@georgedong32/ccs 7.67.1 → 8.0.0

package/dist/web-server/routes/cliproxy-auth-routes.js

@@ -1,48 +1,29 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getStartAuthNicknameError = exports.getStartAuthFailureMessage = exports.getStartUrlUnsupportedReason = void 0;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
+exports.getStartAuthNicknameError = exports.getStartAuthFailureMessage = exports.getStartUrlUnsupportedReason = exports.getKiroStartIDCValidationError = void 0;
 const express_1 = require("express");
-const auth_handler_1 = require("../../cliproxy/auth-handler");
-const project_selection_handler_1 = require("../../cliproxy/project-selection-handler");
-const auth_session_manager_1 = require("../../cliproxy/auth-session-manager");
-const stats_fetcher_1 = require("../../cliproxy/stats-fetcher");
-const account_manager_1 = require("../../cliproxy/account-manager");
-const proxy_target_resolver_1 = require("../../cliproxy/proxy-target-resolver");
-const remote_auth_fetcher_1 = require("../../cliproxy/remote-auth-fetcher");
-const unified_config_loader_1 = require("../../config/unified-config-loader");
+const auth_handler_1 = require("../../cliproxy/auth/auth-handler");
+const project_selection_handler_1 = require("../../cliproxy/auth/project-selection-handler");
+const auth_session_manager_1 = require("../../cliproxy/auth/auth-session-manager");
+const stats_fetcher_1 = require("../../cliproxy/services/stats-fetcher");
+const account_manager_1 = require("../../cliproxy/accounts/account-manager");
+const proxy_target_resolver_1 = require("../../cliproxy/proxy/proxy-target-resolver");
+const remote_auth_fetcher_1 = require("../../cliproxy/services/remote-auth-fetcher");
+const managed_model_prefixes_1 = require("../../cliproxy/ai-providers/managed-model-prefixes");
+const quota_response_cache_1 = require("../../cliproxy/quota/quota-response-cache");
 const kiro_import_1 = require("../../cliproxy/auth/kiro-import");
 const token_manager_1 = require("../../cliproxy/auth/token-manager");
+const gitlab_pat_response_1 = require("../../cliproxy/auth/gitlab-pat-response");
 const auth_types_1 = require("../../cliproxy/auth/auth-types");
 const provider_capabilities_1 = require("../../cliproxy/provider-capabilities");
 const profile_detector_1 = require("../../auth/profile-detector");
-const antigravity_responsibility_1 = require("../../cliproxy/antigravity-responsibility");
+const antigravity_responsibility_1 = require("../../cliproxy/auth/antigravity-responsibility");
 const route_helpers_1 = require("./route-helpers");
 const auth_middleware_1 = require("../middleware/auth-middleware");
+const config_loader_facade_1 = require("../../config/config-loader-facade");
+const oauth_handler_1 = require("../../cliproxy/auth/oauth-handler");
+const oauth_start_failure_guidance_1 = require("../../cliproxy/auth/oauth-start-failure-guidance");
+const binary_manager_1 = require("../../cliproxy/binary-manager");
 const router = (0, express_1.Router)();
 const MANUAL_AUTH_STATE_TTL_MS = 10 * 60 * 1000;
 const POLLED_AUTH_LOCAL_TOKEN_GRACE_MS = 15 * 1000;
@@ -102,55 +83,16 @@ function markManualAuthUpstreamCompleted(state, now = Date.now()) {
     pendingManualAuthState.set(state, pending);
     return now;
 }
-function listProviderTokenSnapshots(provider) {
-    const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
-    if (!fs.existsSync(tokenDir)) {
-        return [];
-    }
-    return fs
-        .readdirSync(tokenDir)
-        .filter((file) => file.endsWith('.json'))
-        .map((file) => {
-        const filePath = path.join(tokenDir, file);
-        if (!(0, token_manager_1.isTokenFileForProvider)(filePath, provider)) {
-            return null;
-        }
-        let email;
-        try {
-            const content = fs.readFileSync(filePath, 'utf8');
-            const parsed = JSON.parse(content);
-            email = typeof parsed.email === 'string' ? parsed.email : undefined;
-        }
-        catch {
-            email = undefined;
-        }
-        const stats = fs.statSync(filePath);
