Skip to content

Add proxy support for add account by token - #90

Merged
dwgx merged 1 commit into
dwgx:masterfrom
smeinecke:feat/add-account-proxy
Apr 29, 2026
Merged

Add proxy support for add account by token#90
dwgx merged 1 commit into
dwgx:masterfrom
smeinecke:feat/add-account-proxy

Conversation

@smeinecke

@smeinecke smeinecke commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

改了什么 / What changed

Added an optional proxy field to the "Add Account" form in the Account Pool dashboard. Users can now specify a proxy (in protocol://[user:pass@]host:port format) when adding an account via API Key or Auth Token, instead of having to configure it separately after the account is created.

为什么 / Why

Previously, when adding an account to the pool, users had to:

  1. Add the account first (which would use the global proxy)
  2. Then separately configure a per-account proxy after creation

This was inconvenient, especially when managing multiple accounts with different proxies. The batch import feature already supported specifying proxies inline, but the single account addition form did not. This change brings feature parity between batch import and single account addition.

测试 / Testing

  • Tested proxy validation:

    • Invalid format (e.g., not-a-proxy) returns ERR_PROXY_FORMAT_INVALID
    • Private IP (e.g., http://192.168.1.1:8080) is blocked by default (returns ERR_PROXY_PRIVATE_IP)
    • Private IP allowed when ALLOW_PRIVATE_PROXY_HOSTS=1 is set
    • Valid public proxy (e.g., http://proxy.example.com:8080) works correctly
    • SOCKS5 with auth (e.g., socks5://user:pass@host:port) parses correctly

  • Tested dashboard UI:

    • Proxy field accepts input and clears after successful account addition
    • Empty proxy field omits proxy from request (uses global proxy)
    • i18n translations display correctly in both English and Chinese

  • Verified proxy is applied immediately:

    • Account is created → proxy is set → LS instance is spawned for the proxy

Checklist

  • 代码风格和现有文件一致 / Code style matches existing files
  • 没有引入 npm 依赖 / No new npm dependencies (project is zero-dep)
  • 涉及 LS binary 协议改动时 在 PR 描述里注明字段号来源 / If touching LS protocol, document field-number source in the PR description (N/A - no LS protocol changes)
  • 涉及 dashboard UI 用 App.confirm / App.prompt 不用浏览器原生 alert/confirm / Uses App.confirm / App.prompt, not native dialogs (if dashboard)

dwgx added a commit that referenced this pull request Apr 29, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
543d996 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx
dwgx requested changes Apr 29, 2026
View reviewed changes

@dwgx dwgx left a comment •
edited
Loading

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @smeinecke. The feature direction is right, but I cannot merge it as-is because proxy validation happens after the account is created.

Blocking issue: if proxy validation fails, the account has already been written to the store, leaving a stale account without the requested proxy binding. Please validate the proxy before calling the add-account path, or roll back the created account on validation failure.

Please also add/confirm tests for:

  • invalid proxy input does not create an account
  • valid proxy input creates the account and stores the proxy binding
  • the no-proxy path still behaves as before

@smeinecke

smeinecke commented Apr 29, 2026

Copy link
Copy Markdown
Contributor Author

You're right. I'll fix this and rebase the branch. Thank you for the feedback!

@dwgx

dwgx commented Apr 29, 2026

Copy link
Copy Markdown
Owner

Oh, I'm very sorry I didn't realize just now that you are not Chinese. I used Chinese. Thank you for your Pull

@smeinecke
feat(dashboard): add per-account proxy field to single-add form
a4dc792 
Add optional proxy input to dashboard single-account add form. Mirrors batch-import proxy binding — user can specify http://proxy:8080 or socks5://user:pass@host:port per account. Backend validates format via parseProxyUrl(), respects ALLOW_PRIVATE_PROXY_HOSTS config (validateHostFormat vs assertPublicUrlHost), calls setAccountProxy() + ensureLsForAccount(). UI clears proxy field on success. i18n for EN/zh-CN.
@smeinecke
smeinecke force-pushed the feat/add-account-proxy branch from 072d151 to a4dc792 Compare April 29, 2026 09:14
@dwgx
dwgx merged commit 59c5f71 into dwgx:master Apr 29, 2026
1 of 2 checks passed
dwgx added a commit that referenced this pull request Apr 29, 2026
@dwgx
feat: 2.0.28 — 本地 Windsurf 凭证导入 (#91) + PR #90 proxy 顺序修正
ec61dc0 
#91 — 从本地 Windsurf 桌面客户端读凭证：
- 新增 src/dashboard/local-windsurf.js：扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions
- 新增 GET /accounts/import-local：req.socket.remoteAddress 严格 loopback 校验
- 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入
- 用 node:sqlite 零依赖，Node 20 graceful 降级到 ~/.codeium/config.json fallback

#90 follow-up — proxy 校验顺序修正：
- /accounts POST 把 proxy 解析+校验提到 addAccount 之前，避免失败留僵尸账号
- 新增 4 条 test/account-add-proxy-ordering.test.js 锁住

测试：327/327 passing（+16 新）；i18n guard ✓
@smeinecke smeinecke mentioned this pull request Apr 29, 2026
Closed
4 tasks
smeinecke added a commit to smeinecke/WindsurfAPI that referenced this pull request Apr 29, 2026
@smeinecke
fix(dashboard): validate credentials before proxy checks in POST /acc…
424bd3b 
…ounts

