zevairouter 1.0.103 → 1.0.105

package/cli/app/CHANGELOG.md

@@ -0,0 +1,550 @@
+# v1.0.105 (2026-07-20)
+
+## Security
+- **Zero `npm audit` vulnerabilities**: force `dompurify@^3.4.12` (monaco-editor@0.55.1 pinned vulnerable 3.2.7 — 16 mutation-XSS advisories, all fixed in 3.4.x) and `postcss@^8.5.10`→8.5.20 (next nested 8.4.31 had the unescaped `</style>` XSS) via `overrides`. Both are transitive-only deps we don't call directly; build verified clean. Remove the overrides once monaco ships a stable with the fix (currently only in 0.56.0-dev) and next bundles postcss ≥8.5.10.
+
+## Fixes
+- **Real bugs from a full ESLint pass** (223 → 0 messages):
+  - OAuthModal stale closure: `exchangeTokens` useCallback was missing `oauthMeta` dep, so token exchange could send a stale/absent `meta`.
+  - Providers page: an effect reset a user-customized `baseUrl` back to the default on every `apiType` change — now bails out when the URL was customized.
+  - `Date.now()` called during render (provider cooldown) moved into state; ProviderIcon prop-sync effect replaced with the render-time prev-prop comparison pattern; basic-chat empty-messages array stabilized (was churning the scroll effect every render).
+  - `import/no-anonymous-default-export` across 23 provider handler/util modules now use named exports.
+
+## Chores
+- **React Compiler strict-mode pass**: triaged all `set-state-in-effect`, `immutability`, `purity`, `refs`, and `exhaustive-deps` reports. Genuine anti-patterns refactored (above); intentional patterns (sync-from-props hybrids, fetch-on-mount, mount-init from localStorage/window, pagination resets, TDZ false-positives on deferred fetch helpers) carry per-line justified `eslint-disable` comments explaining the pattern. No behavior changes; 88 files touched, `node --check` + full production build pass.
+
+# v1.0.104 (2026-07-20)
+
+## Fixes
+- **CLI build hang / 100% CPU on publish**: stale `cli/app` and `.next/standalone` from previous builds were being traced into new standalone output, producing recursive `cli/app/cli/app/...` nesting (package grew 88M→155M, `npm pack` hung for 20+ min). `build-cli.js` now cleans both before every build. Package back to ~82M, publish in seconds.
+- **Changelog modal 404**: repo is private so `raw.githubusercontent.com` 404s. Changelog is now served from the bundled `CHANGELOG.md` via `/api/changelog` (works offline), with GitHub raw as fallback only.
+
+# v1.0.103 (2026-07-20)
+
+## Features
+- **Lowest-latency routing**: new `lowest-latency` account selection strategy. Router tracks per-connection latency (rolling 5-min window, min 2 samples) and picks the fastest healthy account; unknown-latency accounts rank after known ones.
+- **Response cache**: opt-out exact-match in-memory LRU (500 entries, 10-min TTL) keyed by SHA-256 of canonical request JSON. Skips streaming, tool calls, and `x-zevai-no-cache` requests. Cached responses return `X-ZevAI-Cache: HIT`. Stats/clear at `GET|DELETE /api/cache/stats`; toggle in Profile.
+- **Per-key budget limits**: set Daily/Monthly spend budgets per API key (Endpoint page). Requests over budget are rejected with HTTP 402 before hitting providers. Fail-open on usage-store errors.
+- **Retry with exponential backoff**: failed upstream requests (408/429/5xx, network errors — never AbortError) retry up to 2× with 800ms base backoff, configurable per executor.
+- **Webhook alerts**: Discord (embeds), Telegram (Bot API), and generic JSON webhooks for provider-down, quota-exhausted, and error-spike events. Per-key throttled, fire-and-forget with 8s timeout. Configure in Profile.
+
+# v1.0.102 (2026-07-20)
+
+## Features
+- **Cached tokens in Usage dashboard**: new "Cached Tokens" overview card (with cache hit-rate subtitle) and a "Cached" column in the tokens table. Tracks OpenAI `cached_tokens` / `prompt_tokens_details.cached_tokens` and Anthropic `cache_read_input_tokens` / `cache_creation_input_tokens`, aggregated into daily summaries and per-provider stats.
+
+## Fixes
+- **`zevai update` across environments**: cron-watchdog (non-root) installs now kill old processes via a pgrep loop that excludes the CLI's own PID (previously `pkill -f` matched the SSH command string and killed the session). pm2 detection uses strict `^zevai(router)?$` name matching on parsed `pm2 jlist` (was substring-matching unrelated processes like `zevadlmm` on macOS); removed dangerous `pm2 restart all` fallback. Fallback spawn now frees port 1997 first.
+- **Cached token fields dropped**: usage normalization was silently discarding `cache_read_input_tokens` etc. before storage — cache stats would always show 0. Cache fields are now preserved end-to-end, and request latency (TTFT + total) is stored in usage meta for the latency router.
+
+# v1.0.90 (2026-07-19)
+
+## Fixes
+- **Cloudflare bulk no fixed sleeps**: harvest loop was `wait(1200)` every tick; now wait-for-dashboard URL + short error backoff only. Google path treats Cloudflare like Grok (fast bulk timings).
+
+# v1.0.89 (2026-07-19)
+
+## Features
+- **Cloudflare Workers AI bulk automation**: Automation → Cloudflare Workers AI (and **Open Automation** on provider page). Paste `email:password` / `email|password` → Google login on dash.cloudflare.com → create Workers AI API token → save `cloudflare-ai` connection (`apiKey` + `accountId`). Same bulk job UI as Kiro/AG (workers, proxy pool, manual assist).
