={(e) => e.stopPropagation()} className="block text-inherit">
+                          {content}
+                        </Link>
+                      ) : (
+                        content
+                      )}
+                    </td>
+                  );
+                })}
               </motion.tr>
             ))}
           </AnimatePresence>
diff --git a/ui/src/pages/Reviews/Reviews.tsx b/ui/src/pages/Reviews/Reviews.tsx
index bcc7e727..959bec9f 100644
--- a/ui/src/pages/Reviews/Reviews.tsx
+++ b/ui/src/pages/Reviews/Reviews.tsx
@@ -292,6 +292,8 @@ const Reviews: React.FC = () => {
             {
                 id: 'review',
                 accessorFn: (review) => getPrimaryTitle(review),
+                // Links its own title/PR line so "Open PR/MR" isn't nested in a link.
+                meta: { rowLink: false },
                 // Searches title/repo/branch/URL/author together, same combined
                 // free-text search the old top search bar offered (it searched
                 // "repositories or URLs"; author is included too since it's visible
@@ -365,14 +367,18 @@ const Reviews: React.FC = () => {
                     return (
                         <div className="flex flex-col justify-center gap-1 min-w-0 min-h-[44px]">
                             <div className="flex items-center gap-2 min-w-0">
-                                <span className="min-w-0 truncate text-white font-semibold">
+                                <Link
+                                    to={`/reviews/${review.id}`}
+                                    onClick={(e) => e.stopPropagation()}
+                                    className="min-w-0 truncate text-white font-semibold"
+                                >
                                     <TruncatedWithTooltip
                                         text={primaryTitle}
                                         max={TITLE_MAX}
                                     >
                                         {displayTitle}
                                     </TruncatedWithTooltip>
-                                </span>
+                                </Link>
                                 {review.prMrUrl && (
                                     <a
                                         href={review.prMrUrl}
@@ -386,9 +392,13 @@ const Reviews: React.FC = () => {
                                 )}
                             </div>
                             {metaChips.length > 0 && (
-                                <div className="min-w-0 text-sm text-slate-400 truncate">
+                                <Link
+                                    to={`/reviews/${review.id}`}
+                                    onClick={(e) => e.stopPropagation()}
+                                    className="block min-w-0 text-sm text-slate-400 truncate"
+                                >
                                     {metaChips.join(' · ')}
-                                </div>
+                                </Link>
                             )}
                         </div>
                     );
@@ -644,6 +654,7 @@ const Reviews: React.FC = () => {
                 id: 'details',
                 enableSorting: false,
                 enableColumnFilter: false,
+                meta: { rowLink: false },
                 header: () => (
                     <span className="font-semibold text-slate-300 uppercase tracking-wide text-xs">
                         Details
@@ -651,12 +662,11 @@ const Reviews: React.FC = () => {
                 ),
                 cell: ({ row }) => (
                     <Button
+                        as={Link}
+                        to={`/reviews/${row.original.id}`}
                         variant="outline"
                         size="sm"
-                        onClick={(e) => {
-                            e.stopPropagation();
-                            handleViewReview(row.original);
-                        }}
+                        onClick={(e: React.MouseEvent) => e.stopPropagation()}
                         className="border-slate-400 text-white hover:bg-white/10 hover:border-white text-sm cursor-pointer"
                     >
                         View Details
@@ -746,6 +756,7 @@ const Reviews: React.FC = () => {
                 }}
                 pageSizeOptions={pageSizeOptions}
                 onRowClick={handleViewReview}
+                getRowHref={(review) => `/reviews/${review.id}`}
                 manualTotal={total}
             />
         </div>

From 7f79db4add4155da4d6720014212656d17b8f5ab Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Mon, 26 Oct 2026 22:13:40 +0530
Subject: [PATCH 2/9] fix: super admin permission in subscription enforcement

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)
---
 internal/api/auth/middleware.go | 37 ++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/internal/api/auth/middleware.go b/internal/api/auth/middleware.go
index baa8fff8..fdd99d97 100644
--- a/internal/api/auth/middleware.go
+++ b/internal/api/auth/middleware.go
@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"context"
 	"database/sql"
 	"fmt"
 	"net/http"
@@ -252,11 +253,20 @@ func (am *AuthMiddleware) EnforceSubscriptionLimits() echo.MiddlewareFunc {
 			}
 
 			if err := loadPlanState(); err != nil {
-				if err == sql.ErrNoRows {
+				if err != sql.ErrNoRows {
+					fmt.Printf("[Subscription] plan lookup failed user=%d org=%d err=%v\n", user.ID, orgID, err)
+					return echo.NewHTTPError(http.StatusInternalServerError, "failed to check subscription")
+				}
+				// Not a member: only a super admin may continue.
+				plan, isSuperAdmin, err := am.loadSuperAdminPlan(reqCtx, user.ID, orgID)
+				if err != nil {
+					fmt.Printf("[Subscription] super admin plan lookup failed user=%d org=%d err=%v\n", user.ID, orgID, err)
+					return echo.NewHTTPError(http.StatusInternalServerError, "failed to check subscription")
+				}
+				if !isSuperAdmin {
 					return echo.NewHTTPError(http.StatusForbidden, "no access to this organization")
 				}
-				fmt.Printf("[Subscription] plan lookup failed user=%d org=%d err=%v\n", user.ID, orgID, err)
-				return echo.NewHTTPError(http.StatusInternalServerError, "failed to check subscription")
+				planType = plan
 			}
 
 			// Resolve plan type safely (NULL or empty -> free)
@@ -280,6 +290,27 @@ func (am *AuthMiddleware) EnforceSubscriptionLimits() echo.MiddlewareFunc {
 	}
 }
 
+// loadSuperAdminPlan reads an org's plan for a super admin, who can open any org without being a member.
+// isSuperAdmin is false (and plan empty) for everyone else; an org with no billing row yields an empty plan.
+func (am *AuthMiddleware) loadSuperAdminPlan(ctx context.Context, userID, orgID int64) (plan sql.NullString, isSuperAdmin bool, err error) {
+	err = am.db.QueryRowContext(ctx, `
+		SELECT EXISTS(
+			SELECT 1 FROM user_roles ur
+			JOIN roles r ON ur.role_id = r.id
+			WHERE ur.user_id = $1 AND r.name = $2
+		)
+	`, userID, RoleSuperAdmin).Scan(&isSuperAdmin)
+	if err != nil || !isSuperAdmin {
+		return plan, false, err
+	}
+	err = am.db.QueryRowContext(ctx,
+		`SELECT current_plan_code FROM org_billing_state WHERE org_id = $1`, orgID).Scan(&plan)
+	if err == sql.ErrNoRows {
+		err = nil
+	}
+	return plan, true, err
+}
+
 // BuildOrgContextFromHeader middleware extracts org_id from X-Org-Context header and validates org exists
 func (am *AuthMiddleware) BuildOrgContextFromHeader() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {

From 9721cd2e0d27703a2062ce7985c83951fc043d4f Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Wed, 28 Oct 2026 01:16:55 +0530
Subject: [PATCH 3/9] fix: stop duplicate replies and doubled PRs when a repo
 is connected more than once

Same provider account connected in several orgs: only one org now answers a
webhook event (the latest reviewer of that PR, else the oldest connection).

GitHub App and token both connected in one org: when the App covers a repo the
token connector is ignored for it. PR-opened webhooks and the background sync
skip the token, and policy results are posted with the App's credentials.

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
---
 internal/api/webhook_orchestrator_v2.go      | 48 +++++++++++++++-
 internal/jobqueue/pr_policy_force_approve.go |  2 +-
 internal/jobqueue/pr_policy_worker.go        |  2 +-
 internal/jobqueue/repo_sync_worker.go        | 58 +++++++++++++++++++-
 storage/providers/github/token_store.go      | 56 +++++++++++++++++++
 5 files changed, 160 insertions(+), 6 deletions(-)

diff --git a/internal/api/webhook_orchestrator_v2.go b/internal/api/webhook_orchestrator_v2.go
index 10159085..992c8419 100644
--- a/internal/api/webhook_orchestrator_v2.go
+++ b/internal/api/webhook_orchestrator_v2.go
@@ -179,6 +179,14 @@ func (wo *WebhookOrchestratorV2) ProcessWebhookEvent(c echo.Context) error {
 				log.Printf("[ERROR] Job queue not initialized, cannot process PR state event")
 				return c.JSON(http.StatusInternalServerError, map[string]string{"error": "internal_error"})
 			}
+			// The org's GitHub App already tracks this repo's PRs, so a token copy would double the PR and its link.
+			if wo.githubAppCoversRepo(providerName, stateEvent.RepositoryFullName, connectorID, orgID) {
+				return c.JSON(http.StatusOK, map[string]string{
+					"status":   "ignored",
+					"provider": providerName,
+					"reason":   "superseded_by_github_app",
+				})
+			}
 			if err := wo.server.jobQueue.QueuePRStateSyncJob(c.Request().Context(), orgID, connectorID, providerName, *stateEvent); err != nil {
 				log.Printf("[ERROR] Failed to queue PR state sync job: %v", err)
 				return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to queue pr state sync"})
@@ -245,6 +253,16 @@ func (wo *WebhookOrchestratorV2) ProcessWebhookEvent(c echo.Context) error {
 		})
 	}
 
+	// Same provider account connected in several orgs: every org's webhook sees this event, so only one answers.
+	if wo.supersededBySiblingOrg(event, connectorID, orgID) {
+		log.Printf("[INFO] Ignoring webhook for %s: another org with the same provider account answers it (connector_id=%d)", event.Repository.FullName, connectorID)
+		return c.JSON(http.StatusOK, map[string]string{
+			"status":   "ignored",
+			"provider": providerName,
+			"reason":   "handled_by_sibling_org",
+		})
+	}
+
 	// Phase 3: Response Warrant Check
 	botInfo, err := wo.getBotUserInfo(event)
 	if err != nil {
@@ -334,18 +352,42 @@ func (wo *WebhookOrchestratorV2) ProcessWebhookEvent(c echo.Context) error {
 	})
 }
 
+// supersededBySiblingOrg reports whether another org, which connected this repository with a token from the same
+// provider account, should answer the event instead. Any lookup problem keeps the event, so nothing goes unanswered.
+func (wo *WebhookOrchestratorV2) supersededBySiblingOrg(event *UnifiedWebhookEventV2, connectorID, orgID int64) bool {
+	if wo.server == nil || wo.server.db == nil {
+		return false
+	}
+	prURL := ""
+	if event.MergeRequest != nil {
+		prURL = event.MergeRequest.WebURL
+	}
+	preferred, err := storagegithub.NewTokenStore(wo.server.db).PreferredSiblingConnector(
+		connectorID, orgID, strings.TrimSpace(event.Repository.ID), strings.TrimSpace(event.Repository.FullName), prURL)
+	if err != nil {
+		log.Printf("[WARN] Sibling org check failed for %s: %v", event.Repository.FullName, err)
+		return false
+	}
+	return preferred != connectorID
+}
+
 // supersededByGitHubApp reports whether a GitHub event received through a non-App connector is for a repository
 // that a GitHub App connector of the same org also serves.
 func (wo *WebhookOrchestratorV2) supersededByGitHubApp(event *UnifiedWebhookEventV2, connectorID, orgID int64) bool {
-	if wo.server == nil || wo.server.db == nil || !strings.EqualFold(event.Provider, "github") || event.Repository.FullName == "" {
+	return wo.githubAppCoversRepo(event.Provider, event.Repository.FullName, connectorID, orgID)
+}
+
+// githubAppCoversRepo is the check behind supersededByGitHubApp, for callers that have no unified event yet.
+func (wo *WebhookOrchestratorV2) githubAppCoversRepo(provider, repoFullName string, connectorID, orgID int64) bool {
+	if wo.server == nil || wo.server.db == nil || !strings.EqualFold(provider, "github") || repoFullName == "" {
 		return false
 	}
 	if wo.server.isGitHubAppConnector(int(connectorID)) {
 		return false
 	}
-	has, err := storagegithub.NewTokenStore(wo.server.db).HasAppConnectorForRepo(orgID, event.Repository.FullName)
+	has, err := storagegithub.NewTokenStore(wo.server.db).HasAppConnectorForRepo(orgID, repoFullName)
 	if err != nil {
-		log.Printf("[WARN] GitHub App overlap check failed for %s: %v", event.Repository.FullName, err)
+		log.Printf("[WARN] GitHub App overlap check failed for %s: %v", repoFullName, err)
 		return false
 	}
 	return has
diff --git a/internal/jobqueue/pr_policy_force_approve.go b/internal/jobqueue/pr_policy_force_approve.go
index 4e63f30b..60ab7175 100644
--- a/internal/jobqueue/pr_policy_force_approve.go
+++ b/internal/jobqueue/pr_policy_force_approve.go
@@ -68,7 +68,7 @@ func (w *PRPolicyForceApproveWorker) Work(ctx context.Context, job *river.Job[PR
 		release()
 		return err
 	}
-	info, err := loadRepositoryConnectorInfo(w.db, repositoryID)
+	info, err := loadActingConnectorInfo(w.db, repositoryID)
 	if err != nil {
 		release()
 		return err
diff --git a/internal/jobqueue/pr_policy_worker.go b/internal/jobqueue/pr_policy_worker.go
index 19bb4a2a..098fabfc 100644
--- a/internal/jobqueue/pr_policy_worker.go
+++ b/internal/jobqueue/pr_policy_worker.go
@@ -142,7 +142,7 @@ func (w *PRPolicyCheckWorker) publish(ctx context.Context, args PRPolicyCheckJob
 	).Scan(&repositoryID, &number); err != nil {
 		return fmt.Errorf("failed to load pull request %d: %w", pullRequestID, err)
 	}
-	info, err := loadRepositoryConnectorInfo(w.db, repositoryID)
+	info, err := loadActingConnectorInfo(w.db, repositoryID)
 	if err != nil {
 		return fmt.Errorf("failed to load connector for repository %d: %w", repositoryID, err)
 	}
diff --git a/internal/jobqueue/repo_sync_worker.go b/internal/jobqueue/repo_sync_worker.go
index accbba93..67ef4a81 100644
--- a/internal/jobqueue/repo_sync_worker.go
+++ b/internal/jobqueue/repo_sync_worker.go
@@ -21,6 +21,7 @@ import (
 	providergitlab "github.com/livereview/internal/providers/gitlab"
 	"github.com/livereview/internal/prsync"
 	storagejobqueue "github.com/livereview/storage/jobqueue"
+	storagegithub "github.com/livereview/storage/providers/github"
 	"github.com/livereview/storage/providers/pullrequests"
 	"github.com/riverqueue/river"
 )
@@ -72,6 +73,54 @@ func loadRepositoryConnectorInfo(db *sql.DB, repositoryID int64) (*repositoryCon
 	return &info, nil
 }
 
+func isGitHubProvider(provider string) bool {
+	return provider == "github" || provider == "github-com" || provider == "github-enterprise"
+}
+
+// appRepositoryID finds the repositories row of the same org's live GitHub App connector for the same repo on the
+// same host, or sql.ErrNoRows. Only token connectors can be covered by an App.
+func appRepositoryID(db *sql.DB, info *repositoryConnectorInfo) (int64, error) {
+	if info.TokenType == storagegithub.TokenTypeGitHubApp || !isGitHubProvider(info.Provider) {
+		return 0, sql.ErrNoRows
+	}
+	var id int64
+	err := db.QueryRow(`
+		SELECT r.id FROM repositories r JOIN integration_tokens it ON it.id = r.connector_id
+		WHERE it.org_id = $1 AND it.token_type = $2 AND LOWER(r.full_name) = LOWER($3)
+		  AND LOWER(TRIM(TRAILING '/' FROM it.provider_url)) = LOWER(TRIM(TRAILING '/' FROM $4::text))
+		  AND COALESCE(it.metadata->>'removed', 'false') <> 'true'
+		  AND COALESCE(it.metadata->>'suspended', 'false') <> 'true'
+		ORDER BY it.created_at DESC LIMIT 1
+	`, info.OrgID, storagegithub.TokenTypeGitHubApp, info.FullName, info.ProviderURL).Scan(&id)
+	return id, err
+}
+
+// loadActingConnectorInfo is loadRepositoryConnectorInfo, except that when the org's GitHub App also lists the
+// repository, the App's credentials are used, so posts come from the App and not a token owner's account.
+func loadActingConnectorInfo(db *sql.DB, repositoryID int64) (*repositoryConnectorInfo, error) {
+	info, err := loadRepositoryConnectorInfo(db, repositoryID)
+	if err != nil {
+		return nil, err
+	}
+	appRepoID, err := appRepositoryID(db, info)
+	if errors.Is(err, sql.ErrNoRows) {
+		return info, nil
+	}
+	var app *repositoryConnectorInfo
+	if err == nil {
+		app, err = loadRepositoryConnectorInfo(db, appRepoID)
+	}
+	if err != nil {
+		// Better to post with the token than to drop the result.
+		log.Printf("[WARN] acting connector: could not use the GitHub App for repository %d: %v", repositoryID, err)
+		return info, nil
+	}
+	// Keep this PR copy's repository identity; only who we act as changes.
+	info.ConnectorID, info.ProviderURL, info.PATToken, info.AccessToken, info.Email, info.TokenType =
+		app.ConnectorID, app.ProviderURL, app.PATToken, app.AccessToken, app.Email, app.TokenType
+	return info, nil
+}
+
 // RepoPRSyncJobArgs syncs all pull/merge requests for one repository from its
 // provider into the pull_requests table. Enqueued both by the periodic
 // reconciliation coordinator (see ReconciliationSweepWorker) and by the
@@ -101,6 +150,13 @@ func (w *RepoPRSyncWorker) Work(ctx context.Context, job *river.Job[RepoPRSyncJo
 		return fmt.Errorf("failed to load repository %d: %w", args.RepositoryID, err)
 	}
 
+	// The org's GitHub App syncs this repo already; a token copy would double every PR.
+	if _, err := appRepositoryID(w.db, info); err == nil {
+		return nil
+	} else if !errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("failed to check GitHub App coverage for repository %d: %w", args.RepositoryID, err)
+	}
+
 	state := providers.PRListStateAll
 	stopAt := time.Time{}
 	if !args.InitialBackfill && info.LastSyncedAt.Valid {
@@ -308,7 +364,7 @@ func (w *PRStateSyncWorker) postLinksComment(ctx context.Context, repositoryID,
 		return nil
 	}
 
-	info, err := loadRepositoryConnectorInfo(w.db, repositoryID)
+	info, err := loadActingConnectorInfo(w.db, repositoryID)
 	if err == nil {
 		err = writePRSection(ctx, info, number, buildPRLinksSection(host, pullRequestID, repositoryID, ""))
 	}
diff --git a/storage/providers/github/token_store.go b/storage/providers/github/token_store.go
index e8f04b53..d577589a 100644
--- a/storage/providers/github/token_store.go
+++ b/storage/providers/github/token_store.go
@@ -335,6 +335,62 @@ func (s *TokenStore) LatestReviewConnector(connectorIDs []int64, prURL string) (
 	return id, err
 }
 
+// PreferredSiblingConnector says which connector should answer an event for a repo that several orgs connected with
+// a token from the same provider account. Each org has its own webhook, so every one of them sees the event.
+// It is the connector that reviewed prURL most recently, else the oldest. It returns connectorID itself when it has
+// no such siblings (or no saved account profile), so a different answer only ever means "defer to another org".
+func (s *TokenStore) PreferredSiblingConnector(connectorID, orgID int64, repoProviderID, repoFullName, prURL string) (int64, error) {
+	// Deliberately spans orgs, like LatestReviewConnector: the caller only compares the returned id with its own.
+	rows, err := s.db.Query(`
+		WITH accounts AS (
+			SELECT id, org_id, provider, provider_url,
+			       COALESCE(metadata->'githubProfile'->>'id', metadata->'gitlabProfile'->>'id',
+			                metadata->'giteaProfile'->>'id', metadata->'bitbucketProfile'->>'account_id') AS account_id
+			FROM integration_tokens
+			WHERE token_type = 'PAT'
+		)
+		SELECT DISTINCT other.id
+		FROM accounts me
+		JOIN accounts other ON other.provider = me.provider AND other.provider_url = me.provider_url
+		                   AND other.account_id = me.account_id
+		JOIN repositories r ON r.connector_id = other.id
+		WHERE me.id = $1 AND me.org_id = $2 AND me.account_id IS NOT NULL
+		  AND (($3 <> '' AND r.provider_repo_id = $3) OR ($4 <> '' AND LOWER(r.full_name) = LOWER($4)))
+		ORDER BY other.id
+	`, connectorID, orgID, repoProviderID, repoFullName)
+	if err != nil {
+		return connectorID, err
+	}
+	defer rows.Close()
+	var ids []int64
+	includesSelf := false
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return connectorID, err
+		}
+		ids = append(ids, id)
+		includesSelf = includesSelf || id == connectorID
+	}
+	if err := rows.Err(); err != nil {
+		return connectorID, err
+	}
+	// Fail open: if this connector doesn't list the repo itself, don't let a sibling silence it.
+	if len(ids) < 2 || !includesSelf {
+		return connectorID, nil
+	}
+	if prURL != "" {
+		id, err := s.LatestReviewConnector(ids, prURL)
+		if err == nil {
+			return id, nil
+		}
+		if !errors.Is(err, sql.ErrNoRows) {
+			return connectorID, err
+		}
+	}
+	return ids[0], nil
+}
+
 // UpdateCachedInstallationToken stores a freshly minted installation token on its connector.
 func (s *TokenStore) UpdateCachedInstallationToken(connectorID int64, token string, expiresAt time.Time) error {
 	_, err := s.db.Exec(`

From 7b8c5f909bdf71e250d2b532aed7cc952a6b4523 Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Wed, 28 Oct 2026 21:46:54 +0530
Subject: [PATCH 4/9] fix: answer GitHub ping webhooks with 200 instead of an
 error

GitHub sends a ping the moment a webhook is created. The token webhook path
had no handler for it, so every new webhook logged an error and returned 400.
It now returns 200 "ignored" before any conversion runs.

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
---
 internal/api/webhook_orchestrator_v2.go | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/internal/api/webhook_orchestrator_v2.go b/internal/api/webhook_orchestrator_v2.go
index 992c8419..3e225c29 100644
--- a/internal/api/webhook_orchestrator_v2.go
+++ b/internal/api/webhook_orchestrator_v2.go
@@ -23,6 +23,7 @@ import (
 	githubinput "github.com/livereview/internal/provider_input/github"
 	gitlabinput "github.com/livereview/internal/provider_input/gitlab"
 	"github.com/livereview/internal/prsync"
+	"github.com/livereview/internal/webhookutils"
 	storagelicense "github.com/livereview/storage/license"
 	storagegithub "github.com/livereview/storage/providers/github"
 )
@@ -145,6 +146,15 @@ func (wo *WebhookOrchestratorV2) ProcessWebhookEvent(c echo.Context) error {
 
 	log.Printf("[INFO] Detected provider: %s", providerName)
 
+	// GitHub pings a webhook as soon as it is created; there is nothing to process, so answer 200 instead of an error.
+	if event, _ := webhookutils.GetHeaderCaseInsensitive(headers, "X-GitHub-Event"); providerName == "github" && event == "ping" {
+		return c.JSON(http.StatusOK, map[string]string{
+			"status":   "ignored",
+			"provider": providerName,
+			"reason":   "ping",
+		})
+	}
+
 	// Phase 1.5: PR/MR state-sync short-circuit. GitHub's "pull_request" and
 	// GitLab's "merge_request" webhook events are already delivered to this
 	// endpoint today (LiveReview's webhook installer subscribes to them), but

From 9632ab6d584a5a014cc98609476349c4e516f86f Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Wed, 28 Oct 2026 21:47:05 +0530
Subject: [PATCH 5/9] fix: stop connector forms crashing outside the GitHub App
 page

ConnectorForm spread `false` into the layout props whenever the page was not
/git/github-app, which crashes React 19 development builds (every provider's
form, e.g. /git/github/manual). Title and description are now passed
explicitly and fall back to the layout defaults.

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
---
 ui/src/components/Connector/ConnectorForm.tsx | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/ui/src/components/Connector/ConnectorForm.tsx b/ui/src/components/Connector/ConnectorForm.tsx
index 85036c0b..1ae88141 100644
--- a/ui/src/components/Connector/ConnectorForm.tsx
+++ b/ui/src/components/Connector/ConnectorForm.tsx
@@ -13,11 +13,10 @@ import ConnectorLayout from './ConnectorLayout';
 const ConnectorForm: React.FC = () => {
     const isGitHubApp = useLocation().pathname.startsWith('/git/github-app');
     return (
+        // Props stay undefined off the GitHub App page: spreading `false` crashes React 19 dev builds.
         <ConnectorLayout
-            {...(isGitHubApp && {
-                title: 'GitHub App',
-                description: 'Choose which GitHub accounts and repositories LiveReview can review',
-            })}
+            title={isGitHubApp ? 'GitHub App' : undefined}
+            description={isGitHubApp ? 'Choose which GitHub accounts and repositories LiveReview can review' : undefined}
         >
             <Routes>
                 <Route index element={<ProviderSelection />} />

From 044ed7a3e12d91127074401e8bfcc80852f0c0c2 Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Wed, 28 Oct 2026 21:47:32 +0530
Subject: [PATCH 6/9] fix: show an empty state in Review Pipeline when reviews
 found no issues

The card only checked whether reviews ran. When they ran but reported no
issues there were no links to draw, and the Sankey piled its labels on top of
each other. It now shows "No issues found in this period" in that case.

