merge: pull mhiqrambg/9router-mibp-version into master

Merge the MIBP fork (v1.0.14, synced to decolua v0.5.81) into our master
(0.5.86) at merge-base a8c9d380. Keep HEAD's infra policy (untracked
lockfile, mirror-configurable Dockerfile, decolua GHCR/DockerHub, README)
while absorbing the fork's engine features:

- feat(providers): freebuff provider + executor + OAuth + usage tracking
- feat(providers): cline free-tier models, Freebuff catalog sync
- feat(proxy-pools): pool egress geo probe, proxy-pool fitness + retry
- fix(usage): hide noAuth providers (devin-cli, mimo-free) from usage list
- test(harness): DATA_DIR isolation so tests never write the real DB
- fix(codebuddy-intl): probe token in connection test, OAuth by identity
- chore(guards): durable markers so fixes aren't silently dropped

Resolutions:
- registry/index.js regenerated deterministically (122 providers, alpha
  order). trae/windsurf/devin-cli stay hidden per HEAD security posture
  (no tool-calling / local-agent shell access) — not re-enabled.
- nonStreamingHandler: drop the generic unconditional unwrapDataEnvelope
  call; envelope unwrap stays scoped to clineEnvelope-quirk providers
  (unwrapClineEnvelope), fixing a latent mibp bug where non-opted-in
  providers ({success,data} bodies) were stripped.
- Drop fork-local Docker lockfile policy (package-lock.json, AGENTS.md,
  .npmrc verify scripts): this repo keeps package-lock untracked (nix
  build deploy). .npmrc (audit=false/fund=false) kept.
- Keep gitbook-pages workflow enabled (ours); mibp disabled it.
- Restore 13 upstream tests mibp deleted (they cover features we keep).

Verified: 2841 tests, 2687 pass, fail set byte-identical to HEAD (zero
new regressions); providers/alias/oauth baselines regenerated to merged
code and all green.

.dockerignore

@@ -1,6 +1,11 @@
 # VCS
 .git
 **/.git
+.github
+
+# Test suites (not needed for the image build)
+tests
+**/tests
 
 # Editor
 .vscode

.env.example

@@ -39,3 +39,9 @@ NEXT_PUBLIC_CLOUD_URL=https://9router.com
 
 # Currently unused by application runtime (kept as reference)
 # INSTANCE_NAME=9router
+
+# Proxy egress geo probe (Proxy Fitness "Geo probe" toggle makes this a runtime
+# setting too). These env vars are the hard override / advanced knobs for the
+# background scheduler that samples each pool's egress IP+country.
+# POOL_GEO_PROBE_DISABLED=1        # 1 = never run the geo probe
+# GEO_PROBE_URL=                   # optional single custom endpoint (replaces the built-in 4-endpoint chain)

.gitignore

@@ -26,6 +26,7 @@ product
 # misc
 .DS_Store
 *.pem
+.vscode
 
 # debug
 npm-debug.log*

.npmrc

@@ -0,0 +1,17 @@
+# MIBP fork — npm behavior pin.
+#
+# DO NOT DELETE. See AGENTS.md §1.
+#
+# The Docker image (node:22-alpine, pinned by digest) ships npm 10.9.8 and runs
+# `npm ci` against the committed package-lock.json. Regenerating the lockfile
+# with npm 11+ drops the top-level @emnapi/core + @emnapi/runtime entries npm 10
+# needs, which breaks the tag-triggered Docker build ("Build and Push Docker
+# Image") at `npm ci`.
+#
+# Regenerate the lockfile with npm 10 only:
+#   npx -y npm@10.9.8 install --package-lock-only
+#   node scripts/verify-lockfile-npm10.mjs
+#
+# Keep install output quiet; never let audit/fund noise hide a lockfile error.
+audit=false
+fund=false

CLAUDE.md

@@ -2,6 +2,12 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+> ⚠️ **MIBP fork — read [`AGENTS.md`](AGENTS.md) first.** It lists fixes that are
+> easy to silently delete or reintroduce (npm-10 lockfile rule, test DB
+> isolation, hidden-provider filtering, codebuddy-intl behavior, fork-only
+> features that must survive upstream syncs). Do not remove anything listed
+> there without explicit confirmation.
+
 ## What this is
 
 9Router (`9router-app`) — a local AI routing gateway + Next.js dashboard. It exposes one OpenAI-compatible endpoint (`/v1/*`) and routes traffic across 40+ upstream providers with format translation, model-combo fallback, multi-account fallback, OAuth/API-key credential management, token refresh, quota/usage tracking, and optional cloud sync.

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   9router:
-    image: decolua/9router:latest
+    image: mhiqrambhrng/9router-mibp-version:latest
     container_name: 9router
     restart: always
     ports:

gitbook/content/en/deployment/cloud.md

@@ -247,6 +247,10 @@ server {
     ssl_ciphers HIGH:!aNULL:!MD5;
     ssl_prefer_server_ciphers on;
 
+    # Allow large request bodies — big context windows (e.g. 1M token prompts)
+    # produce multi-MB chat payloads; nginx default is 1m and would 413 them.
+    client_max_body_size 128m;
+
     # Proxy to 9Router
     location / {
         proxy_pass http://localhost:3000;

gitbook/content/vi/deployment/cloud.md

@@ -247,6 +247,10 @@ server {
     ssl_ciphers HIGH:!aNULL:!MD5;
     ssl_prefer_server_ciphers on;
 
+    # Cho phép body lớn — prompt ngữ cảnh 1M token sinh payload vài MB;
+    # mặc định nginx là 1m và sẽ trả 413.
+    client_max_body_size 128m;
+
     # Proxy to 9Router
     location / {
         proxy_pass http://localhost:3000;

jsconfig.json

@@ -1,5 +1,6 @@
 {
   "compilerOptions": {
+    "ignoreDeprecations": "6.0",
     "baseUrl": ".",
     "paths": {
       "@/*": ["./src/*"],

open-sse/executors/base.js

@@ -139,8 +139,6 @@ export class BaseExecutor {
 
       try {
         const bodyStr = JSON.stringify(transformedBody);
-        const fetchT0 = Date.now();
-        dbg("FETCH", `${this.provider.toUpperCase()} → ${url} | body=${bodyStr.length}B | connectTimeout=${timeoutMs}ms`);
         const response = await proxyAwareFetch(url, {
           method: "POST",
           headers,
@@ -148,9 +146,6 @@ export class BaseExecutor {
           signal: mergedSignal
         }, proxyOptions);
         clearTimeout(connectTimer);
-        const ct = response.headers?.get?.("content-type") || "";
-        const cl = response.headers?.get?.("content-length") || "?";
-        dbg("FETCH", `${this.provider.toUpperCase()} ← ${response.status} | ttft=${Date.now() - fetchT0}ms | ct=${ct} | cl=${cl}`);
 
         if (await tryRetry(urlIndex, response.status, `status ${response.status}`, response)) { urlIndex--; continue; }
 

open-sse/executors/default.js

@@ -25,8 +25,13 @@ function setAuth(headers, spec, token) {
 // Resolve auth onto headers from a descriptor.
 function applyAuth(headers, desc, credentials) {
   if (desc.combined) {
-    // combined providers always set the header (legacy behavior, incl. noAuth → "Bearer undefined")
+    // combined providers always set the header (legacy behavior, incl. noAuth → "Bearer undefined") —
-    setAuth(headers, desc, credentials.apiKey || credentials.accessToken);
+    // unless the descriptor opts into preserveHookAuth: a hook then owns the
+    // Authorization value (e.g. Cline needs workos:-prefixed OAuth tokens but
+    // plain API keys, which a single merged token can't express).
+    if (!(desc.preserveHookAuth && headers[desc.header])) {
+      setAuth(headers, desc, credentials.apiKey || credentials.accessToken);
+    }
     if (desc.anthropicVersion && !headers["anthropic-version"]) headers["anthropic-version"] = ANTHROPIC_API_VERSION;
     return;
   }
@@ -40,7 +45,7 @@ function applyAuth(headers, desc, credentials) {
 const HEADER_HOOKS = {
   // Stable device_id from OAuth connection (CLIProxyAPI KimiTokenStorage.DeviceID)
   kimiHeaders: (h, c) => Object.assign(h, buildKimiHeaders(c?.providerSpecificData?.deviceId)),
-  clineHeaders: (h, c) => Object.assign(h, buildClineHeaders(c.apiKey || c.accessToken)),
+  clineHeaders: (h, c) => Object.assign(h, buildClineHeaders(c.apiKey || c.accessToken, {}, { isApiKey: !!c.apiKey })),
   kilocodeOrg: (h, c) => { if (c.providerSpecificData?.orgId) h["X-Kilocode-OrganizationID"] = c.providerSpecificData.orgId; },
 };
 

