feat: account management overhaul + 7 issue resolutions (#147)

- Add smart JSON export/import with schema validation and deduplication
- Add per-account proxy configurations (Issue #79)
- Add advanced account sorting engine (Issues #126 & #99)
- Add compact horizontal layout, AI credits, inline model visibility (Issues #145 & #134)
- Add desktop push notifications for low quota (Issue #53)
- Fix Arch Linux AUR process detection bug (Issue #117)
- Default theme set to Dark Mode (it's better)
- UI Polishing: Improved sort dropdown and symmetrical dialog layouts
- Dev Mode: Resolved port conflicts and single-instance locks
- Updated README and README.zh-CN with new features

src/ipc/cloud/authServer.ts

@@ -1,38 +1,79 @@
 import http from 'http';
 import { logger } from '../../utils/logger';
 import { ipcContext } from '../context';
+import { escapeHtml } from '../../utils/url';
 
 export class AuthServer {
   private static server: http.Server | null = null;
   private static PORT = 8888;
 
-  static start() {
+  static async start() {
     if (this.server) {
       logger.warn('AuthServer: Server already running');
       return;
     }
 
-    this.server = http.createServer((req, res) => {
-      const url = new URL(req.url || '', `http://localhost:${this.PORT}`);
+    const tryPorts = [8888, 8889, 8890, 8891, 8892];
+    let boundPort: number | null = null;
 
-      if (url.pathname === '/oauth-callback') {
-        const code = url.searchParams.get('code');
-        const error = url.searchParams.get('error');
+    for (const port of tryPorts) {
+      try {
+        await new Promise<void>((resolve, reject) => {
+          const testServer = http.createServer();
+          testServer.once('error', reject);
+          testServer.listen(port, '127.0.0.1', () => {
+            testServer.close(() => resolve());
+          });
+        });
+        boundPort = port;
+        break;
+      } catch {
+        logger.debug(`AuthServer: Port ${port} is in use, trying next...`);
+      }
+    }
 
-        if (code) {
-          logger.info(`AuthServer: Received authorization code: ${code.substring(0, 10)}...`);
+    if (!boundPort) {
+      logger.error('AuthServer: No available ports found for OAuth callback server');
+      return;
+    }
 
-          // Send code to renderer
-          if (ipcContext.mainWindow) {
-            logger.info('AuthServer: Sending code to renderer via IPC');
-            ipcContext.mainWindow.webContents.send('GOOGLE_AUTH_CODE', code);
-            logger.info('AuthServer: Code sent successfully');
-          } else {
-            logger.error('AuthServer: Main window not found, cannot send code');
-          }
+    if (boundPort !== 8888) {
+      logger.warn(`AuthServer: Using fallback port ${boundPort} (default 8888 is in use)`);
+    }
 
-          res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-          res.end(`
+    this.PORT = boundPort;
+
+    try {
+      this.server = http.createServer((req, res) => {
+        if (req.method !== 'GET') {
+          res.writeHead(405, { Allow: 'GET' });
+          res.end('Method Not Allowed');
+          return;
+        }
+
+        const url = new URL(req.url || '', `http://localhost:${this.PORT}`);
+
+        if (url.pathname === '/oauth-callback') {
+          const code = url.searchParams.get('code');
+          const error = url.searchParams.get('error');
+
+          if (code) {
+            const escapedCode = escapeHtml(code);
+            logger.info(
+              `AuthServer: Received authorization code: ${escapedCode.substring(0, 10)}...`,
+            );
+
+            // Send code to renderer
+            if (ipcContext.mainWindow) {
+              logger.info('AuthServer: Sending code to renderer via IPC');
+              ipcContext.mainWindow.webContents.send('GOOGLE_AUTH_CODE', code);
+              logger.info('AuthServer: Code sent successfully');
+            } else {
+              logger.error('AuthServer: Main window not found, cannot send code');
+            }
+
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(`
             <html>
               <body style="font-family: sans-serif; text-align: center; padding-top: 50px;">
                 <h1>Login Successful</h1>
@@ -43,34 +84,46 @@ export class AuthServer {
               </body>
             </html>
           `);
-        } else if (error) {
-          logger.error(`AuthServer: OAuth error: ${error}`);
-          res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-          res.end(`
+          } else if (error) {
+            const escapedError = escapeHtml(error);
+            logger.error(`AuthServer: OAuth error: ${escapedError}`);
+            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(`
             <html>
               <body>
                 <h1>Login Failed</h1>
-                <p>Error: ${error}</p>
+                <p>Error: ${escapedError}</p>
               </body>
             </html>
           `);
+          } else {
+            res.writeHead(400);
+            res.end('Missing code parameter');
+          }
         } else {
-          res.writeHead(400);
-          res.end('Missing code parameter');
+          res.writeHead(404);
+          res.end('Not Found');
         }
-      } else {
-        res.writeHead(404);
-        res.end('Not Found');
+      });
+
+      this.server.on('error', (err) => {
+        logger.error('AuthServer: Server error', err);
+      });
+
+      this.server.listen(this.PORT, '127.0.0.1', () => {
+        logger.info(`AuthServer: Listening on http://localhost:${this.PORT}`);
+      });
+    } catch (e) {
+      logger.error('AuthServer: Failed to create or start server', e);
+      if (this.server) {
+        this.server.close();
+        this.server = null;
       }
-    });
+    }
+  }
 