-        return {
-            file,
-            mtimeMs: stats.mtimeMs,
-            email,
-        };
-    })
-        .filter((snapshot) => snapshot !== null)
-        .sort((left, right) => right.mtimeMs - left.mtimeMs);
-}
 function findNewTokenSnapshotForPendingAuth(provider, pending) {
-    const knownTokenMtimes = new Map(pending.knownTokenFiles.map((snapshot) => [snapshot.file, snapshot.mtimeMs]));
-    return (listProviderTokenSnapshots(provider).find((snapshot) => {
-        const knownMtime = knownTokenMtimes.get(snapshot.file);
-        if (knownMtime === undefined) {
-            return true;
-        }
-        if (!pending.expectedAccountId) {
-            return false;
-        }
-        return snapshot.mtimeMs > knownMtime + 1;
-    }) || null);
+    return (0, token_manager_1.findNewTokenSnapshot)((0, token_manager_1.listProviderTokenSnapshots)(provider), pending.knownTokenFiles, pending.expectedAccountId);
 }
 function shouldKeepWaitingForLocalToken(state, pending, now = Date.now()) {
     const upstreamCompletedAt = pending.upstreamCompletedAt ?? markManualAuthUpstreamCompleted(state, now);
     return (upstreamCompletedAt !== null && now - upstreamCompletedAt < POLLED_AUTH_LOCAL_TOKEN_GRACE_MS);
 }
+function invalidateQuotaForRegisteredAccount(account) {
+    (0, quota_response_cache_1.invalidateQuotaCache)(account.provider, account.id);
+}
 function parseKiroMethod(raw) {
     if (raw === undefined || raw === null) {
         return { method: (0, auth_types_1.normalizeKiroAuthMethod)(), invalid: false };
@@ -167,9 +109,57 @@ function parseKiroMethod(raw) {
     }
     return { method: (0, auth_types_1.normalizeKiroAuthMethod)(normalized), invalid: false };
 }
+function parseKiroIDCFlow(raw) {
+    if (raw === undefined || raw === null || raw === '') {
+        return { flow: (0, auth_types_1.normalizeKiroIDCFlow)(), invalid: false };
+    }
+    if (typeof raw !== 'string') {
+        return { flow: (0, auth_types_1.normalizeKiroIDCFlow)(), invalid: true };
+    }
+    const normalized = raw.trim().toLowerCase();
+    if (!(0, auth_types_1.isKiroIDCFlow)(normalized)) {
+        return { flow: (0, auth_types_1.normalizeKiroIDCFlow)(), invalid: true };
+    }
+    return { flow: (0, auth_types_1.normalizeKiroIDCFlow)(normalized), invalid: false };
+}
+function parseGitLabAuthMode(raw) {
+    if (raw === undefined || raw === null || raw === '') {
+        return { mode: 'oauth', invalid: false };
+    }
+    if (typeof raw !== 'string') {
+        return { mode: 'oauth', invalid: true };
+    }
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === 'oauth' || normalized === 'pat') {
+        return { mode: normalized, invalid: false };
+    }
+    return { mode: 'oauth', invalid: true };
+}
+function getKiroStartIDCValidationError(options) {
+    if (options.kiroMethod !== 'idc') {
+        return null;
+    }
+    if (options.invalidKiroIDCFlow) {
+        return {
+            error: 'Invalid kiroIDCFlow. Supported: authcode, device',
+            code: 'INVALID_KIRO_IDC_FLOW',
+        };
+    }
+    if (!options.kiroIDCStartUrl) {
+        return {
+            error: 'Kiro IDC login requires kiroIDCStartUrl',
+            code: 'MISSING_KIRO_IDC_START_URL',
+        };
+    }
+    return null;
+}
+exports.getKiroStartIDCValidationError = getKiroStartIDCValidationError;
 function getStartUrlUnsupportedReason(provider, options) {
     if (provider === 'kiro') {
         const kiroMethod = options?.kiroMethod ?? (0, auth_types_1.normalizeKiroAuthMethod)();
+        if (kiroMethod === 'idc') {
+            return "Kiro method 'idc' uses CLI auth flow. Use /api/cliproxy/auth/kiro/start instead.";
+        }
         if (kiroMethod === 'aws-authcode') {
             return "Kiro method 'aws-authcode' uses CLI auth flow. Use /api/cliproxy/auth/kiro/start instead.";
         }
@@ -178,6 +168,9 @@ function getStartUrlUnsupportedReason(provider, options) {
         }
         return null;
     }
+    if ((0, provider_capabilities_1.isBrowserUrlAuthProvider)(provider)) {
+        return null;