open-sse/executors/freebuff.js

@@ -0,0 +1,827 @@
+import crypto from "node:crypto";
+import { BaseExecutor } from "./base.js";
+import { PROVIDERS } from "../config/providers.js";
+import { proxyAwareFetch } from "../utils/proxyFetch.js";
+import { dbg } from "../utils/debugLog.js";
+import {
+  FETCH_CONNECT_TIMEOUT_MS,
+  DEFAULT_RETRY_CONFIG,
+  resolveRetryEntry,
+} from "../config/runtimeConfig.js";
+import { markPoolUnfit, clearPoolUnfit } from "../services/proxyPoolFitness.js";
+
+/**
+ * Freebuff Executor — OpenAI-compatible chat completions on
+ * https://www.codebuff.com/api/v1/chat/completions (the Codebuff/Freebuff backend).
+ *
+ * Wire shape mirrors the official CLI exactly. The CLI (Vercel AI SDK with the
+ * codebuff openai-compatible provider) builds `providerOptions.codebuff` =
+ * { codebuff_metadata, provider } and the provider spreads those entries at
+ * the TOP LEVEL of the request body — i.e. the body is:
+ *   { model, messages, codebuff_metadata: { run_id, client_id, cost_mode,
+ *     freebuff_instance_id? }, provider: { allow_fallbacks } }
+ * NOT nested under a `codebuff` object (the backend rejects the nested shape
+ * with 400 "No runId found in request body").
+ *
+ * The run_id is not a free-form uuid: the backend resolves it against its
+ * agent-run store and rejects unknown ids with 400 "runId Not Found". So every
+ * chat request first registers a run via POST /api/v1/agent-runs
+ * ({ action:"START", agentId, ancestorRunIds:[] }) → { runId }, and that id is
+ * what goes in codebuff_metadata.run_id. The free tier additionally gates on a
+ * session: POST /api/v1/freebuff/session with an `x-freebuff-model` header
+ * claims a row (bound to one model, ~1h); its instance id must ride along as
+ * codebuff_metadata.freebuff_instance_id.
+ */
+const SESSION_PATH = "/api/v1/freebuff/session";
+const RUN_PATH = "/api/v1/agent-runs";
+const SESSION_DEFAULT_TTL_MS = 60 * 60 * 1000; // active sessions live ~1h
+
+// Chat statuses that mean our claimed session is stale and must be re-claimed
+// before retrying (mirrors the CLI's FreebuffGateErrorKind statuses).
+const SESSION_STALE_CODES = new Set([428, 409, 410]);
+
+// Models the backend runs as a CAPACITY-LIMITED OFFER rather than a standing
+// picker row. Claude Fable 5 is not in the client catalog at all: the server
+// advertises it per-session-response (`limitedModelOffers`) only while its
+// shared wave pool has sessions left, and a request without a live offer is
+// refused. A claim must therefore peek at the current offers first instead of
+// POSTing blind (mirrors the CLI: the "Claude Fable 5 · N of M left" row only
+// renders from that payload). Offer state is per-account and cached briefly —
+// the pool can reopen at any time, so a closed offer must NOT set a long
+// cooldown.
+const OFFER_GATED_MODELS = new Set(["anthropic/claude-fable-5"]);
+const OFFER_CACHE_TTL_MS = 45_000;
+
+// The free tier rejects requests whose first system message doesn't open with
+// the canonical Freebuff CLI root prompt (server gate
+// requestHasFreebuffSystemMarker → 403 free_mode_cli_required). The check is a
+// byte-exact prefix test on position 0, so we prepend the canonical opening.
+// Same anti-abuse pattern as mimo-free's MIMO_SYSTEM_MARKER injection.
+const FREEBUFF_SYSTEM_MARKER = "You are Buffy, the strategic coding assistant.";
+
+// Canonical openings accepted by the server gate (mirrors the CLI's
+// FREEBUFF_ROOT_SYSTEM_PROMPT_OPENINGS). The check is a byte-exact prefix on
+// the first message, so our injected marker must be one of these verbatim.
+const FREEBUFF_ROOT_SYSTEM_OPENINGS = [
+  "You are Buffy, the strategic coding assistant.",
+  "You are Buffy, the Freebuff Cloud project planner.",
+  "You are Buffy, a strategic assistant that orchestrates complex coding tasks through specialized sub-agents.",
+];
+
+// Ensure messages[0] opens with a canonical Freebuff root prompt (idempotent).
+function injectFreebuffMarker(body) {
+  const messages = body?.messages;
+  if (!Array.isArray(messages) || messages.length === 0) return body;
+  const first = messages[0];
+  if (first?.role === "system" && typeof first.content === "string") {
+    const trimmed = first.content.trimStart();
+    if (FREEBUFF_ROOT_SYSTEM_OPENINGS.some((opening) => trimmed.startsWith(opening))) return body; // already marked
+    // Prepend the canonical opening to the existing system prompt so it stays
+    // the first thing the model reads (keep the rest of the messages intact).
+    return {
+      ...body,
+      messages: [{ ...first, content: `${FREEBUFF_SYSTEM_MARKER}\n\n${first.content}` }, ...messages.slice(1)],
+    };
+  }
+  // No leading system message — insert one with the canonical opening.
+  return { ...body, messages: [{ role: "system", content: FREEBUFF_SYSTEM_MARKER }, ...messages] };
+}
+
+// The backend's foreign_toolset gate rejects any tool-calling request whose
+// toolset lacks the CLI's `end_turn` tool with a misleading 404 "No endpoints
+// found for {model}" (verified live 2026-08-14; the freebuff-proxy bridge
+// works around the same gate by injecting this definition). Every request that
+// declares tools must carry it or the router finds no serving endpoint.
+const END_TURN_TOOL = {
+  type: "function",
+  function: {
+    name: "end_turn",
+    description: "Signal the end of the current task.",
+    parameters: { type: "object", properties: {} },
+  },
+};
+
+function injectEndTurnTool(body) {
+  const tools = body?.tools;
+  if (!Array.isArray(tools) || tools.length === 0) return body;
+  const hasEndTurn = tools.some(
+    (t) => t?.function?.name === "end_turn",
+  );
+  if (hasEndTurn) return body;
+  return { ...body, tools: [...tools, END_TURN_TOOL] };
+}
+
+// Freebuff root agent id per model (mirrors the CLI's
+// FREEBUFF_CLI_BASE3_AGENT_ID_BY_MODEL — the CLI harness moved from base2 to
+// base3, and the backend can return 404 "No endpoints found" for the old
+// base2 roots during the transition).
+//
+// Withdrawn upstream models (deepseek-v4-pro, minimax-m3, stealth/ox-alpha,
+// google/gemini-3.8-flash, meta/muse-spark-1.3-contributor) are deliberately
+// absent: no new session can be admitted on them, so mapping them would only
+// hide a dead pick behind a wrong root. z-ai/glm-5.2 stays mapped
+// (referral-earned accounts can still run it) even though it is not a
+// standing picker row.
+const FREE_ROOT_AGENT_BY_MODEL = {
+  "deepseek/deepseek-v4-flash": "base3-free-deepseek-flash",
+  "z-ai/glm-5.2": "base3-free-glm",
+  "z-ai/glm-5.3-flash": "base3-free-glm-5-3-flash",
+  "mimo/mimo-v2.5": "base3-free-mimo",
+  "openai/gpt-5.6-luna": "base3-free-luna",
+  "upstage/solar-pro4": "base3-free-solar-pro4",
+  "meta/muse-spark-1.2-contributor": "base3-free-muse-spark",
+  "anthropic/claude-fable-5": "base3-free-fable",
+};
+
+// Per-token+model session cache (in-memory; keyed so multi-account setups
+// don't share one session row). Re-claims are driven by the cache expiring or
+// by a 428 from chat — no early re-claim, so we never POST /session while our
+// own row is still active (which could come back as a spurious model_locked).
+// All state lives on globalThis so Next dev (Turbopack) bundles share ONE copy.
+const FB_STATE_KEY = "__9routerFreebuffState__";
+const fbState = (globalThis[FB_STATE_KEY] ??= {
+  sessionCache: new Map(),      // `${token}::${model}` -> { instanceId, expiresAt }
+  inflight: new Map(),          // dedupe concurrent claims for the same key
+  modelLockCooldowns: new Map(), // `${token}::${model}` -> expiresAt (ms)
+  poolLimitCooldowns: new Map(), // `${proxyKey}::${model}` -> expiresAt (ms)
+  offerCache: new Map(),        // `${token}` -> { fetchedAt, offers: [] } (limited-offer rows)
+});
+const sessionCache = fbState.sessionCache;
+const inflight = fbState.inflight;
+const modelLockCooldowns = fbState.modelLockCooldowns;
+const poolLimitCooldowns = fbState.poolLimitCooldowns;
+const offerCache = fbState.offerCache;
+
+const MODEL_LOCK_COOLDOWN_MS = 10 * 60 * 1000; // session bound to another model (~1h) — re-check every 10 min
+const POOL_LIMITED_COOLDOWN_MS = 5 * 60 * 1000; // IP tier refuses this model — try a different pool/relay
+
+// Cooldown maps need pruning: expired entries are cleared on write (sweep) and
+// on read, so long-running servers don't accumulate one entry per (account,model)
+// / (proxy,model) forever.
+function setCooldown(map, key, until) {
+  const now = Date.now();
+  for (const [k, v] of map) {
+    if (v <= now) map.delete(k);
+  }
+  map.set(key, until);
+}
+
+function getCooldown(map, key) {
+  const until = map.get(key);
+  if (until == null) return null;
+  if (until <= Date.now()) {
+    map.delete(key);
+    return null;
+  }
+  return until;
+}
+
+function proxyKeyOf(proxyOptions) {
+  return proxyOptions?.vercelRelayUrl || proxyOptions?.connectionProxyUrl || "direct";
+}
+
+function sessionGateFromText(text) {
+  let parsed = {};
+  try { parsed = JSON.parse(String(text || "")); } catch { parsed = {}; }
+  return classifySessionGate(parsed.error || parsed.error_type || "", parsed.message || "", parsed.currentModel || null);
+}
+
+// Parse a 409/428/410 body into { kind, currentModel }. `msg` may be a whole
+// error string containing a JSON tail (requestSession errors embed the body).
+function sessionGateFromError(error) {
+  const msg = String(error?.message || "");
+  const start = msg.indexOf("{");
+  if (start < 0) return null;
+  try {
+    const parsed = JSON.parse(msg.slice(start));
+    return classifySessionGate(parsed.error || "", parsed.message || "", parsed.currentModel || null);
+  } catch {
+    return null;
+  }
+}
+
+function classifySessionGate(code, message, currentModel) {
+  if (code === "session_superseded") return { kind: "superseded" };
+  if (code === "model_locked") return { kind: "model_locked", currentModel };
+  // session_model_mismatch with the limited-tier message is an IP-tier refusal;
+  // without it (or unknown) treat it as a model lock so we don't reclaim in a loop.
+  if (code === "session_model_mismatch") {
+    return /limited/i.test(String(message || ""))
+      ? { kind: "limited_ip" }
+      : { kind: "model_locked", currentModel };
+  }
+  return { kind: "stale" }; // 428/410/unknown → reclaim
+}
+
+// Applies cooldowns and throws for non-reclaimable gates. Never returns for them.
+function throwSessionGateError(gate, { token, model, proxyKey, poolId, log }) {
+  if (gate.kind === "model_locked") {
+    const until = Date.now() + MODEL_LOCK_COOLDOWN_MS;
+    setCooldown(modelLockCooldowns, `${token}::${model}`, until);
+    const label = gate.currentModel ? `"${gate.currentModel}"` : "another model";
+    const err = new Error(
+      `Freebuff session is locked to ${label} — it cannot serve ${model}. End the session on freebuff.com or wait for it to expire (~1h).`,
+    );
+    err.status = 409;
+    err.resetsAtMs = until;
+    log?.warn?.("AUTH", `Freebuff model_locked (session=${label}, requested=${model}) — model cooldown ${MODEL_LOCK_COOLDOWN_MS / 60000}min`);
+    throw err;
+  }
+  if (gate.kind === "limited_ip") {
+    const until = Date.now() + POOL_LIMITED_COOLDOWN_MS;
+    setCooldown(poolLimitCooldowns, `${proxyKey}::${model}`, until);
+    const scope = `freebuff::${model}`;
+    if (poolId) markPoolUnfit(poolId, scope, until, "limited_ip");
+    // Pool-scoped, not account-scoped: the caller retries via another pool
+    // instead of locking the account (resetsAtMs intentionally absent).
+    const err = new Error(
+      `Freebuff limited-mode IP rejected ${model} — this IP only allows DeepSeek V4 Flash / MiMo 2.5. Use a full-access proxy or a different model.`,
+    );
+    err.status = 409;
+    err.poolScoped = { poolId, scope, reason: "limited_ip" };
+    log?.warn?.("AUTH", `Freebuff limited-IP refused ${model} (proxy=${proxyKey.slice(0, 40)}…) — cooldown ${POOL_LIMITED_COOLDOWN_MS / 60000}min`);
+    throw err;
+  }
+}
+
+function sessionOrigin() {
+  return new URL(PROVIDERS.freebuff.baseUrl).origin; // https://www.codebuff.com
+}
+
+function sessionCacheKey(token, model) {
+  return `${token}::${model}`;
+}
+
+function rootAgentIdForModel(model) {
+  return FREE_ROOT_AGENT_BY_MODEL[model] || "base2-free";
+}
+
+// Retry transient network errors (ECONNRESET, TLS reset, …) on the session/
+// run API calls — mirrors the CLI's fetchWithRetry. Only fetch-level throws
+// are retried; HTTP error responses are returned as-is.
+//
+// The timeout signal is built per attempt: a single shared
+// AbortSignal.timeout() would stay aborted forever after it fires, silently
+// turning attempts 2..n into instant no-op rejections.
+async function fetchWithNetworkRetry(url, options, proxyOptions, attempts = 3, timeoutMs = FETCH_CONNECT_TIMEOUT_MS) {
+  let lastError;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      const opts = { ...options, signal: AbortSignal.timeout(timeoutMs) };
+      return await proxyAwareFetch(url, opts, proxyOptions);
+    } catch (error) {
+      lastError = error;
+      if (attempt + 1 < attempts) {
+        await new Promise((resolve) => setTimeout(resolve, 750));
+      }
+    }
+  }
+  throw lastError;
+}
+
+async function requestSession(token, model, proxyOptions) {
+  // Offer-gated models (Fable) refuse claims while their wave pool is closed —
+  // checked before the POST so a closed offer never burns a claim attempt.
+  await guardOfferClaim(token, model, proxyOptions);
+
+  const response = await fetchWithNetworkRetry(`${sessionOrigin()}${SESSION_PATH}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "User-Agent": "codebuff-cli/0.0.138",
+      "x-freebuff-model": model,
+    },
+  }, proxyOptions);
+
+  let data = {};
+  try { data = await response.json(); } catch { data = {}; }
+
+  if (response.status === 401) {
+    const err = new Error("Freebuff session auth failed (401) — re-login in the dashboard");
+    err.status = 401;
+    throw err;
+  }
+  const status = data?.status;
+  const GATE_MESSAGES = {
+    country_blocked: "Freebuff is not available in your region (country blocked).",
+    banned: "Your Freebuff account has been banned.",
+    ip_capped: "Freebuff IP cap reached — try again later.",
+    rate_limited: "Freebuff session limit reached for this model — try again later.",
+    spend_limited: "Freebuff spend limit reached — add credits or wait for the window to reset.",
+    model_locked: "Freebuff session is locked to another model — end it in the CLI or wait for it to expire.",
+    model_unavailable: "This model is not available on Freebuff right now.",
+    premium_slot_taken: "Freebuff premium slot is taken — try another model.",
+  };
+  // Gate statuses ride BOTH 200 (pre-join refusals) and 4xx — the backend
+  // sends spend_limited/rate_limited as HTTP 429 with the gate in the body.
+  // Handle them BEFORE the generic !response.ok throw so exhaustion carries
+  // resetsAtMs (skip-until-reset) instead of a bare status.
+  if (GATE_MESSAGES[status]) {
+    const err = new Error(data?.message ? `${GATE_MESSAGES[status]} ${data.message}` : GATE_MESSAGES[status]);
+    // Freebucks / session-allowance exhaustion is a hard stop until the daily
+    // Pacific reset — mark the account unavailable until then so accountFallback
+    // SKIPS it for the rest of the day instead of retrying every 30s and getting
+    // refused repeatedly. resetsAtMs is honored by markAccountUnavailable;
+    // freebuff bypasses the generic 30-min cap (see auth.js).
+    if (status === "rate_limited" || status === "spend_limited") {
+      const resetAtMs = Date.parse(data?.resetAt || "");
+      if (Number.isFinite(resetAtMs) && resetAtMs > Date.now()) {
+        err.resetsAtMs = resetAtMs;
+        err.status = 429;
+      } else {
+        const retryAfterMs = Number(data?.retryAfterMs);
+        if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+          err.resetsAtMs = Date.now() + retryAfterMs;
+          err.status = 429;
+        }
+      }
+    }
+    throw err;
+  }
+
+  if (!response.ok) {
+    const err = new Error(`Freebuff session request failed: ${response.status} ${JSON.stringify(data).slice(0, 200)}`);
+    err.status = response.status;
+    throw err;
+  }
+
+  if (status === "active") {
+    const parsedExp = Date.parse(data.expiresAt || "");
+    const entry = {
+      instanceId: data.instanceId,
+      expiresAt: Number.isFinite(parsedExp) ? parsedExp : Date.now() + SESSION_DEFAULT_TTL_MS,
+    };
+    sessionCache.set(sessionCacheKey(token, model), entry);
+    return { instanceId: data.instanceId, status: "active" };
+  }
+  if (status === "none") {
+    // Not session-gated right now — proceed without an instance id; a 428 on
+    // chat tells us the admission gate actually requires a session.
+    return { instanceId: null, status: "none" };
+  }
+
+  throw new Error(`Freebuff session rejected (${status || response.status}): ${JSON.stringify(data).slice(0, 200)}`);
+}
+
+// Fetch the account's current limited-model offers (GET — never claims).
+// Cached per token for OFFER_CACHE_TTL_MS: the wave pool changes on server
+// time, not ours, and a claim only needs to know "is it open right now".
+async function fetchSessionOffers(token, proxyOptions) {
+  const now = Date.now();
+  const cached = offerCache.get(token);
+  if (cached && now - cached.fetchedAt < OFFER_CACHE_TTL_MS) {
+    return cached.offers;
+  }
+
+  const response = await fetchWithNetworkRetry(`${sessionOrigin()}${SESSION_PATH}`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "User-Agent": "codebuff-cli/0.0.138",
+      Accept: "application/json",
+    },
+  }, proxyOptions);
+
+  let data = {};
+  try { data = await response.json(); } catch { data = {}; }
+
+  if (response.status === 401) {
+    const err = new Error("Freebuff session auth failed (401) — re-login in the dashboard");
+    err.status = 401;
+    throw err;
+  }
+  if (!response.ok) {
+    const err = new Error(`Freebuff offer check failed: ${response.status} ${JSON.stringify(data).slice(0, 200)}`);
+    err.status = response.status;
+    throw err;
+  }
+
+  const offers = Array.isArray(data?.limitedModelOffers)
+    ? data.limitedModelOffers.filter((o) => o && typeof o.model === "string")
+    : [];
+  offerCache.set(token, { fetchedAt: now, offers });
+  return offers;
+}
+
+// For an offer-gated model (Fable), refuse the claim BEFORE the POST when the
+// backend is not currently advertising it. Returns the matching offer when the
+// claim may proceed. Throws a plain Error (no JSON tail) so the executor's
+// sessionGateFromError stays null and the cooldown maps are never touched —
+// a closed offer is availability, not a lock, and the pool can reopen any time.
+async function guardOfferClaim(token, model, proxyOptions) {
+  if (!OFFER_GATED_MODELS.has(model)) return null;
+
+  const offers = await fetchSessionOffers(token, proxyOptions);
+  const offer = offers.find((o) => o.model === model);
+  if (!offer || Number(offer.remaining) <= 0) {
+    const err = new Error(
+      `Claude Fable 5 is not being offered right now — it is a capacity-limited trial served in waves, and freebuff's shared Fable pool is currently empty. Watch the official freebuff CLI for the "Claude Fable 5 · N of M left" row, or retry later.`,
+    );
+    err.status = 409;
+    err.code = "offer_closed";
+    throw err;
+  }
+  const userLeft = Number(offer.userRemaining);
+  if (Number.isFinite(userLeft) && userLeft <= 0) {
+    const resetAt = Date.parse(offer.userResetAt || "");
+    const err = new Error(
+      `Your Freebuff account has used its Claude Fable 5 sessions for today (pool: ${offer.remaining} of ${offer.total} left)${Number.isFinite(resetAt) ? ` — next slot ${new Date(resetAt).toLocaleString()}` : ""}.`,
+    );
+    err.status = 409;
+    err.code = "offer_user_capped";
+    if (Number.isFinite(resetAt)) err.resetsAtMs = resetAt;
+    throw err;
+  }
+  return offer;
+}
+
+async function ensureSession(token, model, proxyOptions, force = false) {
+  const key = sessionCacheKey(token, model);
+  // Lazy prune: drop stale rows so the cache never accumulates expired entries.
+  const cached = sessionCache.get(key);
+  if (cached && cached.expiresAt <= Date.now()) {
+    sessionCache.delete(key);
+  }
+  if (!force && cached && cached.expiresAt > Date.now()) {
+    return { instanceId: cached.instanceId, status: "active" };
+  }
+  if (force) {
+    // Drop both the cached row and any in-flight claim so the fresh POST can't
+    // race a stale one back into the cache.
+    sessionCache.delete(key);
+    inflight.delete(key);
+    return requestSession(token, model, proxyOptions);
+  }
+  if (!inflight.has(key)) {
+    inflight.set(key, requestSession(token, model, proxyOptions).finally(() => inflight.delete(key)));
+  }
+  return inflight.get(key);
+}
+
+// Register an agent run so the chat backend can resolve the run_id we send.
+async function startRun(token, model, proxyOptions) {
+  const response = await fetchWithNetworkRetry(`${sessionOrigin()}${RUN_PATH}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "User-Agent": "codebuff-cli/0.0.138",
+    },
+    body: JSON.stringify({
+      action: "START",
+      agentId: rootAgentIdForModel(model),
+      ancestorRunIds: [],
+    }),
+  }, proxyOptions);
+
+  const text = await response.text().catch(() => "");
+  let data = {};
+  try { data = JSON.parse(text); } catch { data = {}; }
+
+  if (response.status === 401) {
+    const err = new Error("Freebuff run auth failed (401) — re-login in the dashboard");
+    err.status = 401;
+    throw err;
+  }
+  if (!response.ok) {
+    const err = new Error(`Freebuff run start failed: ${response.status} ${text.slice(0, 200)}`);
+    err.status = response.status;
+    throw err;
+  }
+  if (!data?.runId) {
+    throw new Error(`Freebuff run start returned no runId: ${text.slice(0, 200)}`);
+  }
+  return data.runId;
+}
+
+// Best-effort run completion — mirrors the CLI's finishAgentRun. Never throws.
+async function finishRun(token, runId, status, proxyOptions) {
+  if (!runId) return;
+  try {
+    await proxyAwareFetch(`${sessionOrigin()}${RUN_PATH}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "User-Agent": "codebuff-cli/0.0.138",
+      },
+      body: JSON.stringify({ action: "FINISH", runId, status }),
+      signal: AbortSignal.timeout(10_000),
+    }, proxyOptions);
+  } catch {
+    // Best-effort only — the server sweeps stale runs.
+  }
+}
+
+export function resetSessionCache() {
+  sessionCache.clear();
+  inflight.clear();
+  offerCache.clear();
+}
+
+// Snapshot sizes of in-memory freebuff state (for the dashboard memory panel).
+export function sessionStateSize() {
+  return {
+    sessions: sessionCache.size,
+    inflight: inflight.size,
+    modelLocks: modelLockCooldowns.size,
+    poolLimits: poolLimitCooldowns.size,
+    offerCaches: offerCache.size,
+  };
+}
+
+// Periodic sweeper: drop stale session rows + expired cooldowns so long-running
+// servers never accumulate state for accounts/models no longer in use.
+// Returns how many entries were removed.
+export function pruneSessionState(now = Date.now()) {
+  let removed = 0;
+  for (const [key, entry] of sessionCache) {
+    if (entry?.expiresAt && entry.expiresAt <= now) {
+      sessionCache.delete(key);
+      removed += 1;
+    }
+  }
+  for (const [key, entry] of offerCache) {
+    if (now - entry.fetchedAt >= OFFER_CACHE_TTL_MS) {
+      offerCache.delete(key);
+      removed += 1;
+    }
+  }
+  for (const [key, until] of modelLockCooldowns) {
+    if (until <= now) {
+      modelLockCooldowns.delete(key);
+      removed += 1;
+    }
+  }
+  for (const [key, until] of poolLimitCooldowns) {
+    if (until <= now) {
+      poolLimitCooldowns.delete(key);
+      removed += 1;
+    }
+  }
+  return removed;
+}
+
+export class FreebuffExecutor extends BaseExecutor {
+  constructor() {
+    super("freebuff", PROVIDERS.freebuff);
+  }
+
+  buildUrl() {
+    return this.config.baseUrl;
+  }
+
+  // The backend's model router answers 404 "No endpoints found for {model}"
+  // when a tool-calling request's toolset fails its foreign_toolset gate —
+  // normally prevented by injecting the CLI's `end_turn` tool (see
+  // injectEndTurnTool). If one still slips through, surface a helpful message
+  // instead of a bare 404, and let the standard cooldown pace retries.
+  async parseError(response, bodyText) {
+    const text = String(bodyText || "");
+    if (response?.status === 404 && /No endpoints found/i.test(text)) {
+      return {
+        status: 404,
+        message: `Freebuff upstream rejected the request (404: "${text.trim().slice(0, 90)}"). Tool-calling requests need the CLI's end_turn tool — retry; if it persists the Codebuff backend may be having trouble.`,
+        resetsAtMs: Date.now() + 120_000,
+      };
+    }
+    return super.parseError(response, bodyText);
+  }
+
+  transformRequest(model, body, stream, credentials) {
+    // Top-level wire shape — see header comment. `run_id` and
+    // `freebuff_instance_id` are attached by execute() (they need the async
+    // run/session registration), so this only sets the static parts.
+    body.codebuff_metadata = {
+      client_id:
+        credentials?.providerSpecificData?.fingerprintId ||
+        `9router-${crypto.randomUUID()}`,
+      cost_mode: "free",
+    };
+    body.provider = { allow_fallbacks: false };
+    // Freebuff agents (base3-free-*) own reasoning: the backend applies the
+    // agent's reasoningOptions.effort server-side, so a client-sent
+    // reasoning_effort / reasoning.effort collides with that default →
+    // 400 "both provided with conflicting values". Mirror the CLI: send none.
+    delete body.reasoning_effort;
+    delete body.reasoning;
+    // Free-tier gate: first system message must open with the CLI marker.
+    body = injectFreebuffMarker(body);
+    // Foreign-toolset gate: tool-calling requests must declare `end_turn`.
+    return injectEndTurnTool(body);
+  }
+
+  async execute({ model, body, stream, credentials, signal, log, proxyOptions = null }) {
+    const token = credentials?.accessToken;
+    if (!token) {
+      throw new Error("Freebuff requires a connected Freebuff login (no access token found)");
+    }
+
+    // Fail fast while a known-dead (account,model) / (proxy,model) pair is in
+    // cooldown — no session claim, no run registration, no upstream spam.
+    const proxyKey = proxyKeyOf(proxyOptions);
+    const poolId = proxyOptions?.proxyPoolId || null;
+    const scope = `freebuff::${model}`;
+    const lockUntil = getCooldown(modelLockCooldowns, `${token}::${model}`);
+    if (lockUntil) {
+      const err = new Error(`Freebuff session locked to another model — retry after ${new Date(lockUntil).toLocaleTimeString()}`);
+      err.status = 409;
+      err.resetsAtMs = lockUntil;
+      throw err;
+    }
+    const poolUntil = getCooldown(poolLimitCooldowns, `${proxyKey}::${model}`);
+    if (poolUntil) {
+      const err = new Error(`Freebuff limited-mode IP rejected ${model} — retry with a full-access proxy after ${new Date(poolUntil).toLocaleTimeString()}`);
+      err.status = 409;
+      err.poolScoped = { poolId, scope, reason: "limited_ip" };
+      throw err;
+    }
+
+    let session;
+    try {
+      session = await ensureSession(token, model, proxyOptions);
+    } catch (error) {
+      const gate = sessionGateFromError(error);
+      if (gate) throwSessionGateError(gate, { token, model, proxyKey, poolId, log });
+      log?.error?.("AUTH", `Freebuff session failed: ${error.message}`);
+      throw error;
+    }
+
+    const url = this.buildUrl();
+    const headers = this.buildHeaders(credentials, stream);
+    const retryConfig = { ...DEFAULT_RETRY_CONFIG, ...this.config.retry };
+
+    // Registered run whose id the backend resolves on chat. Per-request, like
+    // the CLI's one-run-per-prompt granularity; closure-local so concurrent
+    // requests never share a runId. trace_session_id mirrors the CLI's
+    // extraCodebuffMetadata — one per run, stable across retries.
+    let runId = null;
+    const traceSessionId = crypto.randomUUID();
+
+    const buildBody = () => {
+      const transformed = this.transformRequest(model, body, stream, credentials);
+      transformed.codebuff_metadata.run_id = runId;
+      transformed.codebuff_metadata.trace_session_id = traceSessionId;
+      if (session?.instanceId) {
+        transformed.codebuff_metadata.freebuff_instance_id = session.instanceId;
+      }
+      return transformed;
+    };
+
+    // Chat POST with connect timeout + registry 429/502/503 retry + up to 2
+    // retries on fetch-level network errors (per attempt the body is rebuilt
+    // so each retry reuses the same registered run_id).
+    const doChat = async () => {
+      let networkAttempts = 0;
+      const MAX_NETWORK_ATTEMPTS = 2;
+      for (let attempt = 0; ; attempt++) {
+        const transformedBody = buildBody();
+        const bodyStr = JSON.stringify(transformedBody);
+
+        const connectCtrl = new AbortController();
+        const timeoutMs = this.config?.timeoutMs || FETCH_CONNECT_TIMEOUT_MS;
+        const connectTimer = setTimeout(() => connectCtrl.abort(new Error("fetch connect timeout")), timeoutMs);
+        const mergedSignal = signal ? AbortSignal.any([signal, connectCtrl.signal]) : connectCtrl.signal;
+        let response;
+        try {
+          response = await proxyAwareFetch(url, { method: "POST", headers, body: bodyStr, signal: mergedSignal }, proxyOptions);
+        } catch (error) {
+          // A caller/stream abort (AbortError) is genuine — never retry it. A
+          // transient socket/TLS reset (same class as the run-registration
+          // failure in the field) gets a couple of quick retries so a network
+          // blip doesn't fail the request and lock the model for 30s.
+          const aborted = error?.name === "AbortError";
+          if (aborted || networkAttempts >= MAX_NETWORK_ATTEMPTS) throw error;
+          networkAttempts += 1;
+          log?.debug?.("RETRY", `network error on ${url} (${error.message}), retry ${networkAttempts}/${MAX_NETWORK_ATTEMPTS}`);
+          await new Promise((resolve) => setTimeout(resolve, 750));
+          continue;
+        } finally {
+          clearTimeout(connectTimer);
+        }
+
+        const entry = resolveRetryEntry(retryConfig[response.status]);
+        if (entry && attempt < entry.attempts) {
+          log?.debug?.("RETRY", `${response.status} on ${url}, retry ${attempt + 1}/${entry.attempts} after ${entry.delayMs / 1000}s`);
+          await new Promise((resolve) => setTimeout(resolve, entry.delayMs));
+          continue;
+        }
+        return { response, transformedBody };
+      }
+    };
+
+    // The run currently in flight. Only this one is FINISH-able: after a stale
+    // session (428/409/410) the old run is FINISH'd "cancelled" and cleared, so
+    // a later failure can never double-FINISH it (the server rejects duplicate
+    // FINISHes for the same runId).
+    let activeRunId = null;
+    const markFinished = (status) => {
+      if (!activeRunId) return;
+      const id = activeRunId;
+      activeRunId = null;
+      finishRun(token, id, status, proxyOptions);
+    };
+
+    try {
+      try {
+        runId = await startRun(token, model, proxyOptions);
+        activeRunId = runId;
+      } catch (error) {
+        log?.error?.("AUTH", `Freebuff run start failed: ${error.message}`);
+        throw error;
+      }
+
+      let { response, transformedBody } = await doChat();
+
+      // Session gates that mean our claimed session is stale/absent:
+      //   428 waiting_room_required — no session row / instance id missing
+      //   409 session_superseded — another instance took over the session
+      //   409 session_model_mismatch — session bound to a different model
+      //   410 session_expired    — the active session's expires_at passed
+      // model_locked / limited-tier mismatches are NOT reclaimable — the server
+      // keeps refusing until the session expires or the IP tier changes, so we
+      // set a cooldown and fail fast instead of force re-claiming in a loop.
+      if (SESSION_STALE_CODES.has(response.status)) {
+        const text = await response.text().catch(() => "");
+        const gate = sessionGateFromText(text);
+        if (gate.kind === "model_locked" || gate.kind === "limited_ip") {
+          markFinished("cancelled");
+          throwSessionGateError(gate, { token, model, proxyKey, poolId, log });
+        }
+
+        log?.debug?.("AUTH", `Freebuff ${response.status} session gate — re-claiming session`);
+        markFinished("cancelled");
+        try {
+          session = await ensureSession(token, model, proxyOptions, true);
+          runId = await startRun(token, model, proxyOptions);
+          activeRunId = runId;
+        } catch (error) {
+          const gate2 = sessionGateFromError(error);
+          if (gate2) throwSessionGateError(gate2, { token, model, proxyKey, poolId, log });
+          log?.error?.("AUTH", `Freebuff session re-claim failed: ${error.message}`);
+          throw error;
+        }
+        ({ response, transformedBody } = await doChat());
+
+        if (SESSION_STALE_CODES.has(response.status)) {
+          const text2 = await response.text().catch(() => "");
+          const gate3 = sessionGateFromText(text2);
+          if (gate3.kind === "model_locked" || gate3.kind === "limited_ip") {
+            throwSessionGateError(gate3, { token, model, proxyKey, poolId, log });
+          }
+          const err = new Error(
+            `Freebuff session gate refused (${response.status}) — another freebuff instance may be holding the session. ${text2.slice(0, 160)}`,
+          );
+          err.status = response.status;
+          throw err;
+        }
+      }
+
+      // A successful chat means the pair is healthy again — lift any cooldowns.
+      if (response.ok) {
+        modelLockCooldowns.delete(`${token}::${model}`);
+        poolLimitCooldowns.delete(`${proxyKey}::${model}`);
+        if (poolId) clearPoolUnfit(poolId, scope);
+      }
+
+      // The authToken has no refresh path — when it dies, the user re-logs in.
+      // Drop the cached session for this token so a re-login starts clean.
+      if (response.status === 401) {
+        sessionCache.delete(sessionCacheKey(token, model));
+        const text = await response.text().catch(() => "");
+        const err = new Error(`Freebuff auth failed (401) — re-login in the dashboard. ${text.slice(0, 120)}`);
+        err.status = 401;
+        throw err;
+      }
+
+      // Best-effort run accounting, mirroring the CLI.
+      markFinished(response.ok ? "completed" : "failed");
+
+      return { response, url, headers, transformedBody };
+    } finally {
+      // Never leave the current run dangling on thrown paths (network/abort/gate).
+      if (activeRunId) {
+        finishRun(token, activeRunId, "failed", proxyOptions);
+      }
+    }
+  }
+}
+
+export const __test__ = {
+  ensureSession,
+  requestSession,
+  startRun,
+  resetSessionCache,
+  rootAgentIdForModel,
+  injectFreebuffMarker,
+  injectEndTurnTool,
+  fetchWithNetworkRetry,
+  fetchSessionOffers,
+  guardOfferClaim,
+  OFFER_GATED_MODELS,
+  FREEBUFF_SYSTEM_MARKER,
+  SESSION_STALE_CODES,
+};
+
+export default FreebuffExecutor;