-    this.server.on('error', (err) => {
-      logger.error('AuthServer: Server error', err);
-    });
-
-    this.server.listen(this.PORT, () => {
-      logger.info(`AuthServer: Listening on http://localhost:${this.PORT}`);
-    });
+  static getRedirectUri(): string {
+    return `http://localhost:${this.PORT}/oauth-callback`;
   }
 
   static stop() {

src/ipc/cloud/handler.ts

@@ -1,8 +1,9 @@
 import { v4 as uuidv4 } from 'uuid';
 import { CloudAccountRepo } from '../../ipc/database/cloudHandler';
 import { GoogleAPIService } from '../../services/GoogleAPIService';
-import { CloudAccount } from '../../types/cloudAccount';
+import { CloudAccount, CloudAccountExportSchema } from '../../types/cloudAccount';
 import { logger } from '../../utils/logger';
+import { AuthServer } from './authServer';
 
 import { shell } from 'electron';
 import fs from 'fs';
@@ -22,8 +23,7 @@ import { executeSwitchFlow } from '../../ipc/switchFlow';
 import type { DeviceProfile, DeviceProfilesSnapshot } from '../../types/account';
 
 // Fallback constants if service constants are not available or for direct usage
-const CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
-const REDIRECT_URI = 'http://localhost:8888/oauth-callback';
+const CLIENT_ID = '1071006060591-tmhssin21lcre235vtolojh4g403ep.apps.googleusercontent.com';
 const SCOPE = [
   'https://www.googleapis.com/auth/cloud-platform',
   'https://www.googleapis.com/auth/userinfo.email',
@@ -52,7 +52,13 @@ export async function addGoogleAccount(authCode: string): Promise<CloudAccount>
     // 2. Get User Info
     const userInfo = await GoogleAPIService.getUserInfo(tokenResp.access_token);
 
-    // 3. Construct CloudAccount Object
+    // 3. Check for existing account
+    const existing = await CloudAccountRepo.getAccountByEmail(userInfo.email);
+    if (existing) {
+      throw new Error(`Account with email ${userInfo.email} already exists.`);
+    }
+
+    // 4. Construct CloudAccount Object
     const now = Math.floor(Date.now() / 1000);
     const account: CloudAccount = {
       id: uuidv4(),
@@ -62,7 +68,7 @@ export async function addGoogleAccount(authCode: string): Promise<CloudAccount>
       avatar_url: userInfo.picture,
       token: {
         access_token: tokenResp.access_token,
-        refresh_token: tokenResp.refresh_token || '', // prompt=consent guarantees this, but we fallback safely
+        refresh_token: tokenResp.refresh_token || '',
         expires_in: tokenResp.expires_in,
         expiry_timestamp: now + tokenResp.expires_in,
         token_type: tokenResp.token_type,
@@ -76,10 +82,8 @@ export async function addGoogleAccount(authCode: string): Promise<CloudAccount>
       logger.warn(`No refresh token received for ${account.email}. Account will expire in 1 hour.`);
     }
 
-    // 4. Save to DB
     await CloudAccountRepo.addAccount(account);
 
-    // 5. Initial Quota Check (Async, best effort)
     try {
       const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
       account.quota = quota;
@@ -110,40 +114,56 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
     throw new Error(`Account not found: ${accountId}`);
   }
 
