switchboard-router 0.6.31 → 0.8.0

package/app/package.json

@@ -1,18 +1,23 @@
 {
   "name": "switchboard-app",
-  "version": "0.6.31",
+  "version": "0.8.0",
   "description": "Switchboard — intelligent model routing dashboard",
   "private": true,
+  "engines": {
+    "node": ">=20.9.0"
+  },
   "scripts": {
     "dev": "node scripts/launch.mjs next dev --webpack",
-    "build": "next build --webpack && node scripts/copy-custom-server.mjs",
+    "build": "npm run build:claude-tls && next build --webpack && node scripts/copy-custom-server.mjs",
     "start": "node scripts/launch.mjs next start",
     "dev:bun": "node scripts/launch.mjs bun --bun next dev --webpack",
-    "build:bun": "bun --bun next build --webpack && node scripts/copy-custom-server.mjs",
+    "build:claude-tls": "node scripts/build-claude-tls-helper.mjs",
+    "build:bun": "npm run build:claude-tls && bun --bun next build --webpack && node scripts/copy-custom-server.mjs",
     "start:bun": "node scripts/start-standalone.mjs --runtime bun",
     "start:standalone": "node scripts/start-standalone.mjs",
     "check:i18n": "node scripts/i18n-parity-check.mjs",
     "catalog:refresh": "node scripts/fetch-model-catalog.mjs",
+    "identity:refresh": "node scripts/refresh-identity-versions.mjs",
     "generate:providers": "node scripts/generate-provider-registry.mjs",
     "check:providers": "node scripts/generate-provider-registry.mjs --check",
     "check:versions": "node scripts/assert-release-version.mjs",
@@ -33,6 +38,7 @@
     "confbox": "^0.2.4",
     "figlet": "^1.11.0",
     "gradient-string": "^3.0.0",
+    "impit": "^0.14.3",
     "jose": "^6.1.3",
     "jsonc-parser": "3.3.1",
     "marked": "^18.0.1",

package/app/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next-cli-build","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"instrumentationClientInject":[],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/switchboard-router","allowedDevOrigins":["127.0.0.1","localhost","0.0.0.0","*.local"],"enablePrerenderSourceMaps":true,"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":true,"coldCacheBadge":false,"devValidationWorker":true,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"dynamicOnHover":false,"useOffline":false,"varyParams":true,"optimisticRouting":true,"instrumentationClientRouterTransitionEvents":false,"prefetchInlining":{"maxSize":2048,"maxBundleSize":10240},"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptOperationCache":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"devMemoryThresholdRestart":true,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"requestInsights":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":true,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":true,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"serverComponentsHmrCancellation":false,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":134217728,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":true,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","turbopackMemoryEvictionMode":"auto","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"useCacheTimeout":54,"instantInsights":{"validationLevel":"warning"},"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.mjs","serverExternalPackages":["better-sqlite3","sql.js","node:sqlite","bun:sqlite","node-machine-id","bindings","open-sse"],"turbopack":{"root":"/home/runner/work/switchboard-router"},"outputFileTracingExcludes":{"*":["./gitbook/**/*","./tests/**/*","./cli/app/**/*","./cli/.build-home/**/*"]},"outputFileTracingIncludes":{"*":["./open-sse/providers/generated/catalog.json"],"/api/skills/[id]":["./skills/**/*"],"/api/skills/*":["./skills/**/*"]},"repoRoot":"/home/runner/work/switchboard-router/switchboard-router","distDirRoot":".next-cli-build","supportsImmutableAssets":false,"_originalRewrites":{"beforeFiles":[],"afterFiles":[{"source":"/v1/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1/v1","destination":"/api/v1"},{"source":"/codex/:path*","destination":"/api/v1/responses"},{"source":"/responses","destination":"/api/v1/responses"},{"source":"/v1beta/:path*","destination":"/api/v1beta/:path*"},{"source":"/v1beta","destination":"/api/v1beta"},{"source":"/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1","destination":"/api/v1"}],"fallback":[]}}
+const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next-cli-build","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"instrumentationClientInject":[],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/switchboard-router","allowedDevOrigins":["127.0.0.1","localhost","0.0.0.0","*.local"],"enablePrerenderSourceMaps":true,"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":true,"coldCacheBadge":false,"devValidationWorker":true,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"dynamicOnHover":false,"useOffline":false,"varyParams":true,"optimisticRouting":true,"instrumentationClientRouterTransitionEvents":false,"prefetchInlining":{"maxSize":2048,"maxBundleSize":10240},"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptOperationCache":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"devMemoryThresholdRestart":true,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"requestInsights":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":true,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":true,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"serverComponentsHmrCancellation":false,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":134217728,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":true,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","turbopackMemoryEvictionMode":"auto","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"useCacheTimeout":54,"instantInsights":{"validationLevel":"warning"},"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.mjs","serverExternalPackages":["better-sqlite3","sql.js","node:sqlite","bun:sqlite","node-machine-id","bindings","impit","open-sse"],"turbopack":{"root":"/home/runner/work/switchboard-router"},"outputFileTracingExcludes":{"*":["./gitbook/**/*","./tests/**/*","./cli/app/**/*","./cli/.build-home/**/*"]},"outputFileTracingIncludes":{"*":["./open-sse/providers/generated/catalog.json","./node_modules/impit/**/*","./node_modules/impit-*/**/*","./open-sse/identity/tls/bin/**/*"],"/api/skills/[id]":["./skills/**/*"],"/api/skills/*":["./skills/**/*"]},"repoRoot":"/home/runner/work/switchboard-router/switchboard-router","distDirRoot":".next-cli-build","supportsImmutableAssets":false,"_originalRewrites":{"beforeFiles":[],"afterFiles":[{"source":"/v1/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1/v1","destination":"/api/v1"},{"source":"/codex/:path*","destination":"/api/v1/responses"},{"source":"/responses","destination":"/api/v1/responses"},{"source":"/v1beta/:path*","destination":"/api/v1beta/:path*"},{"source":"/v1beta","destination":"/api/v1beta"},{"source":"/v1/:path*","destination":"/api/v1/:path*"},{"source":"/v1","destination":"/api/v1"}],"fallback":[]}}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/app/src/lib/db/adapters/betterSqliteAdapter.js

