switchboard-router 0.5.21 → 0.6.0

package/app/package.json

@@ -1,16 +1,22 @@
 {
   "name": "switchboard-app",
-  "version": "0.5.21",
+  "version": "0.6.0",
   "description": "Switchboard — intelligent model routing dashboard",
   "private": true,
   "scripts": {
-    "dev": "next dev --webpack --port 20127",
-    "build": "next build --webpack",
-    "start": "HOSTNAME=${HOSTNAME:-127.0.0.1} next start",
-    "dev:bun": "bun --bun next dev --webpack --port 20127",
-    "build:bun": "bun --bun next build --webpack",
-    "start:bun": "HOSTNAME=${HOSTNAME:-127.0.0.1} bun ./.next/standalone/server.js",
-    "start:standalone": "HOSTNAME=${HOSTNAME:-127.0.0.1} node .next/standalone/custom-server.js",
+    "dev": "node scripts/launch.mjs next dev --webpack",
+    "build": "next build --webpack && node scripts/copy-custom-server.mjs",
+    "start": "node scripts/launch.mjs next start",
+    "dev:bun": "node scripts/launch.mjs bun --bun next dev --webpack",
+    "build:bun": "bun --bun next build --webpack && node scripts/copy-custom-server.mjs",
+    "start:bun": "node scripts/start-standalone.mjs --runtime bun",
+    "start:standalone": "node scripts/start-standalone.mjs",
+    "check:i18n": "node scripts/i18n-parity-check.mjs",
+    "catalog:refresh": "node scripts/fetch-model-catalog.mjs",
+    "generate:providers": "node scripts/generate-provider-registry.mjs",
+    "check:providers": "node scripts/generate-provider-registry.mjs --check",
+    "check:versions": "node scripts/assert-release-version.mjs",
+    "lint": "eslint .",
     "cli:pack": "npm --prefix cli run pack:cli",
     "cli:publish": "npm --prefix cli run publish:cli"
   },
@@ -28,6 +34,7 @@
     "figlet": "^1.11.0",
     "gradient-string": "^3.0.0",
     "jose": "^6.1.3",
+    "jsonc-parser": "3.3.1",
     "marked": "^18.0.1",
     "material-symbols": "^0.45.6",
     "monaco-editor": "^0.55.1",
@@ -44,6 +51,7 @@
     "sql.js": "^1.14.1",
     "undici": "^8.7.0",
     "uuid": "^14.0.1",
+    "yaml": "2.9.0",
     "zustand": "^5.0.10"
   },
   "optionalDependencies": {
@@ -52,9 +60,13 @@
   "comment_better_sqlite3": "kept in optionalDependencies so npm install doesn't fail on systems without build tools — sql.js is used as fallback at runtime",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
-    "eslint": "^10.6.0",
+    "eslint": "^9.39.4",
     "eslint-config-next": "^16.2.10",
-    "postcss": "^8.5.6",
+    "postcss": "8.5.16",
     "tailwindcss": "^4"
+  },
+  "overrides": {
+    "dompurify": "3.4.11",
+    "postcss": "$postcss"
   }
 }

package/app/public/i18n/literals/zh-CN.json

@@ -766,6 +766,14 @@
   "OAuth": "OAuth",
   "Click to add, click again to remove. Changes are saved automatically.": "点击添加，再次点击删除。更改将自动保存。",
   "Close": "关闭",
+  "Select Language": "选择语言",
+  "Search language...": "搜索语言...",
+  "Select an option": "选择一个选项",
+  "Auto (by priority)": "自动（按优先级）",
+  "Auto-detect": "自动检测",
+  "MP3 (Binary)": "MP3（二进制）",
+  "JSON (Base64)": "JSON（Base64）",
+  "Binary File": "二进制文件",
   "⚠️ Risk Notice: This provider uses a subscription/OAuth session not officially licensed for proxy/router use. Account may be restricted or banned. Use at your own risk.": "⚠️ 风险提示：此提供商使用的订阅/OAuth 会话未获官方授权用于代理/路由器使用。账户可能被限制或封禁。使用风险自负。",
   "⚠️ MITM intercepts HTTPS traffic of IDE tools (Antigravity, GitHub Copilot, Kiro) via local CA to redirect requests to your providers. May violate ToS → account ban. Use at your own risk.": "⚠️ MITM 通过本地 CA 拦截 IDE 工具（Antigravity、GitHub Copilot、Kiro）的 HTTPS 流量，将请求重定向到您的提供商。可能违反 ToS → 账户封禁风险。使用风险自负。",
   "Endpoint is exposed without an API key.": "端点未设置 API 密钥即对外暴露。"