-  // Check if token needs refresh
   let now = Math.floor(Date.now() / 1000);
   if (account.token.expiry_timestamp < now + 300) {
-    // 5 minutes buffer
     logger.info(`Token for ${account.email} near expiry, refreshing...`);
     try {
-      const newTokenData = await GoogleAPIService.refreshAccessToken(account.token.refresh_token);
+      const newTokenData = await GoogleAPIService.refreshAccessToken(
+        account.token.refresh_token,
+        account.proxy_url,
+      );
 
-      // Update token in memory object
       account.token.access_token = newTokenData.access_token;
       account.token.expires_in = newTokenData.expires_in;
       account.token.expiry_timestamp = now + newTokenData.expires_in;
 
-      // Save to DB
       await CloudAccountRepo.updateToken(account.id, account.token);
     } catch (e) {
       logger.error(`Failed to refresh token during time-check for ${account.email}`, e);
+      throw new Error(`Token refresh failed for ${account.email}. Please try logging in again.`);
     }
   }
 
   try {
-    const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
+    const quota = await GoogleAPIService.fetchQuota(account.token.access_token, account.proxy_url);
     account.quota = quota;
     await CloudAccountRepo.updateQuota(account.id, quota);
+
+    try {
+      const aiCredits = await GoogleAPIService.fetchAICredits(
+        account.token.access_token,
+        account.proxy_url,
+      );
+      if (aiCredits) {
+        account.quota = { ...quota, ai_credits: aiCredits };
+        await CloudAccountRepo.updateQuota(account.id, account.quota);
+      }
+    } catch (e) {
+      logger.warn('Failed to fetch AI credits', e);
+    }
+
     await CloudAccountRepo.updateLastUsed(account.id);
-    account.last_used = Math.floor(Date.now() / 1000); // Sync memory object
+    account.last_used = Math.floor(Date.now() / 1000);
     notifyTrayUpdate(account);
     return account;
   } catch (error: any) {
     if (error.message === 'UNAUTHORIZED') {
       logger.warn(`Got 401 Unauthorized for ${account.email}, forcing token refresh...`);
       try {
-        // Force Refresh
-        const newTokenData = await GoogleAPIService.refreshAccessToken(account.token.refresh_token);
+        const newTokenData = await GoogleAPIService.refreshAccessToken(
+          account.token.refresh_token,
+          account.proxy_url,
+        );
         now = Math.floor(Date.now() / 1000);
 
         account.token.access_token = newTokenData.access_token;
@@ -152,12 +172,28 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
 
         await CloudAccountRepo.updateToken(account.id, account.token);
 
-        // Retry Quota
-        const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
+        const quota = await GoogleAPIService.fetchQuota(
+          account.token.access_token,
+          account.proxy_url,
+        );
         account.quota = quota;
         await CloudAccountRepo.updateQuota(account.id, quota);
+
+        try {
+          const aiCredits = await GoogleAPIService.fetchAICredits(
+            account.token.access_token,
+            account.proxy_url,
+          );
+          if (aiCredits) {
+            account.quota = { ...quota, ai_credits: aiCredits };
+            await CloudAccountRepo.updateQuota(account.id, account.quota);
+          }
+        } catch (e) {
+          logger.warn('Failed to fetch AI credits after token refresh', e);
+        }
+
         await CloudAccountRepo.updateLastUsed(account.id);
-        account.last_used = Math.floor(Date.now() / 1000); // Sync memory object
+        account.last_used = Math.floor(Date.now() / 1000);
         return account;
       } catch (refreshError) {
         logger.error(
@@ -170,7 +206,6 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
       logger.warn(
         `Got 403 Forbidden for ${account.email}, marking as rate limited (if implemented) or just ignoring.`,
       );
-      // Return existing account to avoid crash
       return account;
     }
 
@@ -200,16 +235,23 @@ export async function switchCloudAccount(accountId: string): Promise<void> {
       // 1. Prepare token refresh promise (start it in parallel with process exit)
       const tokenRefreshPromise = (async () => {
         const now = Math.floor(Date.now() / 1000);
-        if (account.token.expiry_timestamp < now + 1200) { // Increased buffer to 20m
+        if (account.token.expiry_timestamp < now + 1200) {
           logger.info(`Token for ${account.email} near expiry, refreshing in parallel...`);
           try {
             const newTokenData = await GoogleAPIService.refreshAccessToken(
               account.token.refresh_token,
+              account.proxy_url,
             );
-            account.token.access_token = newTokenData.access_token;
-            account.token.expires_in = newTokenData.expires_in;
-            account.token.expiry_timestamp = now + newTokenData.expires_in;
-            await CloudAccountRepo.updateToken(account.id, account.token);
+
+            const updatedToken = {
+              ...account.token,
+              access_token: newTokenData.access_token,
+              expires_in: newTokenData.expires_in,
+              expiry_timestamp: now + newTokenData.expires_in,
+            };
+            await CloudAccountRepo.updateToken(account.id, updatedToken);
+
+            account.token = updatedToken;
             logger.info(`Token refreshed for ${account.email}`);
           } catch (e) {
             logger.warn('Failed to refresh token in parallel, will try to use existing', e);
@@ -375,8 +417,119 @@ export async function forcePollCloudMonitor(): Promise<void> {
 }
 
