zevairouter 1.0.112 → 1.0.113

package/src/lib/auth/oidc.js

@@ -1,5 +1,8 @@
 import crypto from "node:crypto";
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import dns from "node:dns/promises";
+import net from "node:net";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+import { Agent, fetch as undiciFetch } from "undici";
 import { getSettings } from "@/lib/localDb";
 
 export const OIDC_COOKIE_NAMES = {
@@ -62,13 +65,77 @@ export async function getOidcRuntimeConfig() {
   };
 }
 
+function isPrivateAddress(address) {
+  const normalized = address.toLowerCase().replace(/^::ffff:/, "");
+  if (net.isIPv4(normalized)) {
+    const [a, b] = normalized.split(".").map(Number);
+    return a === 0 || a === 10 || a === 127 || (a === 169 && b === 254) ||
+      (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
+  }
+  return normalized === "::" || normalized === "::1" || normalized.startsWith("fc") ||
+    normalized.startsWith("fd") || /^fe[89ab]/.test(normalized);
+}
+
+function validateOidcUrl(rawUrl, expectedOrigin) {
+  const url = new URL(rawUrl);
+  if (url.protocol !== "https:" || url.username || url.password || (expectedOrigin && url.origin !== expectedOrigin)) {
+    throw new Error("OIDC endpoints must use HTTPS on the issuer origin");
+  }
+  return url;
+}
+
+async function createOidcDispatcher(rawUrl, expectedOrigin) {
+  const url = validateOidcUrl(rawUrl, expectedOrigin);
+  const addresses = await dns.lookup(url.hostname, { all: true });
+  if (!addresses.length || addresses.some(({ address }) => isPrivateAddress(address))) {
+    throw new Error("OIDC endpoints must resolve to public addresses");
+  }
+  let next = 0;
+  return {
+    url,
+    dispatcher: new Agent({
+      connect: {
+        lookup(_hostname, options, callback) {
+          const candidates = addresses.filter(({ family }) => !options.family || family === options.family);
+          if (options.all) {
+            callback(null, candidates.length ? candidates : addresses);
+            return;
+          }
+          const selected = candidates[next++ % candidates.length] || addresses[0];
+          callback(null, selected.address, selected.family);
+        },
+      },
+    }),
+  };
+}
+
+async function oidcFetch(rawUrl, options = {}, expectedOrigin) {
+  const { url, dispatcher } = await createOidcDispatcher(rawUrl, expectedOrigin);
+  try {
+    return await undiciFetch(url, { ...options, redirect: "error", dispatcher });
+  } finally {
+    await dispatcher.close();
+  }
+}
+
 export async function fetchOidcDiscovery(issuerUrl) {
-  const discoveryUrl = `${trimTrailingSlashes(issuerUrl)}/.well-known/openid-configuration`;
-  const res = await fetch(discoveryUrl, { cache: "no-store" });
+  const normalizedIssuer = trimTrailingSlashes(issuerUrl);
+  const issuer = validateOidcUrl(normalizedIssuer);
+  const discoveryUrl = `${normalizedIssuer}/.well-known/openid-configuration`;
+  const res = await oidcFetch(discoveryUrl, { cache: "no-store" });
   if (!res.ok) {
     throw new Error(`Failed to load OIDC discovery document from ${discoveryUrl}`);
   }
-  return await res.json();
+  const discovery = await res.json();
+  if (!discovery.authorization_endpoint || !discovery.token_endpoint || !discovery.jwks_uri) {
+    throw new Error("OIDC discovery response is missing required endpoints");
+  }
+  await Promise.all([
+    createOidcDispatcher(discovery.authorization_endpoint, issuer.origin).then(({ dispatcher }) => dispatcher.close()),
+    createOidcDispatcher(discovery.token_endpoint, issuer.origin).then(({ dispatcher }) => dispatcher.close()),
+    createOidcDispatcher(discovery.jwks_uri, issuer.origin).then(({ dispatcher }) => dispatcher.close()),
+  ]);
+  return discovery;
 }
 
 export function createPkcePair() {
@@ -126,7 +193,7 @@ export async function exchangeOidcCode({
     body.set("client_secret", clientSecret);
   }
 
-  const res = await fetch(tokenEndpoint, {
+  const res = await oidcFetch(tokenEndpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body,
@@ -164,7 +231,7 @@ export async function probeOidcClientSecret({
     code_verifier: "__oidc_test_invalid_verifier__",
   });
 
