fix(cliproxy): use management auth-url route in paste callback

src/cliproxy/auth/auth-types.ts

@@ -253,6 +253,11 @@ export const CLIPROXY_AUTH_URL_PROVIDER_MAP: Record<CLIProxyProvider, string> =
   (provider) => getCLIProxyAuthUrlProviderName(provider)
 );
 
+export function getManagementAuthUrlPath(provider: CLIProxyProvider): string {
+  const authUrlProvider = CLIPROXY_AUTH_URL_PROVIDER_MAP[provider] || provider;
+  return `/v0/management/${authUrlProvider}-auth-url?is_webui=true`;
+}
+
 /**
  * Get OAuth config for provider
  */

src/cliproxy/auth/oauth-handler.ts

@@ -37,6 +37,7 @@ import {
   getOAuthConfig,
   ProviderOAuthConfig,
   CLIPROXY_CALLBACK_PROVIDER_MAP,
+  getManagementAuthUrlPath,
   normalizeKiroAuthMethod,
 } from './auth-types';
 import { isHeadlessEnvironment, killProcessOnPort, showStep } from './environment-detector';
@@ -275,12 +276,9 @@ async function handlePasteCallbackMode(
 
   try {
     // Request auth URL from CLIProxyAPI
-    // Note: Uses /oauth/${provider}/start endpoint (different from web-server routes which use
-    // /v0/management/${provider}-auth-url). Both start OAuth flows but this endpoint is simpler
-    // for CLI paste-callback mode as it directly returns the auth URL without is_webui param.
-    const startResponse = await fetch(buildProxyUrl(target, `/oauth/${provider}/start`), {
-      method: 'POST',
-      headers: buildManagementHeaders(target, { 'Content-Type': 'application/json' }),
+    // Use management auth-url endpoint to match CLIProxyAPI route contract.
+    const startResponse = await fetch(buildProxyUrl(target, getManagementAuthUrlPath(provider)), {
+      headers: buildManagementHeaders(target),
     });
 
     if (!startResponse.ok) {

tests/unit/cliproxy/auth-types-management-path.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'bun:test';
+import { getManagementAuthUrlPath } from '../../../src/cliproxy/auth/auth-types';
+
+describe('auth-types management auth-url path', () => {
+  it('maps providers to CLIProxyAPI management auth-url routes', () => {
+    expect(getManagementAuthUrlPath('gemini')).toBe(
+      '/v0/management/gemini-cli-auth-url?is_webui=true'
+    );
+    expect(getManagementAuthUrlPath('codex')).toBe('/v0/management/codex-auth-url?is_webui=true');
+    expect(getManagementAuthUrlPath('agy')).toBe(
+      '/v0/management/antigravity-auth-url?is_webui=true'
+    );
+    expect(getManagementAuthUrlPath('claude')).toBe(
+      '/v0/management/anthropic-auth-url?is_webui=true'
+    );
+    expect(getManagementAuthUrlPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
+    expect(getManagementAuthUrlPath('kiro')).toBe('/v0/management/kiro-auth-url?is_webui=true');
+  });
+});