fix: address review feedback and code scanning alerts

src/web/api.ts

@@ -208,7 +208,7 @@ async function proxyTestStreamRequest(data: ProxyTestRequestEnvelope, signal?: A
     clearAuthSession(localStorage);
     throw new Error('Session expired');
   }
-  return fetch('/api/test/proxy/stream', {
+  const response = await fetch('/api/test/proxy/stream', {
     method: 'POST',
     signal,
     headers: {
@@ -217,6 +217,11 @@ async function proxyTestStreamRequest(data: ProxyTestRequestEnvelope, signal?: A
     },
     body: JSON.stringify(data),
   });
+  if (response.status === 401 || response.status === 403) {
+    clearAuthSession(localStorage);
+    throw new Error('Session expired');
+  }
+  return response;
 }
 
 export type ProxyTestJobResponse = {

src/web/pages/helpers/accountConnection.test.ts

@@ -10,6 +10,11 @@ describe('accountConnection helpers', () => {
     expect(resolveAccountCredentialMode({ credentialMode: 'apikey' })).toBe('apikey');
     expect(resolveAccountCredentialMode({ capabilities: { proxyOnly: true } })).toBe('apikey');
     expect(resolveAccountCredentialMode({ accessToken: ' session-token ' })).toBe('session');
+    expect(resolveAccountCredentialMode({
+      credentialMode: 'session',
+      capabilities: { proxyOnly: true },
+      accessToken: 'api-token-ignored-by-explicit-mode',
+    })).toBe('session');
     expect(resolveAccountCredentialMode({})).toBe('apikey');
   });
 
@@ -17,6 +22,9 @@ describe('accountConnection helpers', () => {
     expect(parsePositiveInt('42')).toBe(42);
     expect(parsePositiveInt(' 0 ')).toBe(0);
     expect(parsePositiveInt('abc')).toBe(0);
+    expect(parsePositiveInt('42abc')).toBe(0);
+    expect(parsePositiveInt('1e3')).toBe(0);
+    expect(parsePositiveInt('1.5')).toBe(0);
     expect(parsePositiveInt(null)).toBe(0);
   });
 

src/web/pages/helpers/accountConnection.ts

@@ -11,7 +11,9 @@ export function resolveAccountCredentialMode(account: any): 'session' | 'apikey'
 }
 
 export function parsePositiveInt(input: string | null): number {
-  const value = Number.parseInt(String(input || '').trim(), 10);
+  const normalized = String(input || '').trim();
+  if (!/^\d+$/.test(normalized)) return 0;
+  const value = Number.parseInt(normalized, 10);
   if (!Number.isFinite(value) || value <= 0) return 0;
   return value;
 }

src/web/pages/helpers/conversationFileCapabilities.test.ts

@@ -75,5 +75,9 @@ describe('resolveConversationFileCapability', () => {
       filename: 'voice.mp3',
       mimeType: 'audio/mpeg',
     })).toBe(false);
+    expect(isConversationUploadedFileSupported(claudeCapability, {
+      filename: 'paper.pdf',
+      mimeType: 'application/octet-stream',
+    })).toBe(true);
   });
 });

src/web/pages/token-routes/utils.ts

@@ -65,7 +65,7 @@ export function isRouteExactModel(route: Pick<RouteRow | RouteSummaryRow, 'model
   return !isExplicitGroupRoute(route) && isExactModelPattern(route.modelPattern);
 }
 
-export function parseRegexModelPattern(modelPattern: string): { regex: RegExp | null; error: string | null } {
+export function parseRegexModelPattern(modelPattern: string): { regex: { test(value: string): boolean } | null; error: string | null } {
   return parseTokenRouteRegexPattern(modelPattern);
 }