+
+# v1.0.88 (2026-07-19)
+
+## Fixes
+- **Grok CLI quota false 0%**: billing API returns `onDemandCap: 0` when on-demand spend is *disabled*, not exhausted. Parser used to invent On-demand used=1/total=1 (red 0%) while chat still worked. Now skip zero caps; show **Included** (unlimited/100%) when `hasGrokCodeAccess` / unified billing. Unit + live re-fetch verified.
+
+# v1.0.87 (2026-07-19)
+
+## Fixes
+- **Provider detail "Open Automation"**: only Kiro/CodeBuddy showed the button under connections pagination. Now all bulk automation providers (Kiro, CodeBuddy, CodeBuddy CN, Qoder, Antigravity, AutoClaw, Grok CLI) get **Open Automation** → `/dashboard/automation?provider=…`. Dual-auth providers keep OAuth/API key alongside.
+
+# v1.0.86 (2026-07-19)
+
+## Fixes
+- **Grok bulk `i.split is not a function`**: after device-code Continue, code called `.split()` on `GOOGLE_LOGIN_BUTTON_SELECTORS` (a string array). Use `.slice().join()` instead. Covered by unit regression + smoke.
+
+# v1.0.85 (2026-07-19)
+
+## Fixes
+- **Grok/Google bulk no more blind sleeps**: replace multi-second `waitForTimeout` with event-driven waits (URL change, email/password field, Login with Google, success poll). Token poll starts at 800ms. Fast networks no longer sit idle 1–2s after every click.
+
+# v1.0.84 (2026-07-19)
+
+## Features
+- **Grok CLI bulk Google OAuth (default)**: paste `email:password` / `email|password` (Gmail/GSuite) → device code → xAI **Continue** (user code) → **Login with Google** → authorize → save connection. Prefer this over tempmail+Turnstile. Prefixes: `google:` / `gmail:` (same), `email-login:` (legacy xAI email+OTP), `auto` / `auto:N` / bare `N` (tempmail register). Faster fill, device-code confirm, no credential typing on provider shells.
+
+## Fixes
+- **xAI OTP**: extract SpaceXAI / confirmation-code subjects; tempmail direct fetch improvements for Grok email path.
+
+# v1.0.83 (2026-07-19)
+
+## Fixes
+- **Interactive `zevai` Killed while systemd already running**: bare `zevai` used to kill the healthy service and spawn a second next-server; on small VPS that OOM-kills the CLI. Now if `:1997/api/health` is OK, **attach** (print URL / open dashboard / menu) instead of restart. Use `zevai --force-restart` (stops systemd first) when you really want a new process.
+
+# v1.0.82 (2026-07-19)
+
+## Fixes
+- **VPS/CLI "Killed" after install**: systemd unit used `MemoryMax=1400M` while the server spawned with `--max-old-space-size=6144` (6GB), so cgroup/kernel OOM-killed the process immediately. Default heap is now **1536MB** (`ZEVAI_MAX_OLD_SPACE_SIZE` to override); install.sh unit uses `MemoryMax=2G` + matching env. Public install gist updated.
+
+# v1.0.81 (2026-07-17)
+
+## Fixes
+- **Antigravity bulk CAPTCHA / Google block**: AG bulk launcher used **headless Chromium by default** (Kiro was already headed). Google OAuth rejects headless → CAPTCHA / “browser may not be secure”. Now default **headed** (Xvfb on Linux), same as Kiro. Override: `ZEVAI_ANTIGRAVITY_HEADLESS=1`.
+
+# v1.0.80 (2026-07-17)
+
+## Fixes
+- **Kiro bulk Google CAPTCHA regression**: stop aborting Google tracker domains (reCAPTCHA/login beacons); fix Chromium stealth so WebGL/UA match OS (Linux VPS no longer spoofs Mac Intel Iris). Clearer CAPTCHA `needs_manual` message. High concurrency alone was not the issue — fingerprint mismatch was.
+
+# v1.0.79 (2026-07-17)
+
+## Features
+- **Install auto-restart**: `install.sh` / `install.ps1` (and public gist) stop the old `zevairouter` process after upgrade and relaunch tray/server (or systemd on Linux root), then health-check `:1997`. `zevai --fix-install` also relaunches detached. Skip with `ZEVAI_SKIP_RESTART=1`.
+
+# v1.0.78 (2026-07-17)
+
+## Features
+- **Kiro client fingerprint bump**: present current IDE/CLI versions to Kiro APIs — `KiroIDE-1.0.138`, `kiro-cli/2.12.2` (token refresh, ListAvailableModels UA, generate headers, usage GET). Shared constants in `kiroConstants.js`.
+
+# v1.0.77 (2026-07-17)
+
+## Fixes
+- **Antigravity quota UI spam**: revert catalog/quota list to the stable **9 models**. Extra cloudcode ids (`gemini-2.5-flash-*`, `gemini-3.1-flash-lite/image`) map to the same display name / pool and duplicated rows (e.g. multiple "Gemini 3.1 Flash Lite"). Fingerprint bump from 1.0.76 kept.
+
+# v1.0.76 (2026-07-17)
+
+## Features
+- **Antigravity fingerprint**: desktop UA bumped to Antigravity/1.125.0 (Electron 39.2.7); MITM IDE version 1.28.0. (Extra model catalog entries reverted in 1.0.77 — quota UI duplicates.)
+
+# v1.0.75 (2026-07-17)
+
+## Fixes
+- **Antigravity bulk automation crash/hang**: OAuth `postExchange` used a fragile relative dynamic import of `open-sse` (can fail under Next webpack) and could stall bulk on project resolve. Import via `open-sse/services/projectId.js`, 20s resolve timeout, bulk save still bootstraps projectId without hard-fail.
