zevairouter 1.0.106 → 1.0.107

package/cli/app/CHANGELOG.md

@@ -1,3 +1,14 @@
+# v1.0.107 (2026-07-20)
+
+## Fixes
+- **Full-code audit — 6 verified bugs fixed** (multi-zone static scan + adversarial verification; every finding traced to a concrete failure path, guesses discarded):
+  - **Usage recent-logs always empty**: `getRecentLogs` called the async `getAdapter()` without `await`, so `db.all()` threw on a Promise and the try/catch silently returned `[]`. Both `/api/usage/logs` and `/api/usage/request-logs` now return rows (verified E2E).
+  - **Cloudflare Tunnel dies silently with no auto-recovery**: `killCloudflared` set `intentionalKill = true` even when no live child existed (fresh start / dead stale PID). The flag leaked across the respawn, so the next child's unexpected exit was swallowed and the watchdog respawn never fired. Flag is now armed only when a child/PID was actually killed (reproduced deterministically).
+  - **MITM sudo password corruption (non-ASCII)**: `decryptPassword` concatenated a `decipher.update()` Buffer with a `final("utf8")` string, mangling multi-byte UTF-8 at the chunk boundary. Now decodes once via `Buffer.concat`.
+  - **Model alias direction inverted in `/api/models`**: both the GET reader and PUT writer treated the KV map as `{model: alias}` when it's actually `{alias: "provider/model"}` (confirmed against the live DB). Fixed both directions.
+  - **Kiro MITM dropped reasoning**: `extractThinking` returned only the first `<think>` block per chunk, silently losing every block after the first. Now merges all blocks.
+  - **OpenCode settings showed `zevai/x` instead of `x`**: `activeModel` stripped a `^zevairouter/` prefix that is never written (the actual prefix is `zevai/`), so the replace was a no-op.
+
 # v1.0.106 (2026-07-20)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.106",
+  "version": "1.0.107",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/app/src/mitm/server.js

