chore(release): v2.5.9 — codex passthrough + route validation + JWT persist

fix(build,api): restore production build and validate route bodies

CHANGELOG.md

@@ -4,6 +4,28 @@
 
 ---
 
+## [2.5.9] - 2026-03-15
+
+> Codex native passthrough fix + route body validation hardening.
+
+### 🐛 Bug Fixes
+
+- **fix(codex)**: Preserve native Responses API passthrough for Codex clients — avoids unnecessary translation mutations (PR #387)
+- **fix(api)**: Validate request bodies on pricing/sync and task-routing routes — prevents crashes from malformed inputs (PR #388)
+- **fix(auth)**: JWT secrets persist across restarts via `src/lib/db/secrets.ts` — eliminates 401 errors after pm2 restart (PR #388)
+
+---
+
+## [2.5.8] - 2026-03-15
+
+> Build fix: restore VPS connectivity broken by v2.5.7 incomplete publish.
+
+### 🐛 Bug Fixes
+
+- **fix(build)**: `scripts/prepublish.mjs` still used deprecated `--webpack` flag causing Next.js standalone build to fail silently — npm publish completed without `app/server.js`, breaking VPS deployment
+
+---
+
 ## [2.5.7] - 2026-03-15
 
 > Media playground error handling fixes.

docs/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 2.5.7
+  version: 2.5.9
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,

next.config.mjs

@@ -4,9 +4,30 @@ const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {
-  turbopack: {},
+  // Turbopack config: redirect native modules to stubs at build time
+  turbopack: {
+    resolveAlias: {
+      // Point mitm/manager to a stub during build (native child_process/fs can't be bundled)
+      "@/mitm/manager": "./src/mitm/manager.stub.ts",
+    },
+  },
   output: "standalone",
-  serverExternalPackages: ["better-sqlite3", "zod"],
+  serverExternalPackages: [
+    "better-sqlite3",
+    "zod",
+    "child_process",
+    "fs",
+    "path",
+    "os",
+    "crypto",
+    "net",
+    "tls",
+    "http",
+    "https",
+    "stream",
+    "buffer",
+    "util",
+  ],
   transpilePackages: ["@omniroute/open-sse"],
   allowedDevOrigins: ["localhost", "127.0.0.1", "192.168.*"],
   typescript: {
@@ -16,15 +37,17 @@ const nextConfig = {
   images: {
     unoptimized: true,
   },
-
-  // NEXT_PUBLIC_CLOUD_URL is set in .env — do NOT hardcode here (it overrides .env)
   webpack: (config, { isServer }) => {
-    // Ignore fs/path modules in browser bundle
+    // Ignore native Node.js modules in browser bundle
     if (!isServer) {
       config.resolve.fallback = {
         ...config.resolve.fallback,
         fs: false,
         path: false,
+        child_process: false,
+        net: false,
+        tls: false,
+        crypto: false,
       };
     }
     return config;

open-sse/executors/codex.ts

@@ -106,8 +106,22 @@ export class CodexExecutor extends BaseExecutor {
    * Transform request before sending - inject default instructions if missing
    */
   transformRequest(model, body, stream, credentials) {
+    const nativeCodexPassthrough = body?._nativeCodexPassthrough === true;
+
     // Codex /responses rejects stream=false; we aggregate SSE back to JSON when needed.
     body.stream = true;
+    delete body._nativeCodexPassthrough;
+
+    const requestServiceTier = normalizeServiceTierValue(body.service_tier);
+    if (requestServiceTier) {
+      body.service_tier = requestServiceTier;
+    } else if (defaultFastServiceTierEnabled) {
+      body.service_tier = CODEX_FAST_WIRE_VALUE;
+    }
+
+    if (nativeCodexPassthrough) {
+      return body;
+    }
 
     // If no instructions provided, inject default Codex instructions
     if (!body.instructions || body.instructions.trim() === "") {
@@ -117,13 +131,6 @@ export class CodexExecutor extends BaseExecutor {
     // Ensure store is false (Codex requirement)
     body.store = false;
 