open-sse/executors/index.js

@@ -27,6 +27,7 @@ import ZedExecutor from "./zed.js";
 import WindsurfExecutor from "./windsurf.js";
 import { DefaultExecutor } from "./default.js";
 import { DevinCliExecutor } from "./devin-cli.js";
+import { FreebuffExecutor } from "./freebuff.js";
 
 const executors = {
   antigravity: new AntigravityExecutor(),
@@ -63,6 +64,7 @@ const executors = {
   zed: new ZedExecutor(),
   windsurf: new WindsurfExecutor(),
   "devin-cli": new DevinCliExecutor(),
+  freebuff: new FreebuffExecutor(),
 };
 
 const defaultCache = new Map();

open-sse/executors/opencode.js

@@ -393,6 +393,12 @@ function normalizeOpencodeReasoning(model, body) {
   delete body.reasoning_effort;
 }
 
+// OpenCode free tier is limited per egress IP — a 429/403 with a limit-ish
+// body means the POOL's IP is exhausted, not the account. Declare it
+// pool-scoped so chatCore marks the pool unfit, retries via another pool, and
+// it shows up (clearable) on the Proxy Fitness page.
+const IP_LIMIT_BODY = /limit|rate|quota|exhausted|capacity|too many|retry/i;
+
 export class OpenCodeExecutor extends BaseExecutor {
   constructor() {
     super("opencode", PROVIDERS.opencode);
@@ -484,4 +490,17 @@ export class OpenCodeExecutor extends BaseExecutor {
     if (url.endsWith("/messages")) headers["anthropic-version"] = ANTHROPIC_API_VERSION;
     return headers;
   }
+
+  parseError(response, bodyText) {
+    const status = response?.status || 0;
+    const text = String(bodyText || "");
+    if ((status === 429 || status === 403) && IP_LIMIT_BODY.test(text)) {
+      return {
+        status,
+        message: text.slice(0, 300) || `OpenCode free limit (${status})`,
+        poolScoped: { reason: "ip-limit" },
+      };
+    }
+    return null; // fall through to default parsing
+  }
 }

open-sse/handlers/chatCore.js

@@ -31,6 +31,12 @@ import { stripUnsupportedModalities } from "../translator/concerns/modality.js";
 import { prefetchRemoteImages } from "../translator/concerns/prefetch.js";
 import { defaultClaudeToolType, shouldDefaultClaudeToolType } from "../translator/concerns/toolCall.js";
 import { resolveSessionId } from "../utils/sessionManager.js";
+import { markPoolUnfit, clearPoolUnfit } from "../services/proxyPoolFitness.js";
+
+// Pool-scoped failure retry: when an executor tags an error as belonging to a
+// proxy pool (region gate, dead proxy, …), re-resolve the proxy config
+// excluding that pool and retry instead of failing the whole account.
+const MAX_POOL_RETRIES = 2;
 
 /**
  * Core chat handler - shared between SSE and Worker
@@ -59,7 +65,7 @@ export function stripContinuityFields(body) {
   return body;
 }
 
-export async function handleChatCore({ body, modelInfo, credentials, log, onCredentialsRefreshed, onRequestSuccess, onDisconnect, clientRawRequest, connectionId, userAgent, apiKey, ccFilterNaming, rtkEnabled, headroomEnabled, headroomUrl, headroomCompressUserMessages, headroomTimeoutMs, cavemanEnabled, cavemanLevel, ponytailEnabled, ponytailLevel, pxpipeEnabled, pxpipeMinChars, pxpipeTimeoutMs, pxpipeTransform, onPxpipeEvent, sourceFormatOverride, providerThinking }) {
+export async function handleChatCore({ body, modelInfo, credentials, log, onCredentialsRefreshed, onRequestSuccess, onDisconnect, clientRawRequest, connectionId, userAgent, apiKey, ccFilterNaming, rtkEnabled, headroomEnabled, headroomUrl, headroomCompressUserMessages, headroomTimeoutMs, cavemanEnabled, cavemanLevel, ponytailEnabled, ponytailLevel, pxpipeEnabled, pxpipeMinChars, pxpipeTimeoutMs, pxpipeTransform, onPxpipeEvent, sourceFormatOverride, providerThinking, resolveProxyConfig }) {
   const { provider, model } = modelInfo;
   const requestStartTime = Date.now();
   // Stable per-session color so all lines of one CLI conversation share a tag
@@ -332,16 +338,44 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
     log, provider, model, reqTag
   });
 
-  const proxyOptions = {
+  // Build proxy options from the resolved provider-specific data. `strictProxy`
-    connectionProxyEnabled: credentials?.providerSpecificData?.connectionProxyEnabled === true,
+  // is forced for freebuff so a dead/limited pool can never leak the request
-    connectionProxyUrl: credentials?.providerSpecificData?.connectionProxyUrl || "",
+  // to the caller's real IP (the freebuff session tier is per-egress-IP).
-    connectionNoProxy: credentials?.providerSpecificData?.connectionNoProxy || "",
+  const buildProxyOptions = (psd = {}) => ({
-    vercelRelayUrl: credentials?.providerSpecificData?.vercelRelayUrl || "",
+    connectionProxyEnabled: psd?.connectionProxyEnabled === true,
-  };
+    connectionProxyUrl: psd?.connectionProxyUrl || "",
+    connectionNoProxy: psd?.connectionNoProxy || "",
+    vercelRelayUrl: psd?.vercelRelayUrl || "",
+    strictProxy: psd?.strictProxy === true || provider === "freebuff",
+    proxyPoolId: psd?.proxyPoolId || psd?.connectionProxyPoolId || null,
+  });
+
+  const proxyScope = `${provider}::${model}`;
+  let proxyOptions = buildProxyOptions(credentials?.providerSpecificData || {});
+
+  if (provider === "freebuff" && credentials?.providerSpecificData?.noFitPool === true) {
+    const error = new Error(`Freebuff has no healthy proxy pool for ${model}; all assigned pools are cooling down after limited-IP errors.`);
+    error.status = 503;
+    error.poolScoped = { poolId: null, scope: proxyScope, reason: "no_fit_pool" };
+    trackPendingRequest(model, provider, connectionId, false, true);
+    return createErrorResult(503, error.message);
+  }
+
+  if (
+    provider === "freebuff" &&
+    !proxyOptions.proxyPoolId &&
+    !proxyOptions.vercelRelayUrl &&
+    !(proxyOptions.connectionProxyEnabled && proxyOptions.connectionProxyUrl)
+  ) {
+    const error = new Error(`Freebuff requires a configured proxy pool for ${model}; direct egress is disabled to prevent limited-IP rate limits.`);
+    error.status = 503;
+    trackPendingRequest(model, provider, connectionId, false, true);
+    return createErrorResult(503, error.message);
+  }
 
   if (proxyOptions.vercelRelayUrl) {
     const connectionName = credentials?.connectionName || credentials?.connectionId || "unknown";
-    const poolId = credentials?.providerSpecificData?.connectionProxyPoolId || "none";
+    const poolId = proxyOptions.proxyPoolId || "none";
     log?.info?.("PROXY", `${provider.toUpperCase()} | ${model} | conn=${connectionName} | pool=${poolId} | vercel-relay=${proxyOptions.vercelRelayUrl}`);
   } else if (proxyOptions.connectionProxyEnabled && proxyOptions.connectionProxyUrl) {
     let maskedProxyUrl = proxyOptions.connectionProxyUrl;
@@ -355,7 +389,7 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
       // Keep raw if URL parsing fails
     }
 
-    const poolId = credentials?.providerSpecificData?.connectionProxyPoolId || "none";
+    const poolId = proxyOptions.proxyPoolId || "none";
     const connectionName = credentials?.connectionName || credentials?.connectionId || "unknown";
     log?.info?.("PROXY", `${provider.toUpperCase()} | ${model} | conn=${connectionName} | pool=${poolId} | url=${maskedProxyUrl}`);
   }
@@ -365,23 +399,64 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
     log?.debug?.("PROXY", `${provider.toUpperCase()} | ${model} | conn=${connectionName} | no_proxy=${proxyOptions.connectionNoProxy}`);
   }
 
+  // Execute request — with pool-scoped retry: a failed pool (region gate,
+  // per-IP limit, dead proxy) is marked unfit and the request retried via
+  // another pool instead of failing the account. Covers both thrown errors
+  // (executor.execute) and non-ok responses declared poolScoped via
+  // parseError — poolId/scope are completed here from proxyOptions.
+  let parsedNonOk = null;
+
+  const tryNextPool = async (poolScoped, reasonMsg) => {
+    const failed = {
+      poolId: poolScoped?.poolId || proxyOptions.proxyPoolId || null,
+      scope: poolScoped?.scope || proxyScope,
+      reason: poolScoped?.reason || "pool-scoped",
+    };
+    markPoolUnfit(failed.poolId, failed.scope, undefined, failed.reason);
+    log?.warn?.("PROXY", `${provider.toUpperCase()} | pool ${failed.poolId || "?"} unfit for ${failed.scope} (${failed.reason}) — retry with another pool. ${reasonMsg || ""}`);
+    try {
+      const resolved = await resolveProxyConfig(credentials, [failed.poolId]);
+      if (resolved?.proxyPoolId) {
+        credentials.providerSpecificData = { ...(credentials.providerSpecificData || {}), ...resolved };
+        proxyOptions = buildProxyOptions(credentials.providerSpecificData);
+        return true;
+      }
+    } catch (resolverError) {
+      // A resolver failure must not mask the original pool error.
+      log?.warn?.("PROXY", `${provider.toUpperCase()} | pool re-resolve failed: ${resolverError.message}`);
+    }
+    return false;
+  };
+
+  const executeWithPoolFallback = async (attempt = 0) => {
+    let result;
+    try {
+      result = await executor.execute({ model, body: translatedBody, stream, credentials, providerSessionId: sessionSeed, clientTool, signal: streamController.signal, log, proxyOptions });
+    } catch (error) {
+      if (error?.poolScoped && typeof resolveProxyConfig === "function" && attempt < MAX_POOL_RETRIES) {
+        if (await tryNextPool(error.poolScoped, error.message)) return executeWithPoolFallback(attempt + 1);
+      }
+      throw error;
+    }
+    // Non-ok response that the executor declared pool/IP-scoped (e.g. opencode
+    // free per-IP limit) — parse once, retry via another pool when possible.
+    if (!result.response.ok) {
+      const parsed = await parseUpstreamError(result.response, executor);
+      if (parsed.poolScoped && typeof resolveProxyConfig === "function" && attempt < MAX_POOL_RETRIES) {
+        if (await tryNextPool(parsed.poolScoped, parsed.message)) return executeWithPoolFallback(attempt + 1);
+      }
+      parsedNonOk = parsed;
+    }
+    return result;
+  };
+
   // Execute request
   let providerResponse, providerUrl, providerHeaders, finalBody;
   // Most executors return their registry format. Cursor AgentService is an
   // exception: it is decoded by the executor into OpenAI-compatible output.
   let providerResponseFormat = targetFormat;
   try {
-    const result = await executor.execute({
+    const result = await executeWithPoolFallback();
-      model,
-      body: translatedBody,
-      stream,
-      credentials,
-      providerSessionId: sessionSeed,
-      clientTool,
-      signal: streamController.signal,
-      log,
-      proxyOptions,
-    });
     providerResponse = result.response;
     providerUrl = result.url;
     providerHeaders = result.headers;
@@ -412,9 +487,11 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
     }
     const errMsg = formatProviderError(error, provider, model, HTTP_STATUS.BAD_GATEWAY);
     if (log?.errorLine) {
-      log.errorLine(reqTag, "✗", `ERROR 502 · ${provider}/${model} · ${Date.now() - requestStartTime}ms\n    ${errMsg}${error.stack ? `\n    ${error.stack}` : ""}`);
+      log.errorLine(reqTag, "✗", `ERROR ${error?.status || HTTP_STATUS.BAD_GATEWAY} · ${provider}/${model} · ${Date.now() - requestStartTime}ms\n    ${errMsg}`);
     }
-    return createErrorResult(HTTP_STATUS.BAD_GATEWAY, errMsg);
+    // Carry the executor's own status (429/409 quota gates) when it threw one;
+    // fall back to 502 for generic throws.
+    return createErrorResult(error?.status || HTTP_STATUS.BAD_GATEWAY, errMsg, error?.resetsAtMs || undefined);
   }
 
   // Handle 401/403 - try token refresh (skip for noAuth providers)
@@ -467,7 +544,7 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
   // Provider returned error
   if (!providerResponse.ok) {
     trackPendingRequest(model, provider, connectionId, false, true);
-    const { statusCode, message, resetsAtMs } = await parseUpstreamError(providerResponse, executor);
+    const { statusCode, message, resetsAtMs } = parsedNonOk || await parseUpstreamError(providerResponse, executor);
     appendRequestLog({ model, provider, connectionId, status: `FAILED ${statusCode}` }).catch(() => { });
     saveRequestDetail(buildRequestDetail({
       provider, model, connectionId,

open-sse/handlers/chatCore/nonStreamingHandler.js

@@ -140,6 +140,22 @@ function openAICompletionToResponses(responseBody, customToolNames = null) {
   };
 }
 
+/**
+ * Unwrap gateway envelopes around an OpenAI Chat Completions body.
+ * Some OpenAI-compatible gateways wrap the body in a `data` envelope
+ * (Cline: {data, success}) — without this, choices/usage don't resolve at
+ * top level downstream and surface as "no completion choices".
+ * Generic guard, no provider hardcode: only fires when the OpenAI body is
+ * nested under `data`. Callers decide when to apply it — the handler scopes
+ * it to providers opting in via transport.quirks.clineEnvelope.
+ */
+export function unwrapDataEnvelope(responseBody) {
+  if (responseBody && !responseBody.choices && responseBody.data?.choices) {
+    return responseBody.data;
+  }
+  return responseBody;
+}
+
 /**
  * Translate non-streaming response body from provider format → OpenAI format.
  */
@@ -312,6 +328,8 @@ export async function handleNonStreamingResponse({ providerResponse, provider, m
   responseBody = unwrapClineEnvelope(responseBody, provider);
 
   reqLogger.logProviderResponse(providerResponse.status, providerResponse.statusText, providerResponse.headers, responseBody);
+  // Unwrap AFTER logging (raw envelope stays in the log for forensics) but
+  // BEFORE usage extraction/translation so choices/usage resolve downstream.
   if (onRequestSuccess) {
     Promise.resolve()
       .then(onRequestSuccess)

open-sse/providers/capabilities.js

@@ -307,6 +307,12 @@ export const PATTERN_CAPABILITIES = [
   { pattern: "*gpt-3.5*",       caps: { contextWindow: 16385, maxOutput: 4096 } },
   { pattern: "*gpt-oss*",       caps: { reasoning: true, thinkingFormat: "openai", contextWindow: 128000 } },
 
+  // ── Cline free tier: Upstage Solar Pro + LongCat (agentic coding models;
+  // windows unverified — 200K/32K conservative, same as laguna:free).
+  // NOTE: placed before the o-series catch-alls — "solar-pro4" contains "o4".
+  { pattern: "*solar-pro*",     caps: { reasoning: true, thinkingFormat: "openai", contextWindow: 200000, maxOutput: 32000 } },
+  { pattern: "*longcat*",       caps: { reasoning: true, thinkingFormat: "openai", contextWindow: 200000, maxOutput: 32000 } },
+
   // ── OpenAI o-series (reasoning, vision) ──────────────────────────
   { pattern: "*o1-mini*",       caps: { reasoning: true, thinkingFormat: "openai", contextWindow: 128000 } },
   { pattern: "*o1*",            caps: { vision: true, reasoning: true, thinkingFormat: "openai", contextWindow: 200000, maxOutput: 100000 } },

open-sse/providers/registry/cline.js

@@ -14,8 +14,9 @@ export default {
     },
   },
   category: "oauth",
-  authModes: ["oauth"],
+  authModes: ["oauth", "apikey"],
   hasOAuth: true,
+  authHint: "API key dari app.cline.bot → Settings > API Keys, atau login OAuth via browser.",
   transport: {
     baseUrl: "https://api.cline.bot/api/v1/chat/completions",
     headers: {
@@ -30,6 +31,9 @@ export default {
       combined: true,
       header: "Authorization",
       scheme: "bearer",
+      // Hook owns Authorization: workos:-prefixed OAuth vs plain API key
+      // (a merged token can't express both) — see applyAuth.
+      preserveHookAuth: true,
       hooks: [
         "clineHeaders",
       ],
@@ -44,6 +48,16 @@ export default {
     { id: "google/gemini-3.1-pro-preview", name: "Gemini 3.1 Pro Preview" },
     { id: "google/gemini-3.1-flash-lite-preview", name: "Gemini 3.1 Flash Lite Preview" },
     { id: "kwaipilot/kat-coder-pro", name: "KAT Coder Pro" },
+    // Free tier (verified live via GET /api/v1/ai/cline/recommended-models):
+    // billed $0 on usage, limited quota separate from ClinePass. The
+    // cline-free/* aliases require Cline product headers (see shared/clineAuth.js)
+    // or upstream 403s with "only available via Cline product surfaces".
+    { id: "cline-free/muse-spark-1.3-contributor", name: "Muse Spark 1.3 (Free)" },
+    { id: "deepseek/deepseek-v4-flash", name: "DeepSeek V4 Flash (Free)" },
+    { id: "z-ai/glm-5.3-flash", name: "GLM 5.3 Flash (Free)" },
+    { id: "cline-free/solar-pro4", name: "Solar Pro 4 (Free)" },
+    { id: "cline-free/longcat-2.0", name: "LongCat 2.0 (Free)" },
+    { id: "poolside/laguna-s-2.1:free", name: "Laguna S 2.1 (Free)" },
   ],
   oauth: {
     appBaseUrl: "https://app.cline.bot",

open-sse/providers/registry/clinepass.js

@@ -31,6 +31,9 @@ export default {
       combined: true,
       header: "Authorization",
       scheme: "bearer",
+      // Hook owns Authorization: workos:-prefixed OAuth vs plain API key
+      // (a merged token can't express both) — see applyAuth.
+      preserveHookAuth: true,
       hooks: [
         "clineHeaders",
       ],