package/app/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next-cli-build","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/switchboard-router","allowedDevOrigins":["127.0.0.1","localhost","0.0.0.0","*.local"],"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":134217728,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.mjs","serverExternalPackages":["better-sqlite3","sql.js","node:sqlite","bun:sqlite"],"turbopack":{"root":"/home/runner/work/switchboard-router"},"outputFileTracingExcludes":{"*":["./gitbook/**/*"]},"outputFileTracingIncludes":{"/api/skills/[id]":["./skills/**/*"],"/api/skills/*":["./skills/**/*"]},"distDirRoot":".next-cli-build","_originalRewrites":{"beforeFiles":[],"afterFiles":[{"source":"/v1/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1/v1","destination":"/api/v1"},{"source":"/codex/:path*","destination":"/api/v1/responses"},{"source":"/responses","destination":"/api/v1/responses"},{"source":"/v1beta/:path*","destination":"/api/v1beta/:path*"},{"source":"/v1beta","destination":"/api/v1beta"},{"source":"/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1","destination":"/api/v1"}],"fallback":[]}}
+const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next-cli-build","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/switchboard-router","allowedDevOrigins":["127.0.0.1","localhost","0.0.0.0","*.local"],"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":134217728,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.mjs","serverExternalPackages":["better-sqlite3","sql.js","node:sqlite","bun:sqlite"],"turbopack":{"root":"/home/runner/work/switchboard-router"},"outputFileTracingExcludes":{"*":["./gitbook/**/*","./tests/**/*","./cli/app/**/*","./cli/.build-home/**/*"]},"outputFileTracingIncludes":{"*":["./open-sse/providers/generated/catalog.json"],"/api/skills/[id]":["./skills/**/*"],"/api/skills/*":["./skills/**/*"]},"distDirRoot":".next-cli-build","_originalRewrites":{"beforeFiles":[],"afterFiles":[{"source":"/v1/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1/v1","destination":"/api/v1"},{"source":"/codex/:path*","destination":"/api/v1/responses"},{"source":"/responses","destination":"/api/v1/responses"},{"source":"/v1beta/:path*","destination":"/api/v1beta/:path*"},{"source":"/v1beta","destination":"/api/v1beta"},{"source":"/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1","destination":"/api/v1"}],"fallback":[]}}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/app/src/lib/db/adapters/betterSqliteAdapter.js

@@ -32,11 +32,10 @@ export function createBetterSqliteAdapter(filePath) {
     try { db.close(); } catch {}
   }
 
-  // Ensure WAL is flushed and -wal/-shm files removed on shutdown
+  // Ensure WAL is flushed on shutdown — beforeExit only. CLI parent handles
+  // SIGINT/SIGTERM with SIGTERM → 2s wait → SIGKILL, giving checkpoint time.
   const onShutdown = () => gracefulClose();
   process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
 
   return {
     driver: "better-sqlite3",

package/app/src/lib/db/adapters/bunSqliteAdapter.js

@@ -32,8 +32,6 @@ export async function createBunSqliteAdapter(filePath) {
   }
   const onShutdown = () => gracefulClose();
   process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
 
   return {
     driver: "bun:sqlite",

package/app/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -47,8 +47,6 @@ export async function createNodeSqliteAdapter(filePath) {
   }
   const onShutdown = () => gracefulClose();
   process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
 
   return {
     driver: "node:sqlite",

package/app/src/lib/db/adapters/sqljsAdapter.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import path from "node:path";
 import initSqlJs from "sql.js";
 import { PRAGMA_SQL } from "../schema.js";
 
@@ -23,7 +24,26 @@ export async function createSqlJsAdapter(filePath) {
 
   function persist() {
     const data = db.export();
-    fs.writeFileSync(filePath, Buffer.from(data));
+    const tmp = filePath + ".tmp";
+    fs.writeFileSync(tmp, Buffer.from(data));
+    const fileFd = fs.openSync(tmp, "r");
+    try {
+      fs.fsyncSync(fileFd);
+    } finally {
+      fs.closeSync(fileFd);
+    }
+    fs.renameSync(tmp, filePath);
+    // Persist the directory entry as well. This is required for the rename to
+    // survive a power loss on filesystems that journal file data separately.
+    let dirFd;
+    try {
+      dirFd = fs.openSync(path.dirname(filePath), "r");
+      fs.fsyncSync(dirFd);
+    } catch {
+      // Some platforms (notably Windows) do not allow opening directories.
+    } finally {
+      if (dirFd !== undefined) fs.closeSync(dirFd);
+    }
     dirty = false;
   }
 
@@ -105,11 +125,10 @@ export async function createSqlJsAdapter(filePath) {
     db.close();
   }
 
