zevairouter 1.0.103 → 1.0.105

package/open-sse/handlers/imageProviders/cloudflareAi.js

@@ -136,7 +136,7 @@ function normalizeCloudflareResponse(responseBody) {
   };
 }
 
-export default {
+const cloudflareAi = {
   buildUrl: (model, creds) => {
     const accountId = creds?.providerSpecificData?.accountId;
     if (!accountId) throw new Error("cloudflare-ai requires accountId in providerSpecificData");
@@ -176,3 +176,6 @@ export default {
 
   normalize: normalizeCloudflareResponse,
 };
+
+
+export default cloudflareAi;

package/open-sse/handlers/imageProviders/codex.js

@@ -143,7 +143,7 @@ function buildSseResponse(providerResponse, log, onSuccess) {
   });
 }
 
-export default {
+const codex = {
   stream: true,
   buildUrl: () => CODEX_RESPONSES_URL,
   buildHeaders: (creds) => {
@@ -196,3 +196,6 @@ export default {
   },
   normalize: (responseBody) => responseBody,
 };
+
+
+export default codex;

package/open-sse/handlers/imageProviders/comfyui.js

@@ -1,8 +1,11 @@
 // ComfyUI — local, noAuth (placeholder; full graph workflow not implemented)
-export default {
+const comfyui = {
   noAuth: true,
   buildUrl: () => "http://localhost:8188",
   buildHeaders: () => ({ "Content-Type": "application/json" }),
   buildBody: (_model, body) => ({ prompt: body.prompt }),
   normalize: (responseBody) => responseBody,
 };
+
+
+export default comfyui;

package/open-sse/handlers/imageProviders/falAi.js

@@ -3,7 +3,7 @@ import { sleep, nowSec, sizeToAspectRatio, POLL_INTERVAL_MS, POLL_TIMEOUT_MS } f
 
 const BASE_URL = "https://queue.fal.run";
 
-export default {
+const falAi = {
   async: true,
   buildUrl: (model) => `${BASE_URL}/${model}`,
   buildHeaders: (creds) => {
@@ -39,3 +39,6 @@ export default {
     return { created: nowSec(), data: images.map((img) => ({ url: img.url || img })) };
   },
 };
+
+
+export default falAi;

package/open-sse/handlers/imageProviders/gemini.js

@@ -3,7 +3,7 @@ import { nowSec } from "./_base.js";
 
 const BASE_URL = "https://generativelanguage.googleapis.com/v1beta/models";
 
-export default {
+const gemini = {
   buildUrl: (model, creds) => {
     const apiKey = creds?.apiKey || creds?.accessToken;
     const modelId = model.replace(/^models\//, "");
@@ -23,3 +23,6 @@ export default {
     };
   },
 };
+
+
+export default gemini;

package/open-sse/handlers/imageProviders/huggingface.js

@@ -3,7 +3,7 @@ import { nowSec } from "./_base.js";
 
 const BASE_URL = "https://api-inference.huggingface.co/models";
 
-export default {
+const huggingface = {
   buildUrl: (model) => `${BASE_URL}/${model}`,
   buildHeaders: (creds) => {
     const headers = { "Content-Type": "application/json" };
@@ -20,3 +20,6 @@ export default {
   },
   normalize: (responseBody) => responseBody,
 };
+
+
+export default huggingface;

package/open-sse/handlers/imageProviders/nanobanana.js

@@ -4,7 +4,7 @@ import { sleep, nowSec, sizeToAspectRatio, POLL_INTERVAL_MS, POLL_TIMEOUT_MS } f
 const SUBMIT_URL = "https://api.nanobananaapi.ai/api/v1/nanobanana/generate";
 const POLL_BASE = "https://api.nanobananaapi.ai/api/v1/nanobanana/record-info";
 
-export default {
+const nanobanana = {
   async: true,
   buildUrl: () => SUBMIT_URL,
   buildHeaders: (creds) => {
@@ -56,3 +56,6 @@ export default {
     return { created: nowSec(), data: [] };
   },
 };
+
+
+export default nanobanana;

package/open-sse/handlers/imageProviders/runwayml.js

@@ -3,7 +3,7 @@ import { sleep, nowSec, sizeToAspectRatio, POLL_INTERVAL_MS, POLL_TIMEOUT_MS } f
 
 const BASE_URL = "https://api.dev.runwayml.com/v1";
 