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
---
 internal/docindex/docs/routes_guide/dashboard.md      |  4 +++-
 .../Dashboard/widgets/ReviewPipelineSankey.tsx        | 11 +++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/internal/docindex/docs/routes_guide/dashboard.md b/internal/docindex/docs/routes_guide/dashboard.md
index f401062b..3224ded4 100644
--- a/internal/docindex/docs/routes_guide/dashboard.md
+++ b/internal/docindex/docs/routes_guide/dashboard.md
@@ -98,7 +98,9 @@ Each contributor keeps the same colour across Top Reviewers and Usage Share
 Widgets render an empty state rather than a broken chart when there's no data
 yet — e.g. Review Coverage shows "Review coverage will appear here once
 PRs/MRs are tracked." An empty grid usually means the org hasn't run reviews
-yet, not that something is wrong.
+yet, not that something is wrong. Review Pipeline shows "No issues found in
+this period" when reviews ran but none reported issues, since there is nothing
+to draw ribbons for.
 
 ## Onboarding and banners
 
diff --git a/ui/src/components/Dashboard/widgets/ReviewPipelineSankey.tsx b/ui/src/components/Dashboard/widgets/ReviewPipelineSankey.tsx
index 30c49712..6bd6bd1a 100644
--- a/ui/src/components/Dashboard/widgets/ReviewPipelineSankey.tsx
+++ b/ui/src/components/Dashboard/widgets/ReviewPipelineSankey.tsx
@@ -96,6 +96,17 @@ export const ReviewPipelineSankey: React.FC = () => {
         );
     }
 
+    // Reviews ran but none reported issues: no links means nothing to draw, and echarts piles the nodes up.
+    if (links.length === 0) {
+        return (
+            <EmptyState
+                icon={<Icons.EmptyState />}
+                title="No issues found in this period"
+                description="Reviews ran, but none reported issues, so there is nothing to chart yet."
+            />
+        );
+    }
+
     return (
         <div ref={containerRef} className="w-full h-full">
             <ReactECharts

From ea35b53fd153f00b2df5557d3983faa6abb9588e Mon Sep 17 00:00:00 2001
From: Lince Mathew <linz07m@gmail.com>
Date: Wed, 28 Oct 2026 21:47:42 +0530
Subject: [PATCH 7/9] feat: shrink dashboard cards that only show an empty
 state

Card height comes from the grid layout, so an empty card was drawn at its full
size with a screen of blank space. Empty cards are now displayed 7 rows tall.
The EmptyState reports itself through a small context and DashboardGrid shrinks
that card. It is display only: it is off in Customize mode and is never saved to
the user's layout.

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
---
 .../docindex/docs/routes_guide/dashboard.md   |  6 +++
 .../Dashboard/widgets/DashboardGrid.tsx       | 37 +++++++++++++++++--
 ui/src/components/UIPrimitives.tsx            |  2 +
 ui/src/components/WidgetEmptyContext.ts       | 16 ++++++++
 4 files changed, 58 insertions(+), 3 deletions(-)
 create mode 100644 ui/src/components/WidgetEmptyContext.ts

diff --git a/internal/docindex/docs/routes_guide/dashboard.md b/internal/docindex/docs/routes_guide/dashboard.md
index 3224ded4..07f2755a 100644
--- a/internal/docindex/docs/routes_guide/dashboard.md
+++ b/internal/docindex/docs/routes_guide/dashboard.md
@@ -102,6 +102,12 @@ yet, not that something is wrong. Review Pipeline shows "No issues found in
 this period" when reviews ran but none reported issues, since there is nothing
 to draw ribbons for.
 
+A card that is showing an empty state is drawn at a compact height (about 7
+grid rows) instead of its full size, so empty cards don't take up a screen of
+blank space. This is display only: it is off while you are in **Customize
+Dashboard**, and it never changes your saved layout, so the card returns to its
+normal size as soon as it has data.
+
 ## Onboarding and banners
 
 - **`OnboardingSteps` / `FloatingOnboardingNudge`** — the setup checklist:
diff --git a/ui/src/components/Dashboard/widgets/DashboardGrid.tsx b/ui/src/components/Dashboard/widgets/DashboardGrid.tsx
index 27b2b83c..823297a3 100644
--- a/ui/src/components/Dashboard/widgets/DashboardGrid.tsx
+++ b/ui/src/components/Dashboard/widgets/DashboardGrid.tsx
@@ -1,4 +1,4 @@
-import React, { useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
+import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
 import classNames from 'classnames';
 import { useSearchParams } from 'react-router-dom';
 import { useMutation, useQueryClient } from '@tanstack/react-query';
@@ -7,6 +7,7 @@ import type { Layout } from 'react-grid-layout/legacy';
 import 'react-grid-layout/css/styles.css';
 import 'react-resizable/css/styles.css';
 import { Button, Icons, Popover, Tooltip } from '../../UIPrimitives';
+import { WidgetEmptyReporterContext, WidgetIdContext } from '../../WidgetEmptyContext';
 import { useDashboardLayout } from './useDashboardLayout';
 import { WidgetChrome } from './WidgetChrome';
 import { ChartSkeleton } from './ChartSkeleton';
@@ -28,6 +29,9 @@ interface DashboardGridProps {
 // class, so the anchors below repeat it as `scroll-mt-[140px]` - keep both in sync.
 const SECTION_ANCHOR_OFFSET = 140;
 
+// A card showing only an empty state is drawn this many grid rows tall (about 300px) instead of its full size.
+const EMPTY_WIDGET_ROWS = 7;
+
 // Rendered inside all three providers (not DashboardGrid itself) so it sits alongside the
 // widgets it refreshes. The dashboard query itself is a plain cheap GET (see useDashboardQuery
 // in api/dashboard.ts) - this button is the explicit, user-triggered path to the expensive
@@ -167,6 +171,25 @@ export const DashboardGrid: React.FC<DashboardGridProps> = ({ userId }) => {
         return () => observer.disconnect();
     }, []);
 
+    // Counts per card (not a flag): the expanded view can mount a second empty state for the same card.
+    const [emptyCounts, setEmptyCounts] = useState<Record<string, number>>({});
+    const reportEmpty = useCallback((widgetId: string, empty: boolean) => {
+        setEmptyCounts((prev) => {
+            const count = Math.max(0, (prev[widgetId] ?? 0) + (empty ? 1 : -1));
+            const { [widgetId]: _removed, ...rest } = prev;
+            return count > 0 ? { ...rest, [widgetId]: count } : rest;
+        });
+    }, []);
+    const hasEmptyWidgets = Object.keys(emptyCounts).length > 0;
+
+    // Display only: empty cards shrink unless the user is customizing, and this is never saved to their layout.
+    const displayLayout = useMemo(() => {
+        if (editMode || !hasEmptyWidgets) return layout;
+        return layout.map((item) => emptyCounts[item.i]
+            ? { ...item, h: Math.min(item.h, EMPTY_WIDGET_ROWS), minH: Math.min(item.minH ?? EMPTY_WIDGET_ROWS, EMPTY_WIDGET_ROWS) }
+            : item);
+    }, [layout, emptyCounts, editMode, hasEmptyWidgets]);
+
     return (
         <DashboardPeriodProvider userId={userId}>
         <ReviewLayersProvider>
@@ -256,10 +279,11 @@ export const DashboardGrid: React.FC<DashboardGridProps> = ({ userId }) => {
             */}
             <div ref={gridWrapperRef}>
                 {gridWidth !== null && (
+                    <WidgetEmptyReporterContext.Provider value={reportEmpty}>
                     <Responsive
                         className="layout"
                         width={gridWidth}
-                        layouts={{ lg: layout }}
+                        layouts={{ lg: displayLayout }}
                         breakpoints={{ lg: 0 }}
                         cols={{ lg: 12 }}
                         rowHeight={30}
@@ -268,7 +292,11 @@ export const DashboardGrid: React.FC<DashboardGridProps> = ({ userId }) => {
                         isDraggable={editMode}
                         isResizable={editMode}
                         draggableHandle=".widget-drag-handle"
-                        onLayoutChange={(currentLayout: Layout) => handleLayoutChange(currentLayout)}
+                        onLayoutChange={(currentLayout: Layout) => {
+                            // Skip while empty cards are shrunk: that layout is for display, not the user's saved one.
+                            if (!editMode && hasEmptyWidgets) return;
+                            handleLayoutChange(currentLayout);
+                        }}
                     >
                         {activeWidgets.map((widget, index) => {
                             const isSectionAnchor = anchorByCategory[widget.category]?.id === widget.id;
@@ -278,6 +306,7 @@ export const DashboardGrid: React.FC<DashboardGridProps> = ({ userId }) => {
                                     id={isSectionAnchor ? `dash-section-${widget.category}` : undefined}
                                     className={isSectionAnchor ? 'scroll-mt-[140px]' : undefined}
                                 >
+                                    <WidgetIdContext.Provider value={widget.id}>
                                     <WidgetChrome
                                         title={widget.title}
                                         category={widget.category}
@@ -293,10 +322,12 @@ export const DashboardGrid: React.FC<DashboardGridProps> = ({ userId }) => {
                                             <widget.component />
                                         </React.Suspense>
                                     </WidgetChrome>
+                                    </WidgetIdContext.Provider>
                                 </div>
                             );
                         })}
                     </Responsive>
+                    </WidgetEmptyReporterContext.Provider>
                 )}
             </div>
         </div>
diff --git a/ui/src/components/UIPrimitives.tsx b/ui/src/components/UIPrimitives.tsx
index 5cbf6a5b..e718dd21 100644
--- a/ui/src/components/UIPrimitives.tsx
+++ b/ui/src/components/UIPrimitives.tsx
@@ -17,6 +17,7 @@ import {
 import { FaSlack, FaAws } from 'react-icons/fa6';
 import { TbUserPlus, TbUsersPlus } from 'react-icons/tb';
 import { VscVscode } from 'react-icons/vsc';
+import { useReportWidgetEmpty } from './WidgetEmptyContext';
 
 // ===== BUTTON COMPONENTS =====
 type ButtonVariant = 'primary' | 'secondary' | 'outline' | 'ghost' | 'danger';
@@ -415,6 +416,7 @@ export const EmptyState: React.FC<EmptyStateProps> = ({
   action,
   className,
 }) => {
+  useReportWidgetEmpty();
   return (
     <div className={classNames('flex flex-col items-center justify-center py-10 text-center', className)}>
       {icon && <div className="mb-4 text-slate-400">{icon}</div>}
diff --git a/ui/src/components/WidgetEmptyContext.ts b/ui/src/components/WidgetEmptyContext.ts
new file mode 100644
index 00000000..4b5c1ea3
--- /dev/null
+++ b/ui/src/components/WidgetEmptyContext.ts
@@ -0,0 +1,16 @@
+import { createContext, useContext, useEffect } from 'react';
+
+// Lets an empty dashboard card tell DashboardGrid it has nothing to draw, so the grid can shrink that card.
+export const WidgetIdContext = createContext<string | null>(null);
+export const WidgetEmptyReporterContext = createContext<((widgetId: string, empty: boolean) => void) | null>(null);
+
+// Call from an empty state. It does nothing outside a dashboard card.
+export function useReportWidgetEmpty(): void {
+    const widgetId = useContext(WidgetIdContext);
+    const report = useContext(WidgetEmptyReporterContext);
+    useEffect(() => {
+        if (!widgetId || !report) return;
+        report(widgetId, true);
+        return () => report(widgetId, false);
+    }, [widgetId, report]);
+}

From 39238087b6ef195aa9c532d4bdd42c044541547b Mon Sep 17 00:00:00 2001
From: lovestaco <athreyac4@gmail.com>
Date: Wed, 28 Oct 2026 22:35:12 +0530
Subject: [PATCH 8/9] fix: connect GitHub App from inside the app without
 switching accounts

The GitHub callback took the LiveReview identity from the GitHub user's email, so
someone logged in as a@domain who installed from the app came back as a@gmail,
in a new org, with the installation connected there.

In-app installs now go through POST /api/v1/github-app/start (session-only, any org
member), which puts the org and user into the signed state. The callback then only
uses GitHub to prove which installations the user can access, re-checks that the
user is still active in that org, connects there and returns to the page it started
on. No Hexmos signup, no new user or org, no login hand-off, no verified GitHub
email needed. "Find my GitHub accounts" connects (or offers) every installation the
GitHub user can see. The public start link is sign-in only (/gh-login unchanged).

Any member can Connect; Disconnect and Uninstall stay owner-only. Adds the
connector.github_app.start audit action, UserStore.ActiveOrgAccess, UI buttons and
docs, and scripts/purge_users.sh for clearing local test users.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 AGENTS.md                                     |   3 +
 docs/audit-events.md                          |   1 +
 internal/api/audit_middleware.go              |   4 +-
 internal/api/github_app_auth.go               | 264 ++++++++++++---
 internal/api/github_app_auth_test.go          | 302 ++++++++++++++++--
 internal/api/github_app_state.go              |  35 +-
 internal/api/github_app_state_test.go         |  18 +-
 internal/auditlog/catalog.go                  |  14 +-
 .../docs/routes_guide/get-started-github.md   |  16 +-
 .../docs/routes_guide/git/git-providers.md    |  20 +-
 .../docs/routes_guide/reviews/new-review.md   |   3 +-
 scripts/purge_users.sh                        | 199 ++++++++++++
 storage/storage_status.md                     |  29 +-
 storage/users/cloud_user_store.go             |  22 ++
 ui/src/api/githubApp.ts                       |  37 ++-
 .../Connector/GitHubAppConnector.tsx          |  28 +-
 .../GitHubApp/GitHubAppAccounts.tsx           |  55 ++--
 .../GitHubApp/GitHubAppNotInstalledModal.tsx  |  21 +-
 .../reviews/diffviewer/DiffViewerPanel.tsx    |  20 +-
 ui/src/hooks/useGitHubAppInstall.ts           |  56 ++--
 ui/src/pages/Auth/GhLogin.tsx                 |   4 +-
 ui/src/pages/GetStarted/GetStartedGitHub.tsx  |  26 +-
 ui/src/pages/Reviews/NewReview.tsx            |  35 +-
 23 files changed, 998 insertions(+), 214 deletions(-)
 create mode 100755 scripts/purge_users.sh

diff --git a/AGENTS.md b/AGENTS.md
index a27026b5..e2c8c449 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,6 +74,9 @@ Restricted strictly to read-only views and review execution.
 - **Subscriptions**:
   - `GET /api/v1/subscriptions/:id` ➔ `subscriptionsHandler.GetSubscription`
   - `GET /api/v1/subscriptions/current` ➔ `subscriptionsHandler.GetCurrentSubscription`
+- **GitHub App** (a deliberate exception to read-only: anyone who can access a GitHub account on GitHub may connect it to their org; disconnecting stays owner-only):
+  - `POST /api/v1/github-app/start` ➔ `s.GitHubAppConnectStart`
+  - `POST /api/v1/github-app/installations/:connector_id/connect` ➔ `s.GitHubAppConnect`
 
 #### Dynamic Role Checks & Middlewares
 
diff --git a/docs/audit-events.md b/docs/audit-events.md
index 1b368ca1..33f1fbef 100644
--- a/docs/audit-events.md
+++ b/docs/audit-events.md
@@ -74,6 +74,7 @@ Generated from `internal/auditlog/catalog.go`.
 | `chat.file.upload` | `chat` | file | info | Chat file uploaded | A file was attached to a chat. |
 | `connector.create` | `connector` | connector | warning | Integration connected | A source-control integration was connected. |
 | `connector.delete` | `connector` | connector | warning | Integration removed | A source-control integration was removed. |
+| `connector.github_app.start` | `connector` | connector | info | GitHub App connection started | A member started connecting a GitHub account or organization through the GitHub App. |
 | `connector.reconnect` | `connector` | connector | info | Integration reconnected | A source-control integration was reconnected. |
 | `connector.update` | `connector` | connector | warning | Integration updated | A source-control integration was updated. |
 | `export.audit` | `export` | audit | warning | Audit log exported | Audit events were exported. |
diff --git a/internal/api/audit_middleware.go b/internal/api/audit_middleware.go
index 4f183207..42efbb33 100644
--- a/internal/api/audit_middleware.go
+++ b/internal/api/audit_middleware.go
@@ -170,8 +170,8 @@ func isAuthAuditSkipped(path string) bool {
 // audited registers a route and its audit spec atomically, so the two cannot
 // drift. It returns the Echo route (with the full path) for callers that need
 // it.
-func (s *Server) audited(g *echo.Group, method, path string, spec auditlog.Spec, h echo.HandlerFunc) *echo.Route {
-	r := g.Add(method, path, h)
+func (s *Server) audited(g *echo.Group, method, path string, spec auditlog.Spec, h echo.HandlerFunc, m ...echo.MiddlewareFunc) *echo.Route {
+	r := g.Add(method, path, h, m...)
 	if s.auditRegistry != nil {
 		s.auditRegistry.Register(method, r.Path, spec)
 	}
diff --git a/internal/api/github_app_auth.go b/internal/api/github_app_auth.go
index c5997c34..225af467 100644
--- a/internal/api/github_app_auth.go
+++ b/internal/api/github_app_auth.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/livereview/internal/aidefault"
 	"github.com/livereview/internal/api/auth"
+	"github.com/livereview/internal/auditlog"
 	"github.com/livereview/internal/githubapp"
 	"github.com/livereview/internal/license"
 	githubprovider "github.com/livereview/internal/provider_input/github"
@@ -64,8 +65,19 @@ func (s *Server) registerGitHubAppRoutes(public, v1 *echo.Group, authMiddleware
 		authMiddleware.ValidateOrgAccess(),
 		authMiddleware.BuildPermissionContext(),
 	)
-	// Session-only and org owners only, like disconnecting: it adds a GitHub account's repositories to the org.
-	v1.POST("/github-app/installations/:connector_id/connect", s.GitHubAppConnect,
+	// Session-only, any member of the org: it adds a GitHub account's repositories to the org.
+	s.audited(v1, echo.POST, "/github-app/installations/:connector_id/connect",
+		auditlog.Spec{Action: auditlog.ActionConnectorConnect, ResourceIDParam: "connector_id"},
+		s.GitHubAppConnect,
+		authMiddleware.RequireAuth(),
+		authMiddleware.BuildOrgContextFromHeader(),
+		authMiddleware.ValidateOrgAccess(),
+		authMiddleware.BuildPermissionContext(),
+	)
+	// Session-only, any member of the org: starts a GitHub round trip that connects to this org and keeps the session.
+	s.audited(v1, echo.POST, "/github-app/start",
+		auditlog.Spec{Action: auditlog.ActionGitHubAppConnectStart},
+		s.GitHubAppConnectStart,
 		authMiddleware.RequireAuth(),
 		authMiddleware.BuildOrgContextFromHeader(),
 		authMiddleware.ValidateOrgAccess(),
@@ -242,15 +254,13 @@ func (s *Server) GitHubAppDisconnect(c echo.Context) error {
 // GitHubAppConnect connects an installation the caller's org has available but not connected: one it disconnected,
 // or one it was offered at sign-in because another LiveReview org already uses it. It keeps the repository scope
 // worked out at the org's last GitHub sign-in (every repository, or only those its GitHub user can access), so it
-// needs no trip to GitHub; minting a token proves the App is still installed.
+// needs no trip to GitHub; minting a token proves the App is still installed. Any member of the org may connect
+// (the route's middleware checks membership); disconnecting stays owner-only.
 func (s *Server) GitHubAppConnect(c echo.Context) error {
 	orgID, ok := auth.GetOrgIDFromContext(c)
 	if !ok {
 		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Org context not found"})
 	}
-	if pc := auth.GetPermissionContext(c); pc == nil || pc.RequireOrgOwner() != nil {
-		return c.JSON(http.StatusForbidden, map[string]string{"error": "Only an organization owner can connect a GitHub installation"})
-	}
 	connectorID, err := strconv.ParseInt(c.Param("connector_id"), 10, 64)
 	if err != nil || connectorID <= 0 {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid connector id"})
@@ -318,28 +328,33 @@ func (s *Server) GitHubAppConnect(c echo.Context) error {
 // ---------------------------------------------------------------------------------------------------------
 // start
 
-// GitHubAppStart begins the GitHub round trip: a signed state (mirrored in a cookie) then a redirect to the
-// install page, or to the OAuth authorize page for users who already installed the App.
+// GitHubAppStart begins the /gh-login round trip ("Continue with GitHub"): a signed state (mirrored in a cookie) then
+// a redirect to the OAuth authorize page. It always signs in as the GitHub user's email, so it never installs:
+// installing from inside the app goes through GitHubAppConnectStart, which keeps the user's session.
 func (s *Server) GitHubAppStart(c echo.Context) error {
-	// target_id (install mode only) is the numeric GitHub id of the account or organization to install on, so
-	// GitHub opens straight at that account instead of listing them; anything that is not a positive number is ignored.
-	var targetID int64
-	if id, err := strconv.ParseInt(c.QueryParam("target_id"), 10, 64); err == nil && id > 0 {
-		targetID = id
-	}
-	mode := sanitizeGHMode(c.QueryParam("mode"))
-	// Only /gh-login starts in sign-in mode; the in-app install buttons store their own return page.
-	return s.redirectToGitHub(c, sanitizeGHSrc(c.QueryParam("src")), mode, targetID, mode == ghModeSignin)
+	return s.redirectToGitHub(c, sanitizeGHSrc(c.QueryParam("src")), ghModeSignin, 0, true)
 }
 
+// redirectToGitHub sends an unbound (/gh-login) round trip to GitHub.
 func (s *Server) redirectToGitHub(c echo.Context, src, mode string, targetID int64, getStarted bool) error {
-	nonce, err := newGHNonce()
+	target, err := s.githubAppStartURL(c, ghState{Src: src, Mode: mode, GetStarted: getStarted}, targetID)
 	if err != nil {
 		return s.githubAppErrorPage(c, http.StatusInternalServerError, "Could not start sign-in. Please try again.")
 	}
-	signed, err := signGHState(ghState{Nonce: nonce, Src: src, Mode: mode, Exp: time.Now().Add(ghStateTTL).Unix(), GetStarted: getStarted}, s.githubAppSecret)
+	return c.Redirect(http.StatusFound, target)
+}
+
+// githubAppStartURL signs st (adding the nonce and expiry), mirrors the nonce in the state cookie and returns the
+// GitHub page to send the browser to: the install page (on targetID when set), or the authorize page in sign-in mode.
+func (s *Server) githubAppStartURL(c echo.Context, st ghState, targetID int64) (string, error) {
+	nonce, err := newGHNonce()
 	if err != nil {
-		return s.githubAppErrorPage(c, http.StatusInternalServerError, "Could not start sign-in. Please try again.")
+		return "", err
+	}
+	st.Nonce, st.Exp = nonce, time.Now().Add(ghStateTTL).Unix()
+	signed, err := signGHState(st, s.githubAppSecret)
+	if err != nil {
+		return "", err
 	}
 
 	// Lax, not Strict: the return trip from GitHub is a cross-site top-level GET, which Strict would drop.
@@ -349,14 +364,61 @@ func (s *Server) redirectToGitHub(c echo.Context, src, mode string, targetID int
 		MaxAge: int(ghStateTTL.Seconds()), HttpOnly: true, Secure: c.Scheme() == "https", SameSite: http.SameSiteLaxMode,
 	})
 
