From fa027022a8faf886c7f5891ec8cb2d3879c783e8 Mon Sep 17 00:00:00 2001
From: Brian Le <brian@brianle.xyz>
Date: Tue, 3 Mar 2026 17:59:10 -0500
Subject: [PATCH] fix(cliproxy): use management oauth-callback in paste flow

---
 src/cliproxy/auth/auth-types.ts                        | 4 ++++
 src/cliproxy/auth/oauth-handler.ts                     | 4 ++--
 tests/unit/cliproxy/auth-types-management-path.test.ts | 9 ++++++++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/cliproxy/auth/auth-types.ts b/src/cliproxy/auth/auth-types.ts
index 03fa6b25..3566e6b2 100644
--- a/src/cliproxy/auth/auth-types.ts
+++ b/src/cliproxy/auth/auth-types.ts
@@ -258,6 +258,10 @@ export function getManagementAuthUrlPath(provider: CLIProxyProvider): string {
   return `/v0/management/${authUrlProvider}-auth-url?is_webui=true`;
 }
 
+export function getManagementOAuthCallbackPath(): string {
+  return '/v0/management/oauth-callback';
+}
+
 /**
  * Get OAuth config for provider
  */
diff --git a/src/cliproxy/auth/oauth-handler.ts b/src/cliproxy/auth/oauth-handler.ts
index 47b26cb0..9d4848d3 100644
--- a/src/cliproxy/auth/oauth-handler.ts
+++ b/src/cliproxy/auth/oauth-handler.ts
@@ -38,6 +38,7 @@ import {
   ProviderOAuthConfig,
   CLIPROXY_CALLBACK_PROVIDER_MAP,
   getManagementAuthUrlPath,
+  getManagementOAuthCallbackPath,
   normalizeKiroAuthMethod,
 } from './auth-types';
 import { isHeadlessEnvironment, killProcessOnPort, showStep } from './environment-detector';
@@ -370,8 +371,7 @@ async function handlePasteCallbackMode(
 
     const callbackProvider = CLIPROXY_CALLBACK_PROVIDER_MAP[provider] || provider;
 
-    // Note: /oauth-callback is a CLIProxyAPI endpoint (not /v0/management prefix)
-    const callbackResponse = await fetch(buildProxyUrl(target, '/oauth-callback'), {
+    const callbackResponse = await fetch(buildProxyUrl(target, getManagementOAuthCallbackPath()), {
       method: 'POST',
       headers: buildManagementHeaders(target, { 'Content-Type': 'application/json' }),
       body: JSON.stringify({
diff --git a/tests/unit/cliproxy/auth-types-management-path.test.ts b/tests/unit/cliproxy/auth-types-management-path.test.ts
index cc68b9d8..a9f7cc35 100644
--- a/tests/unit/cliproxy/auth-types-management-path.test.ts
+++ b/tests/unit/cliproxy/auth-types-management-path.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'bun:test';
-import { getManagementAuthUrlPath } from '../../../src/cliproxy/auth/auth-types';
+import {
+  getManagementAuthUrlPath,
+  getManagementOAuthCallbackPath,
+} from '../../../src/cliproxy/auth/auth-types';
 
 describe('auth-types management auth-url path', () => {
   it('maps providers to CLIProxyAPI management auth-url routes', () => {
@@ -16,4 +19,8 @@ describe('auth-types management auth-url path', () => {
     expect(getManagementAuthUrlPath('ghcp')).toBe('/v0/management/github-auth-url?is_webui=true');
     expect(getManagementAuthUrlPath('kiro')).toBe('/v0/management/kiro-auth-url?is_webui=true');
   });
+
+  it('uses CLIProxyAPI management oauth-callback route', () => {
+    expect(getManagementOAuthCallbackPath()).toBe('/v0/management/oauth-callback');
+  });
 });