@yina-npm/openrouterx 0.4.56 → 0.4.72

package/app/public/i18n/literals/zh-CN.json

@@ -194,6 +194,8 @@
   "Est. Cost": "预计。成本",
   "Factory Droid - Manual Configuration": "Factory Droid - 手动配置",
   "Factory Droid CLI not installed": "Factory Droid CLI 未安装",
+  "Fetch Qoder Models": "获取 Qoder 模型",
+  "Fetching...": "获取中...",
   "Failed to load usage statistics.": "无法加载使用情况统计信息。",
   "Features": "功能特性",
   "Flush Interval (ms)": "刷新间隔（毫秒）",
@@ -322,6 +324,7 @@
   "Paste refresh token from Kiro IDE.": "从 Kiro IDE 粘贴刷新令牌。",
   "Paused": "已暂停",
   "Please add and connect providers first to configure CLI tools.": "请先添加并连接提供商以配置 CLI 工具。",
+  "Please add an active Qoder connection first": "请先添加一个活跃的 Qoder 连接",
   "Please copy the URL from the address bar and paste it in the application.": "请复制地址栏中的 URL 并将其粘贴到应用程序中。",
   "Please enter a Proxy URL to test": "请输入代理 URL 进行测试",
   "Please install Claude CLI to use this feature.": "请安装 Claude CLI 才能使用此功能。",
@@ -842,9 +845,6 @@
   "Windows: Run OpenrouterX terminal as Administrator": "Windows：以管理员身份运行 OpenrouterX 终端",
   "Windows: Run terminal (OpenrouterX) as Administrator to enable MITM": "Windows：以管理员身份运行终端 (OpenrouterX) 以启用 MITM",
   "关注UI": "关注UI",
-  "Open New Antigravity": "新开 Antigravity",
-  "Open a new Antigravity window with MITM enabled": "新开一个启用 MITM 的 Antigravity 窗口",
-  "Opened new Antigravity": "已新开 Antigravity",
   "Open New": "新开",
   "Focus UI": "关注UI",
   "Amp CLI": "Amp CLI",
@@ -946,29 +946,5 @@
   "Close": "关闭",
   "⚠️ Risk Notice: This provider uses a subscription/OAuth session not officially licensed for proxy/router use. Account may be restricted or banned. Use at your own risk.": "⚠️ 风险提示：此提供商使用的订阅/OAuth 会话未获官方授权用于代理/路由器使用。账户可能被限制或封禁。使用风险自负。",
   "⚠️ MITM intercepts HTTPS traffic of IDE tools (Antigravity, GitHub Copilot, Kiro) via local CA to redirect requests to your providers. May violate ToS → account ban. Use at your own risk.": "⚠️ MITM 通过本地 CA 拦截 IDE 工具（Antigravity、GitHub Copilot、Kiro）的 HTTPS 流量，将请求重定向到您的提供商。可能违反 ToS → 账户封禁风险。使用风险自负。",
-  "Auto Routes": "自动路由",
-  "Use these routes as the OpenAI-compatible model field, or run the generated curl to verify routing.": "将这些路由作为 OpenAI 兼容的 model 字段使用，或运行生成的 curl 验证路由。",
-  "Virtual combo": "虚拟组合",
-  "Balanced": "均衡",
-  "Default active provider fallback": "默认活跃提供商回退",
-  "Coding": "编码",
-  "Prioritizes coding-capable models": "优先使用适合编码的模型",
-  "Fast": "快速",
-  "Low-latency route for quick tasks": "适合快速任务的低延迟路由",
-  "Cheap": "低价",
-  "Cost-focused active route": "优先控制成本的活跃路由",
-  "Offline": "离线",
-  "Smart": "智能",
-  "Reasoning-oriented route": "偏推理能力的路由",
-  "LKGP": "最近可用",
-  "Last-known-good provider route": "最近验证可用的提供商路由",
-  "Test passed": "测试通过",
-  "Test failed": "测试失败",
-  "Test curl": "测试 curl",
-  "Copy curl": "复制 curl",
-  "Test route": "测试路由",
-  "Copy model ID": "复制模型 ID",
-  "Route responded": "路由已响应",
-  "Provider responded without completion choices yet": "提供商已响应，但暂未返回 completion choices",
-  "Provider responded without message content yet": "提供商已响应，但暂未返回消息内容"
+  "Endpoint is exposed without an API key.": "端点未设置 API 密钥即对外暴露。"
 }