-  // Flush on shutdown
+  // Flush on shutdown — beforeExit only. SIGINT/SIGTERM handled by CLI parent
+  // which now sends SIGTERM → 2s wait → SIGKILL (gives persist time to run).
   const flush = () => { if (dirty) try { persist(); } catch {} };
   process.on("beforeExit", flush);
-  process.on("SIGINT", flush);
-  process.on("SIGTERM", flush);
 
   return { driver: "sql.js", run, get, all, exec, transaction, close, raw: db };
 }

package/app/src/lib/db/migrate.js

@@ -3,10 +3,12 @@ import path from "node:path";
 import { LEGACY_FILES, DB_DIR, DATA_FILE } from "./paths.js";
 import { TABLES, buildCreateTableSql } from "./schema.js";
 import { MIGRATIONS, latestVersion } from "./migrations/index.js";
-import { getMetaSync, setMetaSync } from "./helpers/metaStore.js";
+import { getMetaSync, setMetaSync } from "./helpers/metaStoreSync.js";
 import { makeBackupDir, backupFile, pruneOldBackups } from "./backup.js";
 import { getAppVersion } from "./version.js";
 import { stringifyJson } from "./helpers/jsonCol.js";
+import { connToRow } from "./repos/connectionsRepo.js";
+import { packApiKeyRecord, unpackApiKeyRecord } from "@/lib/crypto/secrets.js";
 
 // Marker file: prevents re-importing legacy JSON when user wipes data.sqlite.
 const MIGRATED_MARKER = path.join(DB_DIR, ".migrated-from-json");
@@ -43,6 +45,10 @@ function readJsonSafe(file) {
   try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return null; }
 }
 
+function checkpointBeforeBackup(adapter) {
+  try { adapter.checkpoint?.(); } catch {}
+}
+
 function isFreshDb(adapter) {
   // Table _meta may not exist yet on truly fresh DB
   try {
@@ -117,10 +123,10 @@ function importLegacyMain(adapter, data) {
   }
 
   importWithAssertion(adapter, "providerConnections", data.providerConnections || [], (c) => {
-    const { id, provider, authType, name, email, priority, isActive, createdAt, updatedAt, ...rest } = c;
+    const row = connToRow(c);
     adapter.run(
       `INSERT OR REPLACE INTO providerConnections(id, provider, authType, name, email, priority, isActive, data, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      [id, provider, authType || "oauth", name || null, email || null, priority || null, isActive === false ? 0 : 1, stringifyJson(rest), createdAt || new Date().toISOString(), updatedAt || new Date().toISOString()]
+      [row.id, row.provider, row.authType || "oauth", row.name, row.email, row.priority, row.isActive, row.data, row.createdAt || new Date().toISOString(), row.updatedAt || new Date().toISOString()]
     );
   }, (c) => ({ id: c.id ?? null, provider: c.provider ?? null, name: c.name ?? null }));
 
@@ -141,9 +147,12 @@ function importLegacyMain(adapter, data) {
   }, (p) => ({ id: p.id ?? null }));
 
   importWithAssertion(adapter, "apiKeys", data.apiKeys || [], (k) => {
+    const storedKey = typeof k.key === "string" && unpackApiKeyRecord(k.key).legacy
+      ? packApiKeyRecord(k.key)
+      : k.key;
     adapter.run(
       `INSERT OR REPLACE INTO apiKeys(id, key, name, machineId, isActive, createdAt) VALUES(?, ?, ?, ?, ?, ?)`,
-      [k.id, k.key, k.name || null, k.machineId || null, k.isActive === false ? 0 : 1, k.createdAt || new Date().toISOString()]
+      [k.id, storedKey, k.name || null, k.machineId || null, k.isActive === false ? 0 : 1, k.createdAt || new Date().toISOString()]
     );
   }, (k) => ({ id: k.id ?? null, name: k.name ?? null }));
 
@@ -272,6 +281,7 @@ export async function runMigrationOnce(adapter) {
   const oldVer = getMetaSync(adapter, "appVersion", null);
   const newVer = getAppVersion();
   if (oldVer && oldVer !== newVer) {
+    checkpointBeforeBackup(adapter);
     const backupDir = makeBackupDir(`upgrade-${oldVer}-to-${newVer}`);
     try { backupFile(DATA_FILE, backupDir); } catch {}
     setMetaSync(adapter, "appVersion", newVer);
@@ -279,6 +289,7 @@ export async function runMigrationOnce(adapter) {
     console.log(`[DB][migrate] App ${oldVer} → ${newVer} | schema ${migInfo.from} → ${migInfo.to} | backup: ${backupDir}`);
   } else if (migInfo.applied > 0) {
     // Schema upgrade without app version bump — still backup
+    checkpointBeforeBackup(adapter);
     const backupDir = makeBackupDir(`schema-${migInfo.from}-to-${migInfo.to}`);
     try { backupFile(DATA_FILE, backupDir); } catch {}
     pruneOldBackups();

