+ {quota?.raw?.freebucks && !error && !isLoading && (
+
+ {formatFreebucksHeader(quota.raw.freebucks)}
+
+ )}
{isLoading ? (
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.js b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.js
index 769e6e82..f43d8ec7 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.js
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.js
@@ -258,6 +258,49 @@ export function formatResetTime(date) {
}
}
+/**
+ * Freebucks account header line — mirrors upstream freebucksHeaderLine:
+ * "10/25 Freebucks daily · resets in 4h 12m · 20 in wallet · $6.50 monthly usage left".
+ * Wallet shown only when non-empty; monthly only when the server sent it
+ * (older servers omit it — showing $0 would read as "nothing left").
+ * @param {{balance: number|null, daily: {limit:number,spent:number,remaining:number,resetAt:string|null}, wallet:{balance:number}, monthly?:{remainingUsd:number,limitUsd:number|null,resetAt:string|null}}} freebucks
+ * @returns {string|null}
+ */
+export function formatFreebucksHeader(freebucks) {
+ if (!freebucks?.daily) return null;
+ const parts = [
+ `${Math.max(0, Math.round(freebucks.daily.remaining))}/${Math.max(0, Math.round(freebucks.daily.limit))} Freebucks daily`,
+ ];
+ const countdown = formatResetTime(freebucks.daily.resetAt);
+ if (countdown !== "-") parts.push(`resets in ${countdown}`);
+ if (Number(freebucks.wallet?.balance) > 0) {
+ parts.push(`${Math.max(0, Math.round(freebucks.wallet.balance))} in wallet`);
+ }
+ if (freebucks.monthly && Number.isFinite(Number(freebucks.monthly.remainingUsd))) {
+ parts.push(`${formatFreebucksUsd(freebucks.monthly.remainingUsd)} monthly usage left`);
+ }
+ return parts.join(" · ");
+}
+
+/**
+ * "$25", "$4.20", "$0" — whole dollars until the figure is small enough that
+ * the cents are the story. Mirrors upstream formatAllowanceUsd.
+ */
+export function formatFreebucksUsd(usd) {
+ const safe = Math.max(0, Number(usd));
+ if (safe >= 10) return `$${Math.round(safe)}`;
+ if (safe >= 1) return `$${safe.toFixed(1).replace(/\.0$/, "")}`;
+ return `$${safe.toFixed(2)}`;
+}
+
+/**
+ * "15 Freebucks/hr" — a bare number would read as dollars; the unit is the
+ * hour, not the message.
+ */
+export function formatFreebucksPrice(price) {
+ return `${Math.max(0, Math.round(Number(price) || 0))} Freebucks/hr`;
+}
+
/**
* Get Tailwind color class based on percentage
* @param {number} percentage - Remaining percentage (0-100)
@@ -685,6 +728,27 @@ export function parseQuotaData(provider, data) {
}
break;
+ case "freebuff":
+ // Session quotas keyed by model id — label rows with the friendly
+ // displayName (from the registry) and keep modelKey for ordering.
+ // Metered rows carry the live Freebucks price (price) + promo tagline
+ // (priceNote), both server-authoritative.
+ if (data.quotas) {
+ Object.entries(data.quotas).forEach(([modelKey, quota]) => {
+ normalizedQuotas.push({
+ name: quota.displayName || modelKey,
+ modelKey,
+ used: quota.used || 0,
+ total: quota.total || 0,
+ resetAt: quota.resetAt || null,
+ recurring: quota.recurring !== false,
+ price: quota.price,
+ priceNote: quota.priceNote,
+ });
+ });
+ }
+ break;
+
case "groq":
// Requests/Tokens rate-limit windows from response headers — absolute
// used/total (calculatePercentage derives the bar), like Codex/Kiro.
diff --git a/src/app/api/oauth/[provider]/[action]/route.js b/src/app/api/oauth/[provider]/[action]/route.js
index a40dd49f..3439cbe1 100644
--- a/src/app/api/oauth/[provider]/[action]/route.js
+++ b/src/app/api/oauth/[provider]/[action]/route.js
@@ -265,6 +265,7 @@ export async function GET(request, { params }) {
"qoder",
"qoder-cn",
"grok-cli",
+ "freebuff",
];
let deviceData;
if (noPkceDeviceProviders.includes(provider)) {
diff --git a/src/app/api/providers/[id]/models/route.js b/src/app/api/providers/[id]/models/route.js
index d209a30f..6900d1ba 100644
--- a/src/app/api/providers/[id]/models/route.js
+++ b/src/app/api/providers/[id]/models/route.js
@@ -471,7 +471,7 @@ const PROVIDER_MODELS_CONFIG = {
},
"grok-cli": {
customResolver: async (connection) => {
- const proxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {});
+ const proxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {}, connection.id);
const result = await resolveGrokCliModels({
...connection,
connectionId: connection.id,
diff --git a/src/app/api/providers/[id]/route.js b/src/app/api/providers/[id]/route.js
index 6ab51797..77e9a5a4 100644
--- a/src/app/api/providers/[id]/route.js
+++ b/src/app/api/providers/[id]/route.js
@@ -33,7 +33,31 @@ function normalizeProxyConfig(body = {}) {
};
}
-async function normalizeProxyPoolUpdate(proxyPoolIdInput) {
+async function normalizeProxyPoolUpdate(body) {
+ // Handle new multi-proxy format
+ if (body.proxyPoolIds !== undefined) {
+ const proxyPoolIds = Array.isArray(body.proxyPoolIds) ? body.proxyPoolIds : [];
+ const proxyRotationStrategy = body.proxyRotationStrategy || "none";
+
+ // Validate all proxy pool IDs exist
+ for (const poolId of proxyPoolIds) {
+ if (poolId) {
+ const pool = await getProxyPoolById(poolId);
+ if (!pool) {
+ return { hasProxyPoolField: true, error: `Proxy pool ${poolId} not found` };
+ }
+ }
+ }
+
+ return {
+ hasProxyPoolField: true,
+ proxyPoolIds: proxyPoolIds.filter(Boolean),
+ proxyRotationStrategy,
+ };
+ }
+
+ // Handle legacy single proxy format
+ const proxyPoolIdInput = body.proxyPoolId;
if (proxyPoolIdInput === undefined) {
return { hasProxyPoolField: false, proxyPoolId: null };
}
@@ -111,7 +135,7 @@ export async function PUT(request, { params }) {
return NextResponse.json({ error: proxyConfig.error }, { status: 400 });
}
- const proxyPoolResult = await normalizeProxyPoolUpdate(body.proxyPoolId);
+ const proxyPoolResult = await normalizeProxyPoolUpdate(body);
if (proxyPoolResult.error) {
return NextResponse.json({ error: proxyPoolResult.error }, { status: 400 });
}
@@ -147,10 +171,19 @@ export async function PUT(request, { params }) {
}
if (proxyPoolResult.hasProxyPoolField) {
- if (proxyPoolResult.proxyPoolId === null) {
+ // Handle new multi-proxy format
+ if (proxyPoolResult.proxyPoolIds !== undefined) {
+ updateData.providerSpecificData.proxyPoolIds = proxyPoolResult.proxyPoolIds;
+ updateData.providerSpecificData.proxyRotationStrategy = proxyPoolResult.proxyRotationStrategy;
+ // Clear legacy field
delete updateData.providerSpecificData.proxyPoolId;
} else {
- updateData.providerSpecificData.proxyPoolId = proxyPoolResult.proxyPoolId;
+ // Handle legacy single-proxy format
+ if (proxyPoolResult.proxyPoolId === null) {
+ delete updateData.providerSpecificData.proxyPoolId;
+ } else {
+ updateData.providerSpecificData.proxyPoolId = proxyPoolResult.proxyPoolId;
+ }
}
}
}
diff --git a/src/app/api/providers/[id]/test/testUtils.js b/src/app/api/providers/[id]/test/testUtils.js
index b81294d4..15e072a8 100644
--- a/src/app/api/providers/[id]/test/testUtils.js
+++ b/src/app/api/providers/[id]/test/testUtils.js
@@ -19,6 +19,7 @@ import {
KIMCHI_CONFIG,
} from "@/lib/oauth/constants/oauth";
import { buildClineHeaders } from "@/shared/utils/clineAuth";
+import { decodeJwtPayload } from "@/lib/oauth/providerHelpers";
// OAuth provider test endpoints
const OAUTH_TEST_CONFIG = {
@@ -100,6 +101,26 @@ const OAUTH_TEST_CONFIG = {
authPrefix: "Bearer ",
},
"codebuddy-cn": { tokenExists: true },
+ // GUARD — DO NOT REMOVE. See AGENTS.md §4. Without this entry, Test Connection
+ // returns "Provider test not supported". codebuddy-intl access tokens are
+ // Keycloak JWTs (iss .../auth/realms/copilot); probe the realm's userinfo
+ // endpoint so a revoked/expired token is caught. Derive the realm URL from the
+ // token's `iss` claim, falling back to the known copilot realm.