-    const requestServiceTier = normalizeServiceTierValue(body.service_tier);
-    if (requestServiceTier) {
-      body.service_tier = requestServiceTier;
-    } else if (defaultFastServiceTierEnabled) {
-      body.service_tier = CODEX_FAST_WIRE_VALUE;
-    }
-
     // Extract thinking level from model name suffix
     // e.g., gpt-5.3-codex-high → high, gpt-5.3-codex → medium (default)
     const effortLevels = ["none", "low", "medium", "high", "xhigh"];

open-sse/handlers/chatCore.ts

@@ -42,6 +42,20 @@ import { getIdempotencyKey, checkIdempotency, saveIdempotency } from "@/lib/idem
 import { createProgressTransform, wantsProgress } from "../utils/progressTracker.ts";
 import { isModelUnavailableError, getNextFamilyFallback } from "../services/modelFamilyFallback.ts";
 
+export function shouldUseNativeCodexPassthrough({
+  provider,
+  sourceFormat,
+  endpointPath,
+}: {
+  provider?: string | null;
+  sourceFormat?: string | null;
+  endpointPath?: string | null;
+}): boolean {
+  if (provider !== "codex") return false;
+  if (sourceFormat !== FORMATS.OPENAI_RESPONSES) return false;
+  return String(endpointPath || "").toLowerCase().endsWith("/responses");
+}
+
 /**
  * Core chat handler - shared between SSE and Worker
  * Returns { success, response, status, error } for caller to handle fallback
@@ -103,6 +117,11 @@ export async function handleChatCore({
   const sourceFormat = detectFormat(body);
   const endpointPath = (clientRawRequest?.endpoint || "").toLowerCase();
   const isResponsesEndpoint = endpointPath.endsWith("/responses");
+  const nativeCodexPassthrough = shouldUseNativeCodexPassthrough({
+    provider,
+    sourceFormat,
+    endpointPath,
+  });
 
   // Check for bypass patterns (warmup, skip) - return fake response
   const bypassResponse = handleBypassRequest(body, model, userAgent);
@@ -164,55 +183,62 @@ export async function handleChatCore({
   // Translate request (pass reqLogger for intermediate logging)
   let translatedBody = body;
   try {
-    // Issue #199: Disable tool name prefix when routing Claude-format requests
-    // to non-Claude backends (prefix causes tool name mismatches)
-    const claudeProviders = ["claude", "anthropic"];
-    if (targetFormat === FORMATS.CLAUDE && !claudeProviders.includes(provider?.toLowerCase?.())) {
-      translatedBody = { ...translatedBody, _disableToolPrefix: true };
-    }
+    if (nativeCodexPassthrough) {
+      translatedBody = { ...body, _nativeCodexPassthrough: true };
+      log?.debug?.("FORMAT", "native codex passthrough enabled");
+    } else {
+      translatedBody = { ...body };
 
-    // ── #291: Strip empty name fields from messages/input items ──
-    // Upstream providers (OpenAI, Codex) reject name:"" with 400 errors.
-    // Clients like PocketPaw may forward empty name fields from assistant turns.
-    if (Array.isArray(body.messages)) {
-      body.messages = body.messages.map((msg: Record<string, unknown>) => {
-        if (msg.name === "") {
-          const { name: _n, ...rest } = msg;
-          return rest;
-        }
-        return msg;
-      });
-    }
-    if (Array.isArray(body.input)) {
-      body.input = body.input.map((item: Record<string, unknown>) => {
-        if (item.name === "") {
-          const { name: _n, ...rest } = item;
-          return rest;
-        }
-        return item;
-      });
-    }
-    // ── #346: Strip tools with empty function.name ──
-    // Claude Code sometimes forwards tool definitions with empty names, causing
-    // OpenAI-compatible upstream providers to reject with:
-    // "Invalid 'input[N].name': empty string. Expected minimum length 1."
-    if (Array.isArray(body.tools)) {
-      body.tools = body.tools.filter((tool: Record<string, unknown>) => {
-        const fn = tool.function as Record<string, unknown> | undefined;
-        return fn?.name && String(fn.name).trim().length > 0;
-      });
-    }
+      // Issue #199: Disable tool name prefix when routing Claude-format requests
+      // to non-Claude backends (prefix causes tool name mismatches)
+      const claudeProviders = ["claude", "anthropic"];
+      if (targetFormat === FORMATS.CLAUDE && !claudeProviders.includes(provider?.toLowerCase?.())) {
+        translatedBody._disableToolPrefix = true;
+      }
 
