@flame0510/project-aether 1.1.12 → 1.1.13

package/model-pricing.json

@@ -40,8 +40,8 @@
     "output": 8.0
   },
   "openrouter/auto": {
-    "input": -1,
-    "output": -1
+    "input": -1.0,
+    "output": -1.0
   },
   "google/gemini-3.1-pro-preview": {
     "input": 2.0,
@@ -124,8 +124,8 @@
     "output": 2.2
   },
   "glm/glm-4.7-flash": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "glm/glm-4.7-flashx": {
     "input": 0.07,
@@ -136,8 +136,8 @@
     "output": 4.0
   },
   "glm/glm-4.6v-flash": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "qwen/qwen3.7-max": {
     "input": 0.83,
@@ -160,36 +160,36 @@
     "output": 0.28
   },
   "groq/llama-3.1-8b-instant": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "groq/llama-3.3-70b-versatile": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "openrouter/deepseek/deepseek-v4-flash": {
-    "input": 0.14,
-    "output": 0.28
+    "input": 0.04886,
+    "output": 0.09772
   },
   "openrouter/google/gemini-2.5-flash": {
-    "input": 0.075,
-    "output": 0.3
+    "input": 0.3,
+    "output": 2.5
   },
   "openrouter/google/gemini-2.5-pro": {
     "input": 1.25,
-    "output": 5.0
+    "output": 10.0
   },
   "openrouter/anthropic/claude-sonnet-4.6": {
     "input": 3.0,
     "output": 15.0
   },
   "openrouter/deepseek/deepseek-v4-pro": {
-    "input": 0.43,
-    "output": 0.87
+    "input": 0.396894,
+    "output": 0.793788
   },
   "openrouter/qwen/qwen3.7-max": {
-    "input": 1.48,
-    "output": 4.42
+    "input": 1.475,
+    "output": 4.425
   },
   "openrouter/qwen/qwen3.7-plus": {
     "input": 0.32,
@@ -200,16 +200,16 @@
     "output": 0.13
   },
   "openrouter/qwen/qwen3.6-plus": {
-    "input": 0.33,
+    "input": 0.325,
     "output": 1.95
   },
   "openrouter/qwen/qwen3.6-flash": {
-    "input": 0.19,
-    "output": 1.12
+    "input": 0.1875,
+    "output": 1.125
   },
   "openrouter/qwen/qwen3.6-27b": {
-    "input": 0.29,
-    "output": 2.4
+    "input": 0.6,
+    "output": 3.6
   },
   "openrouter/qwen/qwen3.6-35b-a3b": {
     "input": 0.14,
@@ -228,7 +228,7 @@
     "output": 3.9
   },
   "openrouter/qwen/qwen3-next-80b-a3b-instruct": {
-    "input": 0.09,
+    "input": 0.1,
     "output": 1.1
   },
   "openrouter/qwen/qwen3-next-80b-a3b-thinking": {
@@ -244,20 +244,20 @@
     "output": 6.0
   },
   "openrouter/qwen/qwen3.6-max-preview": {
-    "input": 1.03,
-    "output": 6.16
+    "input": 1.027,
+    "output": 6.162
   },
   "openrouter/minimax/minimax-m3": {
     "input": 0.3,
     "output": 1.2
   },
   "openrouter/moonshotai/kimi-k2.7-code": {
-    "input": 0.73,
-    "output": 3.5
+    "input": 0.67,
+    "output": 3.4
   },
   "openrouter/moonshotai/kimi-k2.6": {
-    "input": 0.59,
-    "output": 2.48
+    "input": 0.95,
+    "output": 4.0
   },
   "openrouter/moonshotai/kimi-k2": {
     "input": 0.57,
@@ -272,16 +272,16 @@
     "output": 15.0
   },
   "openrouter/z-ai/glm-5.2": {
-    "input": 0.76,
-    "output": 2.42
+    "input": 0.966,
+    "output": 3.036
   },
   "openrouter/z-ai/glm-5.1": {
-    "input": 0.97,
-    "output": 3.04
+    "input": 0.966,
+    "output": 3.036
   },
   "openrouter/z-ai/glm-5": {
-    "input": 0.95,
-    "output": 2.55
+    "input": 0.6,
+    "output": 1.92
   },
   "openrouter/z-ai/glm-5v-turbo": {
     "input": 1.2,
@@ -308,15 +308,15 @@
     "output": 0.3
   },
   "openrouter/tencent/hy3": {
-    "input": 0.13,
-    "output": 0.53
+    "input": 0.132,
+    "output": 0.528
   },
   "openrouter/tencent/hy3-preview": {
-    "input": 0.06,
-    "output": 0.21
+    "input": 0.18,
+    "output": 0.6
   },
   "openrouter/xiaomi/mimo-v2.5-pro": {
-    "input": 0.43,
+    "input": 0.435,
     "output": 0.87
   },
   "openrouter/xiaomi/mimo-v2.5": {
@@ -384,7 +384,7 @@
     "output": 3.2
   },
   "openrouter/nvidia/nemotron-3-super-120b-a12b": {
-    "input": 0.08,
+    "input": 0.085,
     "output": 0.4
   },
   "openrouter/nvidia/nemotron-3-ultra-550b-a55b": {
@@ -396,7 +396,7 @@
     "output": 3.0
   },
   "openrouter/thinkingmachines/inkling": {
-    "input": 1.0,
+    "input": 0.95,
     "output": 4.05
   },
   "openrouter/relace/relace-apply-3": {
@@ -416,8 +416,8 @@
     "output": 12.0
   },
   "openrouter/google/gemini-3.6-flash": {
-    "input": 1.5,
-    "output": 7.5
+    "input": 0.75,
+    "output": 3.75
   },
   "openrouter/anthropic/claude-opus-5": {
     "input": 5.0,
@@ -436,12 +436,12 @@
     "output": 25.0
   },
   "openrouter/openai/gpt-5.6-sol": {
-    "input": 5.0,
-    "output": 30.0
+    "input": 2.0,
+    "output": 10.0
   },
   "openrouter/openai/gpt-5.6-luna": {
-    "input": 0.1,
-    "output": 0.6
+    "input": 0.2,
+    "output": 1.2
   },
   "openrouter/openai/gpt-5.4-mini": {
     "input": 0.75,

