From 5b1754a32043e667bf778180ac1d859e2c629d2f Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Tue, 7 Apr 2026 09:15:36 -0400
Subject: [PATCH] fix(kiro): prefer scored URL extraction for stderr manual
 callback

Use extractLikelyOAuthAuthorizationUrl before falling back to naive
regex when detecting auth URLs in stderr for manual callback replay.
Prevents prompting with non-OAuth URLs when stderr emits multiple URLs.
---
 src/cliproxy/auth/oauth-process.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/cliproxy/auth/oauth-process.ts b/src/cliproxy/auth/oauth-process.ts
index b4cd3dd1..689b93b3 100644
--- a/src/cliproxy/auth/oauth-process.ts
+++ b/src/cliproxy/auth/oauth-process.ts
@@ -765,13 +765,14 @@ export function executeOAuthProcess(options: OAuthProcessOptions): Promise<Accou
         displayUrlFromStderr(output, state, oauthConfig);
       }
       if (options.manualCallback && !state.manualCallbackPrompted) {
-        const urlMatch = output.match(/https?:\/\/[^\s]+/);
-        if (urlMatch) {
+        const authUrl =
+          extractLikelyOAuthAuthorizationUrl(output) ?? output.match(/https?:\/\/[^\s]+/)?.[0];
+        if (authUrl) {
           state.manualCallbackPrompted = true;
           await replayManualCallback(
             options.oauthConfig,
             authProcess,
-            urlMatch[0],
+            authUrl,
             options.verbose,
             state,
             10 * 60 * 1000