-    translatedBody = translateRequest(
-      sourceFormat,
-      targetFormat,
-      model,
-      translatedBody,
-      stream,
-      credentials,
-      provider,
-      reqLogger
-    );
+      // ── #291: Strip empty name fields from messages/input items ──
+      // Upstream providers (OpenAI, Codex) reject name:"" with 400 errors.
+      // Clients like PocketPaw may forward empty name fields from assistant turns.
+      if (Array.isArray(translatedBody.messages)) {
+        translatedBody.messages = translatedBody.messages.map((msg: Record<string, unknown>) => {
+          if (msg.name === "") {
+            const { name: _n, ...rest } = msg;
+            return rest;
+          }
+          return msg;
+        });
+      }
+      if (Array.isArray(translatedBody.input)) {
+        translatedBody.input = translatedBody.input.map((item: Record<string, unknown>) => {
+          if (item.name === "") {
+            const { name: _n, ...rest } = item;
+            return rest;
+          }
+          return item;
+        });
+      }
+      // ── #346: Strip tools with empty function.name ──
+      // Claude Code sometimes forwards tool definitions with empty names, causing
+      // OpenAI-compatible upstream providers to reject with:
+      // "Invalid 'input[N].name': empty string. Expected minimum length 1."
+      if (Array.isArray(translatedBody.tools)) {
+        translatedBody.tools = translatedBody.tools.filter((tool: Record<string, unknown>) => {
+          const fn = tool.function as Record<string, unknown> | undefined;
+          return fn?.name && String(fn.name).trim().length > 0;
+        });
+      }
+
+      translatedBody = translateRequest(
+        sourceFormat,
+        targetFormat,
+        model,
+        translatedBody,
+        stream,
+        credentials,
+        provider,
+        reqLogger
+      );
+    }
   } catch (error) {
     const parsedStatus = Number(error?.statusCode);
     const statusCode =

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "2.5.7",
+  "version": "2.5.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "2.5.7",
+      "version": "2.5.9",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [

package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "2.5.7",
+  "version": "2.5.9",
   "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
   "type": "module",
   "bin": {
@@ -47,7 +47,7 @@
   "homepage": "https://omniroute.online",
   "scripts": {
     "dev": "node scripts/run-next.mjs dev",
-    "build": "next build --webpack",
+    "build": "next build",
     "build:cli": "node scripts/prepublish.mjs",
     "start": "node scripts/run-next.mjs start",
     "lint": "eslint .",

scripts/prepublish.mjs

@@ -34,7 +34,11 @@ execSync("npm install", { cwd: ROOT, stdio: "inherit" });
 
 // ── Step 3: Build Next.js ──────────────────────────────────
 console.log("  🏗️  Building Next.js (standalone)...");
-execSync("npx next build --webpack", { cwd: ROOT, stdio: "inherit" });
+execSync("npx next build", {
+  cwd: ROOT,
+  stdio: "inherit",
+  env: { ...process.env, EXPERIMENTAL_TURBOPACK: "0" },
+});
 
 // ── Step 4: Verify standalone output ───────────────────────
 const standaloneDir = join(ROOT, ".next", "standalone");

src/app/api/cli-tools/antigravity-mitm/route.ts

@@ -1,19 +1,15 @@
-"use server";
+// Node.js-only route: uses child_process, fs, path via mitm/manager
+// Dynamic imports prevent Turbopack from statically resolving native modules
+export const runtime = "nodejs";
 
 import { NextResponse } from "next/server";
-import {
-  getMitmStatus,
-  startMitm,
-  stopMitm,
-  getCachedPassword,
-  setCachedPassword,
-} from "@/mitm/manager";
 import { cliMitmStartSchema, cliMitmStopSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
 // GET - Check MITM status
 export async function GET() {
   try {
+    const { getMitmStatus, getCachedPassword } = await import("@/mitm/manager");
     const status = await getMitmStatus();
     return NextResponse.json({
       running: status.running,
@@ -51,6 +47,7 @@ export async function POST(request) {
       return NextResponse.json({ error: validation.error }, { status: 400 });
     }
     const { apiKey, sudoPassword } = validation.data;
+    const { startMitm, getCachedPassword, setCachedPassword } = await import("@/mitm/manager");
     const isWin = process.platform === "win32";
     const pwd = sudoPassword || getCachedPassword() || "";
 