-export default {
+const runwayml = {
   async: true,
   buildUrl: (model) => {
     // Image models (gen4_image*) → text_to_image; video models → image_to_video
@@ -45,3 +45,6 @@ export default {
     return { created: nowSec(), data: outputs.map((url) => ({ url })) };
   },
 };
+
+
+export default runwayml;

package/open-sse/handlers/imageProviders/sdwebui.js

@@ -1,7 +1,7 @@
 // SD WebUI (AUTOMATIC1111) — local, noAuth
 import { nowSec } from "./_base.js";
 
-export default {
+const sdwebui = {
   noAuth: true,
   buildUrl: () => "http://localhost:7860/sdapi/v1/txt2img",
   buildHeaders: () => ({ "Content-Type": "application/json" }),
@@ -15,3 +15,6 @@ export default {
     return { created: nowSec(), data: images };
   },
 };
+
+
+export default sdwebui;

package/open-sse/handlers/imageProviders/stabilityAi.js

@@ -10,7 +10,7 @@ function modelToEndpoint(model) {
   return "core";
 }
 
-export default {
+const stabilityAi = {
   buildUrl: (model) => `${BASE_URL}/${modelToEndpoint(model)}`,
   buildHeaders: (creds) => {
     const key = creds?.apiKey || creds?.accessToken;
@@ -32,3 +32,6 @@ export default {
     return { created: nowSec(), data: [] };
   },
 };
+
+
+export default stabilityAi;

package/open-sse/handlers/ttsProviders/edgeTts.js

@@ -63,7 +63,7 @@ export async function fetchEdgeTtsVoices() {
   return voices;
 }
 
-export default {
+const edgeTts = {
   noAuth: true,
   async synthesize(text, model) {
     const voiceId = model || "vi-VN-HoaiMyNeural";
@@ -87,3 +87,6 @@ export default {
     return { base64: Buffer.from(buf).toString("base64"), format: "mp3" };
   },
 };
+
+
+export default edgeTts;

package/open-sse/handlers/ttsProviders/elevenlabs.js

@@ -21,7 +21,7 @@ export async function fetchElevenLabsVoices(apiKey) {
   return voices;
 }
 
-export default {
+const elevenlabs = {
   async synthesize(text, model, credentials) {
     if (!credentials?.apiKey) throw new Error("ElevenLabs API key required");
     let modelId = "eleven_flash_v2_5";
@@ -46,3 +46,6 @@ export default {
     return { base64: Buffer.from(buf).toString("base64"), format: "mp3" };
   },
 };
+
+
+export default elevenlabs;

package/open-sse/handlers/ttsProviders/gemini.js

@@ -47,7 +47,7 @@ function buildPrompt(text, language) {
   return language ? `Say in ${language}: ${text}` : `Say: ${text}`;
 }
 
-export default {
+const gemini = {
   async synthesize(text, model, credentials, _responseFormat, opts = {}) {
     if (!credentials?.apiKey) throw new Error("No Gemini API key configured");
     const { modelId, voiceId } = parseGeminiModelVoice(model);
@@ -115,3 +115,6 @@ const PREBUILT_VOICES = [
 export async function fetchGeminiVoices() {
   return PREBUILT_VOICES.map((v) => ({ voice_id: v.id, name: v.id, labels: { language: v.lang, gender: v.gender } }));
 }
+
+
+export default gemini;

package/open-sse/handlers/ttsProviders/googleTts.js

@@ -19,7 +19,7 @@ async function getToken() {
   return cache.token;
 }
 
-export default {
+const googleTts = {
   noAuth: true,
   async synthesize(text, model) {
     const lang = model || "en";
@@ -52,3 +52,6 @@ export default {
     return { base64, format: "mp3" };
   },
 };
+
+
+export default googleTts;

package/open-sse/handlers/ttsProviders/localDevice.js

@@ -78,10 +78,13 @@ async function synthesizeMacOrWin(text, voiceId) {
   }
 }
 
-export default {
+const localDevice = {
   noAuth: true,
   async synthesize(text, model) {
     const base64 = await synthesizeMacOrWin(text, model);
     return { base64, format: "mp3" };
   },
 };
+
+
+export default localDevice;

package/open-sse/handlers/ttsProviders/openai.js

@@ -1,7 +1,7 @@
 // OpenAI TTS — model format: "tts-model/voice"
 import { Buffer } from "node:buffer";
 
