feat: enhance OAuth flow validation and improve security checks; add credential read blocking and git operation safeguards

src/app/bgbash/job.rs

@@ -66,6 +66,19 @@ pub fn spawn_bash_job(command: String) -> BashJob {
         // Send the child PID back to the caller so bash_kill can terminate it
         let _ = pid_tx.send(child.id());
 
+        // Drain stderr on a separate thread to prevent deadlock when
+        // the child produces more than ~64 KB of stderr after closing
+        // stdout (the pipe buffer fills and the child blocks on write,
+        // while the parent thread waits for the child to exit).
+        let _stderr_drain = child.stderr.take().map(|stderr| {
+            std::thread::spawn(move || {
+                let reader = std::io::BufReader::new(stderr);
+                for _line in reader.lines().map_while(Result::ok) {
+                    // Discard stderr lines to prevent pipe buffer deadlock.
+                }
+            })
+        });
+
         if let Some(stdout) = child.stdout.take() {
             let reader = std::io::BufReader::new(stdout);
             for line in reader.lines().map_while(Result::ok) {