@@ -101,6 +98,7 @@ export async function DELETE(request) {
       return NextResponse.json({ error: validation.error }, { status: 400 });
     }
     const { sudoPassword } = validation.data;
+    const { stopMitm, getCachedPassword, setCachedPassword } = await import("@/mitm/manager");
     const isWin = process.platform === "win32";
     const pwd = sudoPassword || getCachedPassword() || "";
 

src/app/api/monitoring/health/route.ts

@@ -10,8 +10,7 @@ import { APP_CONFIG } from "@/shared/constants/config";
  */
 export async function GET() {
   try {
-    const { getAllCircuitBreakerStatuses } =
-      await import("@/../../src/shared/utils/circuitBreaker");
+    const { getAllCircuitBreakerStatuses } = await import("@/shared/utils/circuitBreaker");
     const { getAllRateLimitStatus } = await import("@omniroute/open-sse/services/rateLimitManager");
     const { getAllModelLockouts } = await import("@omniroute/open-sse/services/accountFallback");
 
@@ -66,7 +65,7 @@ export async function GET() {
 export async function DELETE() {
   try {
     const { resetAllCircuitBreakers, getAllCircuitBreakerStatuses } =
-      await import("@/../../src/shared/utils/circuitBreaker");
+      await import("@/shared/utils/circuitBreaker");
 
     const before = getAllCircuitBreakerStatuses();
     const resetCount = before.length;

src/app/api/pricing/sync/route.ts

@@ -7,14 +7,31 @@
  */
 
 import { NextRequest, NextResponse } from "next/server";
+import { pricingSyncRequestSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
 export async function POST(request: NextRequest) {
+  let rawBody: unknown;
   try {
-    const body = await request.json().catch(() => ({}));
-    const sources = Array.isArray(body.sources)
-      ? body.sources.filter((s: unknown): s is string => typeof s === "string")
-      : undefined;
-    const dryRun = body.dryRun === true;
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      {
+        error: {
+          message: "Invalid request",
+          details: [{ field: "body", message: "Invalid JSON body" }],
+        },
+      },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const validation = validateBody(pricingSyncRequestSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { sources, dryRun = false } = validation.data;
 
     const { syncPricingFromSources } = await import("@/lib/pricingSync");
     const result = await syncPricingFromSources({ sources, dryRun });

src/app/api/resilience/reset/route.ts

@@ -7,7 +7,7 @@ export async function POST() {
   try {
     // Reset all circuit breakers
     const { getAllCircuitBreakerStatuses, getCircuitBreaker } =
-      await import("@/../../src/shared/utils/circuitBreaker");
+      await import("@/shared/utils/circuitBreaker");
 
     const statuses = getAllCircuitBreakerStatuses();
     let resetCount = 0;
@@ -23,11 +23,9 @@ export async function POST() {
       resetCount,
       message: `Reset ${resetCount} circuit breaker(s)`,
     });
-  } catch (err) {
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : "Failed to reset resilience state";
     console.error("[API] POST /api/resilience/reset error:", err);
-    return NextResponse.json(
-      { error: err.message || "Failed to reset resilience state" },
-      { status: 500 }
-    );
+    return NextResponse.json({ error: message }, { status: 500 });
   }
 }

src/app/api/resilience/route.ts

@@ -19,8 +19,7 @@ function getErrorMessage(error: unknown, fallback: string): string {
 export async function GET() {
   try {
     // Dynamic imports for open-sse modules
-    const { getAllCircuitBreakerStatuses } =
-      await import("@/../../src/shared/utils/circuitBreaker");
+    const { getAllCircuitBreakerStatuses } = await import("@/shared/utils/circuitBreaker");
     const { getAllRateLimitStatus } = await import("@omniroute/open-sse/services/rateLimitManager");
     const { PROVIDER_PROFILES, DEFAULT_API_LIMITS } =
       await import("@omniroute/open-sse/config/constants");

