zevairouter 1.0.111 → 1.0.113

package/cli/app/CHANGELOG.md

@@ -1,3 +1,13 @@
+# v1.0.113 (2026-07-23)
+
+## Fixes
+- **Full-code audit — security, durability, cancellation, and streaming fixes**: closes verified auth bypasses and credential leaks, hardens OIDC against SSRF and DNS rebinding, isolates terminal sessions per owner, makes SQLite backups/imports and sql.js writes durable and transactional, stops retries and MITM requests after cancellation, and rejects malformed or truncated SSE responses.
+
+# v1.0.112 (2026-07-21)
+
+## Features
+- **CodeBuddy CN bulk import — manual proxy URL**: the automation previously only accepted proxies from DB proxy pools (`proxyPoolMode` + `proxyPoolId`). The register modal now has a "Manual Proxy URL" field — paste any `http(s)://` or `socks4/5://` proxy (e.g. a sticky residential URL you haven't added to a pool) and it takes precedence over pool selection (dropdown auto-disables). The manager validates the scheme, marks the job `proxyPoolMode: "manual"`, and every account in the job runs through that proxy.
+
 # v1.0.111 (2026-07-21)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.111",
+  "version": "1.0.113",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/app/src/lib/db/adapters/betterSqliteAdapter.js

@@ -45,7 +45,7 @@ export function createBetterSqliteAdapter(filePath) {
     all(sql, params = []) { return prepare(sql).all(params); },
     exec(sql) { return db.exec(sql); },
     transaction(fn) { return db.transaction(fn)(); },
-    checkpoint() { try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {} },
+    checkpoint() { db.pragma("wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
       gracefulClose();

package/cli/app/src/lib/db/adapters/bunSqliteAdapter.js

@@ -53,7 +53,7 @@ export async function createBunSqliteAdapter(filePath) {
       const tx = db.transaction(fn);
       return tx();
     },
-    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
       gracefulClose();

package/cli/app/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -74,7 +74,7 @@ export async function createNodeSqliteAdapter(filePath) {
         throw e;
       }
     },
-    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
       gracefulClose();

package/cli/app/src/lib/db/adapters/sqljsAdapter.js

@@ -13,29 +13,25 @@ async function loadSql() {
 export async function createSqlJsAdapter(filePath) {
   const SQLLib = await loadSql();
   const buf = fs.existsSync(filePath) ? fs.readFileSync(filePath) : null;
-  const db = new SQLLib.Database(buf);
+  let db = new SQLLib.Database(buf);
   db.exec(PRAGMA_SQL);
   // Schema is created/synced by migrate.js after adapter init
 
   let dirty = false;
-  let saveTimer = null;
-  const SAVE_DEBOUNCE_MS = 100;
+  let transactionDepth = 0;
 
   function persist() {
     const data = db.export();
-    fs.writeFileSync(filePath, Buffer.from(data));
-    dirty = false;
-  }
-
-  function scheduleSave() {
+    const tempPath = `${filePath}.tmp-${process.pid}`;
     dirty = true;
-    if (saveTimer) clearTimeout(saveTimer);
-    saveTimer = setTimeout(() => {
-      saveTimer = null;
-      if (dirty) {
-        try { persist(); } catch (e) { console.error("[sqljs] save failed:", e); }
-      }
-    }, SAVE_DEBOUNCE_MS);
+    try {
+      fs.writeFileSync(tempPath, Buffer.from(data));
+      fs.renameSync(tempPath, filePath);
+      dirty = false;
+    } catch (error) {
+      try { fs.rmSync(tempPath, { force: true }); } catch {}
+      throw error;
+    }
   }
 
   function paramsObj(params) {
@@ -50,7 +46,7 @@ export async function createSqlJsAdapter(filePath) {
       stmt.step();
       const changes = db.getRowsModified();
       const lastInsertRowid = db.exec("SELECT last_insert_rowid() as id")[0]?.values?.[0]?.[0] ?? null;
-      scheduleSave();
+      if (transactionDepth === 0) persist();
       return { changes, lastInsertRowid };
     } finally {
       stmt.free();
@@ -82,34 +78,36 @@ export async function createSqlJsAdapter(filePath) {
 