+ // 200 = valid, 401 = invalid/revoked.
+ // Covered by tests/unit/codebuddy-intl-connection.test.js.
+ "codebuddy-intl": {
+ buildUrl: (token) => {
+ const iss = decodeJwtPayload(token)?.iss;
+ const base = typeof iss === "string" && iss.startsWith("https://")
+ ? iss.replace(/\/$/, "")
+ : "https://www.codebuddy.ai/auth/realms/copilot";
+ return `${base}/protocol/openid-connect/userinfo`;
+ },
+ method: "GET",
+ authHeader: "Authorization",
+ authPrefix: "Bearer ",
+ refreshable: true,
+ },
kimchi: {
url: KIMCHI_CONFIG.validationUrl || "https://api.cast.ai/v1/llm/openai/supported-providers",
method: "GET",
@@ -111,9 +132,24 @@ const OAUTH_TEST_CONFIG = {
},
refreshable: false,
},
+ freebuff: {
+ // The session endpoint doubles as the auth probe: GET never claims a
+ // session (POST would burn 1.0 unit of the daily quota). Mirrors the usage
+ // handler: 401 = bad token, 403 = region/account gate (token still valid),
+ // 404 = no session row yet (pre-join, token valid). No refresh path —
+ // when the authToken dies the user re-logs in.
+ url: "https://www.codebuff.com/api/v1/freebuff/session",
+ method: "GET",
+ authHeader: "Authorization",
+ authPrefix: "Bearer ",
+ extraHeaders: { Accept: "application/json", "User-Agent": "codebuff-cli/0.0.138" },
+ acceptStatuses: [403, 404],
+ softFailMessage: {
+ 403: "Connected, but Freebuff is gated (403) — country blocked or account banned.",
+ },
+ },
// Grok CLI / Grok Build — probe /v1/user (no inference quota). Headers mirror official CLI.
- "grok-cli": {
- url: PROVIDERS["grok-cli"]?.userUrl || "https://cli-chat-proxy.grok.com/v1/user",
+ "grok-cli": { url: PROVIDERS["grok-cli"]?.userUrl || "https://cli-chat-proxy.grok.com/v1/user",
method: "GET",
authHeader: "Authorization",
authPrefix: "Bearer ",
@@ -247,7 +283,7 @@ async function refreshOAuthToken(connection) {
return { accessToken: data.access_token, expiresIn: data.expires_in, refreshToken: data.refresh_token || refreshToken };
}
- if (provider === "codex" || provider === "grok-cli" || provider === "xai") {
+ if (provider === "codex" || provider === "grok-cli" || provider === "xai" || provider === "codebuddy-intl") {
return await refreshProviderCredentials(provider, connection, console);
}
@@ -849,7 +885,7 @@ export async function testSingleConnection(id) {
const connection = await getProviderConnectionById(id);
if (!connection) return { valid: false, error: "Connection not found", latencyMs: 0, testedAt: new Date().toISOString() };
- const effectiveProxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {});
+ const effectiveProxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {}, connection.id);
if (effectiveProxy.connectionProxyEnabled && effectiveProxy.connectionProxyUrl && !effectiveProxy.vercelRelayUrl) {
const proxyResult = await testProxyUrl({ proxyUrl: effectiveProxy.connectionProxyUrl });
diff --git a/src/app/api/providers/client/route.js b/src/app/api/providers/client/route.js
index be5342c1..9aff702f 100644
--- a/src/app/api/providers/client/route.js
+++ b/src/app/api/providers/client/route.js
@@ -1,6 +1,6 @@
import { NextResponse } from "next/server";
import { getProviderConnections } from "@/lib/localDb";
-import { backfillCodexEmails } from "@/lib/oauth/providers";
+import { backfillCodexEmails, backfillCodeBuddyIntlIdentity } from "@/lib/oauth/providers";
import { USAGE_APIKEY_PROVIDERS, USAGE_SUPPORTED_PROVIDERS } from "@/shared/constants/providers";
const SAFE_FIELDS = [
@@ -77,6 +77,7 @@ function sortConnections(connections, sort) {
export async function GET(request) {
try {
await backfillCodexEmails();
+ await backfillCodeBuddyIntlIdentity();
const { searchParams } = new URL(request.url);
const provider = searchParams.get("provider") || "all";
diff --git a/src/app/api/providers/route.js b/src/app/api/providers/route.js
index 5885472b..76b7438a 100644
--- a/src/app/api/providers/route.js
+++ b/src/app/api/providers/route.js
@@ -9,6 +9,7 @@ import {
import { APIKEY_PROVIDERS } from "@/shared/constants/config";
import { AI_PROVIDERS, FREE_TIER_PROVIDERS, WEB_COOKIE_PROVIDERS, isOpenAICompatibleProvider, isAnthropicCompatibleProvider, isCustomEmbeddingProvider } from "@/shared/constants/providers";
import { normalizeProviderId, normalizeProviderSpecificData } from "@/lib/providerNormalization";
+import { backfillCodeBuddyIntlIdentity } from "@/lib/oauth/providers";
export const dynamic = "force-dynamic";
@@ -49,6 +50,9 @@ async function normalizeProxyPoolId(proxyPoolId) {
// GET /api/providers - List all connections
export async function GET() {
try {
+ // Self-heal legacy CodeBuddy Intl OAuth rows that predate identity capture
+ // (they show as "Account N" with no email). Runs once per process.