-export default {
+const openai = {
   async synthesize(text, model, credentials) {
     if (!credentials?.apiKey) throw new Error("No OpenAI API key configured");
 
@@ -28,3 +28,6 @@ export default {
     return { base64: Buffer.from(buf).toString("base64"), format: "mp3" };
   },
 };
+
+
+export default openai;

package/open-sse/handlers/ttsProviders/openrouter.js

@@ -1,5 +1,5 @@
 // OpenRouter TTS — via chat completions + audio modality (SSE stream)
-export default {
+const openrouter = {
   async synthesize(text, model, credentials) {
     if (!credentials?.apiKey) throw new Error("No OpenRouter API key configured");
 
@@ -68,3 +68,6 @@ export default {
     return { base64: chunks.join(""), format: "wav" };
   },
 };
+
+
+export default openrouter;

package/open-sse/utils/cursorChecksum.js

@@ -141,9 +141,12 @@ export function buildCursorHeaders(accessToken, machineId = null, ghostMode = tr
   };
 }
 
-export default {
+const cursorChecksum = {
   generateCursorChecksum,
   buildCursorHeaders,
   generateHashed64Hex,
   generateSessionId
 };
+
+
+export default cursorChecksum;

package/open-sse/utils/cursorProtobuf.js

@@ -889,7 +889,7 @@ export function extractTextFromResponse(payload) {
 
 // ==================== EXPORTS ====================
 
-export default {
+const cursorProtobuf = {
   encodeVarint,
   encodeField,
   encodeMessage,
@@ -902,3 +902,6 @@ export default {
   parseConnectRPCFrame,
   extractTextFromResponse
 };
+
+
+export default cursorProtobuf;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.103",
+  "version": "1.0.105",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"
@@ -68,13 +68,18 @@
     "zustand": "^5.0.10"
   },
   "comment_optional_runtime": "Heavy packages are NOT optionalDependencies (clean `npm i -g`, no deprecated noise). postinstall warm-ups them into ~/.zevai/runtime so one command still gets full features. ZEVAI_MINIMAL_POSTINSTALL=1 skips browser downloads. Runtime code can still lazy-retry: better-sqlite3, camoufox-js, cloakbrowser, node-pty, playwright.",
+  "overrides": {
+    "dompurify": "^3.4.12",
+    "postcss": "^8.5.10"
+  },
+  "comment_overrides": "dompurify: monaco-editor@0.55.1 pins vulnerable dompurify@3.2.7 (multiple mXSS advisories, all fixed in 3.4.x). Override forces the patched 3.4.12 until monaco ships a stable release with the fix (currently only in 0.56.0-dev). We don't use dompurify directly; monaco only uses it to sanitize HTML hover/completion output.",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
     "better-sqlite3": "^12.6.2",
     "esbuild": "^0.28.1",
     "eslint": "^9",
     "eslint-config-next": "16.2.9",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.10",
     "tailwindcss": "^4"
   },
   "engines": {

package/src/app/(dashboard)/dashboard/automation/page.js

@@ -1,4 +1,5 @@
 "use client";
+/* eslint-disable @next/next/no-img-element -- dynamic/blob/external image src with onError fallback; next/image requires static dims + domain allowlist */
 
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Badge, Button, BulkAccountAutomationModal, Card, CardSkeleton, CodeBuddyCnPhoneRegisterModal, KiroOAuthWrapper, OAuthModal } from "@/shared/components";
@@ -777,6 +778,7 @@ export default function AutomationPage() {
   }, []);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- mount data fetch; fetchConnections sets state only after await, which the rule flags conservatively
     fetchConnections();
   }, [fetchConnections]);
 