   function exec(sql) {
     db.exec(sql);
-    scheduleSave();
+    if (transactionDepth === 0) persist();
   }
 
   function transaction(fn) {
     const sp = `sp_${Math.random().toString(36).slice(2)}`;
+    const snapshot = transactionDepth === 0 ? db.export() : null;
     db.exec(`SAVEPOINT ${sp}`);
+    transactionDepth++;
     try {
       const result = fn();
       db.exec(`RELEASE ${sp}`);
-      scheduleSave();
+      transactionDepth--;
+      if (transactionDepth === 0) persist();
       return result;
     } catch (e) {
+      transactionDepth--;
       try { db.exec(`ROLLBACK TO ${sp}`); db.exec(`RELEASE ${sp}`); } catch {}
+      if (snapshot) {
+        db.close();
+        db = new SQL.Database(snapshot);
+        dirty = false;
+      }
       throw e;
     }
   }
 
   function close() {
-    if (saveTimer) clearTimeout(saveTimer);
     if (dirty) persist();
     db.close();
   }
 
-  // Flush on shutdown
-  const flush = () => { if (dirty) try { persist(); } catch {} };
-  process.on("beforeExit", flush);
-  process.on("SIGINT", flush);
-  process.on("SIGTERM", flush);
-
   return { driver: "sql.js", run, get, all, exec, transaction, close, raw: db };
 }

package/cli/app/src/lib/db/migrate.js

@@ -215,11 +215,22 @@ function importLegacyDetails(adapter, data) {
 // ─── Main entry ──────────────────────────────────────────────────────────
 export async function runMigrationOnce(adapter) {
   if (_migratedAdapters.has(adapter)) return;
-  _migratedAdapters.add(adapter);
 
   // Capture freshness BEFORE migrations stamp _meta (otherwise we'd misclassify
   // a brand-new DB as non-fresh once schemaVersion is written).
   const fresh = isFreshDb(adapter);
+  const oldSchemaVersion = Number(getMetaSync(adapter, "schemaVersion", 0));
+  const oldAppVersion = getMetaSync(adapter, "appVersion", null);
+  const newAppVersion = getAppVersion();
+  let preMigrationBackup = null;
+  if (!fresh && (oldSchemaVersion < latestVersion() || (oldAppVersion && oldAppVersion !== newAppVersion))) {
+    preMigrationBackup = makeBackupDir(
+      oldSchemaVersion < latestVersion()
+        ? `schema-${oldSchemaVersion}-to-${latestVersion()}`
+        : `upgrade-${oldAppVersion}-to-${newAppVersion}`
+    );
+    backupFile(DATA_FILE, preMigrationBackup, null, adapter);
+  }
 
   // 1. Always run versioned migrations chain (skip-version safe)
   const migInfo = runVersionedMigrations(adapter);
@@ -260,27 +271,21 @@ export async function runMigrationOnce(adapter) {
     try { fs.writeFileSync(MIGRATED_MARKER, new Date().toISOString()); } catch {}
     pruneOldBackups();
     console.log(`[DB][migrate] JSON → SQLite in ${Date.now() - t0}ms | legacy JSON kept at DATA_DIR | backup: ${backupDir}`);
+    _migratedAdapters.add(adapter);
     return;
   }
 
   if (fresh) {
     setMetaSync(adapter, "appVersion", getAppVersion());
+    _migratedAdapters.add(adapter);
     return;
   }
 
-  // 4. App version bump → backup data.sqlite (safety net before user-side upgrade)
-  const oldVer = getMetaSync(adapter, "appVersion", null);
-  const newVer = getAppVersion();
-  if (oldVer && oldVer !== newVer) {
-    const backupDir = makeBackupDir(`upgrade-${oldVer}-to-${newVer}`);
-    try { backupFile(DATA_FILE, backupDir); } catch {}
-    setMetaSync(adapter, "appVersion", newVer);
-    pruneOldBackups();
-    console.log(`[DB][migrate] App ${oldVer} → ${newVer} | schema ${migInfo.from} → ${migInfo.to} | backup: ${backupDir}`);
-  } else if (migInfo.applied > 0) {
-    // Schema upgrade without app version bump — still backup
-    const backupDir = makeBackupDir(`schema-${migInfo.from}-to-${migInfo.to}`);
-    try { backupFile(DATA_FILE, backupDir); } catch {}
+  // 4. Record the app version after the pre-migration backup and successful migration.
+  if (oldAppVersion !== newAppVersion) setMetaSync(adapter, "appVersion", newAppVersion);
+  if (preMigrationBackup) {
     pruneOldBackups();
+    console.log(`[DB][migrate] App ${oldAppVersion} → ${newAppVersion} | schema ${migInfo.from} → ${migInfo.to} | backup: ${preMigrationBackup}`);
   }
+  _migratedAdapters.add(adapter);
 }