-	target := s.githubApp.InstallURL(signed)
-	if mode == ghModeInstall && targetID > 0 {
-		target = s.githubApp.InstallURLForTarget(signed, targetID)
+	switch {
+	case st.Mode == ghModeSignin:
+		return s.githubApp.AuthorizeURL(signed), nil
+	case targetID > 0:
+		return s.githubApp.InstallURLForTarget(signed, targetID), nil
+	default:
+		return s.githubApp.InstallURL(signed), nil
+	}
+}
+
+type githubAppConnectStartRequest struct {
+	// "install" (default): GitHub's install page, to install the App or pick repositories. "discover": GitHub's
+	// authorize page, which connects or offers every account the GitHub user can already see the App on.
+	Mode string `json:"mode"`
+	Src  string `json:"src"`
+	// TargetID (install only) is the numeric GitHub id of the account or organization to install on, so GitHub opens
+	// straight at it instead of listing them; anything that is not a positive number is ignored.
+	TargetID int64 `json:"target_id"`
+	// Return is the page to come back to: "git" (default), "get-started" or "review/<id>".
+	Return string `json:"return"`
+}
+
+// GitHubAppConnectStart begins a GitHub round trip for the signed-in user's current org and returns the GitHub URL
+// to open (a navigation can't carry the session token, so the UI asks for the URL first). The state names the org
+// and user, so the callback connects there and leaves the session alone: the GitHub account only proves which
+// installations it can access, whatever its email.
+func (s *Server) GitHubAppConnectStart(c echo.Context) error {
+	orgID, ok := auth.GetOrgIDFromContext(c)
+	user := auth.GetUser(c)
+	if !ok || user == nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Org context not found"})
 	}
-	if mode == ghModeSignin {
-		target = s.githubApp.AuthorizeURL(signed)
+	var req githubAppConnectStartRequest
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
 	}
-	return c.Redirect(http.StatusFound, target)
+	mode, targetID := ghModeInstall, req.TargetID
+	switch req.Mode {
+	case "", ghModeInstall:
+	case "discover":
+		mode, targetID = ghModeSignin, 0
+	default:
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "mode must be install or discover"})
+	}
+	if targetID < 0 {
+		targetID = 0
+	}
+	target, err := s.githubAppStartURL(c, ghState{
+		Src: sanitizeGHSrc(req.Src), Mode: mode, OrgID: orgID, UserID: user.ID, Return: sanitizeGHReturn(req.Return),
+	}, targetID)
+	if err != nil {
+		log.Printf("[GitHubApp] connect start (org %d): %v", orgID, err)
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "Could not start connecting to GitHub. Please try again."})
+	}
+	return c.JSON(http.StatusOK, map[string]string{"url": target})
 }
 
 // ---------------------------------------------------------------------------------------------------------
@@ -371,15 +433,20 @@ func pickPrimaryVerifiedEmail(emails []networkgithub.UserEmail) string {
 	return ""
 }
 
-// GitHubAppCallback finishes the round trip: verify the state, prove who the GitHub user is, prove they own the
-// installation, sign them in through Hexmos (cloud), connect the installation to their org, and hand the
-// browser to the normal Cloud login with the Hexmos JWT.
+// GitHubAppCallback finishes the round trip: verify the state, prove who the GitHub user is and which installations
+// they can access, then either connect them to the signed-in org that started the trip (bound: see
+// finishBoundGitHubAppCallback), or sign the GitHub user in through Hexmos (cloud), connect the installation to
+// their org, and hand the browser to the normal Cloud login with the Hexmos JWT (/gh-login).
 func (s *Server) GitHubAppCallback(c echo.Context) error {
 	cfg := s.githubApp
 	ctx := c.Request().Context()
 
 	if c.QueryParam("setup_action") == "request" {
-		// A member asked an owner to approve the install; there is no installation (and no code) yet.
+		// A member asked an owner to approve the install; there is no installation (and no code) yet. The state is
+		// only read to pick the page to go back to; nothing is connected here.
+		if st, err := verifyGHState(c.QueryParam("state"), s.githubAppSecret, time.Now()); err == nil && st.OrgID != 0 {
+			return s.githubAppBoundErrorPage(c, st, http.StatusOK, "Installation requested. An owner of the GitHub organization needs to approve it on GitHub; you'll get an email when they do. Then come back here and choose Find my GitHub accounts.")
+		}
 		return s.githubAppErrorPage(c, http.StatusOK, "Installation requested. An owner of the GitHub organization needs to approve it on GitHub; you'll get an email when they do. Then start again from the sign-in page.")
 	}
 
@@ -391,35 +458,32 @@ func (s *Server) GitHubAppCallback(c echo.Context) error {
 	if err != nil || cookieErr != nil || !hmac.Equal([]byte(cookie.Value), []byte(state.Nonce)) {
 		return s.githubAppErrorPage(c, http.StatusBadRequest, "This sign-in link expired or was opened in a different browser. Please start again.")
 	}
+	// From here on a bound round trip's errors link back to the app page it started on.
+	fail := func(status int, message string) error {
+		if state.OrgID != 0 {
+			return s.githubAppBoundErrorPage(c, state, status, message)
+		}
+		return s.githubAppErrorPage(c, status, message)
+	}
 
 	code := c.QueryParam("code")
 	if code == "" {
-		return s.githubAppErrorPage(c, http.StatusBadRequest, "GitHub did not return an authorization code. Please start again.")
+		return fail(http.StatusBadRequest, "GitHub did not return an authorization code. Please start again.")
 	}
 
 	// 2. the GitHub user.
 	userTok, err := networkgithub.ExchangeUserCode(ctx, cfg.BaseURL, cfg.ClientID, cfg.ClientSecret, code)
 	if err != nil {
 		log.Printf("[GitHubApp] code exchange failed: %v", err)
-		return s.githubAppErrorPage(c, http.StatusBadRequest, "GitHub rejected the sign-in code. Please start again.")
+		return fail(http.StatusBadRequest, "GitHub rejected the sign-in code. Please start again.")
 	}
 	userToken := userTok.AccessToken
 
-	emails, err := networkgithub.ListUserEmails(ctx, cfg.APIBaseURL(), userToken)
-	if err != nil {
-		log.Printf("[GitHubApp] list emails failed: %v", err)
-		return s.githubAppErrorPage(c, http.StatusBadGateway, "Could not read your GitHub email address. Please try again.")
-	}
-	email := pickPrimaryVerifiedEmail(emails)
-	if email == "" {
-		return s.githubAppErrorPage(c, http.StatusBadRequest, "Your GitHub account needs a verified primary email address to sign in.")
-	}
-
 	// 3. the installation must belong to this GitHub user; otherwise anyone could claim someone else's by editing the URL.
 	installs, err := networkgithub.ListUserInstallations(ctx, cfg.APIBaseURL(), userToken)
 	if err != nil {
 		log.Printf("[GitHubApp] list installations failed: %v", err)
-		return s.githubAppErrorPage(c, http.StatusBadGateway, "Could not read your GitHub installations. Please try again.")
+		return fail(http.StatusBadGateway, "Could not read your GitHub installations. Please try again.")
 	}
 	var targets []networkgithub.Installation
 	explicit := c.QueryParam("installation_id") != ""
@@ -433,8 +497,23 @@ func (s *Server) GitHubAppCallback(c echo.Context) error {
 		targets = append(targets, inst)
 	}
 	if explicit && len(targets) == 0 {
-		return s.githubAppErrorPage(c, http.StatusForbidden, "That installation doesn't belong to your GitHub account.")
+		return fail(http.StatusForbidden, "That installation doesn't belong to your GitHub account.")
 	}
+	if state.OrgID != 0 {
+		return s.finishBoundGitHubAppCallback(c, state, targets, explicit, userToken)
+	}
+
+	// The rest signs in as the GitHub user (/gh-login), so it needs their verified email.
+	emails, err := networkgithub.ListUserEmails(ctx, cfg.APIBaseURL(), userToken)
+	if err != nil {
+		log.Printf("[GitHubApp] list emails failed: %v", err)
+		return s.githubAppErrorPage(c, http.StatusBadGateway, "Could not read your GitHub email address. Please try again.")
+	}
+	email := pickPrimaryVerifiedEmail(emails)
+	if email == "" {
+		return s.githubAppErrorPage(c, http.StatusBadRequest, "Your GitHub account needs a verified primary email address to sign in.")
+	}
+
 	// Signing in with GitHub (no installation_id) is allowed with nothing installed yet: the account is created
 	// below, then the user is sent straight on to GitHub's install page (no LiveReview session yet, so there is no
 	// login screen flash in between). The callback that follows the install signs them in.
@@ -559,6 +638,89 @@ func (s *Server) GitHubAppCallback(c echo.Context) error {
 	return c.Redirect(http.StatusFound, "/?data="+url.QueryEscape(string(data)))
 }
 
+// finishBoundGitHubAppCallback ends a round trip started inside the app (GitHubAppConnectStart). GitHub only proves
+// which installations this GitHub user can access; the org and the user come from the signed state, so the browser
+// keeps its session whatever email the GitHub account uses, and no Hexmos account, LiveReview user or org is
+// created. Each installation is connected exactly as on a GitHub sign-in (see connectGitHubAppInstallation): explicit
+// (just installed or configured) connects it; otherwise one another org already uses is only offered (Connect).
+func (s *Server) finishBoundGitHubAppCallback(c echo.Context, state *ghState, targets []networkgithub.Installation, explicit bool, userToken string) error {
+	ctx := c.Request().Context()
+	fail := func(status int, message string) error { return s.githubAppBoundErrorPage(c, state, status, message) }
+
+	// The session may have changed during the round trip (removed from the org, deactivated): check again.
+	hasAccess, isSuperAdmin, err := storageusers.NewUserStore(s.db).ActiveOrgAccess(ctx, state.UserID, state.OrgID)
+	if err != nil {
+		log.Printf("[GitHubApp] bound callback: access check for user %d in org %d failed: %v", state.UserID, state.OrgID, err)
+		return fail(http.StatusInternalServerError, "Could not check your LiveReview access. Please try again.")
+	}
+	if !hasAccess {
+		return fail(http.StatusForbidden, "You no longer have access to this LiveReview organization, so nothing was connected.")
+	}
+	if len(targets) == 0 && state.Mode != ghModeSignin {
+		return fail(http.StatusBadRequest, "The LiveReview GitHub App isn't installed on that GitHub account yet. Please try again and choose Install.")
+	}
+
+	connected, failed := 0, 0
+	for _, inst := range targets {
+		connectorID, created, resync, err := s.connectGitHubAppInstallation(ctx, state.OrgID, inst, userToken, explicit)
+		if errors.Is(err, storagegithub.ErrAppConnectorDisconnected) || errors.Is(err, storagegithub.ErrAppConnectorOffered) {
+			continue // recorded as available: Connect on the GitHub App page connects it
+		}
+		if err != nil {
+			log.Printf("[GitHubApp] bound callback: connecting installation %d to org %d failed: %v", inst.ID, state.OrgID, err)
+			if explicit {
+				return fail(http.StatusBadGateway, "Could not connect your GitHub installation. Please try again.")
+			}
+			failed++
+			continue
+		}
+		connected++
+		s.syncGitHubAppConnectorAsync(connectorID, created || resync)
+		s.auditBoundGitHubAppConnect(ctx, state, isSuperAdmin, connectorID, created, inst)
+	}
+	if connected == 0 && failed > 0 {
+		return fail(http.StatusBadGateway, "Could not connect your GitHub installation. Please try again.")
+	}
+
+	// Open the org the trip started in, even if another tab switched orgs meanwhile (read and cleared by index.tsx).
+	// nosemgrep: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure, go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly -- the UI must read it from JS (index.tsx); holds only an org id; Secure whenever HTTPS
+	c.SetCookie(&http.Cookie{
+		Name: ghOrgCookieName, Value: strconv.FormatInt(state.OrgID, 10), Path: "/",
+		MaxAge: 300, Secure: c.Scheme() == "https", SameSite: http.SameSiteLaxMode,
+	})
+	return c.Redirect(http.StatusFound, "/"+ghReturnHash(state.Return))
+}
+
+// auditBoundGitHubAppConnect records a bound connection under the user who started it. It is best effort: the
+// connection is already made, and a missing audit row must not strand the user on an error page.
+func (s *Server) auditBoundGitHubAppConnect(ctx context.Context, state *ghState, isSuperAdmin bool, connectorID int64, created bool, inst networkgithub.Installation) {
+	if s.auditRecorder == nil {
+		return
+	}
+	action := auditlog.ActionConnectorUpdate
+	if created {
+		action = auditlog.ActionConnectorCreate
+	}
+	userID := state.UserID
+	ev := auditlog.Event{
+		OrgID:         state.OrgID,
+		ActorUserID:   &userID,
+		ActorKind:     auditlog.ActorKindMember,
+		ActorCapacity: auditlog.ActorCapacityMember,
+		AuthMethod:    "github_app",
+		Action:        action,
+		ResourceType:  "connector",
+		ResourceID:    strconv.FormatInt(connectorID, 10),
+		Details:       auditlog.Details("provider", "github_app", "installation_id", inst.ID, "account_login", inst.AccountLogin),
+	}
+	if isSuperAdmin {
+		ev.ActorKind, ev.ActorCapacity = auditlog.ActorKindSuperAdmin, auditlog.ActorCapacityAdmin
+	}
+	if err := s.auditRecorder.Record(ctx, ev); err != nil {
+		log.Printf("[GitHubApp] bound callback: audit for connector %d failed: %v", connectorID, err)
+	}
+}
+
 // ghSrcLaunchTrial is the /gh-login?src= value of the Product Hunt launch CTA. New orgs created through it may
 // run reviews on the LiveReview model while on the Free plan (within its monthly LOC limit).
 const ghSrcLaunchTrial = "launch-trial"
@@ -1210,14 +1372,24 @@ a.btn{display:inline-block;background:var(--accent);color:#fff;text-decoration:n
 a.alt{margin-left:14px;color:var(--accent)}
 </style></head><body><main>
 <h1>LiveReview</h1><p>{{.Message}}</p>
-<a class="btn" href="/#/gh-login">Try again</a><a class="alt" href="/">Other ways to sign in</a>
+{{if .BackURL}}<a class="btn" href="{{.BackURL}}">Back to LiveReview</a>{{else}}<a class="btn" href="/#/gh-login">Try again</a><a class="alt" href="/">Other ways to sign in</a>{{end}}
 </main></body></html>`))
 
 // githubAppErrorPage renders a small self-contained error page; the GitHub round trip is a browser navigation,
 // so a JSON error would just strand the user.
 func (s *Server) githubAppErrorPage(c echo.Context, status int, message string) error {
+	return s.renderGitHubAppErrorPage(c, status, message, "")
+}
+
+// githubAppBoundErrorPage is githubAppErrorPage for a round trip started inside the app: the user is still signed
+// in, so the button goes back to the page they started on instead of the sign-in page.
+func (s *Server) githubAppBoundErrorPage(c echo.Context, state *ghState, status int, message string) error {
+	return s.renderGitHubAppErrorPage(c, status, message, "/"+ghReturnHash(state.Return))
+}
+
+func (s *Server) renderGitHubAppErrorPage(c echo.Context, status int, message, backURL string) error {
 	var buf bytes.Buffer
-	if err := githubAppErrorTemplate.Execute(&buf, map[string]string{"Message": message}); err != nil {
+	if err := githubAppErrorTemplate.Execute(&buf, map[string]string{"Message": message, "BackURL": backURL}); err != nil {
 		return c.String(status, message)
 	}
 	return c.HTMLBlob(status, buf.Bytes())
diff --git a/internal/api/github_app_auth_test.go b/internal/api/github_app_auth_test.go
index 84620930..8fb4703b 100644
--- a/internal/api/github_app_auth_test.go
+++ b/internal/api/github_app_auth_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/livereview/internal/api/auth"
 	"github.com/livereview/internal/database"
 	"github.com/livereview/internal/githubapp"
+	"github.com/livereview/pkg/models"
 	storagegithub "github.com/livereview/storage/providers/github"
 )
 
@@ -211,12 +212,13 @@ func (s *Server) validState(t *testing.T, mode string) (state, nonce string) {
 	return state, nonce
 }
 
-func TestGitHubAppStart_RedirectsToInstallOrAuthorize(t *testing.T) {
+// The public start is /gh-login's: it always signs in, so an old in-app install link can no longer swap the session.
+func TestGitHubAppStart_AlwaysSignsIn(t *testing.T) {
 	f := newFakeGitHub(t)
 	s, _ := newGitHubAppTestServer(t, f)
 
-	for mode, wantPath := range map[string]string{"": "/github-apps/lr-test/installations/new", "signin": "/login/oauth/authorize"} {
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/github-app/start?src=Home&mode="+mode, nil)
+	for _, mode := range []string{"", "install", "signin"} {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/github-app/start?src=Home&target_id=42&mode="+mode, nil)
 		rec := httptest.NewRecorder()
 		if err := s.GitHubAppStart(echo.New().NewContext(req, rec)); err != nil {
 			t.Fatal(err)
@@ -225,11 +227,11 @@ func TestGitHubAppStart_RedirectsToInstallOrAuthorize(t *testing.T) {
 			t.Fatalf("mode %q: status %d", mode, rec.Code)
 		}
 		loc, _ := url.Parse(rec.Header().Get("Location"))
-		if loc.Path != wantPath {
-			t.Errorf("mode %q: redirected to %s, want path %s", mode, loc.Path, wantPath)
+		if loc.Path != "/login/oauth/authorize" {
+			t.Errorf("mode %q: redirected to %s, want the authorize page", mode, loc.Path)
 		}
 		st, err := verifyGHState(loc.Query().Get("state"), s.githubAppSecret, time.Now())
-		if err != nil || st.Src != "home" {
+		if err != nil || st.Src != "home" || st.Mode != ghModeSignin || !st.GetStarted || st.OrgID != 0 || st.UserID != 0 {
 			t.Fatalf("mode %q: bad state in redirect: %v %+v", mode, err, st)
 		}
 		var cookie *http.Cookie
@@ -270,9 +272,15 @@ func TestGitHubAppCallback_SetupActionRequestIsInformational(t *testing.T) {
 	f := newFakeGitHub(t)
 	s, _ := newGitHubAppTestServer(t, f)
 	rec := s.doCallback(t, callbackParams{setupAction: "request"})
-	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "needs to approve") {
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "needs to approve") || !strings.Contains(rec.Body.String(), `href="/#/gh-login"`) {
 		t.Fatalf("status %d body %q", rec.Code, rec.Body.String())
 	}
+	// Requested from inside the app: the page goes back there.
+	state, _ := s.boundState(t, 3, 4, ghModeInstall, ghNextGetStarted)
+	rec = s.doCallback(t, callbackParams{setupAction: "request", state: state})
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "Find my GitHub accounts") || !strings.Contains(rec.Body.String(), `href="/#/get-started/github"`) {
+		t.Fatalf("bound: status %d body %q", rec.Code, rec.Body.String())
+	}
 }
 
 func TestGitHubAppCallback_RejectsUnverifiedEmailBadCodeAndForeignInstallation(t *testing.T) {
@@ -285,6 +293,7 @@ func TestGitHubAppCallback_RejectsUnverifiedEmailBadCodeAndForeignInstallation(t
 	}
 
 	f.emails = `[{"email":"a@b.test","primary":true,"verified":false}]`
+	f.installations = f.installation(555, "mine")
 	state, nonce = s.validState(t, ghModeInstall)
 	rec := s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code", installation: "555"})
 	if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "verified primary email") {
@@ -1019,7 +1028,7 @@ func TestGitHubAppDisconnect_SharedInstallation(t *testing.T) {
 	}
 }
 
-func TestGitHubAppConnect_OwnersOnlyOrgScopedAndListedAsAvailable(t *testing.T) {
+func TestGitHubAppConnect_MembersOrgScopedAndListedAsAvailable(t *testing.T) {
 	f := newFakeGitHub(t)
 	s, db := newGitHubAppTestServer(t, f)
 	store := storagegithub.NewTokenStore(db)
@@ -1082,14 +1091,12 @@ func TestGitHubAppConnect_OwnersOnlyOrgScopedAndListedAsAvailable(t *testing.T)
 		recs, _ := store.ListAppConnectorsForOrg(orgB)
 		return len(recs) == 1
 	}
-	if rec := call(orgB, false); rec.Code != http.StatusForbidden || live() {
-		t.Fatalf("a plain member must not connect: %d", rec.Code)
-	}
 	if rec := call(orgA, true); rec.Code != http.StatusNotFound || live() {
 		t.Fatalf("another org's owner must get 404: %d", rec.Code)
 	}
-	if rec := call(orgB, true); rec.Code != http.StatusOK || !live() {
-		t.Fatalf("owner connect: %d %s", rec.Code, rec.Body.String())
+	// Any member of the org may connect (disconnecting stays owner-only).
+	if rec := call(orgB, false); rec.Code != http.StatusOK || !live() {
+		t.Fatalf("member connect: %d %s", rec.Code, rec.Body.String())
 	}
 	rec, _ := store.GetGitHubTokenByConnectorID(connB)
 	if sc := connectorMeta(t, rec); rec.PatToken != "ghs_inst" || sc.RepoScope != storagegithub.RepoScopeUser || len(sc.AllowedRepoIDs) != 1 {
@@ -1103,34 +1110,273 @@ func TestGitHubAppConnect_OwnersOnlyOrgScopedAndListedAsAvailable(t *testing.T)
 	}
 }
 
-func TestGitHubAppStart_TargetIDOpensInstallPageOnThatAccount(t *testing.T) {
+// connectStart calls GitHubAppConnectStart as user userID in org orgID (0 leaves the user out of the context).
+func (s *Server) connectStart(t *testing.T, orgID, userID int64, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/github-app/start", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := echo.New().NewContext(req, rec)
+	c.Set("org_id", orgID)
+	if userID != 0 {
+		c.Set(string(auth.UserContextKey), &models.User{ID: userID})
+	}
+	if err := s.GitHubAppConnectStart(c); err != nil {
+		t.Fatal(err)
+	}
+	return rec
+}
+
+func TestGitHubAppConnectStart_BindsSessionOrgAndOpensTarget(t *testing.T) {
 	f := newFakeGitHub(t)
 	s, _ := newGitHubAppTestServer(t, f)
 
-	start := func(query string) *url.URL {
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/github-app/start?"+query, nil)
-		rec := httptest.NewRecorder()
-		if err := s.GitHubAppStart(echo.New().NewContext(req, rec)); err != nil {
-			t.Fatal(err)
+	start := func(body string) (*url.URL, *ghState, *http.Cookie) {
+		rec := s.connectStart(t, 31, 47, body)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("body %s: status %d %s", body, rec.Code, rec.Body.String())
 		}
-		loc, _ := url.Parse(rec.Header().Get("Location"))
-		return loc
+		var out struct {
+			URL string `json:"url"`
+		}
+		_ = json.Unmarshal(rec.Body.Bytes(), &out)
+		loc, err := url.Parse(out.URL)
+		if err != nil || out.URL == "" {
+			t.Fatalf("body %s: no url in %s", body, rec.Body.String())
+		}
+		st, err := verifyGHState(loc.Query().Get("state"), s.githubAppSecret, time.Now())
+		if err != nil {
+			t.Fatalf("body %s: bad state: %v", body, err)
+		}
+		var cookie *http.Cookie
+		for _, c := range rec.Result().Cookies() {
+			if c.Name == ghStateCookieName {
+				cookie = c
+			}
+		}
+		return loc, st, cookie
 	}
 