-  const res = await fetch(tokenEndpoint, {
+  const res = await oidcFetch(tokenEndpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body,
@@ -216,7 +283,9 @@ export async function verifyOidcIdToken({
   jwksUri,
   nonce,
 }) {
-  const jwks = createRemoteJWKSet(new URL(jwksUri));
+  const jwks = createRemoteJWKSet(new URL(jwksUri), {
+    [customFetch]: (url, options) => oidcFetch(url, options),
+  });
   const { payload } = await jwtVerify(idToken, jwks, {
     issuer,
     audience,

package/src/lib/auth/terminalSession.js

@@ -1,5 +1,6 @@
 import { SignJWT, jwtVerify } from "jose";
-import { shouldUseSecureCookie } from "@/lib/auth/dashboardSession";
+import { shouldUseSecureCookie, verifyDashboardAuthToken } from "@/lib/auth/dashboardSession";
+import { getConsistentMachineId } from "@/shared/utils/machineId";
 
 // Same secret loader pattern as dashboard — import via dynamic to share SECRET
 // We re-use createDashboardAuthToken's secret by verifying with the same module path.
@@ -23,6 +24,31 @@ function loadJwtSecret() {
 const SECRET = new TextEncoder().encode(loadJwtSecret());
 const COOKIE_NAME = "terminal_token";
 const TTL = "4h";
+const CLI_TOKEN_HEADER = "x-zevai-cli-token";
+const CLI_TOKEN_SALT = "zevai-cli-auth";
+
+function ownerId(type, token) {
+  return crypto.createHash("sha256").update(`${type}\0${token}`).digest("hex");
+}
+
+export async function getTerminalOwner(request) {
+  const cliToken = request.headers.get(CLI_TOKEN_HEADER);
+  if (cliToken && cliToken === await getConsistentMachineId(CLI_TOKEN_SALT)) {
+    return ownerId("cli", cliToken);
+  }
+
+  const terminalToken = request.cookies.get(COOKIE_NAME)?.value;
+  if (await verifyTerminalUnlockToken(terminalToken)) {
+    return ownerId("terminal", terminalToken);
+  }
+
+  const dashboardToken = request.cookies.get("auth_token")?.value;
+  if (await verifyDashboardAuthToken(dashboardToken)) {
+    return ownerId("dashboard", dashboardToken);
+  }
+
+  return null;
+}
 
 export function getTerminalCookieName() {
   return COOKIE_NAME;

package/src/lib/db/adapters/betterSqliteAdapter.js

@@ -45,7 +45,7 @@ export function createBetterSqliteAdapter(filePath) {
     all(sql, params = []) { return prepare(sql).all(params); },
     exec(sql) { return db.exec(sql); },
     transaction(fn) { return db.transaction(fn)(); },
-    checkpoint() { try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {} },
+    checkpoint() { db.pragma("wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
       gracefulClose();

package/src/lib/db/adapters/bunSqliteAdapter.js

@@ -53,7 +53,7 @@ export async function createBunSqliteAdapter(filePath) {
       const tx = db.transaction(fn);
       return tx();
     },
-    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
       gracefulClose();

package/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -74,7 +74,7 @@ export async function createNodeSqliteAdapter(filePath) {
         throw e;
       }
     },
-    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
       gracefulClose();

package/src/lib/db/adapters/sqljsAdapter.js

@@ -13,29 +13,25 @@ async function loadSql() {
 export async function createSqlJsAdapter(filePath) {
   const SQLLib = await loadSql();
   const buf = fs.existsSync(filePath) ? fs.readFileSync(filePath) : null;
-  const db = new SQLLib.Database(buf);
+  let db = new SQLLib.Database(buf);
   db.exec(PRAGMA_SQL);
   // Schema is created/synced by migrate.js after adapter init
 
   let dirty = false;
-  let saveTimer = null;
-  const SAVE_DEBOUNCE_MS = 100;
+  let transactionDepth = 0;
 
   function persist() {
     const data = db.export();
-    fs.writeFileSync(filePath, Buffer.from(data));
-    dirty = false;
-  }
-
-  function scheduleSave() {
+    const tempPath = `${filePath}.tmp-${process.pid}`;
     dirty = true;
-    if (saveTimer) clearTimeout(saveTimer);
-    saveTimer = setTimeout(() => {
-      saveTimer = null;
-      if (dirty) {
-        try { persist(); } catch (e) { console.error("[sqljs] save failed:", e); }
-      }
-    }, SAVE_DEBOUNCE_MS);
+    try {
+      fs.writeFileSync(tempPath, Buffer.from(data));
+      fs.renameSync(tempPath, filePath);
+      dirty = false;
+    } catch (error) {
+      try { fs.rmSync(tempPath, { force: true }); } catch {}
+      throw error;
+    }
   }
 
