Production GitHub OAuth callback for /me returns Cannot GET /auth/github/callback

[SueJianjian]

Summary

The production GitHub sign-in flow for contributor accounts appears broken on MergeWork.

After starting from /me and completing GitHub authorization, the callback URL returns a plain Cannot GET /auth/github/callback page instead of completing sign-in.

This currently blocks contributor wallet linking and GitHub balance claims.

Reproduction

1. Open https://mrwk.online/me
2. Click Sign in with GitHub
3. Complete GitHub authorization
4. Land on a callback URL like:

https://mrwk.online/auth/github/callback?code=...&state=...

5. Observe the response:

Cannot GET /auth/github/callback

Impact

• contributors cannot complete GitHub sign-in on /me
• wallet linking cannot be completed
• older github:* balances cannot be claimed into a linked mrwk1 wallet
• payout setup is blocked for new contributors

Notes

The repository docs currently state that production GitHub OAuth should allow the exact callback:

• https://mrwk.online/auth/github/callback

and mention the legacy callback only for old links:

• https://mrwk.ltclab.site/auth/github/callback

So this looks like a production callback route/config mismatch or missing deployed route rather than a user-side issue.

Date observed

Observed on June 15, 2026.

[yanyishuai]

Working on #1146 — deploy gate + public link health now fail when OAuth callback returns Express Cannot GET or 404.