@@ -29,7 +29,9 @@ Private-MAC: `+B.digest().toHex()+`\r
 `),n.end()),s?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream"}),t.end(`data: ${JSON.stringify({error:{message:i.message}})}\r
 \r
 `)):(t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:i.message,type:"mitm_error"}})))}}_o.exports={intercept:Yc}});var Ro=F((np,wo)=>{var{err:$c}=Gt(),{fetchRouter:jc,pipeSSE:Wc}=xa(),Xc={"/chat/completions":"/v1/chat/completions","/v1/messages":"/v1/messages","/responses":"/v1/responses"};function Jc(e){for(let[t,a]of Object.entries(Xc))if(e.includes(t))return a;return"/v1/chat/completions"}async function Zc(e,t,a,r){try{let n=JSON.parse(a.toString());n.model=r;let s=Jc(e.url),i=await jc(n,s,e.headers);await Wc(i,t)}catch(n){$c(`[copilot] ${n.message}`),t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:n.message,type:"mitm_error"}}))}}wo.exports={intercept:Zc}});var Oo=F((ip,Po)=>{var{err:ed}=Gt(),{IS_DEV:td}=Er(),{fetchRouter:rd,pipeTransformedEventStream:ad}=xa(),nd=require("fs"),id=require("path"),sd=id.join(__dirname,"../../../data/logs/mitm/kiro-debug.log");function Lo(e){if(td)try{nd.appendFileSync(sd,`${new Date().toISOString()} ${e}
-`)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function ko(e){let t=4294967295;for(let a=0;a<e.length;a++)t=t>>>8^od[(t^e[a])&255];return(t^4294967295)>>>0}function ud(e){return{modelId:e||null,toolCallInit:{},hasToolCalls:!1,finishSent:!1,usage:null,inThink:!1,thinkBuf:""}}function Uo(e,t){if(!e)return{thinking:null,text:null};let a=e;t.inThink&&t.thinkBuf&&(a=t.thinkBuf+a,t.thinkBuf="",t.inThink=!1);let r=/<thinking>|<think>/i,n=a.match(r);if(!n)return{thinking:null,text:a};let s=n[0].toLowerCase(),i=s==="<think>"?"</think>":"</thinking>",o=n.index,u=a.indexOf(i,o+s.length);if(u===-1)return t.inThink=!0,t.thinkBuf=a.slice(o),{thinking:null,text:a.slice(0,o).trim()||null};let l=a.slice(o+s.length,u),f=a.slice(0,o).trim(),c=a.slice(u+i.length).trim(),g=[f,c].filter(Boolean).join(""),v=g?Uo(g,{inThink:!1,thinkBuf:""}):{thinking:null,text:null};return{thinking:l||null,text:v.text||null}}function Nn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8"),n=Buffer.alloc(1+a.length+1+2+r.length),s=0;return n[s++]=a.length,a.copy(n,s),s+=a.length,n[s++]=7,n.writeUInt16BE(r.length,s),s+=2,r.copy(n,s),n}function xt(e,t){let a=Buffer.from(typeof t=="string"?t:JSON.stringify(t),"utf8"),r=Buffer.concat([Nn(":message-type","event"),Nn(":event-type",e),Nn(":content-type","application/json")]),n=r.length,s=12+n+a.length+4,i=Buffer.alloc(s);return i.writeUInt32BE(s,0),i.writeUInt32BE(n,4),i.writeUInt32BE(ko(i.slice(0,8)),8),r.copy(i,12),a.copy(i,12+n),i.writeUInt32BE(ko(i.slice(0,s-4)),s-4),i}function ld(e){if(typeof e=="string")return e;if(e==null)return"{}";try{return JSON.stringify(e)}catch{return"{}"}}function Do(e){let t=[],a=e.userInputMessageContext?.toolResults||[];for(let n of a){let s=(n.content||[]).map(i=>i.text||"").join(`