package/cli/app/src/mitm/server.js

@@ -56,7 +56,7 @@ ${pu}`});Ln.set(e,r),t(null,r)}catch(a){ot(`SNI error for ${e}: ${a.message}`),t
 [ERROR h2] ${g.message}
 `),i.end()),t.headersSent||t.writeHead(502),t.writableEnded||t.end("Bad Gateway");try{f.close()}catch{}l()});let c=f.request(u,{endStream:a.length===0});a.length>0&&c.end(a),c.once("response",g=>{let v=g[":status"],y={};for(let[S,I]of Object.entries(g))S.startsWith(":")||S==="connection"||S==="keep-alive"||S==="transfer-encoding"||(y[S]=I);t.writeHead(v,y),i&&i.writeHeader(v,y);let x=[];c.on("data",S=>{i&&i.writeChunk(S),s&&x.push(S),t.write(S)}),c.on("end",()=>{if(i&&i.end(),t.writableEnded||t.end(),s)try{s(Buffer.concat(x),y)}catch{}try{f.close()}catch{}l()})}),c.once("error",g=>{ot(`[mitm] http2 stream error: ${g.message}`),i&&(i.writeChunk(`
 [ERROR h2-stream] ${g.message}
-`),i.end()),t.headersSent||t.writeHead(502),t.writableEnded||t.end();try{f.close()}catch{}l()})})}async function Zd(e,t,a,r,n,s,i){let o=await Pn(n),u=fu.request({hostname:o,port:443,path:e.url,method:e.method,headers:r,servername:n,rejectUnauthorized:!1},l=>{if(t.writeHead(l.statusCode,l.headers),i&&i.writeHeader(l.statusCode,l.headers),!s&&!i){l.pipe(t);return}let f=[];l.on("data",c=>{i&&i.writeChunk(c),s&&f.push(c),t.write(c)}),l.on("end",()=>{if(i&&i.end(),t.end(),s)try{s(Buffer.concat(f),l.headers)}catch{}})});u.on("error",l=>{ot(`Passthrough error: ${l.message}`),i&&(i.writeChunk(`
-[ERROR] ${l.message}
-`),i.end()),t.headersSent||t.writeHead(502),t.end("Bad Gateway")}),a.length>0&&u.write(a),u.end()}var On=fu.createServer(gu,async(e,t)=>{try{if(e.url==="/_mitm_health"){t.writeHead(200,{"Content-Type":"application/json"}),t.end(JSON.stringify({ok:!0,pid:process.pid}));return}let a=await Yd(e);if(hu&&Rd(e,a,"raw"),e.headers[ou.name]===ou.value)return er(e,t,a);let r=du(e.headers.host);if(!r||!(Od[r]||[]).some(u=>e.url.includes(u)))return er(e,t,a);if(r==="cursor")return uu[r].intercept(e,t,a,null,er);let i=$d(e.url,a);if(i&&(Kd[r]||[]).some(u=>u.test(i)))return er(e,t,a);let o=Wd(r,i);return o?uu[r].intercept(e,t,a,o,er):er(e,t,a)}catch(a){ot(`Unhandled error: ${a.message}`),t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:a.message,type:"mitm_error"}}))}});function eh(e){try{let t=[];if(su){let a=`powershell -NonInteractive -WindowStyle Hidden -Command "Get-NetTCPConnection -LocalPort ${e} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess"`,r=Rn(a,{encoding:"utf-8",windowsHide:!0}).trim();if(!r)return;t=r.split(/\r?\n/).map(n=>n.trim()).filter(n=>n&&Number(n)!==process.pid&&Number(n)>4)}else{let a=Rn(`${Ud} -nP -iTCP:${e} -sTCP:LISTEN -t`,{encoding:"utf-8",windowsHide:!0}).trim();if(!a)return;t=a.split(`