 export async function startAuthFlow(): Promise<void> {
-  const url = `https://accounts.google.com/o/oauth2/v2/auth?client_id=${CLIENT_ID}&redirect_uri=${REDIRECT_URI}&response_type=code&scope=${SCOPE}&access_type=offline&prompt=consent&include_granted_scopes=true`;
+  const url = `https://accounts.google.com/o/oauth2/v2/auth?client_id=${CLIENT_ID}&redirect_uri=${AuthServer.getRedirectUri()}&response_type=code&scope=${SCOPE}&access_type=offline&prompt=consent&include_granted_scopes=true`;
 
   logger.info(`Starting auth flow, opening URL: ${url}`);
   await shell.openExternal(url);
 }
+
+export async function exportCloudAccounts(stripTokens = false): Promise<string> {
+  const accounts = await CloudAccountRepo.getAccounts();
+  const exportData = {
+    version: '1.0' as const,
+    exportedAt: Math.floor(Date.now() / 1000),
+    accounts: accounts.map((acc) => ({
+      provider: acc.provider,
+      email: acc.email,
+      name: acc.name,
+      avatar_url: acc.avatar_url,
+      token: stripTokens ? undefined : acc.token,
+      quota: acc.quota,
+      device_profile: acc.device_profile,
+      device_history: acc.device_history,
+      proxy_url: acc.proxy_url ?? null,
+    })),
+  };
+
+  CloudAccountExportSchema.parse(exportData);
+  return JSON.stringify(exportData, null, 2);
+}
+
+export type ImportStrategy = 'merge' | 'overwrite' | 'skip-existing';
+
+export async function importCloudAccounts(
+  jsonContent: string,
+  strategy: ImportStrategy = 'merge',
+): Promise<{ imported: number; skipped: number; updated: number; errors: string[] }> {
+  const result = { imported: 0, skipped: 0, updated: 0, errors: [] as string[] };
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(jsonContent);
+  } catch {
+    throw new Error('Invalid JSON format');
+  }
+
+  const validated = CloudAccountExportSchema.safeParse(parsed);
+  if (!validated.success) {
+    throw new Error(
+      `Invalid export file: ${validated.error.issues[0]?.message || 'schema mismatch'}`,
+    );
+  }
+
+  const importEmails = new Set<string>();
+  for (const acc of validated.data.accounts) {
+    const emailLower = acc.email.toLowerCase();
+    if (importEmails.has(emailLower)) {
+      throw new Error(`Duplicate email found in import file: ${acc.email}`);
+    }
+    importEmails.add(emailLower);
+  }
+
+  const existingAccounts = await CloudAccountRepo.getAccounts();
+  const existingByEmail = new Map(existingAccounts.map((a) => [a.email.toLowerCase(), a]));
+
+  for (const acc of validated.data.accounts) {
+    try {
+      const existing = existingByEmail.get(acc.email.toLowerCase());
+      const now = Math.floor(Date.now() / 1000);
+
+      if (existing) {
+        if (strategy === 'skip-existing') {
+          result.skipped++;
+          continue;
+        }
+
+        const updatedAccount: CloudAccount = {
+          ...existing,
+          provider: acc.provider,
+          name: acc.name ?? existing.name,
+          avatar_url: acc.avatar_url ?? existing.avatar_url,
+          token: acc.token,
+          quota: acc.quota ?? existing.quota,
+          device_profile: acc.device_profile ?? existing.device_profile,
+          device_history: acc.device_history ?? existing.device_history,
+          proxy_url: acc.proxy_url ?? existing.proxy_url,
+          last_used: now,
+        };
+
+        await CloudAccountRepo.addAccount(updatedAccount);
+        result.updated++;
+      } else {
+        const newAccount: CloudAccount = {
+          id: uuidv4(),
+          provider: acc.provider,
+          email: acc.email,
+          name: acc.name,
+          avatar_url: acc.avatar_url,
+          token: acc.token,
+          quota: acc.quota,
+          device_profile: acc.device_profile,
+          device_history: acc.device_history,
+          proxy_url: acc.proxy_url ?? undefined,
+          created_at: now,
+          last_used: now,
+          status: 'active',
+          is_active: false,
+        };
+
+        await CloudAccountRepo.addAccount(newAccount);
+        result.imported++;
+      }
+    } catch (error: any) {
+      result.errors.push(`Failed to import ${acc.email}: ${error.message}`);
+    }
+  }
+
+  return result;
+}

