fix(cliproxy): preserve kiro paste-callback start route

src/cliproxy/auth/auth-types.ts

@@ -258,6 +258,14 @@ export function getManagementAuthUrlPath(provider: CLIProxyProvider): string {
   return `/v0/management/${authUrlProvider}-auth-url?is_webui=true`;
 }
 
+export function getPasteCallbackStartPath(provider: CLIProxyProvider): string {
+  // Kiro CLI auth methods still use the legacy start route.
+  if (provider === 'kiro') {
+    return `/oauth/${provider}/start`;
+  }
+  return getManagementAuthUrlPath(provider);
+}
+
 export function getManagementOAuthCallbackPath(): string {
   return '/v0/management/oauth-callback';
 }

src/cliproxy/auth/oauth-handler.ts

@@ -37,7 +37,7 @@ import {
   getOAuthConfig,
   ProviderOAuthConfig,
   CLIPROXY_CALLBACK_PROVIDER_MAP,
-  getManagementAuthUrlPath,
+  getPasteCallbackStartPath,
   getManagementOAuthCallbackPath,
   normalizeKiroAuthMethod,
 } from './auth-types';
@@ -276,10 +276,16 @@ async function handlePasteCallbackMode(
   console.log(info(`Starting ${oauthConfig.displayName} OAuth (paste-callback mode)...`));
 
   try {
-    // Request auth URL from CLIProxyAPI
-    // Use management auth-url endpoint to match CLIProxyAPI route contract.
-    const startResponse = await fetch(buildProxyUrl(target, getManagementAuthUrlPath(provider)), {
-      headers: buildManagementHeaders(target),
+    // Request auth URL from CLIProxyAPI.
+    // Kiro keeps its legacy start route because CLI auth methods do not share the generic
+    // management auth-url contract used by providers like Claude.
+    const startPath = getPasteCallbackStartPath(provider);
+    const startResponse = await fetch(buildProxyUrl(target, startPath), {
+      ...(provider === 'kiro' ? { method: 'POST' } : {}),
+      headers:
+        provider === 'kiro'
+          ? buildManagementHeaders(target, { 'Content-Type': 'application/json' })
+          : buildManagementHeaders(target),
     });
 
     if (!startResponse.ok) {

tests/unit/cliproxy/auth-types-management-path.test.ts

@@ -1,22 +1,30 @@
 import { describe, expect, it } from 'bun:test';
 import {
   getManagementAuthUrlPath,
+  getPasteCallbackStartPath,
   getManagementOAuthCallbackPath,
 } from '../../../src/cliproxy/auth/auth-types';
 
-describe('auth-types management auth-url path', () => {
+describe('auth-types paste-callback start path', () => {
   it('maps providers to CLIProxyAPI management auth-url routes', () => {
-    expect(getManagementAuthUrlPath('gemini')).toBe(
+    expect(getPasteCallbackStartPath('gemini')).toBe(
       '/v0/management/gemini-cli-auth-url?is_webui=true'
     );
-    expect(getManagementAuthUrlPath('codex')).toBe('/v0/management/codex-auth-url?is_webui=true');
-    expect(getManagementAuthUrlPath('agy')).toBe(
+    expect(getPasteCallbackStartPath('codex')).toBe('/v0/management/codex-auth-url?is_webui=true');
+    expect(getPasteCallbackStartPath('agy')).toBe(
       '/v0/management/antigravity-auth-url?is_webui=true'
     );
-    expect(getManagementAuthUrlPath('claude')).toBe(
+    expect(getPasteCallbackStartPath('claude')).toBe(
       '/v0/management/anthropic-auth-url?is_webui=true'
     );
-    expect(getManagementAuthUrlPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
+    expect(getPasteCallbackStartPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
+  });
+
+  it('keeps Kiro on the legacy start route for paste-callback mode', () => {
+    expect(getPasteCallbackStartPath('kiro')).toBe('/oauth/kiro/start');
+  });
+
+  it('still exposes the generic management auth-url helper', () => {
     expect(getManagementAuthUrlPath('kiro')).toBe('/v0/management/kiro-auth-url?is_webui=true');
   });