+`),i.end()),t.headersSent||t.writeHead(502),t.writableEnded||t.end();try{f.close()}catch{}l()})})}async function Zd(e,t,a,r,n,s,i){let o=await Pn(n),u=new AbortController,l=()=>u.abort();e.once("aborted",l),t.once("close",l);let f=fu.request({hostname:o,port:443,path:e.url,method:e.method,headers:r,servername:n,rejectUnauthorized:!1,signal:u.signal},g=>{if(t.writeHead(g.statusCode,g.headers),i&&i.writeHeader(g.statusCode,g.headers),!s&&!i){g.pipe(t);return}let v=[];g.on("data",y=>{i&&i.writeChunk(y),s&&v.push(y),t.write(y)}),g.on("end",()=>{if(i&&i.end(),t.end(),s)try{s(Buffer.concat(v),g.headers)}catch{}})}),c=()=>{e.removeListener("aborted",l),t.removeListener("close",l)};f.once("close",c),f.on("error",g=>{c(),!u.signal.aborted&&(ot(`Passthrough error: ${g.message}`),i&&(i.writeChunk(`
+[ERROR] ${g.message}
+`),i.end()),t.headersSent||t.writeHead(502),t.end("Bad Gateway"))}),a.length>0&&f.write(a),f.end()}var On=fu.createServer(gu,async(e,t)=>{try{if(e.url==="/_mitm_health"){t.writeHead(200,{"Content-Type":"application/json"}),t.end(JSON.stringify({ok:!0,pid:process.pid}));return}let a=await Yd(e);if(hu&&Rd(e,a,"raw"),e.headers[ou.name]===ou.value)return er(e,t,a);let r=du(e.headers.host);if(!r||!(Od[r]||[]).some(u=>e.url.includes(u)))return er(e,t,a);if(r==="cursor")return uu[r].intercept(e,t,a,null,er);let i=$d(e.url,a);if(i&&(Kd[r]||[]).some(u=>u.test(i)))return er(e,t,a);let o=Wd(r,i);return o?uu[r].intercept(e,t,a,o,er):er(e,t,a)}catch(a){ot(`Unhandled error: ${a.message}`),t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:a.message,type:"mitm_error"}}))}});function eh(e){try{let t=[];if(su){let a=`powershell -NonInteractive -WindowStyle Hidden -Command "Get-NetTCPConnection -LocalPort ${e} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess"`,r=Rn(a,{encoding:"utf-8",windowsHide:!0}).trim();if(!r)return;t=r.split(/\r?\n/).map(n=>n.trim()).filter(n=>n&&Number(n)!==process.pid&&Number(n)>4)}else{let a=Rn(`${Ud} -nP -iTCP:${e} -sTCP:LISTEN -t`,{encoding:"utf-8",windowsHide:!0}).trim();if(!a)return;t=a.split(`
 `).filter(r=>r&&Number(r)!==process.pid)}if(t.length===0)return;t.forEach(a=>{try{su?Rn(`taskkill /F /PID ${a}`,{windowsHide:!0}):process.kill(Number(a),"SIGKILL")}catch(r){ot(`Failed to kill PID ${a}: ${r.message}`)}}),Un(`Killed ${t.length} process(es) on port ${e}`)}catch(t){if(t.status!==1)throw t}}try{eh(Cr)}catch(e){ot(`Cannot kill process on port ${Cr}: ${e.message}`),process.exit(1)}On.listen(Cr,()=>Un(`\u{1F680} Server ready on :${Cr}`));On.on("error",e=>{e.code==="EADDRINUSE"?ot(`Port ${Cr} already in use`):e.code==="EACCES"?ot(`Permission denied for port ${Cr}`):ot(e.message),process.exit(1)});var{removeAllDNSEntriesSync:th}=ru(),lu=!1,Vn=()=>{if(lu)return;lu=!0,th();let e=setTimeout(()=>process.exit(0),1500);On.close(()=>{clearTimeout(e),process.exit(0)})};process.on("SIGTERM",Vn);process.on("SIGINT",Vn);process.platform==="win32"&&process.on("SIGBREAK",Vn);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.111",
+  "version": "1.0.113",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/open-sse/executors/base.js