src/ipc/cloud/router.ts

@@ -18,10 +18,12 @@ import {
   setAutoSwitchEnabled,
   forcePollCloudMonitor,
   startAuthFlow,
+  exportCloudAccounts,
+  importCloudAccounts,
 } from './handler';
+import { CloudAccountRepo } from '../database/cloudHandler';
 import { CloudAccountSchema } from '../../types/cloudAccount';
 import { DeviceProfileSchema, DeviceProfilesSnapshotSchema } from '../../types/account';
-import { CloudAccountRepo } from '../database/cloudHandler';
 import { logger } from '../../utils/logger';
 import { getSwitchMetricsSnapshot } from '../switchMetrics';
 import { getSwitchGuardSnapshot } from '../switchGuard';
@@ -117,6 +119,18 @@ export const cloudRouter = os.router({
     await startAuthFlow();
   }),
 
+  setAccountProxy: os
+    .input(z.object({ accountId: z.string(), proxyUrl: z.string().nullable() }))
+    .output(z.void())
+    .handler(async ({ input }) => {
+      try {
+        await CloudAccountRepo.setAccountProxy(input.accountId, input.proxyUrl);
+      } catch (error: any) {
+        logger.error('[ORPC] setAccountProxy error:', error.message, error.stack);
+        throw error;
+      }
+    }),
+
   syncLocalAccount: os.output(CloudAccountSchema.nullable()).handler(async () => {
     try {
       const result = await CloudAccountRepo.syncFromIDE();
@@ -185,4 +199,40 @@ export const cloudRouter = os.router({
   openIdentityStorageFolder: os.output(z.void()).handler(async () => {
     await openCloudIdentityStorageFolder();
   }),
+
+  exportCloudAccounts: os
+    .input(z.object({ stripTokens: z.boolean().default(false) }))
+    .output(z.string())
+    .handler(async ({ input }) => {
+      try {
+        return await exportCloudAccounts(input.stripTokens);
+      } catch (error: any) {
+        logger.error('[ORPC] exportCloudAccounts error:', error.message, error.stack);
+        throw error;
+      }
+    }),
+
+  importCloudAccounts: os
+    .input(
+      z.object({
+        jsonContent: z.string(),
+        strategy: z.enum(['merge', 'overwrite', 'skip-existing']).default('merge'),
+      }),
+    )
+    .output(
+      z.object({
+        imported: z.number(),
+        skipped: z.number(),
+        updated: z.number(),
+        errors: z.array(z.string()),
+      }),
+    )
+    .handler(async ({ input }) => {
+      try {
+        return await importCloudAccounts(input.jsonContent, input.strategy);
+      } catch (error: any) {
+        logger.error('[ORPC] importCloudAccounts error:', error.message, error.stack);
+        throw error;
+      }
+    }),
 });

src/ipc/database/cloudHandler.ts

@@ -6,7 +6,12 @@ import { desc, eq } from 'drizzle-orm';
 import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 import { getCloudAccountsDbPath, getAntigravityDbPaths } from '../../utils/paths';
 import { logger } from '../../utils/logger';
-import { CloudAccount } from '../../types/cloudAccount';
+import {
+  CloudAccount,
+  CloudAccountSchema,
+  CloudQuotaDataSchema,
+  CloudTokenDataSchema,
+} from '../../types/cloudAccount';
 import { type DeviceProfile, type DeviceProfileVersion } from '../../types/account';
 import { ItemTableValueRowSchema, TableInfoRowSchema } from '../../types/db';
 import { decryptWithMigration, encrypt, type KeySource } from '../../utils/security';
@@ -90,6 +95,7 @@ function ensureDatabaseInitialized(dbPath: string): void {
     const hasIsActive = tableInfo.some((col) => col.name === 'is_active');
     const hasDeviceProfileJson = tableInfo.some((col) => col.name === 'device_profile_json');
     const hasDeviceHistoryJson = tableInfo.some((col) => col.name === 'device_history_json');
+    const hasProxyUrl = tableInfo.some((col) => col.name === 'proxy_url');
     if (!hasIsActive) {
       db.exec('ALTER TABLE accounts ADD COLUMN is_active INTEGER DEFAULT 0');
     }
@@ -99,6 +105,9 @@ function ensureDatabaseInitialized(dbPath: string): void {
     if (!hasDeviceHistoryJson) {
       db.exec('ALTER TABLE accounts ADD COLUMN device_history_json TEXT');
     }
+    if (!hasProxyUrl) {
+      db.exec('ALTER TABLE accounts ADD COLUMN proxy_url TEXT');
+    }
 