src/app/api/settings/task-routing/route.ts

@@ -6,6 +6,8 @@ import {
   getDefaultTaskModelMap,
 } from "@omniroute/open-sse/services/taskAwareRouter.ts";
 import { updateSettings } from "@/lib/db/settings";
+import { taskRoutingActionSchema, updateTaskRoutingSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
 /**
  * GET /api/settings/task-routing
@@ -29,15 +31,29 @@ export async function GET() {
  * Body: { enabled?: boolean, taskModelMap?: { coding?: "...", ... }, detectionEnabled?: boolean }
  */
 export async function PUT(request: Request) {
-  let rawBody: Record<string, unknown>;
+  let rawBody: unknown;
   try {
     rawBody = await request.json();
   } catch {
-    return NextResponse.json({ error: { message: "Invalid JSON body" } }, { status: 400 });
+    return NextResponse.json(
+      {
+        error: {
+          message: "Invalid request",
+          details: [{ field: "body", message: "Invalid JSON body" }],
+        },
+      },
+      { status: 400 }
+    );
   }
 
   try {
-    setTaskRoutingConfig(rawBody as any);
+    const validation = validateBody(updateTaskRoutingSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const config = validation.data;
+
+    setTaskRoutingConfig(config);
 
     // Persist to database (excluding stats)
     const { stats, ...persistable } = getTaskRoutingConfig();
@@ -56,15 +72,29 @@ export async function PUT(request: Request) {
  * For "detect": pass { action: "detect", body: <request-body> } to test detection
  */
 export async function POST(request: Request) {
-  let rawBody: any;
+  let rawBody: unknown;
   try {
     rawBody = await request.json();
   } catch {
-    return NextResponse.json({ error: { message: "Invalid JSON body" } }, { status: 400 });
+    return NextResponse.json(
+      {
+        error: {
+          message: "Invalid request",
+          details: [{ field: "body", message: "Invalid JSON body" }],
+        },
+      },
+      { status: 400 }
+    );
   }
 
   try {
-    if (rawBody.action === "reset-stats") {
+    const validation = validateBody(taskRoutingActionSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const actionRequest = validation.data;
+
+    if (actionRequest.action === "reset-stats") {
       resetTaskRoutingStats();
       return NextResponse.json({
         success: true,
@@ -72,9 +102,9 @@ export async function POST(request: Request) {
       });
     }
 
-    if (rawBody.action === "detect") {
+    if (actionRequest.action === "detect") {
       const { detectTaskType } = await import("@omniroute/open-sse/services/taskAwareRouter.ts");
-      const taskType = detectTaskType(rawBody.body || {});
+      const taskType = detectTaskType(actionRequest.body || {});
       const config = getTaskRoutingConfig();
       return NextResponse.json({
         taskType,

src/instrumentation.ts

@@ -8,65 +8,41 @@
  * @see https://nextjs.org/docs/app/building-your-application/optimizing/instrumentation
  */
 
-function ensureSecrets(): void {
-  // eslint-disable-next-line no-eval
-  const crypto = eval("require")("crypto");
-  // eslint-disable-next-line no-eval
-  const Database = eval("require")("better-sqlite3");
-  // eslint-disable-next-line no-eval
-  const path = eval("require")("path");
-  const os = eval("require")("os"); // eslint-disable-line no-eval
+function getRandomBytes(byteLength: number): Uint8Array {
+  const bytes = new Uint8Array(byteLength);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
 
-  function getSecretsDb() {
-    const dataDir = process.env.DATA_DIR || path.join(os.homedir(), ".omniroute");
-    const dbPath = path.join(dataDir, "storage.sqlite");
-    try {
-      const db = new Database(dbPath);
-      db.exec(
-        "CREATE TABLE IF NOT EXISTS key_value (namespace TEXT, key TEXT, value TEXT, PRIMARY KEY (namespace, key))"
-      );
-      return db;
-    } catch {
-      return null;
-    }
-  }
+function toBase64(bytes: Uint8Array): string {
+  return btoa(String.fromCharCode(...bytes));
+}
 