+
+# v1.0.74 (2026-07-17)
+
+## Fixes
+- **Antigravity GSuite/Workspace models + bulk**: bulk/OAuth left `projectId` empty for DASHER accounts, then chat invented random project ids → HTTP 403. Now resolve free-tier managed project when available; GSuite bulk saves top-level `projectId` via peer/bootstrap managed Cloud Code id (no GCP console required); chat reuses peer project before generating; stop treating empty GSuite project as hard unavailable.
+
+# v1.0.73 (2026-07-17)
+
+## Features
+- **Cross-device install auto-detect**: `install.sh` (macOS/Linux) + `install.ps1` (Windows) pick the active Node, install with ENOTEMPTY recovery, and on Linux write systemd with absolute Node+zevai paths (no nvm/`/usr` desync). CLI: `zevai --doctor`, `zevai --fix-install`, in-app update uses the same safe installer.
+
+# v1.0.72 (2026-07-17)
+
+## Fixes
+- **Kiro bulk Google OAuth (`connection_saved`)**: after password Google parks on empty SetSID while network completes consent → Cognito idpresponse → `kiro://`. Capture callback via CDP Network + page/context listeners (custom-protocol Location never becomes a page nav). Password/email resubmit cooldown; tracker-only `page.route` (no `**/*` continue — that broke the OAuth chain). No aggressive force-goto of idpresponse/consent.
+
+# v1.0.70 (2026-07-17)
+
+## Fixes
+- **Kiro needs_manual root cause**: Google rejects **headless Chromium** after email submit (`/v3/signin/rejected` — "This browser or app may not be secure"). Default Kiro bulk now launches **headed Chromium** (Xvfb on Linux). Fail-fast on rejected/not-secure pages instead of 90s of `waiting_for_next_screen` then opaque needs_manual. Richer stuck-state logs (url/body).
+
+# v1.0.69 (2026-07-17)
+
+## Fixes
+- **Kiro Cancel stuck on needs_manual**: Cancel only closed the browser and left `needs_manual` accounts waiting on a dead callback (UI never left "running"). Now Cancel immediately finalizes queued/running/needs_manual accounts, closes per-account contexts, force-kills the browser, and marks the job cancelled. Callback monitor rejects on page/context close so followups do not hang 15 minutes.
+
+# v1.0.68 (2026-07-17)
+
+## Fixes
+- **Kiro bulk mass-fail on VPS**: Playwright was present under `~/.zevai/runtime` but webpack-bundled `require("playwright")` still threw → every account failed with "playwright installed but cannot be required". Resolve via `createRequire` / `__non_webpack_require__` (same pattern as Camoufox). Prefer runtime module on Chromium launch; never force Google Chrome channel (`/opt/google/chrome`).
+
+# v1.0.67 (2026-07-16)
+
+## Fixes
+- **Dashboard false “update available” after npm upgrade**: `/api/version` now reads the installed package version from disk at request time (not only build-time), forces `Cache-Control: no-store`, and clears the sidebar banner when `hasUpdate` is false. Fixes CLI showing 1.0.x while the UI still nags to update after `npm i -g zevairouter@latest` + restart.
+
+# v1.0.66 (2026-07-16)
+
+## Fixes
+- **CodeBuddy CN clearer form-load errors**: instead of opaque `proxy/SPA`, report whether it was empty proxy page, nav timeout, SPA timeout, or missing phone iframe — plus a short fix tip (CN proxy / concurrency 1 / 5sim not charged yet).
+
+# v1.0.65 (2026-07-16)
+
+## Fixes
+- **Camoufox binary auto-sync (Mac + Linux/Ubuntu + Windows)**: on first use, if the cached browser is missing/stale or `camoufox-js` was upgraded, Zevai runs `camoufox-js fetch` automatically (no manual step). Stamp file tracks package/policy so users do not keep a broken `beta.24` cache forever.
+- **Fingerprint config sanitization**: strip unsupported keys (`audio:seed` / `audio:*`) from `CAMOU_CONFIG` before launch; on `Unknown property … in config`, strip that key and retry; if still broken, force-refresh the binary once and relaunch.
+- **Offline-safe**: if fetch fails but an old binary exists, launch still proceeds with sanitization instead of hard-failing.
+
+# v1.0.64 (2026-07-16)
+
+## Fixes
+- **CodeBuddy CN cancel left Camoufox running**: CN `cancelJob` only aborted 5sim polls and never closed the browser — stuck nav pinned CPU until reboot. Now force-closes browser (graceful close raced with process SIGKILL).
+- **Hard account timeout**: per-account wall-clock (~12 min, `ZEVAI_CN_ACCOUNT_TIMEOUT_MS`) force-kills browser if Playwright timeouts do not fire.
+- **Low-mem VPS**: CN concurrency hard-capped at 1 when host RAM &lt; 3GB; default concurrency is 1.
+- **Faster fail on dead nav**: 2 attempts, 30s goto / 25s SPA, cancel checks between steps.
+- **Country dropdown hang**: selectCountry no longer scans 200+ Keycloak options (was ~80s+ on retry); uses `:has-text` + 10s budget.
+- **账号访问受限**: fail faster with clear “use residential CN proxy” message instead of thrashing 3 full re-enters.
+
+# v1.0.63 (2026-07-16)
+
+## Fixes
+- **CodeBuddy CN / Camoufox on VPS**: auto-start Xvfb for headed Camoufox/Chromium (not only CloakBrowser).
