@@ -52,7 +52,10 @@ describe('account settings legacy links', () => {
     )
   })
 
-  it('still rejects unknown sections', async () => {
-    await expect(AccountSettingsSectionPage(pageProps('unknown'))).rejects.toThrow('NEXT_NOT_FOUND')
-  })
+  it.each(['unknown', 'connected-accounts'])(
+    'rejects unavailable sections: %s',
+    async (section) => {
+      await expect(AccountSettingsSectionPage(pageProps(section))).rejects.toThrow('NEXT_NOT_FOUND')
+    }
+  )
 })
@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import type { CredentialGroupOAuthFailure } from '@/lib/credential-groups/oauth-completion'
 
 const NO_STORE_REDIRECT_HEADERS = {
   'Cache-Control': 'no-store',
@@ -20,23 +21,17 @@ export function createCredentialGroupEnrollmentRedirect(
   })
 }
 
-export type CredentialGroupOAuthFailure =
-  | 'expired'
-  | 'denied'
-  | 'account_mismatch'
-  | 'permissions_required'
-  | 'configuration_changed'
-  | 'rate_limited'
-  | 'unavailable'
-  | 'failed'
-
 export function createCredentialGroupCompletionRedirect(
-  oauth?: CredentialGroupOAuthFailure
+  oauth?: CredentialGroupOAuthFailure,
+  completionId?: string
 ): NextResponse {
+  const query = new URLSearchParams()
+  if (oauth) query.set('oauth', oauth)
+  if (completionId) query.set('completionId', completionId)
   return new NextResponse(null, {
     status: 303,
     headers: {
-      Location: `/credential-groups/complete${oauth ? `?oauth=${oauth}` : ''}`,
+      Location: `/credential-groups/complete${query.size ? `?${query}` : ''}`,
       ...NO_STORE_REDIRECT_HEADERS,
     },
   })
 
@@ -5,14 +5,14 @@ import type { CredentialGroupOAuthCallbackQuery } from '@/lib/api/contracts/cred
 import { credentialGroupOAuthAttemptPrincipal } from '@/lib/credential-groups/application/enrollment-auth'
 import { completePublicCredentialGroupOAuth } from '@/lib/credential-groups/application/public-enrollment'
 import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
+import type { CredentialGroupOAuthFailure } from '@/lib/credential-groups/oauth-completion'
 import { consumeCredentialGroupOAuthAttempt } from '@/lib/credential-groups/oauth-state'
 import {
   CredentialGroupInvitationUnavailableError,
   CredentialGroupOAuthError,
 } from '@/lib/credential-groups/provider-adapter'
 import type { CredentialGroupProvider } from '@/lib/credential-groups/providers'
 import {
-  type CredentialGroupOAuthFailure,
   createCredentialGroupCompletionRedirect,
   createCredentialGroupEnrollmentRedirect,
 } from '@/app/api/credential-groups/enrollment-redirect'
@@ -54,7 +54,7 @@ export async function handleCredentialGroupOAuthCallback({
     : {}
   const failureRedirect = (oauth: CredentialGroupOAuthFailure) =>
     attempt.completionRedirect
-      ? createCredentialGroupCompletionRedirect(oauth)
+      ? createCredentialGroupCompletionRedirect(oauth, attempt.completionId)
       : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { ...focus, oauth })
   if (limited) {
     return failureRedirect('rate_limited')
@@ -74,7 +74,7 @@ export async function handleCredentialGroupOAuthCallback({
       request,
     })
     return attempt.completionRedirect
-      ? createCredentialGroupCompletionRedirect()
+      ? createCredentialGroupCompletionRedirect(undefined, attempt.completionId)
       : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
           ...focus,
           connected: attempt.optionId,
 