+    }
     if ((0, provider_capabilities_1.getOAuthFlowType)(provider) === 'device_code') {
         return `Provider '${provider}' uses Device Code flow. Use /api/cliproxy/auth/${provider}/start instead.`;
     }
@@ -473,6 +466,16 @@ router.post('/:provider/start', async (req, res) => {
     const nicknameRaw = typeof requestBody.nickname === 'string' ? requestBody.nickname : undefined;
     const noIncognitoBody = typeof requestBody.noIncognito === 'boolean' ? requestBody.noIncognito : undefined;
     const kiroMethodRaw = requestBody.kiroMethod;
+    const kiroIDCStartUrl = typeof requestBody.kiroIDCStartUrl === 'string'
+        ? requestBody.kiroIDCStartUrl.trim()
+        : undefined;
+    const kiroIDCRegion = typeof requestBody.kiroIDCRegion === 'string' ? requestBody.kiroIDCRegion.trim() : undefined;
+    const kiroIDCFlowRaw = requestBody.kiroIDCFlow;
+    const gitlabAuthModeRaw = requestBody.gitlabAuthMode;
+    const gitlabBaseUrl = typeof requestBody.gitlabBaseUrl === 'string' ? requestBody.gitlabBaseUrl.trim() : undefined;
+    const gitlabPersonalAccessToken = typeof requestBody.gitlabPersonalAccessToken === 'string'
+        ? requestBody.gitlabPersonalAccessToken.trim()
+        : undefined;
     const riskAcknowledgement = requestBody.riskAcknowledgement;
     const target = (0, proxy_target_resolver_1.getProxyTarget)();
     if (target.isRemote) {
@@ -482,6 +485,8 @@ router.post('/:provider/start', async (req, res) => {
     // Trim nickname for consistency with CLI (oauth-handler.ts trims input)
     const nickname = nicknameRaw?.trim();
     const { method: kiroMethod, invalid: invalidKiroMethod } = parseKiroMethod(kiroMethodRaw);
+    const { flow: kiroIDCFlow, invalid: invalidKiroIDCFlow } = parseKiroIDCFlow(kiroIDCFlowRaw);
+    const { mode: gitlabAuthMode, invalid: invalidGitLabAuthMode } = parseGitLabAuthMode(gitlabAuthModeRaw);
     // Validate provider
     if (!validProviders.includes(provider)) {
         res.status(400).json({ error: `Invalid provider: ${provider}` });
@@ -489,11 +494,29 @@ router.post('/:provider/start', async (req, res) => {
     }
     if (provider === 'kiro' && invalidKiroMethod) {
         res.status(400).json({
-            error: 'Invalid kiroMethod. Supported: aws, aws-authcode, google, github',
+            error: 'Invalid kiroMethod. Supported: aws, aws-authcode, google, github, idc',
             code: 'INVALID_KIRO_METHOD',
         });
         return;
     }
+    if (provider === 'gitlab' && invalidGitLabAuthMode) {
+        res.status(400).json({
+            error: 'Invalid gitlabAuthMode. Supported: oauth, pat',
+            code: 'INVALID_GITLAB_AUTH_MODE',
+        });
+        return;
+    }
+    if (provider === 'kiro') {
+        const kiroIDCValidationError = getKiroStartIDCValidationError({
+            kiroMethod,
+            kiroIDCStartUrl,
+            invalidKiroIDCFlow,
+        });
+        if (kiroIDCValidationError) {
+            res.status(400).json(kiroIDCValidationError);
+            return;
+        }
+    }
     if (provider === 'agy' && !(0, antigravity_responsibility_1.isAntigravityResponsibilityBypassEnabled)()) {
         const validation = (0, antigravity_responsibility_1.validateAntigravityRiskAcknowledgement)(riskAcknowledgement);
         if (!validation.valid) {
@@ -504,6 +527,73 @@ router.post('/:provider/start', async (req, res) => {
             return;
         }
     }
+    if (provider === 'gitlab' && gitlabAuthMode === 'pat') {
+        if (!gitlabPersonalAccessToken) {
+            res.status(400).json({
+                error: 'gitlabPersonalAccessToken is required when gitlabAuthMode=pat',
+                code: 'MISSING_GITLAB_PAT',
+            });
+            return;
+        }
+        try {
+            const localProvider = provider;
+            const knownTokenFiles = (0, token_manager_1.listProviderTokenSnapshots)(localProvider);
+            const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, '/v0/management/gitlab-auth-url'), {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(0, proxy_target_resolver_1.buildManagementHeaders)(target),
