zevairouter 1.0.110 → 1.0.112

package/cli/app/CHANGELOG.md

@@ -1,7 +1,18 @@
+# v1.0.112 (2026-07-21)
+
+## Features
+- **CodeBuddy CN bulk import — manual proxy URL**: the automation previously only accepted proxies from DB proxy pools (`proxyPoolMode` + `proxyPoolId`). The register modal now has a "Manual Proxy URL" field — paste any `http(s)://` or `socks4/5://` proxy (e.g. a sticky residential URL you haven't added to a pool) and it takes precedence over pool selection (dropdown auto-disables). The manager validates the scheme, marks the job `proxyPoolMode: "manual"`, and every account in the job runs through that proxy.
+
+# v1.0.111 (2026-07-21)
+
+## Fixes
+- **CodeBuddy CN bulk import — SPA "did not boot" + API key 401** (re-release): v1.0.110 was published before these changes were committed, so the live build never contained them. This release ships them. (1) Tencent's privacy-consent dialog (a `同意` button) gates the login UI depending on the egress IP — the automation now waits up to 6s for the consent button and dismisses it (logs `cn_consent_dismissed`) before the normal SPA-ready wait, instead of timing out with `html=2670`. (2) API key creation now retries up to 3 rounds on 401/403 (openresty edge rejecting half-synced Keycloak cookies), nudging the OIDC re-handoff and waiting for a strong Keycloak session with 8s/16s/24s backoff.
+
 # v1.0.110 (2026-07-21)
 
 ## Fixes
 - **CLI Tools: OpenCode page crash ("This page couldn't load")**: `OpenCodeToolCard` line 72 had a broken optional chain — `status?.config?.agent?.explorer?.model?.startsWith("zevai/") || status.config?.agent...` — when `status` was `null` (tool not installed), the second operand `status.config` threw `TypeError: Cannot read properties of null (reading 'config')` during render, crashing the entire page. Fixed by extracting `explorerModel` with a full optional chain and using it for both the condition and the value. Also added `isOpen` guard to `ModelSelectModal.groupedModels` useMemo to skip heavy per-provider computation when the modal is closed (prevents hydration lag with many connections). Verified with headless-Chrome repro: page renders clean, zero pageerror.
+- **CodeBuddy CN bulk import — SPA "did not boot" + API key 401**: two compounding fixes in the phone-automation flow. (1) Tencent's privacy-consent dialog (a `同意` button) gates the login UI depending on the egress IP — the automation waited for the SPA to be "ready" while the consent modal blocked it, so it timed out with `html=2670`. The flow now waits up to 6s for the consent button, dismisses it (logs `cn_consent_dismissed`), then proceeds with the normal SPA-ready wait. (2) When API key creation returned 401/403 (openresty edge rejecting half-synced Keycloak cookies, common on slow proxies), the flow now retries up to 3 rounds — nudging the OIDC re-handoff and waiting for a strong Keycloak session with 8s/16s/24s backoff — instead of failing on the first attempt. Error messages now surface the edge-proxy-blocked case explicitly.
 
 # v1.0.109 (2026-07-21)
 

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.110",
+  "version": "1.0.112",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.110",
+  "version": "1.0.112",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.110",
+  "version": "1.0.112",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/app/api/oauth/codebuddy-cn/bulk-import/route.js

@@ -44,6 +44,7 @@ export async function POST(request) {
       engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode,
       proxyPoolId: body?.proxyPoolId,
+      manualProxyUrl: typeof body?.manualProxyUrl === "string" && body.manualProxyUrl.trim() ? body.manualProxyUrl.trim() : null,
       region,
     });
 

package/src/dashboardGuard.js

@@ -191,10 +191,12 @@ export async function proxy(request) {
   // Always protected - require valid JWT or local CLI token (machineId-based)
   if (ALWAYS_PROTECTED.some((p) => pathname.startsWith(p))) {
     const isTerminalApi = pathname.startsWith("/api/terminal");
-    // Terminal allows requireLogin=false path (still needs secondary terminal password).
+    // Local browser with requireLogin=false can reach sensitive routes (e.g. DB import);
+    // remote still requires JWT/CLI token. Same trust level as LOCAL_ONLY_PATHS.
     const dashboardOk =
       (await hasValidCliToken(request))
       || (await hasValidToken(request))
+      || (isLocalRequest(request) && (await isAuthenticated(request)))
       || (isTerminalApi && (await isAuthenticated(request)));
 
     if (!dashboardOk) {

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -204,7 +204,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
    * @param {string} [opts.proxyPoolId]
    * @param {string} [opts.region]          5sim region (hongkong|china|any)
    */
-  async startJob({ count, concurrency, engine, proxyPoolMode, proxyPoolId, region }) {
+  async startJob({ count, concurrency, engine, proxyPoolMode, proxyPoolId, manualProxyUrl, region }) {
     // Validate count
     const countNum = Number.parseInt(count, 10);
     if (!Number.isFinite(countNum) || countNum < 1) {
@@ -232,9 +232,19 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     // Validate region
     const resolvedRegion = SUPPORTED_REGIONS.has(region) ? region : DEFAULT_REGION;
 
