Harden OAuth callback recovery

wrapper.js

@@ -1,5 +1,7 @@
 import http from 'node:http';
 
+const originalCreateServer = http.createServer.bind(http);
+const originalWriteHead = http.ServerResponse.prototype.writeHead;
 const originalEnd = http.ServerResponse.prototype.end;
 
 const layoutPatch = `<style id="layout-v3">
@@ -33,6 +35,30 @@ const layoutPatch = `<style id="layout-v3">
 }
 </style>`;
 
+http.createServer = function (...args) {
+  const listenerIndex = args.findIndex(value => typeof value === 'function');
+  if (listenerIndex >= 0) {
+    const listener = args[listenerIndex];
+    args[listenerIndex] = (req, res) => {
+      const pathname = String(req.url || '').split('?')[0];
+      if (pathname === '/favicon.ico') {
+        res.writeHead(204, { 'cache-control': 'public, max-age=86400' });
+        return res.end();
+      }
+      return listener(req, res);
+    };
+  }
+  return originalCreateServer(...args);
+};
+
+http.ServerResponse.prototype.writeHead = function (statusCode, ...args) {
+  if (statusCode === 400 && String(this.req?.url || '').startsWith('/callback')) {
+    this.setHeader('Location', '/login');
+    statusCode = 302;
+  }
+  return originalWriteHead.call(this, statusCode, ...args);
+};
+
 http.ServerResponse.prototype.end = function (chunk, encoding, callback) {
   if (typeof chunk === 'string') {
     chunk = chunk.replaceAll('Arrowstack Tasks', 'i love you tasks');