package/app/src/lib/updater/updater.js

@@ -18,7 +18,13 @@ const lingerMs = parseInt(process.env.UPDATER_LINGER_MS || "30000", 10);
 const waitMinMs = parseInt(process.env.UPDATER_WAIT_MIN_MS || "3000", 10);
 const waitMaxMs = parseInt(process.env.UPDATER_WAIT_MAX_MS || "15000", 10);
 const waitCheckMs = parseInt(process.env.UPDATER_WAIT_CHECK_MS || "500", 10);
+const statusStartupTimeoutMs = parseInt(process.env.UPDATER_STARTUP_TIMEOUT_MS || "2000", 10);
 const appPort = parseInt(process.env.UPDATER_APP_PORT || "20128", 10);
+const allowedStatusOrigins = new Set([
+  `http://127.0.0.1:${appPort}`,
+  `http://localhost:${appPort}`,
+  `http://[::1]:${appPort}`,
+]);
 
 // Data directory (match mitm/paths.js logic)
 function getDataDir() {
@@ -66,7 +72,11 @@ function setPhase(phase) {
 
 // HTTP server exposing status (browser polls this while Next server is dead)
 const server = http.createServer((req, res) => {
-  res.setHeader("Access-Control-Allow-Origin", "*");
+  const origin = req.headers.origin;
+  if (origin && allowedStatusOrigins.has(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  }
   res.setHeader("Cache-Control", "no-store");
   if (req.url === "/update/status" || req.url === "/") {
     res.setHeader("Content-Type", "application/json");
@@ -77,15 +87,54 @@ const server = http.createServer((req, res) => {
   res.end("not found");
 });
 
+let statusServerReady = false;
+let statusServerFailed = false;
+let statusServerStartupTimer = null;
+
+function failStatusServer(error) {
+  if (statusServerReady || statusServerFailed) return;
+  statusServerFailed = true;
+  if (statusServerStartupTimer) clearTimeout(statusServerStartupTimer);
+
+  state.done = true;
+  state.success = false;
+  state.error = `status server error: ${error.message}`;
+  state.finishedAt = Date.now();
+  pushLog(`[updater] ${state.error}; exiting without running the installer`);
+  setPhase("error");
+
+  // Do not wait on a server that never bound. This is normally EADDRINUSE
+  // when another updater already owns the fixed status port.
+  try { server.close(); } catch { /* best effort */ }
+  setTimeout(() => process.exit(1), Math.min(Math.max(lingerMs, 0), 1000));
+}
+
 server.on("error", (e) => {
+  if (!statusServerReady) {
+    failStatusServer(e);
+    return;
+  }
   state.error = `status server error: ${e.message}`;
   persistStatus();
 });
 
-server.listen(port, "127.0.0.1", () => {
-  persistStatus();
-  waitForAppExit().then(runInstall);
-});
+statusServerStartupTimer = setTimeout(() => {
+  failStatusServer(new Error(`status server did not bind to 127.0.0.1:${port} within ${statusStartupTimeoutMs}ms`));
+}, Math.max(statusStartupTimeoutMs, 0));
+
+try {
+  server.listen(port, "127.0.0.1", () => {
+    statusServerReady = true;
+    if (statusServerStartupTimer) clearTimeout(statusServerStartupTimer);
+    persistStatus();
+    waitForAppExit().then(runInstall).catch((error) => {
+      pushLog(`[updater] wait failed: ${error.message}`);
+      finalize(false, null, error.message);
+    });
+  });
+} catch (error) {
+  failStatusServer(error);
+}
 
 // Check if app port is still being listened on (= app server still alive)
 function isAppPortBusy() {
@@ -174,10 +223,19 @@ function runInstall() {
 
 function openBrowser(url) {
   const platform = process.platform;
-  const cmd = platform === "darwin" ? `open "${url}"`
-    : platform === "win32" ? `start "" "${url}"`
-    : `xdg-open "${url}"`;
-  try { spawn(cmd, { shell: true, detached: true, stdio: "ignore" }).unref(); } catch { /* ignore */ }
+  const launcher = platform === "darwin"
+    ? { command: "open", args: [url] }
+    : platform === "win32"
+      ? { command: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] }
+      : { command: "xdg-open", args: [url] };
+  try {
+    spawn(launcher.command, launcher.args, {
+      shell: false,
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    }).unref();
+  } catch { /* ignore */ }
 }
 
 // Wait until app port is listening (server alive again), then open dashboard

package/app/src/shared/utils/apiKey.js

@@ -22,15 +22,11 @@ function loadApiKeySecret() {
 const API_KEY_SECRET = loadApiKeySecret();
 
 /**
- * Generate 6-char random keyId
+ * Generate random keyId with >=128 bits of entropy (32-char hex).
+ * crypto.randomBytes avoids Math.random's ~31-bit entropy.
  */
 function generateKeyId() {
-  const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
-  let result = "";
-  for (let i = 0; i < 6; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return result;
+  return crypto.randomBytes(16).toString("hex");
 }
 
 /**