   function paramsObj(params) {
@@ -50,7 +46,7 @@ export async function createSqlJsAdapter(filePath) {
       stmt.step();
       const changes = db.getRowsModified();
       const lastInsertRowid = db.exec("SELECT last_insert_rowid() as id")[0]?.values?.[0]?.[0] ?? null;
-      scheduleSave();
+      if (transactionDepth === 0) persist();
       return { changes, lastInsertRowid };
     } finally {
       stmt.free();
@@ -82,34 +78,36 @@ export async function createSqlJsAdapter(filePath) {
 
   function exec(sql) {
     db.exec(sql);
-    scheduleSave();
+    if (transactionDepth === 0) persist();
   }
 
   function transaction(fn) {
     const sp = `sp_${Math.random().toString(36).slice(2)}`;
+    const snapshot = transactionDepth === 0 ? db.export() : null;
     db.exec(`SAVEPOINT ${sp}`);
+    transactionDepth++;
     try {
       const result = fn();
       db.exec(`RELEASE ${sp}`);
-      scheduleSave();
+      transactionDepth--;
+      if (transactionDepth === 0) persist();
       return result;
     } catch (e) {
+      transactionDepth--;
       try { db.exec(`ROLLBACK TO ${sp}`); db.exec(`RELEASE ${sp}`); } catch {}
+      if (snapshot) {
+        db.close();
+        db = new SQL.Database(snapshot);
+        dirty = false;
+      }
       throw e;
     }
   }
 
   function close() {
-    if (saveTimer) clearTimeout(saveTimer);
     if (dirty) persist();
     db.close();
   }
 
-  // Flush on shutdown
-  const flush = () => { if (dirty) try { persist(); } catch {} };
-  process.on("beforeExit", flush);
-  process.on("SIGINT", flush);
-  process.on("SIGTERM", flush);
-
   return { driver: "sql.js", run, get, all, exec, transaction, close, raw: db };
 }

package/src/lib/db/backup.js

@@ -14,8 +14,9 @@ export function makeBackupDir(label) {
   return dir;
 }
 
-export function backupFile(srcPath, destDir, destName = null) {
+export function backupFile(srcPath, destDir, destName = null, adapter = null) {
   if (!fs.existsSync(srcPath)) return null;
+  adapter?.checkpoint?.();
   const name = destName || path.basename(srcPath);
   const dest = path.join(destDir, name);
   fs.copyFileSync(srcPath, dest);

package/src/lib/db/index.js

@@ -1,5 +1,6 @@
 // Public API barrel — all DB functions
 import { getAdapter } from "./driver.js";
+import { TABLES } from "./schema.js";
 import { stringifyJson, parseJson } from "./helpers/jsonCol.js";
 
 // Settings
@@ -97,6 +98,7 @@ export async function exportDb() {
     customModels: [],
     mitmAlias: {},
     pricing: {},
+    tables: Object.fromEntries(Object.keys(TABLES).map((table) => [table, db.all(`SELECT * FROM "${table}"`)])),
   };
 
   for (const r of db.all(`SELECT key, value FROM kv WHERE scope = 'modelAliases'`)) out.modelAliases[r.key] = parseJson(r.value);
@@ -114,7 +116,23 @@ export async function importDb(payload) {
   const db = await getAdapter();
 
   db.transaction(() => {
-    // Wipe all tables (keep _meta)
+    if (payload.tables && typeof payload.tables === "object" && !Array.isArray(payload.tables)) {
+      for (const table of Object.keys(TABLES).reverse()) db.run(`DELETE FROM "${table}"`);
+      for (const [table, rows] of Object.entries(payload.tables)) {
+        if (!TABLES[table] || !Array.isArray(rows)) continue;
+        for (const row of rows) {
+          const columns = Object.keys(row).filter((column) => TABLES[table].columns[column]);
+          if (columns.length === 0) continue;
+          db.run(
+            `INSERT INTO "${table}" (${columns.map((column) => `"${column}"`).join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`,
+            columns.map((column) => row[column])
+          );
+        }
+      }
+      return;
+    }
+
+    // Legacy exports replace only the datasets they historically contained.
     db.run(`DELETE FROM settings`);
     db.run(`DELETE FROM providerConnections`);
     db.run(`DELETE FROM providerNodes`);

package/src/lib/db/migrate.js

@@ -215,11 +215,22 @@ function importLegacyDetails(adapter, data) {
 // ─── Main entry ──────────────────────────────────────────────────────────
 export async function runMigrationOnce(adapter) {
   if (_migratedAdapters.has(adapter)) return;
-  _migratedAdapters.add(adapter);
 