@@ -1,5 +1,6 @@
 import Database from "better-sqlite3";
 import { PRAGMA_SQL } from "../schema.js";
+import { registerAdapterCloser } from "./adapterShutdownRegistry.js";
 
 // Periodic checkpoint to keep WAL file small (avoid huge -wal/-shm growth)
 const CHECKPOINT_INTERVAL_MS = 60 * 1000;
@@ -32,10 +33,18 @@ export function createBetterSqliteAdapter(filePath) {
     try { db.close(); } catch {}
   }
 
+  let closed = false;
+  function close() {
+    unregisterClose();
+    if (closed) return;
+    closed = true;
+    clearInterval(checkpointTimer);
+    gracefulClose();
+  }
+
   // Ensure WAL is flushed on shutdown — beforeExit only. CLI parent handles
   // SIGINT/SIGTERM with SIGTERM → 2s wait → SIGKILL, giving checkpoint time.
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
+  const unregisterClose = registerAdapterCloser(close);
 
   return {
     driver: "better-sqlite3",
@@ -45,10 +54,7 @@ export function createBetterSqliteAdapter(filePath) {
     exec(sql) { return db.exec(sql); },
     transaction(fn) { return db.transaction(fn)(); },
     checkpoint() { try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {} },
-    close() {
-      clearInterval(checkpointTimer);
-      gracefulClose();
-    },
+    close,
     raw: db,
   };
 }

package/app/src/lib/db/adapters/bunSqliteAdapter.js

@@ -1,6 +1,7 @@
 // Bun runtime adapter — uses built-in bun:sqlite (native, fastest under Bun).
 // Loaded only when process.versions.bun is present.
 import { PRAGMA_SQL } from "../schema.js";
+import { registerAdapterCloser } from "./adapterShutdownRegistry.js";
 
 const CHECKPOINT_INTERVAL_MS = 60 * 1000;
 