open-sse/providers/registry/index.js

@@ -1,130 +1,127 @@
 // Auto-generated: static imports for all registry entries
 import p0 from "./alicode-intl.js";
 import p1 from "./alicode.js";
-import p2 from "./anthropic.js";
+import p2 from "./alims-intl.js";
-import p3 from "./antigravity.js";
+import p3 from "./alitp-intl.js";
-import p4 from "./assemblyai.js";
+import p4 from "./anthropic.js";
-import p5 from "./aws-polly.js";
+import p5 from "./antigravity.js";
-import p6 from "./azure.js";
+import p6 from "./api-airforce.js";
-import p7 from "./black-forest-labs.js";
+import p7 from "./assemblyai.js";
-import p8 from "./blackbox.js";
+import p8 from "./aws-polly.js";
-import p9 from "./brave-search.js";
+import p9 from "./azure.js";
-import p10 from "./byteplus.js";
+import p10 from "./baidu.js";
-import p11 from "./cartesia.js";
+import p11 from "./bazaarlink.js";
-import p12 from "./cerebras.js";
+import p12 from "./black-forest-labs.js";
-import p13 from "./chutes.js";
+import p13 from "./blackbox.js";
-import p14 from "./claude.js";
+import p14 from "./bluesminds.js";
-import p15 from "./cline.js";
+import p15 from "./brave-search.js";
-import p16 from "./clinepass.js";
+import p16 from "./byteplus.js";
-import p17 from "./cloudflare-ai.js";
+import p17 from "./cartesia.js";
-import p18 from "./codebuddy-cn.js";
+import p18 from "./cerebras.js";
-import p19 from "./codex.js";
+import p19 from "./chutes.js";
-import p20 from "./cohere.js";
+import p20 from "./claude.js";
-import p21 from "./comfyui.js";
+import p21 from "./cline.js";
-import p22 from "./commandcode.js";
+import p22 from "./clinepass.js";
-import p23 from "./coqui.js";
+import p23 from "./cloudflare-ai.js";
-import p24 from "./cursor.js";
+import p24 from "./codebuddy-cn.js";
-import p25 from "./deepgram.js";
+import p25 from "./codebuddy-intl.js";
-import p26 from "./deepseek.js";
+import p26 from "./codex.js";
-import p27 from "./edge-tts.js";
+import p27 from "./cohere.js";
-import p28 from "./elevenlabs.js";
+import p28 from "./comfyui.js";
-import p29 from "./exa.js";
+import p29 from "./commandcode.js";
-import p30 from "./fal-ai.js";
+import p30 from "./coqui.js";
-import p31 from "./featherless.js";
+import p31 from "./cursor.js";
-import p32 from "./firecrawl.js";
+import p32 from "./deepgram.js";
-import p33 from "./fireworks.js";
+import p33 from "./deepseek.js";
-import p34 from "./gemini-cli.js";
+import p34 from "./edge-tts.js";
-import p35 from "./gemini.js";
+import p35 from "./elevenlabs.js";
-import p36 from "./github.js";
+import p36 from "./exa.js";
-import p37 from "./gitlab.js";
+import p37 from "./fal-ai.js";
-import p38 from "./glm-cn.js";
+import p38 from "./featherless.js";
-import p39 from "./glm.js";
+import p39 from "./firecrawl.js";
-import p40 from "./google-pse.js";
+import p40 from "./fireworks.js";
-import p41 from "./google-tts.js";
+import p41 from "./fish-audio.js";
-import p42 from "./grok-cli.js";
+import p42 from "./freebuff.js";
-import p43 from "./grok-web.js";
+import p43 from "./gemini-cli.js";
-import p44 from "./groq.js";
+import p44 from "./gemini.js";
-import p45 from "./huggingface.js";
+import p45 from "./github.js";
-import p46 from "./hyperbolic.js";
+import p46 from "./gitlab.js";
-import p47 from "./iflow.js";
+import p47 from "./glm-cn.js";
-import p48 from "./inworld.js";
+import p48 from "./glm.js";
-import p49 from "./jina-ai.js";
+import p49 from "./google-pse.js";
-import p50 from "./jina-reader.js";
+import p50 from "./google-tts.js";
-import p51 from "./kilocode.js";
+import p51 from "./grok-cli.js";
-import p52 from "./kimchi.js";
+import p52 from "./grok-web.js";
-import p53 from "./kimi.js";
+import p53 from "./groq.js";
-import p54 from "./kiro.js";
+import p54 from "./huggingface.js";
-import p55 from "./linkup.js";
+import p55 from "./hyperbolic.js";
-import p56 from "./local-device.js";
+import p56 from "./iflow.js";
-import p57 from "./mimo-free.js";
+import p57 from "./inworld.js";
-import p58 from "./minimax-cn.js";
+import p58 from "./jina-ai.js";
-import p59 from "./minimax.js";
+import p59 from "./jina-reader.js";
-import p60 from "./mistral.js";
+import p60 from "./kilo-gateway.js";
-import p61 from "./mmf.js";
+import p61 from "./kilocode.js";
-import p62 from "./nanobanana.js";
+import p62 from "./kimchi.js";
-import p63 from "./nebius.js";
+import p63 from "./kimi.js";
-import p64 from "./nvidia.js";
+import p64 from "./kiro.js";
-import p65 from "./ollama-local.js";
+import p65 from "./linkup.js";
-import p66 from "./ollama.js";
+import p66 from "./llm7.js";
-import p123 from "./ollama-search.js";
+import p67 from "./local-device.js";
-import p67 from "./openai.js";
+import p68 from "./mimo-free.js";
-import p68 from "./opencode-go.js";
+import p69 from "./minimax-cn.js";
-import p68z from "./opencode-zen.js";
+import p70 from "./minimax.js";
-import p69 from "./opencode.js";
+import p71 from "./mistral.js";
-import p70 from "./openrouter.js";
+import p72 from "./mmf.js";
-import p71 from "./perplexity-web.js";
+import p73 from "./morph.js";
-import p72 from "./perplexity.js";
+import p74 from "./nanobanana.js";
-import p73 from "./perplexity-agent.js";
+import p75 from "./nebius.js";
-import p74 from "./playht.js";
+import p76 from "./nvidia.js";
-import p75 from "./qoder.js";
+import p77 from "./ollama-local.js";
-import p124 from "./qoder-cn.js";
+import p78 from "./ollama-search.js";
-import p77 from "./recraft.js";
+import p79 from "./ollama.js";
-import p78 from "./runwayml.js";
+import p80 from "./openai.js";
-import p79 from "./sdwebui.js";
+import p81 from "./opencode-go.js";
-import p80 from "./searchapi.js";
+import p82 from "./opencode-zen.js";
-import p81 from "./searxng.js";
+import p83 from "./opencode.js";
-import p82 from "./serper.js";
+import p84 from "./openrouter.js";
-import p83 from "./siliconflow.js";
+import p85 from "./perplexity-agent.js";
-import p84 from "./stability-ai.js";
+import p86 from "./perplexity-web.js";
-import p85 from "./tavily.js";
+import p87 from "./perplexity.js";
-import p86 from "./together.js";
+import p88 from "./playht.js";
-import p87 from "./topaz.js";
+import p89 from "./poolside.js";
-import p88 from "./tortoise.js";
+import p90 from "./qoder-cn.js";
-import p89 from "./venice.js";
+import p91 from "./qoder.js";
-import p90 from "./vercel-ai-gateway.js";
+import p92 from "./recraft.js";
-import p91 from "./vertex-partner.js";
+import p93 from "./runwayml.js";
-import p92 from "./vertex.js";
+import p94 from "./sambanova.js";
-import p93 from "./volcengine-ark.js";
+import p95 from "./sdwebui.js";
-import p94 from "./voyage-ai.js";
+import p96 from "./searchapi.js";
-import p95 from "./xai.js";
+import p97 from "./searxng.js";
-import p96 from "./xiaomi-mimo.js";
+import p98 from "./selfhosted-embedding.js";
-import p97 from "./xiaomi-tokenplan.js";
+import p99 from "./selfhosted-stt.js";
-import p98 from "./youcom.js";
+import p100 from "./selfhosted-tts.js";
-import p99 from "./alims-intl.js";
+import p101 from "./serper.js";
-import p100 from "./codebuddy-intl.js";
+import p102 from "./siliconflow.js";
-// Temporarily hidden — no tool calling support (trae SOLO agent / windsurf gRPC skip ToolCallChunk).
+import p103 from "./stability-ai.js";
-// Re-enable by uncommenting both the import and the array entry below.
+import p104 from "./tavily.js";
-// import p102 from "./trae.js";
+import p105 from "./tencent.js";
-import p103 from "./zed.js";
+import p106 from "./together.js";
-import p105 from "./api-airforce.js";
+import p107 from "./tokenrouter.js";
-import p106 from "./baidu.js";
+import p108 from "./topaz.js";
-import p107 from "./bazaarlink.js";
+import p109 from "./tortoise.js";
-import p108 from "./bluesminds.js";
+import p110 from "./venice.js";
-import p109 from "./kilo-gateway.js";
+import p111 from "./vercel-ai-gateway.js";
-import p110 from "./llm7.js";
+import p112 from "./vertex-partner.js";
-import p111 from "./sambanova.js";
+import p113 from "./vertex.js";
-import p112 from "./tencent.js";
+import p114 from "./volcengine-ark.js";
-import p113 from "./morph.js";
+import p115 from "./voyage-ai.js";
-// import p114 from "./devin-cli.js";
+import p116 from "./xai.js";
-// import p104 from "./windsurf.js";
+import p117 from "./xiaomi-mimo.js";
-import p115 from "./poolside.js";
+import p118 from "./xiaomi-tokenplan.js";
-import p116 from "./tokenrouter.js";
+import p119 from "./xquik.js";
-import p117 from "./selfhosted-stt.js";
+import p120 from "./youcom.js";
-import p118 from "./selfhosted-tts.js";
+import p121 from "./zed.js";
-import p119 from "./selfhosted-embedding.js";
+
-import p120 from "./fish-audio.js";
-import p121 from "./alitp-intl.js";
-import p122 from "./xquik.js";
 export default [
   p0,
   p1,
@@ -193,11 +190,8 @@ export default [
   p64,
   p65,
   p66,
-  p123,
-  p124,
   p67,
   p68,
-  p68z,
   p69,
   p70,
   p71,
@@ -205,6 +199,7 @@ export default [
   p73,
   p74,
   p75,
+  p76,
   p77,
   p78,
   p79,
@@ -229,8 +224,10 @@ export default [
   p98,
   p99,
   p100,
-  // p102, // trae — hidden, no tool calling
+  p101,
+  p102,
   p103,
+  p104,
   p105,
   p106,
   p107,
@@ -240,8 +237,7 @@ export default [
   p111,
   p112,
   p113,
-  // p114, // devin-cli — hidden, spawns local agent with shell/fs access
+  p114,
-  // p104, // windsurf — hidden, no tool calling
   p115,
   p116,
   p117,
@@ -249,5 +245,4 @@ export default [
   p119,
   p120,
   p121,
-  p122,
 ];

open-sse/services/clinepassModels.js

@@ -5,17 +5,11 @@ const FETCH_TIMEOUT_MS = 5000;
 
 /**
  * Build request headers for the ClinePass /models endpoint (Cline's upstream API).
- * - API keys are sent as plain Bearer tokens.
+ * Auth shape lives in shared/clineAuth: API keys ride plain Bearer, OAuth
- * - OAuth access tokens must carry the WorkOS `workos:` prefix (handled by buildClineHeaders).
+ * access tokens carry the WorkOS `workos:` prefix.
  */
 function buildModelListHeaders(token, isApiKey) {
-  if (isApiKey) {
+  return buildClineHeaders(token, { Accept: "application/json" }, { isApiKey });
-    return {
-      Accept: "application/json",
-      Authorization: `Bearer ${token}`,
-    };
-  }
-  return buildClineHeaders(token, { Accept: "application/json" });
 }
 
 /**

open-sse/services/poolGeo.js

@@ -0,0 +1,176 @@
+// Pool egress geo — engine layer, shared by the dashboard UI (Proxy Fitness /
+// Proxy Pools egress column) and any provider region policy that wants to
+// pre-mark pools unfit by egress region.
+//
+// The probe transport is provider-agnostic: it fetches a geo service THROUGH
+// the pool itself (relay headers for vercel/cloudflare/deno, proxy URL for
+// socks/http), so it works for every pool type and every provider.
+//
+// A chain of free endpoints is tried in order so a rate-limited or broken
+// provider drops to the next; ipinfo (the most quota-bound) is last.
+//
+// State lives on globalThis (same reason as proxyPoolFitness): the background
+// probe and the /api/proxy-pools reader must share ONE cache across Next dev
+// bundles.
+
+const GEO_STATE_KEY = "__9routerPoolGeo__";
+const geoCache = (globalThis[GEO_STATE_KEY] ??= new Map()); // poolId -> { ip, country, ..., ts, ipHistory }
+
+export const POOL_GEO_TTL_MS = 60 * 60 * 1000;
+// How many past egress IPs to remember for flapping detection.
+export const POOL_GEO_IP_HISTORY_MAX = 8;
+
+// Test helper: drop all cached geo (module state is globalThis-backed).
+export function resetPoolGeo() {
+  geoCache.clear();
+}
+
+// Attach stability classification: >=2 distinct egress IPs observed = flapping
+// (typical for serverless relays — Vercel/Cloudflare egress varies per colo).
+function withStability(entry) {
+  const ips = new Set([entry?.ip, ...(entry?.ipHistory || []).map((h) => h.ip)]);
+  ips.delete("");
+  const ipCount = ips.size;
+  return { ...entry, ipCount, isUnstable: ipCount >= 2 };
+}
+
+export function getPoolGeo(poolId) {
+  const entry = geoCache.get(poolId);
+  if (!entry) return null;
+  if (entry.ts + POOL_GEO_TTL_MS < Date.now()) {
+    geoCache.delete(poolId);
+    return null;
+  }
+  return withStability(entry);
+}
+
+export function setPoolGeo(poolId, geo) {
+  if (!poolId || !geo?.ip) return;
+  const prev = geoCache.get(poolId);
+  const ipHistory = prev?.ipHistory ? [...prev.ipHistory] : [];
+  if (prev?.ip && prev.ip !== geo.ip) {
+    // Record the IP we are leaving — the history tracks past egress IPs.
+    ipHistory.push({ ip: prev.ip, ts: Date.now() });
+    if (ipHistory.length > POOL_GEO_IP_HISTORY_MAX) ipHistory.shift();
+  }
+  geoCache.set(poolId, { ...geo, ts: Date.now(), ipHistory });
+}
+
+export function poolGeoSnapshot(now = Date.now()) {
+  const out = {};
+  for (const [poolId, entry] of geoCache) {
+    if (entry.ts + POOL_GEO_TTL_MS <= now) {
+      geoCache.delete(poolId);
+      continue;
+    }
+    out[poolId] = withStability(entry);
+  }
+  return out;
+}
+
+// Sweep geo entries past their TTL (ipHistory rides along with the entry).
+// Returns how many entries were removed.
+export function pruneStaleGeo(now = Date.now()) {
+  let removed = 0;
+  for (const [poolId, entry] of geoCache) {
+    if (entry.ts + POOL_GEO_TTL_MS <= now) {
+      geoCache.delete(poolId);
+      removed += 1;
+    }
+  }
+  return removed;
+}
+
+// Normalize a single provider's geo payload to { ip, country, region, city, org }.
+const GEO_PARSE = {
+  "ipwho.is": (d) => ({ ip: d?.ip, country: d?.country, region: d?.region, city: d?.city, org: d?.org || d?.connection?.org }),
+  "ip-api": (d) => ({ ip: d?.query, country: d?.country, region: d?.regionName, city: d?.city, org: d?.org }),
+  "ipapi.co": (d) => ({ ip: d?.ip, country: d?.country_name, region: d?.region, city: d?.city, org: d?.org }),
+  ipinfo: (d) => ({ ip: d?.ip, country: d?.country, region: d?.region, city: d?.city, org: d?.org }),
+};
+
+// Tried in order — rate-friendly first, quota-bound ipinfo last.
+const GEO_PROBES = [
+  { name: "ipwho.is", url: "https://ipwho.is/" },
+  { name: "ip-api", url: "https://ip-api.com/json/?fields=status,message,query,country,regionName,city,org" },
+  { name: "ipapi.co", url: "https://ipapi.co/json/" },
+  { name: "ipinfo", url: "https://ipinfo.io/json" },
+];
+
+// Custom single endpoint via env (replaces the chain). Keys mapped generically.
+function customGeoParse(d) {
+  if (!d || typeof d !== "object") return null;
+  const pick = (...keys) => keys.map((k) => d[k]).find((v) => v != null && v !== "");
+  return {
+    ip: pick("query", "ip"),
+    country: pick("country", "country_name", "countryName"),
+    region: pick("regionName", "region", "state", "regionCode"),
+    city: pick("city"),
+    org: pick("org", "organization", "isp", "orgName", "connection", "asn"),
+  };
+}
+
+function probeSource({ proxyAwareFetch, url, proxyOptions, timeoutMs, name }) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(new Error("geo probe timeout")), timeoutMs);
+  return (async () => {
+    try {
+      const res = await proxyAwareFetch(url, { signal: ctrl.signal }, proxyOptions);
+      if (!res.ok) {
+        const txt = await res.text().catch(() => "");
+        const error = res.status === 429 || res.status === 403 ? "rate-limit"
+          : res.status >= 500 ? "server"
+          : "network";
+        return { ok: false, error, detail: `${res.status} ${txt.slice(0, 80)}` };
+      }
+      const data = await res.json().catch(() => null);
+      const parsed = name ? GEO_PARSE[name]?.(data) : customGeoParse(data);
+      if (!parsed?.ip) return { ok: false, error: "no-ip", detail: `${name || "custom"}` };
+      return {
+        ok: true,
+        geo: {
+          ip: String(parsed.ip || "").trim(),
+          country: String(parsed.country || "").trim(),
+          region: String(parsed.region || "").trim(),
+          city: String(parsed.city || "").trim(),
+          org: String(parsed.org || "").trim(),
+          isDatacenter: /(cloudflare|vercel|amazon|aws|google|microsoft|azure|digitalocean|hetzner|ovh|contabo|leaseweb)/i.test(
+            String(parsed.org || ""),
+          ),
+        },
+      };
+    } catch (error) {
+      const timedOut = ctrl.signal?.aborted && error?.name === "AbortError";
+      return { ok: false, error: timedOut ? "timeout" : "network", detail: `${error?.name}: ${error?.message}` };
+    } finally {
+      clearTimeout(timer);
+    }
+  })();
+}
+
+// Probe the egress geo of one pool through a chain of geo providers. Fail-open:
+// returns { ok:true, geo } on success, { ok:false, error } otherwise with
+// `error` one of "rate-limit" | "server" | "no-ip" | "network" | "timeout".
+// `pool` shape: { proxyUrl, type }. 15s timeout per endpoint by default.
+export async function probePoolGeo(pool, timeoutMs = 15000) {
+  const proxyUrl = pool?.proxyUrl;
+  if (!proxyUrl) return { ok: false, error: "network", detail: "no proxy url" };
+  const { proxyAwareFetch } = await import("../utils/proxyFetch.js");
+  const isRelay = ["vercel", "cloudflare", "deno"].includes(pool?.type);
+  const proxyOptions = isRelay
+    ? { vercelRelayUrl: proxyUrl }
+    : { connectionProxyEnabled: true, connectionProxyUrl: proxyUrl };
+
+  const custom = process.env.GEO_PROBE_URL ? [{ name: null, url: process.env.GEO_PROBE_URL }] : [];
+  const probes = custom.length ? custom : GEO_PROBES;
+
+  let last = { ok: false, error: "network", detail: "no provider responded" };
+  for (const p of probes) {
+    const res = await probeSource({ proxyAwareFetch, url: p.url, proxyOptions, timeoutMs, name: p.name });
+    if (res.ok) return res;
+    // Prefer the most specific failure: rate-limit/server over generic network.
+    if (res.error === "rate-limit" || res.error === "server") last = res;
+    else if (last.error === "network") last = res;
+  }
+  return last;
+}

