fix(web): harden balance banner redirect

[kilo-code-bot]

Summary

• Resolves CodeQL alert 268 by stopping the insufficient-balance server action from echoing a redirect target back to the browser.
• Navigates to a locally constructed internal credits route with encoded organization IDs after the return URL cookie is set.

Verification

Not manually verified; this is a non-visual redirect hardening and no local app session was started.

Visual Changes

N/A

Reviewer Notes

CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/268

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The PR correctly hardens the balance banner redirect by removing the server-action echo of creditsUrl and switching to a locally constructed client-side router.push, fully resolving the open redirect vector (CodeQL alert 268).

Files Reviewed (2 files)

• apps/web/src/components/shared/InsufficientBalanceBanner.actions.ts
• apps/web/src/components/shared/InsufficientBalanceBanner.tsx

Security Analysis

Root cause fixed: The original code passed creditsUrl as a parameter to the server action and received it back in the return value — a pattern CodeQL correctly flagged because client code was trusting a server-action return value to construct a redirect target. The fix moves creditsUrl construction entirely to the client side (where it was already derived) and uses router.push(creditsUrl) directly, breaking the trust-chain that caused the alert.

returnUrl (pathname) validation: usePathname() always returns an internal Next.js route path. setPaymentReturnUrl validates it server-side via isValidReturnUrl, which only accepts relative paths starting with / (not //). This chain is safe.

encodeURIComponent(organizationId): Correct defensive improvement; organization IDs in this codebase appear to be UUIDs, so this is harmless and appropriate.

router.push vs window.location.href: The switch from window.location.href to Next.js router.push is correct — it keeps navigation within the SPA, avoids a full page reload, and is the idiomatic approach for client components.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 515,017 tokens}

_{Review guidance: REVIEW.md from base branch main}