-	loc := start("mode=install&src=x&target_id=42")
+	loc, st, cookie := start(`{"mode":"install","src":"git-providers","target_id":42,"return":"get-started"}`)
 	if loc.Path != "/github-apps/lr-test/installations/new/permissions" || loc.Query().Get("target_id") != "42" {
 		t.Errorf("install with target_id went to %s", loc)
 	}
-	if _, err := verifyGHState(loc.Query().Get("state"), s.githubAppSecret, time.Now()); err != nil {
-		t.Errorf("state missing or bad on the targeted install URL: %v", err)
+	if st.OrgID != 31 || st.UserID != 47 || st.Mode != ghModeInstall || st.Return != ghNextGetStarted || st.GetStarted || st.Src != "git-providers" {
+		t.Errorf("state = %+v, want bound to org 31 / user 47, returning to get-started", st)
+	}
+	if cookie == nil || cookie.Value != st.Nonce || !cookie.HttpOnly || cookie.Path != "/api/v1/auth/github-app" {
+		t.Errorf("state cookie wrong: %+v", cookie)
 	}
-	for _, bad := range []string{"abc", "-5", "0", "1.5"} {
-		if loc := start("mode=install&src=x&target_id=" + bad); loc.Path != "/github-apps/lr-test/installations/new" {
+	for _, bad := range []string{"-5", "0"} {
+		if loc, _, _ := start(`{"target_id":` + bad + `}`); loc.Path != "/github-apps/lr-test/installations/new" {
 			t.Errorf("target_id=%s must be ignored, went to %s", bad, loc)
 		}
 	}
-	if loc := start("mode=signin&src=x&target_id=42"); loc.Path != "/login/oauth/authorize" {
-		t.Errorf("sign-in must ignore target_id, went to %s", loc)
+	if loc, st, _ := start(`{"mode":"discover","target_id":42,"return":"https://evil.example"}`); loc.Path != "/login/oauth/authorize" ||
+		st.Mode != ghModeSignin || st.Return != ghNextGitProviders || st.OrgID != 31 {
+		t.Errorf("discover went to %s with state %+v", loc, st)
+	}
+
+	if rec := s.connectStart(t, 31, 47, `{"mode":"signin"}`); rec.Code != http.StatusBadRequest {
+		t.Errorf("unknown mode: status %d, want 400", rec.Code)
+	}
+	if rec := s.connectStart(t, 31, 0, `{}`); rec.Code != http.StatusUnauthorized {
+		t.Errorf("no user: status %d, want 401", rec.Code)
+	}
+}
+
+// boundState is a state from GitHubAppConnectStart: user userID in org orgID.
+func (s *Server) boundState(t *testing.T, orgID, userID int64, mode, ret string) (state, nonce string) {
+	t.Helper()
+	nonce = "nonce-" + fmt.Sprint(time.Now().UnixNano())
+	state, err := signGHState(ghState{Nonce: nonce, Src: "test", Mode: mode, Exp: time.Now().Add(time.Minute).Unix(),
+		OrgID: orgID, UserID: userID, Return: ret}, s.githubAppSecret)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return state, nonce
+}
+
+// mkGitHubAppOrg creates an org named name (removed after the test).
+func mkGitHubAppOrg(t *testing.T, db *sql.DB, name string) int64 {
+	t.Helper()
+	cleanupGitHubAppTenant(t, db, name)
+	var id int64
+	if err := db.QueryRow(`INSERT INTO orgs (name, description) VALUES ($1, 'github app bound test') RETURNING id`, name).Scan(&id); err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+// mkGitHubAppUser creates an email-login user with role in each of orgs (removed after the test, before the orgs).
+func mkGitHubAppUser(t *testing.T, db *sql.DB, email, role string, orgs ...int64) int64 {
+	t.Helper()
+	cleanupGitHubAppTenant(t, db, email)
+	var id int64
+	if err := db.QueryRow(`INSERT INTO users (email, password_hash) VALUES ($1, 'x') RETURNING id`, email).Scan(&id); err != nil {
+		t.Fatal(err)
+	}
+	for _, org := range orgs {
+		if _, err := db.Exec(`INSERT INTO user_roles (user_id, org_id, role_id) VALUES ($1, $2, (SELECT id FROM roles WHERE name = $3))`, id, org, role); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return id
+}
+
+func cookieValue(rec *httptest.ResponseRecorder, name string) string {
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == name {
+			return c.Value
+		}
+	}
+	return ""
+}
+
+// Rows 1, 3 and 13 of the GitHub App case table: someone signed in as a@domain installs from the app with a GitHub
+// account whose email is different (and here not even verified), and that email has its own LiveReview account.
+func TestGitHubAppCallback_BoundInstallConnectsSessionOrgWithoutSigningIn(t *testing.T) {
+	f := newFakeGitHub(t)
+	s, db := newGitHubAppTestServer(t, f)
+	suffix := time.Now().UnixNano()
+	domainEmail := fmt.Sprintf("a-%d@domain.test", suffix)
+	gmail := fmt.Sprintf("a-%d@gmail.test", suffix)
+	orgX := mkGitHubAppOrg(t, db, domainEmail)
+	userX := mkGitHubAppUser(t, db, domainEmail, "owner", orgX)
+	gmailOrg := mkGitHubAppOrg(t, db, gmail)
+	mkGitHubAppUser(t, db, gmail, "owner", gmailOrg)
+
+	f.emails = fmt.Sprintf(`[{"email":%q,"primary":true,"verified":false}]`, gmail)
+	newFakeParse(t, gmail, true) // a Hexmos sign-up would fail the callback: it must not happen
+	inst := suffix % 1_000_000_000_000
+	f.installations = f.installation(inst, "hexmostech")
+
+	state, nonce := s.boundState(t, orgX, userX, ghModeInstall, ghNextGitProviders)
+	rec := s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code", installation: fmt.Sprint(inst), setupAction: "install"})
+	if rec.Code != http.StatusFound {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	if loc := rec.Header().Get("Location"); loc != "/#/git/github-app" {
+		t.Fatalf("redirected to %q, want straight back to the GitHub App page with no login hand-off", loc)
+	}
+	if got := cookieValue(rec, ghOrgCookieName); got != fmt.Sprint(orgX) {
+		t.Errorf("org cookie %q, want the session's org %d", got, orgX)
+	}
+	if got := cookieValue(rec, ghNextCookieName); got != "" {
+		t.Errorf("a bound trip sets no login destination; next = %q", got)
+	}
+	store := storagegithub.NewTokenStore(db)
+	conn, err := store.GetAppConnectorByInstallation(f.srv.URL, inst, orgX)
+	if err != nil || conn.PatToken != "ghs_inst" || connectorMeta(t, conn).Removed {
+		t.Fatalf("session org connector = %+v, %v; want connected", conn, err)
+	}
+	if _, err := store.GetAppConnectorByInstallation(f.srv.URL, inst, gmailOrg); !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("the GitHub email's own org must get nothing; err = %v", err)
+	}
+	var users int
+	_ = db.QueryRow(`SELECT COUNT(*) FROM users WHERE email IN ($1, $2)`, domainEmail, gmail).Scan(&users)
+	if users != 2 {
+		t.Fatalf("got %d users, want the 2 that existed (no new account)", users)
+	}
+}
+
+// Row 2 and "Find my GitHub accounts": the installation is already used by another org.
+func TestGitHubAppCallback_BoundDiscoverOffersSharedAndInstallConnectsIt(t *testing.T) {
+	f := newFakeGitHub(t)
+	s, db := newGitHubAppTestServer(t, f)
+	suffix := time.Now().UnixNano()
+	orgA := mkGitHubAppOrg(t, db, fmt.Sprintf("gh-bound-a-%d@example.test", suffix))
+	orgB := mkGitHubAppOrg(t, db, fmt.Sprintf("gh-bound-b-%d@domain.test", suffix))
+	userB := mkGitHubAppUser(t, db, fmt.Sprintf("b-%d@domain.test", suffix), "member", orgB)
+	f.emails = `[{"email":"b@gmail.test","primary":true,"verified":true}]`
+
+	shared, own := suffix%1_000_000_000_000, suffix%1_000_000_000_000+1
+	store := storagegithub.NewTokenStore(db)
+	if _, _, err := store.UpsertAppInstallationConnector(storagegithub.AppConnectorUpsert{
+		OrgID: orgA, BaseURL: f.srv.URL, InstallationID: shared, AccountLogin: "hexmostech", AccountType: "Organization",
+		Token: "ghs_a", ExpiresAt: time.Now().Add(time.Hour), RepoScope: storagegithub.RepoScopeInstaller,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	f.installations = "[" + strings.Trim(f.installation(shared, "hexmostech"), "[]") + "," + strings.Trim(f.installation(own, "bsv"), "[]") + "]"
+	f.instRepos = `[{"id":1,"name":"api","full_name":"hexmostech/api"},{"id":2,"name":"web","full_name":"hexmostech/web"}]`
+	f.userRepos = `[{"id":1}]`
+
+	// Discover: the shared installation is only offered, the one nobody uses is connected.
+	state, nonce := s.boundState(t, orgB, userB, ghModeSignin, "review/9")
+	rec := s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code"})
+	if rec.Code != http.StatusFound || rec.Header().Get("Location") != "/#/reviews/9" {
+		t.Fatalf("discover: status %d location %q: %s", rec.Code, rec.Header().Get("Location"), rec.Body.String())
+	}
+	connShared, err := store.GetAppConnectorByInstallation(f.srv.URL, shared, orgB)
+	if err != nil || !connectorMeta(t, connShared).Removed || connShared.PatToken != "" {
+		t.Fatalf("shared installation in org B = %+v, %v; want offered, not connected", connShared, err)
+	}
+	if avail, _ := store.ListNotConnectedAppConnectorsForOrg(orgB); len(avail) != 1 || avail[0].ID != connShared.ID {
+		t.Fatalf("org B isn't offered the shared installation: %v", avail)
+	}
+	if connOwn, err := store.GetAppConnectorByInstallation(f.srv.URL, own, orgB); err != nil || connectorMeta(t, connOwn).Removed {
+		t.Fatalf("unshared installation in org B = %+v, %v; want connected", connOwn, err)
+	}
+
+	// Install (Configure on GitHub) connects the shared one, limited to the repositories this GitHub user can access.
+	state, nonce = s.boundState(t, orgB, userB, ghModeInstall, "")
+	rec = s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code", installation: fmt.Sprint(shared), setupAction: "update"})
+	if rec.Code != http.StatusFound || rec.Header().Get("Location") != "/#/git/github-app" {
+		t.Fatalf("install: status %d location %q: %s", rec.Code, rec.Header().Get("Location"), rec.Body.String())
+	}
+	connShared, _ = store.GetAppConnectorByInstallation(f.srv.URL, shared, orgB)
+	if sc := connectorMeta(t, connShared); sc.Removed || sc.RepoScope != storagegithub.RepoScopeUser || len(sc.AllowedRepoIDs) != 1 || sc.AllowedRepoIDs[0] != 1 {
+		t.Fatalf("org B connector = %+v, want connected with user scope [1]", sc)
+	}
+	if connA, _ := store.GetAppConnectorByInstallation(f.srv.URL, shared, orgA); connectorMeta(t, connA).Removed || connectorMeta(t, connA).RepoScope != storagegithub.RepoScopeInstaller {
+		t.Fatal("the installer org's connector changed")
+	}
+}
+
+// Rows 11 and 16: the org comes from the state (not the user's other orgs), and access is checked again on return.
+func TestGitHubAppCallback_BoundUsesStateOrgAndRechecksAccess(t *testing.T) {
+	f := newFakeGitHub(t)
+	s, db := newGitHubAppTestServer(t, f)
+	suffix := time.Now().UnixNano()
+	orgX := mkGitHubAppOrg(t, db, fmt.Sprintf("gh-multi-x-%d@example.test", suffix))
+	orgY := mkGitHubAppOrg(t, db, fmt.Sprintf("gh-multi-y-%d@example.test", suffix))
+	user := mkGitHubAppUser(t, db, fmt.Sprintf("multi-%d@domain.test", suffix), "member", orgX, orgY)
+	inst := suffix % 1_000_000_000_000
+	f.installations = f.installation(inst, "acme")
+	store := storagegithub.NewTokenStore(db)
+
+	state, nonce := s.boundState(t, orgY, user, ghModeInstall, "")
+	if rec := s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code", installation: fmt.Sprint(inst)}); rec.Code != http.StatusFound || cookieValue(rec, ghOrgCookieName) != fmt.Sprint(orgY) {
+		t.Fatalf("status %d org cookie %q: %s", rec.Code, cookieValue(rec, ghOrgCookieName), rec.Body.String())
+	}
+	if _, err := store.GetAppConnectorByInstallation(f.srv.URL, inst, orgY); err != nil {
+		t.Fatalf("state org Y has no connector: %v", err)
+	}
+	if _, err := store.GetAppConnectorByInstallation(f.srv.URL, inst, orgX); !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("the user's other org X must get nothing; err = %v", err)
+	}
+
+	// Removed from org X while away on GitHub: nothing is connected, and the error page links back into the app.
+	if _, err := db.Exec(`DELETE FROM user_roles WHERE user_id = $1 AND org_id = $2`, user, orgX); err != nil {
+		t.Fatal(err)
+	}
+	state, nonce = s.boundState(t, orgX, user, ghModeInstall, "review/5")
+	rec := s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code", installation: fmt.Sprint(inst)})
+	if rec.Code != http.StatusForbidden || !strings.Contains(rec.Body.String(), `href="/#/reviews/5"`) {
+		t.Fatalf("removed member: status %d body %s", rec.Code, rec.Body.String())
+	}
+	if _, err := store.GetAppConnectorByInstallation(f.srv.URL, inst, orgX); !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("a removed member must not connect anything; err = %v", err)
+	}
+
+	// A deactivated user is refused too.
+	if _, err := db.Exec(`UPDATE users SET is_active = FALSE WHERE id = $1`, user); err != nil {
+		t.Fatal(err)
+	}
+	state, nonce = s.boundState(t, orgY, user, ghModeSignin, "")
+	if rec := s.doCallback(t, callbackParams{state: state, cookieNonce: nonce, code: "good-code"}); rec.Code != http.StatusForbidden {
+		t.Fatalf("deactivated user: status %d", rec.Code)
 	}
 }
 
diff --git a/internal/api/github_app_state.go b/internal/api/github_app_state.go
index 83bb7a51..f8233764 100644
--- a/internal/api/github_app_state.go
+++ b/internal/api/github_app_state.go
@@ -38,6 +38,34 @@ type ghState struct {
 	// GetStarted: the round trip began on /gh-login, so a successful sign-in lands on get-started. Only the
 	// callback decides this (nothing is stored before leaving), so a failed attempt leaves no stale destination.
 	GetStarted bool `json:"g,omitempty"`
+	// OrgID and UserID bind the round trip to a signed-in LiveReview session (POST /github-app/start): the callback
+	// connects to that org and keeps the session, whatever email the GitHub account uses. Zero for /gh-login.
+	OrgID  int64 `json:"o,omitempty"`
+	UserID int64 `json:"u,omitempty"`
+	// Return is the page a bound round trip lands on, as a sanitizeGHReturn key (never a URL).
+	Return string `json:"r,omitempty"`
+}
+
+var ghReturnReviewPattern = regexp.MustCompile(`^review/[1-9][0-9]{0,18}$`)
+
+// sanitizeGHReturn keeps only the pages a bound round trip may land on; anything else becomes the GitHub App card.
+func sanitizeGHReturn(ret string) string {
+	if ret == ghNextGetStarted || ghReturnReviewPattern.MatchString(ret) {
+		return ret
+	}
+	return ghNextGitProviders
+}
+
+// ghReturnHash is the UI route for a sanitizeGHReturn key.
+func ghReturnHash(ret string) string {
+	switch {
+	case ret == ghNextGetStarted:
+		return "#/get-started/github"
+	case ghReturnReviewPattern.MatchString(ret):
+		return "#/reviews/" + strings.TrimPrefix(ret, "review/")
+	default:
+		return "#/git/github-app"
+	}
 }
 
 // sanitizeGHSrc keeps the campaign tag short and harmless; anything else becomes "unknown".
@@ -49,13 +77,6 @@ func sanitizeGHSrc(src string) string {
 	return "unknown"
 }
 
-func sanitizeGHMode(mode string) string {
-	if mode == ghModeSignin {
-		return ghModeSignin
-	}
-	return ghModeInstall
-}
-
 func newGHNonce() (string, error) {
 	b := make([]byte, 16)
 	if _, err := rand.Read(b); err != nil {
diff --git a/internal/api/github_app_state_test.go b/internal/api/github_app_state_test.go
index c7108bac..456e64d0 100644
--- a/internal/api/github_app_state_test.go
+++ b/internal/api/github_app_state_test.go
@@ -54,13 +54,25 @@ func TestGHState_Rejections(t *testing.T) {
 	}
 }
 
-func TestSanitizeGHSrcAndMode(t *testing.T) {
+func TestSanitizeGHSrcAndReturn(t *testing.T) {
 	for in, want := range map[string]string{"Home": "home", "start-free_1": "start-free_1", "": "unknown", "a b": "unknown", "<script>": "unknown", strings.Repeat("a", 33): "unknown"} {
 		if got := sanitizeGHSrc(in); got != want {
 			t.Errorf("sanitizeGHSrc(%q) = %q, want %q", in, got, want)
 		}
 	}
-	if sanitizeGHMode("signin") != ghModeSignin || sanitizeGHMode("anything") != ghModeInstall || sanitizeGHMode("") != ghModeInstall {
-		t.Error("sanitizeGHMode wrong")
+	for in, want := range map[string]string{
+		"":                              "#/git/github-app",
+		"git":                           "#/git/github-app",
+		"get-started":                   "#/get-started/github",
+		"review/42":                     "#/reviews/42",
+		"review/0":                      "#/git/github-app",
+		"review/42/../../admin":         "#/git/github-app",
+		"https://evil.example":          "#/git/github-app",
+		"//evil.example/#/x":            "#/git/github-app",
+		"review/1234567890123456789012": "#/git/github-app",
+	} {
+		if got := ghReturnHash(sanitizeGHReturn(in)); got != want {
+			t.Errorf("return %q lands on %q, want %q", in, got, want)
+		}
 	}
 }
diff --git a/internal/auditlog/catalog.go b/internal/auditlog/catalog.go
index bfb3cd3f..c1b85cbb 100644
--- a/internal/auditlog/catalog.go
+++ b/internal/auditlog/catalog.go
@@ -150,12 +150,13 @@ const (
 	ActionSettingsRetention     Action = "settings.retention.update"
 	ActionSettingsPrompts       Action = "settings.prompts.update"
 
-	ActionConnectorCreate  Action = "connector.create"
-	ActionConnectorUpdate  Action = "connector.update"
-	ActionConnectorDelete  Action = "connector.delete"
-	ActionConnectorConnect Action = "connector.reconnect"
-	ActionWebhookInstall   Action = "webhook.install"
-	ActionWebhookUninstall Action = "webhook.uninstall"
+	ActionConnectorCreate       Action = "connector.create"
+	ActionConnectorUpdate       Action = "connector.update"
+	ActionConnectorDelete       Action = "connector.delete"
+	ActionConnectorConnect      Action = "connector.reconnect"
+	ActionGitHubAppConnectStart Action = "connector.github_app.start"
+	ActionWebhookInstall        Action = "webhook.install"
+	ActionWebhookUninstall      Action = "webhook.uninstall"
 
 	ActionRepositoryCreate Action = "repository.create"
 	ActionRepositoryUpdate Action = "repository.update"
@@ -292,6 +293,7 @@ var actionCatalog = func() map[Action]ActionMeta {
 		meta(ActionConnectorUpdate, CategoryConnector, "connector", "Integration updated", "A source-control integration was updated.", SeverityWarning),
 		sensitive(meta(ActionConnectorDelete, CategoryConnector, "connector", "Integration removed", "A source-control integration was removed.", SeverityWarning)),
 		meta(ActionConnectorConnect, CategoryConnector, "connector", "Integration reconnected", "A source-control integration was reconnected.", SeverityInfo),
+		meta(ActionGitHubAppConnectStart, CategoryConnector, "connector", "GitHub App connection started", "A member started connecting a GitHub account or organization through the GitHub App.", SeverityInfo),
 		meta(ActionWebhookInstall, CategoryConnector, "webhook", "Webhook installed", "A repository webhook was installed.", SeverityInfo),
 		meta(ActionWebhookUninstall, CategoryConnector, "webhook", "Webhook removed", "A repository webhook was removed.", SeverityWarning),
 
diff --git a/internal/docindex/docs/routes_guide/get-started-github.md b/internal/docindex/docs/routes_guide/get-started-github.md
index 0beeb35c..3fced2d5 100644
--- a/internal/docindex/docs/routes_guide/get-started-github.md
+++ b/internal/docindex/docs/routes_guide/get-started-github.md
@@ -11,12 +11,13 @@ set up, and run the first review on a real pull request.
 
 If the organization has no GitHub App connection yet, or the app was given no
 repositories, the user is sent to GitHub (a spinner shows briefly): into the
-install flow when the app isn't installed (the user stays signed in and comes back in
-through the GitHub flow), or to the installation's settings page on GitHub when
+install flow when the app isn't installed (the user stays signed in as themselves,
+whatever email their GitHub account uses, and comes back to this page), or to the installation's settings page on GitHub when
 it is installed but has no repositories. This happens only once per browser
 session. If the user comes back (Back button) without
-finishing, the page shows a small card with a **Continue with GitHub** button
-(or **Add repositories on GitHub**) instead of redirecting again.
+finishing, the page shows a small card with a **Continue with GitHub** button and
+a **Find my GitHub accounts** button (or **Add repositories on GitHub**) instead of
+redirecting again.
 
 ## Who can access it
 
@@ -35,12 +36,15 @@ organization has a GitHub App connection.
   opens GitHub's install page so the app can be added to
   another account or organization (it lists the ones you can install on); after
   installing, the user returns here and the new account appears in the list.
+- **Find my GitHub accounts** — next to it: signs in to GitHub and adds every
+  account the app is already installed on that the user's GitHub account can
+  access (ones another LiveReview account uses are listed as **Available**).
 - **Already installed by someone else:** when the only GitHub accounts the user
   can see already have the app installed by another LiveReview account (for
   example a teammate's), nothing is connected yet. The page says "LiveReview is
   already installed on <account>" and lists each such account on one line,
-  marked **Available**, with a **Connect** button (organization owners only;
-  members see that an owner can connect it). Connecting adds all of its
+  marked **Available**, with a **Connect** button (any member of the
+  organization). Connecting adds all of its
   repositories, or only the ones the user's GitHub account can access (the line
   says which), and the usual steps appear. It doesn't send the user to GitHub.
 - When the app was already installed on the account by someone else, the
diff --git a/internal/docindex/docs/routes_guide/git/git-providers.md b/internal/docindex/docs/routes_guide/git/git-providers.md
index 15d05036..fc0c679a 100644
--- a/internal/docindex/docs/routes_guide/git/git-providers.md
+++ b/internal/docindex/docs/routes_guide/git/git-providers.md
@@ -44,7 +44,7 @@ Several LiveReview organizations can use the same installation (for example two
 people from one GitHub organization who each signed up). Each has its own
 connection. When a user signs in with GitHub and the app is already installed on
 an account by another LiveReview organization, it isn't connected to theirs
-automatically: it's listed as **Available** and an owner clicks **Connect** to
+automatically: it's listed as **Available** and any member clicks **Connect** to
 opt in. (Installing or configuring the app from LiveReview connects it
 straight away.) An organization that joined an installation someone else
 installed only gets the repositories its user's GitHub account can access. Each account
@@ -68,7 +68,7 @@ confirmation says how many other accounts are affected). Below the connected
 accounts, each account that isn't connected is one line with no repositories:
 **Available** (installed by another LiveReview account; "Already installed by N
 other LiveReview accounts" opens the masked list) or **Disconnected**
-(disconnected here), plus a **Connect** button for organization owners.
+(disconnected here), plus a **Connect** button (any member of the organization).
 Connect needs no trip to GitHub; the repositories sync in the background.
 Once an account is connected, a **Next steps** section below the accounts shows
 the same two steps as get-started: the AI provider (LiveReview AI already
@@ -76,8 +76,20 @@ connected, or **Configure AI**) and **Review a pull request** (**See open
 MRs/PRs and trigger a review** or **Trigger a review via URL**).
 **Add repositories or organization** opens
 GitHub's install page; afterwards the user returns to `/git/github-app` and the
-new account appears. With nothing connected or available yet the page shows **Install the
-GitHub App**. Returning GitHub sign-ins land directly on this page.
+new account appears. **Find my GitHub accounts** signs in to GitHub and adds every
+account the app is already installed on that the user's GitHub account can access:
+accounts nobody else uses are connected, ones another LiveReview account uses are
+listed as **Available** (use **Connect**). With nothing connected or available yet
+the page shows **Install the GitHub App** and **Find my GitHub accounts**.
+Returning GitHub sign-ins land directly on this page.
+
+The GitHub account used on GitHub doesn't have to match the LiveReview login:
+someone signed in to LiveReview as `a@company.com` can install or find accounts
+with a GitHub account whose email is `a@gmail.com`. They stay signed in as
+`a@company.com`, the accounts are connected to the organization they started
+from, and no second LiveReview account is created. GitHub only decides which
+accounts and repositories that user can access. (Signing in with **Continue with
+GitHub** on `/gh-login` is different: it signs in as the GitHub account's email.)
 