@@ -30,8 +31,15 @@ export async function createBunSqliteAdapter(filePath) {
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
+  let closed = false;
+  function close() {
+    unregisterClose();
+    if (closed) return;
+    closed = true;
+    clearInterval(checkpointTimer);
+    gracefulClose();
+  }
+  const unregisterClose = registerAdapterCloser(close);
 
   return {
     driver: "bun:sqlite",
@@ -52,10 +60,7 @@ export async function createBunSqliteAdapter(filePath) {
       return tx();
     },
     checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
-    close() {
-      clearInterval(checkpointTimer);
-      gracefulClose();
-    },
+    close,
     raw: db,
   };
 }

package/app/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -1,6 +1,7 @@
 // Built-in node:sqlite adapter — available in Node >= 22.5.0.
 // No native build, no npm install. API mirrors betterSqliteAdapter.
 import { PRAGMA_SQL } from "../schema.js";
+import { registerAdapterCloser } from "./adapterShutdownRegistry.js";
 
 const CHECKPOINT_INTERVAL_MS = 60 * 1000;
 
@@ -45,8 +46,15 @@ export async function createNodeSqliteAdapter(filePath) {
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
+  let closed = false;
+  function close() {
+    unregisterClose();
+    if (closed) return;
+    closed = true;
+    clearInterval(checkpointTimer);
+    gracefulClose();
+  }
+  const unregisterClose = registerAdapterCloser(close);
 
   return {
     driver: "node:sqlite",
@@ -75,10 +83,7 @@ export async function createNodeSqliteAdapter(filePath) {
       }
     },
     checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
-    close() {
-      clearInterval(checkpointTimer);
-      gracefulClose();
-    },
+    close,
     raw: db,
   };
 }

package/app/src/lib/db/adapters/sqljsAdapter.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import initSqlJs from "sql.js";
 import { PRAGMA_SQL } from "../schema.js";
+import { registerAdapterCloser } from "./adapterShutdownRegistry.js";
 
 let SQL = null;
 
@@ -119,16 +120,22 @@ export async function createSqlJsAdapter(filePath) {
     }
   }
 
+  let closed = false;
   function close() {
-    if (saveTimer) clearTimeout(saveTimer);
-    if (dirty) persist();
-    db.close();
+    unregisterClose();
+    if (closed) return;
+    closed = true;
+    clearTimeout(saveTimer);
+    try {
+      if (dirty) persist();
+    } finally {
+      db.close();
+    }
   }
 
   // Flush on shutdown — beforeExit only. SIGINT/SIGTERM handled by CLI parent
   // which now sends SIGTERM → 2s wait → SIGKILL (gives persist time to run).
-  const flush = () => { if (dirty) try { persist(); } catch {} };
-  process.on("beforeExit", flush);
+  const unregisterClose = registerAdapterCloser(close);
 
   return { driver: "sql.js", run, get, all, exec, transaction, close, raw: db };
 }

package/app/src/lib/db/migrate.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { LEGACY_FILES, DB_DIR, DATA_FILE } from "./paths.js";
+import { LEGACY_FILES, DB_DIR, DATA_FILE, BACKUPS_DIR } from "./paths.js";
 import { TABLES, buildCreateTableSql } from "./schema.js";
 import { MIGRATIONS, latestVersion } from "./migrations/index.js";
 import { getMetaSync, setMetaSync } from "./helpers/metaStoreSync.js";
@@ -8,13 +8,21 @@ import { makeBackupDir, backupFile, pruneOldBackups } from "./backup.js";
 import { getAppVersion } from "./version.js";
 import { stringifyJson } from "./helpers/jsonCol.js";
 import { connToRow } from "./repos/connectionsRepo.js";
-import { packApiKeyRecord, unpackApiKeyRecord } from "@/lib/crypto/secrets.js";
+import { matchesApiKeyRecord, normalizeApiKeyRecordLookup, packApiKeyRecord, unpackApiKeyRecord } from "@/lib/crypto/secrets.js";
+import { resolveClientKeyId, scrubUsageDailyData } from "./migrations/008-client-key-identity.js";
+import { rebuildPrometheusMetrics } from "./migrations/009-prometheus-materialization.js";
 