@@ -1,3 +1,4 @@
+import { setTimeout as delay } from "node:timers/promises";
 import { HTTP_STATUS, RETRY_CONFIG, DEFAULT_RETRY_CONFIG, resolveRetryEntry, FETCH_CONNECT_TIMEOUT_MS } from "../config/runtimeConfig.js";
 import { shouldRefreshCredentials } from "../services/oauthCredentialManager.js";
 import { proxyAwareFetch } from "../utils/proxyFetch.js";
@@ -115,7 +116,7 @@ export class BaseExecutor {
       if (attempts <= 0 || retryAttemptsByUrl[urlIndex] >= attempts) return false;
       retryAttemptsByUrl[urlIndex]++;
       log?.debug?.("RETRY", `${reason} retry ${retryAttemptsByUrl[urlIndex]}/${attempts} after ${delayMs / 1000}s`);
-      await new Promise(resolve => setTimeout(resolve, delayMs));
+      await delay(delayMs, undefined, { signal });
       return true;
     };
 

package/open-sse/handlers/chatCore/sseToJsonHandler.js

@@ -36,16 +36,24 @@ function pickAssistantMessageForChatCompletion(output) {
  */
 export function parseSSEToOpenAIResponse(rawSSE, fallbackModel) {
   const chunks = [];
+  let terminated = false;
 
   for (const line of String(rawSSE || "").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed.startsWith("data:")) continue;
     const payload = trimmed.slice(5).trim();
-    if (!payload || payload === "[DONE]") continue;
-    try { chunks.push(JSON.parse(payload)); } catch { /* ignore malformed lines */ }
+    if (!payload) continue;
+    if (payload === "[DONE]") {
+      terminated = true;
+      continue;
+    }
+    let chunk;
+    try { chunk = JSON.parse(payload); } catch { return null; }
+    chunks.push(chunk);
+    if (chunk?.choices?.some((choice) => choice?.finish_reason)) terminated = true;
   }
 
-  if (chunks.length === 0) return null;
+  if (chunks.length === 0 || !terminated) return null;
 
   const first = chunks[0];
   const contentParts = [];

package/open-sse/handlers/chatCore.js

@@ -1,3 +1,4 @@
+import { setTimeout as delay } from "node:timers/promises";
 import { detectFormat, getTargetFormat } from "../services/provider.js";
 import { translateRequest } from "../translator/index.js";
 import { FORMATS } from "../translator/formats.js";
@@ -267,13 +268,13 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
         lastResult = result;
         const backoff = retryBaseMs * Math.pow(2, attempt);
         log?.info?.("RETRY", `${provider.toUpperCase()} | ${model} | HTTP ${result.response.status}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);
-        await new Promise((r) => setTimeout(r, backoff));
+        await delay(backoff, undefined, { signal: streamController.signal });
       } catch (e) {
         lastErr = e;
         if (!isRetryableError(e) || attempt === maxRetries) throw e;
         const backoff = retryBaseMs * Math.pow(2, attempt);
         log?.info?.("RETRY", `${provider.toUpperCase()} | ${model} | ${e.name}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);
-        await new Promise((r) => setTimeout(r, backoff));
+        await delay(backoff, undefined, { signal: streamController.signal });
       }
     }
     if (lastResult) return lastResult;

package/open-sse/transformer/streamToJsonConverter.js

@@ -20,7 +20,7 @@ function processSSEMessage(msg, state) {
 
   let parsed;
   try { parsed = JSON.parse(dataStr); }
-  catch { return; }
+  catch { throw new Error(`Malformed SSE data for ${eventType}`); }
 
   if (eventType === "response.created") {
     state.responseId = parsed.response?.id || state.responseId;
@@ -85,6 +85,10 @@ export async function convertResponsesStreamToJson(stream) {
     reader.releaseLock();
   }
 