 ## Related pages
 
diff --git a/internal/docindex/docs/routes_guide/reviews/new-review.md b/internal/docindex/docs/routes_guide/reviews/new-review.md
index 8695286b..6c9ca885 100644
--- a/internal/docindex/docs/routes_guide/reviews/new-review.md
+++ b/internal/docindex/docs/routes_guide/reviews/new-review.md
@@ -31,7 +31,8 @@ self-hosted license limits.
   comments** (runs the review and shows the findings in LiveReview without
   posting to the pull request). Installing opens GitHub's install page, already
   on that owner, in a new tab, so this page and the review being set up stay
-  put; the other tab signs in again and lands on the connected GitHub accounts.
+  put; the other tab comes back to the connected GitHub accounts, still signed in
+  as the same user (whatever email the GitHub account uses).
   The collapsible **Finished installing on
   GitHub?** section appears under the button right away (the button shows "Opening GitHub…" for two seconds before the tab actually opens), with a highlighted **I've
   installed it, continue review** button. It checks that LiveReview can now see
diff --git a/scripts/purge_users.sh b/scripts/purge_users.sh
new file mode 100755
index 00000000..6d2dd062
--- /dev/null
+++ b/scripts/purge_users.sh
@@ -0,0 +1,199 @@
+#!/usr/bin/env bash
+# Purge LiveReview users and their personal orgs from a database (meant for local test data).
+#
+# For each email: the user, and the org named after that email (the personal org sign-up creates), are deleted
+# together with everything that depends on them. Rows that only optionally point at them (for example a review in
+# another org created by the user) are kept with that reference set to NULL. Other orgs the user belonged to are
+# kept; the user is just removed from them. Audit events for the purged orgs and users are deleted too.
+#
+# Usage:
+#   scripts/purge_users.sh [--dry-run] [--yes] [--allow-remote] [--env-file FILE] email [email...]
+#
+#   --dry-run       run everything inside a transaction and roll it back (shows what would be deleted)
+#   --yes           don't ask for confirmation
+#   --allow-remote  allow a DATABASE_URL whose host is not localhost
+#   --env-file      read DATABASE_URL from this file (default: .env next to this script's repo root)
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+env_file="$repo_root/.env"
+dry_run=0 assume_yes=0 allow_remote=0
+emails=()
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+	--dry-run) dry_run=1 ;;
+	--yes) assume_yes=1 ;;
+	--allow-remote) allow_remote=1 ;;
+	--env-file)
+		env_file="$2"
+		shift
+		;;
+	-h | --help)
+		sed -n '2,17p' "$0"
+		exit 0
+		;;
+	-*)
+		echo "unknown option: $1" >&2
+		exit 2
+		;;
+	*) emails+=("$(echo "$1" | tr '[:upper:]' '[:lower:]')") ;;
+	esac
+	shift
+done
+
+if [ ${#emails[@]} -eq 0 ]; then
+	echo "usage: $0 [--dry-run] [--yes] [--allow-remote] [--env-file FILE] email [email...]" >&2
+	exit 2
+fi
+for e in "${emails[@]}"; do
+	if ! [[ "$e" =~ ^[a-z0-9._%+-]+@[a-z0-9.-]+$ ]]; then
+		echo "not an email address: $e" >&2
+		exit 2
+	fi
+done
+
+if ! command -v psql >/dev/null; then
+	echo "psql not found" >&2
+	exit 1
+fi
+db_url="$(grep -E '^DATABASE_URL=' "$env_file" | tail -1 | cut -d= -f2- | sed -E "s/^['\"]//; s/['\"]$//")"
+if [ -z "$db_url" ]; then
+	echo "DATABASE_URL not found in $env_file" >&2
+	exit 1
+fi
+db_host="$(echo "$db_url" | sed -E 's#^[a-z]+://([^@/]*@)?(\[[^]]*\]|[^:/?]*).*#\2#')"
+case "$db_host" in
+localhost | 127.0.0.1 | "[::1]" | ::1) ;;
+*)
+	if [ "$allow_remote" -ne 1 ]; then
+		echo "refusing: DATABASE_URL host is '$db_host', not localhost (pass --allow-remote if you really mean it)" >&2
+		exit 1
+	fi
+	;;
+esac
+
+email_list="$(
+	IFS=,
+	echo "${emails[*]}"
+)"
+
+echo "Database: $db_host ($(echo "$db_url" | sed -E 's#.*/([^/?]+)(\?.*)?$#\1#'))"
+psql "$db_url" -X -q -v ON_ERROR_STOP=1 -v emails="$email_list" <<'SQL'
+\pset footer off
+\echo 'Users:'
+SELECT id, email FROM users WHERE lower(email) = ANY (string_to_array(:'emails', ','));
+\echo 'Orgs named after these emails (deleted with all their data):'
+SELECT o.id, o.name,
+       (SELECT string_agg(u.email, ', ') FROM user_roles ur JOIN users u ON u.id = ur.user_id WHERE ur.org_id = o.id) AS members
+FROM orgs o WHERE lower(o.name) = ANY (string_to_array(:'emails', ','));
+SQL
+
+if [ "$dry_run" -ne 1 ] && [ "$assume_yes" -ne 1 ]; then
+	read -r -p "Permanently delete the above? [y/N] " answer
+	case "$answer" in
+	y | Y | yes) ;;
+	*)
+		echo "cancelled"
+		exit 1
+		;;
+	esac
+fi
+
+finish="COMMIT;"
+if [ "$dry_run" -eq 1 ]; then
+	finish="ROLLBACK;"
+	echo "(dry run: nothing will be kept)"
+fi
+
+{
+	cat <<'SQL'
+\set ON_ERROR_STOP 1
+BEGIN;
+SET LOCAL app.audit_purge = 'on';
+
+CREATE TEMP TABLE purge_users ON COMMIT DROP AS
+	SELECT id FROM users WHERE lower(email) = ANY (string_to_array(:'emails', ','));
+CREATE TEMP TABLE purge_orgs ON COMMIT DROP AS
+	SELECT id FROM orgs WHERE lower(name) = ANY (string_to_array(:'emails', ','));
+
+-- purge(tbl, cond): delete the rows of tbl matching cond, after dealing with everything that references them:
+-- nullable references are set to NULL, required ones are purged recursively.
+CREATE FUNCTION pg_temp.purge(tbl regclass, cond text, depth int DEFAULT 0) RETURNS void AS $$
+DECLARE
+	fk record;
+	n bigint;
+BEGIN
+	IF depth > 12 THEN
+		RAISE EXCEPTION 'foreign key chain too deep at %', tbl;
+	END IF;
+	FOR fk IN
+		SELECT c.conrelid::regclass AS child, a.attname AS ccol, pa.attname AS pcol,
+		       NOT a.attnotnull AS nullable, array_length(c.conkey, 1) AS ncols
+		FROM pg_constraint c
+		JOIN pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = c.conkey[1]
+		JOIN pg_attribute pa ON pa.attrelid = c.confrelid AND pa.attnum = c.confkey[1]
+		WHERE c.contype = 'f' AND c.confrelid = tbl
+		  AND c.conrelid NOT IN (SELECT inhrelid FROM pg_inherits) -- partitions are reached through their parent
+	LOOP
+		IF fk.ncols <> 1 THEN
+			RAISE EXCEPTION 'multi-column foreign key on % is not handled', fk.child;
+		END IF;
+		IF fk.nullable THEN
+			EXECUTE format('UPDATE %s SET %I = NULL WHERE %I IN (SELECT %I FROM %s WHERE %s)',
+			               fk.child, fk.ccol, fk.ccol, fk.pcol, tbl, cond);
+			GET DIAGNOSTICS n = ROW_COUNT;
+			IF n > 0 THEN
+				RAISE NOTICE '%null %.% (%)', repeat('  ', depth), fk.child, fk.ccol, n;
+			END IF;
+		ELSE
+			PERFORM pg_temp.purge(fk.child,
+				format('%I IN (SELECT %I FROM %s WHERE %s)', fk.ccol, fk.pcol, tbl, cond), depth + 1);
+		END IF;
+	END LOOP;
+	EXECUTE format('DELETE FROM %s WHERE %s', tbl, cond);
+	GET DIAGNOSTICS n = ROW_COUNT;
+	IF n > 0 THEN
+		RAISE NOTICE '%delete % (%)', repeat('  ', depth), tbl, n;
+	END IF;
+END $$ LANGUAGE plpgsql;
+
+-- Webhook registry rows hang off a connector through a nullable key (and older rows carry a wrong org_id), so
+-- delete them with their connectors instead of leaving them orphaned.
+DELETE FROM webhook_registry
+WHERE integration_token_id IN (SELECT id FROM integration_tokens WHERE org_id IN (SELECT id FROM purge_orgs));
+
+-- Rows tagged with a purged org but not linked by a foreign key (audit events, caches, ...).
+DO $$
+DECLARE
+	t record;
+BEGIN
+	FOR t IN
+		SELECT c.oid::regclass AS tbl
+		FROM pg_class c
+		JOIN pg_namespace ns ON ns.oid = c.relnamespace AND ns.nspname = 'public'
+		JOIN pg_attribute a ON a.attrelid = c.oid AND a.attname = 'org_id' AND NOT a.attisdropped
+		WHERE c.relkind IN ('r', 'p') AND c.oid NOT IN (SELECT inhrelid FROM pg_inherits)
+		ORDER BY 1
+	LOOP
+		PERFORM pg_temp.purge(t.tbl, 'org_id IN (SELECT id FROM purge_orgs)');
+	END LOOP;
+END $$;
+DELETE FROM audit_events WHERE actor_user_id IN (SELECT id FROM purge_users);
+
+SELECT pg_temp.purge('orgs', 'id IN (SELECT id FROM purge_orgs)');
+SELECT pg_temp.purge('users', 'id IN (SELECT id FROM purge_users)');
+
+\pset footer off
+SELECT 'users left' AS check, count(*) FROM users WHERE lower(email) = ANY (string_to_array(:'emails', ','))
+UNION ALL
+SELECT 'orgs left', count(*) FROM orgs WHERE lower(name) = ANY (string_to_array(:'emails', ','));
+SQL
+	echo "$finish"
+} | psql "$db_url" -X -q -v emails="$email_list" 2>&1 | grep -vE '^ *purge *$|^-+$|^ *$|^\(1 row\)$'
+
+if [ "$dry_run" -eq 1 ]; then
+	echo "Dry run finished; rolled back."
+else
+	echo "Done."
+fi
diff --git a/storage/storage_status.md b/storage/storage_status.md
index 1ba35630..df3d0de1 100644
--- a/storage/storage_status.md
+++ b/storage/storage_status.md
@@ -185,20 +185,21 @@ Latest milestone batch note (MF-LOC-007, MF-LOC-008, MF-PRORATION-003, MF-ATTRIB
 | providersgithub.ListAppConnectorsExpiringBefore | added | [ListAppConnectorsExpiringBefore](providers/github/token_store.go#L349) |
 | providersgithub.ListAppConnectorsForOrg | added | [ListAppConnectorsForOrg](providers/github/token_store.go#L360) |
 | providersgithub.SetAppConnectorFlags | added | [SetAppConnectorFlags](providers/github/token_store.go#L388) |
-| users.FindUserByEmail | added | [FindUserByEmail](users/cloud_user_store.go#L12) |
-| users.InsertCloudUser | added | [InsertCloudUser](users/cloud_user_store.go#L19) |
-| users.FindOrgIDByName | added | [FindOrgIDByName](users/cloud_user_store.go#L29) |
-| users.InsertPersonalOrg | added | [InsertPersonalOrg](users/cloud_user_store.go#L36) |
-| users.InsertPromptApplicationContext | added | [InsertPromptApplicationContext](users/cloud_user_store.go#L49) |
-| users.SetDefaultOrgIfUnset | added | [SetDefaultOrgIfUnset](users/cloud_user_store.go#L55) |
-| users.SetOnboardingAPIKey | added | [SetOnboardingAPIKey](users/cloud_user_store.go#L64) |
-| users.OwnerRoleID | added | [OwnerRoleID](users/cloud_user_store.go#L70) |
-| users.UserRoleID | added | [UserRoleID](users/cloud_user_store.go#L77) |
-| users.InsertFreeUserRole | added | [InsertFreeUserRole](users/cloud_user_store.go#L83) |
-| users.UpdateUserRole | added | [UpdateUserRole](users/cloud_user_store.go#L91) |
-| users.DefaultOrgID | added | [DefaultOrgID](users/cloud_user_store.go#L97) |
-| users.SetOrgSignupPath | added | [SetOrgSignupPath](users/cloud_user_store.go#L104) |
-| users.OrgSignupPath | added | [OrgSignupPath](users/cloud_user_store.go#L110) |
+| users.FindUserByEmail | added | [FindUserByEmail](users/cloud_user_store.go#L13) |
+| users.InsertCloudUser | added | [InsertCloudUser](users/cloud_user_store.go#L20) |
+| users.FindOrgIDByName | added | [FindOrgIDByName](users/cloud_user_store.go#L30) |
+| users.InsertPersonalOrg | added | [InsertPersonalOrg](users/cloud_user_store.go#L37) |
+| users.InsertPromptApplicationContext | added | [InsertPromptApplicationContext](users/cloud_user_store.go#L50) |
+| users.SetDefaultOrgIfUnset | added | [SetDefaultOrgIfUnset](users/cloud_user_store.go#L56) |
+| users.SetOnboardingAPIKey | added | [SetOnboardingAPIKey](users/cloud_user_store.go#L65) |
+| users.OwnerRoleID | added | [OwnerRoleID](users/cloud_user_store.go#L71) |
+| users.UserRoleID | added | [UserRoleID](users/cloud_user_store.go#L78) |
+| users.InsertFreeUserRole | added | [InsertFreeUserRole](users/cloud_user_store.go#L84) |
+| users.UpdateUserRole | added | [UpdateUserRole](users/cloud_user_store.go#L92) |
+| users.DefaultOrgID | added | [DefaultOrgID](users/cloud_user_store.go#L98) |
+| users.SetOrgSignupPath | added | [SetOrgSignupPath](users/cloud_user_store.go#L105) |
+| users.ActiveOrgAccess | added | [ActiveOrgAccess](users/cloud_user_store.go#L113) |
+| users.OrgSignupPath | added | [OrgSignupPath](users/cloud_user_store.go#L132) |
 | users.LockOrgPlanCode | added | [LockOrgPlanCode](users/user_store.go#L35) |
 | users.CountActiveOrgMembers | added | [CountActiveOrgMembers](users/user_store.go#L48) |
 | aiconnectors.NewManagedAIStore | added | [NewManagedAIStore](aiconnectors/managed_ai_store.go#L43) |
diff --git a/storage/users/cloud_user_store.go b/storage/users/cloud_user_store.go
index 7a75deb6..d6a3f076 100644
--- a/storage/users/cloud_user_store.go
+++ b/storage/users/cloud_user_store.go
@@ -1,6 +1,7 @@
 package users
 
 import (
+	"context"
 	"database/sql"
 	"errors"
 )
@@ -106,6 +107,27 @@ func (s *UserStore) SetOrgSignupPath(orgID int64, path string) error {
 	return err
 }
 
+// ActiveOrgAccess reports whether the user is active and may open the org: as a member, or as a super admin (the
+// same rule as auth.ValidateOrgAccess). isSuperAdmin says the user has the super admin role. The GitHub App callback
+// uses it to re-check a session that started before the GitHub round trip.
+func (s *UserStore) ActiveOrgAccess(ctx context.Context, userID, orgID int64) (hasAccess, isSuperAdmin bool, err error) {
+	var member bool
+	err = s.db.QueryRowContext(ctx, `
+		SELECT
+			EXISTS (SELECT 1 FROM user_roles ur WHERE ur.user_id = u.id AND ur.org_id = $2),
+			EXISTS (SELECT 1 FROM user_roles ur JOIN roles r ON r.id = ur.role_id WHERE ur.user_id = u.id AND r.name = 'super_admin')
+		FROM users u
+		WHERE u.id = $1 AND u.is_active = TRUE AND EXISTS (SELECT 1 FROM orgs WHERE id = $2)
+	`, userID, orgID).Scan(&member, &isSuperAdmin)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, false, nil
+	}
+	if err != nil {
+		return false, false, err
+	}
+	return member || isSuperAdmin, isSuperAdmin, nil
+}
+
 // OrgSignupPath returns the org's signup path ("" when unset).
 func (s *UserStore) OrgSignupPath(orgID int64) (string, error) {
 	var p sql.NullString
diff --git a/ui/src/api/githubApp.ts b/ui/src/api/githubApp.ts
index 068335ee..c67c3c1e 100644
--- a/ui/src/api/githubApp.ts
+++ b/ui/src/api/githubApp.ts
@@ -89,11 +89,40 @@ export const getPublicUIConfig = async (): Promise<PublicUIConfig> => {
 };
 
 /**
- * Where the "Continue with GitHub" flow starts on the server; it redirects on to GitHub. `targetId` (install mode)
- * is the numeric GitHub id of the account or organization to install on, so GitHub opens straight at it.
+ * Where "Continue with GitHub" (/gh-login) starts on the server; it redirects on to GitHub and signs in as the
+ * GitHub user's email. Inside the app use startGitHubAppConnect instead, which keeps the current session.
  */
-export const githubAppStartUrl = (mode: 'install' | 'signin', src: string, targetId?: number): string =>
-  `/api/v1/auth/github-app/start?mode=${mode}&src=${encodeURIComponent(src)}${targetId ? `&target_id=${targetId}` : ''}`;
+export const githubAppSignInUrl = (src: string): string =>
+  `/api/v1/auth/github-app/start?src=${encodeURIComponent(src)}`;
+
+/**
+ * "install": GitHub's install page (on `targetId`, the numeric GitHub id of an account or organization, when set).
+ * "discover": GitHub's sign-in, which connects or offers every account your GitHub user can already see the App on.
+ */
+export type GitHubAppConnectMode = 'install' | 'discover';
+
+/** The page a GitHub round trip started inside the app comes back to. */
+export type GitHubAppReturn = 'git' | 'get-started' | `review/${number}`;
+
+/**
+ * Starts a GitHub round trip for the current org and resolves to the GitHub URL to open. The round trip connects
+ * whatever the GitHub account can access to this org and comes back to `returnTo` signed in as the same user,
+ * whatever email the GitHub account uses.
+ */
+export const startGitHubAppConnect = async (
+  mode: GitHubAppConnectMode,
+  src: string,
+  returnTo: GitHubAppReturn,
+  targetId?: number,
+): Promise<string> => {
+  const res = await apiClient.post<{ url: string }>('/api/v1/github-app/start', {
+    mode,
+    src,
+    return: returnTo,
+    ...(targetId ? { target_id: targetId } : {}),
+  });
+  return res.url;
+};
 
 export interface GitHubAppInstallCheck {
   /** False when the input is not a pull request (or repository) on the App's GitHub host. */
diff --git a/ui/src/components/Connector/GitHubAppConnector.tsx b/ui/src/components/Connector/GitHubAppConnector.tsx
index 48a31245..4c8f1cec 100644
--- a/ui/src/components/Connector/GitHubAppConnector.tsx
+++ b/ui/src/components/Connector/GitHubAppConnector.tsx
@@ -9,14 +9,15 @@ import { useGitHubAppEnabled } from '../../hooks/useGitHubAppEnabled';
 import { useGitHubAppInstall } from '../../hooks/useGitHubAppInstall';
 import { useOrgContext } from '../../hooks/useOrgContext';
 
-// The "GitHub App" provider card: install the app, and see/manage every connected GitHub account with its
-// repositories. Returning GitHub sign-ins land here (see the lr_gh_next cookie handling in index.tsx).
+// The "GitHub App" provider card: install the app (or find the accounts it is already on), and see/manage every
+// connected GitHub account with its repositories. Returning GitHub sign-ins and in-app GitHub round trips land here
+// (see the lr_gh_next cookie handling in index.tsx, and GitHubAppConnectStart on the server).
 const GitHubAppConnector: React.FC = () => {
     const navigate = useNavigate();
     const enabled = useGitHubAppEnabled();
     const { isSuperAdmin, currentOrg } = useOrgContext();
     const canDisconnect = isSuperAdmin || currentOrg?.role === 'owner';
-    const { startInstall, busy } = useGitHubAppInstall('#/git/github-app', 'git-providers');
+    const { startInstall, startDiscover, installing, discovering } = useGitHubAppInstall('git', 'git-providers');
 
     const { data: demo, isLoading, error, refetch } = useQuery({
         queryKey: ['github-app', 'demo', 'git-providers'],
@@ -63,7 +64,9 @@ const GitHubAppConnector: React.FC = () => {
                         repos={demo?.repositories || []}
                         canDisconnect={canDisconnect}
                         onInstallAnother={startInstall}
-                        installBusy={busy}
+                        installBusy={installing}
+                        onFindAccounts={startDiscover}
+                        findBusy={discovering}
                         onChanged={async () => {
                             await refetch();
                         }}
@@ -79,9 +82,20 @@ const GitHubAppConnector: React.FC = () => {
                     )}
                 </>
             ) : (
-                <Button icon={<Icons.GitHub />} onClick={startInstall} isLoading={busy}>
-                    Install the GitHub App
-                </Button>
+                <div className="space-y-2">
+                    <div className="flex flex-wrap gap-2">
+                        <Button icon={<Icons.GitHub />} onClick={startInstall} isLoading={installing} disabled={discovering}>
+                            Install the GitHub App
+                        </Button>
+                        <Button variant="outline" onClick={startDiscover} isLoading={discovering} disabled={installing}>
+                            Find my GitHub accounts
+                        </Button>
+                    </div>
+                    <p className="text-sm text-slate-400">
+                        Already installed on GitHub (by you or a teammate)? Find my GitHub accounts signs in to GitHub and
+                        lists every account you can access, whatever email your GitHub account uses.
+                    </p>
+                </div>
             )}
         </div>
     );
diff --git a/ui/src/components/GitHubApp/GitHubAppAccounts.tsx b/ui/src/components/GitHubApp/GitHubAppAccounts.tsx
index abe28f1e..56ea7382 100644
--- a/ui/src/components/GitHubApp/GitHubAppAccounts.tsx
+++ b/ui/src/components/GitHubApp/GitHubAppAccounts.tsx
@@ -17,10 +17,13 @@ interface GitHubAppAccountsProps {
     // Accounts this LiveReview account can connect but hasn't: shown minimized, with a Connect button.
     available?: GitHubAppAvailableInstallation[];
     repos: GitHubAppRepository[];
-    // Only organization owners can connect, disconnect or uninstall; the server enforces it too.
+    // Only organization owners can disconnect or uninstall; the server enforces it too. Any member can connect.
     canDisconnect: boolean;
     onInstallAnother: () => void;
     installBusy?: boolean;
+    // "Find my GitHub accounts": signs in to GitHub to connect (or offer) the accounts the App is already on there.
+    onFindAccounts: () => void;
+    findBusy?: boolean;
     // Called after an account was connected, disconnected or uninstalled; the parent refreshes its data.
     onChanged: () => void | Promise<void>;
 }
@@ -39,7 +42,7 @@ const accountsLabel = (n: number) => `${n} other LiveReview ${n === 1 ? 'account
 // The org's connected GitHub accounts: each one is a heading with its repositories indented below it, a
 // "Manage on GitHub" button and (for owners) "Disconnect" and "Uninstall"; then the accounts it can connect but
 // hasn't (installed by someone in another LiveReview account, or disconnected here), one line each with "Connect";
-// plus "Add repositories or organization".
+// plus "Add repositories or organization" and "Find my GitHub accounts".
 // Several LiveReview accounts can share one installation, so Disconnect only affects this account while Uninstall
 // removes the App from GitHub for all of them.
 // Shared by the Git Providers page and the get-started page.
@@ -50,6 +53,8 @@ const GitHubAppAccounts: React.FC<GitHubAppAccountsProps> = ({
     canDisconnect,
     onInstallAnother,
     installBusy = false,
+    onFindAccounts,
+    findBusy = false,
     onChanged,
 }) => {
     const [pending, setPending] = useState<PendingAction | null>(null);
@@ -172,7 +177,6 @@ const GitHubAppAccounts: React.FC<GitHubAppAccountsProps> = ({
                         <AvailableAccountRow
                             key={inst.connector_id}
                             inst={inst}
-                            canConnect={canDisconnect}
                             connecting={connecting === inst.connector_id}
                             disabled={connecting !== null}
                             onConnect={() => void connect(inst)}
@@ -181,16 +185,28 @@ const GitHubAppAccounts: React.FC<GitHubAppAccountsProps> = ({
                     ))}
                 </ul>
             )}
-            <Button
-                className="mt-4"
-                size="sm"
-                variant="outline"
-                icon={<Icons.Add />}
-                onClick={onInstallAnother}
-                isLoading={installBusy}
-            >
-                Add repositories or organization
-            </Button>
+            <div className="mt-4 flex flex-wrap gap-2">
+                <Button
+                    size="sm"
+                    variant="outline"
+                    icon={<Icons.Add />}
+                    onClick={onInstallAnother}
+                    isLoading={installBusy}
+                    disabled={findBusy}
+                >
+                    Add repositories or organization
+                </Button>
+                <Button
+                    size="sm"
+                    variant="ghost"
+                    icon={<Icons.GitHub />}
+                    onClick={onFindAccounts}
+                    isLoading={findBusy}
+                    disabled={installBusy}
+                >
+                    Find my GitHub accounts
+                </Button>
+            </div>
             <ConfirmModal
                 show={pending !== null}
                 loading={busy}
@@ -213,12 +229,11 @@ const GitHubAppAccounts: React.FC<GitHubAppAccountsProps> = ({
 // One minimized line for an account this LiveReview account can connect: no repositories until it's connected.
 const AvailableAccountRow: React.FC<{
     inst: GitHubAppAvailableInstallation;
-    canConnect: boolean;
     connecting: boolean;
     disabled: boolean;
     onConnect: () => void;
     onShowOthers: () => void;
-}> = ({ inst, canConnect, connecting, disabled, onConnect, onShowOthers }) => (
+}> = ({ inst, connecting, disabled, onConnect, onShowOthers }) => (
     <li className="flex flex-wrap items-center justify-between gap-3 border border-slate-700 rounded-lg bg-slate-800 px-4 py-2.5">
         <div className="flex items-center min-w-0">
             <Avatar size="sm" initials={inst.account_login.charAt(0).toUpperCase()} className="flex-shrink-0 mr-3" />
@@ -259,13 +274,9 @@ const AvailableAccountRow: React.FC<{
                 </p>
             </div>
         </div>
-        {canConnect ? (
-            <Button size="sm" onClick={onConnect} isLoading={connecting} disabled={disabled && !connecting}>
-                Connect
-            </Button>
-        ) : (
-            <span className="text-xs text-slate-400">An organization owner can connect it</span>
-        )}
+        <Button size="sm" onClick={onConnect} isLoading={connecting} disabled={disabled && !connecting}>
+            Connect
+        </Button>
     </li>
 );
 
diff --git a/ui/src/components/GitHubApp/GitHubAppNotInstalledModal.tsx b/ui/src/components/GitHubApp/GitHubAppNotInstalledModal.tsx
index ac8c0796..ef2fd20e 100644
--- a/ui/src/components/GitHubApp/GitHubAppNotInstalledModal.tsx
+++ b/ui/src/components/GitHubApp/GitHubAppNotInstalledModal.tsx
@@ -12,9 +12,9 @@ interface GitHubAppNotInstalledModalProps {
     owner: string;
     repository: string;
     // Opens GitHub's install page for `owner` in a new tab (this page stays put). Returns false when the browser
-    // blocked the tab; `installUrl` is then offered as a plain link.
+    // blocked the tab; `installUrl` is then offered as a plain link once the parent has it.
     onInstall: () => boolean;
-    installUrl: string;
+    installUrl?: string;
     // After installing: resolves true when LiveReview can now see the installation (the parent then starts the
     // review), false when it can't yet.
     onInstalled: () => Promise<boolean>;
@@ -25,8 +25,7 @@ interface GitHubAppNotInstalledModalProps {
 }
 