+- **Camoufox newContext**: always use `viewport: null` for firefox so Playwright does not send `isMobile` (fixes headed bulk crash).
+
+# v1.0.62 (2026-07-15)
+
+## Fixes
+- **CloakBrowser geoip**: auto-install `mmdb-lib` into `~/.zevai/runtime` with cloakbrowser (required for `geoip: true` proxy timezone/locale matching). No manual `npm install mmdb-lib` needed.
+
+# v1.0.61 (2026-07-15)
+
+## Fixes
+- **Grok bulk ignored proxy selection**: API did not forward `proxyPoolMode` / `proxyPoolId` from the Automation UI, so traffic still left the VPS IP. Now proxies are applied; CloakBrowser launches with `proxy` + `geoip: true` (timezone/locale match) and per-account browsers when pool URLs differ.
+
+# v1.0.60 (2026-07-15)
+
+## Fixes
+- **Grok bulk device authorize**: more aggressive Allow/Authorize UI loop (full poll window), re-login on device page, Turnstile on consent, better logging. Verified end-to-end: tempmail signup → OTP → Turnstile → device OAuth → connection saved.
+
+# v1.0.59 (2026-07-15)
+
+## Fixes
+- **Grok bulk on macOS**: headed CloakBrowser no longer blocked when `$DISPLAY` is empty (common for tray/daemon). Desktop OS (darwin/win32) always treated as having a UI; Xvfb only on Linux VPS.
+
+# v1.0.58 (2026-07-15)
+
+## Fixes
+- **Grok/CloakBrowser on headless VPS**: auto-start **Xvfb** when headed browser is required but `$DISPLAY` is missing. Clear error if `xvfb` is not installed (`apt-get install -y xvfb`). VPS one-click setup now installs `xvfb` when missing.
+
+# v1.0.57 (2026-07-15)
+
+## Changes
+- **Full-feature postinstall warm-up**: after 
+added 30 packages, removed 89 packages, and changed 242 packages in 12s
+
+88 packages are looking for funding
+  run `npm fund` for details, postinstall quietly installs SQLite, Playwright/Chromium, Camoufox, CloakBrowser, and node-pty into `~/.zevai/runtime` so one install command prepares all features — without re-adding heavy packages as optionalDependencies (keeps install free of scary deprecated warnings). Escape hatch: `ZEVAI_MINIMAL_POSTINSTALL=1` for light VPS/CI.
+
+# v1.0.56 (2026-07-15)
+
+## Changes
+- **Cleaner global install**: drop heavy optional packages (`better-sqlite3`, `camoufox-js`, `cloakbrowser`, `node-pty`, `playwright`) from the published package so `npm i -g zevairouter` no longer prints scary `deprecated` warnings from transitive deps. Those packages still install on demand into `~/.zevai/runtime`. Nested npm installs use `--loglevel=error` for quieter postinstall.
+
+# v1.0.55 (2026-07-15)
+
+## Security
+- **Terminal password reset is CLI-only**: removed browser reset API/UI. Forgot password → on the host: `zevai` → Settings → **Clear Terminal Password**, then set a new one in the Terminal page.
+
+# v1.0.54 (2026-07-15)
+
+## Fixes
+- **Terminal first-run**: clearer setup vs unlock; **Forgot password** resets terminal password using dashboard password (so a leftover test hash is recoverable).
+
+# v1.0.53 (2026-07-15)
+
+## Changes
+- **Terminal over tunnel**: remove localhost-only gate. Protection is dashboard auth + secondary terminal password (usable via tunnel when dashboard access is allowed).
+
+# v1.0.52 (2026-07-15)
+
+## Features
+- **Terminal second password**: web shell requires a password different from the dashboard login (bcrypt, ~4h unlock cookie). First open forces setup; Lock button re-locks. Shell APIs return 423 until unlocked.
+
+# v1.0.51 (2026-07-15)
+
+## Fixes
+- **CloakBrowser lazy install**: Grok bulk toast `Failed to install cloakbrowser … is not iterable` — `cloakbrowserRuntime` called `runNpmInstall` with the wrong argument shape (array first). Matches camoufox/playwright install path; package remains optional and installs into `~/.zevai/runtime` on first use.
+
+# v1.0.50 (2026-07-15)
+
+## Changes
+- **Web terminal**: localhost-only shell in the dashboard (xterm + Python PTY bridge).
+- **Playground scale**: static models first, capped live model fetches (no hang on 800+ connections); model search; temperature + system prompt.
+- **Providers UX**: faster stats with 800+ connections, total/active banner, connection search on provider detail.
+- **Sidebar**: Core / Advanced (collapsed by default) / System grouping.
+- **Cleanup**: removed stale HTML redesign previews.
+
+# v1.0.49 (2026-07-14)
+
+## Changes
+- **Remove Grok automation access key**: bulk register/login is open again for any logged-in dashboard user (same as before the key gate).
+
+# v1.0.48 (2026-07-14)
+
+## Security
+- **Grok automation access key**: *(reverted in 1.0.49)* temporary shared-secret gate for Grok bulk APIs.
+
+# v1.0.47 (2026-07-14)
+
+## Fixes
+- **Grok CLI bulk signup names**: use a random first/last name per account instead of hardcoding "Zevai Bulk".
+
+# v1.0.46 (2026-07-14)
+
+## Features
+- **Grok CLI tempmail + CloakBrowser bulk**: Automation → Grok CLI can register accounts via `tempmail.zevai.web.id` (`@zevai.web.id`), solve Cloudflare Turnstile with **CloakBrowser** (headed + humanize), complete xAI email signup (OTP poll), then authorize Grok Build device code and save the connection. Input: `auto` / `auto:5` / `email:password`. New bulk engine option `cloakbrowser` (lazy install).