@@ -56,6 +56,22 @@ function request(query: string) {
 }
 
 describe('credential group OAuth callback', () => {
+  it.each([
+    ['code=code-1', undefined],
+    ['error=access_denied', 'denied'],
+  ])(
+    'correlates direct OAuth completion without returning to enrollment: %s',
+    async (query, failure) => {
+      const completionId = '550e8400-e29b-41d4-a716-446655440000'
+      mocks.consumeAttempt.mockResolvedValue({ ...attempt, completionRedirect: true, completionId })
+      const response = await GET(request(`state=state-1&${query}`), context)
+      const location = new URL(response.headers.get('location')!, 'https://sim.test')
+      expect(response.status).toBe(303)
+      expect(location.pathname).toBe('/credential-groups/complete')
+      expect(location.searchParams.get('completionId')).toBe(completionId)
+      expect(location.searchParams.get('oauth')).toBe(failure ?? null)
+    }
+  )
   beforeEach(() => {
     vi.clearAllMocks()
     mocks.rateLimit.mockResolvedValue(null)
 
@@ -16,10 +16,11 @@ export const POST = defineInternalJsonRoute({
     reason:
       'A member connecting their own account by hand; each call only re-issues their own invitation',
   }),
-  errorPolicy: internalKnowledgeErrorPolicies.connectors,
-  mapInput: ({ params }) => ({
+  errorPolicy: internalKnowledgeErrorPolicies.connectAccount,
+  mapInput: ({ params, query }) => ({
     connectorId: params.connectorId,
     knowledgeBaseId: params.id,
+    oauthCompletionId: query.oauthCompletionId,
   }),
   useCase: startKnowledgeConnectorMemberEnrollment,
   present: ({ url }) => ({ success: true as const, data: { url } }),
 
@@ -13,7 +13,7 @@ export const POST = defineInternalJsonRoute({
   auth: internalSessionAuth,
   operation: knowledgeOperations.simSearchConnect,
   rateLimit: internalRateLimits.none({ reason: 'One click per source; mints a single-use link' }),
-  errorPolicy: internalKnowledgeErrorPolicies.connectors,
+  errorPolicy: internalKnowledgeErrorPolicies.connectAccount,
   mapInput: ({ body }) => body,
   useCase: connectSimSearchConnector,
   present: (result) => ({ success: true as const, data: result }),
 
@@ -1,6 +1,10 @@
 /** @vitest-environment node */
 import { authMockFns, createMockRequest } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  OrganizationSearchProviderSummary,
+  SearchSourceSummary,
+} from '@/lib/api/contracts/knowledge/connectors'
 
 const mocks = vi.hoisted(() => ({
   execute: vi.fn(),
@@ -58,9 +62,10 @@ const source = {
   viewerDocumentCount: 0,
   viewerFailedDocumentCount: 0,
   viewerEmailVerified: true,
+  viewerAccounts: [],
   connectionRequired: false,
   viewerMembership: null,
-}
+} satisfies SearchSourceSummary
 
 beforeEach(() => {
   vi.clearAllMocks()
@@ -266,8 +271,9 @@ describe('organization administration overview boundary', () => {
       sourceCount: 1,
       approved: true,
       status: 'waiting_for_connections',
+      issue: null,
       isSyncing: false,
-    }
+    } satisfies OrganizationSearchProviderSummary
     mocks.adminOverview.mockResolvedValue({
       providers: [{ ...provider, privateAccount: 'private' }],
       documentNames: ['private'],
 