@@ -784,6 +786,7 @@ export default function AutomationPage() {
     if (typeof window === "undefined") return;
     const requestedProvider = new URLSearchParams(window.location.search).get("provider");
     if (AUTOMATION_PROVIDERS.some((provider) => provider.id === requestedProvider)) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- one-time mount initialization from URL query param (external source, client-only)
       setActiveProviderId(requestedProvider);
     }
   }, []);

package/src/app/(dashboard)/dashboard/basic-chat/BasicChatPageClient.js

@@ -1,4 +1,5 @@
 "use client";
+/* eslint-disable @next/next/no-img-element -- dynamic/blob/external image src with onError fallback; next/image requires static dims + domain allowlist */
 
 import { useEffect, useMemo, useRef, useState } from "react";
 import { marked } from "marked";
@@ -19,6 +20,10 @@ const STORAGE_KEYS = {
   systemPrompt: "basic-chat.systemPrompt",
 };
 
+// Stable empty array — avoids creating a new [] every render when there's no
+// active session, which would otherwise churn effects/memos keyed on messages.
+const EMPTY_MESSAGES = [];
+
 const SUGGESTIONS = [
   "Explain this project like I'm new",
   "Write a concise PR description",
@@ -292,6 +297,7 @@ export default function BasicChatPageClient() {
   const messagesEndRef = useRef(null);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- hydration gate: flags client mount so lazy localStorage reads (in useState initializers) only persist after hydration
     setIsHydrated(true);
   }, []);
 
@@ -478,7 +484,7 @@ export default function BasicChatPageClient() {
   }, [activeModelId, modelIndex, activeProviderGroup, sessions, activeSessionId]);
 
   const currentSession = useMemo(() => sessions.find((session) => session.id === activeSessionId) || null, [sessions, activeSessionId]);
-  const currentMessages = currentSession?.messages || [];
+  const currentMessages = currentSession?.messages || EMPTY_MESSAGES;
   const sessionItems = useMemo(() => [...sessions].sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime()), [sessions]);
   const canSend = !isSending && !!activeModel && (draft.trim().length > 0 || attachments.length > 0);
 
@@ -509,6 +515,7 @@ export default function BasicChatPageClient() {
         ? modelIndex.get(session.modelId)
         : savedModel;
       initializedRef.current = true;
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- one-time session/model reconciliation after async data load, guarded by initializedRef
       setActiveSessionId(session.id);
       setActiveProviderId(sessionModel?.providerId || savedProvider.providerId);
       setActiveModelId(sessionModel?.id || savedModel.id);

package/src/app/(dashboard)/dashboard/cli-tools/components/AntigravityToolCard.js

@@ -29,24 +29,30 @@ export default function AntigravityToolCard({
 
   useEffect(() => {
     if (apiKeys?.length > 0 && !selectedApiKey) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- controlled/uncontrolled hybrid: default selection from apiKeys prop, user can change it independently
       setSelectedApiKey(apiKeys[0].key);
     }
   }, [apiKeys, selectedApiKey]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync-from-props hybrid: mirrors initialStatus prop, but status is also updated independently by fetch/user actions
     if (initialStatus) setStatus(initialStatus);
   }, [initialStatus]);
 
   useEffect(() => {
     if (isExpanded && !status) {
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchStatus();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       loadSavedMappings();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchModelAliases();
     }
     if (isExpanded) {
       loadSavedMappings();
       fetchModelAliases();
     }
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [isExpanded]; read latest status (adding it would re-trigger on every change)
   }, [isExpanded]);
 
   const loadSavedMappings = async () => {

package/src/app/(dashboard)/dashboard/cli-tools/components/BaseUrlSelect.js

@@ -73,6 +73,7 @@ export default function BaseUrlSelect({
   const initializedRef = useRef(false);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- one-time mount initialization from localStorage (external store), intentionally client-only
     setSavedPresets(readSavedPresets());
   }, []);
 