-    // Resolve proxy pool URLs for round-robin assignment (copy from base)
+    // Resolve proxy URLs: manual URL takes precedence over pool selection.
     let proxyUrls = [];
-    if (proxyPoolMode === "all") {
+    const manualProxy = typeof manualProxyUrl === "string" ? manualProxyUrl.trim() : "";
+    if (manualProxy) {
+      // Basic scheme check — Playwright needs a parseable http(s)/socks URL.
+      if (!/^(https?|socks4|socks5):\/\/.+/i.test(manualProxy)) {
+        throw Object.assign(
+          new Error("manualProxyUrl must be a valid proxy URL (http://, https://, socks4://, or socks5://)"),
+          { error: "manualProxyUrl must be a valid proxy URL (http://, https://, socks4://, or socks5://)" },
+        );
+      }
+      proxyUrls = [manualProxy];
+    } else if (proxyPoolMode === "all") {
       const pools = await getProxyPools({ isActive: true });
       proxyUrls = pools.map((p) => p.proxyUrl).filter(Boolean);
     } else if (proxyPoolMode === "single" && proxyPoolId) {
@@ -256,7 +266,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       status: "running",
       concurrency: clampCnConcurrency(concurrency),
       engine: resolvedEngine,
-      proxyPoolMode: proxyPoolMode || "none",
+      proxyPoolMode: manualProxy ? "manual" : (proxyPoolMode || "none"),
       proxyUrls,
       region: resolvedRegion,
       createdAt,
@@ -835,10 +845,16 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
       }
 
-      // One more full nudge cycle if key creation returned 401/403 (session half-baked)
-      const status = apiKeyResult?.status;
-      if (!apiKeyResult?.ok && (status === 401 || status === 403 || status === 0 || !apiKeyResult)) {
-        this.setAccountStep(account, "retrying_api_key", "API key 401/403 — re-running OIDC handoff then retry");
+      // Retry loop on 401/403 — openresty edge blocks create-key when Keycloak
+      // cookies are half-synced (common on slow proxies). Nudge OIDC handoff,
+      // wait for strong session, then retry. Up to 3 rounds with backoff.
+      const isAuthBlocked = (r) => !r?.ok && (r?.status === 401 || r?.status === 403 || r?.status === 0 || !r);
+      for (let round = 1; round <= 3 && isAuthBlocked(apiKeyResult); round += 1) {
+        this.setAccountStep(
+          account,
+          "retrying_api_key",
+          `API key 401/403 — OIDC re-handoff round ${round}/3 (waiting strong session)`,
+        );
         await this.persistJobSnapshot(job, { forcePreview: true });
         for (const path of [
           "https://www.codebuddy.cn/",
@@ -848,14 +864,26 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           await page.goto(path, { waitUntil: "domcontentloaded", timeout: 45_000 }).catch(() => null);
           await waitAfterNav();
         }
+        // Wait for strong Keycloak cookie — openresty accepts api-keys only after full session.
+        await waitUntil(async () => {
+          const snap = await cookieSnapshot();
+          return hasStrongKeycloak(snap.names);
+        }, { timeout: 8_000 * round, interval: 300 }).catch(() => null);
         apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
       }
 
       const businessCode = apiKeyResult?.data?.code;
       const businessOk = businessCode === 0 || businessCode === 200 || typeof businessCode === "undefined";
       if (!apiKeyResult || !apiKeyResult.ok || !apiKeyResult.data || !businessOk) {
+        // Surface openresty HTML block (_raw) clearly instead of opaque "code=n/a".
+        const rawSnippet = typeof apiKeyResult?.data?._raw === "string"
+          ? apiKeyResult.data._raw.replace(/\s+/g, " ").slice(0, 120)
+          : null;
+        const edgeNote = rawSnippet && /openresty|nginx|Authorization Required/i.test(rawSnippet)
+          ? " [edge proxy blocked — session half-baked]"
+          : "";
         throw new Error(
-          `API key creation failed (HTTP ${apiKeyResult?.status ?? "no-response"}, code=${businessCode ?? "n/a"}): ${JSON.stringify(apiKeyResult?.data ?? null).slice(0, 200)}`,
+          `API key creation failed (HTTP ${apiKeyResult?.status ?? "no-response"}, code=${businessCode ?? "n/a"})${edgeNote}: ${JSON.stringify(apiKeyResult?.data ?? null).slice(0, 200)}`,
         );
       }
 

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -65,6 +65,14 @@ const SPA_READY_SELECTORS = [
   ".login-phone-box",
 ];
 
