zevairouter 1.0.110 → 1.0.111

package/cli/app/CHANGELOG.md

@@ -1,7 +1,13 @@
+# v1.0.111 (2026-07-21)
+
+## Fixes
+- **CodeBuddy CN bulk import — SPA "did not boot" + API key 401** (re-release): v1.0.110 was published before these changes were committed, so the live build never contained them. This release ships them. (1) Tencent's privacy-consent dialog (a `同意` button) gates the login UI depending on the egress IP — the automation now waits up to 6s for the consent button and dismisses it (logs `cn_consent_dismissed`) before the normal SPA-ready wait, instead of timing out with `html=2670`. (2) API key creation now retries up to 3 rounds on 401/403 (openresty edge rejecting half-synced Keycloak cookies), nudging the OIDC re-handoff and waiting for a strong Keycloak session with 8s/16s/24s backoff.
+
 # v1.0.110 (2026-07-21)
 
 ## Fixes
 - **CLI Tools: OpenCode page crash ("This page couldn't load")**: `OpenCodeToolCard` line 72 had a broken optional chain — `status?.config?.agent?.explorer?.model?.startsWith("zevai/") || status.config?.agent...` — when `status` was `null` (tool not installed), the second operand `status.config` threw `TypeError: Cannot read properties of null (reading 'config')` during render, crashing the entire page. Fixed by extracting `explorerModel` with a full optional chain and using it for both the condition and the value. Also added `isOpen` guard to `ModelSelectModal.groupedModels` useMemo to skip heavy per-provider computation when the modal is closed (prevents hydration lag with many connections). Verified with headless-Chrome repro: page renders clean, zero pageerror.
+- **CodeBuddy CN bulk import — SPA "did not boot" + API key 401**: two compounding fixes in the phone-automation flow. (1) Tencent's privacy-consent dialog (a `同意` button) gates the login UI depending on the egress IP — the automation waited for the SPA to be "ready" while the consent modal blocked it, so it timed out with `html=2670`. The flow now waits up to 6s for the consent button, dismisses it (logs `cn_consent_dismissed`), then proceeds with the normal SPA-ready wait. (2) When API key creation returned 401/403 (openresty edge rejecting half-synced Keycloak cookies, common on slow proxies), the flow now retries up to 3 rounds — nudging the OIDC re-handoff and waiting for a strong Keycloak session with 8s/16s/24s backoff — instead of failing on the first attempt. Error messages now surface the edge-proxy-blocked case explicitly.
 
 # v1.0.109 (2026-07-21)
 

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.110",
+  "version": "1.0.111",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.110",
+  "version": "1.0.111",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.110",
+  "version": "1.0.111",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/dashboardGuard.js

@@ -191,10 +191,12 @@ export async function proxy(request) {
   // Always protected - require valid JWT or local CLI token (machineId-based)
   if (ALWAYS_PROTECTED.some((p) => pathname.startsWith(p))) {
     const isTerminalApi = pathname.startsWith("/api/terminal");
-    // Terminal allows requireLogin=false path (still needs secondary terminal password).
+    // Local browser with requireLogin=false can reach sensitive routes (e.g. DB import);
+    // remote still requires JWT/CLI token. Same trust level as LOCAL_ONLY_PATHS.
     const dashboardOk =
       (await hasValidCliToken(request))
       || (await hasValidToken(request))
+      || (isLocalRequest(request) && (await isAuthenticated(request)))
       || (isTerminalApi && (await isAuthenticated(request)));
 
     if (!dashboardOk) {

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -835,10 +835,16 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
       }
 