+ await backfillCodeBuddyIntlIdentity();
const connections = await getProviderConnections();
// Build nodeNameMap for compatible providers (id → name)
diff --git a/src/app/api/proxy-pools/[id]/fitness/clear/route.js b/src/app/api/proxy-pools/[id]/fitness/clear/route.js
new file mode 100644
index 00000000..947258c6
--- /dev/null
+++ b/src/app/api/proxy-pools/[id]/fitness/clear/route.js
@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { clearPoolUnfit, ensurePoolFitnessHydrated } from "open-sse/services/proxyPoolFitness.js";
+
+// POST /api/proxy-pools/[id]/fitness/clear
+// Body: { scope: "provider::model" } — clears the mark for this pool + scope.
+export async function POST(request, { params }) {
+ try {
+ await ensurePoolFitnessHydrated();
+ const { id } = await params;
+ let body = {};
+ try {
+ body = await request.json();
+ } catch {
+ body = {};
+ }
+ const scope = typeof body?.scope === "string" ? body.scope.trim() : "";
+ if (!id || !scope) {
+ return NextResponse.json({ error: "pool id and scope are required" }, { status: 400 });
+ }
+ clearPoolUnfit(id, scope);
+ return NextResponse.json({ ok: true, poolId: id, scope });
+ } catch (error) {
+ console.log("Error clearing pool fitness:", error);
+ return NextResponse.json({ error: "Failed to clear pool fitness" }, { status: 500 });
+ }
+}
diff --git a/src/app/api/proxy-pools/fitness/clear-all/route.js b/src/app/api/proxy-pools/fitness/clear-all/route.js
new file mode 100644
index 00000000..5d89bc9c
--- /dev/null
+++ b/src/app/api/proxy-pools/fitness/clear-all/route.js
@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { clearAllPoolUnfit, ensurePoolFitnessHydrated } from "open-sse/services/proxyPoolFitness.js";
+
+// POST /api/proxy-pools/fitness/clear-all
+// Body: { provider?: string } — clears every mark, or only marks scoped to the
+// given provider ("provider::*") when provided.
+export async function POST(request) {
+ try {
+ await ensurePoolFitnessHydrated();
+ let body = {};
+ try {
+ body = await request.json();
+ } catch {
+ body = {};
+ }
+ const provider = typeof body?.provider === "string" && body.provider.trim() ? body.provider.trim() : null;
+ clearAllPoolUnfit(provider);
+ return NextResponse.json({ ok: true, provider: provider || null });
+ } catch (error) {
+ console.log("Error clearing proxy fitness:", error);
+ return NextResponse.json({ error: "Failed to clear proxy fitness" }, { status: 500 });
+ }
+}
diff --git a/src/app/api/proxy-pools/fitness/route.js b/src/app/api/proxy-pools/fitness/route.js
new file mode 100644
index 00000000..4f178b1c
--- /dev/null
+++ b/src/app/api/proxy-pools/fitness/route.js
@@ -0,0 +1,14 @@
+import { NextResponse } from "next/server";
+import { ensurePoolFitnessHydrated, poolFitnessSnapshot } from "open-sse/services/proxyPoolFitness.js";
+
+// GET /api/proxy-pools/fitness — in-memory snapshot of pool fitness marks.
+// Returns { pools: { [poolId]: { [scope]: { until, reason } } } }.
+export async function GET() {
+ try {
+ await ensurePoolFitnessHydrated();
+ return NextResponse.json({ pools: poolFitnessSnapshot() });
+ } catch (error) {
+ console.log("Error reading proxy fitness:", error);
+ return NextResponse.json({ error: "Failed to read proxy fitness" }, { status: 500 });
+ }
+}
diff --git a/src/app/api/proxy-pools/route.js b/src/app/api/proxy-pools/route.js
index 3dcfa06f..3d05aa3e 100644
--- a/src/app/api/proxy-pools/route.js
+++ b/src/app/api/proxy-pools/route.js
@@ -1,5 +1,6 @@
import { NextResponse } from "next/server";
import { createProxyPool, getProviderConnections, getProxyPools } from "@/models";
+import { getPoolGeo } from "open-sse/services/poolGeo.js";
function toBoolean(value) {
if (value === "true") return true;
@@ -65,6 +66,8 @@ export async function GET(request) {
const enrichedProxyPools = proxyPools.map((pool) => ({
...pool,
boundConnectionCount: usageMap.get(pool.id) || 0,
+ // Egress geo from the background probe cache (null until first probe).
+ egress: getPoolGeo(pool.id) || null,
}));
return NextResponse.json({ proxyPools: enrichedProxyPools });
diff --git a/src/app/api/system/memory/route.js b/src/app/api/system/memory/route.js
new file mode 100644
index 00000000..41101d7c
--- /dev/null
+++ b/src/app/api/system/memory/route.js
@@ -0,0 +1,62 @@
+import { NextResponse } from "next/server";
+import fs from "node:fs";
+import path from "node:path";
+import { getDataDir } from "@/lib/dataDir";
+import { DATA_DIR, DATA_FILE } from "@/lib/db/paths";
+import { poolFitnessSnapshot } from "open-sse/services/proxyPoolFitness.js";
+import { poolGeoSnapshot } from "open-sse/services/poolGeo.js";
+
+function formatMB(bytes) {
+ return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;
+}
+
+function dirSizeMB(dir, maxDepth = 4) {
+ let total = 0;
+ const walk = (p, depth) => {
+ if (depth > maxDepth) return;
+ let entries = [];
+ try {
+ entries = fs.readdirSync(p, { withFileTypes: true });
+ } catch {
+ return;
+ }
+ for (const e of entries) {
+ const full = path.join(p, e.name);
+ try {
+ if (e.isDirectory()) walk(full, depth + 1);
+ else if (e.isFile()) total += fs.statSync(full).size;
+ } catch { /* skip */ }
+ }
+ };
+ walk(dir, 0);
+ return total;
+}
+
+// GET /api/system/memory — data + in-memory state sizes.