   // Capture freshness BEFORE migrations stamp _meta (otherwise we'd misclassify
   // a brand-new DB as non-fresh once schemaVersion is written).
   const fresh = isFreshDb(adapter);
+  const oldSchemaVersion = Number(getMetaSync(adapter, "schemaVersion", 0));
+  const oldAppVersion = getMetaSync(adapter, "appVersion", null);
+  const newAppVersion = getAppVersion();
+  let preMigrationBackup = null;
+  if (!fresh && (oldSchemaVersion < latestVersion() || (oldAppVersion && oldAppVersion !== newAppVersion))) {
+    preMigrationBackup = makeBackupDir(
+      oldSchemaVersion < latestVersion()
+        ? `schema-${oldSchemaVersion}-to-${latestVersion()}`
+        : `upgrade-${oldAppVersion}-to-${newAppVersion}`
+    );
+    backupFile(DATA_FILE, preMigrationBackup, null, adapter);
+  }
 
   // 1. Always run versioned migrations chain (skip-version safe)
   const migInfo = runVersionedMigrations(adapter);
@@ -260,27 +271,21 @@ export async function runMigrationOnce(adapter) {
     try { fs.writeFileSync(MIGRATED_MARKER, new Date().toISOString()); } catch {}
     pruneOldBackups();
     console.log(`[DB][migrate] JSON → SQLite in ${Date.now() - t0}ms | legacy JSON kept at DATA_DIR | backup: ${backupDir}`);
+    _migratedAdapters.add(adapter);
     return;
   }
 
   if (fresh) {
     setMetaSync(adapter, "appVersion", getAppVersion());
+    _migratedAdapters.add(adapter);
     return;
   }
 
-  // 4. App version bump → backup data.sqlite (safety net before user-side upgrade)
-  const oldVer = getMetaSync(adapter, "appVersion", null);
-  const newVer = getAppVersion();
-  if (oldVer && oldVer !== newVer) {
-    const backupDir = makeBackupDir(`upgrade-${oldVer}-to-${newVer}`);
-    try { backupFile(DATA_FILE, backupDir); } catch {}
-    setMetaSync(adapter, "appVersion", newVer);
-    pruneOldBackups();
-    console.log(`[DB][migrate] App ${oldVer} → ${newVer} | schema ${migInfo.from} → ${migInfo.to} | backup: ${backupDir}`);
-  } else if (migInfo.applied > 0) {
-    // Schema upgrade without app version bump — still backup
-    const backupDir = makeBackupDir(`schema-${migInfo.from}-to-${migInfo.to}`);
-    try { backupFile(DATA_FILE, backupDir); } catch {}
+  // 4. Record the app version after the pre-migration backup and successful migration.
+  if (oldAppVersion !== newAppVersion) setMetaSync(adapter, "appVersion", newAppVersion);
+  if (preMigrationBackup) {
     pruneOldBackups();
+    console.log(`[DB][migrate] App ${oldAppVersion} → ${newAppVersion} | schema ${migInfo.from} → ${migInfo.to} | backup: ${preMigrationBackup}`);
   }
+  _migratedAdapters.add(adapter);
 }

package/src/lib/terminal/sessionManager.js

@@ -264,8 +264,8 @@ function writeWelcome(session, cwd) {
   );
 }
 
-export function listTerminalSessions() {
-  return Array.from(g.sessions.values()).map((s) => ({
+export function listTerminalSessions(owner) {
+  return Array.from(g.sessions.values()).filter((s) => s.owner === owner).map((s) => ({
     id: s.id,
     createdAt: s.createdAt,
     lastActive: s.lastActive,
@@ -277,21 +277,23 @@ export function listTerminalSessions() {
   }));
 }
 
-export function getTerminalSession(id) {
-  return g.sessions.get(id) || null;
+export function getTerminalSession(id, owner) {
+  const session = g.sessions.get(id);
+  return session?.owner === owner ? session : null;
 }
 