open-sse/services/proxyPoolFitness.js

@@ -0,0 +1,167 @@
+// Pool fitness registry — shared, in-memory, engine layer.
+//
+// Rotation strategies can opt into region/provider-aware pool selection: an
+// executor that learns a pool's egress is unfit for a provider/model (e.g.
+// Freebuff limited-mode IP) marks it here, and the pool picker skips it for
+// that scope until the cooldown expires.
+//
+// Scope format: `provider::model` (e.g. "freebuff::openai/gpt-5.6-luna").
+// All functions are fail-open: unknown pool/scope ⇒ fit.
+
+// Scope format: `provider::model` (e.g. "freebuff::openai/gpt-5.6-luna").
+// All functions are fail-open: unknown pool/scope ⇒ fit.
+//
+// State lives on globalThis so Next dev (Turbopack) never splits one Map into
+// several per-bundle copies — the executor/chatCore marks and the
+// /api/proxy-pools/fitness reader must share the SAME registry.
+
+const FITNESS_STATE_KEY = "__9routerPoolFitness__";
+const fitness = (globalThis[FITNESS_STATE_KEY] ??= new Map()); // poolId -> Map<scope, { until, reason }>
+let persistTimer = null;
+let hydratePromise = null;
+
+export const POOL_UNFIT_MS = 5 * 60 * 1000;
+
+function schedulePersist() {
+  if (persistTimer) return;
+  persistTimer = setTimeout(async () => {
+    persistTimer = null;
+    try {
+      const { updateSettings } = await import("@/lib/db/repos/settingsRepo.js");
+      await updateSettings({ proxyPoolFitness: poolFitnessSnapshot() });
+    } catch {
+      // Fitness is advisory; persistence failures must not block requests.
+    }
+  }, 25);
+  if (persistTimer.unref) persistTimer.unref();
+}
+
+export function hydratePoolFitness(snapshot = {}) {
+  for (const [poolId, byScope] of Object.entries(snapshot || {})) {
+    const entries = Object.entries(byScope || {}).filter(([, entry]) => Number(entry?.until) > Date.now());
+    if (entries.length) fitness.set(poolId, new Map(entries));
+  }
+}
+
+export async function ensurePoolFitnessHydrated() {
+  if (!hydratePromise) {
+    hydratePromise = import("@/lib/db/repos/settingsRepo.js")
+      .then(({ getSettings }) => getSettings())
+      .then((settings) => hydratePoolFitness(settings.proxyPoolFitness || {}))
+      .catch(() => {})
+      .then(() => undefined);
+  }
+  return hydratePromise;
+}
+
+export function markPoolUnfit(poolId, scope, until = Date.now() + POOL_UNFIT_MS, reason = "") {
+  if (!poolId || !scope) return;
+  const byScope = fitness.get(poolId) || new Map();
+  byScope.set(scope, { until, reason });
+  fitness.set(poolId, byScope);
+  schedulePersist();
+}
+
+export function clearPoolUnfit(poolId, scope) {
+  const byScope = fitness.get(poolId);
+  if (!byScope) return;
+  byScope.delete(scope);
+  if (byScope.size === 0) fitness.delete(poolId);
+  schedulePersist();
+}
+
+// "provider::model" -> "provider::*" (null when the scope has no provider part)
+function providerWildcardScope(scope) {
+  const sep = String(scope || "").indexOf("::");
+  if (sep < 0) return null;
+  return `${scope.slice(0, sep)}::*`;
+}
+
+export function isPoolFit(poolId, scope, now = Date.now()) {
+  if (!poolId) return true;
+  const byScope = fitness.get(poolId);
+  if (!byScope) return true;
+  // A provider-wide mark ("provider::*", e.g. manual blocks) also covers any
+  // model lookup for that provider.
+  const candidates = [scope, providerWildcardScope(scope)];
+  for (const key of candidates) {
+    if (!key) continue;
+    const entry = byScope.get(key);
+    if (!entry) continue;
+    if (entry.until <= now) {
+      byScope.delete(key);
+      if (byScope.size === 0) fitness.delete(poolId);
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+
+// Keep only pool ids that are not in cooldown for the scope.
+export function fitPoolIds(poolIds, scope, now = Date.now()) {
+  return (poolIds || []).filter((id) => isPoolFit(id, scope, now));
+}
+
+// Clear every mark — or only scopes belonging to one provider (`provider::*`).
+export function clearAllPoolUnfit(provider = null) {
+  if (provider) {
+    const prefix = `${provider}::`;
+    for (const [poolId, byScope] of fitness) {
+      for (const scope of [...byScope.keys()]) {
+        if (scope.startsWith(prefix)) byScope.delete(scope);
+      }
+      if (byScope.size === 0) fitness.delete(poolId);
+    }
+    schedulePersist();
+    return;
+  }
+  fitness.clear();
+  schedulePersist();
+}
+
+// Snapshot of live (non-expired) marks — expired entries are pruned here so
+// consumers never see stale data and memory stays bounded.
+// Test helper: drop all marks (module state is globalThis-backed).
+export function resetPoolFitness() {
+  fitness.clear();
+  hydratePromise = Promise.resolve();
+  schedulePersist();
+}
+
+// Sweep all expired marks. Returns how many scope entries were removed.
+export function pruneExpired(now = Date.now()) {
+  let removed = 0;
+  for (const [poolId, byScope] of fitness) {
+    for (const [scope, entry] of byScope) {
+      if (entry.until <= now) {
+        byScope.delete(scope);
+        removed += 1;
+      }
+    }
+    if (byScope.size === 0) fitness.delete(poolId);
+  }
+  if (removed) schedulePersist();
+  return removed;
+}
+
+export function poolFitnessSnapshot(now = Date.now()) {
+  const out = {};
+  for (const [poolId, byScope] of fitness) {
+    let pruned = false;
+    for (const [scope, entry] of byScope) {
+      if (entry.until <= now) {
+        byScope.delete(scope);
+        pruned = true;
+      }
+    }
+    if (byScope.size === 0) {
+      fitness.delete(poolId);
+      continue;
+    }
+    if (pruned || byScope.size > 0) {
+      out[poolId] = Object.fromEntries(byScope);
+    }
+  }
+  return out;
+}

open-sse/services/usage.js

@@ -14,6 +14,7 @@ import { getCodeBuddyCnUsage, getCodeBuddyIntlUsage } from "./usage/codebuddy-cn
 import { getGrokCliUsage } from "./usage/grok-cli.js";
 import { getKimiUsage } from "./usage/kimi.js";
 import { getDeepseekUsage } from "./usage/deepseek.js";
+import { getFreebuffUsage } from "./usage/freebuff.js";
 import { getOpenCodeGoUsage } from "./usage/opencode-go.js";
 import { getOpenCodeZenUsage } from "./usage/opencode-zen.js";
 import { getGroqUsage } from "./usage/groq.js";
@@ -58,6 +59,7 @@ const USAGE_HANDLERS = {
   "opencode-go": (c) => getOpenCodeGoUsage(c.apiKey, c.proxyOptions),
   "opencode-zen": (c) => getOpenCodeZenUsage(c.apiKey, c.proxyOptions),
   deepseek: (c) => getDeepseekUsage(c.apiKey, c.proxyOptions),
+  freebuff: (c) => getFreebuffUsage(c.accessToken, c.providerSpecificData, c.proxyOptions),
   groq: (c) => getGroqUsage(c.apiKey, c.proxyOptions),
   zed: (c) => getZedUsage(c.accessToken, c.providerSpecificData, c.proxyOptions),
   "xiaomi-mimo": (c) => getXiaomiMimoUsage(c.accessToken, c.providerSpecificData, c.proxyOptions),

open-sse/services/usage/freebuff.js

@@ -0,0 +1,201 @@
+/**
+ * Freebuff usage handler
+ *
+ * Freebuff has no separate billing/quota API — the daily free/premium session
+ * quota lives on the session endpoint itself. Reading it MUST use
+ * GET /api/v1/freebuff/session (the CLI's status poll): POST would CLAIM a
+ * session and burn 1.0 unit of the daily quota, which a quota tracker must
+ * never do.
+ *
+ * The GET response carries the shared session quota as `rateLimitsByModel`,
+ * keyed by model id, on the pre-join (`none`), `active`, and `ended` states:
+ *   { limit, recentCount, resetAt, period: 'pacific_day'|'pacific_week',
+ *     resetTimeZone, entitlementBreakdown? }
+ * `recentCount` is fractional — a long agent run can consume 1.3 units — and
+ * includes the active session's own 1.0-unit reservation. `limit` can be
+ * raised by referral/streak rewards (entitlementBreakdown.base + referral +
+ * streak).
+ *
+ * Freebucks-metered accounts (2026-09-02+) get NO pool rows: the server sends
+ * a `freebucks` block instead — { balance, daily:{limit,spent,remaining,resetAt},
+ * wallet:{balance,...}, monthly?:{limitUsd,spentUsd,remainingUsd,resetAt},
+ * planId, prices:{model→Freebucks/hr}, priceNotices?, priceChanges? }. The
+ * daily pool replaces rateLimitsByModel, so the tracker folds it in by
+ * replicating the pool snapshot under every priced model id, exactly as the
+ * official picker does.
+ *
+ * Pricing is SERVER-AUTHORITATIVE and nothing here hardcodes a number: each
+ * row carries the live `prices[model]` (plus its `priceNotices` tagline), and
+ * `applyFreebucksPriceChanges` folds the server's announced `priceChanges`
+ * schedule into the map — a promo (e.g. Solar Pro 4's Labor Day 0-Freebucks
+ * offer) expires and reverts on the server's timeline with no client release,
+ * mirroring upstream common/src/util/freebuff-price-changes.ts. A compact
+ * account summary (`freebucks`) rides the response for the card header.
+ */
+
+import REGISTRY from "../../providers/registry/index.js";
+import { U, fetchWithTimeout } from "./shared.js";
+
+// Friendly labels from the registry model list (mirrors the CLI picker).
+const freebuffRegistry = REGISTRY.find((r) => r.id === "freebuff") || {};
+const MODEL_LABELS = Object.fromEntries(
+  (freebuffRegistry.models || []).map((m) => [m.id, m.name]),
+);
+
+// Fold the server's announced price schedule into the live price map —
+// mirrors upstream applyFreebucksPriceChanges: due changes override the price
+// AND its picker tagline, and drop off the pending list.
+function applyFreebucksPriceChanges(info) {
+  const now = Date.now();
+  const due = (info?.priceChanges || []).filter((c) => Date.parse(c.at) <= now);
+  if (due.length === 0) return info;
+  const prices = { ...(info.prices || {}) };
+  const priceNotices = { ...(info.priceNotices || {}) };
+  for (const change of due.sort((a, b) => Date.parse(a.at) - Date.parse(b.at))) {
+    if (prices[change.modelId] === undefined) continue;
+    prices[change.modelId] = change.price;
+    priceNotices[change.modelId] = change.tagline;
+  }
+  return {
+    ...info,
+    prices,
+    priceNotices,
+    priceChanges: (info.priceChanges || []).filter((c) => Date.parse(c.at) > now),
+  };
+}
+
+function sessionUrl() {
+  return U("freebuff").url;
+}
+
+export async function getFreebuffUsage(accessToken, providerSpecificData, proxyOptions = null) {
+  if (!accessToken) {
+    return { message: "Freebuff credential not available — connect a Freebuff login first." };
+  }
+
+  try {
+    const response = await fetchWithTimeout(
+      sessionUrl(),
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          "User-Agent": "codebuff-cli/0.0.138",
+          Accept: "application/json",
+        },
+      },
+      15000,
+      proxyOptions,
+    );
+
+    if (response.status === 401) {
+      return { message: "Freebuff credential invalid or expired — re-login in the dashboard." };
+    }
+    if (response.status === 403) {
+      // A 403 from the session endpoint is usually a server-side gate status
+      // (country_blocked / banned), not a credential problem — telling the
+      // user to re-login would be misleading (mirrors the CLI's
+      // callFreebuffSession 403 branch).
+      const body = await response.json().catch(() => ({}));
+      if (body?.status === "country_blocked") {
+        return { message: "Freebuff is not available in your region." };
+      }
+      if (body?.status === "banned") {
+        return { message: "Your Freebuff account has been banned." };
+      }
+      return {
+        message: `Freebuff quota access denied (403)${body?.message ? `: ${body.message}` : ""}.`,
+      };
+    }
+    // 404 = no session row at all → pre-join state, no quota to report.
+    if (response.status === 404) {
+      return { plan: "Freebuff", message: "Freebuff connected. No session quota to report right now." };
+    }
+    if (!response.ok) {
+      return { message: `Freebuff quota API error (${response.status}).` };
+    }
+
+    const data = await response.json().catch(() => ({}));
+    const rateLimits = { ...(data.rateLimitsByModel || {}) };
+    // An active session carries its own `rateLimit` row — fold it in when the
+    // shared map omits the model (older servers).
+    if (data.status === "active" && data.rateLimit && !rateLimits[data.model]) {
+      rateLimits[data.model] = data.rateLimit;
+    }
+
+    const quotas = {};
+    for (const [model, rl] of Object.entries(rateLimits)) {
+      if (!rl || typeof rl !== "object") continue;
+      const used = Number(rl.recentCount);
+      const total = Number(rl.limit);
+      quotas[model] = {
+        used: Number.isFinite(used) ? used : 0,
+        total: Number.isFinite(total) ? total : 0,
+        resetAt: rl.resetAt || null,
+        unlimited: false,
+        // Daily/weekly Pacific session allowance replenishes at resetAt — the
+        // UI must say "Resets in", not "Expires in".
+        recurring: true,
+        ...(MODEL_LABELS[model] ? { displayName: MODEL_LABELS[model] } : {}),
+      };
+    }
+
+    // Freebucks meter: the daily Freebucks pool is the quota for metered
+    // accounts, replicated under each priced model like the picker's rings.
+    // Prices come off the wire (prices + priceChanges folded in); each row
+    // carries its own price/tagline, and a compact summary rides the response
+    // for the account header in the UI.
+    let freebucksSummary = null;
+    const rawFreebucks = data.freebucks;
+    if (rawFreebucks && rawFreebucks.daily && typeof rawFreebucks.daily === "object") {
+      const freebucks = applyFreebucksPriceChanges(rawFreebucks);
+      const spent = Number(freebucks.daily.spent);
+      const limit = Number(freebucks.daily.limit);
+      for (const [model, price] of Object.entries(freebucks.prices || {})) {
+        quotas[model] = {
+          used: Number.isFinite(spent) ? spent : 0,
+          total: Number.isFinite(limit) ? limit : 0,
+          resetAt: freebucks.daily.resetAt || null,
+          unlimited: false,
+          recurring: true,
+          price: Number.isFinite(Number(price)) ? Number(price) : undefined,
+          ...(freebucks.priceNotices?.[model] ? { priceNote: freebucks.priceNotices[model] } : {}),
+          ...(MODEL_LABELS[model] ? { displayName: MODEL_LABELS[model] } : {}),
+        };
+      }
+      freebucksSummary = {
+        balance: Number.isFinite(Number(freebucks.balance)) ? Number(freebucks.balance) : null,
+        daily: {
+          limit: Number.isFinite(limit) ? limit : 0,
+          spent: Number.isFinite(spent) ? spent : 0,
+          remaining: Number.isFinite(Number(freebucks.daily.remaining)) ? Number(freebucks.daily.remaining) : 0,
+          resetAt: freebucks.daily.resetAt || null,
+        },
+        wallet: {
+          balance: Number.isFinite(Number(freebucks.wallet?.balance)) ? Number(freebucks.wallet.balance) : 0,
+        },
+        ...(freebucks.monthly && Number.isFinite(Number(freebucks.monthly.remainingUsd))
+          ? {
+              monthly: {
+                remainingUsd: Number(freebucks.monthly.remainingUsd),
+                limitUsd: Number.isFinite(Number(freebucks.monthly.limitUsd)) ? Number(freebucks.monthly.limitUsd) : null,
+                resetAt: freebucks.monthly.resetAt || null,
+              },
+            }
+          : {}),
+      };
+    }
+
+    const plan = data.accessTier === "limited" ? "Freebuff (Limited)" : "Freebuff";
+    if (Object.keys(quotas).length === 0) {
+      return { plan, message: "Freebuff connected. No session quota to report right now." };
+    }
+    const out = { plan, quotas };
+    if (freebucksSummary) out.freebucks = freebucksSummary;
+    return out;
+  } catch (error) {
+    return { message: `Freebuff usage error: ${error.message}` };
+  }
+}
+
+export default getFreebuffUsage;

open-sse/shared/clineAuth.js

@@ -1,6 +1,10 @@
-import pkg from "../../package.json" with { type: "json" };
+// Cline CLI identity (mirrors apps/cli + sdk/packages/llms request-headers.ts
-
+// in cline/cline). Upstream gates the cline-free/* model aliases to Cline
-const APP_VERSION = pkg.version || "0.0.0";
+// product surfaces + recent client versions — requests sent as
+// X-CLIENT-TYPE 9router are 403'd with "only available via Cline product
+// surfaces". Verified live 2026-09-11: cline-cli/3.0.61 passes the gate.
+const CLINE_CLIENT_TYPE = "cline-cli";
+const CLINE_CLIENT_VERSION = "3.0.61";
 
 export function getClineAccessToken(token) {
   if (typeof token !== "string") return "";
@@ -21,17 +25,26 @@ export function getClineAuthorizationHeader(token) {
   return accessToken ? `Bearer ${accessToken}` : "";
 }
 
-export function buildClineHeaders(token, extraHeaders = {}) {
+export function buildClineHeaders(token, extraHeaders = {}, opts = {}) {
-  const authorization = getClineAuthorizationHeader(token);
+  // API keys ride plain Bearer; OAuth access tokens must carry the WorkOS
+  // `workos:` prefix so the backend routes verification to WorkOS
+  // (cline/cline: "Prefixed with 'workos:'..."). Verified live 2026-09-11:
+  // plain sk_* works, workos:sk_* → 401.
+  const trimmed = typeof token === "string" ? token.trim() : "";
+  const authorization = !trimmed
+    ? ""
+    : opts.isApiKey
+      ? `Bearer ${trimmed}`
+      : getClineAuthorizationHeader(trimmed);
   const headers = {
     "HTTP-Referer": "https://cline.bot",
     "X-Title": "Cline",
-    "User-Agent": `9Router/${APP_VERSION}`,
+    "User-Agent": `Cline/${CLINE_CLIENT_VERSION}`,
-    "X-PLATFORM": process.platform || "unknown",
+    "X-PLATFORM": "cli",
-    "X-PLATFORM-VERSION": process.version || "unknown",
+    "X-PLATFORM-VERSION": CLINE_CLIENT_VERSION,
-    "X-CLIENT-TYPE": "9router",
+    "X-CLIENT-TYPE": CLINE_CLIENT_TYPE,
-    "X-CLIENT-VERSION": APP_VERSION,
+    "X-CLIENT-VERSION": CLINE_CLIENT_VERSION,
-    "X-CORE-VERSION": APP_VERSION,
+    "X-CORE-VERSION": CLINE_CLIENT_VERSION,
     "X-IS-MULTIROOT": "false",
     ...extraHeaders,
   };

open-sse/utils/error.js

@@ -69,7 +69,14 @@ export async function parseUpstreamError(response, executor = null) {
       const parsed = executor.parseError(response, bodyText);
       if (parsed && typeof parsed === "object") {
         const msg = parsed.message || DEFAULT_ERROR_MESSAGES[response.status] || `Upstream error: ${response.status}`;
-        return { statusCode: parsed.status || response.status, message: msg, resetsAtMs: parsed.resetsAtMs };
+        return {
+          statusCode: parsed.status || response.status,
+          message: msg,
+          resetsAtMs: parsed.resetsAtMs,
+          // Executors declare IP/pool-scoped failures (e.g. per-IP rate limits)
+          // here; chatCore completes poolId/scope and retries via another pool.
+          poolScoped: parsed.poolScoped,
+        };
       }
     } catch { /* fall through to default parsing */ }
   }

open-sse/utils/stream.js

@@ -381,8 +381,6 @@ export function createSSEStream(options = {}) {
     },
 
     flush(controller) {
-      const evtSummary = Object.entries(eventTypeCounts).map(([k, v]) => `${k}=${v}`).join(",") || "none";
-      dbg("SSE", `flush | provider=${provider} | model=${model} | recvLines=${sseLineCount} | emitted=${sseEmittedCount} | events=[${evtSummary}]`);
       trackPendingRequest(model, provider, connectionId, false);
       try {
         const remaining = decoder.decode();

open-sse/utils/streamHandler.js

@@ -1,6 +1,6 @@
 // Stream handler with disconnect detection - shared for all providers
 import { STREAM_STALL_TIMEOUT_MS } from "../config/runtimeConfig.js";
-import { dbg, isDebugEnabled } from "./debugLog.js";
+import { dbg } from "./debugLog.js";
 
 // Get HH:MM:SS timestamp
 function getTimeString() {
@@ -79,7 +79,7 @@ export function createStreamController({ onDisconnect, onError, log, provider, m
         return;
       }
 
-      logStream("✗", `ERROR: ${error.message}${error.stack ? `\n    ${error.stack}` : ""}`, true);
+      logStream("✗", `ERROR: ${error.message}`, true);
       onError?.(error);
     },
 
