bug: history.replaceState drops existing query params and hash after OAuth callback

[perry-the-pr-reviewer]

Bug

openrouter-oauth/SKILL.md line 77 recommends this URL cleanup after the OAuth callback:

history.replaceState({}, "", location.pathname)

location.pathname strips everything after the path — including existing query params and the hash fragment. This breaks:

• SPA hash routing (e.g. /#/dashboard becomes /)
• Any other query params the app had before the OAuth redirect
• Apps using ? params for state management

Fix

Delete only the code param and preserve everything else:

const u = new URL(location.href);
u.searchParams.delete("code");
u.searchParams.delete("state"); // if used
history.replaceState({}, "", u.toString());

Reviewed by Perry