 // Shown before a review starts from a pasted GitHub pull request URL when the LiveReview GitHub App can't post to
-// that repository. Styled like ConfirmModal. Installing happens in another tab (the GitHub round trip ends in a
-// sign-in there), so once it is opened a collapsible "Finished installing?" section appears with the highlighted
+// that repository. Styled like ConfirmModal. Installing happens in another tab, so once it is opened a collapsible "Finished installing?" section appears with the highlighted
 // button that continues the review here.
 const GitHubAppNotInstalledModal: React.FC<GitHubAppNotInstalledModalProps> = ({
     owner,
@@ -127,10 +126,16 @@ const GitHubAppNotInstalledModal: React.FC<GitHubAppNotInstalledModalProps> = ({
                                             {popupBlocked ? (
                                                 <p className="text-xs text-yellow-300">
                                                     Your browser blocked the new tab.{' '}
-                                                    <a className="underline" href={installUrl} target="_blank" rel="noopener noreferrer">
-                                                        Open the GitHub install page
-                                                    </a>
-                                                    , finish installing, then come back to this tab.
+                                                    {installUrl ? (
+                                                        <>
+                                                            <a className="underline" href={installUrl} target="_blank" rel="noopener noreferrer">
+                                                                Open the GitHub install page
+                                                            </a>
+                                                            , finish installing, then come back to this tab.
+                                                        </>
+                                                    ) : (
+                                                        'Preparing a link to the GitHub install page…'
+                                                    )}
                                                 </p>
                                             ) : opening ? (
                                                 <p className="text-xs text-blue-300">Opening GitHub in a new tab…</p>
diff --git a/ui/src/components/reviews/diffviewer/DiffViewerPanel.tsx b/ui/src/components/reviews/diffviewer/DiffViewerPanel.tsx
index b3098f85..41ed7f68 100644
--- a/ui/src/components/reviews/diffviewer/DiffViewerPanel.tsx
+++ b/ui/src/components/reviews/diffviewer/DiffViewerPanel.tsx
@@ -15,8 +15,9 @@ import classNames from 'classnames';
 import { useSearchParams } from 'react-router-dom';
 import { Alert, Button, EmptyState, Icons, Spinner } from '../../UIPrimitives';
 import { getDiffReview } from '../../../api/reviews';
-import { getGitHubAppInstallCheck, githubAppStartUrl } from '../../../api/githubApp';
+import { getGitHubAppInstallCheck, startGitHubAppConnect } from '../../../api/githubApp';
 import { showRedirectOverlay } from '../../../utils/redirectOverlay';
+import { notify } from '../../../utils/notify';
 import { BlastRadiusReport, DiffReviewFile, DiffReviewStatusResponse } from '../../../types/reviews';
 import type { RiskScore } from '../RiskAssessment';
 import { attachBlastData, buildBlastLookup, flattenFilesByRisk, hasBlastRadiusData, sortFilesByBlastRadius } from '../../../lib/blastRadius';
@@ -124,8 +125,8 @@ const DiffViewerPanel: React.FC<DiffViewerPanelProps> = ({ reviewId, blastReport
   const [searchParams, setSearchParams] = useSearchParams();
   const [installing, setInstalling] = useState(false);
 
-  // "Install now": leave for GitHub and come back to this review through the normal login (the same hand-off the
-  // get-started page uses). The session is kept until the sign-in actually returns.
+  // "Install now": leave for GitHub and come back to this review, still signed in as the same user (the round trip
+  // is bound to this session and org on the server).
   const installNow = async () => {
     setInstalling(true);
     // Open GitHub's install page already on the repository's owner; without the id it lists the accounts instead.
@@ -138,13 +139,16 @@ const DiffViewerPanel: React.FC<DiffViewerPanelProps> = ({ reviewId, blastReport
         console.error('GitHub App install check failed:', err);
       }
     }
-    showRedirectOverlay('Taking you to GitHub…');
+    let target: string;
     try {
-      sessionStorage.setItem('redirectAfterLogin', window.location.hash || `#/reviews/${reviewId}`);
-    } catch {
-      // Falls back to the dashboard after login.
+      target = await startGitHubAppConnect('install', 'review', `review/${reviewId}`, targetId);
+    } catch (err: any) {
+      setInstalling(false);
+      notify.error(err?.message || 'Could not start connecting to GitHub. Please try again.');
+      return;
     }
-    window.location.assign(githubAppStartUrl('install', 'review', targetId));
+    showRedirectOverlay('Taking you to GitHub…');
+    window.location.assign(target);
   };
 
   useEffect(() => {
diff --git a/ui/src/hooks/useGitHubAppInstall.ts b/ui/src/hooks/useGitHubAppInstall.ts
index b0d7cdd8..b3d80b69 100644
--- a/ui/src/hooks/useGitHubAppInstall.ts
+++ b/ui/src/hooks/useGitHubAppInstall.ts
@@ -1,40 +1,54 @@
 import { useEffect, useState } from 'react';
-import { githubAppStartUrl } from '../api/githubApp';
+import { GitHubAppReturn, startGitHubAppConnect, GitHubAppConnectMode } from '../api/githubApp';
 import { showRedirectOverlay } from '../utils/redirectOverlay';
+import { notify } from '../utils/notify';
 
-// Sends the user to GitHub's install page for the LiveReview GitHub App ("Add repositories or organization",
-// first install, etc.). The user stays signed in while away; the callback ends in the normal Cloud login
-// (utils/dropSessionOnLoginReturn lets it replace the session) and that returns the user to `returnHash`
-// (for example '#/git/github-app').
-export const useGitHubAppInstall = (returnHash: string, src: string) => {
-    const [busy, setBusy] = useState(false);
+// Sends the user to GitHub for the LiveReview GitHub App: the install page ("Add repositories or organization",
+// first install, etc.) or GitHub's sign-in ("Find my GitHub accounts"). The round trip is bound to the current
+// session and org on the server, so whatever email the GitHub account uses, the user comes back to `returnTo` still
+// signed in as themselves, with the accounts connected to this org.
+export const useGitHubAppInstall = (returnTo: GitHubAppReturn, src: string) => {
+    // Which round trip is starting (for the spinner on the button that was clicked); null when idle.
+    const [pending, setPending] = useState<GitHubAppConnectMode | null>(null);
 
     // Coming back with the browser's Back button can restore this page as it was (spinner and all): reset it.
     useEffect(() => {
         const onPageShow = (e: PageTransitionEvent) => {
-            if (e.persisted) setBusy(false);
+            if (e.persisted) setPending(null);
         };
         window.addEventListener('pageshow', onPageShow);
         return () => window.removeEventListener('pageshow', onPageShow);
     }, []);
 
-    // `targetId` opens GitHub's install page already on that account or organization.
-    const run = (targetId?: number) => {
-        setBusy(true);
-        // Covers the page while the browser starts navigating, so nothing flashes.
-        showRedirectOverlay('Taking you to GitHub…');
+    const run = async (mode: GitHubAppConnectMode) => {
+        setPending(mode);
+        let url: string;
         try {
-            sessionStorage.setItem('redirectAfterLogin', returnHash);
-        } catch {
-            // Falls back to the dashboard after login.
+            url = await startGitHubAppConnect(mode, src, returnTo);
+        } catch (err: any) {
+            setPending(null);
+            notify.error(err?.message || 'Could not start connecting to GitHub. Please try again.');
+            return;
         }
+        // Covers the page while the browser starts navigating, so nothing flashes.
+        showRedirectOverlay('Taking you to GitHub…');
         // assign, not replace: Back from GitHub returns to this page.
-        window.location.assign(githubAppStartUrl('install', src, targetId));
+        window.location.assign(url);
     };
 
-    // Separate from startInstallOn so it can be used directly as an onClick handler (which passes an event).
-    const startInstall = () => run();
-    const startInstallOn = (targetId?: number) => run(targetId);
+    // Wrapped so they can be used directly as onClick handlers (which pass an event).
+    const startInstall = (): void => {
+        void run('install');
+    };
+    const startDiscover = (): void => {
+        void run('discover');
+    };
 
-    return { startInstall, startInstallOn, busy };
+    return {
+        startInstall,
+        startDiscover,
+        busy: pending !== null,
+        installing: pending === 'install',
+        discovering: pending === 'discover',
+    };
 };
diff --git a/ui/src/pages/Auth/GhLogin.tsx b/ui/src/pages/Auth/GhLogin.tsx
index 1f2bc343..1dc962f4 100644
--- a/ui/src/pages/Auth/GhLogin.tsx
+++ b/ui/src/pages/Auth/GhLogin.tsx
@@ -4,7 +4,7 @@ import { FcGoogle } from 'react-icons/fc';
 import { FaCheck, FaEnvelope, FaLinkedinIn } from 'react-icons/fa6';
 import { Icons } from '../../components/UIPrimitives';
 import { FullScreenLoader } from '../../components/FullScreenLoader';
-import { getPublicUIConfig, githubAppStartUrl } from '../../api/githubApp';
+import { getPublicUIConfig, githubAppSignInUrl } from '../../api/githubApp';
 import { isCloudMode } from '../../utils/deploymentMode';
 import { hexmosSigninUrl } from '../../utils/hexmosSignin';
 
@@ -67,7 +67,7 @@ const GhLogin: React.FC = () => {
     // Nothing is stored before leaving: the callback says where to land (get-started) only when sign-in succeeds,
     // so a failed attempt followed by another sign-in method doesn't end up on get-started.
     const start = () => {
-        window.location.href = githubAppStartUrl('signin', src);
+        window.location.href = githubAppSignInUrl(src);
     };
 
     if (enabled === null || enabled === false) {
diff --git a/ui/src/pages/GetStarted/GetStartedGitHub.tsx b/ui/src/pages/GetStarted/GetStartedGitHub.tsx
index 02aa1afc..66a321ae 100644
--- a/ui/src/pages/GetStarted/GetStartedGitHub.tsx
+++ b/ui/src/pages/GetStarted/GetStartedGitHub.tsx
@@ -18,7 +18,8 @@ const AUTO_CONNECT_KEY = 'lrGhAutoConnectTried';
 const GetStartedGitHub: React.FC = () => {
     const navigate = useNavigate();
 
-    const { startInstall: connectGitHub, busy: reconnecting } = useGitHubAppInstall('#/get-started/github', 'get-started');
+    const { startInstall: connectGitHub, startDiscover, busy: reconnecting, installing, discovering } =
+        useGitHubAppInstall('get-started', 'get-started');
     const { isSuperAdmin, currentOrg } = useOrgContext();
     const canDisconnect = isSuperAdmin || currentOrg?.role === 'owner';
 
@@ -117,9 +118,14 @@ const GetStartedGitHub: React.FC = () => {
                                     Add repositories on GitHub
                                 </Button>
                             ) : (
-                                <Button icon={<Icons.GitHub />} onClick={connectGitHub} isLoading={reconnecting}>
-                                    Continue with GitHub
-                                </Button>
+                                <div className="flex flex-wrap gap-2">
+                                    <Button icon={<Icons.GitHub />} onClick={connectGitHub} isLoading={installing} disabled={discovering}>
+                                        Continue with GitHub
+                                    </Button>
+                                    <Button variant="outline" onClick={startDiscover} isLoading={discovering} disabled={installing}>
+                                        Find my GitHub accounts
+                                    </Button>
+                                </div>
                             )}
                         </div>
                     </Card>
@@ -132,9 +138,7 @@ const GetStartedGitHub: React.FC = () => {
                                 LiveReview is already installed on {available.map((a) => a.account_login).join(', ')}
                             </h2>
                             <p className="text-sm text-slate-300">
-                                {canDisconnect
-                                    ? 'Connect it to your account to see its repositories and pull requests here and review them with your own AI provider.'
-                                    : 'An owner of your LiveReview organization can connect it to see its repositories and pull requests here.'}
+                                Connect it to your account to see its repositories and pull requests here and review them with your own AI provider.
                             </p>
                             <GitHubAppAccounts
                                 installations={[]}
@@ -142,7 +146,9 @@ const GetStartedGitHub: React.FC = () => {
                                 repos={[]}
                                 canDisconnect={canDisconnect}
                                 onInstallAnother={connectGitHub}
-                                installBusy={reconnecting}
+                                installBusy={installing}
+                                onFindAccounts={startDiscover}
+                                findBusy={discovering}
                                 onChanged={async () => {
                                     await refetch();
                                 }}
@@ -165,7 +171,9 @@ const GetStartedGitHub: React.FC = () => {
                                         repos={repos}
                                         canDisconnect={canDisconnect}
                                         onInstallAnother={connectGitHub}
-                                        installBusy={reconnecting}
+                                        installBusy={installing}
+                                        onFindAccounts={startDiscover}
+                                        findBusy={discovering}
                                         onChanged={afterChange}
                                     />
                                 </div>
diff --git a/ui/src/pages/Reviews/NewReview.tsx b/ui/src/pages/Reviews/NewReview.tsx
index 119a1a88..8c82782d 100644
--- a/ui/src/pages/Reviews/NewReview.tsx
+++ b/ui/src/pages/Reviews/NewReview.tsx
@@ -22,7 +22,8 @@ import { useQuotaStatusQuery, useBillingStatusQuery } from '../../api/billing';
 import { QuotaExhaustedBanner } from '../../components/Dashboard/QuotaExhaustedBanner';
 import { QuotaWarningBanner } from '../../components/Dashboard/QuotaWarningBanner';
 import GitHubAppNotInstalledModal from '../../components/GitHubApp/GitHubAppNotInstalledModal';
-import { getGitHubAppInstallCheck, githubAppStartUrl } from '../../api/githubApp';
+import { getGitHubAppInstallCheck, startGitHubAppConnect } from '../../api/githubApp';
+import { notify } from '../../utils/notify';
 import { useGitHubAppEnabled } from '../../hooks/useGitHubAppEnabled';
 
 type QuotaStatusResponse = {
@@ -106,6 +107,8 @@ const NewReview: React.FC = () => {
   // A pasted GitHub PR URL whose repository the LiveReview GitHub App can't post to: ask before starting the review.
   const githubAppEnabled = useGitHubAppEnabled();
   const [notInstalled, setNotInstalled] = useState<{ owner: string; repository: string; targetId?: number } | null>(null);
+  // The GitHub install URL of the last "Install GitHub App" click, offered as a link if the browser blocked the tab.
+  const [installUrl, setInstallUrl] = useState<string | undefined>(undefined);
 
   // Load connectors when component mounts
   useEffect(() => {
@@ -563,24 +566,24 @@ const NewReview: React.FC = () => {
             owner={notInstalled.owner}
             repository={notInstalled.repository}
             continueBusy={loading}
-            installUrl={githubAppStartUrl('install', 'new-review', notInstalled.targetId)}
+            installUrl={installUrl}
             onInstall={() => {
-              // The GitHub round trip ends in a sign-in, so it runs in its own tab and this page keeps the review
-              // being set up. A tab opened this way starts with a copy of sessionStorage: it lands on the connected
-              // GitHub accounts after signing in (this tab's own value is removed right away).
-              try {
-                sessionStorage.setItem('redirectAfterLogin', '#/git/github-app');
-              } catch {
-                // The new tab then lands on the dashboard.
-              }
-              const tab = window.open(githubAppStartUrl('install', 'new-review', notInstalled.targetId), '_blank');
-              try {
-                sessionStorage.removeItem('redirectAfterLogin');
-              } catch {
-                // ignore
-              }
+              // The GitHub round trip runs in its own tab, so this page keeps the review being set up; it ends on the
+              // connected GitHub accounts, still signed in as this user. The tab is opened right away (browsers only
+              // allow that shortly after a click) and sent to GitHub once the server has started the round trip.
+              const tab = window.open('', '_blank');
               // A tab opened this way can reach back to this page through window.opener; cut that link.
               if (tab) tab.opener = null;
+              setInstallUrl(undefined);
+              startGitHubAppConnect('install', 'new-review', 'git', notInstalled.targetId)
+                .then((target) => {
+                  setInstallUrl(target);
+                  if (tab) tab.location.href = target;
+                })
+                .catch((err: any) => {
+                  tab?.close();
+                  notify.error(err?.message || 'Could not start connecting to GitHub. Please try again.');
+                });
               return tab !== null;
             }}
             onInstalled={async () => {

From 57bf261441159ab40ea6fba5d806c94173d5f7ee Mon Sep 17 00:00:00 2001
From: lovestaco <athreyac4@gmail.com>
Date: Wed, 28 Oct 2026 22:57:25 +0530
Subject: [PATCH 9/9] fix(security): bump vulnerable dependencies found by the
 security scans

- go-jose/v4 4.1.4 -> 4.1.6 (GHSA-mgcc-cww5-fp2q) and golang.org/x/net 0.61.0 -> 0.62.0
  (GO-2026-6860, GO-2026-6866); govulncheck now reports nothing.
- npm qs override 6.16.0 -> 6.16.1 (GHSA-6pq8-jhm2-2vcw).
- certifi -> 2026.10.18+ in tests/mcp/requirements.txt and scripts/uv.lock; Pillow 13.0.0 in
  scripts/uv.lock (needs Streamlit 1.66.1, which allows Pillow 13) for the open Dependabot alerts.
- Ignore GHSA-gcqx-w48m-w2h4 (deepmerge, no patched release, dev tooling only) in
  config/osv-scanner.toml until 2027-01-28.
- scripts/purge_users.sh: stop changing IFS (semgrep ifs-tampering).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 config/osv-scanner.toml    |   5 +
 go.mod                     |   4 +-
 go.sum                     |   4 +
 scripts/purge_users.sh     |   6 +-
 scripts/uv.lock            | 205 ++++++++++++++-----------------------
 tests/mcp/requirements.txt |   2 +-
 ui/package-lock.json       |   6 +-
 ui/package.json            |   2 +-
 8 files changed, 94 insertions(+), 140 deletions(-)

diff --git a/config/osv-scanner.toml b/config/osv-scanner.toml
index 1680e928..42184f51 100644
--- a/config/osv-scanner.toml
+++ b/config/osv-scanner.toml
@@ -2,3 +2,8 @@
 [[ignoredVulns]]
 id = "GO-2026-5932"
 reason = "False positive — golang.org/x/crypto/openpgp sub-package is never imported by this project; only golang.org/x/crypto/bcrypt is used."
+
+[[ignoredVulns]]
+id = "GHSA-gcqx-w48m-w2h4"
+ignoreUntil = 2027-01-28
+reason = "No patched release exists. deepmerge 4.3.1 is only pulled in by dev tooling (jest, fork-ts-checker-webpack-plugin); `npm ls deepmerge --omit=dev` is empty, so it never ships and never merges untrusted input. Re-check when a fixed version is published."
diff --git a/go.mod b/go.mod
index b4f854cd..cbc6c77c 100644
--- a/go.mod
+++ b/go.mod
@@ -140,7 +140,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
 	github.com/gitleaks/go-gitdiff v0.9.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.22.5 // indirect
@@ -257,7 +257,7 @@ require (
 	golang.org/x/arch v0.25.0 // indirect
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
 	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
diff --git a/go.sum b/go.sum
index c8b57d9c..3f04f308 100644
--- a/go.sum
+++ b/go.sum
@@ -233,6 +233,8 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -713,6 +715,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
 golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
diff --git a/scripts/purge_users.sh b/scripts/purge_users.sh
index 6d2dd062..93a0da11 100755
--- a/scripts/purge_users.sh
+++ b/scripts/purge_users.sh
@@ -73,10 +73,8 @@ localhost | 127.0.0.1 | "[::1]" | ::1) ;;
 	;;
 esac
 
-email_list="$(
-	IFS=,
-	echo "${emails[*]}"
-)"
+email_list="$(printf '%s,' "${emails[@]}")"
+email_list="${email_list%,}"
 
 echo "Database: $db_host ($(echo "$db_url" | sed -E 's#.*/([^/?]+)(\?.*)?$#\1#'))"
 psql "$db_url" -X -q -v ON_ERROR_STOP=1 -v emails="$email_list" <<'SQL'
diff --git a/scripts/uv.lock b/scripts/uv.lock
index aa6c7e67..b741692e 100644
--- a/scripts/uv.lock
+++ b/scripts/uv.lock
@@ -65,11 +65,11 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2026.7.22"
+version = "2026.10.23"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fd/11/b524cbd9bbdaca58608e4cf4053fd463417549e1959fa8d3aa18319f9555/certifi-2026.10.23.tar.gz", hash = "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd", size = 136225, upload-time = "2026-10-23T11:36:16.478Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
+    { url = "https://files.pythonhosted.org/packages/32/d1/a3652fe2c19134d0d15922177821d863cbd7e842d53a21bbe7e8e3a1b5ac/certifi-2026.10.23-py3-none-any.whl", hash = "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1", size = 135082, upload-time = "2026-10-23T11:36:14.763Z" },
 ]
 
 [[package]]
@@ -247,42 +247,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515, upload-time = "2025-04-24T03:35:24.344Z" },
 ]
 