package/models.config.json

@@ -796,7 +796,7 @@
       "name": "Kimi K3 (OR)",
       "provider": "openrouter",
       "enabled": false,
-      "modality": "text+image->text"
+      "modality": "text+image+video->text"
     },
     {
       "id": "openrouter/amazon/nova-premier-v1",
@@ -841,4 +841,4 @@
       "modality": "text+image->text"
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flame0510/project-aether",
-  "version": "1.1.12",
+  "version": "1.1.13",
   "description": "Rev4a — Revolution for Agents. OpenClaw agent fleet orchestrator.",
   "keywords": [
     "openclaw",
@@ -38,6 +38,8 @@
     "lineage.js",
     "terminal-ws-server.js",
     "package.json",
+    "proxy.ts",
+    "instrumentation.ts",
     "next.config.mjs",
     "tsconfig.json",
     "next-env.d.ts",
@@ -51,6 +53,7 @@
     "build": "next build",
     "start": "rev4a serve",
     "start:all": "rev4a serve",
+    "refresh:pricing": "node scripts/refresh-model-pricing.mjs",
     "smoke:db-bootstrap": "node scripts/smoke-db-bootstrap.mjs",
     "postinstall": "node bin/postinstall.js"
   },

package/proxy.ts

@@ -0,0 +1,68 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import { jwtVerify } from 'jose';
+import { getJwtSecret } from '@/lib/rev4a-auth';
+
+/* ------------------------------------------------------------------ */
+/*  Public routes — no auth required                                  */
+/* ------------------------------------------------------------------ */
+const PUBLIC_PREFIXES = ['/login', '/setup'];
+
+/* ------------------------------------------------------------------ */
+/*  Bypass — static assets and APIs have their own auth               */
+/* ------------------------------------------------------------------ */
+function isStaticOrApi(pathname: string): boolean {
+  return (
+    pathname.startsWith('/_next') ||
+    pathname.startsWith('/api') ||
+    pathname.startsWith('/favicon') ||
+    pathname.startsWith('/icon') ||
+    pathname.startsWith('/apple-touch') ||
+    pathname.startsWith('/rev4a-logo') ||
+    pathname.startsWith('/manifest') ||
+    pathname.includes('.') // file extensions (png, svg, ico, etc.)
+  );
+}
+
+/* ------------------------------------------------------------------ */
+/*  Proxy (formerly middleware — Next.js 16 renamed the convention;   */
+/*  runs on Node.js runtime by default now, so it shares the same     */
+/*  env+file secret resolution as every API route instead of its own */
+/*  env-only copy.)                                                    */
+/* ------------------------------------------------------------------ */
+export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  // Public routes
+  if (PUBLIC_PREFIXES.some((p) => pathname.startsWith(p))) {
+    return NextResponse.next();
+  }
+
+  // Static assets & API routes
+  if (isStaticOrApi(pathname)) {
+    return NextResponse.next();
+  }
+
+  // Protected route — verify JWT
+  const token = request.cookies.get('rev4a_token')?.value;
+  if (!token) {
+    const loginUrl = new URL('/login', request.url);
+    return NextResponse.redirect(loginUrl);
+  }
+
+  try {
+    const secret = new TextEncoder().encode(getJwtSecret());
+    await jwtVerify(token, secret);
+    return NextResponse.next();
+  } catch {
+    const loginUrl = new URL('/login', request.url);
+    return NextResponse.redirect(loginUrl);
+  }
+}
+
+/* ------------------------------------------------------------------ */
+/*  Matcher — only run on page routes, skip Next.js internals         */
+/* ------------------------------------------------------------------ */
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+};