@@ -194,12 +194,7 @@ export function createDisconnectAwareStream(transformStream, streamController, o
  */
 export function pipeWithDisconnect(providerResponse, transformStream, streamController, onAbortTerminal = null, stallTimeoutMs = STREAM_STALL_TIMEOUT_MS) {
   let stallTimer = null;
-  let chunkCount = 0;
-  let totalBytes = 0;
-  let lastChunkAt = Date.now();
   let abortMessage = "upstream connection lost";
-  const t0 = Date.now();
-  const tag = "STREAM";
   const clearStall = () => {
     if (stallTimer) { clearTimeout(stallTimer); stallTimer = null; }
   };
@@ -208,7 +203,6 @@ export function pipeWithDisconnect(providerResponse, transformStream, streamCont
     stallTimer = setTimeout(() => {
       stallTimer = null;
       abortMessage = "stream stall timeout";
-      dbg(tag, `STALL TIMEOUT ${stallTimeoutMs}ms | chunks=${chunkCount} | bytes=${totalBytes} | sinceLast=${Date.now() - lastChunkAt}ms`);
       streamController.handleError?.(new Error("stream stall timeout"));
       streamController.abort?.();
     }, stallTimeoutMs);
@@ -221,30 +215,20 @@ export function pipeWithDisconnect(providerResponse, transformStream, streamCont
     signal: streamController.signal,
     startTime: streamController.startTime,
     isConnected: () => streamController.isConnected(),
-    handleComplete: () => { dbg(tag, `complete | chunks=${chunkCount} | bytes=${totalBytes} | dur=${Date.now() - t0}ms`); clearStall(); streamController.handleComplete(); },
+    handleComplete: () => { clearStall(); streamController.handleComplete(); },
-    handleError: (e) => { dbg(tag, `error: ${e?.message} | chunks=${chunkCount} | bytes=${totalBytes} | dur=${Date.now() - t0}ms`); clearStall(); streamController.handleError(e); },
+    handleError: (e) => { clearStall(); streamController.handleError(e); },
-    handleDisconnect: (r) => { dbg(tag, `disconnect: ${r} | chunks=${chunkCount} | bytes=${totalBytes} | dur=${Date.now() - t0}ms`); clearStall(); streamController.handleDisconnect(r); },
+    handleDisconnect: (r) => { clearStall(); streamController.handleDisconnect(r); },
     abort: () => { clearStall(); streamController.abort(); }
   };
 
   armStall();
-  dbg(tag, `pipe start | stallTimeout=${stallTimeoutMs}ms`);
 
   const upstreamTap = new TransformStream({
     transform(chunk, controller) {
-      chunkCount++;
-      const sz = chunk?.byteLength || chunk?.length || 0;
-      totalBytes += sz;
-      const now = Date.now();
-      const gap = now - lastChunkAt;
-      lastChunkAt = now;
-      if (isDebugEnabled && (chunkCount <= 5 || chunkCount % 20 === 0 || gap > 5000)) {
-        dbg(tag, `chunk #${chunkCount} | size=${sz}B | gap=${gap}ms | total=${totalBytes}B`);
-      }
       armStall();
       controller.enqueue(chunk);
     },
-    flush() { dbg(tag, `upstream EOF | chunks=${chunkCount} | bytes=${totalBytes} | dur=${Date.now() - t0}ms`); clearStall(); }
+    flush() { clearStall(); }
   });
 
   const transformedBody = providerResponse.body

package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router-app",
-  "version": "0.5.86",
+"version": "0.5.86",
   "description": "9Router web dashboard",
   "private": true,
   "scripts": {
@@ -28,12 +28,13 @@
     "bcryptjs": "^3.0.3",
     "chalk": "^5.6.2",
     "confbox": "^0.2.4",
+    "dompurify": "^3.4.13",
     "express": "^5.2.1",
     "http-proxy-middleware": "^3.0.5",
     "jose": "^6.1.3",
     "marked": "^18.0.1",
     "material-symbols": "^0.44.6",
-    "monaco-editor": "^0.55.1",
+    "monaco-editor": "^0.56.0",
     "next": "^16.1.6",
     "node-forge": "^1.3.3",
     "node-machine-id": "^1.1.12",
@@ -61,5 +62,8 @@
     "eslint-config-next": "16.1.6",
     "postcss": "^8.5.6",
     "tailwindcss": "^4"
+  },
+  "overrides": {
+    "dompurify": "^3.4.13"
   }
 }

scripts/test-combo-autoswitch.mjs

@@ -2,9 +2,14 @@
 // Sends text / image / search requests to a combo and reports which member ran.
 //   node scripts/test-combo-autoswitch.mjs
 const BASE = process.env.BASE_URL || "http://localhost:20127";
-const KEY = process.env.API_KEY || "sk-6581be4f05a82b6b-uxy6jn-c8190ea8";
+const KEY = process.env.API_KEY;
 const COMBO = process.env.COMBO || "haha";
 
+if (!KEY) {
+  console.error("API_KEY environment variable is required");
+  process.exit(1);
+}
+
 // 16x16 PNG (valid image so vision providers accept it).
 const PNG = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAFklEQVR4nGO4I2JDEmIY1TCqYfhqAAAeBCwQ8YdREQAAAABJRU5ErkJggg==";
 

src/app/(dashboard)/dashboard/profile/page.js

@@ -10,6 +10,16 @@ import { APP_CONFIG } from "@/shared/constants/config";
 import { LOCALE_COOKIE, normalizeLocale } from "@/i18n/config";
 import { LOCALE_FLAGS } from "@/shared/constants/locales";
 
+function memoryLine(m) {
+  if (!m) return "";
+  const fb = m.inMemory?.freebuff || {};
+  return [
+    `DB: ${m.dbPath || "-"} (${m.dbSizeMB || "-"})`,
+    `Data dir: ${m.dataDirSizeMB || "-"}`,
+    `In-memory: fitness=${m.inMemory?.fitnessPools ?? 0} pool(s) · geo=${m.inMemory?.geoPools ?? 0} pool(s) · freebuff sessions=${fb.sessions ?? 0}, locks=${fb.modelLocks ?? 0}, pool-limits=${fb.poolLimits ?? 0}`,
+  ].join("\n");
+}
+
 function getLocaleFromCookie() {
   if (typeof document === "undefined") return "en";
   const cookie = document.cookie
@@ -72,6 +82,8 @@ export default function ProfilePage() {
   const certFileRef = useRef(null);
 
   const importFileRef = useRef(null);
+  const [memoryInfo, setMemoryInfo] = useState(null);
+  const [memoryLoading, setMemoryLoading] = useState(false);
   const [proxyForm, setProxyForm] = useState({
     outboundProxyEnabled: false,
     outboundProxyUrl: "",
@@ -752,6 +764,19 @@ export default function ProfilePage() {
     setShutdownOpen(false);
   };
 
+  const handleMemoryCheck = async () => {
+    setMemoryLoading(true);
+    try {
+      const res = await fetch("/api/system/memory", { cache: "no-store" });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      setMemoryInfo(await res.json());
+    } catch (err) {
+      setMemoryInfo({ error: err.message });
+    } finally {
+      setMemoryLoading(false);
+    }
+  };
+
   const handleLogout = async () => {
     try {
       const res = await fetch("/api/auth/logout", { method: "POST" });
@@ -825,6 +850,15 @@ export default function ProfilePage() {
               >
                 Import Backup
               </Button>
+              <Button
+                variant="outline"
+                icon="memory"
+                onClick={handleMemoryCheck}
+                loading={memoryLoading}
+                className="w-full sm:w-auto"
+              >
+                Check Size Memory
+              </Button>
               <input
                 ref={importFileRef}
                 type="file"
@@ -838,6 +872,13 @@ export default function ProfilePage() {
                 {dbStatus.message}
               </p>
             )}
+            {memoryInfo && (
+              <pre className="text-[11px] font-mono text-text-muted whitespace-pre-wrap break-all">
+                {memoryInfo.error
+                  ? `Error: ${memoryInfo.error}`
+                  : memoryLine(memoryInfo)}
+              </pre>
+            )}
           </div>
         </Card>
 
@@ -1646,6 +1687,14 @@ export default function ProfilePage() {
         <div className="text-center text-xs sm:text-sm text-text-muted py-4">
           <p>{APP_CONFIG.name} v{APP_CONFIG.version}</p>
           <p className="mt-1">{isRemoteHost ? "Remote Mode" : "Local Mode - All data stored on your machine"}</p>
+          <a
+            href="https://github.com/mhiqrambg/9router-mibp-version"
+            target="_blank"
+            rel="noreferrer"
+            className="inline-block mt-1 text-[11px] hover:text-primary transition-colors"
+          >
+            MIBP Edition
+          </a>
         </div>
       </div>
 

src/app/(dashboard)/dashboard/providers/[id]/ConnectionRow.js

@@ -6,30 +6,76 @@ import PropTypes from "prop-types";
 import { Badge, Toggle, Tooltip } from "@/shared/components";
 import CooldownTimer from "./CooldownTimer";
 
-export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst, isLast, onMoveUp, onMoveDown, onToggleActive, onUpdateProxy, onEdit, onDelete, oneByOneStatus = null, autoPing = null }) {
+export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst, isLast, onMoveUp, onMoveDown, onToggleActive, onUpdateProxy, onEdit, onDelete, oneByOneStatus = null, autoPing = null, modelAssignmentOptions = null, onModelAssignmentChange = null, strictModelAssignment = false }) {
   const [showProxyDropdown, setShowProxyDropdown] = useState(false);
   const [updatingProxy, setUpdatingProxy] = useState(false);
+  const [selectedProxyIds, setSelectedProxyIds] = useState([]);
+  const [rotationStrategy, setRotationStrategy] = useState("none");
   const proxyDropdownRef = useRef(null);
 
+  // Initialize proxy state from connection
+  useEffect(() => {
+    const proxyPoolIds = connection.providerSpecificData?.proxyPoolIds || [];
+    const legacyProxyPoolId = connection.providerSpecificData?.proxyPoolId;
+    
+    // Migrate legacy single proxy to array format
+    queueMicrotask(() => {
+      if (legacyProxyPoolId && proxyPoolIds.length === 0) {
+        setSelectedProxyIds([legacyProxyPoolId]);
+      } else {
+        setSelectedProxyIds(proxyPoolIds);
+      }
+      setRotationStrategy(connection.providerSpecificData?.proxyRotationStrategy || "none");
+    });
+  }, [connection]);
+
   const proxyPoolMap = new Map((proxyPools || []).map((pool) => [pool.id, pool]));
-  const boundProxyPoolId = connection.providerSpecificData?.proxyPoolId || null;
+  
-  const boundProxyPool = boundProxyPoolId ? proxyPoolMap.get(boundProxyPoolId) : null;
+  // Display logic - support both new (multi-proxy) and legacy (single proxy) formats
   const hasLegacyProxy = connection.providerSpecificData?.connectionProxyEnabled === true && !!connection.providerSpecificData?.connectionProxyUrl;
-  const hasAnyProxy = !!boundProxyPoolId || hasLegacyProxy;
+  const hasAnyProxy = selectedProxyIds.length > 0 || hasLegacyProxy;
-  const proxyDisplayText = boundProxyPool
+  
-    ? `Pool: ${boundProxyPool.name}`
+  const getProxyDisplayText = () => {
-    : boundProxyPoolId
+    if (selectedProxyIds.length === 0 && !hasLegacyProxy) return "";
-      ? `Pool: ${boundProxyPoolId} (inactive/missing)`
+    
-      : hasLegacyProxy
+    if (selectedProxyIds.length === 1) {
-        ? `Legacy: ${connection.providerSpecificData?.connectionProxyUrl}`
+      const pool = proxyPoolMap.get(selectedProxyIds[0]);
-        : "";
+      return pool ? `Pool: ${pool.name}` : `Pool: ${selectedProxyIds[0]} (inactive/missing)`;
+    }
+    
+    if (selectedProxyIds.length > 1) {
+      const strategyLabel = rotationStrategy === "random" ? "Random" : rotationStrategy === "round-robin" ? "Round Robin" : rotationStrategy === "failover" ? "Failover" : rotationStrategy === "smart" ? "Smart" : "Multiple";
+      return `${selectedProxyIds.length} pools (${strategyLabel})`;
+    }
+    
+    if (hasLegacyProxy) {
+      return `Legacy: ${connection.providerSpecificData?.connectionProxyUrl}`;
+    }
+    
+    return "";
+  };
+  
+  const proxyDisplayText = getProxyDisplayText();
   const autoPingTooltip = autoPing?.provider === "codex"
     ? "Auto-starts the next 5h Codex window after reset by sending a tiny gpt-5.5 request. Consumes a small amount of quota."
     : "When your 5h quota runs out, auto-sends a request the moment it resets so a new window starts right away.";
 
   let maskedProxyUrl = "";
-  if (boundProxyPool?.proxyUrl || connection.providerSpecificData?.connectionProxyUrl) {
+  if (selectedProxyIds.length > 0) {
-    const rawProxyUrl = boundProxyPool?.proxyUrl || connection.providerSpecificData?.connectionProxyUrl;
+    const selectedPools = selectedProxyIds.map(id => proxyPoolMap.get(id)).filter(Boolean);
+    if (selectedPools.length > 0) {
+      try {
+        const parsed = new URL(selectedPools[0].proxyUrl);
+        maskedProxyUrl = `${parsed.protocol}//${parsed.hostname}${parsed.port ? `:${parsed.port}` : ""}`;
+        if (selectedPools.length > 1) {
+          maskedProxyUrl += ` (+${selectedPools.length - 1} more)`;
+        }
+      } catch {
+        maskedProxyUrl = selectedPools[0].proxyUrl;
+      }
+    }
+  } else if (connection.providerSpecificData?.connectionProxyUrl) {
+    const rawProxyUrl = connection.providerSpecificData?.connectionProxyUrl;
     try {
       const parsed = new URL(rawProxyUrl);
       maskedProxyUrl = `${parsed.protocol}//${parsed.hostname}${parsed.port ? `:${parsed.port}` : ""}`;
@@ -38,12 +84,15 @@ export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst
     }
   }
 
-  const noProxyText = boundProxyPool?.noProxy || connection.providerSpecificData?.connectionNoProxy || "";
+  const noProxyText = selectedProxyIds.length > 0 
+    ? proxyPoolMap.get(selectedProxyIds[0])?.noProxy || ""
+    : connection.providerSpecificData?.connectionNoProxy || "";
 
   let proxyBadgeVariant = "default";
-  if (boundProxyPool?.isActive === true) {
+  if (selectedProxyIds.length > 0) {
-    proxyBadgeVariant = "success";
+    const allActive = selectedProxyIds.every(id => proxyPoolMap.get(id)?.isActive === true);
-  } else if (boundProxyPoolId || hasLegacyProxy) {
+    proxyBadgeVariant = allActive ? "success" : "error";
+  } else if (hasLegacyProxy) {
     proxyBadgeVariant = "error";
   }
 
@@ -59,10 +108,54 @@ export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst
     return () => document.removeEventListener("mousedown", handler);
   }, [showProxyDropdown]);
 
-  const handleSelectProxy = async (poolId) => {
+  const handleToggleProxySelection = (poolId) => {
+    setSelectedProxyIds(prev => {
+      if (prev.includes(poolId)) {
+        return prev.filter(id => id !== poolId);
+      } else {
+        return [...prev, poolId];
+      }
+    });
+  };
+
+  const handleStrategyChange = (strategy) => {
+    setRotationStrategy(strategy);
+    
+    // Auto-select all active proxy pools when switching to rotation strategies
+    if (strategy !== "none" && selectedProxyIds.length === 0) {
+      const activePoolIds = (proxyPools || [])
+        .filter(pool => pool.isActive === true)
+        .map(pool => pool.id);
+      setSelectedProxyIds(activePoolIds);
+    }
+    
+    // Reset to single proxy when switching to "none"
+    if (strategy === "none" && selectedProxyIds.length > 1) {
+      setSelectedProxyIds(selectedProxyIds.slice(0, 1));
+    }
+  };
+
+  const handleApplyProxyChanges = async () => {
     setUpdatingProxy(true);
     try {
-      await onUpdateProxy(poolId === "__none__" ? null : poolId);
+      await onUpdateProxy({
+        proxyPoolIds: selectedProxyIds,
+        proxyRotationStrategy: rotationStrategy,
+      });
+      setShowProxyDropdown(false);
+    } finally {
+      setUpdatingProxy(false);
+    }
+  };
+
+  const handleSelectProxy = async (poolId) => {
+    // Legacy single-proxy mode (backwards compatibility)
+    setUpdatingProxy(true);
+    try {
+      await onUpdateProxy({
+        proxyPoolIds: poolId === "__none__" ? [] : [poolId],
+        proxyRotationStrategy: "none",
+      });
     } finally {
       setUpdatingProxy(false);
       setShowProxyDropdown(false);
@@ -109,7 +202,7 @@ export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst
     return () => {
       if (interval) clearInterval(interval);
     };
-  }, [modelLockUntil]);
+  }, [connection, modelLockUntil]);
 
   // Determine effective status (override unavailable if cooldown expired)
   const effectiveStatus = (connection.testStatus === "unavailable" && !isCooldown)
@@ -191,6 +284,20 @@ export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst
               </Badge>
             )}
           </div>
+           {modelAssignmentOptions && onModelAssignmentChange && (
+             <select
+               value={connection.providerSpecificData?.assignedModel || connection.providerSpecificData?.freebuffModel || ""}
+              onChange={(e) => onModelAssignmentChange(e.target.value)}
+              disabled={!strictModelAssignment}
+               className="mt-2 max-w-full rounded-md border border-border bg-background px-2 py-1 text-[11px] text-text-main"
+               title="Model assignment"
+             >
+               <option value="">Unassigned</option>
+               {modelAssignmentOptions.map((model) => (
+                <option key={model.id} value={model.id}>{model.name || model.id}</option>
+              ))}
+            </select>
+          )}
           {hasAnyProxy && (
             <div className="mt-1 flex items-center gap-2 flex-wrap">
               <span className="max-w-full truncate text-[11px] text-text-muted sm:max-w-[420px]" title={proxyDisplayText}>
@@ -226,22 +333,119 @@ export default function ConnectionRow({ connection, proxyPools, isOAuth, isFirst
                 <span className="text-[10px] leading-tight">Proxy</span>
               </button>
               {showProxyDropdown && (
-                <div className="absolute right-0 top-full z-50 mt-1 max-w-[78vw] min-w-[160px] rounded-lg border border-border bg-bg py-1 shadow-lg">
+                <div className="absolute left-0 top-full z-50 mt-1 max-w-[calc(100vw-2rem)] min-w-[280px] rounded-lg border border-border bg-bg shadow-lg sm:left-auto sm:right-0">
-                  <button
+                  {/* Rotation Strategy Selector */}
-                    onClick={() => handleSelectProxy("__none__")}
+                  <div className="border-b border-border p-3">
-                    className={`w-full text-left px-3 py-1.5 text-sm hover:bg-black/5 dark:hover:bg-white/5 ${!boundProxyPoolId ? "text-primary font-medium" : "text-text-main"}`}
+                    <label className="block text-xs font-medium text-text-muted mb-2">Rotation Strategy</label>
-                  >
+                    <select
-                    None
+                      value={rotationStrategy}
-                  </button>
+                      onChange={(e) => handleStrategyChange(e.target.value)}
-                  {(proxyPools || []).map((pool) => (
+                      className="w-full rounded border border-border bg-bg px-2 py-1.5 text-sm text-text-main focus:border-primary focus:outline-none"
-                    <button
-                      key={pool.id}
-                      onClick={() => handleSelectProxy(pool.id)}
-                      className={`w-full text-left px-3 py-1.5 text-sm hover:bg-black/5 dark:hover:bg-white/5 ${boundProxyPoolId === pool.id ? "text-primary font-medium" : "text-text-main"}`}
                     >
-                      {pool.name}
+                      <option value="none">None (Single Proxy)</option>
+                      <option value="random">Random</option>
+                      <option value="round-robin">Round Robin</option>
+                      <option value="failover">Failover</option>
+                      <option value="smart">Smart</option>
+                    </select>
+                    {rotationStrategy !== "none" && (
+                      <p className="mt-1 text-[10px] text-text-muted">
+                        {rotationStrategy === "random" && "Randomly select proxy on each request"}
+                        {rotationStrategy === "round-robin" && "Rotate proxies in order across requests"}
+                        {rotationStrategy === "failover" && "Try next proxy on failure"}
+                        {rotationStrategy === "smart" && "Skip pools whose egress IP is blocked for this provider/model (e.g. Freebuff limited-IP). See Proxy Fitness to clear/block."}
+                      </p>
+                    )}
+                  </div>
+
+                  {/* Proxy Pool Selection */}
+                  <div className="max-h-[200px] overflow-y-auto py-1">
+                    <button
+                      onClick={() => {
+                        setSelectedProxyIds([]);
+                        setRotationStrategy("none");
+                      }}
+                      className={`w-full text-left px-3 py-2 text-sm hover:bg-black/5 dark:hover:bg-white/5 ${selectedProxyIds.length === 0 ? "text-primary font-medium" : "text-text-main"}`}
+                    >
+                      <div className="flex items-center gap-2">
+                        <span className="material-symbols-outlined text-[16px]">
+                          {selectedProxyIds.length === 0 ? "check_box" : "check_box_outline_blank"}
+                        </span>
+                        <span>None</span>
+                      </div>
                     </button>
-                  ))}
+                    
+                    {/* Select All Button (only for rotation strategies) */}
+                    {rotationStrategy !== "none" && (
+                      <button
+                        onClick={() => {
+                          const activePoolIds = (proxyPools || [])
+                            .filter(pool => pool.isActive === true)
+                            .map(pool => pool.id);
+                          const allSelected = activePoolIds.length > 0 && activePoolIds.every(id => selectedProxyIds.includes(id));
+                          
+                          if (allSelected) {
+                            setSelectedProxyIds([]);
+                          } else {
+                            setSelectedProxyIds(activePoolIds);
+                          }
+                        }}
+                        className={`w-full text-left px-3 py-2 text-sm border-b border-border hover:bg-black/5 dark:hover:bg-white/5 ${selectedProxyIds.length === (proxyPools || []).filter(p => p.isActive).length ? "bg-black/5 dark:bg-white/5" : ""}`}
+                      >
+                        <div className="flex items-center gap-2">
+                          <span className="material-symbols-outlined text-[16px]">
+                            {selectedProxyIds.length === (proxyPools || []).filter(p => p.isActive).length && selectedProxyIds.length > 0
+                              ? "check_box"
+                              : "check_box_outline_blank"
+                            }
+                          </span>
+                          <span className="font-medium">Select All Active</span>
+                        </div>
+                      </button>
+                    )}
+                    
+                    {(proxyPools || []).map((pool) => {
+                      const isSelected = selectedProxyIds.includes(pool.id);
+                      const isActive = pool.isActive === true;
+                      return (
+                        <button
+                          key={pool.id}
+                          onClick={() => {
+                            if (rotationStrategy === "none") {
+                              setSelectedProxyIds([pool.id]);
+                            } else {
+                              handleToggleProxySelection(pool.id);
+                            }
+                          }}
+                          className={`w-full text-left px-3 py-2 text-sm hover:bg-black/5 dark:hover:bg-white/5 ${isSelected ? "bg-black/5 dark:bg-white/5" : ""}`}
+                        >
+                          <div className="flex items-center gap-2">
+                            <span className="material-symbols-outlined text-[16px]">
+                              {rotationStrategy === "none" 
+                                ? (isSelected ? "radio_button_checked" : "radio_button_unchecked")
+                                : (isSelected ? "check_box" : "check_box_outline_blank")
+                              }
+                            </span>
+                            <span className={isSelected ? "text-primary font-medium" : "text-text-main"}>{pool.name}</span>
+                            {!isActive && (
+                              <span className="ml-auto text-[10px] text-red-500">(inactive)</span>
+                            )}
+                          </div>
+                        </button>
+                      );
+                    })}
+                  </div>
+
+                  {/* Apply Button */}
+                  <div className="border-t border-border p-2">
+                    <button
+                      onClick={handleApplyProxyChanges}
+                      disabled={updatingProxy}
+                      className="w-full rounded bg-primary px-3 py-2 text-sm font-medium text-white hover:bg-primary/90 disabled:opacity-50 disabled:cursor-not-allowed"
+                    >
+                      {updatingProxy ? "Applying..." : "Apply"}
+                    </button>
+                  </div>
                 </div>
               )}
             </div>
@@ -306,6 +510,9 @@ ConnectionRow.propTypes = {
   onUpdateProxy: PropTypes.func,
   onEdit: PropTypes.func.isRequired,
   onDelete: PropTypes.func.isRequired,
+  modelAssignmentOptions: PropTypes.arrayOf(PropTypes.shape({ id: PropTypes.string.isRequired, name: PropTypes.string })),
+  onModelAssignmentChange: PropTypes.func,
+  strictModelAssignment: PropTypes.bool,
   oneByOneStatus: PropTypes.shape({
     state: PropTypes.string,
     error: PropTypes.string,