-  function loadPersistedSecret(key: string): string | null {
-    try {
-      const db = getSecretsDb();
-      if (!db) return null;
-      const row = db
-        .prepare("SELECT value FROM key_value WHERE namespace = 'secrets' AND key = ?")
-        .get(key) as { value: string } | undefined;
-      db.close();
-      return row ? JSON.parse(row.value) : null;
-    } catch {
-      return null;
-    }
-  }
+function toHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 
-  function persistSecret(key: string, value: string): void {
-    try {
-      const db = getSecretsDb();
-      if (!db) return;
-      db.prepare(
-        "INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('secrets', ?, ?)"
-      ).run(key, JSON.stringify(value));
-      db.close();
-    } catch {
-      // Non-fatal — secrets can still work in-memory if persist fails
-    }
+async function ensureSecrets(): Promise<void> {
+  let getPersistedSecret = (_key: string): string | null => null;
+  let persistSecret = (_key: string, _value: string): void => {};
+
+  try {
+    ({ getPersistedSecret, persistSecret } = await import("@/lib/db/secrets"));
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(
+      "[STARTUP] Secret persistence unavailable; falling back to process-local secrets:",
+      msg
+    );
   }
 
   if (!process.env.JWT_SECRET || process.env.JWT_SECRET.trim() === "") {
-    // Try to load previously generated secret from DB (survives restarts)
-    const persisted = loadPersistedSecret("jwtSecret");
+    const persisted = getPersistedSecret("jwtSecret");
     if (persisted) {
       process.env.JWT_SECRET = persisted;
       console.log("[STARTUP] JWT_SECRET restored from persistent store");
     } else {
-      // First run — generate and persist
-      const generated = crypto.randomBytes(48).toString("base64");
+      const generated = toBase64(getRandomBytes(48));
       process.env.JWT_SECRET = generated;
       persistSecret("jwtSecret", generated);
       console.log("[STARTUP] JWT_SECRET auto-generated and persisted (random 64-char secret)");
@@ -74,11 +50,11 @@ function ensureSecrets(): void {
   }
 
   if (!process.env.API_KEY_SECRET || process.env.API_KEY_SECRET.trim() === "") {
-    const persisted = loadPersistedSecret("apiKeySecret");
+    const persisted = getPersistedSecret("apiKeySecret");
     if (persisted) {
       process.env.API_KEY_SECRET = persisted;
     } else {
-      const generated = crypto.randomBytes(32).toString("hex");
+      const generated = toHex(getRandomBytes(32));
       process.env.API_KEY_SECRET = generated;
       persistSecret("apiKeySecret", generated);
       console.log(
@@ -91,7 +67,7 @@ function ensureSecrets(): void {
 export async function register() {
   // Only run on the server (not during build or in Edge runtime)
   if (process.env.NEXT_RUNTIME === "nodejs") {
-    ensureSecrets();
+    await ensureSecrets();
     // Console log file capture (must be first — before any logging occurs)
     const { initConsoleInterceptor } = await import("@/lib/consoleInterceptor");
     initConsoleInterceptor();

src/lib/db/secrets.ts

@@ -0,0 +1,27 @@
+import { getDbInstance } from "./core";
+
+interface SecretRow {
+  value?: unknown;
+}
+
+export function getPersistedSecret(key: string): string | null {
+  try {
+    const db = getDbInstance();
+    const row = db
+      .prepare<SecretRow>("SELECT value FROM key_value WHERE namespace = 'secrets' AND key = ?")
+      .get(key);
+    return typeof row?.value === "string" ? JSON.parse(row.value) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function persistSecret(key: string, value: string): void {
+  try {
+    const db = getDbInstance();
+    db.prepare("INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('secrets', ?, ?)")
+      .run(key, JSON.stringify(value));
+  } catch {
+    // Non-fatal: secrets still work for the current process if persistence fails.
+  }
+}

src/mitm/manager.stub.ts

@@ -0,0 +1,18 @@
+// Build-time stub for @/mitm/manager
+// Used by Turbopack during next build to avoid native module resolution errors.
+// The real module is used at runtime via dynamic import in route handlers.
+
+export const getCachedPassword = () => null;
+export const setCachedPassword = (_pwd: string) => {};
+export const clearCachedPassword = () => {};
+export const getMitmStatus = async () => ({
+  running: false,
+  pid: null,
+  dnsConfigured: false,
+  certExists: false,
+});
+export const startMitm = async (_apiKey: string, _sudoPassword: string) => ({
+  running: false,
+  pid: null,
+});
+export const stopMitm = async (_sudoPassword: string) => ({ running: false, pid: null });

src/mitm/manager.ts

@@ -23,8 +23,12 @@ export function clearCachedPassword() {
   _cachedPassword = null;
 }
 