-[[package]]
-name = "httptools"
-version = "0.8.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/43/e5/d471fcb0e14523fe1c3f4ba58ca52480e7bd70ad7109a3846bc75892f7fb/httptools-0.8.0.tar.gz", hash = "sha256:6b2a32f18d97e16e90827d7a819ffa8dbd8cc245fc4e1fa9d1095b54ef4bd999", size = 271342, upload-time = "2026-05-25T22:17:48.841Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/14/88/1d21a36da8f5cb0fa49eafd4b169eba5608d57e75bbcf61845cbc6243216/httptools-0.8.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:880490234c10f70a9830743097e8958d6e4b9f5a0ffc24515023afeef984054d", size = 208247, upload-time = "2026-05-25T22:17:07.843Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/42/cc4feea2945cb3051038f090c9b36bd5b8a9d7f5a894a506a8983e33fd1c/httptools-0.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:5931891fb7b441b8a3853cf1b85c82c903defce084dd5f6771ca46e31bf862c5", size = 113064, upload-time = "2026-05-25T22:17:09.136Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/a6/febbb8b8db0f58b38e44ad6cb946e6a255ae49b55f2e8543408fb7501ccd/httptools-0.8.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b15fc622b0f869d19207c4089a501d9bcc63ca5e071ffdd2f03f922df882dcb2", size = 523851, upload-time = "2026-05-25T22:17:10.106Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/e4/f90a0df0b83beff265b7e3b65f2a4cefd95792d4be0ac3e16049f2acd3c2/httptools-0.8.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:425f83884fd6343828d8c565f046cb72b6d19063f6924093e11bcd8e1548cd09", size = 518842, upload-time = "2026-05-25T22:17:11.218Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/2d/0c9ac76dd2c893841fbf6498d6acec4f2442e1b7067f6e3e316a80e494e8/httptools-0.8.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ef7c3c97f4311c7be57e2986629df89d49cb434dbff78eafcd48c2bff986b15a", size = 501238, upload-time = "2026-05-25T22:17:12.728Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/42/906adc91ae3a5fa9c59c0a2f21c139725bd7e5b41ae6acd485cd14123ebf/httptools-0.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:a1afd7c9fbff0d9f5d489c4ce2768bd09c84a46ddefc7161e6aa82ae35c85745", size = 509567, upload-time = "2026-05-25T22:17:13.842Z" },
-    { url = "https://files.pythonhosted.org/packages/05/0b/4240efeb672751ee5b9b380cb0e3fdc050bc05f68adc7a8aefc4fcd9a69a/httptools-0.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:cd96f29b4bab1d42fa6e3d008711c75e0f79e94e06827330160e3a304227f150", size = 90918, upload-time = "2026-05-25T22:17:15.155Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/e5/8cfcabc5546e8022f168be28bcdaa128a240a0befdd03b59d558b4f18bd6/httptools-0.8.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:614ceea8ea606848bece2338ac03b3ce5324bcb4be8dc7d377ed708012fa4db8", size = 205148, upload-time = "2026-05-25T22:17:16.333Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/0e/0fb14848c19a686c8062ff9067c1a48793e3224b47bc5b201535b6036fce/httptools-0.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2d689918c15a013c65ef52d9fd495d766893ab831a2c8d89f2ac5940a5df847c", size = 111368, upload-time = "2026-05-25T22:17:17.586Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/1b/46f1cecf06b9bbde8e4b8c88034ac7908989e5ff7a3a388ef38392949c1f/httptools-0.8.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:eb3028cca2fc0a6d720e52ef61d8ebb62fcbfeb1de56874546d858d3f25a26b7", size = 486447, upload-time = "2026-05-25T22:17:18.564Z" },
-    { url = "https://files.pythonhosted.org/packages/77/00/258bfc0837221f81d9725c45f9b948a6a6b2994a147a4fb66e85100c668f/httptools-0.8.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:88bdd940f2b5d487b4d032c6afa5489a7dc4694410d43de3c38c4fb3af0dc45d", size = 482448, upload-time = "2026-05-25T22:17:19.912Z" },
-    { url = "https://files.pythonhosted.org/packages/04/ab/d1cef3b5523f4d272a70f42a776c3169a2dddfe3a54de4b2ce4a36341528/httptools-0.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:6a43c9dd399758ccc0531acb0a3c4a6c299ee893ee9400e9c893b7bdcfae0681", size = 464460, upload-time = "2026-05-25T22:17:20.882Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/48/5d1d072442277bb2b3434e0e60690b8e8c23840ef7de8b6ea54040a536d3/httptools-0.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0770728beb05094c809b98e814edff5fef69d26ad7d21185f2f6d5884a0ba683", size = 471312, upload-time = "2026-05-25T22:17:22.085Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/66/b96623b27e51a68199ef4efdda0613cced9233fe3062ac74e50749c5ad37/httptools-0.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:7685df791fad561384bfb139e77fde27a1ffd93134e016f95a0db424ffbf77b1", size = 90117, upload-time = "2026-05-25T22:17:23.074Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/12/fa3fbf5f9517b273edea2dc982aa82a8c634091e67c590792b729017bc6f/httptools-0.8.0-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:de242a49b5d18e0a8776e654e9f6bf6d89f3875a5c35b425a0e7ce940feb3fd6", size = 206183, upload-time = "2026-05-25T22:17:24.004Z" },
-    { url = "https://files.pythonhosted.org/packages/30/fc/5e7c4cb443370f2090a3aba0453a07384d29ff66b7435bb90e77e1037599/httptools-0.8.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:159e9ab5f701ccd42e555a12f1ad8ff69702910fc1c996cf2bb66e5fcb7a231b", size = 112079, upload-time = "2026-05-25T22:17:25.216Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/53/771bd891eb0f236f32145d6a1775777ec85745f3cc983a1f23d1a3b8ddfe/httptools-0.8.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:c4a9f1707e4823d54dfec6c33fa3697d302aed536ed352a7ebb5a061ddb869d0", size = 481596, upload-time = "2026-05-25T22:17:26.186Z" },
-    { url = "https://files.pythonhosted.org/packages/62/42/94e15bc68ce3d423243c45d7f1b0c7561f13844f97dc52ae23182fb65628/httptools-0.8.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d76ad7b951387e3632c8716a9bb03ac5b45c5f16119aa409db0459520887944e", size = 480865, upload-time = "2026-05-25T22:17:27.542Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/7c/fe2980fc03723272e30f135b62360b075f513dfe7cc73aef36c7f04012bd/httptools-0.8.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:a3b7387147361c3fd47a0bde763c5c91b5b4cd4dc9989b8ece84ff436c99843b", size = 463189, upload-time = "2026-05-25T22:17:28.546Z" },
-    { url = "https://files.pythonhosted.org/packages/15/1b/47fc5fff68acd1bfa20b4734059c9a06cadb88119dcd5258b5b0d21d91c8/httptools-0.8.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f256d6ce930c52ca1cb2a960b7da03548c454e7d28b06059ad41bfe789036ce0", size = 466610, upload-time = "2026-05-25T22:17:29.816Z" },
-    { url = "https://files.pythonhosted.org/packages/60/bd/07b13c93ffd9bec9546e0d43f8e19378dd696dbd278511406bc07371ef1f/httptools-0.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:19d1ee275bb59ba2643ba9a3a1e51cc0c788caf2b8df506368e03f56fdd08527", size = 92705, upload-time = "2026-05-25T22:17:31.133Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/c4/121648f68ce066d7bd762d6b6d97e620847642d38d54f3d90ff11d947629/httptools-0.8.0-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:de1ed58a974e75d56560acc7e7fed01a454994429456f65209789992e41f2568", size = 215023, upload-time = "2026-05-25T22:17:32.401Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/b0/312a062ae741ae3e8baa8c8bf20be81b2e67337b259ab4349bebc7b6142e/httptools-0.8.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:e93c227b595c6926c1acee96891dd9da4be338cfbe82e5cd3bb9d8dd7dc4ac0b", size = 117405, upload-time = "2026-05-25T22:17:33.742Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/37/fccd705f795386bb05bf413012fecff2a33e5aa8c2f069096de3e9fd8702/httptools-0.8.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2a021c3a8e65cc125390d72f59b968afca3bdcaff25bd67965e0a055a14946ca", size = 558497, upload-time = "2026-05-25T22:17:34.732Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/39/f172e8003576de35f5ba77ff417cf0e34429d35dc014deef15afa337a72c/httptools-0.8.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:48774d39cbb70e2b1f71f88852a3087ae1d3a1eb80482bb48c13067ab080c14f", size = 571585, upload-time = "2026-05-25T22:17:35.813Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/b9/f5564760af99f3dbbf3f9104dc00e5da27e96cf433c6bdcf77617f70bf3f/httptools-0.8.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:88eead8ec8680a9f146c655bc88445a325bd7921cfd8194c7337e9467282427d", size = 543297, upload-time = "2026-05-25T22:17:37.08Z" },
-    { url = "https://files.pythonhosted.org/packages/99/67/8d9f2c313618e161b82f3873188e7196126da1d6e29688df40eb3997c77a/httptools-0.8.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2c032fa028f46871ec7e1fc59fc15e8023eab3e6bbe6ece786a1611719a5d081", size = 539535, upload-time = "2026-05-25T22:17:38.032Z" },
-    { url = "https://files.pythonhosted.org/packages/48/63/b906c01e53f50d432c0defe43ce52764a111dc1bdd028bafbeb54dcfd008/httptools-0.8.0-cp314-cp314t-win_amd64.whl", hash = "sha256:384c17174464c8e873398b7af24f0b1f44d992c820328413951a625323155d77", size = 108209, upload-time = "2026-05-25T22:17:39.473Z" },
-]
-
 [[package]]
 name = "idna"
 version = "3.18"
@@ -544,73 +508,78 @@ wheels = [
 