+                },
+                body: JSON.stringify({
+                    ...(gitlabBaseUrl ? { base_url: gitlabBaseUrl } : {}),
+                    personal_access_token: gitlabPersonalAccessToken,
+                }),
+            });
+            const responseBody = await response.text();
+            const parsedResponse = (0, gitlab_pat_response_1.parseGitLabPatAuthResponse)(response.ok, response.status, responseBody, gitlabPersonalAccessToken);
+            if (!parsedResponse.ok) {
+                res.status(response.ok ? 400 : response.status).json({
+                    error: parsedResponse.errorMessage || 'GitLab PAT authentication failed',
+                });
+                return;
+            }
+            const tokenSnapshot = (0, token_manager_1.findNewTokenSnapshot)((0, token_manager_1.listProviderTokenSnapshots)(localProvider), knownTokenFiles);
+            if (!tokenSnapshot) {
+                res.status(409).json({
+                    error: 'GitLab PAT authentication completed, but CCS could not find the saved token.',
+                });
+                return;
+            }
+            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), nickname, false, tokenSnapshot.file);
+            if (!account) {
+                res.status(409).json({
+                    error: 'GitLab PAT authentication succeeded, but account registration failed.',
+                });
+                return;
+            }
+            try {
+                await (0, managed_model_prefixes_1.ensureManagedModelPrefixes)([account.provider]);
+            }
+            catch {
+                // Keep auth success path non-fatal when prefix repair cannot run.
+            }
+            res.json({
+                success: true,
+                account: {
+                    id: account.id,
+                    email: account.email,
+                    nickname: account.nickname,
+                    provider: account.provider,
+                    isDefault: account.isDefault,
+                },
+            });
+            return;
+        }
+        catch (error) {
+            respondInternalError(res, error, 'Failed to start GitLab PAT flow.');
+            return;
+        }
+    }
     const existingAccounts = (0, account_manager_1.getProviderAccounts)(provider);
     const nicknameError = getStartAuthNicknameError(provider, nickname, existingAccounts);
     if (nicknameError) {
@@ -514,7 +604,7 @@ router.post('/:provider/start', async (req, res) => {
     // Default to true (use normal browser) for reliability - incognito often fails
     let noIncognito = true;
     if (provider === 'kiro') {
-        const config = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
+        const config = (0, config_loader_facade_1.loadOrCreateUnifiedConfig)();
         noIncognito = noIncognitoBody ?? config.cliproxy?.kiro_no_incognito ?? true;
     }
     try {
@@ -525,10 +615,21 @@ router.post('/:provider/start', async (req, res) => {
             nickname: nickname || undefined,
             acceptAgyRisk: provider === 'agy',
             kiroMethod: provider === 'kiro' ? kiroMethod : undefined,
+            kiroIDCStartUrl: provider === 'kiro' ? kiroIDCStartUrl : undefined,
+            kiroIDCRegion: provider === 'kiro' ? kiroIDCRegion : undefined,
+            kiroIDCFlow: provider === 'kiro' && kiroMethod === 'idc' ? kiroIDCFlow : undefined,
+            gitlabAuthMode: provider === 'gitlab' ? gitlabAuthMode : undefined,
+            gitlabBaseUrl: provider === 'gitlab' ? gitlabBaseUrl : undefined,
             fromUI: true, // Enable project selection prompt in UI
             noIncognito, // Kiro: use normal browser if enabled
         });
         if (account) {
+            try {
+                await (0, managed_model_prefixes_1.ensureManagedModelPrefixes)([account.provider]);
+            }
+            catch {
+                // Keep OAuth success path non-fatal when prefix repair cannot run.
