fix(auth): bind callback server to localhost for IPv4/IPv6 compat, fix nil deref

internal/auth/login.go

@@ -78,7 +78,7 @@ func buildManualAuthURL(codeChallenge, state string) string {
 
 func startCallbackServer(expectedState string) (port int, codeChan <-chan string, cleanup func(), err error) {
 	ch := make(chan string, 1)
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	ln, err := net.Listen("tcp", "localhost:0")
 	if err != nil {
 		return 0, nil, nil, err
 	}
@@ -145,8 +145,8 @@ func Login(ctx context.Context) (*Credential, error) {
 	var isManual bool
 
 	stdinCh := make(chan string, 1)
-	fi, _ := os.Stdin.Stat()
-	if (fi.Mode() & os.ModeCharDevice) != 0 {
+	fi, statErr := os.Stdin.Stat()
+	if statErr == nil && (fi.Mode()&os.ModeCharDevice) != 0 {
 		fmt.Print("If browser didn't open, paste the authorization code here: ")
 		go func() {
 			var line string