 [[package]]
 name = "pillow"
-version = "12.3.0"
+version = "13.0.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d/pillow-13.0.0.tar.gz", hash = "sha256:cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510", size = 47058631, upload-time = "2026-10-16T22:18:09.718Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/37/bf/fb3ebff8ddcb76aac5a01389251bbbb9519922a9b520d8247c1ca864a25d/pillow-12.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965", size = 5345969, upload-time = "2026-07-01T11:54:06.397Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/66/9a386a92561f402389a4fc70c18838bf6d35eb5eb5c6850b4b2dc64f5048/pillow-12.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7", size = 4780323, upload-time = "2026-07-01T11:54:09.351Z" },
-    { url = "https://files.pythonhosted.org/packages/25/27/ac8f99618ffd3dde21db0f4d4b1d2ab00c0880595bfd17df103f7f39fd0c/pillow-12.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9", size = 6266838, upload-time = "2026-07-01T11:54:11.71Z" },
-    { url = "https://files.pythonhosted.org/packages/84/21/a35af28dcc61f37ed850a2d64c65c701321dfbf25085e469d5559360cbbf/pillow-12.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91", size = 6940830, upload-time = "2026-07-01T11:54:13.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/51/8b08617af3ad95e33ce6d7dd2c99ed6c8298f7fb131636303956be022e25/pillow-12.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c", size = 6344383, upload-time = "2026-07-01T11:54:15.756Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/72/cf78ac9780bb93c28328f408973845a309d4d145041665f734572ced1b52/pillow-12.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df", size = 7052934, upload-time = "2026-07-01T11:54:17.721Z" },
-    { url = "https://files.pythonhosted.org/packages/20/20/25e0f4dc178a6bc0696793720055519a0de89e7661dae886992decbd2f81/pillow-12.3.0-cp312-cp312-win32.whl", hash = "sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f", size = 6472684, upload-time = "2026-07-01T11:54:19.839Z" },
-    { url = "https://files.pythonhosted.org/packages/45/89/da2f7971a317f83d807fdd4065c0af40208e59e692cc43d315a71a0e96d1/pillow-12.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09", size = 7227137, upload-time = "2026-07-01T11:54:22.025Z" },
-    { url = "https://files.pythonhosted.org/packages/de/47/4845a0a6c0dbf1db8456bd9fc791f13c5ced7ced20606d08a0aacfd25b49/pillow-12.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510", size = 2568267, upload-time = "2026-07-01T11:54:24.051Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/ac/31fb64e1e7efb5a4b50cd3d92049ba89ac6e4d8d3bb6a74e15048ca3353e/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89", size = 4161684, upload-time = "2026-07-01T11:54:25.934Z" },
-    { url = "https://files.pythonhosted.org/packages/87/b4/9805e23d2b4d77842b468513841fda254ee42f0289d25088340e4ff46e2d/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace", size = 4255487, upload-time = "2026-07-01T11:54:27.935Z" },
-    { url = "https://files.pythonhosted.org/packages/df/39/ecf519435a200c693fe053a6ee4d835b41cf963a4dfc2551c4e637cb2a71/pillow-12.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec", size = 3696433, upload-time = "2026-07-01T11:54:29.813Z" },
-    { url = "https://files.pythonhosted.org/packages/42/92/2fc3ffad878ae8dd5469ec1bc8eb83b71f48e13efdf68f02709003982a32/pillow-12.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66", size = 5345889, upload-time = "2026-07-01T11:54:31.97Z" },
-    { url = "https://files.pythonhosted.org/packages/10/76/8803c13605b763d33d156c4678fc77f8443389c0c51c8aef707bb02015f4/pillow-12.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35", size = 4780109, upload-time = "2026-07-01T11:54:34.026Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/01/e18aff37cb0b4aac47ac90f016d347a49aca667ef97f190b06ac2aabc928/pillow-12.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65", size = 6263736, upload-time = "2026-07-01T11:54:36.131Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/62/de5bdd77d935331f4f802edc11e4d82950f642caad6cb2f949837b8560e2/pillow-12.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3", size = 6937129, upload-time = "2026-07-01T11:54:38.216Z" },
-    { url = "https://files.pythonhosted.org/packages/70/4d/105627a13300c5e0df1d174230b32fd1273062c96f7745fd552b945d1e1d/pillow-12.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a", size = 6339562, upload-time = "2026-07-01T11:54:40.354Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/1d/f13de01a553988ab895ba1c722e06cf3144d4f57656fd5b81b6d881f1179/pillow-12.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e", size = 7049439, upload-time = "2026-07-01T11:54:42.489Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/f9/066794cca041b969964f779ee5fa66a9498bbf34248ac39c5d7954e4198f/pillow-12.3.0-cp313-cp313-win32.whl", hash = "sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f", size = 6473287, upload-time = "2026-07-01T11:54:44.9Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/9b/7a58e61d62be561da3a356fe2384d4059a6345fc130e23ef1c36a5b81d24/pillow-12.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8", size = 7239691, upload-time = "2026-07-01T11:54:47.141Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/b0/c4ed4f0ef8f8fa5ee8351537db6650bb8189f7e118842978dd6589065692/pillow-12.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b", size = 2568185, upload-time = "2026-07-01T11:54:49.137Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/01/001f65b68192f0228cc1dbbc8d2530ab5d58b61037ba0587f946fea607cd/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330", size = 4161736, upload-time = "2026-07-01T11:54:51.156Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/d2/0219746d0fd16fc8a84498e79452375be3797d3ce4044596ce565164b84f/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217", size = 4255435, upload-time = "2026-07-01T11:54:53.414Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/02/8d0bc62ef0302318c46ff2a512822d2610e81c7aa46c9b3abe6cbaca5ad0/pillow-12.3.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930", size = 3696262, upload-time = "2026-07-01T11:54:55.739Z" },
-    { url = "https://files.pythonhosted.org/packages/85/e2/73c77d218410b14f5f2d565e8a998d5317b7b9c75368d29985139f7a46f0/pillow-12.3.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8", size = 5350344, upload-time = "2026-07-01T11:54:57.657Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/da/32c752228ae345f489e3a42499d817b6c3996da7e8a3bc7a04fc806b243b/pillow-12.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0", size = 4780131, upload-time = "2026-07-01T11:54:59.713Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/9d/8b2c807dbef61a5197c047afe99823787eb66f63daf9fb2432f91d6f0462/pillow-12.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321", size = 6263757, upload-time = "2026-07-01T11:55:01.778Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/44/c85361f65dbe00eea8576ee467c768d25129989efb76e94f205e9ca9bb46/pillow-12.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b", size = 6936962, upload-time = "2026-07-01T11:55:03.93Z" },
-    { url = "https://files.pythonhosted.org/packages/18/7e/e483414b35800b86b6f08dbbc7803fb5cd52c4d6f897f47d53ea2c7e6f65/pillow-12.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198", size = 6339171, upload-time = "2026-07-01T11:55:05.989Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/f4/68c491844841ede6bed70189546b3ee9731cf9f2cbad396faff5e1ccba45/pillow-12.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130", size = 7048116, upload-time = "2026-07-01T11:55:08.131Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/34/77f3f793fed8efc7d243f21b33c5a3f0d1c97ee70346d3db855587e155ff/pillow-12.3.0-cp314-cp314-win32.whl", hash = "sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a", size = 6467209, upload-time = "2026-07-01T11:55:10.408Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/e0/492879f69d94f91f60fc8cd05ba03650e9520afebb2fb7aa12777d7c7f38/pillow-12.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d", size = 7237707, upload-time = "2026-07-01T11:55:12.745Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/ac/6b11f2875f1c2ac040d84e1bbf9cf22a88038f901ca1037898b280b38365/pillow-12.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838", size = 2565995, upload-time = "2026-07-01T11:55:14.736Z" },
-    { url = "https://files.pythonhosted.org/packages/52/69/c2208e56af9bfc1913afb24020297a691eb1d4ef688474c8a04913f65e04/pillow-12.3.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e", size = 5352503, upload-time = "2026-07-01T11:55:17.076Z" },
-    { url = "https://files.pythonhosted.org/packages/07/70/e5686d753e898a45d778ff1718dba8516ead6ab6b95d85fc8c4b70650cf2/pillow-12.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17", size = 4782956, upload-time = "2026-07-01T11:55:19.448Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/37/25c6692f06927ee973ff18c8d9ee98ad0b4d84ee67a09610c2dd1447958e/pillow-12.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385", size = 6322855, upload-time = "2026-07-01T11:55:21.613Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/91/420637fcb8f1bc11029e403b4538e6694744428d8246118e45719f944556/pillow-12.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c", size = 6989642, upload-time = "2026-07-01T11:55:24.006Z" },
-    { url = "https://files.pythonhosted.org/packages/10/08/b94d7811281ccf0d143a1cf768d1c49e1e54af63e7b708ab2ee3eb87face/pillow-12.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d", size = 6391281, upload-time = "2026-07-01T11:55:26.252Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/87/24233f785f55474dc02ce3e739c5528a77e3a862e9333d1dd7a25cc31f70/pillow-12.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931", size = 7096716, upload-time = "2026-07-01T11:55:28.318Z" },
-    { url = "https://files.pythonhosted.org/packages/23/26/fcb2f6e37175b04f53570b59937867e2b80ee1685e744023153028fc14f9/pillow-12.3.0-cp314-cp314t-win32.whl", hash = "sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7", size = 6474125, upload-time = "2026-07-01T11:55:30.956Z" },
-    { url = "https://files.pythonhosted.org/packages/90/de/3634abee5f1c9e13c56787b7d5517b0ba8d6de51700b95578cf338349c9f/pillow-12.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c", size = 7242939, upload-time = "2026-07-01T11:55:34.044Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/2a/fd13f8eb24de5714a6eb444a3d67e2842c6c576e159a43793adf23051351/pillow-12.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45", size = 2567506, upload-time = "2026-07-01T11:55:35.988Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/dc/8fdce34ec725a33c81c6ba122b904d6b9024e50ea9ac7bede62fab54506c/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139", size = 4162063, upload-time = "2026-07-01T11:55:37.941Z" },
-    { url = "https://files.pythonhosted.org/packages/76/66/2044b9a63d3b84ff048228dfcb7cd9bf0df983e8470971bf7d4c57b693de/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402", size = 4255549, upload-time = "2026-07-01T11:55:40.022Z" },
-    { url = "https://files.pythonhosted.org/packages/52/7e/1f67e6f4ece6b582ee4b539decbcc9f848dc245a93ed8cd7338bafef72f1/pillow-12.3.0-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c", size = 3696331, upload-time = "2026-07-01T11:55:41.98Z" },
-    { url = "https://files.pythonhosted.org/packages/12/40/d306fc2c8e4d45d7f175c77edca7063be7b86fe7fe6e68f4353bf71d808c/pillow-12.3.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f", size = 5350370, upload-time = "2026-07-01T11:55:44.028Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/44/668fb1437e8ce420f62d6106eb66e44a5971602a4d794615bdf79315d82d/pillow-12.3.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701", size = 4780147, upload-time = "2026-07-01T11:55:46.073Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/08/93fa2e70e30a2d81547e481b6ee2bb9522117221fb1e0ce4b5df70967677/pillow-12.3.0-cp315-cp315-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace", size = 6273659, upload-time = "2026-07-01T11:55:48.264Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/6d/043e96ff814fc31a33077e4cba86082167db520c93632afdf2042febbb0c/pillow-12.3.0-cp315-cp315-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4", size = 6947439, upload-time = "2026-07-01T11:55:50.503Z" },
-    { url = "https://files.pythonhosted.org/packages/af/92/ba71d2ee2ac0edf3fa33bd9d5ee9ee080da70b1766f3ca3934f9938ddac9/pillow-12.3.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39", size = 6353577, upload-time = "2026-07-01T11:55:52.697Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/ce/e63064e2122923ff687c8ad792d0d736a7b3920a56a46982e81a7fdd25d6/pillow-12.3.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71", size = 7060394, upload-time = "2026-07-01T11:55:55.149Z" },
-    { url = "https://files.pythonhosted.org/packages/54/76/a09cc3ccc8d773a7283d34c38bec1708f9e3cc932093cbc4c5e71ac4060b/pillow-12.3.0-cp315-cp315-win32.whl", hash = "sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827", size = 6467375, upload-time = "2026-07-01T11:55:57.769Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/03/1846c49ba3b1d5550392a4bbd06d6fb4578e1cd91a803198b5c90f5f7d53/pillow-12.3.0-cp315-cp315-win_amd64.whl", hash = "sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5", size = 7237048, upload-time = "2026-07-01T11:55:59.975Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/bb/89f35dcc79610423f9f195504d7def7f0d1416a711541b42867e25fe3412/pillow-12.3.0-cp315-cp315-win_arm64.whl", hash = "sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658", size = 2566006, upload-time = "2026-07-01T11:56:02.143Z" },
-    { url = "https://files.pythonhosted.org/packages/30/88/707027ba09942dfa2c28759b5c222d769290a41c6d20ea60ec250801941f/pillow-12.3.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf", size = 5352509, upload-time = "2026-07-01T11:56:04.2Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/6d/00352fa25332c2569cd387851f568cc5a4b75a9adbfb37ac4fbce4c02eec/pillow-12.3.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64", size = 4783167, upload-time = "2026-07-01T11:56:06.631Z" },
-    { url = "https://files.pythonhosted.org/packages/13/4f/9e049dfa21af7c22427275720e2490267ba8138120add5c4c574deb69782/pillow-12.3.0-cp315-cp315t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e", size = 6329237, upload-time = "2026-07-01T11:56:08.868Z" },
-    { url = "https://files.pythonhosted.org/packages/36/16/cf6eeaae8d0fce8dd390a33437cf68c5d5bd73834a2bc6e2f14efda0ab45/pillow-12.3.0-cp315-cp315t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777", size = 6997047, upload-time = "2026-07-01T11:56:11.379Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/69/dbf769bdd55f48bf5733cac28edc6364ffaa072ec9ba336266e4fe66be55/pillow-12.3.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1", size = 6400440, upload-time = "2026-07-01T11:56:13.908Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/e1/ffc9cfc2eea0d178da8018e18e959301ad9d6bc9f3edb7181e748a474b97/pillow-12.3.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9", size = 7105895, upload-time = "2026-07-01T11:56:16.575Z" },
-    { url = "https://files.pythonhosted.org/packages/18/f0/a5595c1e8c3ae44b9828cb2f0fa8155e5095ef04d6327b8f61cf44a3df85/pillow-12.3.0-cp315-cp315t-win32.whl", hash = "sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8", size = 6474384, upload-time = "2026-07-01T11:56:18.855Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/04/62bcd9f844984c5938d3b05264a61d797a29d3e0812341a8204af70bbdee/pillow-12.3.0-cp315-cp315t-win_amd64.whl", hash = "sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418", size = 7243537, upload-time = "2026-07-01T11:56:21.214Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/68/1f3066acedf37673694a7141381d8f811ae97f30d34413d236abe7d489f1/pillow-12.3.0-cp315-cp315t-win_arm64.whl", hash = "sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59", size = 2567491, upload-time = "2026-07-01T11:56:23.506Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/b8/58d79332229482eb0d27c82973850808c19d37e5bdc14443d3417bd373f5/pillow-13.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:67c8d44ad89fa7eb88de5d6ef6199b1e03dd24974f85a67639fc8badb801fe79", size = 5568643, upload-time = "2026-10-16T22:15:44.474Z" },
+    { url = "https://files.pythonhosted.org/packages/39/4b/f2ed53d83aa44ac19599ac0a54897f867fafb95f406980d1e24083f8cbe3/pillow-13.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc481f742ccda20e9ed760b8f978dff50f2a4e9bc253ac167fb0a05b0783ef52", size = 4852329, upload-time = "2026-10-16T22:15:46.284Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/bb/9e30e8ed18c20800ee327a12107d5249ad8dc444867b3adfcc21654e3c71/pillow-13.0.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8bf295fe459343bc6093c8e5e0df60bfa189e0fcb775a22e2c2488fdeccc6c0d", size = 6519309, upload-time = "2026-10-16T22:15:48.14Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/99/fdf65cc539e266ab93546c261bdf98411fe165c6e4e13f9dbf597097192b/pillow-13.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca", size = 7144542, upload-time = "2026-10-16T22:15:50.093Z" },
+    { url = "https://files.pythonhosted.org/packages/26/9b/f38b7c4d8f599537e2d1a6d546cec9beef7536ff8f5c49a3f9c78179d8ac/pillow-13.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4bd024d567eca931b668978d672dba914d4b8e2628e2c3073a2ad178de8a2620", size = 6618042, upload-time = "2026-10-16T22:15:52.054Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/7c/45ee28531f89ee4582967d8a17f7a26d71ca64cd902b93c269590cd60a00/pillow-13.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:23edf4ec4b6f4f240e8df6e4985e9ee2ced86474632433e55fb1e2548744bf40", size = 7228137, upload-time = "2026-10-16T22:15:54.009Z" },
+    { url = "https://files.pythonhosted.org/packages/01/bc/9c2a969cb1b70201d04fa17fd5aedf02a732870b8da86bceaaa30b0ca385/pillow-13.0.0-cp312-cp312-win32.whl", hash = "sha256:02464da86f561f410e13b061ec37c3068a9cb557a095494157742d07b3c24a27", size = 6515423, upload-time = "2026-10-16T22:15:56.25Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/cd/73a79ecdc822076002eb24b5e1e4a530b0bb5310fcb6d239abbec877110b/pillow-13.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:ff3fe9eb621fbb9db4c4be33ab946f6bac5f98ab50ca8d3260503653656c961b", size = 7272166, upload-time = "2026-10-16T22:15:58.597Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/a3/be5a1236efd085b3984e4305da8f179ae9dab80c991d2ad78f2bd5c4c843/pillow-13.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:c3bc8ee0271387e0b1e3ad0ff893645990a656e79bf9c42f4f734a3642b11d51", size = 2698943, upload-time = "2026-10-16T22:16:00.637Z" },
+    { url = "https://files.pythonhosted.org/packages/82/e2/9132d38df320e8099e2642d9fa538f18a7dfebf68a875a31725dc2a115aa/pillow-13.0.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:e98b4f91f99b24b1da72e10621ba181f7281922384a7403094debb4199de6c00", size = 4190620, upload-time = "2026-10-16T22:16:02.527Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/be/436dac0996876f65ef1916ffb711c5ef4af2ebc57414b6f16642e07f6b47/pillow-13.0.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:34fb3db1149c879343861831728c243c432d4a5afc8f1878ca7612ef8de2a033", size = 4290286, upload-time = "2026-10-16T22:16:04.861Z" },
+    { url = "https://files.pythonhosted.org/packages/60/16/7c1007162e4169ea0d5bec47e2e0b2174f56c50cf5b8c02a1dc23e41037e/pillow-13.0.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:2d50500a4a3bc6469adcdb319cf05d688b08ca3bf0f22a05339f3b25b433a599", size = 3723169, upload-time = "2026-10-16T22:16:06.956Z" },
+    { url = "https://files.pythonhosted.org/packages/08/bc/578ab2eaa04705a8978bd9be0fe15c3d43a8fc95097c4f7e39540e79e4fa/pillow-13.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ef5fe6b7db3f501c56000ba8fe7c7e1a35ca1d45824fbeb95a67daa85cff4dbe", size = 5568469, upload-time = "2026-10-16T22:16:08.664Z" },
+    { url = "https://files.pythonhosted.org/packages/98/c8/ccede3dcc4f274b80fb49199eed1ef34ba05566c8b71976b9d1f111da2e3/pillow-13.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f11a3c1358bb3c68012a7b1f41b223c3db9f7bfde90b481df028cfe1c3363313", size = 4852187, upload-time = "2026-10-16T22:16:10.693Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/3c/cd0770e96d20bfd990db024bcbd43897ff3e88da1f4782cf90ea231b1d4f/pillow-13.0.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:19b66ca0a4d25cc0200b381ce824c7ea090db61427315e73cfb05dbf1b35c369", size = 6515908, upload-time = "2026-10-16T22:16:12.896Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/fe/f5cdaa2d1c4086e757430f368c271a58ee29cfe7378e7ae7b9d964015c25/pillow-13.0.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5f56499c1a74d2b862beb0c33b8016f99d095858455df9d21583bbbc1c15b582", size = 7142544, upload-time = "2026-10-16T22:16:14.844Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/b5/a54f6d44adbcd23737c8c12953f42be107e4cca64e247c0ca3a5b563061c/pillow-13.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a2a14cd73d5e6c927f644b0110ee81f59c4ef506259ec9183904747f2caacc81", size = 6613097, upload-time = "2026-10-16T22:16:16.893Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/b4/9e6c1207c21b2e91db0d15c16d30f3701ce5add1bd4da0e787761e66cb6e/pillow-13.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:08b826a9bf1265c76de04a42061d61ea6b109418b7826f28ff1ecdfaa26c5502", size = 7224846, upload-time = "2026-10-16T22:16:19.195Z" },
+    { url = "https://files.pythonhosted.org/packages/78/9f/d3c3cb0518f3dd1eee0ef501535f53d15597a53c5c4118d178086143397a/pillow-13.0.0-cp313-cp313-win32.whl", hash = "sha256:12b0fa15879fe5a9d9eebe66e4e2d74128a773b1a4448010c9c714f45e04b9d8", size = 6516013, upload-time = "2026-10-16T22:16:21.389Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ed/1b16fb66a37e1b9e41370b93b2c614c7da761a5b2a41dc333f7af4639962/pillow-13.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:9dda0788a9932776a75d8bcc020076edc308ce2508b51f6739a45e3158b3fc42", size = 7284777, upload-time = "2026-10-16T22:16:23.393Z" },
+    { url = "https://files.pythonhosted.org/packages/87/7d/8d02eba9f7ecc87f8e90f731e032cc4773802f2a843763afd0c66a535ff4/pillow-13.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:40a266371ece581e5de13b6635ef78d7487824af80561b6ca27694a88c19bc0f", size = 2698826, upload-time = "2026-10-16T22:16:25.382Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/45/fbad9c7f5e2f1745c373a434d46072bc84eddfefaa28b852425ac957fda6/pillow-13.0.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:44629d4498c9cb6b2051806155f22141df0d8a929c56134b166655232dfb2f8c", size = 4190721, upload-time = "2026-10-16T22:16:27.524Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/bf/2074902a259a90692c5dbf132885d21671644cbbd3f690047516243a55db/pillow-13.0.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:bf97ba1b5542050e9b0c74e632323b6d8136cc99d64e193abebee22fe6013c76", size = 4290236, upload-time = "2026-10-16T22:16:29.562Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/a5/3d1bb93b8ea38d15d21356c1b8e9f50971ac592aaa248f7fb71739094c0e/pillow-13.0.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:aa694c49787040943570d61c9b8fc01271bd2a2cfdd55f0d896f8aecdce1a981", size = 3723093, upload-time = "2026-10-16T22:16:31.249Z" },
+    { url = "https://files.pythonhosted.org/packages/84/a1/be060135d85187b25fa8b2573786c0e45c62ae27527fff5257675eb97f4a/pillow-13.0.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:49c12af515073e9bf511e4ef736743bf70d531a643668722279314b937742ba4", size = 5572253, upload-time = "2026-10-16T22:16:33.103Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/f4/0bf6f1ac9ba7ee2ffe9914aeb410a1035a0c1a3c42f122388d7fc950bc4b/pillow-13.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:d9b0a2bee3f3e03e9f29057aedb807dbf1e1d96ee1b9d0f422d9db6c8583271d", size = 4852269, upload-time = "2026-10-16T22:16:35.102Z" },
+    { url = "https://files.pythonhosted.org/packages/83/16/b603274617b3e6728da3a0133d4fba1ea8d7fbe0c4ea5fef9cbffa398b8b/pillow-13.0.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5933fcea5a5ba64c686f55c886a115cbfd92f2900460784a1e79909fdbafd7b6", size = 6516058, upload-time = "2026-10-16T22:16:37.228Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/f2/1371707ce438ba9a43f9d24089828494ec6f9396e28cd7903aa704dd6306/pillow-13.0.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e91c2b1cbeae768c98752e67e717e283d68dae45717b41f2d91eaee648e37b7d", size = 7142574, upload-time = "2026-10-16T22:16:39.172Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/a9/62cf68587f910bc87c5951bcb6e9430c7643a65076adf5f18b4bf350e2bd/pillow-13.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7f6299e494e46253d40c34653cac369412f44ca53b5f85d848d3f95b1ed0546c", size = 6614295, upload-time = "2026-10-16T22:16:41.117Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/c9/9e9b48178649730299be0bafbf5f810a5b6977538f5a92d47e4ba5f5d608/pillow-13.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f9bd7d260d986f3553518c5d723544346fa48031f8aef3265d786aeb59845bc0", size = 7224841, upload-time = "2026-10-16T22:16:43.118Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/48/c44e91384b1b6c072a714a63d00608acc16a6a968735e478e4be4384e5ac/pillow-13.0.0-cp314-cp314-win32.whl", hash = "sha256:2e31c4e68cffd7b1f116127626813b82fcba19edf6b940a7b0c266d6484d0055", size = 6508694, upload-time = "2026-10-16T22:16:45.883Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e2/7ad17747517e4c813dca78257d6bb593466f8231baf1384bc98d92745edb/pillow-13.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:f7cbb7a64e7ec664775195e4f81923bc8a93d9451b963f844e59118f63147a7a", size = 7281830, upload-time = "2026-10-16T22:16:47.725Z" },
+    { url = "https://files.pythonhosted.org/packages/41/9f/e5b51f2ce8ef4563215334035403ce61a244f93a2e65c24a940131618f87/pillow-13.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:a6aaa7871aebca081eb5c45f83e845bbd9712ae99fa9286dbfdcee835e63f4b4", size = 2695468, upload-time = "2026-10-16T22:16:49.515Z" },
+    { url = "https://files.pythonhosted.org/packages/97/73/a53502f731f6c84805a4ce87a8881e86d07a65aee64728b900d112dc703e/pillow-13.0.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:7b999816b5850a35ada08443e6e03945f1f6488144a83afe2d37b240a552aafa", size = 5578196, upload-time = "2026-10-16T22:16:51.291Z" },
+    { url = "https://files.pythonhosted.org/packages/21/50/7e949959a56b5559c78ef172b70fc6025706acb289f3f648a15329e4fa6f/pillow-13.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:67871a13cf47275201553b536c025da777f997fa562a19eb798af4ad4b97c18f", size = 4857276, upload-time = "2026-10-16T22:16:53.399Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/52/43ded0ac08e77e39d17bd6d894162572201b5e8fdc4a022b14c55a1960a4/pillow-13.0.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e8ca8f69b7c77fa96dad99f8638c1fc4f1c0bed4acaa1baf7a3c31bdb80a0ab1", size = 6607008, upload-time = "2026-10-16T22:16:55.525Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/2e/4a57ed216d5bf877387cba4d44c02aa87abe51ad2e06404aa6b597c4da39/pillow-13.0.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6bce6a29c3898191f4c9998e4d4e8f69790caeabde46e54da4bc235ce5bde683", size = 7224281, upload-time = "2026-10-16T22:16:57.738Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/3d/2929b248e135752d63aaeabf53f6de797e905b7b6263f9c1e2adade20aba/pillow-13.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:816752a5ef76a80484c8c441c85593b7ea9304f6231fc5776ad1fbff7e773058", size = 6695600, upload-time = "2026-10-16T22:16:59.842Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/33/fb0da992cf084ed1ee6ee05e96b6191e35c351eb707ca2df874feb24ce47/pillow-13.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5bdb38ba220b61b4ec31dd1046dea6b016d3c6850a23f43ed8b58332b2fc668e", size = 7300589, upload-time = "2026-10-16T22:17:01.686Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/af/c30dd9ef6a3dce84ecb1b2393cac629047a32e66279056c6cb46c3ffd65c/pillow-13.0.0-cp314-cp314t-win32.whl", hash = "sha256:06903aac074d00c988e77a1fc435286dc498506d4ca8d6f69df9babddf4ecc15", size = 6517204, upload-time = "2026-10-16T22:17:03.722Z" },
+    { url = "https://files.pythonhosted.org/packages/85/d5/ef3a8ae7609c8ab26570abf18194882534b480d245a9148b895a2262c004/pillow-13.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:9a635068d9793c7f0d929f39f18b58f1bd86c236e8e7b64167b86af9232ebca0", size = 7286695, upload-time = "2026-10-16T22:17:05.543Z" },
+    { url = "https://files.pythonhosted.org/packages/84/3c/0861db0c69a03689ebe3e7599d35668a414deb5aaafd8255215e4e62e3d3/pillow-13.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0d1a9cf7bc6917538b20f8d06b9ab2147e542f68849e96fc58eb66bdf6acc692", size = 2698098, upload-time = "2026-10-16T22:17:07.674Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/eb/e86a41962a3a31ad495a3d6a912d9002b01bba4a6fa71c28703abdca7f69/pillow-13.0.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:7d5e097eabd5d4915c27ac9f6e9325bb1e01a7c94d7348b5c4451d3fc30e8521", size = 4191213, upload-time = "2026-10-16T22:17:09.449Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/04/7e7445e706afec84ef06dc25b2c77f9cecff242c23730c62928ad1089d4a/pillow-13.0.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:51ebb529fc5e8abdd55302f6c3f8943037348ec2384329a3e55677f69ae2fdfc", size = 4290650, upload-time = "2026-10-16T22:17:11.196Z" },
+    { url = "https://files.pythonhosted.org/packages/46/85/d534089068ac40c0f61f650389a296c812eab745a8a733f81feec39ae955/pillow-13.0.0-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:c87a04e7f152ee4db5dbe15f0bfa3fe628a1aeedbe66b81c43b87f52c813f9ac", size = 3723078, upload-time = "2026-10-16T22:17:12.772Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/2b/00b5c3b401df538b5dbe311d3899730fae5ba1e21cb8b80a128887ac6747/pillow-13.0.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:20722cd5375533ad754053363a80b8fb30c79d37930a6f7228030e237ce3bd5d", size = 5572292, upload-time = "2026-10-16T22:17:14.539Z" },
+    { url = "https://files.pythonhosted.org/packages/72/f5/a6b0610f946e9b54ae888ba7ad29d6e2f8d9b11f69e212d70416b7186c09/pillow-13.0.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:04a63720f79e22fd54d897c233a68314c50ca0603360f54ce2bd5db8f0f43782", size = 4852222, upload-time = "2026-10-16T22:17:16.521Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/d0/c0ff25bb0427ec70f32aac995453321fc3c4494a46c7292ff02d9d260b04/pillow-13.0.0-cp315-cp315-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4f8db54177035a2b5f717f94475b74907e12a96dc74f6d487f3966b0a4694071", size = 6527349, upload-time = "2026-10-16T22:17:18.534Z" },
+    { url = "https://files.pythonhosted.org/packages/85/11/e46fa0bcc0fc117f1eacc206b3d51f04d583fab328b4b740672d0438d83f/pillow-13.0.0-cp315-cp315-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8f36aa77f74b14a2103622b196402c71330e4e7cf4122ee45c854e9a01e0eecf", size = 7152873, upload-time = "2026-10-16T22:17:20.415Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/53/2bdeca705f3a58679fa9201233193c86a30238340ca29b3a152c3fcc719b/pillow-13.0.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:149a1c323ba366f90b48e6f1a6db6582eb50512df374588de56fc909abc0f0f3", size = 6626871, upload-time = "2026-10-16T22:17:22.361Z" },
+    { url = "https://files.pythonhosted.org/packages/14/de/3829030f209722ade3753bb456b805a0e7f885cf885b483407365c82e9ca/pillow-13.0.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:e892354a424b1e82a78ba16785822bdd40de06f19446a3d4a28047df1a4f8932", size = 7236439, upload-time = "2026-10-16T22:17:24.352Z" },
+    { url = "https://files.pythonhosted.org/packages/44/b1/67fc37388382bc036a74f04da5bb6fcbf90ec3ac1f45893e06176c373fd3/pillow-13.0.0-cp315-cp315-win32.whl", hash = "sha256:8e459b613cf31f8980f584387b4fe47bf08e076e288d61aa8eba1f7fd4ddbb81", size = 6508688, upload-time = "2026-10-16T22:17:26.314Z" },
+    { url = "https://files.pythonhosted.org/packages/44/05/fdb6a79aee10861165526b41b7b440e36ee1ff58613b2fbefe3acbf06d4f/pillow-13.0.0-cp315-cp315-win_amd64.whl", hash = "sha256:d4737f50d23ddd11d6685faacbb9252887dde0bc7997127757247983d74399d6", size = 7281107, upload-time = "2026-10-16T22:17:28.198Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/9c/6c6f7dc2a566467baf121394e83de25ac287cffe34cc030726beb4be0224/pillow-13.0.0-cp315-cp315-win_arm64.whl", hash = "sha256:2310e2adfc13c6d457d7d0f2ffdd5c56a74a317650cf765887df8d515a647ac0", size = 2695513, upload-time = "2026-10-16T22:17:30.013Z" },
+    { url = "https://files.pythonhosted.org/packages/23/16/e9120defdb8bff693b582d035312acc6f530cdc2bc5238a87f410efccd82/pillow-13.0.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:21c32061a5512dc13f87cc7303e120e4d77c2f70df89a35af0e3ce246e5ac57f", size = 5578129, upload-time = "2026-10-16T22:17:31.642Z" },
+    { url = "https://files.pythonhosted.org/packages/47/22/76faf2bb2448f48a84cf894c1e2bb1090d7d2b1aa521ece131cb2f05d631/pillow-13.0.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:1c774b9c0ba0d0b356f71530677b39028878a2cae5a93e0a13779cfd17120f88", size = 4857428, upload-time = "2026-10-16T22:17:33.43Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/64/0861ea4e03c50b14af9ed9dd8b9f388ab42f445c623a9fcbab19aef7aa55/pillow-13.0.0-cp315-cp315t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:20822140c9a2ba9c5e42df342b0a892ab2e102fc0e3db967a133bb9ce3f898bb", size = 6612582, upload-time = "2026-10-16T22:17:35.415Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/20/cd1e9b3f60a9f3d5ebe46da36955c26004092a501f7f2c42f9fcc26611bc/pillow-13.0.0-cp315-cp315t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ffea6b2986a797c84b6d1d27d4f43e0b83c73fc16281a930891cd237cf0d08fe", size = 7230176, upload-time = "2026-10-16T22:17:37.362Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/ef/ffb0a2fc85690714fb7ac662956949645d57f15bf4426f520da361e7b6e3/pillow-13.0.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:05cd2cd39055d0b9650060e4513ef4a9a0aea870083950bd046a0d6490f93a22", size = 6703640, upload-time = "2026-10-16T22:17:39.313Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/c2/6402ee3ccb3363aeed8fdb3f9fe56703ac5377a539f0b81b53999d7e121f/pillow-13.0.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:c6fd031333dedcad7ce3e03d244093f43504f209e86925ebdb2b868fa4037630", size = 7309231, upload-time = "2026-10-16T22:17:41.021Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/96/d6b82e8b8c06ad143b66b12e0b31051e4bf489b4fabca1f390a14fe1ebde/pillow-13.0.0-cp315-cp315t-win32.whl", hash = "sha256:c50c80e3591e5cf9a8dfa6007d4f10732f02e32263850999286e56ccd650cfb2", size = 6517200, upload-time = "2026-10-16T22:17:42.886Z" },
+    { url = "https://files.pythonhosted.org/packages/60/d4/0062e6005e9b270b165015aafd343364ac378ec5a685431ea42baad33357/pillow-13.0.0-cp315-cp315t-win_amd64.whl", hash = "sha256:adb3c2124c68e480f4632d06cb7caa3b48a51678475f483b4edb1c6dee29ea43", size = 7287488, upload-time = "2026-10-16T22:17:45.56Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/81/b8eb349746be7bce47dd95337c6634e84910af91b59aaa9159c034c614fa/pillow-13.0.0-cp315-cp315t-win_arm64.whl", hash = "sha256:4a25756244bdcce3b50580baadf320fa48297f0eeb8e114ba64139a40d4d0fc8", size = 2698073, upload-time = "2026-10-16T22:17:47.556Z" },
+    { url = "https://files.pythonhosted.org/packages/60/da/f6d644e631c5b370c5d0b899f3ccadd2780aab070b29a110527cf4e1fd2c/pillow-13.0.0-pp312-pypy312_pp80-macosx_10_15_x86_64.whl", hash = "sha256:8619685cad8efc4c38c66d3b36aad854523297c43d748b3b6f0cc03c90ba3463", size = 5523188, upload-time = "2026-10-16T22:17:59.334Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/b0/2594f202d743a35d4fe80682bfd96f277e5ca7aecb27cf64ef5bfc1d000b/pillow-13.0.0-pp312-pypy312_pp80-macosx_11_0_arm64.whl", hash = "sha256:7e91e97a929232cdb828889ee6ad0e48d7f40f4ec38818f4e4a8968b2b1af22e", size = 4806808, upload-time = "2026-10-16T22:18:01.188Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/ed/d504165ef79af6fafe25c76726cf30f544cc236002f7ed054f1d51adc4ff/pillow-13.0.0-pp312-pypy312_pp80-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:93ff9c9c3663ce23aaa5d0b6b6abac55359e2a0c06c7e30f3771829af816be63", size = 5464358, upload-time = "2026-10-16T22:18:02.779Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/fe/a10aba5503ca13e9e009b8bd0a1a4ce5584bdce246245fd6f3a83701369c/pillow-13.0.0-pp312-pypy312_pp80-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e65dd6e75de67b2362a4fa3e16aa627595f65054dc4ec73d64680c84d592fa61", size = 6043514, upload-time = "2026-10-16T22:18:04.538Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/37/66b12dc476041fe523bca29c9d58fbf1ea92a4eaf73acfb9e993948f1191/pillow-13.0.0-pp312-pypy312_pp80-win_amd64.whl", hash = "sha256:567f20f1c75897d7663830da6ea8af719e03d712b1d9ee7f813319f9ece42e5a", size = 7366030, upload-time = "2026-10-16T22:18:06.638Z" },
 ]
 
 [[package]]
@@ -982,14 +951,12 @@ wheels = [
 
 [[package]]
 name = "streamlit"
-version = "1.61.1"
+version = "1.66.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "altair" },
     { name = "anyio" },
-    { name = "blinker" },
     { name = "click" },
-    { name = "httptools" },
     { name = "itsdangerous" },
     { name = "numpy" },
     { name = "packaging" },
@@ -1001,25 +968,14 @@ dependencies = [
     { name = "python-multipart" },
     { name = "requests" },
     { name = "starlette" },
-    { name = "tenacity" },
-    { name = "toml" },
     { name = "typing-extensions" },
     { name = "uvicorn" },
     { name = "watchdog", marker = "sys_platform != 'darwin'" },
     { name = "websockets" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ad/4a/6d0bf2f78de59924564caf47298341c09f61bf3814f15f0d15ef09fe1e3d/streamlit-1.61.1.tar.gz", hash = "sha256:68acf1ff1b6005b19205c2777d832deea0c1edd6fbbf7f43f091b96220e5e35f", size = 9907073, upload-time = "2026-08-05T14:51:01.956Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7f/20/d6490a27b4985907364112f40511c8e575efe042fb05983d060c753daf1c/streamlit-1.66.1.tar.gz", hash = "sha256:7710a8b67469da7af7bf3503c9b68afca5676f832f62f9bda1221e0ce11941d1", size = 9826774, upload-time = "2026-10-21T17:02:58.805Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4f/e3/deeea39117e1ffbce29755b45bceb214692e0a0aa496a17ce742b98ef3e1/streamlit-1.61.1-py3-none-any.whl", hash = "sha256:3f0ebf6764c3f938f8107414c9533942fa85a84b57affdaa7727d562210d8ece", size = 10512871, upload-time = "2026-08-05T14:50:59.246Z" },
-]
-
-[[package]]
-name = "tenacity"
-version = "9.1.4"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/47/c6/ee486fd809e357697ee8a44d3d69222b344920433d3b6666ccd9b374630c/tenacity-9.1.4.tar.gz", hash = "sha256:adb31d4c263f2bd041081ab33b498309a57c77f9acf2db65aadf0898179cf93a", size = 49413, upload-time = "2026-02-07T10:45:33.841Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d7/c1/eb8f9debc45d3b7918a32ab756658a0904732f75e555402972246b0b8e71/tenacity-9.1.4-py3-none-any.whl", hash = "sha256:6095a360c919085f28c6527de529e76a06ad89b23659fa881ae0649b867a9d55", size = 28926, upload-time = "2026-02-07T10:45:32.24Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/eb/f12286b0b5c30e3fd8e45ca47f05a6cd14cb6e583d04ef4409974a17d371/streamlit-1.66.1-py3-none-any.whl", hash = "sha256:29607190a589fe1fa9bd7e154635d335d47dc09b4010c6cc273daa6e4430ee31", size = 10364948, upload-time = "2026-10-21T17:02:55.973Z" },
 ]
 
 [[package]]
@@ -1031,15 +987,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a6/a5/c0b6468d3824fe3fde30dbb5e1f687b291608f9473681bbf7dabbf5a87d7/text_unidecode-1.3-py2.py3-none-any.whl", hash = "sha256:1311f10e8b895935241623731c2ba64f4c455287888b18189350b67134a822e8", size = 78154, upload-time = "2019-08-30T21:37:03.543Z" },
 ]
 
-[[package]]
-name = "toml"
-version = "0.10.2"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/be/ba/1f744cdc819428fc6b5084ec34d9b30660f6f9daaf70eead706e3203ec3c/toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f", size = 22253, upload-time = "2020-11-01T01:40:22.204Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/44/6f/7120676b6d73228c96e17f1f794d8ab046fc910d781c8d151120c3f1569e/toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b", size = 16588, upload-time = "2020-11-01T01:40:20.672Z" },
-]
-
 [[package]]
 name = "typing-extensions"
 version = "4.16.0"
diff --git a/tests/mcp/requirements.txt b/tests/mcp/requirements.txt
index 34a7fb2e..e5f7b8d6 100644
--- a/tests/mcp/requirements.txt
+++ b/tests/mcp/requirements.txt
@@ -1,7 +1,7 @@
 annotated-types==0.8.0
 anyio==4.14.2
 attrs==26.1.0
-certifi==2026.7.22
+certifi==2026.10.18
 cffi==2.1.1
 click==8.4.2
 cryptography==50.0.0
diff --git a/ui/package-lock.json b/ui/package-lock.json
index 82bc7510..4a4be288 100644
--- a/ui/package-lock.json
+++ b/ui/package-lock.json
@@ -17056,9 +17056,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",
diff --git a/ui/package.json b/ui/package.json
index 67efe540..e3262c83 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -153,7 +153,7 @@
     "picomatch@2": "2.3.2",
     "picomatch@4": "4.0.4",
     "preact": "10.27.3",
-    "qs": "6.16.0",
+    "qs": "6.16.1",
     "react-router": "$react-router",
     "serialize-javascript": "7.1.3",
     "svgo": "3.3.5",