package/app/public/i18n/literals/zh-TW.json

@@ -253,36 +253,10 @@
   "warning": "警告",
   "Wi-Fi status": "Wi-Fi 狀態",
   "关注UI": "關注UI",
-  "Open New Antigravity": "新開 Antigravity",
-  "Open a new Antigravity window with MITM enabled": "新開一個啟用 MITM 的 Antigravity 視窗",
-  "Opened new Antigravity": "已新開 Antigravity",
   "Open New": "新開",
   "Focus UI": "關注UI",
   "Click to add, click again to remove. Changes are saved automatically.": "點擊新增，再次點擊移除。變更將自動儲存。",
   "⚠️ Risk Notice: This provider uses a subscription/OAuth session not officially licensed for proxy/router use. Account may be restricted or banned. Use at your own risk.": "⚠️ 風險提示：此提供商使用的訂閱/OAuth 工作階段未獲官方授權用於代理/路由器使用。帳戶可能被限制或封禁。使用風險自負。",
   "⚠️ MITM intercepts HTTPS traffic of IDE tools (Antigravity, GitHub Copilot, Kiro) via local CA to redirect requests to your providers. May violate ToS → account ban. Use at your own risk.": "⚠️ MITM 透過本地 CA 攔截 IDE 工具（Antigravity、GitHub Copilot、Kiro）的 HTTPS 流量，將請求重新導向到您的提供商。可能違反 ToS → 帳戶封禁風險。使用風險自負。",
-  "Auto Routes": "自動路由",
-  "Use these routes as the OpenAI-compatible model field, or run the generated curl to verify routing.": "將這些路由作為 OpenAI 相容的 model 欄位使用，或執行產生的 curl 驗證路由。",
-  "Virtual combo": "虛擬組合",
-  "Balanced": "均衡",
-  "Default active provider fallback": "預設啟用供應商回退",
-  "Coding": "程式碼",
-  "Prioritizes coding-capable models": "優先使用適合程式碼的模型",
-  "Fast": "快速",
-  "Low-latency route for quick tasks": "適合快速任務的低延遲路由",
-  "Cheap": "低成本",
-  "Cost-focused active route": "優先控制成本的啟用路由",
-  "Smart": "智慧",
-  "Reasoning-oriented route": "偏推理能力的路由",
-  "LKGP": "最近可用",
-  "Last-known-good provider route": "最近驗證可用的供應商路由",
-  "Test passed": "測試通過",
-  "Test failed": "測試失敗",
-  "Test curl": "測試 curl",
-  "Copy curl": "複製 curl",
-  "Test route": "測試路由",
-  "Copy model ID": "複製模型 ID",
-  "Route responded": "路由已回應",
-  "Provider responded without completion choices yet": "提供商已回應，但暫未返回 completion choices",
-  "Provider responded without message content yet": "提供商已回應，但暫未返回訊息內容"
+  "Endpoint is exposed without an API key.": "端點未設定 API 金鑰即對外暴露。"
 }

package/app/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/Users/bytedance/Documents/Projects/9router","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":17,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.mjs","serverExternalPackages":["better-sqlite3","sql.js","node:sqlite","bun:sqlite"],"turbopack":{"root":"/Users/bytedance/Documents/Projects/9router"},"outputFileTracingExcludes":{"*":["./gitbook/**/*"]},"outputFileTracingIncludes":{"*":["./node_modules/sql.js/dist/sql-wasm.wasm"]},"distDirRoot":".next","_originalRewrites":{"beforeFiles":[],"afterFiles":[{"source":"/v1/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1/v1","destination":"/api/v1"},{"source":"/codex/:path*","destination":"/api/v1/responses"},{"source":"/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1","destination":"/api/v1"}],"fallback":[]}}
+const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/Users/bytedance/Documents/Projects/9router","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":17,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":134217728,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.mjs","serverExternalPackages":["better-sqlite3","sql.js","node:sqlite","bun:sqlite"],"turbopack":{"root":"/Users/bytedance/Documents/Projects/9router"},"outputFileTracingExcludes":{"*":["./gitbook/**/*"]},"outputFileTracingIncludes":{"*":["./node_modules/sql.js/dist/sql-wasm.wasm"]},"distDirRoot":".next","_originalRewrites":{"beforeFiles":[],"afterFiles":[{"source":"/v1/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1/v1","destination":"/api/v1"},{"source":"/codex/:path*","destination":"/api/v1/responses"},{"source":"/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1","destination":"/api/v1"}],"fallback":[]}}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/app/src/lib/oauth/services/qoder.js