+// Tencent privacy-consent dialog that gates the login UI behind a 同意 button.
+// Some proxy egress IPs trigger it every load; others never see it.
+const CONSENT_BUTTON_SELECTORS = [
+  "button:has-text('同意')",
+  "text=同意并继续",
+  "text=同意",
+];
+
 // Iframe selector
 const PHONE_IFRAME_SELECTOR = "#phone-iframe";
 
@@ -204,11 +212,19 @@ export async function runCodeBuddyCnPhoneRegistration({
         });
         throwIfCancelled();
 
-        // Give the SPA a short moment to mount React/Vue after document commit
-        await page.waitForTimeout(1_500);
+        // Wait for document to finish parsing (readyState interactive/complete) — scales to
+        // proxy speed instead of a fixed 1.5s that fires too early on slow China proxies
+        await page.waitForFunction(() => document.readyState !== "loading", { timeout: 10_000 }).catch(() => {});
         throwIfCancelled();
 
-        // SPA shell loads first; wait for any login UI marker (not networkidle — long-lived sockets)
+        // SPA shell loads first; dismiss privacy-consent dialog if it gates the login UI,
+        // then wait for any login UI marker (not networkidle — long-lived sockets)
+        const consentBtn = await waitForFirstVisibleLocator(page, CONSENT_BUTTON_SELECTORS, { timeout: 6_000 });
+        if (consentBtn) {
+          await consentBtn.click().catch(() => {});
+          reportStep("cn_consent_dismissed", "Privacy consent dialog dismissed (同意)");
+          await page.waitForTimeout(1_000);
+        }
         const spaReady = await waitForAnyVisible(page, SPA_READY_SELECTORS, SPA_TIMEOUT_MS);
         throwIfCancelled();
         if (!spaReady) {

package/src/shared/components/CodeBuddyCnPhoneRegisterModal.js

@@ -57,6 +57,7 @@ export default function CodeBuddyCnPhoneRegisterModal({ isOpen, onClose, onSucce
   const [engine, setEngine] = useState(DEFAULT_ENGINE);
   const [proxyPoolSelection, setProxyPoolSelection] = useState("");
   const [proxyPools, setProxyPools] = useState([]);
+  const [manualProxyUrl, setManualProxyUrl] = useState("");
   const [fiveSimApiKey, setFiveSimApiKey] = useState("");
   const [fiveSimKeyConfigured, setFiveSimKeyConfigured] = useState(false);
   const [savingKey, setSavingKey] = useState(false);
@@ -184,6 +185,7 @@ export default function CodeBuddyCnPhoneRegisterModal({ isOpen, onClose, onSucce
 
     let proxyPoolMode = "none";
     let proxyPoolId = null;
+    const trimmedManualProxy = manualProxyUrl.trim();
     if (proxyPoolSelection === "all") {
       proxyPoolMode = "all";
     } else if (proxyPoolSelection && proxyPoolSelection !== "") {
@@ -201,6 +203,7 @@ export default function CodeBuddyCnPhoneRegisterModal({ isOpen, onClose, onSucce
           engine,
           proxyPoolMode,
           proxyPoolId,
+          manualProxyUrl: trimmedManualProxy || null,
           region,
         }),
       });
@@ -216,7 +219,7 @@ export default function CodeBuddyCnPhoneRegisterModal({ isOpen, onClose, onSucce
       startInFlightRef.current = false;
       setImporting(false);
     }
-  }, [count, region, concurrency, engine, proxyPoolSelection, fiveSimKeyConfigured, storageKey, importing, runningJob]);
+  }, [count, region, concurrency, engine, proxyPoolSelection, manualProxyUrl, fiveSimKeyConfigured, storageKey, importing, runningJob]);
 
   // Cancel job
   const handleCancelJob = useCallback(async () => {
@@ -370,7 +373,7 @@ export default function CodeBuddyCnPhoneRegisterModal({ isOpen, onClose, onSucce
                     className="w-full rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main focus:border-primary focus:outline-none"
                     value={proxyPoolSelection}
                     onChange={(e) => setProxyPoolSelection(e.target.value)}
-                    disabled={importing}
+                    disabled={importing || !!manualProxyUrl.trim()}
                   >
                     <option value="">None</option>
                     <option value="all">All Active Pools (round-robin)</option>
@@ -381,6 +384,18 @@ export default function CodeBuddyCnPhoneRegisterModal({ isOpen, onClose, onSucce
                 </div>
               </div>
 
+              <div>
+                <label className="mb-1 block text-xs font-medium text-text-muted">Manual Proxy URL (optional, overrides pool)</label>
+                <input
+                  type="text"
+                  className="w-full rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main focus:border-primary focus:outline-none"
+                  placeholder="http://user:pass@host:port or socks5://host:port"
+                  value={manualProxyUrl}
+                  onChange={(e) => setManualProxyUrl(e.target.value)}
+                  disabled={importing}
+                />
+              </div>
+
               {error && (
                 <div className="rounded-lg bg-red-500/10 p-3 text-sm text-red-400">{error}</div>
               )}