     // Create index on email for faster lookups
     // Create index on email for faster lookups
@@ -450,6 +459,9 @@ export class CloudAccountRepo {
   }
 
   static async addAccount(account: CloudAccount): Promise<void> {
+    // Validate account data before processing
+    CloudAccountSchema.parse(account);
+
     const { raw, orm } = getCloudDb();
     try {
       const tokenEncrypted = await encrypt(JSON.stringify(account.token));
@@ -468,6 +480,7 @@ export class CloudAccountRepo {
         lastUsed: account.last_used,
         status: account.status || 'active',
         isActive: account.is_active ? 1 : 0,
+        proxyUrl: account.proxy_url ?? null,
       };
 
       orm.transaction((tx) => {
@@ -509,79 +522,86 @@ export class CloudAccountRepo {
 
       const cloudAccounts: CloudAccount[] = [];
       for (const normalizedRow of rows) {
-        let tokenResult: DecryptFieldResult;
         try {
-          tokenResult = await decryptAndMigrateField(
-            orm,
-            normalizedRow.id,
-            'tokenJson',
-            normalizedRow.tokenJson,
-          );
-        } catch (error) {
-          migrationStats.failedFields += 1;
-          logger.error(`Failed to decrypt token for account ${normalizedRow.id}`, error);
-          throw error;
-        }
+          let tokenResult: DecryptFieldResult;
+          try {
+            tokenResult = await decryptAndMigrateField(
+              orm,
+              normalizedRow.id,
+              'tokenJson',
+              normalizedRow.tokenJson,
+            );
+          } catch (error) {
+            migrationStats.failedFields += 1;
+            logger.error(`Failed to decrypt token for account ${normalizedRow.id}`, error);
+            continue; // Skip corrupted account
+          }
 
-        let quotaResult: DecryptFieldResult;
-        try {
-          quotaResult = await decryptAndMigrateField(
-            orm,
-            normalizedRow.id,
-            'quotaJson',
-            normalizedRow.quotaJson,
-          );
-        } catch (error) {
-          migrationStats.failedFields += 1;
-          logger.error(`Failed to decrypt quota for account ${normalizedRow.id}`, error);
-          throw error;
-        }
+          let quotaResult: DecryptFieldResult;
+          try {
+            quotaResult = await decryptAndMigrateField(
+              orm,
+              normalizedRow.id,
+              'quotaJson',
+              normalizedRow.quotaJson,
+            );
+          } catch (error) {
+            migrationStats.failedFields += 1;
+            logger.error(`Failed to decrypt quota for account ${normalizedRow.id}`, error);
+            quotaResult = { value: null, migrated: false }; // Quota is optional, proceed
+          }
 
-        if (!tokenResult.value) {
-          throw new Error(`Missing token data for account ${normalizedRow.id}`);
-        }
+          if (!tokenResult.value) {
+            logger.warn(`Missing token data for account ${normalizedRow.id}`);
+            continue;
+          }
 
-        if (tokenResult.value) {
-          migrationStats.totalFields += 1;
-        }
-        if (tokenResult.usedFallback) {
-          migrationStats.fallbackUsedFields += 1;
-        }
-        if (tokenResult.migrated) {
-          migrationStats.migratedFields += 1;
+          if (tokenResult.value) {
+            migrationStats.totalFields += 1;
+          }
           if (tokenResult.usedFallback) {
-            migrationStats.migratedBySource[tokenResult.usedFallback] += 1;
+            migrationStats.fallbackUsedFields += 1;
+          }
+          if (tokenResult.migrated) {
+            migrationStats.migratedFields += 1;
+            if (tokenResult.usedFallback) {
+              migrationStats.migratedBySource[tokenResult.usedFallback] += 1;
+            }
           }
-        }
 
