fix(security): HTML-escape error in OAuth callback response

[NP-compete]

Summary

• Apply html.escape() to the error string in _callback_html() before embedding in the HTML response
• Defense-in-depth hardening; all current callers pass hardcoded strings

Closes #222

Test plan

• test_error_html_escapes_tags -- verifies <script> tags are escaped to <script>
• All 12 OAuth handler tests pass

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 8955767b-6f85-4823-8c9b-0aa40b56e624

📥 Commits

Reviewing files that changed from the base of the PR and between c2ee694 and 79e5143.

📒 Files selected for processing (1)

• deep_agent/aegra/mcp_oauth_handlers.py

---

Walkthrough

The OAuth callback error page now applies html.escape() to error messages before inserting them into HTML. Unit tests verify that script tags appear escaped in the rendered response.

Suggested reviewers: anish701, pratistha19

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the security fix for HTML-escaping OAuth callback errors.
Description check	✅ Passed	The description accurately explains the HTML-escaping change, security rationale, linked issue, and test coverage.
Linked Issues check	✅ Passed	The implementation and test cover issue #222 by escaping the OAuth callback error before HTML embedding.
Out of Scope Changes check	✅ Passed	The changes are limited to the requested OAuth callback escaping fix and its focused test coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

🚀 Post-Merge Actions

• Update changelog

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[vishnusrichand]

LGTM

[coderabbitai]

🚀 Post-Merge Actions

• ❌ Update changelog — Changes were generated but the follow-up pull request could not be opened. Stacked pull requests cannot be created when the source branch lives on a fork — for security reasons, CodeRabbit cannot push to the fork's repository. Re-run this command from a branch in the upstream repository, or open the PR from a branch on the same repository.

@NP-compete one or more post-merge actions failed.