 // Marker file: prevents re-importing legacy JSON when user wipes data.sqlite.
 const MIGRATED_MARKER = path.join(DB_DIR, ".migrated-from-json");
+const LEGACY_SANITIZED_MARKER = path.join(DB_DIR, ".legacy-secrets-sanitized");
 
 // Track per-adapter so reusing same adapter skips re-run, but new adapter (after reset) re-runs.
 const _migratedAdapters = new WeakSet();
+let _legacyKeyMatcher = matchesApiKeyRecord;
+
+export function __setLegacyKeyMatcherForTests(matcher = matchesApiKeyRecord) {
+  _legacyKeyMatcher = matcher;
+}
 
 // Thrown when row-count assertion fails. Outer transaction rolls back,
 // legacy db.json kept intact, marker not written → next boot retries.
@@ -45,6 +53,108 @@ function readJsonSafe(file) {
   try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return null; }
 }
 
+function buildLegacyKeyIdMap(data, usage, matchCache = new Map()) {
+  const map = new Map();
+  const records = [];
+  for (const key of data?.apiKeys || []) {
+    if (typeof key?.key !== "string" || !key.id) continue;
+    const normalized = normalizeApiKeyRecordLookup(key.key);
+    records.push({ id: key.id, stored: normalized });
+    if (unpackApiKeyRecord(normalized).legacy) map.set(String(key.key), key.id);
+  }
+  const rawValues = new Set((usage?.history || []).map((entry) => entry?.apiKey).filter((raw) => typeof raw === "string" && raw !== "local-no-key"));
+  for (const day of Object.values(usage?.dailySummary || {})) {
+    for (const [counterKey, entry] of Object.entries(day?.byApiKey || {})) {
+      const raw = typeof entry?.apiKey === "string" ? entry.apiKey : counterKey.split("|")[0];
+      if (raw && raw !== "local-no-key") rawValues.add(String(raw));
+    }
+  }
+  for (const raw of rawValues) {
+    if (map.has(raw)) continue;
+    const matched = records.find((record) => {
+      const cacheKey = `${record.id}\u0000${record.stored}\u0000${raw}`;
+      if (!matchCache.has(cacheKey)) matchCache.set(cacheKey, _legacyKeyMatcher(record.stored, raw));
+      return matchCache.get(cacheKey);
+    });
+    if (matched) map.set(raw, matched.id);
+  }
+  return map;
+}
+
+function legacyImportTargetIsEmpty(adapter) {
+  for (const table of ["settings", "providerConnections", "providerNodes", "proxyPools", "apiKeys", "combos", "kv", "usageHistory", "usageDaily", "requestDetails"]) {
+    if ((adapter.get(`SELECT COUNT(*) count FROM ${table}`)?.count || 0) !== 0) return false;
+  }
+  return true;
+}
+
+function writeJsonRestricted(file, value) {
+  if (!file || !fs.existsSync(path.dirname(file))) return;
+  const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, JSON.stringify(value, null, 2), { mode: 0o600 });
+  fs.renameSync(temp, file);
+  fs.chmodSync(file, 0o600);
+}
+
+function sanitizePayloadKey(key, storedById, useCurrentVerifier) {
+  if (useCurrentVerifier && storedById.has(key.id)) return storedById.get(key.id);