+export async function GET() {
+ try {
+ const dataDir = getDataDir();
+ const dbPath = DATA_FILE;
+ let dbFile = 0;
+ try { dbFile = fs.statSync(dbPath).size; } catch { dbFile = 0; }
+
+ const fitness = poolFitnessSnapshot();
+ const geo = poolGeoSnapshot();
+ const { sessionStateSize } = await import("open-sse/executors/freebuff.js");
+
+ return NextResponse.json({
+ dataDir,
+ dbPath,
+ dbSizeMB: formatMB(dbFile),
+ dataDirSizeMB: formatMB(dirSizeMB(dataDir)),
+ inMemory: {
+ fitnessPools: Object.keys(fitness).length,
+ geoPools: Object.keys(geo).length,
+ freebuff: sessionStateSize(),
+ },
+ });
+ } catch (error) {
+ console.log("Error reading memory sizes:", error);
+ return NextResponse.json({ error: "Failed to read memory sizes" }, { status: 500 });
+ }
+}
\ No newline at end of file
diff --git a/src/app/api/usage/[connectionId]/route.js b/src/app/api/usage/[connectionId]/route.js
index 84dd7674..c7469e64 100644
--- a/src/app/api/usage/[connectionId]/route.js
+++ b/src/app/api/usage/[connectionId]/route.js
@@ -146,7 +146,7 @@ export async function GET(request, { params }) {
}
// Resolve connection proxy config; force strictProxy=false so quota/refresh fall back to direct on failure
- const proxyConfig = await resolveConnectionProxyConfig(connection.providerSpecificData);
+ const proxyConfig = await resolveConnectionProxyConfig(connection.providerSpecificData, connection.id);
const proxyOptions = {
connectionProxyEnabled: proxyConfig.connectionProxyEnabled === true,
connectionProxyUrl: proxyConfig.connectionProxyUrl || "",
diff --git a/src/lib/db/repos/connectionsRepo.js b/src/lib/db/repos/connectionsRepo.js
index 78abfc90..28b419be 100644
--- a/src/lib/db/repos/connectionsRepo.js
+++ b/src/lib/db/repos/connectionsRepo.js
@@ -8,6 +8,7 @@ const OPTIONAL_FIELDS = [
"scope", "projectId", "apiKey", "testStatus",
"lastTested", "lastError", "lastErrorAt", "rateLimitedUntil", "expiresIn", "errorCode",
"consecutiveUseCount", "idToken", "lastRefreshAt",
+ "proxyRotationStrategy", "proxyPoolIds",
];
const MODEL_LOCK_PREFIX = "modelLock_";
diff --git a/src/lib/network/connectionProxy.js b/src/lib/network/connectionProxy.js
index 9ecd2535..393382ec 100644
--- a/src/lib/network/connectionProxy.js
+++ b/src/lib/network/connectionProxy.js
@@ -1,4 +1,5 @@
import { getProxyPoolById } from "@/models";
+import { ensurePoolFitnessHydrated, fitPoolIds } from "open-sse/services/proxyPoolFitness.js";
// Safely normalize any value into a trimmed string.
function normalizeString(value) {
@@ -13,24 +14,43 @@ const rotateState = new Map(); // providerId → { index }
* Pick one proxy pool ID from a list based on strategy.
* round-robin: cycle sequentially (in-memory, resets on restart)
* random: uniform random pick
+ * smart: region-aware — skip pools unfit for `scope`, round-robin on the fit subset
* none/single: return first entry
+ * @param {string[]} poolIds
+ * @param {string} strategy
+ * @param {string} providerId
+ * @param {{ scope?: string, excludeIds?: string[] }} [opts]
*/
-export function pickProxyPoolId(poolIds, strategy, providerId) {
+export function pickProxyPoolId(poolIds, strategy, providerId, opts = {}) {
if (!poolIds || poolIds.length === 0) return null;
- if (poolIds.length === 1) return poolIds[0];
+ const { scope = null, excludeIds = [] } = opts || {};
- if (strategy === "round-robin") {
+ let eligible = poolIds.filter((id) => !(excludeIds || []).includes(id));
+ // Region-aware filtering is opt-in via the "smart" strategy.
+ if (strategy === "smart" && scope) eligible = fitPoolIds(eligible, scope);
+
+ if (eligible.length === 0) {
+ // Freebuff must never reuse a limited-IP egress. Other providers retain
+ // the previous fail-open behavior when every smart candidate is marked
+ // unfit; their executors may have their own pool fallback semantics.
+ if (providerId === "freebuff" && strategy === "smart") return null;
+ eligible = poolIds.filter((id) => !(excludeIds || []).includes(id));
+ if (eligible.length === 0) return null;
+ }
+ if (eligible.length === 1) return eligible[0];
+
+ if (strategy === "round-robin" || strategy === "smart") {
const state = rotateState.get(providerId) || { index: -1 };
- state.index = (state.index + 1) % poolIds.length;
+ state.index = (state.index + 1) % eligible.length;
rotateState.set(providerId, state);
- return poolIds[state.index];
+ return eligible[state.index];
}
if (strategy === "random") {
- return poolIds[Math.floor(Math.random() * poolIds.length)];
+ return eligible[Math.floor(Math.random() * eligible.length)];
}
- return poolIds[0]; // "none" or unknown
+ return eligible[0]; // "none" or unknown
}
/**
@@ -59,75 +79,127 @@ function normalizeLegacyProxy(providerSpecificData = {}) {
* Resolve final proxy configuration.
*
* Priority:
- * 1. Proxy Pool
- * 2. Legacy Proxy
- * 3. No Proxy
+ * 1. Multi-Proxy Pool (new format with rotation)
+ * 2. Single Proxy Pool (legacy)
+ * 3. Legacy Proxy
+ * 4. No Proxy
*/
export async function resolveConnectionProxyConfig(
- providerSpecificData = {}
+ providerSpecificData = {},
+ connectionId = null,
+ excludePoolIds = null
) {
try {
- const proxyPoolIdRaw = normalizeString(
- providerSpecificData?.proxyPoolId
- );
-
- // "__none__" means explicitly disabled
- const proxyPoolId =
- proxyPoolIdRaw === "__none__" ? "" : proxyPoolIdRaw;
+ await ensurePoolFitnessHydrated();
+ // Handle new multi-proxy format
+ const proxyPoolIds = providerSpecificData?.proxyPoolIds || [];
+ const proxyRotationStrategy = providerSpecificData?.proxyRotationStrategy || "none";
+
+ // Handle legacy single-proxy format
+ const legacyProxyPoolId = normalizeString(providerSpecificData?.proxyPoolId);
+ const proxyPoolIdRaw = legacyProxyPoolId === "__none__" ? "" : legacyProxyPoolId;
const legacy = normalizeLegacyProxy(providerSpecificData);
+ const multiPoolScope = providerSpecificData?.proxyPoolScope || null;
+ let selectedPoolId = null;
/**
* -----------------------------
- * Proxy Pool Resolution
+ * Multi-Proxy Pool Resolution (NEW)
* -----------------------------
*/
- if (proxyPoolId) {
- const proxyPool = await getProxyPoolById(proxyPoolId);
+ if (proxyPoolIds.length > 0) {
+ selectedPoolId = pickProxyPoolId(proxyPoolIds, proxyRotationStrategy, connectionId, { scope: multiPoolScope, excludeIds: excludePoolIds });
+
+ if (selectedPoolId) {
+ const proxyPool = await getProxyPoolById(selectedPoolId);
+ const proxyUrl = normalizeString(proxyPool?.proxyUrl);
+ const noProxy = normalizeString(proxyPool?.noProxy);
+ const isValidPool = proxyPool && proxyPool.isActive === true && proxyUrl;
+
+ if (isValidPool) {
+ /**
+ * Vercel/Cloudflare relay proxies use base URL rewriting
+ * instead of HTTP_PROXY environment variables.