-      // One more full nudge cycle if key creation returned 401/403 (session half-baked)
-      const status = apiKeyResult?.status;
-      if (!apiKeyResult?.ok && (status === 401 || status === 403 || status === 0 || !apiKeyResult)) {
-        this.setAccountStep(account, "retrying_api_key", "API key 401/403 — re-running OIDC handoff then retry");
+      // Retry loop on 401/403 — openresty edge blocks create-key when Keycloak
+      // cookies are half-synced (common on slow proxies). Nudge OIDC handoff,
+      // wait for strong session, then retry. Up to 3 rounds with backoff.
+      const isAuthBlocked = (r) => !r?.ok && (r?.status === 401 || r?.status === 403 || r?.status === 0 || !r);
+      for (let round = 1; round <= 3 && isAuthBlocked(apiKeyResult); round += 1) {
+        this.setAccountStep(
+          account,
+          "retrying_api_key",
+          `API key 401/403 — OIDC re-handoff round ${round}/3 (waiting strong session)`,
+        );
         await this.persistJobSnapshot(job, { forcePreview: true });
         for (const path of [
           "https://www.codebuddy.cn/",
@@ -848,14 +854,26 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           await page.goto(path, { waitUntil: "domcontentloaded", timeout: 45_000 }).catch(() => null);
           await waitAfterNav();
         }
+        // Wait for strong Keycloak cookie — openresty accepts api-keys only after full session.
+        await waitUntil(async () => {
+          const snap = await cookieSnapshot();
+          return hasStrongKeycloak(snap.names);
+        }, { timeout: 8_000 * round, interval: 300 }).catch(() => null);
         apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
       }
 
       const businessCode = apiKeyResult?.data?.code;
       const businessOk = businessCode === 0 || businessCode === 200 || typeof businessCode === "undefined";
       if (!apiKeyResult || !apiKeyResult.ok || !apiKeyResult.data || !businessOk) {
+        // Surface openresty HTML block (_raw) clearly instead of opaque "code=n/a".
+        const rawSnippet = typeof apiKeyResult?.data?._raw === "string"
+          ? apiKeyResult.data._raw.replace(/\s+/g, " ").slice(0, 120)
+          : null;
+        const edgeNote = rawSnippet && /openresty|nginx|Authorization Required/i.test(rawSnippet)
+          ? " [edge proxy blocked — session half-baked]"
+          : "";
         throw new Error(
-          `API key creation failed (HTTP ${apiKeyResult?.status ?? "no-response"}, code=${businessCode ?? "n/a"}): ${JSON.stringify(apiKeyResult?.data ?? null).slice(0, 200)}`,
+          `API key creation failed (HTTP ${apiKeyResult?.status ?? "no-response"}, code=${businessCode ?? "n/a"})${edgeNote}: ${JSON.stringify(apiKeyResult?.data ?? null).slice(0, 200)}`,
         );
       }
 

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -65,6 +65,14 @@ const SPA_READY_SELECTORS = [
   ".login-phone-box",
 ];
 
+// Tencent privacy-consent dialog that gates the login UI behind a 同意 button.
+// Some proxy egress IPs trigger it every load; others never see it.
+const CONSENT_BUTTON_SELECTORS = [
+  "button:has-text('同意')",
+  "text=同意并继续",
+  "text=同意",
+];
+
 // Iframe selector
 const PHONE_IFRAME_SELECTOR = "#phone-iframe";
 
@@ -204,11 +212,19 @@ export async function runCodeBuddyCnPhoneRegistration({
         });
         throwIfCancelled();
 
-        // Give the SPA a short moment to mount React/Vue after document commit
-        await page.waitForTimeout(1_500);
+        // Wait for document to finish parsing (readyState interactive/complete) — scales to
+        // proxy speed instead of a fixed 1.5s that fires too early on slow China proxies
+        await page.waitForFunction(() => document.readyState !== "loading", { timeout: 10_000 }).catch(() => {});
         throwIfCancelled();
 
-        // SPA shell loads first; wait for any login UI marker (not networkidle — long-lived sockets)
+        // SPA shell loads first; dismiss privacy-consent dialog if it gates the login UI,
+        // then wait for any login UI marker (not networkidle — long-lived sockets)
+        const consentBtn = await waitForFirstVisibleLocator(page, CONSENT_BUTTON_SELECTORS, { timeout: 6_000 });
+        if (consentBtn) {
+          await consentBtn.click().catch(() => {});
+          reportStep("cn_consent_dismissed", "Privacy consent dialog dismissed (同意)");
+          await page.waitForTimeout(1_000);
+        }
         const spaReady = await waitForAnyVisible(page, SPA_READY_SELECTORS, SPA_TIMEOUT_MS);
         throwIfCancelled();
         if (!spaReady) {