+  if (state.status !== "completed") {
+    throw new Error(`Responses SSE ended without successful termination (status: ${state.status})`);
+  }
+
   // Build output array from accumulated items (ordered by index)
   const output = [];
   const maxIndex = state.items.size > 0 ? Math.max(...state.items.keys()) : -1;

package/open-sse/utils/requestLogger.js

@@ -69,25 +69,16 @@ function writeJsonFile(sessionPath, filename, data) {
   }
 }
 
-// Mask sensitive data in headers (DISABLED - keep full token for testing)
+// Mask credentials while preserving non-sensitive headers for debugging
 function maskSensitiveHeaders(headers) {
   if (!headers) return {};
-  return { ...headers };
-  
-  // Old masking code (disabled):
-  // const masked = { ...headers };
-  // const sensitiveKeys = ["authorization", "x-api-key", "cookie", "token"];
-  // 
-  // for (const key of Object.keys(masked)) {
-  //   const lowerKey = key.toLowerCase();
-  //   if (sensitiveKeys.some(sk => lowerKey.includes(sk))) {
-  //     const value = masked[key];
-  //     if (value && value.length > 20) {
-  //       masked[key] = value.slice(0, 10) + "..." + value.slice(-5);
-  //     }
-  //   }
-  // }
-  // return masked;
+  const masked = { ...headers };
+  const sensitiveKeys = ["authorization", "proxy-authorization", "x-api-key", "cookie", "set-cookie"];
+
+  for (const key of Object.keys(masked)) {
+    if (sensitiveKeys.includes(key.toLowerCase())) masked[key] = "[REDACTED]";
+  }
+  return masked;
 }
 
 // No-op logger when logging is disabled
@@ -170,7 +161,7 @@ export async function createRequestLogger(sourceFormat, targetFormat, model) {
         timestamp: new Date().toISOString(),
         status,
         statusText,
-        headers: headers ? (typeof headers.entries === "function" ? Object.fromEntries(headers.entries()) : headers) : {},
+        headers: maskSensitiveHeaders(headers ? (typeof headers.entries === "function" ? Object.fromEntries(headers.entries()) : headers) : {}),
         body
       });
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.111",
+  "version": "1.0.113",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/app/api/auth/oidc/test/route.js

@@ -22,13 +22,15 @@ export async function POST(request) {
     const body = await request.json().catch(() => ({}));
     const settings = await getSettings();
 
-    const issuerUrl = String(body.issuerUrl || settings.oidcIssuerUrl || "").trim();
+    const requestedIssuer = String(body.issuerUrl || "").trim();
+    const issuerUrl = requestedIssuer || String(settings.oidcIssuerUrl || "").trim();
     const clientId = String(body.clientId || settings.oidcClientId || "").trim();
     const scopes = String(body.scopes || settings.oidcScopes || "openid profile email").trim() || "openid profile email";
+    const sameIssuer = issuerUrl.replace(/\/+$/, "") === String(settings.oidcIssuerUrl || "").trim().replace(/\/+$/, "");
     const clientSecret = String(
       Object.prototype.hasOwnProperty.call(body, "clientSecret")
         ? body.clientSecret
-        : settings.oidcClientSecret || ""
+        : sameIssuer ? settings.oidcClientSecret || "" : ""
     ).trim();
 
     if (!issuerUrl) {

package/src/app/api/oauth/[provider]/[action]/route.js

@@ -81,29 +81,6 @@ export async function GET(request, { params }) {
       return NextResponse.json(authData);
     }
 
-    if (action === "start-proxy") {
-      if (!["codex", "xai"].includes(provider)) {
-        return NextResponse.json({ error: "Proxy only supported for codex/xai" }, { status: 400 });
-      }
-      const appPort = searchParams.get("app_port");
-      if (!appPort) {
-        return NextResponse.json({ error: "Missing app_port" }, { status: 400 });
-      }
-      const state = searchParams.get("state");
-      const codeVerifier = searchParams.get("code_verifier");
-      const redirectUri = searchParams.get("redirect_uri");
-      const result = provider === "xai"
-        ? await startXaiProxy(Number(appPort))
-        : await startCodexProxy(Number(appPort));
-      let serverSide = false;
-      if (result.success && state && codeVerifier && redirectUri) {
-        serverSide = provider === "xai"
-          ? registerXaiSession({ state, codeVerifier, redirectUri })
-          : registerCodexSession({ state, codeVerifier, redirectUri });
-      }
-      return NextResponse.json({ ...result, serverSide });
-    }
-
     if (action === "poll-status") {
       if (!["codex", "xai"].includes(provider)) {
         return NextResponse.json({ error: "Poll only supported for codex/xai" }, { status: 400 });
@@ -123,15 +100,6 @@ export async function GET(request, { params }) {
       return NextResponse.json({ status: session.status });
     }
 