package/scripts/refresh-model-pricing.mjs

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * Refresh model-pricing.json and models.config.json from the live OpenRouter
+ * catalogue.
+ *
+ * Why this exists: both files are maintained by hand and drift. When this was
+ * written, 16 of 79 OpenRouter entries had stale prices — google/gemini-2.5-flash
+ * understated the real cost by ~8x. The dashboard reads these files, and so does
+ * daemon.js when it writes cost_usd rows, so a wrong number here is a wrong
+ * number in every spend figure the product reports.
+ *
+ * SCOPE — deliberately limited to `openrouter/*` models.
+ *   OpenRouter resells models we also offer direct (openai, anthropic, google,
+ *   deepseek, qwen). Their rates are NOT the same: at time of writing 8 of the
+ *   25 overlapping models differ — openai/gpt-5.6-sol is $5/$30 direct in our
+ *   file but $2/$10 on OpenRouter. We can't tell from OpenRouter's catalogue
+ *   what the direct vendor charges, so those entries are left alone. Keep them
+ *   updated by hand from each provider's own pricing page.
+ *
+ * The endpoint is public — no API key, CDN-cached, never billed.
+ *
+ * Usage:
+ *   node scripts/refresh-model-pricing.mjs            # apply
+ *   node scripts/refresh-model-pricing.mjs --dry-run  # preview only
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PRICING_FILE = path.join(ROOT, 'model-pricing.json');
+const MODELS_FILE = path.join(ROOT, 'models.config.json');
+const CATALOGUE_URL = 'https://openrouter.ai/api/v1/models';
+
+const dryRun = process.argv.includes('--dry-run');
+
+function perMillion(raw) {
+  if (raw === undefined || raw === null) return null;
+  const n = parseFloat(raw);
+  // -1 marks router models (OpenRouter Auto): dynamic, not a real price.
+  if (!Number.isFinite(n) || n < 0) return null;
+  return n * 1_000_000;
+}
+
+/** Round to the precision the file already uses, so we don't churn on float noise. */
+function round(n) {
+  return Math.round(n * 1e6) / 1e6;
+}
+
+/**
+ * Serialise model-pricing.json preserving its `5.0` style for whole numbers.
+ * JSON.stringify writes `5`, which is the same value but rewrites ~114 lines
+ * that didn't change — burying the handful of real price moves in noise and
+ * making the diff unreviewable on every run.
+ */
+function serialisePricing(pricing) {
+  const num = (n) => (Number.isInteger(n) ? n.toFixed(1) : String(n));
+  const body = Object.entries(pricing)
+    .map(([id, p]) => `  ${JSON.stringify(id)}: {\n    "input": ${num(p.input)},\n    "output": ${num(p.output)}\n  }`)
+    .join(',\n');
+  return `{\n${body}\n}\n`;
+}
+
+/**
+ * Our catalogue namespaces OpenRouter entries as `openrouter/<upstream id>`,
+ * but OpenRouter also publishes house models under a literal `openrouter/`
+ * vendor prefix (openrouter/auto). Try the stripped form, then the id as-is.
+ */
+function upstreamCandidates(id) {
+  const stripped = id.slice('openrouter/'.length);
+  return stripped === id ? [id] : [stripped, id];
+}
+
+async function main() {
+  console.log(`Fetching ${CATALOGUE_URL} …`);
+  const res = await fetch(CATALOGUE_URL, { headers: { accept: 'application/json' } });
+  if (!res.ok) {
+    console.error(`✗ Catalogue returned HTTP ${res.status}`);
+    process.exit(1);