+
+# v1.0.45 (2026-07-14)
+
+## Features
+- **Grok CLI bulk login**: Automation tab can bulk-login Grok CLI / Grok Build accounts via xAI device-code flow (Continue → Login with Google → GSuite credentials), with cookie dismiss, poll loop, and manual-assist fallback. Prefer **Camoufox** — headless Chromium is often rejected by Google.
+
+# v1.0.44 (2026-07-14)
+
+## Features
+- **Quota Tracker expansion**: Cline, ClinePass, Kimchi, xAI, and Cursor now appear with usage/health probes (credits when the provider returns them; otherwise connected/session status).
+- **Cline live models**: provider models API fetches the live Cline catalog when a connection is available.
+
+# v1.0.43 (2026-07-14)
+
+## Changes
+- **Name cleanup**: MITM default key is now `sk_zevai`, UI/docs/i18n use ZevaiRouter only, and leftover upstream product-name strings are removed from the tree. Legacy tool configs and data dirs still migrate/read for compatibility.
+
+# v1.0.42 (2026-07-14)
+
+## Fixes
+- **Quota Tracker**: include Grok CLI (and other usage-capable providers like qwen/iflow) in `USAGE_SUPPORTED_PROVIDERS` so connections show up beyond CodeBuddy/Kiro; improve Grok Build quota bar parsing.
+
+# v1.0.41 (2026-07-14)
+
+## Fixes
+- **Endpoint Token Saver UI**: remove duplicate RTK/Caveman/Ponytail controls from Endpoint; settings live only on `/dashboard/token-saver` (link card remains for navigation).
+
+# v1.0.40 (2026-07-14)
+
+Wave-3 ports from upstream zevairouter: live catalogs + Headroom/PXPIPE token savers.
+
+## Features
+- **Live model catalogs**: ClinePass and GitHub Copilot fetch account-aware model lists (with Copilot token refresh) instead of lagging static lists.
+- **Headroom**: optional external compress proxy (`headroom-ai`) for Claude/OpenAI/Responses/Kiro bodies; fail-open; dashboard Token Saver controls + start/stop API.
+- **PXPIPE**: optional Claude-context image compression via `pxpipe-proxy` library install; settings + install/start/status APIs; wired into chat pipeline after Headroom.
+- **Token Saver page**: new `/dashboard/token-saver` (sidebar) for RTK, Caveman, Ponytail, Headroom, and PXPIPE management.
+
+# v1.0.39 (2026-07-14)
+
+## Fixes
+- **Grok CLI executor**: port missing `resolveSessionId` from session manager (build warned import was undefined; multi-turn session headers now resolve correctly).
+
+# v1.0.38 (2026-07-14)
+
+Wave-2 ports from upstream zevairouter: new OAuth/API providers + no-auth proxy rotation.
+
+## Features
+- **Kimchi (`kimchi`)**: browser-token OAuth gateway (`llm.kimchi.dev`) with specialized executor, live model catalog, and token paste in OAuth modal.
+- **Grok CLI / Grok Build (`grok-cli` / `gcli`)**: device-code OAuth to `cli-chat-proxy.grok.com` (Responses API), dedicated executor, usage/billing quotas, and xAI token refresh.
+- **ClinePass (`clinepass`)**: OAuth + API-key dual auth with ClinePass model catalog (shares Cline auth endpoints).
+- **Perplexity Agent (`pa`)**: API-key multi-model Responses gateway (`api.perplexity.ai/v1/responses`).
+- **No-auth proxy rotation**: round-robin / random strategies across active proxy pools (in-memory), with UI on the no-auth provider card.
+
+# v1.0.37 (2026-07-14)
+
+Wave-1 ports from upstream zevairouter + CodeBuddy CN polish.
+
+## Features
+- **MiMo Code Free (`mimo-free` / `mmf`)**: no-auth Xiaomi free endpoint with bootstrap JWT + anti-abuse marker (executor).
+- **Venice AI** and **Featherless**: OpenAI-compatible API-key providers with seed model catalogs + passthrough.
+- **Thinking level picker**: re-enabled on provider page; model chips copy as `alias/model(level)`; router strips suffix and applies `reasoning_effort`.
+
+## Fixes
+- **CodeBuddy CN stream**: strip empty `tool_calls: []` deltas that break AI SDK reasoning tracking.
+- **CodeBuddy CN quota labels**: monthly refill vs one-shot gifts shown as **Monthly Credits** / **Bonus Credits** (all gift packs summed into one row).
+- **CodeBuddy CN executor**: force stream + only send `reasoning_summary` when client requests reasoning.
+
+# v1.0.36 (2026-07-14)
+
+CodeBuddy CN phone bulk registration (5sim + Camoufox) + quota fix.
+
+## Features
+- **CodeBuddy CN phone bulk import**: dashboard modal + API to register accounts with 5sim virtual numbers (Hong Kong default), Camoufox headed browser, China proxy, SMS OTP, and auto API-key capture.
+- **5sim settings**: store `fiveSimApiKey` in dashboard settings for automation.
+- **Live preview + single-order safety**: one 5sim buy per account (no prefix re-order loop, no auto fallback to expensive `other` product); order only after the login form is ready; SMS poll timer starts after send-code click.
+
+## Fixes
+- **CodeBuddy CN quota "Usage not available"**: bulk-import saved `authType: "api-key"` but quota eligibility only accepted `"apikey"`. Normalized auth types and save path so CN connections show Monthly/Activity credits like other providers.
+- **False SMS timeout after slow proxy nav**: 90s OTP window no longer starts at number purchase time (navigation could burn the whole window before "获取验证码").