+`)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function ko(e){let t=4294967295;for(let a=0;a<e.length;a++)t=t>>>8^od[(t^e[a])&255];return(t^4294967295)>>>0}function ud(e){return{modelId:e||null,toolCallInit:{},hasToolCalls:!1,finishSent:!1,usage:null,inThink:!1,thinkBuf:""}}function Uo(e,t){if(!e)return{thinking:null,text:null};let a=e;t.inThink&&t.thinkBuf&&(a=t.thinkBuf+a,t.thinkBuf="",t.inThink=!1);let r=/<thinking>|<think>/i,n=a.match(r);if(!n)return{thinking:null,text:a};let s=n[0].toLowerCase(),i=s==="<think>"?"</think>":"</thinking>",o=n.index,u=a.indexOf(i,o+s.length);if(u===-1)return t.inThink=!0,t.thinkBuf=a.slice(o),{thinking:null,text:a.slice(0,o).trim()||null};let l=a.slice(o+s.length,u),f=a.slice(0,o).trim(),c=a.slice(u+i.length).trim(),g=[f,c].filter(Boolean).join(""),v=g?Uo(g,{inThink:!1,thinkBuf:""}):{thinking:null,text:null};return{thinking:[l,v.thinking].filter(x=>x).join(`
+
+`)||null,text:v.text||null}}function Nn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8"),n=Buffer.alloc(1+a.length+1+2+r.length),s=0;return n[s++]=a.length,a.copy(n,s),s+=a.length,n[s++]=7,n.writeUInt16BE(r.length,s),s+=2,r.copy(n,s),n}function xt(e,t){let a=Buffer.from(typeof t=="string"?t:JSON.stringify(t),"utf8"),r=Buffer.concat([Nn(":message-type","event"),Nn(":event-type",e),Nn(":content-type","application/json")]),n=r.length,s=12+n+a.length+4,i=Buffer.alloc(s);return i.writeUInt32BE(s,0),i.writeUInt32BE(n,4),i.writeUInt32BE(ko(i.slice(0,8)),8),r.copy(i,12),a.copy(i,12+n),i.writeUInt32BE(ko(i.slice(0,s-4)),s-4),i}function ld(e){if(typeof e=="string")return e;if(e==null)return"{}";try{return JSON.stringify(e)}catch{return"{}"}}function Do(e){let t=[],a=e.userInputMessageContext?.toolResults||[];for(let n of a){let s=(n.content||[]).map(i=>i.text||"").join(`
 `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolUses||[];return t.length>0?{role:"assistant",content:e.content||null,tool_calls:t.map(a=>({id:a.toolUseId||`call_${Date.now()}`,type:"function",function:{name:a.name||"",arguments:ld(a.input)}}))}:{role:"assistant",content:e.content||""}}function cd(e){let t=e.conversationState||{},a=t.history||[],r=t.currentMessage,n=[];for(let s of a)s.userInputMessage?n.push(...Do(s.userInputMessage)):s.assistantResponseMessage&&n.push(fd(s.assistantResponseMessage));return r?.userInputMessage&&n.push(...Do(r.userInputMessage)),n}function dd(e){let t=e.conversationState||{},a=t.currentMessage?.userInputMessage?.userInputMessageContext?.tools||[],r=t.history?.find(s=>s.userInputMessage?.userInputMessageContext?.tools)?.userInputMessage?.userInputMessageContext?.tools||[],n=a.length>0?a:r;return n.length?n.map(s=>{let i=s.toolSpecification||s;return{type:"function",function:{name:i.name||"",description:i.description||`Tool: ${i.name||"unknown"}`,parameters:i.inputSchema?.json||{type:"object",properties:{},required:[]}}}}):[]}function hd(e,t){if(!e){if(t.finishSent)return null;if(t.inThink&&t.thinkBuf){t.inThink=!1;let i=t.thinkBuf;return t.thinkBuf="",xt("reasoningContentEvent",{content:i,modelId:t.modelId||"kiro-unknown"})}return xt("messageStopEvent",{})}let a=[],r=e.choices?.