From 6fcd924b1c8743484823b958ff403c4c37379eab Mon Sep 17 00:00:00 2001
From: Brian Le <brian@brianle.xyz>
Date: Tue, 3 Mar 2026 17:16:07 -0500
Subject: [PATCH] fix(cliproxy): use management auth-url route in paste
 callback

---
 src/cliproxy/auth/auth-types.ts               |  5 +++++
 src/cliproxy/auth/oauth-handler.ts            | 10 ++++------
 .../auth-types-management-path.test.ts        | 19 +++++++++++++++++++
 3 files changed, 28 insertions(+), 6 deletions(-)
 create mode 100644 tests/unit/cliproxy/auth-types-management-path.test.ts

diff --git a/src/cliproxy/auth/auth-types.ts b/src/cliproxy/auth/auth-types.ts
index 9d1cf401..03fa6b25 100644
--- a/src/cliproxy/auth/auth-types.ts
+++ b/src/cliproxy/auth/auth-types.ts
@@ -253,6 +253,11 @@ export const CLIPROXY_AUTH_URL_PROVIDER_MAP: Record<CLIProxyProvider, string> =
   (provider) => getCLIProxyAuthUrlProviderName(provider)
 );
 
+export function getManagementAuthUrlPath(provider: CLIProxyProvider): string {
+  const authUrlProvider = CLIPROXY_AUTH_URL_PROVIDER_MAP[provider] || provider;
+  return `/v0/management/${authUrlProvider}-auth-url?is_webui=true`;
+}
+
 /**
  * Get OAuth config for provider
  */
diff --git a/src/cliproxy/auth/oauth-handler.ts b/src/cliproxy/auth/oauth-handler.ts
index f4a2d3b2..47b26cb0 100644
--- a/src/cliproxy/auth/oauth-handler.ts
+++ b/src/cliproxy/auth/oauth-handler.ts
@@ -37,6 +37,7 @@ import {
   getOAuthConfig,
   ProviderOAuthConfig,
   CLIPROXY_CALLBACK_PROVIDER_MAP,
+  getManagementAuthUrlPath,
   normalizeKiroAuthMethod,
 } from './auth-types';
 import { isHeadlessEnvironment, killProcessOnPort, showStep } from './environment-detector';
@@ -275,12 +276,9 @@ async function handlePasteCallbackMode(
 
   try {
     // Request auth URL from CLIProxyAPI
-    // Note: Uses /oauth/${provider}/start endpoint (different from web-server routes which use
-    // /v0/management/${provider}-auth-url). Both start OAuth flows but this endpoint is simpler
-    // for CLI paste-callback mode as it directly returns the auth URL without is_webui param.
-    const startResponse = await fetch(buildProxyUrl(target, `/oauth/${provider}/start`), {
-      method: 'POST',
-      headers: buildManagementHeaders(target, { 'Content-Type': 'application/json' }),
+    // Use management auth-url endpoint to match CLIProxyAPI route contract.
+    const startResponse = await fetch(buildProxyUrl(target, getManagementAuthUrlPath(provider)), {
+      headers: buildManagementHeaders(target),
     });
 
     if (!startResponse.ok) {
diff --git a/tests/unit/cliproxy/auth-types-management-path.test.ts b/tests/unit/cliproxy/auth-types-management-path.test.ts
new file mode 100644
index 00000000..cc68b9d8
--- /dev/null
+++ b/tests/unit/cliproxy/auth-types-management-path.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'bun:test';
+import { getManagementAuthUrlPath } from '../../../src/cliproxy/auth/auth-types';
+
+describe('auth-types management auth-url path', () => {
+  it('maps providers to CLIProxyAPI management auth-url routes', () => {
+    expect(getManagementAuthUrlPath('gemini')).toBe(
+      '/v0/management/gemini-cli-auth-url?is_webui=true'
+    );
+    expect(getManagementAuthUrlPath('codex')).toBe('/v0/management/codex-auth-url?is_webui=true');
+    expect(getManagementAuthUrlPath('agy')).toBe(
+      '/v0/management/antigravity-auth-url?is_webui=true'
+    );
+    expect(getManagementAuthUrlPath('claude')).toBe(
+      '/v0/management/anthropic-auth-url?is_webui=true'
+    );
+    expect(getManagementAuthUrlPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
+    expect(getManagementAuthUrlPath('kiro')).toBe('/v0/management/kiro-auth-url?is_webui=true');
+  });
+});