src/app/(dashboard)/dashboard/providers/[id]/page.js

@@ -67,6 +67,7 @@ export default function ProviderDetailPage() {
   const [bulkUpdatingProxy, setBulkUpdatingProxy] = useState(false);
   const [providerStrategy, setProviderStrategy] = useState(null);
   const [providerStickyLimit, setProviderStickyLimit] = useState("");
+  const [strictModelAssignment, setStrictModelAssignment] = useState(false);
   const [thinkingMode, setThinkingMode] = useState("auto");
   const [autoPing, setAutoPing] = useState({ enabled: false, connections: {} });
   const [suggestedModels, setSuggestedModels] = useState([]);
@@ -181,6 +182,21 @@ export default function ProviderDetailPage() {
     return levels && levels.includes(thinkingMode) ? thinkingMode : null;
   };
   const providerStorageAlias = isCompatible ? providerId : providerAlias;
+  const assignmentModels = (() => {
+    const byId = new Map();
+    const add = (model) => {
+      if (model?.id && !byId.has(model.id)) byId.set(model.id, model);
+    };
+    models.forEach(add);
+    kiloFreeModels.forEach(add);
+    customModels.forEach((model) => {
+      if (model.providerAlias === providerStorageAlias && (model.kind || model.type || "llm") === "llm") {
+        add(model);
+      }
+    });
+    const disabled = new Set(disabledModelIds);
+    return [...byId.values()].filter((model) => !disabled.has(model.id));
+  })();
   // Union of levels across this provider's reasoning models — drives the level picker options.
   // Include custom models too (e.g. manually added gpt-5.6-sol → max).
   const providerThinkingLevels = (() => {
@@ -324,6 +340,7 @@ export default function ProviderDetailPage() {
       const override = (settingsData.providerStrategies || {})[providerId] || {};
       setProviderStrategy(override.fallbackStrategy || null);
       setProviderStickyLimit(override.stickyRoundRobinLimit != null ? String(override.stickyRoundRobinLimit) : "1");
+      setStrictModelAssignment(override.strictModelAssignment === true);
       // Load per-provider thinking config
       const thinkingCfg = (settingsData.providerThinking || {})[providerId] || {};
       setThinkingMode(thinkingCfg.mode || "auto");
@@ -379,9 +396,13 @@ export default function ProviderDetailPage() {
       const settingsData = settingsRes.ok ? await settingsRes.json() : {};
       const current = settingsData.providerStrategies || {};
 
-      // Build override: null strategy means remove override, use global
+      // Preserve Freebuff-only settings while changing the shared strategy.
-      const override = {};
+      const override = { ...(current[providerId] || {}) };
       if (strategy) override.fallbackStrategy = strategy;
+      else {
+        delete override.fallbackStrategy;
+        delete override.stickyRoundRobinLimit;
+      }
       if (strategy === "round-robin" && stickyLimit !== "") {
         override.stickyRoundRobinLimit = Number(stickyLimit) || 3;
       }
@@ -403,6 +424,44 @@ export default function ProviderDetailPage() {
     }
   };
 
+  const handleStrictAssignmentToggle = async (enabled) => {
+    setStrictModelAssignment(enabled);
+    try {
+      const settingsRes = await fetch("/api/settings", { cache: "no-store" });
+      const settingsData = settingsRes.ok ? await settingsRes.json() : {};
+      const current = settingsData.providerStrategies || {};
+      await fetch("/api/settings", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          providerStrategies: {
+            ...current,
+            [providerId]: { ...(current[providerId] || {}), strictModelAssignment: enabled },
+          },
+        }),
+      });
+    } catch (error) {
+      console.log("Error saving Freebuff strict assignment:", error);
+    }
+  };
+
+  const handleModelAssignment = async (connectionId, assignedModel) => {
+    try {
+      const res = await fetch(`/api/providers/${connectionId}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ providerSpecificData: { assignedModel: assignedModel || null } }),
+      });
+      if (res.ok) {
+        setConnections((prev) => prev.map((c) => c.id === connectionId
+          ? { ...c, providerSpecificData: { ...(c.providerSpecificData || {}), assignedModel: assignedModel || null } }
+          : c));
+      }
+    } catch (error) {
+      console.log("Error saving Freebuff model assignment:", error);
+    }
+  };
+
   const handleRoundRobinToggle = (enabled) => {
     const strategy = enabled ? "round-robin" : null;
     const sticky = enabled ? (providerStickyLimit || "1") : providerStickyLimit;
@@ -463,10 +522,12 @@ export default function ProviderDetailPage() {
   };
 
   useEffect(() => {
-    fetchConnections();
+    Promise.resolve().then(() => {
-    fetchAliases();
+      fetchConnections();
-    fetchCustomModels();
+      fetchAliases();
-    fetchDisabledModels();
+      fetchCustomModels();
+      fetchDisabledModels();
+    });
   }, [fetchConnections, fetchAliases, fetchCustomModels, fetchDisabledModels]);
 
   // Live per-connection catalogs (cursor, zed): the static registry carries
@@ -476,13 +537,13 @@ export default function ProviderDetailPage() {
   useEffect(() => {
     const isLiveCatalog = providerId === "cursor" || providerId === "zed";
     if (!isLiveCatalog) {
-      setLiveModels([]);
+      queueMicrotask(() => setLiveModels([]));
       return;
     }
 
     const connection = connections.find((item) => item.isActive !== false);
     if (!connection?.id) {
-      setLiveModels([]);
+      queueMicrotask(() => setLiveModels([]));
       if (providerId === "zed") setLiveModelsError(null);
       return;
     }
@@ -942,7 +1003,9 @@ export default function ProviderDetailPage() {
   };
 
   useEffect(() => {
-    setSelectedConnectionIds((prev) => prev.filter((id) => connections.some((conn) => conn.id === id)));
+    queueMicrotask(() => {
+      setSelectedConnectionIds((prev) => prev.filter((id) => connections.some((conn) => conn.id === id)));
+    });
   }, [connections]);
 
   const selectedProxySummary = (() => {
@@ -1043,17 +1106,39 @@ export default function ProviderDetailPage() {
                   onToggle: (on) => handleAutoPingConnection(conn.id, on),
                   provider: providerId,
                 } : null}
-                onUpdateProxy={async (proxyPoolId) => {
+                onUpdateProxy={async (proxyConfig) => {
                   try {
+                    // Support both new format (object) and legacy format (string/null)
+                    const updatePayload = typeof proxyConfig === 'object' && proxyConfig !== null
+                      ? {
+                          proxyPoolIds: proxyConfig.proxyPoolIds || [],
+                          proxyRotationStrategy: proxyConfig.proxyRotationStrategy || "none",
+                        }
+                      : {
+                          // Legacy single-proxy format
+                          proxyPoolId: proxyConfig || null,
+                        };
+
                     const res = await fetch(`/api/providers/${conn.id}`, {
                       method: "PUT",
                       headers: { "Content-Type": "application/json" },
-                      body: JSON.stringify({ proxyPoolId: proxyPoolId || null }),
+                      body: JSON.stringify(updatePayload),
                     });
                     if (res.ok) {
                       setConnections(prev => prev.map(c =>
                         c.id === conn.id
-                          ? { ...c, providerSpecificData: { ...c.providerSpecificData, proxyPoolId: proxyPoolId || null } }
+                          ? { 
+                              ...c, 
+                              providerSpecificData: { 
+                                ...c.providerSpecificData, 
+                                ...(updatePayload.proxyPoolIds !== undefined ? {
+                                  proxyPoolIds: updatePayload.proxyPoolIds,
+                                  proxyRotationStrategy: updatePayload.proxyRotationStrategy,
+                                } : {
+                                  proxyPoolId: updatePayload.proxyPoolId,
+                                })
+                              } 
+                            }
                           : c
                       ));
                     }
@@ -1067,6 +1152,9 @@ export default function ProviderDetailPage() {
                 }}
                 onDelete={() => handleDelete(conn.id)}
                 oneByOneStatus={oneByOneResults[conn.id] || null}
+                modelAssignmentOptions={assignmentModels}
+                onModelAssignmentChange={(model) => handleModelAssignment(conn.id, model)}
+                strictModelAssignment={strictModelAssignment}
               />
             </div>
           </div>
@@ -1578,6 +1666,13 @@ export default function ProviderDetailPage() {
                   </div>
                 )}
               </div>
+              <div className="flex flex-wrap items-center gap-2 border-t border-black/[0.03] pt-2 dark:border-white/[0.03]">
+                <div>
+                  <span className="text-xs text-text-muted font-medium">Strict Model Assignment</span>
+                  <p className="text-[10px] text-text-muted">Only assigned accounts can serve each model for this provider.</p>
+                </div>
+                <Toggle checked={strictModelAssignment} onChange={handleStrictAssignmentToggle} />
+              </div>
             </div>
           </div>
 

src/app/(dashboard)/dashboard/proxy-fitness/page.js

@@ -0,0 +1,424 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Badge, Button, Card, CardSkeleton, Input, ConfirmModal, Toggle } from "@/shared/components";
+import ProviderIcon from "@/shared/components/ProviderIcon";
+import { useNotificationStore } from "@/store/notificationStore";
+
+function fmtTime(value) {
+  if (!value) return "-";
+  const d = new Date(value);
+  return Number.isNaN(d.getTime()) ? "-" : d.toLocaleTimeString();
+}
+
+// "freebuff::openai/gpt-5.6-luna" -> { provider: "freebuff", model: "openai/gpt-5.6-luna" }
+// "freebuff::*" -> { provider: "freebuff", model: null }
+function parseScope(scope) {
+  const sep = String(scope || "").indexOf("::");
+  if (sep < 0) return { provider: String(scope || ""), model: null };
+  const provider = scope.slice(0, sep);
+  const model = scope.slice(sep + 2);
+  return { provider, model: model === "*" || model === "" ? null : model };
+}
+
+function maskProxyUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const host = parsed.hostname || "";
+    const port = parsed.port ? `:${parsed.port}` : "";
+    return `${parsed.protocol}//${host}${port}`;
+  } catch {
+    return String(url || "");
+  }
+}
+
+// Flatten fitness snapshot into one record per (pool, scope); drops expired marks.
+function buildRecords(fitness, pools, now = Date.now()) {
+  const poolById = new Map((pools || []).map((p) => [p.id, p]));
+  const records = [];
+  for (const [poolId, byScope] of Object.entries(fitness || {})) {
+    const pool = poolById.get(poolId);
+    for (const [scope, info] of Object.entries(byScope || {})) {
+      const until = info?.until ? new Date(info.until).getTime() : 0;
+      if (!until || until <= now) continue;
+      const { provider, model } = parseScope(scope);
+      records.push({
+        poolId,
+        scope,
+        provider,
+        model,
+        until,
+        reason: info?.reason || "blocked",
+        poolName: pool?.name || poolId.slice(0, 8),
+        proxyUrl: pool?.proxyUrl || "",
+        egress: pool?.egress || null,
+      });
+    }
+  }
+  return records;
+}
+
+export default function ProxyFitnessPage() {
+  const [pools, setPools] = useState([]);
+  const [fitness, setFitness] = useState({});
+  const [loading, setLoading] = useState(true);
+  const [providerFilter, setProviderFilter] = useState("all");
+  const [search, setSearch] = useState("");
+  const [providerMenuOpen, setProviderMenuOpen] = useState(false);
+  const [providerMenuDropUp, setProviderMenuDropUp] = useState(false);
+  const [clearingScope, setClearingScope] = useState(null); // poolId::scope while clearing
+  const [confirmClearAll, setConfirmClearAll] = useState(false);
+  const [clearingAll, setClearingAll] = useState(false);
+  const [geoEnabled, setGeoEnabled] = useState(true);
+  const [geoUpdating, setGeoUpdating] = useState(false);
+  const providerMenuRef = useRef(null);
+  const notify = useNotificationStore();
+
+  useEffect(() => {
+    const handleClickOutside = (e) => {
+      if (providerMenuRef.current && !providerMenuRef.current.contains(e.target)) {
+        setProviderMenuOpen(false);
+      }
+    };
+    if (providerMenuOpen) {
+      document.addEventListener("mousedown", handleClickOutside);
+    }
+    return () => document.removeEventListener("mousedown", handleClickOutside);
+  }, [providerMenuOpen]);
+
+  const fetchAll = useCallback(async () => {
+    try {
+      const [poolRes, fitRes] = await Promise.all([
+        fetch("/api/proxy-pools?includeUsage=true", { cache: "no-store" }),
+        fetch("/api/proxy-pools/fitness", { cache: "no-store" }),
+      ]);
+      const poolData = await poolRes.json().catch(() => ({ proxyPools: [] }));
+      setPools(poolData.proxyPools || []);
+      if (fitRes.ok) {
+        const fitData = await fitRes.json().catch(() => ({}));
+        setFitness(fitData.pools || fitData.fitness || {});
+      } else {
+        setFitness({});
+      }
+    } catch (error) {
+      console.log("Error fetching proxy fitness:", error);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    fetchAll();
+  }, [fetchAll]);
+
+  useEffect(() => {
+    fetch("/api/settings", { cache: "no-store" })
+      .then((r) => (r.ok ? r.json() : {}))
+      .then((s) => {
+        if (typeof s.poolGeoProbeEnabled === "boolean") setGeoEnabled(s.poolGeoProbeEnabled);
+      })
+      .catch(() => {});
+  }, []);
+
+  const handleGeoToggle = async (next) => {
+    setGeoUpdating(true);
+    setGeoEnabled(next);
+    try {
+      const res = await fetch("/api/settings", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ poolGeoProbeEnabled: next }),
+      });
+      if (!res.ok) {
+        setGeoEnabled(!next);
+        throw new Error(`HTTP ${res.status}`);
+      }
+      notify.success(next ? "Geo probe enabled" : "Geo probe disabled");
+    } catch (err) {
+      notify.error(`Update failed: ${err.message}`);
+    } finally {
+      setGeoUpdating(false);
+    }
+  };
+
+  const records = useMemo(() => buildRecords(fitness, pools), [fitness, pools]);
+
+  // Providers present in the fitness data (filter options)
+  const providerOptions = useMemo(() => {
+    const set = new Set();
+    for (const rec of records) {
+      if (rec.provider) set.add(rec.provider);
+    }
+    return Array.from(set).sort();
+  }, [records]);
+
+  const filteredRecords = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    return records.filter((rec) => {
+      if (providerFilter !== "all" && rec.provider !== providerFilter) return false;
+      if (q) {
+        const hay = [rec.proxyUrl, rec.egress?.ip, rec.egress?.country, rec.egress?.region, rec.poolName]
+          .filter(Boolean)
+          .join(" ")
+          .toLowerCase();
+        if (!hay.includes(q)) return false;
+      }
+      return true;
+    });
+  }, [records, providerFilter, search]);
+
+  const handleClear = async (rec) => {
+    setClearingScope(rec.scope);
+    try {
+      const res = await fetch(`/api/proxy-pools/${rec.poolId}/fitness/clear`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ scope: rec.scope }),
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      notify.success(`Cleared ${rec.scope}`);
+      fetchAll();
+    } catch (err) {
+      notify.error(`Clear failed: ${err.message}`);
+    } finally {
+      setClearingScope(null);
+    }
+  };
+
+  const handleClearAll = async () => {
+    setClearingAll(true);
+    try {
+      const res = await fetch("/api/proxy-pools/fitness/clear-all", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(providerFilter !== "all" ? { provider: providerFilter } : {}),
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      notify.success(providerFilter !== "all" ? `Cleared all ${providerFilter} blocks` : "Cleared all blocks");
+      setConfirmClearAll(false);
+      fetchAll();
+    } catch (err) {
+      notify.error(`Clear all failed: ${err.message}`);
+    } finally {
+      setClearingAll(false);
+    }
+  };
+
+  const selectedProviderLabel = providerFilter === "all" ? "All providers" : providerFilter;
+
+  // Open the provider menu as an overlay anchored to its container. Flips to
+  // drop-up when there isn't enough viewport space below (menu max-h ~288px).
+  const toggleProviderMenu = () => {
+    if (providerMenuOpen) {
+      setProviderMenuOpen(false);
+      return;
+    }
+    const el = providerMenuRef.current;
+    if (el) {
+      const rect = el.getBoundingClientRect();
+      setProviderMenuDropUp(window.innerHeight - rect.bottom < 300);
+    }
+    setProviderMenuOpen(true);
+  };
+
+  return (
+    <div className="mx-auto w-full max-w-5xl space-y-4 p-4 sm:p-6">
+      {loading ? (
+        <CardSkeleton />
+      ) : (
+        <>
+          {/* Header */}
+          <div className="flex flex-wrap items-center justify-between gap-3">
+            <div className="flex items-center gap-2">
+              <h1 className="text-lg font-semibold text-text-main">Proxy Fitness</h1>
+              <Badge variant={records.length > 0 ? "error" : "default"} size="sm">
+                {records.length} active block{records.length === 1 ? "" : "s"}
+              </Badge>
+            </div>
+            <div className="flex items-center gap-2">
+              {records.length > 0 && (
+                <Button
+                  variant="danger"
+                  size="sm"
+                  icon="delete_sweep"
+                  onClick={() => setConfirmClearAll(true)}
+                  disabled={clearingAll}
+                >
+                  Clear All{providerFilter !== "all" ? ` (${providerFilter})` : ""}
+                </Button>
+              )}
+              <Toggle
+                size="sm"
+                checked={geoEnabled}
+                onChange={handleGeoToggle}
+                disabled={geoUpdating}
+                label="Geo probe"
+                description="Probe egress IP/country per pool every ~30 min (uses geo-API quota)"
+              />
+              <Button variant="secondary" size="sm" icon="refresh" onClick={fetchAll}>Refresh</Button>
+            </div>
+          </div>
+
+          <p className="text-sm text-text-muted">
+            Shows which provider is blocked on which proxy IP (from provider region gates, per-IP
+            limits, or manual marks). Smart rotation skips these pools while the block is active.
+          </p>
+
+          {/* Filters */}
+          <div className="flex flex-wrap items-end gap-3 rounded-lg border border-border-subtle bg-surface p-3">
+            <div className="relative flex w-64 max-w-full flex-col" ref={providerMenuRef}>
+              <label className="mb-1 text-xs font-medium text-text-muted">Provider</label>
+              <button
+                type="button"
+                onClick={toggleProviderMenu}
+                className="flex h-8 w-full items-center justify-between gap-1 rounded-lg border border-black/10 bg-black/[0.02] px-2 text-xs text-text-main transition-colors hover:bg-black/5 dark:border-white/10 dark:bg-white/[0.03] dark:hover:bg-white/10"
+                aria-haspopup="menu"
+                aria-expanded={providerMenuOpen}
+                title="Filter by provider"
+              >
+                <span className="flex min-w-0 items-center gap-1.5">
+                  {providerFilter === "all" ? (
+                    <span className="material-symbols-outlined text-[14px] text-text-muted">apps</span>
+                  ) : (
+                    <ProviderIcon providerId={providerFilter} size={18} className="size-[18px] rounded object-contain" fallbackText={providerFilter.slice(0, 2).toUpperCase()} />
+                  )}
+                  <span className="truncate capitalize">{selectedProviderLabel}</span>
+                </span>
+                <span className="material-symbols-outlined text-[14px] text-text-muted">expand_more</span>
+              </button>
+
+              {providerMenuOpen && (
+                <div className={`absolute left-0 z-20 w-full max-h-72 overflow-y-auto rounded-lg border border-border-subtle bg-surface p-1 shadow-lg ${providerMenuDropUp ? "bottom-full mb-1" : "top-full mt-1"}`}>
+                  <button
+                    type="button"
+                    onClick={() => { setProviderFilter("all"); setProviderMenuOpen(false); }}
+                    className={`flex w-full items-center gap-3 rounded-xl px-3 py-2.5 text-left text-sm transition-colors ${providerFilter === "all" ? "bg-primary/10 text-primary" : "text-text-main hover:bg-black/5 dark:hover:bg-white/10"}`}
+                  >
+                    <span className="material-symbols-outlined text-[22px]">apps</span>
+                    <span className="font-medium">All providers</span>
+                    {providerFilter === "all" && <span className="material-symbols-outlined ml-auto text-[20px]">check</span>}
+                  </button>
+                  <div className="my-1 h-px bg-black/10 dark:bg-white/10" />
+                  {providerOptions.map((provider) => (
+                    <button
+                      key={provider}
+                      type="button"
+                      onClick={() => { setProviderFilter(provider); setProviderMenuOpen(false); }}
+                      className={`flex w-full items-center gap-3 rounded-xl px-3 py-2.5 text-left text-sm transition-colors ${providerFilter === provider ? "bg-primary/10 text-primary" : "text-text-main hover:bg-black/5 dark:hover:bg-white/10"}`}
+                    >
+                      <ProviderIcon providerId={provider} size={24} className="size-6 rounded-md object-contain" fallbackText={provider.slice(0, 2).toUpperCase()} />
+                      <span className="font-medium capitalize">{provider}</span>
+                      {providerFilter === provider && <span className="material-symbols-outlined ml-auto text-[20px]">check</span>}
+                    </button>
+                  ))}
+                </div>
+              )}
+            </div>
+
+            <div className="flex min-w-48 flex-1 flex-col">
+              <label className="mb-1 text-xs font-medium text-text-muted">IP / Proxy / Pool</label>
+              <Input
+                value={search}
+                onChange={(e) => setSearch(e.target.value)}
+                placeholder="e.g. 104.28, vercel-relay…"
+                icon="search"
+              />
+            </div>
+          </div>
+
+          {/* Records table */}
+          <Card className="p-0">
+            <div className="overflow-x-auto">
+              <table className="w-full min-w-[700px] border-collapse text-sm">
+                <thead>
+                  <tr className="border-b border-border-subtle text-left text-xs uppercase tracking-wider text-text-muted">
+                    <th className="px-4 py-2 font-semibold">Provider</th>
+                    <th className="px-4 py-2 font-semibold">Model</th>
+                    <th className="px-4 py-2 font-semibold">IP / Proxy</th>
+                    <th className="px-4 py-2 font-semibold">Pool</th>
+                    <th className="px-4 py-2 font-semibold">Reason</th>
+                    <th className="px-4 py-2 font-semibold">Until</th>
+                    <th className="px-4 py-2 text-right font-semibold">Actions</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {filteredRecords.length === 0 ? (
+                    <tr>
+                      <td colSpan={7} className="px-4 py-10 text-center text-text-muted">
+                        {records.length === 0
+                          ? "No active blocks. Blocks appear here when a provider region-gates a proxy IP."
+                          : "No blocks match the current filters."}
+                      </td>
+                    </tr>
+                  ) : (
+                    filteredRecords.map((rec) => (
+                      <tr key={`${rec.poolId}::${rec.scope}`} className="border-b border-border-subtle last:border-0 align-top hover:bg-surface-2/40">
+                        <td className="px-4 py-3">
+                          <span className="inline-flex items-center gap-2 rounded bg-red-500/10 px-2 py-0.5 text-xs font-medium text-red-600 dark:text-red-400">
+                            <span className="material-symbols-outlined text-[14px]">block</span>
+                            <span className="capitalize">{rec.provider}</span>
+                          </span>
+                        </td>
+                        <td className="max-w-56 px-4 py-3">
+                          <span className="truncate text-text-main">{rec.model || <em className="text-text-muted">all models</em>}</span>
+                        </td>
+                        <td className="px-4 py-3">
+                          <div className="flex min-w-0 flex-col gap-0.5">
+                            <code className="truncate font-mono text-xs text-text-main">{maskProxyUrl(rec.proxyUrl)}</code>
+                            {rec.egress?.ip && (
+                              <span className="flex items-center gap-1 text-[11px] text-text-muted">
+                                <span className="truncate">egress {rec.egress.ip}{rec.egress.country ? ` · ${rec.egress.country}` : ""}</span>
+                                {rec.egress.isUnstable && (
+                                  <span
+                                    className="inline-flex shrink-0 items-center gap-0.5 rounded bg-amber-500/15 px-1 py-0.5 text-[10px] font-medium text-amber-600 dark:text-amber-400"
+                                    title={rec.egress.ipCount >= 2 ? `Egress IP changed ${rec.egress.ipCount}× — relay egress is not stable` : "Egress is unstable"}
+                                  >
+                                    unstable
+                                  </span>
+                                )}
+                              </span>
+                            )}
+                          </div>
+                        </td>
+                        <td className="px-4 py-3 text-text-muted">{rec.poolName}</td>
+                        <td className="px-4 py-3 text-text-muted">{rec.reason}</td>
+                        <td className="px-4 py-3 text-text-muted">{fmtTime(rec.until)}</td>
+                        <td className="px-4 py-3">
+                          <div className="flex justify-end">
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              icon="close"
+                              onClick={() => handleClear(rec)}
+                              disabled={clearingScope === rec.scope}
+                              title="Clear this block"
+                            >
+                              {clearingScope === rec.scope ? "Clearing..." : "Clear"}
+                            </Button>
+                          </div>
+                        </td>
+                      </tr>
+                    ))
+                  )}
+                </tbody>
+              </table>
+            </div>
+          </Card>
+        </>
+      )}
+
+      <ConfirmModal
+        isOpen={confirmClearAll}
+        onClose={() => setConfirmClearAll(false)}
+        onConfirm={handleClearAll}
+        title="Clear all blocks"
+        message={providerFilter !== "all"
+          ? `Clear all active blocks for provider "${providerFilter}"? This lets those pools be selected again immediately.`
+          : "Clear all active proxy blocks? This lets all pools be selected again immediately."}
+        confirmText={clearingAll ? "Clearing..." : "Clear All"}
+        cancelText="Cancel"
+        variant="danger"
+      />
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaTable.js

