From 7ea64bdb4392d8cd41bc871892466d30c50b58fd Mon Sep 17 00:00:00 2001
From: kaitranntt <kaitran.ntt@gmail.com>
Date: Fri, 19 Dec 2025 09:49:05 -0500
Subject: [PATCH] fix(cliproxy): prevent variant names matching reserved
 provider names

Added validation to reject variant names that match reserved CLIProxy
provider names (gemini, codex, agy, qwen, iflow). Also protected reserved
provider settings files from being deleted when deleting variants.

This prevents accidental deletion of default provider configurations when
users create variants with conflicting names.
---
 src/web-server/routes.ts | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/web-server/routes.ts b/src/web-server/routes.ts
index a7cf9175..5ff038eb 100644
--- a/src/web-server/routes.ts
+++ b/src/web-server/routes.ts
@@ -378,6 +378,15 @@ apiRoutes.post('/cliproxy', (req: Request, res: Response): void => {
     return;
   }
 
+  // Reject reserved provider names as variant names
+  const reservedNames = ['gemini', 'codex', 'agy', 'qwen', 'iflow'];
+  if (reservedNames.includes(name.toLowerCase())) {
+    res.status(400).json({
+      error: `Cannot use reserved provider name '${name}' as variant name`,
+    });
+    return;
+  }
+
   const config = readConfigSafe();
   config.cliproxy = config.cliproxy || {};
 
@@ -472,10 +481,14 @@ apiRoutes.delete('/cliproxy/:name', (req: Request, res: Response): void => {
     return;
   }
 
-  // Delete settings file
-  const settingsPath = path.join(getCcsDir(), `${name}.settings.json`);
-  if (fs.existsSync(settingsPath)) {
-    fs.unlinkSync(settingsPath);
+  // Never delete settings files for reserved provider names (safety guard)
+  const reservedNames = ['gemini', 'codex', 'agy', 'qwen', 'iflow'];
+  if (!reservedNames.includes(name.toLowerCase())) {
+    // Only delete settings file for non-reserved variant names
+    const settingsPath = path.join(getCcsDir(), `${name}.settings.json`);
+    if (fs.existsSync(settingsPath)) {
+      fs.unlinkSync(settingsPath);
+    }
   }
 
   delete config.cliproxy[name];