+            }
             res.json({
                 success: true,
                 account: {
@@ -662,9 +763,12 @@ router.post('/:provider/start-url', async (req, res) => {
     const requestBody = req.body && typeof req.body === 'object' ? req.body : {};
     const nicknameRaw = typeof requestBody.nickname === 'string' ? requestBody.nickname : undefined;
     const kiroMethodRaw = requestBody.kiroMethod;
+    const gitlabAuthModeRaw = requestBody.gitlabAuthMode;
+    const gitlabBaseUrl = typeof requestBody.gitlabBaseUrl === 'string' ? requestBody.gitlabBaseUrl.trim() : undefined;
     const riskAcknowledgement = requestBody.riskAcknowledgement;
     const nickname = nicknameRaw?.trim();
     const { method: kiroMethod, invalid: invalidKiroMethod } = parseKiroMethod(kiroMethodRaw);
+    const { mode: gitlabAuthMode, invalid: invalidGitLabAuthMode } = parseGitLabAuthMode(gitlabAuthModeRaw);
     // Check remote mode
     const target = (0, proxy_target_resolver_1.getProxyTarget)();
     if (target.isRemote) {
@@ -678,11 +782,25 @@ router.post('/:provider/start-url', async (req, res) => {
     }
     if (provider === 'kiro' && invalidKiroMethod) {
         res.status(400).json({
-            error: 'Invalid kiroMethod. Supported: aws, aws-authcode, google, github',
+            error: 'Invalid kiroMethod. Supported: aws, aws-authcode, google, github, idc',
             code: 'INVALID_KIRO_METHOD',
         });
         return;
     }
+    if (provider === 'gitlab' && invalidGitLabAuthMode) {
+        res.status(400).json({
+            error: 'Invalid gitlabAuthMode. Supported: oauth, pat',
+            code: 'INVALID_GITLAB_AUTH_MODE',
+        });
+        return;
+    }
+    if (provider === 'gitlab' && gitlabAuthMode === 'pat') {
+        res.status(400).json({
+            error: 'GitLab PAT login must use /api/cliproxy/auth/gitlab/start',
+            code: 'GITLAB_PAT_REQUIRES_START',
+        });
+        return;
+    }
     if (provider === 'agy' && !(0, antigravity_responsibility_1.isAntigravityResponsibilityBypassEnabled)()) {
         const validation = (0, antigravity_responsibility_1.validateAntigravityRiskAcknowledgement)(riskAcknowledgement);
         if (!validation.valid) {
@@ -706,21 +824,61 @@ router.post('/:provider/start-url', async (req, res) => {
         res.status(400).json(nicknameError);
         return;
     }
+    // Phase 3: Pre-fetch credential guard for Plus-backend OAuth providers (gemini, agy).
+    // Returns null for providers not in the table or when backend is not 'plus'.
+    const credentialError = (0, oauth_handler_1.getPlusOAuthCredentialError)(provider, (0, binary_manager_1.getStoredConfiguredBackend)());
+    if (credentialError) {
+        console.error(`[cliproxy-auth-routes] start-url credential guard fired for provider=${provider}: ${credentialError}`);
+        res.status(400).json({
+            error: 'plus_oauth_credentials_missing',
+            provider,
+            message: credentialError,
+        });
+        return;
+    }
+    let startPath = null;
     try {
         const authUrlProvider = auth_types_1.CLIPROXY_AUTH_URL_PROVIDER_MAP[provider] || provider;
-        const kiroQuery = provider === 'kiro'
-            ? `&method=${encodeURIComponent((0, auth_types_1.toKiroManagementMethod)(kiroMethod))}`
+        const kiroManagementMethod = provider === 'kiro' ? (0, auth_types_1.toKiroManagementMethod)(kiroMethod) : null;
+        const kiroQuery = provider === 'kiro' && kiroManagementMethod
+            ? `&method=${encodeURIComponent(kiroManagementMethod)}`
             : '';
+        const gitlabQuery = provider === 'gitlab' && gitlabBaseUrl
+            ? `&base_url=${encodeURIComponent(gitlabBaseUrl)}`
+            : '';
+        startPath = `/v0/management/${authUrlProvider}-auth-url?is_webui=true${kiroQuery}${gitlabQuery}`;
         // Call CLIProxyAPI to start OAuth and get auth URL
         // CLIProxyAPI management routes are under /v0/management prefix
-        const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, `/v0/management/${authUrlProvider}-auth-url?is_webui=true${kiroQuery}`), { headers: (0, proxy_target_resolver_1.buildManagementHeaders)(target) });
+        const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, startPath), {
+            headers: (0, proxy_target_resolver_1.buildManagementHeaders)(target),
+        });
         if (!response.ok) {
             const error = await response.text();
-            res.status(response.status).json({ error: error || 'Failed to start OAuth' });
+            const guidance = (0, oauth_start_failure_guidance_1.buildOAuthStartFailureGuidance)(provider, {
+                target,
+                startPath,
+                cause: error || `HTTP ${response.status}`,
+            });
+            res.status(response.status).json(guidance);
             return;
         }
         const data = (await response.json());
         const authUrl = data.url || data.auth_url;
+        // Phase 4: Post-fetch auth-URL guard — detect Plus emitting an OAuth URL with empty client_id.
