Function isLoopbackRedirect

internal/agent/oauth_handlers.go:205–211

isLoopbackRedirect reports whether a full redirect_uri is an http loopback URL (http://localhost[:port]/…, http://127.0.0.1[:port]/…, http://[::1]…). https URLs return false even though they're valid redirect targets — the point of this gate is "the callback lands on the user's own machine", which o

(raw string)

// consent screen offer account scope to local tools (Claude Code, Cursor) while
// a hosted/remote client — which can't receive a localhost callback — can't.
func isLoopbackRedirect(raw string) bool {
	u, err := url.Parse(raw)
	if err != nil || u.Scheme != "http" {
		return false
	}
	return isLoopbackHost(u.Hostname())
}

func validateRedirectURI(raw string) error {
	if raw == "" {