+  }
+  const body = await res.json();
+  if (!Array.isArray(body?.data) || body.data.length === 0) {
+    console.error('✗ Unexpected catalogue shape');
+    process.exit(1);
+  }
+  const live = new Map(body.data.map((m) => [m.id, m]));
+  console.log(`  ${live.size} models upstream\n`);
+
+  const modelsDoc = JSON.parse(fs.readFileSync(MODELS_FILE, 'utf-8'));
+  const models = Array.isArray(modelsDoc) ? modelsDoc : modelsDoc.models;
+  const pricing = JSON.parse(fs.readFileSync(PRICING_FILE, 'utf-8'));
+
+  const priceChanges = [];
+  const modalityChanges = [];
+  let missing = 0;
+  let dynamic = 0;
+
+  for (const m of models) {
+    if (m.provider !== 'openrouter') continue;
+
+    let up = null;
+    for (const candidate of upstreamCandidates(m.id)) {
+      if (live.has(candidate)) { up = live.get(candidate); break; }
+    }
+    if (!up) {
+      missing++;
+      console.log(`  ? ${m.id} — not in the upstream catalogue, left as-is`);
+      continue;
+    }
+
+    // Pricing
+    const input = perMillion(up.pricing?.prompt);
+    const output = perMillion(up.pricing?.completion);
+    if (input === null || output === null) {
+      dynamic++; // router model — keep whatever the file says (-1/-1)
+    } else {
+      const current = pricing[m.id];
+      const next = { input: round(input), output: round(output) };
+      if (!current || current.input !== next.input || current.output !== next.output) {
+        priceChanges.push({
+          id: m.id,
+          from: current ? `$${current.input}/$${current.output}` : '(none)',
+          to: `$${next.input}/$${next.output}`,
+        });
+        pricing[m.id] = next;
+      }
+    }
+
+    // Modality — updating the curated file (rather than overriding at runtime)
+    // keeps the UI and app/api/gateway/sync.ts, which provisions containers
+    // from this same value, in agreement.
+    const upModality = up.architecture?.modality;
+    if (upModality && upModality !== m.modality) {
+      modalityChanges.push({ id: m.id, from: m.modality ?? '(none)', to: upModality });
+      m.modality = upModality;
+    }
+  }
+
+  console.log(`\nPricing:  ${priceChanges.length} changed`);
+  for (const c of priceChanges) console.log(`  ${c.id}\n      ${c.from}  →  ${c.to}`);
+
+  console.log(`\nModality: ${modalityChanges.length} changed`);
+  for (const c of modalityChanges) console.log(`  ${c.id}\n      ${c.from}  →  ${c.to}`);
+
+  const direct = models.filter((m) => m.provider !== 'openrouter').length;
+  console.log(
+    `\nSkipped:  ${dynamic} dynamic (router), ${missing} not upstream, ` +
+    `${direct} direct-provider (different vendor, different rates — update by hand)`,
+  );
+
+  if (priceChanges.length === 0 && modalityChanges.length === 0) {
+    console.log('\n✓ Already up to date.');
+    return;
+  }
+
+  if (dryRun) {
+    console.log('\n(dry run — nothing written)');
+    return;
+  }
+
+  fs.writeFileSync(PRICING_FILE, serialisePricing(pricing), 'utf-8');
+  fs.writeFileSync(MODELS_FILE, JSON.stringify(modelsDoc, null, 2) + '\n', 'utf-8');
+  console.log('\n✓ Wrote model-pricing.json and models.config.json');
+  console.log('  Review the diff before committing.');
+}
+
+main().catch((e) => {
+  console.error(`✗ ${e.message}`);
+  process.exit(1);
+});