-    if (action === "stop-proxy") {
-      if (!["codex", "xai"].includes(provider)) {
-        return NextResponse.json({ error: "Proxy only supported for codex/xai" }, { status: 400 });
-      }
-      if (provider === "xai") stopXaiProxy();
-      else stopCodexProxy();
-      return NextResponse.json({ success: true });
-    }
-
     if (action === "device-code") {
       const providerData = getProvider(provider);
       if (providerData.flowType !== "device_code") {
@@ -187,6 +155,35 @@ export async function POST(request, { params }) {
       return NextResponse.json({ error: "Invalid or empty request body" }, { status: 400 });
     }
 
+    if (action === "start-proxy") {
+      if (!["codex", "xai"].includes(provider)) {
+        return NextResponse.json({ error: "Proxy only supported for codex/xai" }, { status: 400 });
+      }
+      const { appPort, state, codeVerifier, redirectUri } = body;
+      if (!appPort) {
+        return NextResponse.json({ error: "Missing app_port" }, { status: 400 });
+      }
+      const result = provider === "xai"
+        ? await startXaiProxy(Number(appPort))
+        : await startCodexProxy(Number(appPort));
+      let serverSide = false;
+      if (result.success && state && codeVerifier && redirectUri) {
+        serverSide = provider === "xai"
+          ? registerXaiSession({ state, codeVerifier, redirectUri })
+          : registerCodexSession({ state, codeVerifier, redirectUri });
+      }
+      return NextResponse.json({ ...result, serverSide });
+    }
+
+    if (action === "stop-proxy") {
+      if (!["codex", "xai"].includes(provider)) {
+        return NextResponse.json({ error: "Proxy only supported for codex/xai" }, { status: 400 });
+      }
+      if (provider === "xai") stopXaiProxy();
+      else stopCodexProxy();
+      return NextResponse.json({ success: true });
+    }
+
     if (action === "exchange") {
       const { code, redirectUri, codeVerifier, state, meta } = body;
 

package/src/app/api/oauth/codebuddy-cn/bulk-import/route.js

@@ -44,6 +44,7 @@ export async function POST(request) {
       engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode,
       proxyPoolId: body?.proxyPoolId,
+      manualProxyUrl: typeof body?.manualProxyUrl === "string" && body.manualProxyUrl.trim() ? body.manualProxyUrl.trim() : null,
       region,
     });
 

package/src/app/api/terminal/session/[id]/input/route.js

@@ -1,10 +1,13 @@
 import { NextResponse } from "next/server";
+import { getTerminalOwner } from "@/lib/auth/terminalSession";
 import { writeTerminalInput } from "@/lib/terminal/sessionManager";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
 export async function POST(request, { params }) {
+  const owner = await getTerminalOwner(request);
+  if (!owner) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { id } = await params;
   let data = "";
 
@@ -21,7 +24,7 @@ export async function POST(request, { params }) {
     return NextResponse.json({ error: "Input too large" }, { status: 413 });
   }
 