+  if (typeof key.key !== "string") return null;
+  const normalized = normalizeApiKeyRecordLookup(key.key);
+  return unpackApiKeyRecord(normalized).legacy ? packApiKeyRecord(normalized) : normalized;
+}
+
+function sanitizeLegacyPayload(legacyMain, legacyUsage, keys, storedById, legacyKeyIds = null, matchCache = new Map(), useCurrentVerifier = false) {
+  const keyIds = legacyKeyIds || buildLegacyKeyIdMap(legacyMain, legacyUsage, matchCache);
+  const main = legacyMain && typeof legacyMain === "object"
+    ? {
+        ...legacyMain,
+        apiKeys: (legacyMain.apiKeys || []).map((key) => ({
+          ...key,
+          key: sanitizePayloadKey(key, storedById, useCurrentVerifier),
+        })),
+      }
+    : null;
+  const usage = legacyUsage && typeof legacyUsage === "object"
+    ? {
+        ...legacyUsage,
+        history: (legacyUsage.history || []).map((entry) => ({
+          ...entry,
+          apiKey: null,
+          clientKeyId: keyIds.get(String(entry.apiKey)) || entry.clientKeyId || null,
+        })),
+        dailySummary: Object.fromEntries(
+          Object.entries(legacyUsage.dailySummary || {}).map(([dateKey, day]) => [
+            dateKey,
+            scrubUsageDailyData(day, keys, "up", (raw) => keyIds.get(String(raw)) || null),
+          ])
+        ),
+      }
+    : null;
+  return { main, usage };
+}
+
+function sanitizeLegacySources(adapter, legacyMain, legacyUsage, backupDir = null, legacyKeyIds = null, matchCache = new Map()) {
+  const keys = adapter.all(`SELECT id, key FROM apiKeys`) || [];
+  const storedById = new Map(keys.map((key) => [key.id, key.key]));
+  const active = sanitizeLegacyPayload(legacyMain, legacyUsage, keys, storedById, legacyKeyIds, matchCache, true);
+  if (active.main) writeJsonRestricted(LEGACY_FILES.main, active.main);
+  if (active.usage) writeJsonRestricted(LEGACY_FILES.usage, active.usage);
+
+  if (!fs.existsSync(BACKUPS_DIR)) return;
+  for (const entry of fs.readdirSync(BACKUPS_DIR, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !entry.name.startsWith("migrate-from-json-")) continue;
+    const dir = path.join(BACKUPS_DIR, entry.name);
+    const mainPath = path.join(dir, path.basename(LEGACY_FILES.main));
+    const usagePath = path.join(dir, path.basename(LEGACY_FILES.usage));
+    const backupMain = readJsonSafe(mainPath);
+    const backupUsage = readJsonSafe(usagePath);
+    const useCurrentVerifier = Boolean(backupDir) && path.resolve(dir) === path.resolve(backupDir);
+    const sanitized = sanitizeLegacyPayload(backupMain, backupUsage, keys, storedById, null, matchCache, useCurrentVerifier);
+    if (sanitized.main) writeJsonRestricted(mainPath, sanitized.main);
+    if (sanitized.usage) writeJsonRestricted(usagePath, sanitized.usage);
+  }
+}
+
 function checkpointBeforeBackup(adapter) {
   try { adapter.checkpoint?.(); } catch {}
 }
@@ -60,7 +170,7 @@ function isFreshDb(adapter) {
 }
 