+ */
+ if (proxyPool.type === "vercel" || proxyPool.type === "cloudflare" || proxyPool.type === "deno") {
+ return {
+ source: proxyPool.type,
+ proxyPoolId: selectedPoolId,
+ proxyPool,
+ connectionProxyEnabled: false,
+ connectionProxyUrl: "",
+ connectionNoProxy: noProxy,
+ strictProxy: proxyPool.strictProxy === true,
+ vercelRelayUrl: proxyUrl,
+ };
+ }
+
+ /**
+ * Standard proxy pool
+ */
+ return {
+ source: "pool",
+ proxyPoolId: selectedPoolId,
+ proxyPool,
+ connectionProxyEnabled: true,
+ connectionProxyUrl: proxyUrl,
+ connectionNoProxy: noProxy,
+ strictProxy: proxyPool.strictProxy === true,
+ };
+ }
+ }
+ }
+ if (
+ !selectedPoolId &&
+ proxyRotationStrategy === "smart" &&
+ multiPoolScope?.startsWith("freebuff::")
+ ) {
+ return {
+ source: "pool",
+ proxyPoolId: null,
+ proxyPool: null,
+ noFitPool: true,
+ connectionProxyEnabled: false,
+ connectionProxyUrl: "",
+ connectionNoProxy: "",
+ strictProxy: true,
+ };
+ }
+
+ /**
+ * -----------------------------
+ * Single Proxy Pool Resolution (LEGACY)
+ * -----------------------------
+ */
+ if (proxyPoolIdRaw) {
+ const proxyPool = await getProxyPoolById(proxyPoolIdRaw);
const proxyUrl = normalizeString(proxyPool?.proxyUrl);
const noProxy = normalizeString(proxyPool?.noProxy);
-
- const isValidPool =
- proxyPool &&
- proxyPool.isActive === true &&
- proxyUrl;
+ const isValidPool = proxyPool && proxyPool.isActive === true && proxyUrl;
if (isValidPool) {
- /**
- * Vercel/Cloudflare relay proxies use base URL rewriting
- * instead of HTTP_PROXY environment variables.
- */
if (proxyPool.type === "vercel" || proxyPool.type === "cloudflare" || proxyPool.type === "deno") {
return {
source: proxyPool.type,
-
- proxyPoolId,
+ proxyPoolId: proxyPoolIdRaw,
proxyPool,
-
connectionProxyEnabled: false,
connectionProxyUrl: "",
connectionNoProxy: noProxy,
-
strictProxy: proxyPool.strictProxy === true,
-
- vercelRelayUrl: proxyUrl, // Still mapped to vercelRelayUrl in the unified payload since they use the exact same header spec
+ vercelRelayUrl: proxyUrl,
};
}
- /**
- * Standard proxy pool
- */
return {
source: "pool",
-
- proxyPoolId,
+ proxyPoolId: proxyPoolIdRaw,
proxyPool,
-
connectionProxyEnabled: true,
connectionProxyUrl: proxyUrl,
connectionNoProxy: noProxy,
-
strictProxy: proxyPool.strictProxy === true,
};
}
@@ -145,7 +217,7 @@ export async function resolveConnectionProxyConfig(
return {
source: "legacy",
- proxyPoolId: proxyPoolId || null,
+ proxyPoolId: proxyPoolIdRaw || null,
proxyPool: null,
...legacy,
@@ -160,7 +232,7 @@ export async function resolveConnectionProxyConfig(
return {
source: "none",
- proxyPoolId: proxyPoolId || null,
+ proxyPoolId: proxyPoolIdRaw || null,
proxyPool: null,
...legacy,
diff --git a/src/lib/network/poolEgressProbe.js b/src/lib/network/poolEgressProbe.js
new file mode 100644
index 00000000..61b1e4b7
--- /dev/null
+++ b/src/lib/network/poolEgressProbe.js
@@ -0,0 +1,115 @@
+// Background pool egress geo probe — fills the poolGeo cache so the Proxy
+// Fitness / Proxy Pools UI can show each pool's egress IP + country, and
+// future provider region policies can pre-mark pools unfit.
+// Fail-open everywhere; never blocks startup or requests.
+//
+// Rate safety: each probe hits ipinfo.io through the pool; quotas are small,
+// so failing pools get a negative backoff instead of being re-probed every
+// pass, and per-pass output is a single aggregated summary line.
+
+import { getProxyPools } from "@/models";
+import { probePoolGeo, setPoolGeo, getPoolGeo } from "open-sse/services/poolGeo.js";
+import { isNonServerRuntime } from "@/sse/services/backgroundTokenRefresh.js";
+import { getSettings } from "@/lib/localDb";
+
+const PROBE_INTERVAL_MS = 30 * 60 * 1000;
+const INITIAL_DELAY_MS = 15 * 1000;
+const CONCURRENCY = 3;
+// Re-probe a pool when its last sample is older than this — multiple samples
+// per pool are what let us flag flapping (changing egress) relays.
+const GEO_REPROBE_MS = 30 * 60 * 1000;
+
+// Backoff windows per failure family: server/rate problems are likely to
+// persist (broken relay, exhausted quota), network blips recover sooner.
+const BACKOFF = {
+ "rate-limit": 2 * 60 * 60 * 1000,
+ server: 2 * 60 * 60 * 1000,
+ network: 30 * 60 * 1000,
+ timeout: 30 * 60 * 1000,
+ "no-ip": 30 * 60 * 1000,
+};
+
+let started = false;
+let intervalHandle = null;
+let initialTimeoutHandle = null;
+let probing = false;
+const probeBackoff = new Map(); // poolId -> retryAfter (ms epoch)
+
+function isTruthyEnv(v) {
+ if (v == null || v === "") return false;
+ return ["1", "true", "yes", "on"].includes(String(v).trim().toLowerCase());
+}
+
+// probe with bounded concurrency; skips pools in backoff or with fresh samples.
+async function probeAll() {
+ if (probing) return;
+ probing = true;
+ try {
+ // UI toggle (settings.poolGeoProbeEnabled) gates the whole feature; the
+ // env var remains a hard override for headless setups.