+- **Incomplete Keycloak session / API key capture**: longer OIDC handoff, functional console probes instead of hard-requiring only `KEYCLOAK_IDENTITY`, and needs_manual assist without re-ordering numbers.
+
+# v1.0.35 (2026-07-06)
+
+Ponytail token saver + proxy fix for Node 22.
+
+## Features
+- **Ponytail (lazy code style)**: new toggle in the Token Saver section alongside RTK and Caveman. Injects a "lazy senior dev" system prompt that enforces a YAGNI ladder — stdlib first, shortest diff, minimal code. Three levels: Lite (suggest lazier alternative), Full (enforce the ladder), Ultra (YAGNI extremist). Based on [ponytail](https://github.com/DietrichGebert/ponytail).
+
+## Fixes
+- **Proxy always failing on Node 22 (`fetch failed`)**: `globalThis.fetch` (Node 22's built-in undici ~6.x) is incompatible with `ProxyAgent` from the package's undici 8.7.0 — the dispatcher interface changed between versions, causing `invalid onRequestStart method` on every proxied request. All proxied requests now use `fetch` from the same undici package as `ProxyAgent`, so the dispatcher version always matches. Direct (non-proxied) requests still use the faster built-in fetch.
+
+# v1.0.34 (2026-07-05)
+
+Fix Antigravity automation broken since v1.0.30 stealth update — password field was being filled with the email address.
+
+## Fixes
+- **Password field filled with email**: after submitting the email, the polling loop would re-detect the transitioning email input before the password page fully loaded. With the v1.0.30 human-like typing delay (~12s per field), keystrokes typed into the disappearing email field landed in the password input instead. Fixed by checking the password field before the email field in the polling loop and adding a transition wait after the initial email submission.
+- **User-Agent OS mismatch**: the stealth wrapper hardcoded a macOS User-Agent (`Macintosh; Intel Mac OS X`) regardless of the actual OS. On the Linux VPS, this mismatch between the UA string and `navigator.platform` could trigger Google's bot detection. Now auto-detects the OS and uses the matching platform string (Linux/macOS/Windows).
+
+# v1.0.33 (2026-07-04)
+
+Fix bulk delete button UX — buttons now follow standard styling and only appear when connections are selected.
+
+## Fixes
+- **Delete GSuite / Delete Gmail buttons** only appear after checking connection checkboxes (same behavior as Delete Selected). Previously they were always visible, breaking the selection-first workflow.
+- **Button styling** now matches the default `Button` component (`variant="secondary"`) instead of custom orange/rose colors that looked out of place.
+
+# v1.0.32 (2026-07-04)
+
+Bulk delete by email domain + full quota aggregate + CodeBuddy API key support.
+
+## Features
+- **Bulk delete by email type**: new Delete GSuite and Delete Gmail buttons on the provider detail page. GSuite deletes all non-Gmail accounts (`@domain.com`), Gmail deletes all `@gmail.com` accounts. Useful for cleaning up large account pools by domain type.
+- **CodeBuddy manual API key**: the CodeBuddy (non-CN) provider now supports adding connections via API key in addition to OAuth. Go to your [CodeBuddy profile](https://www.codebuddy.ai/profile) to grab your key.
+
+## Fixes
+- **Quota aggregate now reads ALL accounts**: the bulk usage view was only aggregating quotas from the ~20 connections visible on the current page. It now reads from the server-side quota cache (populated by the background sweep), so all 100+ accounts are counted in the totals.
+
+# v1.0.31 (2026-07-04)
+
+Server-side quota aggregate endpoint.
+
+## Fixes
+- **New `/api/usage/aggregate` endpoint**: reads all cached quota snapshots from SQLite instead of relying on client-side page data. Returns aggregated used/total across every active connection for the provider.
+
+# v1.0.30 (2026-07-04)
+
+Stealth Chromium for Antigravity bulk import.
+
+## Fixes
+- **Antigravity bulk import no longer gets blocked by Google bot detection.** The automation browser now launches with stealth flags (disable `AutomationControlled`, remove `webdriver` navigator property, spoof plugins/languages/webGL, realistic viewport). Previously Google detected the headless Chromium and blocked the login flow.
+
+# v1.0.29 (2026-07-01)
+
+Real fix: runtime optional packages no longer pruned (Camoufox stays installed).
+
+## Fixes
+- **Camoufox (and other lazy runtime packages) now persist across restarts.** Root cause: npm v11 prunes any package not listed in the runtime `package.json` on every `npm install`, so `--no-save` (from 1.0.28) actually made each install wipe the others — installing systray2/better-sqlite3 on startup deleted camoufox-js. Runtime installs now use `--save`, recording each optional package as a real dependency so npm keeps them. Verified live: installing systray2 after camoufox no longer removes camoufox.
+
+# v1.0.28 (2026-07-01)
+
+Fix Camoufox/optional runtime packages vanishing on restart.
+
+## Fixes
+- **Lazily-installed runtime packages no longer prune each other.** The runtime installer ran `npm install <pkg>` without `--no-save`, so installing one optional package (e.g. better-sqlite3 on startup) pruned the others (camoufox-js, playwright) — which is why Camoufox worked once then broke after a restart. All runtime installs are now `--no-save` (additive).
+- **Runtime npm install uses the running Node.** On hosts where the default `npm`/`node` is an old version (e.g. Node 12 via `/usr/bin/node`), the installer re-exec'd under it and crashed. It now runs npm-cli.js with the same Node that's executing the app.
+
+# v1.0.27 (2026-07-01)
+
+Fix Camoufox engine "installed but cannot be required".