 // ─── Versioned migrations runner (skip-version safe) ─────────────────────
-function runVersionedMigrations(adapter) {
+export function runVersionedMigrations(adapter) {
   // Bootstrap _meta first so we can read schemaVersion
   adapter.exec(buildCreateTableSql("_meta", TABLES._meta));
 
@@ -71,10 +181,9 @@ function runVersionedMigrations(adapter) {
   const pending = MIGRATIONS.filter((m) => m.version > current);
   let lastApplied = current;
   for (const m of pending) {
-    adapter.transaction(() => {
-      m.up(adapter);
-      setMetaSync(adapter, "schemaVersion", m.version);
-    });
+    adapter.transaction(() => m.up(adapter));
+    if (typeof m.afterUp === "function") m.afterUp(adapter);
+    adapter.transaction(() => setMetaSync(adapter, "schemaVersion", m.version));
     lastApplied = m.version;
     console.log(`[DB][migrate] applied #${m.version} ${m.name}`);
   }
@@ -147,15 +256,19 @@ function importLegacyMain(adapter, data) {
   }, (p) => ({ id: p.id ?? null }));
 
   importWithAssertion(adapter, "apiKeys", data.apiKeys || [], (k) => {
-    const storedKey = typeof k.key === "string" && unpackApiKeyRecord(k.key).legacy
-      ? packApiKeyRecord(k.key)
-      : k.key;
+    const normalizedKey = normalizeApiKeyRecordLookup(k.key);
+    const storedKey = typeof normalizedKey === "string" && unpackApiKeyRecord(normalizedKey).legacy
+      ? packApiKeyRecord(normalizedKey)
+      : normalizedKey;
+    const unpacked = unpackApiKeyRecord(storedKey);
     adapter.run(
-      `INSERT OR REPLACE INTO apiKeys(id, key, name, machineId, isActive, createdAt) VALUES(?, ?, ?, ?, ?, ?)`,
-      [k.id, storedKey, k.name || null, k.machineId || null, k.isActive === false ? 0 : 1, k.createdAt || new Date().toISOString()]
+      `INSERT OR REPLACE INTO apiKeys(id, key, keyPrefix, lookupDigest, name, machineId, isActive, createdAt, allowedModels, allowedCombos, expiresAt, rateLimitPerMinute, concurrencyLimit, spendLimitUsd, spentUsd)
+       VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [k.id, storedKey, unpacked.prefix || null, unpacked.lookupDigest || null, k.name || null, k.machineId || null, k.isActive === false ? 0 : 1, k.createdAt || new Date().toISOString(),
+        k.allowedModels == null ? null : stringifyJson(k.allowedModels), k.allowedCombos == null ? null : stringifyJson(k.allowedCombos),
+        k.expiresAt || null, k.rateLimitPerMinute ?? null, k.concurrencyLimit ?? null, k.spendLimitUsd ?? null, Number(k.spentUsd || 0)]
     );
   }, (k) => ({ id: k.id ?? null, name: k.name ?? null }));
-
   importWithAssertion(adapter, "combos", data.combos || [], (c) => {
     adapter.run(
       `INSERT OR REPLACE INTO combos(id, name, kind, models, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?)`,
@@ -178,15 +291,18 @@ function importLegacyMain(adapter, data) {
   }
 }
 
-function importLegacyUsage(adapter, data) {
+function importLegacyUsage(adapter, data, legacyKeyIds = new Map()) {
+  const keys = adapter.all(`SELECT id, key FROM apiKeys`) || [];
   if (!data || typeof data !== "object") return;
   for (const e of data.history || []) {
     const t = e.tokens || {};
+    const clientKeyId = legacyKeyIds.get(String(e.apiKey)) || null;
     adapter.run(
-      `INSERT INTO usageHistory(timestamp, provider, model, connectionId, apiKey, endpoint, promptTokens, completionTokens, cost, status, tokens, meta) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT INTO usageHistory(timestamp, provider, model, connectionId, clientKeyId, endpoint, promptTokens, completionTokens, cost, status, tokens, meta)
+       VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         e.timestamp || new Date().toISOString(),
-        e.provider || null, e.model || null, e.connectionId || null, e.apiKey || null, e.endpoint || null,
+        e.provider || null, e.model || null, e.connectionId || null, clientKeyId, e.endpoint || null,
         t.prompt_tokens || t.input_tokens || 0,
         t.completion_tokens || t.output_tokens || 0,
         e.cost || 0,
@@ -195,9 +311,15 @@ function importLegacyUsage(adapter, data) {
         stringifyJson({}),
       ]
     );
+    if (clientKeyId) {
+      adapter.run(`UPDATE apiKeys SET spentUsd = spentUsd + ? WHERE id = ?`, [Number(e.cost || 0), clientKeyId]);
+    }
   }
   for (const [dateKey, day] of Object.entries(data.dailySummary || {})) {
-    adapter.run(`INSERT OR REPLACE INTO usageDaily(dateKey, data) VALUES(?, ?)`, [dateKey, stringifyJson(day)]);
+    adapter.run(
+      `INSERT OR REPLACE INTO usageDaily(dateKey, data) VALUES(?, ?)`,
+      [dateKey, stringifyJson(scrubUsageDailyData(day, keys, "up", (raw) => legacyKeyIds.get(String(raw)) || null))]
+    );
   }
   if (typeof data.totalRequestsLifetime === "number") {
     setMetaSync(adapter, "totalRequestsLifetime", data.totalRequestsLifetime);
@@ -224,7 +346,6 @@ function importLegacyDetails(adapter, data) {
 // ─── Main entry ──────────────────────────────────────────────────────────
 export async function runMigrationOnce(adapter) {
   if (_migratedAdapters.has(adapter)) return;
-  _migratedAdapters.add(adapter);
 