+ try {
+ const settings = await getSettings();
+ if (settings?.poolGeoProbeEnabled === false) return;
+ } catch { /* DB hiccup — keep probing (fail-open) */ }
+
+ const pools = await getProxyPools({ isActive: true });
+ const now = Date.now();
+ const active = (pools || []).filter((p) => !!p?.proxyUrl);
+ const targets = active.filter((p) => {
+ const until = probeBackoff.get(p.id);
+ if (until && until > now) return false; // waiting out a failure
+ const geo = getPoolGeo(p.id);
+ return !geo || now - geo.ts >= GEO_REPROBE_MS;
+ });
+ if (targets.length === 0) return;
+
+ const failTally = {};
+ let next = 0;
+ const workers = Array.from({ length: Math.min(CONCURRENCY, Math.max(targets.length, 1)) }, async () => {
+ while (next < targets.length) {
+ const pool = targets[next++];
+ const res = await probePoolGeo(pool);
+ if (res.ok) {
+ setPoolGeo(pool.id, res.geo);
+ if (probeBackoff.has(pool.id)) probeBackoff.delete(pool.id);
+ } else {
+ failTally[res.error] = (failTally[res.error] || 0) + 1;
+ probeBackoff.set(pool.id, now + (BACKOFF[res.error] || BACKOFF.network));
+ }
+ }
+ });
+ await Promise.allSettled(workers);
+
+ const filled = active.filter((p) => getPoolGeo(p.id)).length;
+ const failSummary = Object.entries(failTally).map(([k, n]) => `${k}×${n}`).join(", ") || "none";
+ console.log(`[PoolEgressProbe] geo ${filled}/${active.length} · fail: ${failSummary}`);
+ } catch (e) {
+ console.log(`[PoolEgressProbe] pass failed: ${e?.message || e}`);
+ } finally {
+ probing = false;
+ }
+}
+
+export function startPoolEgressProbe({ intervalMs } = {}) {
+ if (started) return false;
+ if (isNonServerRuntime()) return false;
+ if (isTruthyEnv(process.env.POOL_GEO_PROBE_DISABLED)) return false;
+ started = true;
+ const period = Number.isFinite(intervalMs) && intervalMs > 0 ? intervalMs : PROBE_INTERVAL_MS;
+ console.log("[PoolEgressProbe] Scheduler started", { intervalMs: period, initialDelayMs: INITIAL_DELAY_MS });
+ initialTimeoutHandle = setTimeout(() => { probeAll().catch(() => {}); }, INITIAL_DELAY_MS);
+ if (initialTimeoutHandle.unref) initialTimeoutHandle.unref();
+ intervalHandle = setInterval(() => { probeAll().catch(() => {}); }, period);
+ if (intervalHandle.unref) intervalHandle.unref();
+ return true;
+}
+
+export function stopPoolEgressProbe() {
+ if (initialTimeoutHandle) clearTimeout(initialTimeoutHandle);
+ if (intervalHandle) clearInterval(intervalHandle);
+ initialTimeoutHandle = null;
+ intervalHandle = null;
+ started = false;
+}
+
+export const __test__ = { probeAll };
\ No newline at end of file
diff --git a/src/lib/network/stateSweeper.js b/src/lib/network/stateSweeper.js
new file mode 100644
index 00000000..df33c673
--- /dev/null
+++ b/src/lib/network/stateSweeper.js
@@ -0,0 +1,47 @@
+// Periodic in-memory state sweeper — a cron-like job that prunes expired data
+// so here long-running servers never accumulate stale entries:
+// • pool fitness marks (proxyPoolFitness.pruneExpired)
+// • pool egress geo cache incl. ipHistory (poolGeo.pruneStaleGeo)
+// • freebuff session cache + cooldowns (freebuff.pruneSessionState)
+// Fail-open everywhere; never blocks startup or requests.
+
+import { pruneExpired } from "open-sse/services/proxyPoolFitness.js";
+import { pruneStaleGeo } from "open-sse/services/poolGeo.js";
+import { isNonServerRuntime } from "@/sse/services/backgroundTokenRefresh.js";
+
+const SWEEP_INTERVAL_MS = 10 * 60 * 1000;
+
+let started = false;
+let handle = null;
+
+async function sweep() {
+ try {
+ const fitness = pruneExpired();
+ const geo = pruneStaleGeo();
+ const { pruneSessionState } = await import("open-sse/executors/freebuff.js");
+ const sessions = pruneSessionState();
+ if (fitness || geo || sessions) {
+ console.log(`[StateSweeper] pruned ${fitness} fitness, ${geo} geo, ${sessions} session/cooldown entries`);
+ }
+ } catch {
+ // fail-open: next tick retries
+ }
+}
+
+export function startStateSweeper({ intervalMs } = {}) {
+ if (started) return false;
+ if (isNonServerRuntime()) return false;
+ started = true;
+ const period = Number.isFinite(intervalMs) && intervalMs > 0 ? intervalMs : SWEEP_INTERVAL_MS;
+ handle = setInterval(() => { sweep().catch(() => {}); }, period);
+ if (handle.unref) handle.unref();
+ return true;
+}
+
+export function stopStateSweeper() {
+ if (handle) clearInterval(handle);
+ handle = null;
+ started = false;
+}
+
+export const __test__ = { sweep };
\ No newline at end of file
diff --git a/src/lib/oauth/constants/oauth.js b/src/lib/oauth/constants/oauth.js
index cd35d331..163986e0 100644
--- a/src/lib/oauth/constants/oauth.js
+++ b/src/lib/oauth/constants/oauth.js
@@ -127,6 +127,9 @@ export const KIMCHI_CONFIG = { ...PROVIDER_OAUTH["kimchi"] };
// Endpoint: cli-chat-proxy.grok.com — same client_id as xai, different flow + scopes
export const GROK_CLI_CONFIG = { ...PROVIDER_OAUTH["grok-cli"] };
+// Freebuff OAuth Configuration (Device Code Flow)
+export const FREEBUFF_CONFIG = { ...PROVIDER_OAUTH["freebuff"] };
+
// Trae (ByteDance marscode) OAuth — authorization_code flow with local callback.
// 1) POST GetLoginGuidance {loginTraceID} → {Result.LoginHost}
// 2) Browser opens ${loginHost}/authorization?client_id=...&login_trace_id=...&auth_callback_url=${cb}
diff --git a/src/lib/oauth/providerHelpers.js b/src/lib/oauth/providerHelpers.js
index 0cb46933..c2a7fdd7 100644
--- a/src/lib/oauth/providerHelpers.js
+++ b/src/lib/oauth/providerHelpers.js
@@ -50,6 +50,21 @@ function extractEmailFromAccessToken(accessToken) {
return payload.email || payload.preferred_username || payload.sub || undefined;
}
+// Human display name from OIDC-style JWT claims.
+// Preference: full `name` → given+family → email local-part.