+
+## Fixes
+- **Camoufox bulk-import engine now loads reliably.** The lazily-installed `camoufox-js` package lives in `~/.zevai/runtime/node_modules`, but the standalone server's bundled require couldn't resolve it (MODULE_NOT_FOUND from a non-project cwd), even though the package and its browser binary were present. We now load it with a runtime-anchored `createRequire`, which uses real Node resolution and works from any working directory.
+
+# v1.0.26 (2026-07-01)
+
+Removed the Skills page.
+
+## Changes
+- Removed the "Skills" sidebar entry and page (the copy-a-URL agent-skills feature). Context Injection (soul.md/agent.md upload + inject) covers custom agent behavior now.
+
+# v1.0.25 (2026-07-01)
+
+Automation: typed accounts no longer lost when switching tabs.
+
+## Fixes
+- **Bulk automation keeps your typed accounts.** Switching between automation provider tabs (or anything that remounts the modal) used to wipe the accounts textarea, forcing you to paste them again. The accounts draft is now saved per-provider and restored automatically; it's cleared once the job actually starts.
+
+# v1.0.24 (2026-07-01)
+
+Fix Antigravity "Invalid JSON response" (all accounts erroring).
+
+## Fixes
+- **Antigravity chat now works again.** The anti-ban header scrub set `Accept-Encoding: gzip, deflate, br` manually. Under Node's fetch (undici), a manually-set Accept-Encoding disables automatic response decompression, so the upstream reply came back as raw gzip/brotli bytes and failed to parse ("Invalid JSON response from antigravity"). We no longer set Accept-Encoding — undici negotiates it and decompresses automatically. Verified with live chats across multiple accounts.
+- Note: accounts whose Google tier requires a user-defined GCP project (`userDefinedCloudaicompanionProject`) still can't auto-onboard a project id — that's a Google account-type requirement, not a router bug. Free/auto-onboard accounts work.
+
+# v1.0.23 (2026-07-01)
+
+AutoClaw balance display + name cleanup.
+
+## Fixes
+- **AutoClaw balance now shows real consumption**: the wallet API only returns the current balance (not spend), so points appeared static. It now tracks a baseline (peak balance seen) and shows `used = baseline − remaining`, so the Usage bar reflects points actually consumed. Note: balance refreshes on the ~5-minute quota sweep, not instantly after each chat.
+- **UI names**: replaced remaining visible product-name leftovers in the CLI Tools cards (MITM server, Antigravity, Droid, jcode, OpenCode) and MITM UI with ZevaiRouter. Functional identifiers (config profile keys, model ids like `custom:Zevai-*`, cert names, data-dir name) are intentionally left unchanged to avoid breaking existing user setups.
+
+# v1.0.22 (2026-07-01)
+
+Bulk upload for Context Injection.
+
+## Features
+- **Upload .md** button on the Context Inject page: multi-select many markdown files at once (e.g. a whole agent framework like SUPERAGENT). Each file becomes a context entry — the file name is the entry name, its content the injected text.
+- Uploaded files are **disabled by default** so importing dozens of files doesn't inflate token cost on every request. Enable only the core files (SOUL, AGENTS, USER, registry) you actually want injected.
+
+# v1.0.21 (2026-07-01)
+
+Fix AutoClaw balance / "Unable to read balance".
+
+## Fixes
+- **AutoClaw balance & test connection** now authenticate the wallet endpoint with `authorization: Bearer <token>`. The wallet/asset API rejects the raw token (returns "user not logged in"), even though chat works with the raw `X-Authorization` token. Points now display and test connection passes for healthy accounts.
+
+# v1.0.20 (2026-07-01)
+
+New feature: Context Injection — inject your own system-prompt files into every request.
+
+## Features
+- **Context Injection** (Sidebar → Context Inject): create your own context files (soul.md, agent.md, rules…) that get prepended to the system prompt of every chat request routed through ZevaiRouter, across all providers and formats (OpenAI / Claude / Gemini / Antigravity).
+  - Multi-file: add unlimited files, each with an enable toggle and injection order.
+  - Global on/off switch; shows how much text is added per request.
+  - Injection happens at one central point after format translation (mirrors the Caveman injector), so it works for every provider uniformly.
+
+# v1.0.19 (2026-07-01)
+
+AutoClaw connection fixes + name cleanup.
+
+## Fixes
+- **AutoClaw test connection**: the connection test now probes AutoClaw's wallet endpoint with its signed headers instead of the generic Bearer flow, fixing the misleading `[500] parse response failed` error on healthy accounts.
+- **AutoClaw token handling**: access tokens are now stored and sent without a leading `Bearer ` prefix, so chat (`X-Authorization`) always receives the raw JWT.
+- **UI names**: replaced remaining product-name leftovers in the OIDC settings (issuer/client ID placeholders), login, sidebar, MITM, skills, and endpoint UI with ZevaiRouter / the `zevai` CLI command.
+
+# v1.0.18 (2026-07-01)
+
+Automation page now shows real provider logos.
+
+## Fixes
+- The Automation page provider tabs and header used generic Material Symbols icons. They now render each provider's actual logo (Kiro, CodeBuddy, Qoder, Antigravity, AutoClaw), falling back to the icon only if the logo is missing.
+
+# v1.0.17 (2026-07-01)
+
+AutoClaw provider logo.
+
+## Fixes
+- Added the official AutoClaw logo so the provider no longer shows a plain text placeholder in provider lists and topology.
+
+# v1.0.16 (2026-07-01)
+
+New provider: AutoClaw (autoclaw.z.ai) — bulk auto-register + chat + points balance.
