fix(kiro): harden idc and callback auth paths

- keep headless paste routing aligned with the selected Kiro auth method

- validate local callback replay targets and add prompt cancellation safeguards

- wire IDC params through the dashboard start route and support equals-form CLI flags

tests/unit/cliproxy/oauth-process-error-parser.test.ts

@@ -1,5 +1,9 @@
 import { describe, expect, it } from 'bun:test';
-import { extractLikelyAuthFailureFromStderr } from '../../../src/cliproxy/auth/oauth-process';
+import {
+  extractLikelyAuthFailureFromStderr,
+  getExpectedLocalCallback,
+  validateManualCallbackUrl,
+} from '../../../src/cliproxy/auth/oauth-process';
 
 describe('oauth-process stderr parsing', () => {
   it('ignores non-ghcp providers', () => {
@@ -33,3 +37,50 @@ describe('oauth-process stderr parsing', () => {
     expect((parsed as string).length).toBe(240);
   });
 });
+
+describe('oauth-process manual callback validation', () => {
+  const authUrl =
+    'https://oidc.example.com/authorize?redirect_uri=http%3A%2F%2F127.0.0.1%3A9876%2Foauth%2Fcallback&state=test-state';
+
+  it('extracts the expected local callback target from the auth URL', () => {
+    expect(getExpectedLocalCallback(authUrl)).toEqual({
+      origin: 'http://127.0.0.1:9876',
+      pathname: '/oauth/callback',
+      state: 'test-state',
+    });
+  });
+
+  it('accepts matching loopback callback URLs', () => {
+    expect(
+      validateManualCallbackUrl(
+        'http://127.0.0.1:9876/oauth/callback?code=abc123&state=test-state',
+        authUrl
+      )
+    ).toBeNull();
+  });
+
+  it('rejects non-loopback callback URLs', () => {
+    expect(
+      validateManualCallbackUrl(
+        'https://evil.example.com/oauth/callback?code=abc123&state=test-state',
+        authUrl
+      )
+    ).toContain('local OAuth callback server');
+  });
+
+  it('rejects callback URLs with the wrong path or state', () => {
+    expect(
+      validateManualCallbackUrl(
+        'http://127.0.0.1:9876/not-the-callback?code=abc123&state=test-state',
+        authUrl
+      )
+    ).toContain('expected local OAuth callback target');
+
+    expect(
+      validateManualCallbackUrl(
+        'http://127.0.0.1:9876/oauth/callback?code=abc123&state=wrong-state',
+        authUrl
+      )
+    ).toContain('state does not match');
+  });
+});