-        if (quotaResult.value) {
-          migrationStats.totalFields += 1;
-        }
-        if (quotaResult.usedFallback) {
-          migrationStats.fallbackUsedFields += 1;
-        }
-        if (quotaResult.migrated) {
-          migrationStats.migratedFields += 1;
+          if (quotaResult.value) {
+            migrationStats.totalFields += 1;
+          }
           if (quotaResult.usedFallback) {
-            migrationStats.migratedBySource[quotaResult.usedFallback] += 1;
+            migrationStats.fallbackUsedFields += 1;
+          }
+          if (quotaResult.migrated) {
+            migrationStats.migratedFields += 1;
+            if (quotaResult.usedFallback) {
+              migrationStats.migratedBySource[quotaResult.usedFallback] += 1;
+            }
           }
-        }
 
-        cloudAccounts.push({
-          id: normalizedRow.id,
-          provider: normalizedRow.provider as CloudAccount['provider'],
-          email: normalizedRow.email,
-          name: normalizedRow.name ?? undefined,
-          avatar_url: normalizedRow.avatarUrl ?? undefined,
-          token: JSON.parse(tokenResult.value),
-          quota: quotaResult.value ? JSON.parse(quotaResult.value) : undefined,
-          device_profile: parseDeviceProfileColumn(normalizedRow.deviceProfileJson),
-          device_history: parseDeviceHistoryColumn(normalizedRow.deviceHistoryJson),
-          created_at: normalizedRow.createdAt,
-          last_used: normalizedRow.lastUsed,
-          status: (normalizedRow.status as CloudAccount['status']) ?? undefined,
-          is_active: Boolean(normalizedRow.isActive),
-        });
+          cloudAccounts.push({
+            id: normalizedRow.id,
+            provider: normalizedRow.provider as CloudAccount['provider'],
+            email: normalizedRow.email,
+            name: normalizedRow.name ?? undefined,
+            avatar_url: normalizedRow.avatarUrl ?? undefined,
+            token: JSON.parse(tokenResult.value),
+            quota: quotaResult.value ? JSON.parse(quotaResult.value) : undefined,
+            device_profile: parseDeviceProfileColumn(normalizedRow.deviceProfileJson),
+            device_history: parseDeviceHistoryColumn(normalizedRow.deviceHistoryJson),
+            created_at: normalizedRow.createdAt,
+            last_used: normalizedRow.lastUsed,
+            status: (normalizedRow.status as CloudAccount['status']) ?? undefined,
+            is_active: Boolean(normalizedRow.isActive),
+            proxy_url: normalizedRow.proxyUrl ?? undefined,
+          });
+        } catch (rowError) {
+          logger.error(`Unexpected error processing row for account ${normalizedRow.id}`, rowError);
+          continue;
+        }
       }
 
       return cloudAccounts;
@@ -649,6 +669,7 @@ export class CloudAccountRepo {
         last_used: normalizedRow.lastUsed,
         status: (normalizedRow.status as CloudAccount['status']) ?? undefined,
         is_active: Boolean(normalizedRow.isActive),
+        proxy_url: normalizedRow.proxyUrl ?? undefined,
       };
     } finally {
       raw.close();
@@ -666,22 +687,42 @@ export class CloudAccountRepo {
   }
 
   static async updateToken(id: string, token: any): Promise<void> {
+    // Validate token data before encryption
+    CloudTokenDataSchema.parse(token);
+
     const { raw, orm } = getCloudDb();
 
     try {
       const encrypted = await encrypt(JSON.stringify(token));
-      orm.update(accounts).set({ tokenJson: encrypted }).where(eq(accounts.id, id)).run();
+      const result = orm
+        .update(accounts)
+        .set({ tokenJson: encrypted })
+        .where(eq(accounts.id, id))
+        .run();
+      if (result.changes === 0) {
+        logger.warn(`updateToken: No account found with ID ${id}`);
+      }
     } finally {
       raw.close();
     }
   }
 
   static async updateQuota(id: string, quota: any): Promise<void> {
+    // Validate quota data before encryption
+    CloudQuotaDataSchema.parse(quota);
+
     const { raw, orm } = getCloudDb();
 
     try {
       const encrypted = await encrypt(JSON.stringify(quota));
-      orm.update(accounts).set({ quotaJson: encrypted }).where(eq(accounts.id, id)).run();
+      const result = orm
+        .update(accounts)
+        .set({ quotaJson: encrypted })
+        .where(eq(accounts.id, id))
+        .run();
+      if (result.changes === 0) {
+        logger.warn(`updateQuota: No account found with ID ${id}`);
+      }
     } finally {
       raw.close();
     }
@@ -911,6 +952,24 @@ export class CloudAccountRepo {
     }
   }
 