Move api_key/token presence check to top of POST /accounts handler - runs before proxy validation + account creation. Prevents proxy network checks when credentials are missing. Simplify account creation to ternary expression (api_key vs token path). No functional change to validation order from dwgx#90 (proxy still validated before account creation).
huanchen pushed a commit to huanchen/WindsurfAPI that referenced this pull request May 3, 2026
@dwgx
Merge pull request dwgx#88 from smeinecke/feat/allow-private-proxies
ddf2af1 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase dwgx#90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
huanchen pushed a commit to huanchen/WindsurfAPI that referenced this pull request May 3, 2026
@dwgx
Merge pull request dwgx#90 from smeinecke/feat/add-account-proxy
6e2e427 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from dwgx#88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
huanchen pushed a commit to huanchen/WindsurfAPI that referenced this pull request May 3, 2026
@dwgx
feat: 2.0.28 — 本地 Windsurf 凭证导入 (dwgx#91) + PR dwgx#90 proxy 顺序修正
9a0e93b 
dwgx#91 — 从本地 Windsurf 桌面客户端读凭证：
- 新增 src/dashboard/local-windsurf.js：扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions
- 新增 GET /accounts/import-local：req.socket.remoteAddress 严格 loopback 校验
- 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入
- 用 node:sqlite 零依赖，Node 20 graceful 降级到 ~/.codeium/config.json fallback

dwgx#90 follow-up — proxy 校验顺序修正：
- /accounts POST 把 proxy 解析+校验提到 addAccount 之前，避免失败留僵尸账号
- 新增 4 条 test/account-add-proxy-ordering.test.js 锁住

测试：327/327 passing（+16 新）；i18n guard ✓
dwgx added a commit that referenced this pull request May 9, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
2ed28c9 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request May 9, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
d01fbfd 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request May 9, 2026
@dwgx
feat: 2.0.28 — 本地 Windsurf 凭证导入 (#91) + PR #90 proxy 顺序修正
b95896a 
#91 — 从本地 Windsurf 桌面客户端读凭证：
- 新增 src/dashboard/local-windsurf.js：扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions
- 新增 GET /accounts/import-local：req.socket.remoteAddress 严格 loopback 校验
- 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入
- 用 node:sqlite 零依赖，Node 20 graceful 降级到 ~/.codeium/config.json fallback

#90 follow-up — proxy 校验顺序修正：
- /accounts POST 把 proxy 解析+校验提到 addAccount 之前，避免失败留僵尸账号
- 新增 4 条 test/account-add-proxy-ordering.test.js 锁住

测试：327/327 passing（+16 新）；i18n guard ✓
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
1414ec6 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
87f0d0f 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
feat: 2.0.28 — 本地 Windsurf 凭证导入 (#91) + PR #90 proxy 顺序修正
13ad9e2 
#91 — 从本地 Windsurf 桌面客户端读凭证：
- 新增 src/dashboard/local-windsurf.js：扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions
- 新增 GET /accounts/import-local：req.socket.remoteAddress 严格 loopback 校验
- 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入
- 用 node:sqlite 零依赖，Node 20 graceful 降级到 ~/.codeium/config.json fallback

#90 follow-up — proxy 校验顺序修正：
- /accounts POST 把 proxy 解析+校验提到 addAccount 之前，避免失败留僵尸账号
- 新增 4 条 test/account-add-proxy-ordering.test.js 锁住

测试：327/327 passing（+16 新）；i18n guard ✓
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
9572518 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
6576a5f 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
feat: 2.0.28 — 本地 Windsurf 凭证导入 (#91) + PR #90 proxy 顺序修正
a8e9866 
#91 — 从本地 Windsurf 桌面客户端读凭证：
- 新增 src/dashboard/local-windsurf.js：扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions
- 新增 GET /accounts/import-local：req.socket.remoteAddress 严格 loopback 校验
- 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入
- 用 node:sqlite 零依赖，Node 20 graceful 降级到 ~/.codeium/config.json fallback

#90 follow-up — proxy 校验顺序修正：
- /accounts POST 把 proxy 解析+校验提到 addAccount 之前，避免失败留僵尸账号
- 新增 4 条 test/account-add-proxy-ordering.test.js 锁住

测试：327/327 passing（+16 新）；i18n guard ✓
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
8d2bfc8 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
ce9dfba 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
feat: 2.0.28 — 本地 Windsurf 凭证导入 (#91) + PR #90 proxy 顺序修正
7299d4a 
#91 — 从本地 Windsurf 桌面客户端读凭证：
- 新增 src/dashboard/local-windsurf.js：扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions
- 新增 GET /accounts/import-local：req.socket.remoteAddress 严格 loopback 校验
- 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入
- 用 node:sqlite 零依赖，Node 20 graceful 降级到 ~/.codeium/config.json fallback

#90 follow-up — proxy 校验顺序修正：
- /accounts POST 把 proxy 解析+校验提到 addAccount 之前，避免失败留僵尸账号
- 新增 4 条 test/account-add-proxy-ordering.test.js 锁住

测试：327/327 passing（+16 新）；i18n guard ✓
dwgx added a commit that referenced this pull request Jun 29, 2026
@dwgx
docs(thanks): add 6 missing merged-PR contributors
5dace50 
Backfill contributors who were merged but never added to the thanks
page, with weight tiers calibrated against existing entries:

- #64  baily-zhang (S)  — cascade transport canceled-session recovery
- #163 you922 (A)       — LS crash self-heal: exponential-backoff restart
- #204 lovivi (B+)      — glm-5.2 gpt_native tool dialect fix
- #90  smeinecke (B+)   — inline proxy on add-account form
- #88  smeinecke (B+)   — ALLOW_PRIVATE_PROXY_HOSTS opt-in for local proxy
- #89  smeinecke (B)    — login-flow i18n + error-code standardization

Synced src -> docs via sync:contributors. Also gitignore .workflow-results/
(local audit artifacts, not source). dashboard tests 17/17.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dwgx dwgx dwgx requested changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@smeinecke @dwgx