@@ -88,6 +89,7 @@ export default function BaseUrlSelect({
     initializedRef.current = true;
     const first = options.find((o) => o.value !== CUSTOM_VALUE);
     if (first) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- one-time default selection guarded by initializedRef; options depend on async localStorage presets so it cannot be derived during initial render
       setMode(first.value);
       onChange(first.url);
     } else {

package/src/app/(dashboard)/dashboard/cli-tools/components/ClaudeToolCard.js

@@ -53,20 +53,25 @@ export default function ClaudeToolCard({
 
   useEffect(() => {
     if (apiKeys?.length > 0 && !selectedApiKey) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- controlled/uncontrolled hybrid: default selection from apiKeys prop, user can change it independently
       setSelectedApiKey(apiKeys[0].key);
     }
   }, [apiKeys, selectedApiKey]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync-from-props hybrid: mirrors initialStatus prop, but claudeStatus is also updated independently by fetch/user actions
     if (initialStatus) setClaudeStatus(initialStatus);
   }, [initialStatus]);
 
   useEffect(() => {
     if (isExpanded && !claudeStatus) {
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       checkClaudeStatus();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchModelAliases();
     }
     if (isExpanded) fetchModelAliases();
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [isExpanded]; read latest claudeStatus (adding it would re-trigger on every change)
   }, [isExpanded]);
 
   useEffect(() => {
@@ -112,6 +117,7 @@ export default function ClaudeToolCard({
       // Only set selectedApiKey if it exists in apiKeys list
       const tokenFromFile = env.ANTHROPIC_AUTH_TOKEN;
       if (tokenFromFile && apiKeys?.some(k => k.key === tokenFromFile)) {
+        // eslint-disable-next-line react-hooks/set-state-in-effect -- one-time pre-fill from fetched config file, guarded by hasInitializedModels ref
         setSelectedApiKey(tokenFromFile);
       }
     }

package/src/app/(dashboard)/dashboard/cli-tools/components/ClineToolCard.js

@@ -22,22 +22,28 @@ export default function ClineToolCard({ tool, isExpanded, onToggle, baseUrl, api
   const [customBaseUrl, setCustomBaseUrl] = useState("");
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- controlled/uncontrolled hybrid: default selection from apiKeys prop, user can change it independently
     if (apiKeys?.length > 0 && !selectedApiKey) setSelectedApiKey(apiKeys[0].key);
   }, [apiKeys, selectedApiKey]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync-from-props hybrid: mirrors initialStatus prop, but status is also updated independently by fetch/user actions
     if (initialStatus) setStatus(initialStatus);
   }, [initialStatus]);
 
   useEffect(() => {
     if (isExpanded && !status) {
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       checkStatus();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchModelAliases();
     }
     if (isExpanded) fetchModelAliases();
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [isExpanded]; read latest status (adding it would re-trigger on every change)
   }, [isExpanded]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync from fetched tool config: pre-fills selectedModel, which the user can also change via the model modal
     if (status?.settings?.openAiModelId) setSelectedModel(status.settings.openAiModelId);
   }, [status]);
 

package/src/app/(dashboard)/dashboard/cli-tools/components/CodexToolCard.js

@@ -27,24 +27,30 @@ export default function CodexToolCard({ tool, isExpanded, onToggle, baseUrl, api
 
   useEffect(() => {
     if (apiKeys?.length > 0 && !selectedApiKey) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- controlled/uncontrolled hybrid: default selection from apiKeys prop, user can change it independently
       setSelectedApiKey(apiKeys[0].key);
     }
   }, [apiKeys, selectedApiKey]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync-from-props hybrid: mirrors initialStatus prop, but codexStatus is also updated independently by fetch/user actions
     if (initialStatus) setCodexStatus(initialStatus);
   }, [initialStatus]);
 
   useEffect(() => {
     if (isExpanded && !codexStatus) {
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       checkCodexStatus();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchModelAliases();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchGatewayAccounts();
     }
     if (isExpanded) {
       fetchModelAliases();
       fetchGatewayAccounts();
     }
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [isExpanded]; read latest codexStatus (adding it would re-trigger on every change)
   }, [isExpanded]);
 
   const fetchModelAliases = async () => {
@@ -74,6 +80,7 @@ export default function CodexToolCard({ tool, isExpanded, onToggle, baseUrl, api
   useEffect(() => {
     if (codexStatus?.config) {
       const modelMatch = codexStatus.config.match(/^model\s*=\s*"([^"]+)"/m);
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- sync from fetched tool config: pre-fills selectedModel, which the user can also change via the model modal
       if (modelMatch) setSelectedModel(modelMatch[1]);
 