-export function createTerminalSession({ cols = 120, rows = 40 } = {}) {
+export function createTerminalSession({ cols = 120, rows = 40, owner } = {}) {
   for (const [id, s] of g.sessions) {
     if (!s.alive) destroySession(id, "cleanup");
   }
 
-  if (g.sessions.size >= MAX_SESSIONS) {
-    const oldest = Array.from(g.sessions.values()).sort((a, b) => a.lastActive - b.lastActive)[0];
+  const ownerSessions = Array.from(g.sessions.values()).filter((s) => s.owner === owner);
+  if (ownerSessions.length >= MAX_SESSIONS) {
+    const oldest = ownerSessions.sort((a, b) => a.lastActive - b.lastActive)[0];
     if (oldest) destroySession(oldest.id, "evicted");
   }
 
-  if (g.sessions.size >= MAX_SESSIONS) {
+  if (Array.from(g.sessions.values()).filter((s) => s.owner === owner).length >= MAX_SESSIONS) {
     const err = new Error(`Too many terminal sessions (max ${MAX_SESSIONS})`);
     err.code = "MAX_SESSIONS";
     throw err;
@@ -303,6 +305,7 @@ export function createTerminalSession({ cols = 120, rows = 40 } = {}) {
   const ptySpawn = spawnWithNodePty(cols, rows);
   if (ptySpawn) {
     const session = makeSessionBase(id, cols, rows, ptySpawn.mode);
+    session.owner = owner;
     session.pty = ptySpawn.term;
     session.kind = "pty";
     ptySpawn.term.onData((data) => pushOutput(session, data));
@@ -326,6 +329,7 @@ export function createTerminalSession({ cols = 120, rows = 40 } = {}) {
   const pySpawn = spawnWithPythonBridge(cols, rows);
   if (pySpawn) {
     const session = makeSessionBase(id, cols, rows, pySpawn.mode);
+    session.owner = owner;
     session.kind = "pty";
     attachChildIO(session, pySpawn.child);
     // Don't write welcome before bridge prompt — only a short header
@@ -342,6 +346,7 @@ export function createTerminalSession({ cols = 120, rows = 40 } = {}) {
   // 3) Piped shell
   const pipeSpawn = spawnWithPipe(cols, rows);
   const session = makeSessionBase(id, cols, rows, pipeSpawn.mode);
+  session.owner = owner;
   session.kind = "pipe";
   attachChildIO(session, pipeSpawn.child);
   writeWelcome(session, pipeSpawn.cwd);
@@ -350,8 +355,8 @@ export function createTerminalSession({ cols = 120, rows = 40 } = {}) {
   return { id, shell: session.shell, mode: session.mode, cols, rows };
 }
 
-export function writeTerminalInput(id, data) {
-  const session = g.sessions.get(id);
+export function writeTerminalInput(id, owner, data) {
+  const session = getTerminalSession(id, owner);
   if (!session?.alive) {
     return { ok: false, error: "Session not found or dead" };
   }
@@ -383,8 +388,8 @@ export function writeTerminalInput(id, data) {
   }
 }
 
-export function resizeTerminalSession(id, cols, rows) {
-  const session = g.sessions.get(id);
+export function resizeTerminalSession(id, owner, cols, rows) {
+  const session = getTerminalSession(id, owner);
   if (!session?.alive) return { ok: false, error: "Session not found or dead" };
   const c = Math.max(20, Math.min(500, Number(cols) || session.cols));
   const r = Math.max(5, Math.min(200, Number(rows) || session.rows));
@@ -405,12 +410,13 @@ export function resizeTerminalSession(id, cols, rows) {
   return { ok: true, cols: c, rows: r };
 }
 
-export function killTerminalSession(id) {
+export function killTerminalSession(id, owner) {
+  if (!getTerminalSession(id, owner)) return false;
   return destroySession(id, "client-kill");
 }
 