+        // Only fires for table-listed providers (gemini, agy); returns null for all others.
+        if (authUrl) {
+            const authUrlError = (0, oauth_handler_1.getPlusAuthUrlCredentialError)(provider, authUrl);
+            if (authUrlError) {
+                const redactedUrl = authUrl.split('?')[0];
+                console.error(`[cliproxy-auth-routes] Plus emitted OAuth URL without client_id for provider=${provider} url=${redactedUrl}`);
+                res.status(502).json({
+                    error: 'plus_oauth_url_missing_client_id',
+                    provider,
+                    message: authUrlError,
+                });
+                return;
+            }
+        }
         const oauthState = data.state || parseAuthUrlState(authUrl);
         // Some upstream flows return state first and provide auth_url in subsequent status polling.
         if (!authUrl && !oauthState) {
@@ -732,7 +890,7 @@ router.post('/:provider/start-url', async (req, res) => {
         if (oauthState) {
             rememberManualAuthState(oauthState, {
                 nickname: nickname || undefined,
-                knownTokenFiles: listProviderTokenSnapshots(provider),
+                knownTokenFiles: (0, token_manager_1.listProviderTokenSnapshots)(provider),
             });
         }
         res.json({
@@ -743,7 +901,24 @@ router.post('/:provider/start-url', async (req, res) => {
         });
     }
     catch (error) {
-        respondInternalError(res, error, 'CLIProxyAPI not reachable.', 503);
+        if (error instanceof SyntaxError) {
+            console.error(`[cliproxy-auth-routes] Invalid OAuth start response for provider=${provider}: ${error.message}`);
+            res.status(502).json({
+                error: 'cliproxy_oauth_start_invalid_response',
+                provider,
+                message: 'CLIProxyAPI returned an invalid OAuth start response.',
+                details: error.message,
+            });
+            return;
+        }
+        const authUrlProvider = auth_types_1.CLIPROXY_AUTH_URL_PROVIDER_MAP[provider] || provider;
+        const guidance = (0, oauth_start_failure_guidance_1.buildOAuthStartFailureGuidance)(provider, {
+            target,
+            startPath: startPath ?? `/v0/management/${authUrlProvider}-auth-url?is_webui=true`,
+            cause: error,
+        });
+        console.error(`[cliproxy-auth-routes] ${guidance.message} ${guidance.details}`);
+        res.status(503).json(guidance);
     }
 });
 /**
@@ -800,7 +975,13 @@ router.get('/:provider/status', async (req, res) => {
                 });
                 return;
             }
-            pendingManualAuthState.delete(state);
+            try {
+                await (0, managed_model_prefixes_1.ensureManagedModelPrefixes)([account.provider]);
+            }
+            catch {
+                // Keep manual callback success path non-fatal when prefix repair cannot run.
+            }
+            invalidateQuotaForRegisteredAccount(account);
             res.json({
                 status: 'ok',
                 account: {
@@ -811,6 +992,7 @@ router.get('/:provider/status', async (req, res) => {
                     isDefault: account.isDefault,
                 },
             });
+            pendingManualAuthState.delete(state);
             return;
         }
         res.json(data);
@@ -922,8 +1104,14 @@ router.post('/:provider/submit-callback', async (req, res) => {
                 return;
             }
             if (parsed.state) {
-                pendingManualAuthState.delete(parsed.state);
+                try {
+                    await (0, managed_model_prefixes_1.ensureManagedModelPrefixes)([account.provider]);
+                }
+                catch {
+                    // Keep manual callback success path non-fatal when prefix repair cannot run.
+                }
             }
+            invalidateQuotaForRegisteredAccount(account);
             res.json({
                 success: true,
                 account: {
@@ -934,6 +1122,9 @@ router.post('/:provider/submit-callback', async (req, res) => {
                     isDefault: account.isDefault,
                 },
             });
+            if (parsed.state) {
+                pendingManualAuthState.delete(parsed.state);
+            }
             return;
         }
         const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), undefined, false, undefined);
@@ -943,6 +1134,7 @@ router.post('/:provider/submit-callback', async (req, res) => {
             });
             return;
         }
+        invalidateQuotaForRegisteredAccount(account);
         res.json({
             success: true,
             account: {