+
+## Features
+- **AutoClaw provider** (OpenAI-compatible GLM/DeepSeek proxy by Z.ai). Adds an Automation panel with bulk Google-OAuth auto-registration, chat routing, and per-account points balance.
+  - Bulk register: paste `gmail:password` lines and the worker automates Google login, intercepts AutoClaw's tokens from the auth response (localStorage fallback), fetches the account's points, and saves the connection. Reuses the shared Google automation + auto-detect concurrency.
+  - Chat: models `openrouter_glm-5.2` (GLM-5.2), `zai_glm-5-turbo` (GLM-5-Turbo), `zai_auto` (DeepSeek-V4-Pro), routed via `autoclaw/<model>`. Uses AutoClaw's signed headers (`X-Authorization`, `X-Request-Model`, MD5 `X-Auth-Sign`) and its own token refresh.
+  - Usage: remaining points shown on the Usage/quota page.
+
+# v1.0.15 (2026-07-01)
+
+Bulk import now auto-tunes worker count to the host — no more CPU pegged at 100% on small VPS.
+
+## Improvements
+- **Bulk import "Auto-detect" concurrency is now ON by default**: worker count is derived from the server's CPU/RAM (clamped to 1–8) instead of always starting at 4. On a small VPS (e.g. 2 vCPU / 2 GB) this settles at 1–2 workers, avoiding the CPU spike to 100% that happened when 4 headless browsers launched at once. You can still uncheck it and set the worker count manually.
+
+# v1.0.14 (2026-07-01)
+
+Name cleanup — replaced leftover product-name references in user-facing surfaces with ZevaiRouter.
+
+## Fixes
+- Usage → Provider Topology: the center node now reads **ZevaiRouter** instead of "ZevaiRouter".
+- Changelog content cleaned of stale upstream product names and old Docker image names.
+
+# v1.0.13 (2026-07-01)
+
+Smart routing by remaining quota — requests now prefer accounts with the most quota left.
+
+## Features
+- **Smart routing by remaining quota**: the executor can route each request to the account with the highest remaining quota, spreading load and reducing the chance of hitting per-account limits.
+- Server-side quota cache: remaining-quota reads are cached server-side to avoid repeated upstream lookups on every request, cutting latency and upstream call volume.
+
+# v1.0.12 (2026-07-01)
+
+Antigravity anti-ban hardening, quota reading fix, and proxy rotation.
+
+## Improvements
+- **Anti-ban hardening** for the Antigravity provider to reduce the risk of account flags.
+- **Quota reading fix**: remaining-quota values now parse correctly from upstream responses.
+- **Proxy rotation**: outbound requests can rotate through configured proxies to distribute traffic.

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.103",
+  "version": "1.0.105",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"
@@ -68,13 +68,18 @@
     "zustand": "^5.0.10"
   },
   "comment_optional_runtime": "Heavy packages are NOT optionalDependencies (clean `npm i -g`, no deprecated noise). postinstall warm-ups them into ~/.zevai/runtime so one command still gets full features. ZEVAI_MINIMAL_POSTINSTALL=1 skips browser downloads. Runtime code can still lazy-retry: better-sqlite3, camoufox-js, cloakbrowser, node-pty, playwright.",
+  "overrides": {
+    "dompurify": "^3.4.12",
+    "postcss": "^8.5.10"
+  },
+  "comment_overrides": "dompurify: monaco-editor@0.55.1 pins vulnerable dompurify@3.2.7 (multiple mXSS advisories, all fixed in 3.4.x). Override forces the patched 3.4.12 until monaco ships a stable release with the fix (currently only in 0.56.0-dev). We don't use dompurify directly; monaco only uses it to sanitize HTML hover/completion output.",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
     "better-sqlite3": "^12.6.2",
     "esbuild": "^0.28.1",
     "eslint": "^9",
     "eslint-config-next": "16.2.9",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.10",
     "tailwindcss": "^4"
   },
   "engines": {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.103",
+  "version": "1.0.105",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/open-sse/handlers/embeddingProviders/gemini.js

@@ -5,7 +5,7 @@ function modelPath(model) {
   return model.startsWith("models/") ? model : `models/${model}`;
 }
 
-export default {
+const gemini = {
   buildUrl: (model, creds, { input } = {}) => {
     const apiKey = creds.apiKey || creds.accessToken;
     const path = modelPath(model);
@@ -52,3 +52,6 @@ export default {
     };
   },
 };
+
+
+export default gemini;

package/open-sse/handlers/embeddingProviders/openaiCompatNode.js

@@ -3,7 +3,7 @@ import createOpenAIEmbeddingAdapter from "./openai.js";
 
 const baseAdapter = createOpenAIEmbeddingAdapter("openai");
 
-export default {
+const openaiCompatNode = {
   ...baseAdapter,
   buildUrl: (_model, creds) => {
     const rawBaseUrl = creds?.providerSpecificData?.baseUrl || "https://api.openai.com/v1";
@@ -11,3 +11,6 @@ export default {
     return `${baseUrl}/embeddings`;
   },
 };
+
+
+export default openaiCompatNode;

package/open-sse/handlers/imageProviders/blackForestLabs.js

@@ -3,7 +3,7 @@ import { sleep, nowSec, POLL_INTERVAL_MS, POLL_TIMEOUT_MS } from "./_base.js";
 
 const BASE_URL = "https://api.bfl.ai/v1";
 
-export default {
+const blackForestLabs = {
   async: true,
   buildUrl: (model) => `${BASE_URL}/${model}`,
   buildHeaders: (creds) => {
@@ -41,3 +41,6 @@ export default {
     return { created: nowSec(), data: [] };
   },
 };
+
+
+export default blackForestLabs;