+  static setAccountProxy(id: string, proxyUrl: string | null): void {
+    const { raw, orm } = getCloudDb();
+    try {
+      orm.update(accounts).set({ proxyUrl }).where(eq(accounts.id, id)).run();
+      logger.info(`Updated proxy for account ${id}: ${proxyUrl ?? 'none'}`);
+    } catch (error) {
+      logger.error(`Failed to update proxy for account ${id}`, error);
+      throw error;
+    } finally {
+      raw.close();
+    }
+  }
+
+  static async getAccountByEmail(email: string): Promise<CloudAccount | null> {
+    const all = await this.getAccounts();
+    return all.find((a) => a.email.toLowerCase() === email.toLowerCase()) || null;
+  }
+
   private static upsertItemValue(db: DrizzleExecutor, key: string, value: string): void {
     db.insert(itemTable)
       .values({ key, value })

src/ipc/database/schema.ts

@@ -12,8 +12,9 @@ export const accounts = sqliteTable('accounts', {
   deviceHistoryJson: text('device_history_json'),
   createdAt: integer('created_at').notNull(),
   lastUsed: integer('last_used').notNull(),
-  status: text('status'),
+  status: text('status', { enum: ['active', 'rate_limited', 'expired'] }).default('active'),
   isActive: integer('is_active').notNull().default(0),
+  proxyUrl: text('proxy_url'),
 });
 
 export const settings = sqliteTable('settings', {

src/ipc/process/handler.ts

@@ -73,19 +73,17 @@ export async function isProcessRunning(): Promise<boolean> {
     const currentPid = process.pid;
 
     // Use find-process to search for Antigravity processes
-    // 'name' search type matches process name
-    const processMap = new Map<number, ProcessInfo>();
+    const allMatches: ProcessInfo[] = [];
     const searchNames = ['Antigravity', 'antigravity'];
+    if (platform === 'linux') {
+      searchNames.push('electron');
+    }
     let sawNoMatch = false;
 
     for (const searchName of searchNames) {
       try {
-        const matches = await findProcess('name', searchName, true);
-        for (const proc of matches) {
-          if (typeof proc.pid === 'number') {
-            processMap.set(proc.pid, proc);
-          }
-        }
+        const matches = await findProcess('name', searchName, false);
+        allMatches.push(...matches);
       } catch (error) {
         if (isPgrepNoMatchError(error)) {
           sawNoMatch = true;
@@ -95,6 +93,13 @@ export async function isProcessRunning(): Promise<boolean> {
       }
     }
 
+    const processMap = new Map<number, ProcessInfo>();
+    for (const proc of allMatches) {
+      if (typeof proc.pid === 'number') {
+        processMap.set(proc.pid, proc);
+      }
+    }
+
     const processes = Array.from(processMap.values());
     if (processes.length === 0 && sawNoMatch) {
       logger.debug('No Antigravity process found (pgrep returned 1)');
@@ -145,7 +150,27 @@ export async function isProcessRunning(): Promise<boolean> {
           return true;
         }
       } else {
-        // Linux: Check for antigravity in name or path (but not tools)
+        const nameLower = name.toLowerCase();
+        const cmdLower = cmd.toLowerCase();
+
+        if (nameLower === 'electron') {
+          // Stricter check for AUR/Electron wrapper:
+          // Must include antigravity in command line but NOT manager or tools
+          const isAntigravityApp =
+            (cmdLower.includes('/antigravity') ||
+              cmdLower.includes(' antigravity') ||
+              cmdLower.endsWith('antigravity')) &&
+            !cmdLower.includes('manager') &&
+            !cmdLower.includes('tools');
+
+          if (isAntigravityApp) {
+            logger.debug(
+              `Found Antigravity (AUR/electron) process: PID=${proc.pid}, name=${name}, cmd=${cmd.substring(0, 100)}`,
+            );
+            return true;
+          }
+        }
+
         if (
           (name.includes('antigravity') || cmd.includes('/antigravity')) &&
           !name.includes('tools')