+function extractDisplayNameFromAccessToken(accessToken) {
+ const payload = decodeJwtPayload(accessToken);
+ if (!payload) return undefined;
+ const full = typeof payload.name === "string" ? payload.name.trim() : "";
+ if (full) return full;
+ const given = typeof payload.given_name === "string" ? payload.given_name.trim() : "";
+ const family = typeof payload.family_name === "string" ? payload.family_name.trim() : "";
+ const combined = [given, family].filter(Boolean).join(" ").trim();
+ if (combined) return combined;
+ const email = typeof payload.email === "string" ? payload.email.trim() : "";
+ return email ? email.split("@")[0] : undefined;
+}
+
export async function fetchKiroProfileArn(accessToken) {
if (!accessToken) return null;
try {
@@ -87,4 +102,5 @@ export {
decodeXaiIdTokenEmail,
decodeJwtPayload,
extractEmailFromAccessToken,
+ extractDisplayNameFromAccessToken,
};
diff --git a/src/lib/oauth/providers/codebuddy-intl.js b/src/lib/oauth/providers/codebuddy-intl.js
index e82e430f..66bd3905 100644
--- a/src/lib/oauth/providers/codebuddy-intl.js
+++ b/src/lib/oauth/providers/codebuddy-intl.js
@@ -1,4 +1,5 @@
import { CODEBUDDY_INTL_CONFIG } from "../constants/oauth.js";
+import { extractEmailFromAccessToken, extractDisplayNameFromAccessToken } from "../providerHelpers.js";
// CodeBuddy International — mirrors codebuddy-cn flow against the .ai domain.
const codebuddyIntl = {
@@ -67,6 +68,12 @@ const codebuddyIntl = {
accessToken: tokens.access_token,
refreshToken: tokens.refresh_token,
expiresIn: tokens.expires_in || 86400,
+ // GUARD — DO NOT REMOVE. See AGENTS.md §4. The CodeBuddy access token is a
+ // Keycloak JWT carrying email/name claims; surface them so a fresh OAuth
+ // login is named by identity (and deduped on re-login) instead of falling
+ // back to "Account N". Covered by tests/unit/codebuddy-intl-connection.test.js.
+ email: extractEmailFromAccessToken(tokens.access_token) || null,
+ displayName: extractDisplayNameFromAccessToken(tokens.access_token) || null,
providerSpecificData: {},
}),
};
diff --git a/src/lib/oauth/providers/freebuff.js b/src/lib/oauth/providers/freebuff.js
new file mode 100644
index 00000000..986ca6e6
--- /dev/null
+++ b/src/lib/oauth/providers/freebuff.js
@@ -0,0 +1,131 @@
+import crypto from "node:crypto";
+import { FREEBUFF_CONFIG } from "../constants/oauth.js";
+
+/**
+ * Freebuff / Codebuff CLI login (fingerprint device-flow — NOT OAuth2):
+ * 1) POST {baseUrl}/api/auth/cli/code { fingerprintId } // baseUrl = https://freebuff.com
+ * → { fingerprintId, fingerprintHash, loginUrl, expiresAt }
+ * (The server echoes the request host into loginUrl, so calling
+ * freebuff.com yields freebuff.com/login?auth_code=… — exactly the link
+ * the official CLI shows. www.codebuff.com would return a wrong link.)
+ * 2) User opens loginUrl in a browser and signs in / confirms the device
+ * 3) GET {baseUrl}/api/auth/cli/status?fingerprintId=..&fingerprintHash=..&expiresAt=..
+ * → { user: { id, email, name, authToken, fingerprintId, ... } } once authorized
+ *
+ * The resulting user.authToken is the Bearer token used against the
+ * OpenAI-compatible endpoint https://www.codebuff.com/api/v1/chat/completions
+ * (same backend, different host — freebuff.com does not serve /api/v1/*).
+ *
+ * Implemented on top of the generic "device_code" flow: the fingerprintId +
+ * fingerprintHash + expiresAt triple rides in the `device_code` payload and is
+ * decoded server-side on every poll.
+ */
+// Login-flow host. The CLI in freebuff mode logs in via freebuff.com, and the
+// server builds loginUrl from the host it was called on — so this must stay
+// https://freebuff.com (www.codebuff.com would yield the wrong login link).
+const LOGIN_HOST = "https://freebuff.com";
+
+const freebuff = {
+ config: FREEBUFF_CONFIG,
+ flowType: "device_code",
+ requestDeviceCode: async (config) => {
+ const fingerprintId = crypto.randomUUID();
+ const baseUrl = (config.baseUrl || LOGIN_HOST).replace(/\/$/, "");
+ const response = await fetch(
+ `${baseUrl}${config.loginCodePath || "/api/auth/cli/code"}`,
+ {
+ method: "POST",
+ headers: {
+ "Content-Type": "application/json",
+ Accept: "application/json",
+ "User-Agent": "codebuff-cli/0.0.138",
+ },
+ body: JSON.stringify({ fingerprintId }),
+ },
+ );
+ if (!response.ok) {
+ const error = await response.text();
+ throw new Error(`Freebuff login code request failed: ${error}`);
+ }
+ const data = await response.json();
+ const loginUrl = typeof data.loginUrl === "string" ? data.loginUrl : "";
+ const authCode = loginUrl.match(/auth_code=([^&]+)/)?.[1] || "";
+ const expiresAt = Number(data.expiresAt) || 0;
+ // Server codes live ~1h, but the official CLI stops polling after 5 minutes
+ // (and OAuthModal derives its deadline from expires_in). Clamp to
+ // oauthTimeoutMs so the modal doesn't hammer /api/auth/cli/status for an hour.
+ // When the server omits expiresAt, fall back to the full oauthTimeoutMs —
+ // never the 60s floor, or the user gets only a minute to finish login.
+ const timeoutSec = Math.max(60, Math.floor((config.oauthTimeoutMs || 300000) / 1000));
+ const serverMs =
+ Number.isFinite(expiresAt) && expiresAt > 0 ? expiresAt - Date.now() : timeoutSec * 1000;
+ const expiresIn = Math.max(60, Math.min(Math.floor(serverMs / 1000), timeoutSec));
+ return {
+ // fingerprintId + fingerprintHash + expiresAt travel inside device_code;
+ // pollToken decodes them for /api/auth/cli/status.
+ device_code: JSON.stringify({
+ fingerprintId: data.fingerprintId || fingerprintId,
+ fingerprintHash: data.fingerprintHash,
+ expiresAt,
+ }),
+ user_code: authCode || "",
+ verification_uri: loginUrl,
+ verification_uri_complete: loginUrl,
+ expires_in: expiresIn,
+ interval: 5,
+ };
+ },
+ pollToken: async (config, deviceCode) => {
+ let parsed = {};
+ try {
+ parsed = JSON.parse(deviceCode) || {};
+ } catch {
+ parsed = {};
+ }
+ const { fingerprintId, fingerprintHash, expiresAt } = parsed;
+ if (!fingerprintId || !fingerprintHash || !expiresAt) {
+ return { ok: true, data: { error: "authorization_pending" } };
+ }
+ // The status endpoint is a GET with query params; it returns 401
+ // {"error":"Authentication failed"} while the device is still waiting for
+ // the browser sign-in, and 200 { user } once authorized. Mirror the CLI:
+ // keep polling on anything except a `user` payload (the modal enforces its
+ // own 5-minute deadline).