-  const result = writeTerminalInput(id, data);
+  const result = writeTerminalInput(id, owner, data);
   if (!result.ok) {
     return NextResponse.json({ error: result.error || "Write failed" }, { status: 404 });
   }

package/src/app/api/terminal/session/[id]/resize/route.js

@@ -1,13 +1,16 @@
 import { NextResponse } from "next/server";
+import { getTerminalOwner } from "@/lib/auth/terminalSession";
 import { resizeTerminalSession } from "@/lib/terminal/sessionManager";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
 export async function POST(request, { params }) {
+  const owner = await getTerminalOwner(request);
+  if (!owner) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { id } = await params;
   const body = await request.json().catch(() => ({}));
-  const result = resizeTerminalSession(id, body?.cols, body?.rows);
+  const result = resizeTerminalSession(id, owner, body?.cols, body?.rows);
   if (!result.ok) {
     return NextResponse.json({ error: result.error || "Resize failed" }, { status: 404 });
   }

package/src/app/api/terminal/session/[id]/route.js

@@ -1,12 +1,15 @@
 import { NextResponse } from "next/server";
+import { getTerminalOwner } from "@/lib/auth/terminalSession";
 import { getTerminalSession, killTerminalSession } from "@/lib/terminal/sessionManager";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
-export async function GET(_request, { params }) {
+export async function GET(request, { params }) {
+  const owner = await getTerminalOwner(request);
+  if (!owner) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { id } = await params;
-  const session = getTerminalSession(id);
+  const session = getTerminalSession(id, owner);
   if (!session) {
     return NextResponse.json({ error: "Session not found" }, { status: 404 });
   }
@@ -22,9 +25,11 @@ export async function GET(_request, { params }) {
   });
 }
 
-export async function DELETE(_request, { params }) {
+export async function DELETE(request, { params }) {
+  const owner = await getTerminalOwner(request);
+  if (!owner) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { id } = await params;
-  const killed = killTerminalSession(id);
+  const killed = killTerminalSession(id, owner);
   if (!killed) {
     return NextResponse.json({ error: "Session not found" }, { status: 404 });
   }

package/src/app/api/terminal/session/[id]/stream/route.js

@@ -1,11 +1,19 @@
+import { getTerminalOwner } from "@/lib/auth/terminalSession";
 import { getTerminalSession, subscribeTerminalOutput } from "@/lib/terminal/sessionManager";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
 export async function GET(request, { params }) {
+  const owner = await getTerminalOwner(request);
+  if (!owner) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
   const { id } = await params;
-  const session = getTerminalSession(id);
+  const session = getTerminalSession(id, owner);
 
   if (!session) {
     return new Response(JSON.stringify({ error: "Session not found" }), {
@@ -54,7 +62,7 @@ export async function GET(request, { params }) {
         alive: session.alive,
       });
 
-      state.unsubscribe = subscribeTerminalOutput(id, {
+      state.unsubscribe = subscribeTerminalOutput(id, owner, {
         onData: (text) => send({ type: "data", data: text }),
         onExit: (info) => {
           send({ type: "exit", ...info });

package/src/app/api/terminal/session/route.js

@@ -1,19 +1,24 @@
 import { NextResponse } from "next/server";
+import { getTerminalOwner } from "@/lib/auth/terminalSession";
 import { createTerminalSession, listTerminalSessions } from "@/lib/terminal/sessionManager";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
-export async function GET() {
-  return NextResponse.json({ sessions: listTerminalSessions() });
+export async function GET(request) {
+  const owner = await getTerminalOwner(request);
+  if (!owner) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  return NextResponse.json({ sessions: listTerminalSessions(owner) });
 }
 
 export async function POST(request) {
   try {
+    const owner = await getTerminalOwner(request);
+    if (!owner) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     const body = await request.json().catch(() => ({}));
     const cols = Number(body?.cols) || 120;
     const rows = Number(body?.rows) || 40;
-    const session = createTerminalSession({ cols, rows });
+    const session = createTerminalSession({ cols, rows, owner });
     return NextResponse.json({ ok: true, session });
   } catch (error) {
     const status = error?.code === "MAX_SESSIONS" ? 429 : 500;

package/src/dashboardGuard.js

@@ -44,6 +44,7 @@ const ALWAYS_PROTECTED = [
   "/api/oauth/cursor/auto-import",
   "/api/oauth/kiro/auto-import",
   "/api/terminal",
+  "/api/headroom/proxy",
 ];
 
 // Require auth, but allow through if requireLogin is disabled
@@ -132,7 +133,6 @@ async function hasValidApiKey(request) {
 }
 
 async function canAccessPublicLlmApi(request) {
-  if (isLocalRequest(request)) return true;
   if (await hasValidCliToken(request)) return true;
   return await hasValidApiKey(request);
 }