[0],n=r?.delta||{};!t.modelId&&e.model&&(t.modelId=e.model);let s=t.modelId||"unknown";if(e.usage&&(t.usage=e.usage),n.tool_calls){t.hasToolCalls=!0;for(let i of n.tool_calls){let o=i.index??0;if(i.id&&i.function?.name&&!t.toolCallInit[o]&&(t.toolCallInit[o]={id:i.id,name:i.function.name},Lo(`toolUseEvent init: ${i.function.name} (${i.id})`),a.push(xt("toolUseEvent",{name:i.function.name,toolUseId:i.id}))),i.function?.arguments){let u=t.toolCallInit[o];Lo(`toolUseEvent fragment: ${i.function.arguments.slice(0,100)}`),a.push(xt("toolUseEvent",{input:i.function.arguments,name:u?.name||i.function?.name||"",toolUseId:u?.id||i.id||""}))}}}if(n.reasoning_content&&a.push(xt("reasoningContentEvent",{content:n.reasoning_content,modelId:s})),n.content){let{thinking:i,text:o}=Uo(n.content,t);i&&a.push(xt("reasoningContentEvent",{content:i,modelId:s})),o&&a.push(xt("assistantResponseEvent",{content:o,modelId:s}))}if(r?.finish_reason){let i=pd(t);i&&a.push(...Array.isArray(i)?i:[i])}return a.length===0?null:a.length===1?a[0]:a}function pd(e){let t=[];if(e.hasToolCalls)for(let a of Object.keys(e.toolCallInit).sort()){let r=e.toolCallInit[a];t.push(xt("toolUseEvent",{name:r.name,stop:!0,toolUseId:r.id}))}else t.push(xt("messageStopEvent",{}));return e.finishSent=!0,e.usage&&t.push(xt("usageEvent",{inputTokens:e.usage.prompt_tokens||0,outputTokens:e.usage.completion_tokens||0})),e.toolCallInit={},t.length>0?t:null}async function gd(e,t,a,r){try{if(yd(a))throw new Error(`Binary EventStream format detected (${a.length}B) - request should use passthrough instead of intercept`);let n=JSON.parse(a.toString()),s=cd(n);if(s.length===0)throw new Error("codeWhispererToMessages produced 0 messages \u2014 check request body");let i=dd(n),o={model:r,messages:s,stream:!0,...i.length>0&&{tools:i,tool_choice:"auto"}},u=await rd(o,"/v1/chat/completions",e.headers),l=ud(r);await ad(u,t,hd,l)}catch(n){ed(`[Kiro MITM] Request processing failed: ${n.message}`),t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:n.message,type:"mitm_error",handler:"kiro"}}))}}function yd(e){if(!e||e.length<12)return!1;let t=e.readUInt32BE(0),a=e.readUInt32BE(4);return t>12&&t<1e6&&a<t-12}Po.exports={intercept:gd}});var Fo=F((sp,Vo)=>{async function vd(e,t){t.writeHead(501,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:"Cursor MITM support is coming soon.",type:"not_implemented"}}))}Vo.exports={intercept:vd}});var Mo=F((op,Ko)=>{var md={antigravity:["daily-cloudcode-pa.googleapis.com","cloudcode-pa.googleapis.com"],copilot:["api.individual.githubcopilot.com"],kiro:["q.us-east-1.amazonaws.com","codewhisperer.us-east-1.amazonaws.com"],cursor:["api2.cursor.sh"]};Ko.exports={TOOL_HOSTS:md}});var Yo=F((up,Qo)=>{var{exec:qo,execSync:Cd}=require("child_process"),Ho=process.platform==="win32";function Go(){if(Ho)try{return Cd("net session >nul 2>&1",{windowsHide:!0,stdio:"ignore"}),!0}catch{return!1}return typeof process.getuid=="function"&&process.getuid()===0}function zo(e){return`'${String(e).replace(/'/g,"''")}'`}function Ed(e){if(!Ho)return Promise.reject(new Error("Windows-only"));let t=Buffer.from(e,"utf16le").toString("base64");if(Go())return new Promise((r,n)=>{qo(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${t}`,{windowsHide:!0},(s,i,o)=>{s?n(new Error(o||s.message)):r(i)})});let a=`
     $proc = Start-Process powershell -ArgumentList @(
       '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.106",
+  "version": "1.0.107",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.106",
+  "version": "1.0.107",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/app/api/cli-tools/opencode-settings/route.js