-// server.js is in same directory as this file
 const PID_FILE = path.join(resolveDataDir(), "mitm", ".mitm.pid");
+const MITM_SERVER_URL = new URL("./server.cjs", import.meta.url);
+const MITM_SERVER_PATH =
+  process.platform === "win32" && MITM_SERVER_URL.pathname.startsWith("/")
+    ? decodeURIComponent(MITM_SERVER_URL.pathname.slice(1))
+    : decodeURIComponent(MITM_SERVER_URL.pathname);
 
 // Check if a PID is alive
 function isProcessAlive(pid) {
@@ -104,8 +108,7 @@ export async function startMitm(apiKey, sudoPassword) {
 
   // 4. Start MITM server
   console.log("Starting MITM server...");
-  const serverPath = path.join(process.cwd(), "src/mitm/server.js");
-  serverProcess = spawn("node", [serverPath], {
+  serverProcess = spawn(process.execPath, [MITM_SERVER_PATH], {
     env: {
       ...process.env,
       ROUTER_API_KEY: apiKey,

src/mitm/server.cjs

@@ -244,7 +244,7 @@ const server = https.createServer(sslOptions, async (req, res) => {
   const bodyBuffer = await collectBodyRaw(req);
 
   // Save request log if enabled
-  if ((bodyBuffer as any).length > 0) saveRequestLog(req.url, bodyBuffer);
+  if (bodyBuffer.length > 0) saveRequestLog(req.url, bodyBuffer);
 
   // Anti-loop: requests from OmniRoute bypass interception
   if (req.headers["x-omniroute-source"] === "omniroute") {

src/shared/validation/schemas.ts

@@ -378,6 +378,58 @@ export const resetStatsActionSchema = z.object({
   action: z.literal("reset-stats"),
 });
 
+const pricingSyncSourceSchema = z.enum(["litellm"]);
+
+export const pricingSyncRequestSchema = z
+  .object({
+    sources: z.array(pricingSyncSourceSchema).min(1).optional(),
+    dryRun: z.boolean().optional(),
+  })
+  .strict();
+
+const taskRoutingModelMapSchema = z
+  .object({
+    coding: z.string().max(200).optional(),
+    creative: z.string().max(200).optional(),
+    analysis: z.string().max(200).optional(),
+    vision: z.string().max(200).optional(),
+    summarization: z.string().max(200).optional(),
+    background: z.string().max(200).optional(),
+    chat: z.string().max(200).optional(),
+  })
+  .strict();
+
+export const updateTaskRoutingSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    taskModelMap: taskRoutingModelMapSchema.optional(),
+    detectionEnabled: z.boolean().optional(),
+  })
+  .strict()
+  .superRefine((value, ctx) => {
+    if (
+      value.enabled === undefined &&
+      value.taskModelMap === undefined &&
+      value.detectionEnabled === undefined
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "No valid fields to update",
+        path: [],
+      });
+    }
+  });
+
+export const taskRoutingActionSchema = z.discriminatedUnion("action", [
+  resetStatsActionSchema,
+  z
+    .object({
+      action: z.literal("detect"),
+      body: jsonObjectSchema.optional(),
+    })
+    .strict(),
+]);
+
 export const updateComboDefaultsSchema = z
   .object({
     comboDefaults: comboRuntimeConfigSchema.optional(),

tests/unit/plan3-p0.test.mjs

@@ -4,6 +4,7 @@ import assert from "node:assert/strict";
 import { FORMATS } from "../../open-sse/translator/formats.ts";
 import { getModelInfoCore } from "../../open-sse/services/model.ts";
 import { detectFormat } from "../../open-sse/services/provider.ts";
+import { shouldUseNativeCodexPassthrough } from "../../open-sse/handlers/chatCore.ts";
 import { translateRequest } from "../../open-sse/translator/index.ts";
 import { GithubExecutor } from "../../open-sse/executors/github.ts";
 import {
@@ -79,6 +80,44 @@ test("CodexExecutor maps fast service tier to priority", () => {
   assert.equal(transformed.service_tier, "priority");
 });
 