@@ -0,0 +1,216 @@
+import {
+  QODER_DEVICE_TOKEN_URL,
+  QODER_LOGIN_URL,
+  QODER_USERINFO_URL,
+} from "../../qoder/constants.js";
+import crypto from "crypto";
+import { v4 as uuidv4 } from "uuid";
+
+/**
+ * Qoder OAuth Service
+ * Implements the device-token flow:
+ *   1. Generate PKCE pair + nonce + machine_id locally.
+ *   2. Open https://qoder.com/device/selectAccounts?challenge=...&nonce=...
+ *      in the user's browser.
+ *   3. Poll openapi.qoder.sh/api/v1/deviceToken/poll until the user authorizes
+ *      and the upstream returns a `dt-...` access token.
+ *
+ * Tokens live ~30 days; refresh is a no-op (the upstream refresh endpoint
+ * returns 403 for our flow). Users re-run login when expired.
+ *
+ * Mirrors the structure of KiroService — the COSY signing / WAF-bypass body
+ * encoding / chat protocol live separately in src/lib/qoder/ because they're
+ * used by every signed request, not just OAuth.
+ */
+
+// Timeout for OAuth helper calls. The OAuth modal polls every 2s for up to
+// 5 minutes; an individual request that stalls beyond this is treated as a
+// failed poll attempt and the next poll iteration retries.
+const FETCH_TIMEOUT_MS = 15_000;
+
+function base64Url(buf) {
+  return buf
+    .toString("base64")
+    .replace(/=/g, "")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_");
+}
+
+/**
+ * Wrap fetch with an AbortController-based timeout. Without this, a stalled
+ * upstream socket hangs on Node's default keepalive timeout (minutes) and
+ * abandoned polls accumulate hung sockets.
+ */
+async function fetchWithTimeout(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort("timeout"), FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export class QoderService {
+  /**
+   * Generate a PKCE verifier + S256 challenge pair.
+   * Uses 32 random bytes (matches qodercli/Veria).
+   */
+  generatePkcePair() {
+    const verifier = base64Url(crypto.randomBytes(32));
+    const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+  }
+
+  /**
+   * Initiate the device flow. Returns the URL to open in a browser plus the
+   * verifier/nonce/machineId we'll need to poll and to sign future requests.
+   */
+  initiateDeviceFlow() {
+    const { verifier, challenge } = this.generatePkcePair();
+    const nonce = uuidv4();
+    const machineId = uuidv4();
+
+    const params = new URLSearchParams({
+      challenge,
+      challenge_method: "S256",
+      machine_id: machineId,
+      nonce,
+    });
+
+    return {
+      verificationUriComplete: `${QODER_LOGIN_URL}?${params.toString()}`,
+      codeVerifier: verifier,
+      nonce,
+      machineId,
+    };
+  }
+
+  /**
+   * Single poll attempt. Returns one of:
+   *   { status: "pending" }       — keep polling
+   *   { status: "ok", token, ... } — user authorized, tokens captured
+   *   throws Error                 — terminal failure
+   *
+   * Upstream returns 202/404 while waiting; 200 with a JSON body when done.
+   */
+  async pollDeviceToken({ nonce, codeVerifier }) {
+    if (!nonce || !codeVerifier) {
+      throw new Error("pollDeviceToken: missing nonce or code verifier");
+    }
+    const url = `${QODER_DEVICE_TOKEN_URL}?nonce=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(codeVerifier)}&challenge_method=S256`;
+
+    const response = await fetchWithTimeout(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "Go-http-client/2.0",
+      },
+    });
+
+    // Pending — server has registered the device code but the user hasn't
+    // finished the browser flow yet. Both 202 and 404 mean "keep polling".
+    if (response.status === 202 || response.status === 404) {
+      return { status: "pending" };
+    }
+
+    const text = await response.text();
+
+    if (!response.ok) {
+      let message = `Qoder device token poll failed: HTTP ${response.status}`;
+      try {
+        const body = JSON.parse(text);
+        if (body.message) message = `Qoder device token poll failed: ${body.message}`;
+      } catch {}
+      throw new Error(message);
+    }
+
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch (err) {
+      throw new Error(`Qoder device token poll: invalid JSON response (${err.message})`);
+    }
+
+    // Defensive: 200 + empty token means the upstream changed shape.
+    if (!body.token) {
+      throw new Error("Qoder device token poll returned 200 but no token");
+    }
+
+    const expireMs = QoderService.parseExpiry(body.expires_at, body.expires_in);
+
+    return {
+      status: "ok",
+      accessToken: body.token,
+      refreshToken: body.refresh_token || "",
+      userId: body.user_id || "",
+      expireTime: expireMs,
+      rawResponse: body,
+    };
+  }
+
+  /**
+   * Fetch profile info for the freshly-issued token. Best-effort — failures
+   * shouldn't block login; returning empty strings is fine.
+   */
+  async fetchUserInfo(accessToken) {
+    try {
+      const response = await fetchWithTimeout(QODER_USERINFO_URL, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json",
+          "User-Agent": "Go-http-client/2.0",
+        },
+      });
+      if (!response.ok) return { name: "", email: "" };
+      const body = await response.json();
+      return {
+        name: (body.name || body.username || "").trim(),
+        email: (body.email || "").trim(),
+        organizationId: (body.organization_id || "").trim(),
+      };
+    } catch {
+      return { name: "", email: "" };
+    }
+  }
+
+  /**
+   * Convert the upstream's expiry hint into a Unix-millisecond timestamp.
+   * Accepts:
+   *   - numeric (ms-epoch): returned as-is
+   *   - numeric string of ms-epoch: e.g. "1781594470000"
+   *   - RFC3339 string: e.g. "2026-06-16T07:15:04Z"
+   *   - seconds-from-now via expiresInSeconds (>= 0)
+   * Falls back to "now + 30 days" when both are missing.
+   *
+   * Order matters: try numeric (string or number) before Date.parse, since
+   * Date.parse accepts short numeric strings like "2026" as years and would
+   * otherwise return a misleading year-2026 timestamp instead of falling
+   * through to the integer branch.
+   *
+   * Static so callers (and tests) can use it without instantiating.
+   */
+  static parseExpiry(expiresAt, expiresInSeconds) {
+    if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
+      return expiresAt;
+    }
+    const trimmed = typeof expiresAt === "string" ? expiresAt.trim() : "";
+    if (trimmed) {
+      // Pure numeric string → ms-epoch (don't let Date.parse swallow short
+      // numerics as years).
+      if (/^\d+$/.test(trimmed)) {
+        const ms = Number.parseInt(trimmed, 10);
+        if (Number.isFinite(ms) && ms > 0) return ms;
+      }
+      const parsed = Date.parse(trimmed);
+      if (!Number.isNaN(parsed)) return parsed;
+    }
+    // expiresInSeconds === 0 means "already expired"; honor that by returning
+    // the current time rather than fabricating a 30-day default.
+    if (typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) && expiresInSeconds >= 0) {
+      return Date.now() + expiresInSeconds * 1000;
+    }
+    return Date.now() + 30 * 24 * 60 * 60 * 1000;
+  }
+}