+ const baseUrl = (config.baseUrl || LOGIN_HOST).replace(/\/$/, "");
+ const query = new URLSearchParams({ fingerprintId, fingerprintHash, expiresAt: String(expiresAt) });
+ const response = await fetch(
+ `${baseUrl}${config.loginStatusPath || "/api/auth/cli/status"}?${query.toString()}`,
+ {
+ method: "GET",
+ headers: {
+ Accept: "application/json",
+ "User-Agent": "codebuff-cli/0.0.138",
+ },
+ },
+ );
+ let data;
+ try {
+ data = await response.json();
+ } catch {
+ data = {};
+ }
+
+ if (data?.user?.authToken) {
+ return { ok: true, data: { access_token: data.user.authToken, ...data.user } };
+ }
+ return { ok: true, data: { error: "authorization_pending" } };
+ },
+ mapTokens: (tokens) => ({
+ accessToken: tokens.access_token,
+ refreshToken: null,
+ email: tokens.email || undefined,
+ displayName: tokens.name || undefined,
+ providerSpecificData: {
+ authMethod: "device_code",
+ fingerprintId: tokens.fingerprintId || null,
+ userId: tokens.id || null,
+ },
+ }),
+};
+
+export default freebuff;
diff --git a/src/lib/oauth/providers/index.js b/src/lib/oauth/providers/index.js
index 86ed5338..7cea92a9 100644
--- a/src/lib/oauth/providers/index.js
+++ b/src/lib/oauth/providers/index.js
@@ -2,7 +2,7 @@
import "open-sse/index.js";
import { generatePKCE } from "../utils/pkce.js";
-import { extractCodexAccountInfo, fetchKiroProfileArn } from "../providerHelpers.js";
+import { extractCodexAccountInfo, fetchKiroProfileArn, extractEmailFromAccessToken, extractDisplayNameFromAccessToken } from "../providerHelpers.js";
import claude from "./claude.js";
import codex from "./codex.js";
@@ -16,6 +16,7 @@ import qoderCn from "./qoder-cn.js";
import github from "./github.js";
import kiro from "./kiro.js";
import cursor from "./cursor.js";
+import freebuff from "./freebuff.js";
import kimi from "./kimi.js";
import kilocode from "./kilocode.js";
import cline from "./cline.js";
@@ -42,6 +43,7 @@ const PROVIDERS = {
github,
kiro,
cursor,
+ freebuff,
kimi,
kilocode,
cline,
@@ -209,6 +211,43 @@ export async function pollForToken(providerName, deviceCode, codeVerifier, extra
// Run-once guard across the process lifetime
let codexBackfillDone = false;
+let codebuddyIntlBackfillDone = false;
+
+// Backfill email + displayName for existing CodeBuddy Intl OAuth connections
+// created before mapTokens surfaced identity (they show up as "Account N").
+// The access token is a Keycloak JWT carrying email/name claims.
+export async function backfillCodeBuddyIntlIdentity() {
+ if (codebuddyIntlBackfillDone) return;
+ codebuddyIntlBackfillDone = true;
+ try {
+ const { getProviderConnections, updateProviderConnection } = await import("@/lib/localDb");
+ const connections = await getProviderConnections();
+ const targets = connections.filter((c) => {
+ if (c.provider !== "codebuddy-intl" || c.authType !== "oauth" || !c.accessToken) return false;
+ // Also re-heal rows whose name is still the generic "Account N" placeholder.
+ const genericName = typeof c.name === "string" && /^Account \d+$/.test(c.name.trim());
+ return !c.email || !c.displayName || genericName;
+ });
+ for (const conn of targets) {
+ const patch = {};
+ const email = conn.email || extractEmailFromAccessToken(conn.accessToken);
+ const displayName = conn.displayName || extractDisplayNameFromAccessToken(conn.accessToken);
+ if (!conn.email && email) patch.email = email;
+ if (!conn.displayName && displayName) patch.displayName = displayName;
+ // Rename the generic placeholder to the identity (email preferred, matching
+ // deriveConnectionName's behavior for new logins).
+ if (/^Account \d+$/.test((conn.name || "").trim()) && (email || displayName)) {
+ patch.name = email || displayName;
+ }
+ if (Object.keys(patch).length) {
+ await updateProviderConnection(conn.id, patch);
+ }
+ }
+ } catch (err) {
+ codebuddyIntlBackfillDone = false;
+ console.log("backfillCodeBuddyIntlIdentity failed:", err?.message || err);
+ }
+}
// Backfill email + chatgpt account info for existing codex OAuth connections missing them
export async function backfillCodexEmails() {
diff --git a/src/shared/components/Header.js b/src/shared/components/Header.js
index cc0f89c0..045a2f18 100644
--- a/src/shared/components/Header.js
+++ b/src/shared/components/Header.js
@@ -8,7 +8,6 @@ import ProviderIcon from "@/shared/components/ProviderIcon";
import HeaderMenu from "@/shared/components/HeaderMenu";
import HeaderLanguage from "@/shared/components/HeaderLanguage";
import ThemeToggle from "@/shared/components/ThemeToggle";
-import DonateModal from "@/shared/components/DonateModal";
import { useHeaderSearchStore } from "@/store/headerSearchStore";
import { OAUTH_PROVIDERS, APIKEY_PROVIDERS } from "@/shared/constants/config";
import { MEDIA_PROVIDER_KINDS, AI_PROVIDERS } from "@/shared/constants/providers";
@@ -183,7 +182,6 @@ export default function Header({ onMenuClick, showMenuButton = true }) {
const pathname = usePathname();
const [displayName, setDisplayName] = useState("");
const [loginMethod, setLoginMethod] = useState("");
- const [donateOpen, setDonateOpen] = useState(false);
// Memoize page info to prevent unnecessary recalculations
const pageInfo = useMemo(() => getPageInfo(pathname), [pathname]);
@@ -316,19 +314,20 @@ export default function Header({ onMenuClick, showMenuButton = true }) {
)}
-
setDonateOpen(true)}
- className="flex items-center gap-1.5 px-3 h-8 rounded-lg border border-pink-500/30 bg-pink-500/10 text-pink-600 dark:text-pink-400 hover:bg-pink-500/20 transition-colors text-sm font-medium"
- aria-label="Donate"
+
- volunteer_activism
- Donate
-
+
code
+
MIBP Edition
+
-
- # 9Router - 免费 AI 路由器与 Token 节省器
-
- **编程永不停歇。使用 RTK + 自动切换到免费/低价 AI 模型，节省 20-40% 的 tokens。**
-
- **将所有 AI 编程工具（Claude Code、Cursor、Antigravity、Copilot、Codex、Gemini、OpenCode、Cline、OpenClaw...）连接到 40+ AI 提供商和 100+ 模型。**
-
- [](https://www.npmjs.com/package/9router)
- [](https://www.npmjs.com/package/9router)
- [](https://github.com/decolua/9router/blob/main/LICENSE)
-
- 
- 
- 
- 
- 
- 
- 
