From c7dd3a4f41353fd8a9c2c1c42c574c468e765d66 Mon Sep 17 00:00:00 2001
From: "kiloconnect[bot]" <240665456+kiloconnect[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 14:04:38 +0000
Subject: [PATCH 1/2] fix: hide cmd.exe window when opening browser during
 login on Windows

Replace the 'open' package with a platform-specific exec call using
windowsHide: true in device-auth-tui.ts, preventing the black terminal
flash during the OAuth login flow on Windows.

Closes #8078
---
 packages/kilo-gateway/src/auth/device-auth-tui.ts | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/packages/kilo-gateway/src/auth/device-auth-tui.ts b/packages/kilo-gateway/src/auth/device-auth-tui.ts
index 8d233f26b82..2fe54c01789 100644
--- a/packages/kilo-gateway/src/auth/device-auth-tui.ts
+++ b/packages/kilo-gateway/src/auth/device-auth-tui.ts
@@ -1,4 +1,4 @@
-import open from "open"
+import { exec } from "child_process"
 import type { DeviceAuthInitiateResponse, DeviceAuthPollResponse } from "../types.js"
 import { poll } from "./polling.js"
 import { getKiloProfile, getKiloDefaultModel } from "../api/profile.js"
@@ -70,10 +70,14 @@ export async function authenticateWithDeviceAuthTUI(inputs?: Record<string, stri
   const authData = await initiateDeviceAuth()
   const { code, verificationUrl, expiresIn } = authData
 
-  // Step 2: Open browser
-  await open(verificationUrl).catch(() => {
-    // Silently fail if browser can't be opened - user can manually open URL
-  })
+  // Step 2: Open browser (windowsHide: true prevents cmd.exe flash on Windows)
+  const openCmd =
+    process.platform === "darwin"
+      ? `open "${verificationUrl}"`
+      : process.platform === "win32"
+        ? `start "" "${verificationUrl}"`
+        : `xdg-open "${verificationUrl}"`
+  exec(openCmd, { windowsHide: true })
 
   // Step 3: Return instructions and callback for TUI to handle
   return {

From bc4a7ce7e5b257248222e2b80aa8d6a3c08d2088 Mon Sep 17 00:00:00 2001
From: Mark IJbema <mark@kilocode.ai>
Date: Wed, 1 Apr 2026 16:20:19 +0200
Subject: [PATCH 2/2] fix(gateway): prevent shell injection in device auth URL
 opening

---
 packages/kilo-gateway/src/auth/device-auth-tui.ts | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/kilo-gateway/src/auth/device-auth-tui.ts b/packages/kilo-gateway/src/auth/device-auth-tui.ts
index 2fe54c01789..466aca7baaf 100644
--- a/packages/kilo-gateway/src/auth/device-auth-tui.ts
+++ b/packages/kilo-gateway/src/auth/device-auth-tui.ts
@@ -1,4 +1,4 @@
-import { exec } from "child_process"
+import { execFile } from "child_process"
 import type { DeviceAuthInitiateResponse, DeviceAuthPollResponse } from "../types.js"
 import { poll } from "./polling.js"
 import { getKiloProfile, getKiloDefaultModel } from "../api/profile.js"
@@ -71,13 +71,13 @@ export async function authenticateWithDeviceAuthTUI(inputs?: Record<string, stri
   const { code, verificationUrl, expiresIn } = authData
 
   // Step 2: Open browser (windowsHide: true prevents cmd.exe flash on Windows)
-  const openCmd =
+  const [cmd, ...args] =
     process.platform === "darwin"
-      ? `open "${verificationUrl}"`
+      ? ["open", verificationUrl]
       : process.platform === "win32"
-        ? `start "" "${verificationUrl}"`
-        : `xdg-open "${verificationUrl}"`
-  exec(openCmd, { windowsHide: true })
+        ? ["cmd", "/c", "start", "", verificationUrl]
+        : ["xdg-open", verificationUrl]
+  execFile(cmd, args, { windowsHide: true })
 
   // Step 3: Return instructions and callback for TUI to handle
   return {