fix(kiro): validate region to prevent SSRF (GHSA-6mwv-4mrm-5p3m)

Reject non-AWS region values before interpolating them into upstream
URLs and stop reflecting upstream response bodies to the client.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/lib/oauth/providers.js

@@ -18,6 +18,7 @@ import {
   ANTIGRAVITY_CONFIG,
   GITHUB_CONFIG,
   KIRO_CONFIG,
+  assertValidAwsRegion,
   CURSOR_CONFIG,
   KIMI_CODING_CONFIG,
   KILOCODE_CONFIG,
@@ -792,6 +793,7 @@ const PROVIDERS = {
     requestDeviceCode: async (config, codeChallenge, options = {}) => {
       const trimmedRegion = typeof options.region === "string" ? options.region.trim() : "";
       const region = trimmedRegion || "us-east-1";
+      assertValidAwsRegion(region);
       const trimmedStartUrl = typeof options.startUrl === "string" ? options.startUrl.trim() : "";
       const startUrl = trimmedStartUrl || config.startUrl;
       const authMethod = options.authMethod === "idc" ? "idc" : "builder-id";
@@ -860,6 +862,7 @@ const PROVIDERS = {
     },
     pollToken: async (config, deviceCode, codeVerifier, extraData) => {
       const region = extraData?._region || "us-east-1";
+      assertValidAwsRegion(region);
       const tokenUrl = `https://oidc.${region}.amazonaws.com/token`;
       const response = await fetch(tokenUrl, {
         method: "POST",