-export function subscribeTerminalOutput(id, { onData, onExit }) {
-  const session = g.sessions.get(id);
+export function subscribeTerminalOutput(id, owner, { onData, onExit }) {
+  const session = getTerminalSession(id, owner);
   if (!session) return () => {};
 
   const dataHandler = (text) => onData?.(text);

package/src/mitm/server.js

@@ -280,6 +280,10 @@ async function passthroughHttp2(req, res, bodyBuffer, headers, targetHost, onRes
 // Fallback: raw https.request HTTP/1.1 with custom DNS (bypasses /etc/hosts MITM loop)
 async function passthroughHttps(req, res, bodyBuffer, headers, targetHost, onResponse, dumper) {
   const targetIP = await resolveTargetIP(targetHost);
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  req.once("aborted", abort);
+  res.once("close", abort);
   const forwardReq = https.request({
     hostname: targetIP,
     port: 443,
@@ -287,7 +291,8 @@ async function passthroughHttps(req, res, bodyBuffer, headers, targetHost, onRes
     method: req.method,
     headers,
     servername: targetHost,
-    rejectUnauthorized: false
+    rejectUnauthorized: false,
+    signal: controller.signal
   }, (forwardRes) => {
     res.writeHead(forwardRes.statusCode, forwardRes.headers);
     if (dumper) dumper.writeHeader(forwardRes.statusCode, forwardRes.headers);
@@ -310,7 +315,14 @@ async function passthroughHttps(req, res, bodyBuffer, headers, targetHost, onRes
     });
   });
 
+  const cleanup = () => {
+    req.removeListener("aborted", abort);
+    res.removeListener("close", abort);
+  };
+  forwardReq.once("close", cleanup);
   forwardReq.on("error", (e) => {
+    cleanup();
+    if (controller.signal.aborted) return;
     err(`Passthrough error: ${e.message}`);
     if (dumper) { dumper.writeChunk(`\n[ERROR] ${e.message}\n`); dumper.end(); }
     if (!res.headersSent) res.writeHead(502);

package/src/shared/components/OAuthModal.js

@@ -238,12 +238,16 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
       let codexServerSide = false;
       if (provider === "codex") {
         try {
-          const proxyUrl = new URL(`/api/oauth/codex/start-proxy`, window.location.origin);
-          proxyUrl.searchParams.set("app_port", appPort);
-          proxyUrl.searchParams.set("state", data.state);
-          proxyUrl.searchParams.set("code_verifier", data.codeVerifier);
-          proxyUrl.searchParams.set("redirect_uri", redirectUri);
-          const proxyRes = await fetch(proxyUrl.toString());
+          const proxyRes = await fetch(`/api/oauth/codex/start-proxy`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              appPort,
+              state: data.state,
+              codeVerifier: data.codeVerifier,
+              redirectUri,
+            }),
+          });
           const proxyData = await proxyRes.json();
           codexProxyActive = proxyData.success;
           codexServerSide = !!proxyData.serverSide;
@@ -257,12 +261,16 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
       let xaiServerSide = false;
       if (provider === "xai") {
         try {
-          const proxyUrl = new URL(`/api/oauth/xai/start-proxy`, window.location.origin);
-          proxyUrl.searchParams.set("app_port", appPort);
-          proxyUrl.searchParams.set("state", data.state);
-          proxyUrl.searchParams.set("code_verifier", data.codeVerifier);
-          proxyUrl.searchParams.set("redirect_uri", redirectUri);
-          const proxyRes = await fetch(proxyUrl.toString());
+          const proxyRes = await fetch(`/api/oauth/xai/start-proxy`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              appPort,
+              state: data.state,
+              codeVerifier: data.codeVerifier,
+              redirectUri,
+            }),
+          });
           const proxyData = await proxyRes.json();
           xaiProxyActive = proxyData.success;
           xaiServerSide = !!proxyData.serverSide;
@@ -324,9 +332,9 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
       // Abort polling and cleanup proxy when modal closes
       pollingAbortRef.current = true;
       if (provider === "codex") {
-        fetch("/api/oauth/codex/stop-proxy").catch(() => {});
+        fetch("/api/oauth/codex/stop-proxy", { method: "POST" }).catch(() => {});
       } else if (provider === "xai") {
-        fetch("/api/oauth/xai/stop-proxy").catch(() => {});
+        fetch("/api/oauth/xai/stop-proxy", { method: "POST" }).catch(() => {});
       }
     }
   }, [isOpen, provider, startOAuthFlow]);
@@ -509,9 +517,9 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
   // Clear session on modal close + cleanup proxy
   const handleClose = useCallback(() => {
     if (provider === "codex") {
-      fetch("/api/oauth/codex/stop-proxy").catch(() => {});
+      fetch("/api/oauth/codex/stop-proxy", { method: "POST" }).catch(() => {});
     } else if (provider === "xai") {
-      fetch("/api/oauth/xai/stop-proxy").catch(() => {});
+      fetch("/api/oauth/xai/stop-proxy", { method: "POST" }).catch(() => {});
     }
     onClose();
   }, [onClose, provider]);