@@ -0,0 +1,49 @@
+/** @vitest-environment jsdom */
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { CredentialGroupCompletionHandoff } from '@/app/credential-groups/complete/completion-handoff'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+describe('credential group OAuth completion', () => {
+  it.each([undefined, 'denied', 'configuration_changed'] as const)(
+    'publishes %s to only its initiating tab and closes',
+    (failure) => {
+      const postMessage = vi.fn()
+      const closeChannel = vi.fn()
+      const names: string[] = []
+      vi.stubGlobal(
+        'BroadcastChannel',
+        class {
+          postMessage = postMessage
+          close = closeChannel
+          constructor(name: string) {
+            names.push(name)
+          }
+        }
+      )
+      const closeWindow = vi.spyOn(window, 'close').mockImplementation(() => {})
+      ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+      const container = document.createElement('div')
+      const root = createRoot(container)
+      const completionId = '550e8400-e29b-41d4-a716-446655440000'
+      try {
+        act(() =>
+          root.render(
+            <CredentialGroupCompletionHandoff completionId={completionId} failure={failure} />
+          )
+        )
+        expect(names).toEqual([`sim:credential-group-oauth:${completionId}`])
+        expect(postMessage).toHaveBeenCalledExactlyOnceWith(failure ?? 'connected')
+        expect(closeChannel).toHaveBeenCalledOnce()
+        expect(closeWindow).toHaveBeenCalledOnce()
+      } finally {
+        act(() => root.unmount())
+      }
+    }
+  )
+})
@@ -0,0 +1,26 @@
+'use client'
+
+import { useEffect } from 'react'
+import {
+  type CredentialGroupOAuthFailure,
+  credentialGroupOAuthCompletionChannel,
+} from '@/lib/credential-groups/oauth-completion'
+
+interface CredentialGroupCompletionHandoffProps {
+  completionId: string
+  failure?: CredentialGroupOAuthFailure
+}
+
+/** Notifies the originating tab even when provider navigation has removed window.opener. */
+export function CredentialGroupCompletionHandoff({
+  completionId,
+  failure,
+}: CredentialGroupCompletionHandoffProps) {
+  useEffect(() => {
+    const channel = new BroadcastChannel(credentialGroupOAuthCompletionChannel(completionId))
+    channel.postMessage(failure ?? 'connected')
+    channel.close()
+    window.close()
+  }, [completionId, failure])
+  return null
+}
@@ -1,36 +1,33 @@
 import { ChipLink } from '@sim/emcn'
+import { isValidUuid } from '@sim/utils/id'
 import type { Metadata } from 'next'
+import {
+  CREDENTIAL_GROUP_OAUTH_FAILURE_MESSAGES,
+  isCredentialGroupOAuthFailure,
+} from '@/lib/credential-groups/oauth-completion'
 import { APP_ENTRY_PATH } from '@/lib/navigation/paths'
 import { AuthHeader, AuthShell } from '@/app/(auth)/components'
+import { CredentialGroupCompletionHandoff } from '@/app/credential-groups/complete/completion-handoff'
 
 export const metadata: Metadata = {
   title: 'Accounts connected',
   robots: { index: false, follow: false },
 }
 
-const OAUTH_FAILURE_MESSAGES = {
-  expired: 'This connection attempt expired. Open Sim and start connecting your account again.',
-  denied: 'Authorization was canceled. Open Sim to try again.',
-  account_mismatch: 'Choose the account matching your Sim email address.',
-  permissions_required: 'All requested permissions are required to connect this account.',
-  configuration_changed: 'The connection settings changed. Open Sim to try again.',
-  rate_limited: 'Too many authorization attempts. Wait a few minutes and try again.',
-  unavailable: 'This connection is unavailable. Open Sim to try again.',
-  failed: 'Account authorization did not complete. Open Sim to try again.',
-} as const
-
 export default async function CredentialGroupCompletePage({
   searchParams,
 }: {
-  searchParams: Promise<{ oauth?: string | string[] }>
+  searchParams: Promise<{ oauth?: string | string[]; completionId?: string | string[] }>
 }) {
-  const { oauth } = await searchParams
-  const error =
-    typeof oauth === 'string' && Object.hasOwn(OAUTH_FAILURE_MESSAGES, oauth)
-      ? OAUTH_FAILURE_MESSAGES[oauth as keyof typeof OAUTH_FAILURE_MESSAGES]
-      : undefined
+  const { oauth, completionId } = await searchParams
+  const failure =
+    oauth === undefined ? undefined : isCredentialGroupOAuthFailure(oauth) ? oauth : 'failed'
+  const error = failure ? CREDENTIAL_GROUP_OAUTH_FAILURE_MESSAGES[failure] : undefined
   return (
     <AuthShell>
+      {typeof completionId === 'string' && isValidUuid(completionId) && (
+        <CredentialGroupCompletionHandoff completionId={completionId} failure={failure} />
+      )}
       <AuthHeader
         title={error ? 'Account not connected' : 'Accounts connected'}
         description={error ?? 'Your accounts are ready to use — you can close this tab.'}