+test("shouldUseNativeCodexPassthrough only enables responses-native Codex requests", () => {
+  assert.equal(
+    shouldUseNativeCodexPassthrough({
+      provider: "codex",
+      sourceFormat: FORMATS.OPENAI_RESPONSES,
+      endpointPath: "/v1/responses",
+    }),
+    true
+  );
+
+  assert.equal(
+    shouldUseNativeCodexPassthrough({
+      provider: "codex",
+      sourceFormat: FORMATS.OPENAI,
+      endpointPath: "/v1/responses",
+    }),
+    false
+  );
+
+  assert.equal(
+    shouldUseNativeCodexPassthrough({
+      provider: "openai",
+      sourceFormat: FORMATS.OPENAI_RESPONSES,
+      endpointPath: "/v1/responses",
+    }),
+    false
+  );
+
+  assert.equal(
+    shouldUseNativeCodexPassthrough({
+      provider: "codex",
+      sourceFormat: FORMATS.OPENAI_RESPONSES,
+      endpointPath: "/v1/chat/completions",
+    }),
+    false
+  );
+});
+
 test("CodexExecutor can force fast service tier from settings", () => {
   setDefaultFastServiceTierEnabled(true);
 
@@ -101,6 +140,33 @@ test("CodexExecutor always requests SSE accept header", () => {
   assert.equal(headers.Accept, "text/event-stream");
 });
 
+test("CodexExecutor preserves native responses payloads for Codex passthrough", () => {
+  const executor = new CodexExecutor();
+  const transformed = executor.transformRequest(
+    "gpt-5.1-codex",
+    {
+      model: "gpt-5.1-codex",
+      input: "ship it",
+      instructions: "custom system prompt",
+      store: true,
+      metadata: { source: "codex-client" },
+      reasoning_effort: "high",
+      service_tier: "fast",
+      _nativeCodexPassthrough: true,
+      stream: false,
+    },
+    false
+  );
+
+  assert.equal(transformed.stream, true);
+  assert.equal(transformed.service_tier, "priority");
+  assert.equal(transformed.instructions, "custom system prompt");
+  assert.equal(transformed.store, true);
+  assert.deepEqual(transformed.metadata, { source: "codex-client" });
+  assert.equal(transformed.reasoning_effort, "high");
+  assert.ok(!("_nativeCodexPassthrough" in transformed));
+});
+
 test("translateNonStreamingResponse converts Responses API payload to OpenAI chat.completion", () => {
   const responseBody = {
     id: "resp_123",

tests/unit/t06-schema-hardening.test.mjs

@@ -10,6 +10,9 @@ import {
   v1EmbeddingsSchema,
   providerChatCompletionSchema,
   v1CountTokensSchema,
+  pricingSyncRequestSchema,
+  updateTaskRoutingSchema,
+  taskRoutingActionSchema,
 } from "../../src/shared/validation/schemas.ts";
 
 test("translatorDetectSchema rejects empty body object", () => {
@@ -130,3 +133,49 @@ test("v1CountTokensSchema rejects empty messages", () => {
   });
   assert.equal(validation.success, false);
 });
+
+test("pricingSyncRequestSchema rejects unsupported sources", () => {
+  const validation = validateBody(pricingSyncRequestSchema, {
+    sources: ["unknown-source"],
+  });
+  assert.equal(validation.success, false);
+});
+
+test("pricingSyncRequestSchema accepts dryRun-only requests", () => {
+  const validation = validateBody(pricingSyncRequestSchema, {
+    dryRun: true,
+  });
+  assert.equal(validation.success, true);
+});
+
+test("updateTaskRoutingSchema rejects empty payloads", () => {
+  const validation = validateBody(updateTaskRoutingSchema, {});
+  assert.equal(validation.success, false);
+});
+
+test("updateTaskRoutingSchema accepts partial task routing updates", () => {
+  const validation = validateBody(updateTaskRoutingSchema, {
+    enabled: true,
+    taskModelMap: {
+      coding: "codex/gpt-5.1-codex",
+    },
+  });
+  assert.equal(validation.success, true);
+});
+
+test("taskRoutingActionSchema rejects unknown actions", () => {
+  const validation = validateBody(taskRoutingActionSchema, {
+    action: "noop",
+  });
+  assert.equal(validation.success, false);
+});
+
+test("taskRoutingActionSchema accepts detect action with object body", () => {
+  const validation = validateBody(taskRoutingActionSchema, {
+    action: "detect",
+    body: {
+      messages: [{ role: "user", content: "write code" }],
+    },
+  });
+  assert.equal(validation.success, true);
+});