   // Capture freshness BEFORE migrations stamp _meta (otherwise we'd misclassify
   // a brand-new DB as non-fresh once schemaVersion is written).
@@ -243,18 +364,36 @@ export async function runMigrationOnce(adapter) {
   const legacyDisabled = readJsonSafe(LEGACY_FILES.disabled);
   const legacyDetails = readJsonSafe(LEGACY_FILES.details);
   const hasLegacy = !!(legacyMain || legacyUsage || legacyDisabled || legacyDetails);
+  const legacySanitized = fs.existsSync(LEGACY_SANITIZED_MARKER);
+  const migrationProof = getMetaSync(adapter, "migratedAt", null);
+  if (hasLegacy && !legacySanitized && migrationProof) {
+    adapter.checkpoint?.();
+    const legacyMatchCache = new Map();
+    const legacyKeyIds = buildLegacyKeyIdMap(legacyMain, legacyUsage, legacyMatchCache);
+    sanitizeLegacySources(adapter, legacyMain, legacyUsage, null, legacyKeyIds, legacyMatchCache);
+    fs.writeFileSync(LEGACY_SANITIZED_MARKER, new Date().toISOString(), { mode: 0o600 });
+  }
 
-  if (fresh && hasLegacy && !alreadyImported) {
+  const pendingLegacyImport = hasLegacy && !alreadyImported && !migrationProof;
+  if (pendingLegacyImport && !legacyImportTargetIsEmpty(adapter)) {
+    console.error("[DB][migrate] legacy import pending but target tables are not empty; preserving sources for repair");
+    return;
+  }
+
+  if (pendingLegacyImport) {
     const t0 = Date.now();
     const backupDir = makeBackupDir("migrate-from-json");
     for (const f of Object.values(LEGACY_FILES)) backupFile(f, backupDir);
+    const legacyMatchCache = new Map();
+    const legacyKeyIds = buildLegacyKeyIdMap(legacyMain, legacyUsage, legacyMatchCache);
 
     try {
       adapter.transaction(() => {
         importLegacyMain(adapter, legacyMain);
-        importLegacyUsage(adapter, legacyUsage);
+        importLegacyUsage(adapter, legacyUsage, legacyKeyIds);
         importLegacyDisabled(adapter, legacyDisabled);
         importLegacyDetails(adapter, legacyDetails);
+        rebuildPrometheusMetrics(adapter);
         setMetaSync(adapter, "appVersion", getAppVersion());
         setMetaSync(adapter, "migratedAt", new Date().toISOString());
       });
@@ -266,14 +405,19 @@ export async function runMigrationOnce(adapter) {
       throw err;
     }
 
-    try { fs.writeFileSync(MIGRATED_MARKER, new Date().toISOString()); } catch {}
+    adapter.checkpoint?.();
+    sanitizeLegacySources(adapter, legacyMain, legacyUsage, backupDir, legacyKeyIds, legacyMatchCache);
+    fs.writeFileSync(LEGACY_SANITIZED_MARKER, new Date().toISOString(), { mode: 0o600 });
+    fs.writeFileSync(MIGRATED_MARKER, new Date().toISOString(), { mode: 0o600 });
     pruneOldBackups();
-    console.log(`[DB][migrate] JSON → SQLite in ${Date.now() - t0}ms | legacy JSON kept at DATA_DIR | backup: ${backupDir}`);
+    console.log(`[DB][migrate] JSON → SQLite in ${Date.now() - t0}ms | legacy sources sanitized | backup: ${backupDir}`);
+    _migratedAdapters.add(adapter);
     return;
   }
 
   if (fresh) {
     setMetaSync(adapter, "appVersion", getAppVersion());
+    _migratedAdapters.add(adapter);
     return;
   }
 
@@ -294,4 +438,5 @@ export async function runMigrationOnce(adapter) {
     try { backupFile(DATA_FILE, backupDir); } catch {}
     pruneOldBackups();
   }
+  _migratedAdapters.add(adapter);
 }

package/app/src/lib/oauth/services/qoder.js

@@ -5,6 +5,8 @@ import {
 } from "../../qoder/constants.js";
 import crypto from "crypto";
 import { v4 as uuidv4 } from "uuid";
+import { getOAuthFetchProfile } from "../providerHelpers.js";
+import { proxyAwareFetch } from "open-sse/utils/proxyFetch.js";
 