package/app/src/lib/oauth/services/xai.js

@@ -0,0 +1,238 @@
+import open from "open";
+import { OAuthService } from "./oauth.js";
+import crypto from "crypto";
+import { XAI_CONFIG, XAI_PKCE_VERIFIER_BYTES } from "../constants/xai.js";
+import { startLocalServer } from "../utils/server.js";
+import { generateCodeVerifier, generateCodeChallenge, generateState } from "../utils/pkce.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * xAI (Grok) OAuth Service
+ *
+ * Source of truth: router-for-me/CLIProxyAPI internal/auth/xai/xai.go
+ *
+ * Flow:
+ *  1. Discover endpoints from `${XAI_ISSUER}/.well-known/openid-configuration`
+ *  2. Bind loopback server on 127.0.0.1:56121, path /callback
+ *  3. PKCE S256 with 96-byte verifier
+ *  4. Exchange code with form-urlencoded body
+ *  5. id_token email decode (no signature verify, mirrors Go)
+ */
+
+const BASE64_BLOCK_SIZE = 4;
+
+let cachedDiscovery = null;
+
+export function validateOAuthEndpoint(rawUrl, field) {
+  const value = String(rawUrl || "").trim();
+  if (!value) throw new Error(`xai discovery ${field} is empty`);
+
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch (err) {
+    throw new Error(`xai discovery ${field} is invalid: ${err.message}`);
+  }
+
+  if (parsed.protocol !== "https:") {
+    throw new Error(`xai discovery ${field} must use https: ${value}`);
+  }
+
+  const host = parsed.hostname.toLowerCase().trim();
+  if (host !== "x.ai" && !host.endsWith(".x.ai")) {
+    throw new Error(`xai discovery ${field} host ${host} is not on x.ai`);
+  }
+
+  return value;
+}
+
+/**
+ * Discover authorization + token endpoints. Cached process-wide.
+ */
+export async function discoverEndpoints() {
+  if (cachedDiscovery) return cachedDiscovery;
+
+  try {
+    const res = await fetch(XAI_CONFIG.discoveryUrl, {
+      headers: { Accept: "application/json" },
+    });
+    if (res.ok) {
+      const data = await res.json();
+      cachedDiscovery = {
+        authorizeUrl: validateOAuthEndpoint(data.authorization_endpoint, "authorization_endpoint"),
+        tokenUrl: validateOAuthEndpoint(data.token_endpoint, "token_endpoint"),
+      };
+      return cachedDiscovery;
+    }
+  } catch {
+    // fall through to static fallback
+  }
+
+  cachedDiscovery = {
+    authorizeUrl: XAI_CONFIG.authorizeUrl,
+    tokenUrl: XAI_CONFIG.tokenUrl,
+  };
+  return cachedDiscovery;
+}
+
+/**
+ * Decode the `email` claim from an id_token JWT. No signature verification —
+ * mirrors CLIProxyAPI Go behavior. Returns undefined if not parseable.
+ */
+export function decodeIdTokenEmail(idToken) {
+  if (!idToken || typeof idToken !== "string") return undefined;
+  const parts = idToken.split(".");
+  if (parts.length !== 3) return undefined;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padding = (BASE64_BLOCK_SIZE - (base64.length % BASE64_BLOCK_SIZE)) % BASE64_BLOCK_SIZE;
+    const json = Buffer.from(base64 + "=".repeat(padding), "base64").toString("utf8");
+    const payload = JSON.parse(json);
+    return payload.email || payload.preferred_username || payload.sub || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export class XaiService extends OAuthService {
+  constructor() {
+    super(XAI_CONFIG);
+  }
+
+  /**
+   * Build xAI authorization URL. Spaces in scope are encoded as %20.
+   */
+  buildXaiAuthUrl(redirectUri, state, codeChallenge, authorizeUrl) {
+    const nonce = crypto.randomBytes(16).toString("hex");
+    const params = {
+      response_type: "code",
+      client_id: XAI_CONFIG.clientId,
+      redirect_uri: redirectUri,
+      scope: XAI_CONFIG.scope,
