security: OAuth callback URL not URL-encoded

[samsonajulor]

Summary

The CLI auth callback URL is injected raw into the login URL query string without url.QueryEscape. This breaks on any system where the callback URL contains special characters and can cause auth flow failures.

Vulnerable code

internal/deploy/auth.go:72

loginURL := fmt.Sprintf("%s/cli-auth?callback=%s", computeBase, callbackURL)
// callbackURL = "http://localhost:PORT/callback" — not URL-encoded

Fix

import "net/url"

loginURL := fmt.Sprintf("%s/cli-auth?callback=%s", computeBase, url.QueryEscape(callbackURL))

And on the receiving end (app/cli-auth/page.tsx), useSearchParams().get('callback') already decodes it automatically.

Severity

MEDIUM — breaks auth flow, could cause token delivery failure.