package/lib/auth.ts

@@ -1,28 +0,0 @@
-import { NextResponse, type NextRequest } from 'next/server';
-import { jwtVerify } from 'jose';
-import { TOKEN } from '@/lib/db';
-
-const JWT_SECRET = new TextEncoder().encode(
-  process.env.REV4A_JWT_SECRET ?? 'rev4a-jwt-secret-change-in-prod',
-);
-
-export async function requireBrowserAuth(request: NextRequest): Promise<NextResponse | null> {
-  const token = new URL(request.url).searchParams.get('token');
-  const auth = request.headers.get('authorization');
-
-  if (token === TOKEN || auth === `Bearer ${TOKEN}`) {
-    return null;
-  }
-
-  const cookieToken = request.cookies.get('rev4a_token')?.value;
-  if (cookieToken) {
-    try {
-      await jwtVerify(cookieToken, JWT_SECRET);
-      return null;
-    } catch {
-      // Fall through to unauthorized.
-    }
-  }
-
-  return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-}

package/lib/requireAuth.tsx

@@ -1,38 +0,0 @@
-import { cookies } from 'next/headers';
-import { redirect } from 'next/navigation';
-import { jwtVerify } from 'jose';
-import * as fs from 'fs';
-import { ENV_FILE } from './rev4a-paths';
-
-function getJwtSecret(): Uint8Array {
-  const fromEnv = process.env.REV4A_JWT_SECRET;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) {
-    return new TextEncoder().encode(fromEnv);
-  }
-  // Fallback: read from persistent .env
-  try {
-    if (fs.existsSync(ENV_FILE)) {
-      const content = fs.readFileSync(ENV_FILE, 'utf-8');
-      const match = content.match(/^REV4A_JWT_SECRET=(.*)$/m);
-      if (match && match[1].trim()) {
-        return new TextEncoder().encode(match[1].trim());
-      }
-    }
-  } catch { /* ignore */ }
-  return new TextEncoder().encode('');
-}
-
-export async function requireAuth(): Promise<void> {
-  const cookieStore = await cookies();
-  const token = cookieStore.get('rev4a_token')?.value;
-
-  if (token) {
-    try {
-      await jwtVerify(token, getJwtSecret());
-      return;
-    } catch {
-      // Invalid — redirect
-    }
-  }
-  redirect('/login');
-}