+      code_challenge: codeChallenge,
+      code_challenge_method: XAI_CONFIG.codeChallengeMethod,
+      state,
+      nonce,
+      plan: "generic",
+      referrer: "cli-proxy-api",
+    };
+    const qs = Object.entries(params)
+      .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
+      .join("&");
+    return `${authorizeUrl}?${qs}`;
+  }
+
+  /**
+   * Exchange authorization code for tokens.
+   * xAI is a public PKCE client — no client_secret.
+   */
+  async exchangeXaiCode({ tokenUrl, code, redirectUri, codeVerifier }) {
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: XAI_CONFIG.clientId,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier,
+      }),
+    });
+
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`xAI token exchange failed: ${err}`);
+    }
+    return await res.json();
+  }
+
+  /**
+   * Refresh an access token using a refresh_token.
+   */
+  async refreshAccessToken(refreshToken) {
+    const { tokenUrl } = await discoverEndpoints();
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: XAI_CONFIG.clientId,
+        refresh_token: refreshToken,
+      }),
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`xAI token refresh failed: ${err}`);
+    }
+    return await res.json();
+  }
+
+  /**
+   * Complete xAI OAuth flow end-to-end (CLI entrypoint).
+   * Returns the raw token response plus extracted email.
+   */
+  async connect() {
+    const spinner = createSpinner("Starting xAI OAuth...").start();
+    try {
+      spinner.text = "Discovering xAI endpoints...";
+      const { authorizeUrl, tokenUrl } = await discoverEndpoints();
+
+      spinner.text = `Starting local server on port ${XAI_CONFIG.loopbackPort}...`;
+      let callbackParams = null;
+      const { port, close } = await startLocalServer((params) => {
+        callbackParams = params;
+      }, XAI_CONFIG.loopbackPort);
+      const redirectUri = `http://127.0.0.1:${port}${XAI_CONFIG.callbackPath}`;
+      spinner.succeed(`Local server started on port ${port}`);
+
+      const codeVerifier = generateCodeVerifier(XAI_PKCE_VERIFIER_BYTES);
+      const codeChallenge = generateCodeChallenge(codeVerifier);
+      const state = generateState();
+      const authUrl = this.buildXaiAuthUrl(redirectUri, state, codeChallenge, authorizeUrl);
+
+      console.log("\nOpening browser for xAI authentication...");
+      console.log(`If browser doesn't open, visit:\n${authUrl}\n`);
+      await open(authUrl);
+
+      spinner.start("Waiting for xAI authorization...");
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => reject(new Error("Authentication timeout (5 minutes)")), 300000);
+        const iv = setInterval(() => {
+          if (callbackParams) {
+            clearInterval(iv);
+            clearTimeout(timeout);
+            resolve();
+          }
+        }, 100);
+      });
+      close();
+
+      if (callbackParams.error) {
+        throw new Error(callbackParams.error_description || callbackParams.error);
+      }
+      if (!callbackParams.code) throw new Error("No authorization code received");
+      if (callbackParams.state !== state) throw new Error("Invalid state parameter");
+
+      spinner.start("Exchanging code for tokens...");
+      const tokens = await this.exchangeXaiCode({
+        tokenUrl,
+        code: callbackParams.code,
+        redirectUri,
+        codeVerifier,
+      });
+
+      const email = decodeIdTokenEmail(tokens.id_token);
+      spinner.succeed("xAI connected successfully!");
+      return { tokens, email };
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}