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useMemo, useState } from "react";
-import { formatResetTime, getRemainingPercentage } from "./utils";
+import { formatFreebucksPrice, formatResetTime, getRemainingPercentage } from "./utils";
 
 const PAGE_SIZE = 10;
 
@@ -171,9 +171,20 @@ export default function QuotaTable({
               {/* Name */}
               <div className="flex w-36 min-w-0 items-center gap-1.5">
                 <span className="text-[10px] shrink-0">{colors.emoji}</span>
-                <span className={`${nameText} font-medium text-text-primary truncate`}>
+                <div className="min-w-0">
-                  {quota.name}
+                  <div className={`${nameText} font-medium text-text-primary truncate`}>
-                </span>
+                    {quota.name}
+                  </div>
+                  {quota.price !== undefined && (
+                    <div
+                      className="text-[9px] leading-tight text-text-muted truncate"
+                      title={quota.priceNote || ""}
+                    >
+                      {formatFreebucksPrice(quota.price)}
+                      {quota.priceNote ? ` · ${quota.priceNote}` : ""}
+                    </div>
+                  )}
+                </div>
               </div>
 
               {/* Progress + used/total */}

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.js

@@ -9,6 +9,7 @@ import {
   parseQuotaData,
   calculatePercentage,
   filterQuotasByVisibility,
+  formatFreebucksHeader,
   getHiddenQuotaRows,
   getQuotaVisibilityKey,
   getConnectionLabel,
@@ -1263,6 +1264,11 @@ export default function ProviderLimits() {
               </div>
 
               <div className="px-2 py-1.5">
+                {quota?.raw?.freebucks && !error && !isLoading && (
+                  <div className="mb-1.5 rounded-md bg-black/[0.03] px-2 py-1.5 text-[10px] leading-relaxed text-text-muted dark:bg-white/[0.03]">
+                    {formatFreebucksHeader(quota.raw.freebucks)}
+                  </div>
+                )}
                 {isLoading ? (
                   <div className="text-center py-5 text-text-muted">
                     <span className="material-symbols-outlined text-[28px] animate-spin">

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.js

@@ -258,6 +258,49 @@ export function formatResetTime(date) {
   }
 }
 
+/**
+ * Freebucks account header line — mirrors upstream freebucksHeaderLine:
+ * "10/25 Freebucks daily · resets in 4h 12m · 20 in wallet · $6.50 monthly usage left".
+ * Wallet shown only when non-empty; monthly only when the server sent it
+ * (older servers omit it — showing $0 would read as "nothing left").
+ * @param {{balance: number|null, daily: {limit:number,spent:number,remaining:number,resetAt:string|null}, wallet:{balance:number}, monthly?:{remainingUsd:number,limitUsd:number|null,resetAt:string|null}}} freebucks
+ * @returns {string|null}
+ */
+export function formatFreebucksHeader(freebucks) {
+  if (!freebucks?.daily) return null;
+  const parts = [
+    `${Math.max(0, Math.round(freebucks.daily.remaining))}/${Math.max(0, Math.round(freebucks.daily.limit))} Freebucks daily`,
+  ];
+  const countdown = formatResetTime(freebucks.daily.resetAt);
+  if (countdown !== "-") parts.push(`resets in ${countdown}`);
+  if (Number(freebucks.wallet?.balance) > 0) {
+    parts.push(`${Math.max(0, Math.round(freebucks.wallet.balance))} in wallet`);
+  }
+  if (freebucks.monthly && Number.isFinite(Number(freebucks.monthly.remainingUsd))) {
+    parts.push(`${formatFreebucksUsd(freebucks.monthly.remainingUsd)} monthly usage left`);
+  }
+  return parts.join(" · ");
+}
+
+/**
+ * "$25", "$4.20", "$0" — whole dollars until the figure is small enough that
+ * the cents are the story. Mirrors upstream formatAllowanceUsd.
+ */
+export function formatFreebucksUsd(usd) {
+  const safe = Math.max(0, Number(usd));
+  if (safe >= 10) return `$${Math.round(safe)}`;
+  if (safe >= 1) return `$${safe.toFixed(1).replace(/\.0$/, "")}`;
+  return `$${safe.toFixed(2)}`;
+}
+
+/**
+ * "15 Freebucks/hr" — a bare number would read as dollars; the unit is the
+ * hour, not the message.
+ */
+export function formatFreebucksPrice(price) {
+  return `${Math.max(0, Math.round(Number(price) || 0))} Freebucks/hr`;
+}
+
 /**
  * Get Tailwind color class based on percentage
  * @param {number} percentage - Remaining percentage (0-100)
@@ -685,6 +728,27 @@ export function parseQuotaData(provider, data) {
         }
         break;
 
+      case "freebuff":
+        // Session quotas keyed by model id — label rows with the friendly
+        // displayName (from the registry) and keep modelKey for ordering.
+        // Metered rows carry the live Freebucks price (price) + promo tagline
+        // (priceNote), both server-authoritative.
+        if (data.quotas) {
+          Object.entries(data.quotas).forEach(([modelKey, quota]) => {
+            normalizedQuotas.push({
+              name: quota.displayName || modelKey,
+              modelKey,
+              used: quota.used || 0,
+              total: quota.total || 0,
+              resetAt: quota.resetAt || null,
+              recurring: quota.recurring !== false,
+              price: quota.price,
+              priceNote: quota.priceNote,
+            });
+          });
+        }
+        break;
+
       case "groq":
         // Requests/Tokens rate-limit windows from response headers — absolute
         // used/total (calculatePercentage derives the bar), like Codex/Kiro.

src/app/api/oauth/[provider]/[action]/route.js

@@ -265,6 +265,7 @@ export async function GET(request, { params }) {
         "qoder",
         "qoder-cn",
         "grok-cli",
+        "freebuff",
       ];
       let deviceData;
       if (noPkceDeviceProviders.includes(provider)) {

src/app/api/providers/[id]/models/route.js

@@ -471,7 +471,7 @@ const PROVIDER_MODELS_CONFIG = {
   },
   "grok-cli": {
     customResolver: async (connection) => {
-      const proxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {});
+      const proxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {}, connection.id);
       const result = await resolveGrokCliModels({
         ...connection,
         connectionId: connection.id,

src/app/api/providers/[id]/route.js

@@ -33,7 +33,31 @@ function normalizeProxyConfig(body = {}) {
   };
 }
 
-async function normalizeProxyPoolUpdate(proxyPoolIdInput) {
+async function normalizeProxyPoolUpdate(body) {
+  // Handle new multi-proxy format
+  if (body.proxyPoolIds !== undefined) {
+    const proxyPoolIds = Array.isArray(body.proxyPoolIds) ? body.proxyPoolIds : [];
+    const proxyRotationStrategy = body.proxyRotationStrategy || "none";
+    
+    // Validate all proxy pool IDs exist
+    for (const poolId of proxyPoolIds) {
+      if (poolId) {
+        const pool = await getProxyPoolById(poolId);
+        if (!pool) {
+          return { hasProxyPoolField: true, error: `Proxy pool ${poolId} not found` };
+        }
+      }
+    }
+    
+    return {
+      hasProxyPoolField: true,
+      proxyPoolIds: proxyPoolIds.filter(Boolean),
+      proxyRotationStrategy,
+    };
+  }
+  
+  // Handle legacy single proxy format
+  const proxyPoolIdInput = body.proxyPoolId;
   if (proxyPoolIdInput === undefined) {
     return { hasProxyPoolField: false, proxyPoolId: null };
   }
@@ -111,7 +135,7 @@ export async function PUT(request, { params }) {
       return NextResponse.json({ error: proxyConfig.error }, { status: 400 });
     }
 
-    const proxyPoolResult = await normalizeProxyPoolUpdate(body.proxyPoolId);
+    const proxyPoolResult = await normalizeProxyPoolUpdate(body);
     if (proxyPoolResult.error) {
       return NextResponse.json({ error: proxyPoolResult.error }, { status: 400 });
     }
@@ -147,10 +171,19 @@ export async function PUT(request, { params }) {
       }
 
       if (proxyPoolResult.hasProxyPoolField) {
-        if (proxyPoolResult.proxyPoolId === null) {
+        // Handle new multi-proxy format
+        if (proxyPoolResult.proxyPoolIds !== undefined) {
+          updateData.providerSpecificData.proxyPoolIds = proxyPoolResult.proxyPoolIds;
+          updateData.providerSpecificData.proxyRotationStrategy = proxyPoolResult.proxyRotationStrategy;
+          // Clear legacy field
           delete updateData.providerSpecificData.proxyPoolId;
         } else {
-          updateData.providerSpecificData.proxyPoolId = proxyPoolResult.proxyPoolId;
+          // Handle legacy single-proxy format
+          if (proxyPoolResult.proxyPoolId === null) {
+            delete updateData.providerSpecificData.proxyPoolId;
+          } else {
+            updateData.providerSpecificData.proxyPoolId = proxyPoolResult.proxyPoolId;
+          }
         }
       }
     }

src/app/api/providers/[id]/test/testUtils.js

@@ -19,6 +19,7 @@ import {
   KIMCHI_CONFIG,
 } from "@/lib/oauth/constants/oauth";
 import { buildClineHeaders } from "@/shared/utils/clineAuth";
+import { decodeJwtPayload } from "@/lib/oauth/providerHelpers";
 
 // OAuth provider test endpoints
 const OAUTH_TEST_CONFIG = {
@@ -100,6 +101,26 @@ const OAUTH_TEST_CONFIG = {
     authPrefix: "Bearer ",
   },
   "codebuddy-cn": { tokenExists: true },
+  // GUARD — DO NOT REMOVE. See AGENTS.md §4. Without this entry, Test Connection
+  // returns "Provider test not supported". codebuddy-intl access tokens are
+  // Keycloak JWTs (iss .../auth/realms/copilot); probe the realm's userinfo
+  // endpoint so a revoked/expired token is caught. Derive the realm URL from the
+  // token's `iss` claim, falling back to the known copilot realm.
+  // 200 = valid, 401 = invalid/revoked.
+  // Covered by tests/unit/codebuddy-intl-connection.test.js.
+  "codebuddy-intl": {
+    buildUrl: (token) => {
+      const iss = decodeJwtPayload(token)?.iss;
+      const base = typeof iss === "string" && iss.startsWith("https://")
+        ? iss.replace(/\/$/, "")
+        : "https://www.codebuddy.ai/auth/realms/copilot";
+      return `${base}/protocol/openid-connect/userinfo`;
+    },
+    method: "GET",
+    authHeader: "Authorization",
+    authPrefix: "Bearer ",
+    refreshable: true,
+  },
   kimchi: {
     url: KIMCHI_CONFIG.validationUrl || "https://api.cast.ai/v1/llm/openai/supported-providers",
     method: "GET",
@@ -111,9 +132,24 @@ const OAUTH_TEST_CONFIG = {
     },
     refreshable: false,
   },
+  freebuff: {
+    // The session endpoint doubles as the auth probe: GET never claims a
+    // session (POST would burn 1.0 unit of the daily quota). Mirrors the usage
+    // handler: 401 = bad token, 403 = region/account gate (token still valid),
+    // 404 = no session row yet (pre-join, token valid). No refresh path —
+    // when the authToken dies the user re-logs in.
+    url: "https://www.codebuff.com/api/v1/freebuff/session",
+    method: "GET",
+    authHeader: "Authorization",
+    authPrefix: "Bearer ",
+    extraHeaders: { Accept: "application/json", "User-Agent": "codebuff-cli/0.0.138" },
+    acceptStatuses: [403, 404],
+    softFailMessage: {
+      403: "Connected, but Freebuff is gated (403) — country blocked or account banned.",
+    },
+  },
   // Grok CLI / Grok Build — probe /v1/user (no inference quota). Headers mirror official CLI.
-  "grok-cli": {
+  "grok-cli": {    url: PROVIDERS["grok-cli"]?.userUrl || "https://cli-chat-proxy.grok.com/v1/user",
-    url: PROVIDERS["grok-cli"]?.userUrl || "https://cli-chat-proxy.grok.com/v1/user",
     method: "GET",
     authHeader: "Authorization",
     authPrefix: "Bearer ",
@@ -247,7 +283,7 @@ async function refreshOAuthToken(connection) {
       return { accessToken: data.access_token, expiresIn: data.expires_in, refreshToken: data.refresh_token || refreshToken };
     }
 
-    if (provider === "codex" || provider === "grok-cli" || provider === "xai") {
+    if (provider === "codex" || provider === "grok-cli" || provider === "xai" || provider === "codebuddy-intl") {
       return await refreshProviderCredentials(provider, connection, console);
     }
 
@@ -849,7 +885,7 @@ export async function testSingleConnection(id) {
   const connection = await getProviderConnectionById(id);
   if (!connection) return { valid: false, error: "Connection not found", latencyMs: 0, testedAt: new Date().toISOString() };
 
-  const effectiveProxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {});
+  const effectiveProxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {}, connection.id);
 
   if (effectiveProxy.connectionProxyEnabled && effectiveProxy.connectionProxyUrl && !effectiveProxy.vercelRelayUrl) {
     const proxyResult = await testProxyUrl({ proxyUrl: effectiveProxy.connectionProxyUrl });