@@ -71,7 +71,7 @@ export async function GET() {
       configPath: getConfigPath(),
         opencode: {
           models: Object.keys(modelMap),
-          activeModel: config?.model?.startsWith("zevai/") ? config.model.replace(/^zevairouter\//, "") : null,
+          activeModel: config?.model?.startsWith("zevai/") ? config.model.replace(/^zevai\//, "") : null,
           baseURL: providerConfig?.options?.baseURL || null,
         },
     });

package/src/app/api/models/route.js

@@ -18,10 +18,13 @@ export async function GET() {
       })
       .map((m) => {
         const fullModel = `${m.provider}/${m.model}`;
+        // alias map shape is { aliasName: "provider/model" } — reverse-lookup the
+        // alias whose VALUE points at this model (model.js:197 resolves aliases[alias]).
+        const alias = Object.keys(modelAliases).find((a) => modelAliases[a] === fullModel) || m.model;
         return {
           ...m,
           fullModel,
-          alias: modelAliases[fullModel] || m.model,
+          alias,
         };
       });
 
@@ -44,17 +47,18 @@ export async function PUT(request) {
 
     const modelAliases = await getModelAliases();
 
-    // Check if alias already exists for different model
+    // alias map shape is { aliasName: "provider/model" }; the alias name is the KEY.
+    // Reject if this alias name is already bound to a *different* model.
     const existingModel = Object.entries(modelAliases).find(
-      ([key, val]) => val === alias && key !== model
+      ([key, val]) => key === alias && val !== model
     );
 
     if (existingModel) {
       return NextResponse.json({ error: "Alias already in use" }, { status: 400 });
     }
 
-    // Update alias
-    await setModelAlias(model, alias);
+    // Update alias — setModelAlias(alias, model)
+    await setModelAlias(alias, model);
 
     return NextResponse.json({ success: true, model, alias });
   } catch (error) {

package/src/lib/db/repos/usageRepo.js

@@ -768,7 +768,7 @@ export async function appendRequestLog() {}
 
 export async function getRecentLogs(limit = 200) {
   try {
-    const db = getAdapter();
+    const db = await getAdapter();
     const rows = db.all(
       `SELECT timestamp, provider, model, connectionId, promptTokens, completionTokens, status, tokens FROM usageHistory ORDER BY id DESC LIMIT ?`,
       [limit],

package/src/lib/tunnel/cloudflare/cloudflared.js

@@ -418,7 +418,13 @@ function killCloudflaredByPort(port) {
 }
 
 export function killCloudflared(localPort) {
-  intentionalKill = true;
+  // Only suppress the unexpected-exit watchdog when we actually killed a live
+  // child. Setting intentionalKill unconditionally leaks the flag across a fresh
+  // respawn (no in-memory child / dead stale PID -> no 'exit' event consumes it),
+  // so the NEXT child's unexpected exit takes the intentionalKill branch and the
+  // watchdog respawn never fires — the tunnel dies silently.
+  const hadChild = !!cloudflaredProcess;
+  let killedPid = false;
   if (cloudflaredProcess) {
     try {
       cloudflaredProcess.kill();
@@ -430,11 +436,16 @@ export function killCloudflared(localPort) {
   if (pid) {
     try {
       process.kill(pid);
+      killedPid = true;
     } catch (e) { /* ignore */ }
     clearPid();
   }
 
   killCloudflaredByPort(localPort);
+
+  // Arm the flag only when something was actually killed this call; if nothing
+  // was alive, leave it as-is so a future unexpected exit still triggers recovery.
+  intentionalKill = hadChild || killedPid;
 }
 
 export function isCloudflaredRunning() {

package/src/mitm/handlers/kiro.js

@@ -96,8 +96,15 @@ function extractThinking(text, state) {
     ? extractThinking(rest, { inThink: false, thinkBuf: "" })
     : { thinking: null, text: null };
 
+  // Merge thinking from ALL blocks in this chunk — previously only the first block
+  // was returned and recurse.thinking was dropped, silently losing every <think>
+  // block after the first. Join with a blank line so no reasoning content is lost.
+  const allThinking = [thinking, recurse.thinking]
+    .filter((t) => t)
+    .join("\n\n") || null;
+
   return {
-    thinking: thinking || null,
+    thinking: allThinking,
     text: recurse.text || null
   };
 }

package/src/mitm/manager.js

@@ -179,7 +179,13 @@ function decryptPassword(stored) {
       const key = deriveKey(salt);
       const decipher = crypto.createDecipheriv(ENCRYPT_ALGO, key, Buffer.from(ivHex, "hex"));
       decipher.setAuthTag(Buffer.from(tagHex, "hex"));
-      return decipher.update(Buffer.from(dataHex, "hex")) + decipher.final("utf8");
+      // Concatenate raw Buffers first, then decode once — decipher.update() returns a
+      // Buffer; `Buffer + string` would decode each chunk separately and corrupt any
+      // multi-byte UTF-8 sequence split across the update/final boundary (non-ASCII passwords).
+      return Buffer.concat([
+        decipher.update(Buffer.from(dataHex, "hex")),
+        decipher.final(),
+      ]).toString("utf8");
     } catch {
       return null;
     }