package/app/src/lib/updater/updater.js

@@ -10,7 +10,6 @@ const fs = require("fs");
 const os = require("os");
 
 const packageName = process.env.UPDATER_PKG_NAME || "9router";
-const APP_DATA_DIR_NAME = "openrouterx";
 const port = parseInt(process.env.UPDATER_PORT || "20129", 10);
 const tailLines = parseInt(process.env.UPDATER_TAIL_LINES || "8", 10);
 const maxRetries = parseInt(process.env.UPDATER_RETRIES || "3", 10);
@@ -19,7 +18,7 @@ const lingerMs = parseInt(process.env.UPDATER_LINGER_MS || "30000", 10);
 const waitMinMs = parseInt(process.env.UPDATER_WAIT_MIN_MS || "3000", 10);
 const waitMaxMs = parseInt(process.env.UPDATER_WAIT_MAX_MS || "15000", 10);
 const waitCheckMs = parseInt(process.env.UPDATER_WAIT_CHECK_MS || "500", 10);
-const appPort = parseInt(process.env.UPDATER_APP_PORT || "20502", 10);
+const appPort = parseInt(process.env.UPDATER_APP_PORT || "20128", 10);
 
 // Data directory (match mitm/paths.js logic)
 function getDataDir() {
@@ -27,10 +26,10 @@ function getDataDir() {
   if (process.platform === "win32") {
     return path.join(
       process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"),
-      APP_DATA_DIR_NAME
+      "9router"
     );
   }
-  return path.join(os.homedir(), `.${APP_DATA_DIR_NAME}`);
+  return path.join(os.homedir(), ".9router");
 }
 const updateDir = path.join(getDataDir(), "update");
 try { fs.mkdirSync(updateDir, { recursive: true }); } catch { /* best effort */ }