       // Parse subagent settings

package/src/app/(dashboard)/dashboard/cli-tools/components/CopilotToolCard.js

@@ -27,20 +27,25 @@ export default function CopilotToolCard({ tool, isExpanded, onToggle, baseUrl, a
 
   useEffect(() => {
     if (apiKeys?.length > 0 && !selectedApiKey) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- controlled/uncontrolled hybrid: default selection from apiKeys prop, user can change it independently
       setSelectedApiKey(apiKeys[0].key);
     }
   }, [apiKeys, selectedApiKey]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync-from-props hybrid: mirrors initialStatus prop, but status is also updated independently by fetch/user actions
     if (initialStatus) setStatus(initialStatus);
   }, [initialStatus]);
 
   useEffect(() => {
     if (isExpanded && !status) {
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       checkStatus();
+      // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
       fetchModelAliases();
     }
     if (isExpanded) fetchModelAliases();
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [isExpanded]; read latest status (adding it would re-trigger on every change)
   }, [isExpanded]);
 
   // Pre-fill from existing config
@@ -48,9 +53,11 @@ export default function CopilotToolCard({ tool, isExpanded, onToggle, baseUrl, a
     if (status?.config && Array.isArray(status.config) && selectedModels.length === 0) {
       const entry = status.config.find((e) => e.name === "ZevaiRouter");
       if (entry?.models?.length > 0) {
+        // eslint-disable-next-line react-hooks/set-state-in-effect -- one-time pre-fill from fetched tool config (only when user has made no selection), user edits models independently afterwards
         setSelectedModels(entry.models.map((m) => m.id));
       }
     }
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [status]; read latest selectedModels.length (adding it would re-trigger on every change)
   }, [status]);
 
   const fetchModelAliases = async () => {

package/src/app/(dashboard)/dashboard/cli-tools/components/CoworkToolCard.js

@@ -52,16 +52,20 @@ export default function CoworkToolCard({
 
   useEffect(() => {
     if (apiKeys?.length > 0 && !selectedApiKey) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- controlled/uncontrolled hybrid: default selection from apiKeys prop, user can change it independently
       setSelectedApiKey(apiKeys[0].key);
     }
   }, [apiKeys, selectedApiKey]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- sync-from-props hybrid: mirrors initialStatus prop, but status is also updated independently by fetch/user actions
     if (initialStatus) setStatus(initialStatus);
   }, [initialStatus]);
 
   useEffect(() => {
+    // eslint-disable-next-line react-hooks/immutability -- false positive: these are local fetch+setState helpers invoked once on effect fire (not during render); defined with const below because all invocations are deferred (effects/events), so no TDZ issue at runtime
     if (isExpanded && !status) checkStatus();
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [isExpanded]; read latest status (adding it would re-trigger on every change)
   }, [isExpanded]);
 
   useEffect(() => {
@@ -76,6 +80,7 @@ export default function CoworkToolCard({
 
   useEffect(() => {
     if (status?.cowork?.models?.length) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- sync from fetched tool config: pre-fills selectedModels, which the user can also edit independently
       setSelectedModels(status.cowork.models);
     }
     if (status?.cowork?.baseUrl && !customBaseUrl) {
@@ -93,6 +98,7 @@ export default function CoworkToolCard({
     if (Array.isArray(status?.cowork?.customPlugins) && status.cowork.customPlugins.length > 0) {
       setCustomPlugins(status.cowork.customPlugins);
     }
+  // eslint-disable-next-line react-hooks/exhaustive-deps -- intentional: react only to [status]; read latest customBaseUrl (adding it would re-trigger on every change)
   }, [status]);
 
   const checkStatus = async () => {