 /**
  * Qoder OAuth Service
@@ -27,6 +29,7 @@ import { v4 as uuidv4 } from "uuid";
 // 5 minutes; an individual request that stalls beyond this is treated as a
 // failed poll attempt and the next poll iteration retries.
 const FETCH_TIMEOUT_MS = 15_000;
+const QODER_FETCH_PROFILE = getOAuthFetchProfile("qoder");
 
 function base64Url(buf) {
   return buf
@@ -45,7 +48,11 @@ async function fetchWithTimeout(url, init = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort("timeout"), FETCH_TIMEOUT_MS);
   try {
-    return await fetch(url, { ...init, signal: controller.signal });
+    return await proxyAwareFetch(url, {
+      ...init,
+      signal: controller.signal,
+      ...QODER_FETCH_PROFILE,
+    });
   } finally {
     clearTimeout(timer);
   }

package/app/src/lib/oauth/services/xai.js

@@ -5,6 +5,7 @@ import { XAI_CONFIG, XAI_PKCE_VERIFIER_BYTES } from "../constants/xai.js";
 import { startLocalServer } from "../utils/server.js";
 import { generateCodeVerifier, generateCodeChallenge, generateState } from "../utils/pkce.js";
 import { spinner as createSpinner } from "../utils/ui.js";
+import { proxyAwareFetch } from "open-sse/utils/proxyFetch.js";
 
 /**
  * xAI (Grok) OAuth Service
@@ -53,8 +54,11 @@ export async function discoverEndpoints() {
   if (cachedDiscovery) return cachedDiscovery;
 
   try {
-    const res = await fetch(XAI_CONFIG.discoveryUrl, {
+    const res = await proxyAwareFetch(XAI_CONFIG.discoveryUrl, {
       headers: { Accept: "application/json" },
+      identity: "grok-cli",
+      provider: "xai",
+      format: "openai",
     });
     if (res.ok) {
       const data = await res.json();
@@ -127,7 +131,7 @@ export class XaiService extends OAuthService {
    * xAI is a public PKCE client — no client_secret.
    */
   async exchangeXaiCode({ tokenUrl, code, redirectUri, codeVerifier }) {
-    const res = await fetch(tokenUrl, {
+    const res = await proxyAwareFetch(tokenUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
@@ -140,6 +144,8 @@ export class XaiService extends OAuthService {
         redirect_uri: redirectUri,
         code_verifier: codeVerifier,
       }),
+      identity: "grok-cli",
+      provider: "xai",
     });
 
     if (!res.ok) {
@@ -154,7 +160,7 @@ export class XaiService extends OAuthService {
    */
   async refreshAccessToken(refreshToken) {
     const { tokenUrl } = await discoverEndpoints();
-    const res = await fetch(tokenUrl, {
+    const res = await proxyAwareFetch(tokenUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
@@ -165,6 +171,8 @@ export class XaiService extends OAuthService {
         client_id: XAI_CONFIG.clientId,
         refresh_token: refreshToken,
       }),
+      identity: "grok-cli",
+      provider: "xai",
     });
     if (!res.ok) {
       const err = await res.text();

package/cli.js

@@ -12,6 +12,20 @@ const processTools = require("./src/cli/processManager");
 const { findListeningPids } = processTools;
 const { probeSwitchboard, probeTcp, waitForSwitchboard } = require("./src/cli/serverStatus");
 
+// Subcommands (`switchboard xai video …`) run against an already-running
+// gateway and skip the launcher flow (no arg parsing, no server spawn).
+const subArgs = process.argv.slice(2);
+if (subArgs[0] === "xai" && subArgs[1] === "video") {
+  const { run: runXaiVideo } = require("./src/cli/commands/xaiVideo");
+  runXaiVideo(subArgs.slice(2))
+    .then((code) => process.exit(code))
+    .catch((error) => {
+      console.error(`Error: ${error?.message || error}`);
+      process.exit(1);
+    });
+  return;
+}
+
 let cliOptions;
 try {
   cliOptions = parseCliArgs(process.argv.slice(2));