From 86ca18003a033be976b787811db16bf38bf82a91 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Sat, 7 Mar 2026 13:38:22 +0700
Subject: [PATCH] fix(cliproxy): preserve kiro paste-callback start route

---
 src/cliproxy/auth/auth-types.ts               |  8 ++++++++
 src/cliproxy/auth/oauth-handler.ts            | 16 ++++++++++-----
 .../auth-types-management-path.test.ts        | 20 +++++++++++++------
 3 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/src/cliproxy/auth/auth-types.ts b/src/cliproxy/auth/auth-types.ts
index 3566e6b2..dd8ad3e6 100644
--- a/src/cliproxy/auth/auth-types.ts
+++ b/src/cliproxy/auth/auth-types.ts
@@ -258,6 +258,14 @@ export function getManagementAuthUrlPath(provider: CLIProxyProvider): string {
   return `/v0/management/${authUrlProvider}-auth-url?is_webui=true`;
 }
 
+export function getPasteCallbackStartPath(provider: CLIProxyProvider): string {
+  // Kiro CLI auth methods still use the legacy start route.
+  if (provider === 'kiro') {
+    return `/oauth/${provider}/start`;
+  }
+  return getManagementAuthUrlPath(provider);
+}
+
 export function getManagementOAuthCallbackPath(): string {
   return '/v0/management/oauth-callback';
 }
diff --git a/src/cliproxy/auth/oauth-handler.ts b/src/cliproxy/auth/oauth-handler.ts
index 9d4848d3..5ef17166 100644
--- a/src/cliproxy/auth/oauth-handler.ts
+++ b/src/cliproxy/auth/oauth-handler.ts
@@ -37,7 +37,7 @@ import {
   getOAuthConfig,
   ProviderOAuthConfig,
   CLIPROXY_CALLBACK_PROVIDER_MAP,
-  getManagementAuthUrlPath,
+  getPasteCallbackStartPath,
   getManagementOAuthCallbackPath,
   normalizeKiroAuthMethod,
 } from './auth-types';
@@ -276,10 +276,16 @@ async function handlePasteCallbackMode(
   console.log(info(`Starting ${oauthConfig.displayName} OAuth (paste-callback mode)...`));
 
   try {
-    // Request auth URL from CLIProxyAPI
-    // Use management auth-url endpoint to match CLIProxyAPI route contract.
-    const startResponse = await fetch(buildProxyUrl(target, getManagementAuthUrlPath(provider)), {
-      headers: buildManagementHeaders(target),
+    // Request auth URL from CLIProxyAPI.
+    // Kiro keeps its legacy start route because CLI auth methods do not share the generic
+    // management auth-url contract used by providers like Claude.
+    const startPath = getPasteCallbackStartPath(provider);
+    const startResponse = await fetch(buildProxyUrl(target, startPath), {
+      ...(provider === 'kiro' ? { method: 'POST' } : {}),
+      headers:
+        provider === 'kiro'
+          ? buildManagementHeaders(target, { 'Content-Type': 'application/json' })
+          : buildManagementHeaders(target),
     });
 
     if (!startResponse.ok) {
diff --git a/tests/unit/cliproxy/auth-types-management-path.test.ts b/tests/unit/cliproxy/auth-types-management-path.test.ts
index a9f7cc35..ee999850 100644
--- a/tests/unit/cliproxy/auth-types-management-path.test.ts
+++ b/tests/unit/cliproxy/auth-types-management-path.test.ts
@@ -1,22 +1,30 @@
 import { describe, expect, it } from 'bun:test';
 import {
   getManagementAuthUrlPath,
+  getPasteCallbackStartPath,
   getManagementOAuthCallbackPath,
 } from '../../../src/cliproxy/auth/auth-types';
 
-describe('auth-types management auth-url path', () => {
+describe('auth-types paste-callback start path', () => {
   it('maps providers to CLIProxyAPI management auth-url routes', () => {
-    expect(getManagementAuthUrlPath('gemini')).toBe(
+    expect(getPasteCallbackStartPath('gemini')).toBe(
       '/v0/management/gemini-cli-auth-url?is_webui=true'
     );
-    expect(getManagementAuthUrlPath('codex')).toBe('/v0/management/codex-auth-url?is_webui=true');
-    expect(getManagementAuthUrlPath('agy')).toBe(
+    expect(getPasteCallbackStartPath('codex')).toBe('/v0/management/codex-auth-url?is_webui=true');
+    expect(getPasteCallbackStartPath('agy')).toBe(
       '/v0/management/antigravity-auth-url?is_webui=true'
     );
-    expect(getManagementAuthUrlPath('claude')).toBe(
+    expect(getPasteCallbackStartPath('claude')).toBe(
       '/v0/management/anthropic-auth-url?is_webui=true'
     );
-    expect(getManagementAuthUrlPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
+    expect(getPasteCallbackStartPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
+  });
+
+  it('keeps Kiro on the legacy start route for paste-callback mode', () => {
+    expect(getPasteCallbackStartPath('kiro')).toBe('/oauth/kiro/start');
+  });
+
+  it('still exposes the generic management auth-url helper', () => {
     expect(getManagementAuthUrlPath('kiro')).toBe('/v0/management/kiro-auth-url?is_webui=true');
   });