zevairouter 1.0.127 → 1.0.129

package/open-sse/config/providerModels.js

@@ -38,6 +38,13 @@ export const PROVIDER_MODELS = {
     { id: "claude-haiku-4-5-20251001", name: "Claude 4.5 Haiku" },
   ],
   cx: withCodexReviewModels([  // OpenAI Codex
+    // GPT 5.6 family (Sol/Terra/Luna) — default Codex models as of 2026-07
+    // gpt-5.6 is the flagship alias (routes to Sol upstream)
+    { id: "gpt-5.6", name: "GPT 5.6", upstreamModelId: "gpt-5.6-sol" },
+    { id: "gpt-5.6-sol", name: "GPT 5.6 Sol" },
+    { id: "gpt-5.6-terra", name: "GPT 5.6 Terra" },
+    { id: "gpt-5.6-luna", name: "GPT 5.6 Luna" },
+    // GPT 5.5 / 5.4 retained for backward compatibility
     { id: "gpt-5.5", name: "GPT 5.5" },
     { id: "gpt-5.4", name: "GPT 5.4" },
     { id: "gpt-5.4-mini", name: "GPT 5.4 Mini" },
@@ -49,6 +56,7 @@ export const PROVIDER_MODELS = {
     { id: "gpt-5.3-codex-none", name: "GPT 5.3 Codex (None)" },
     { id: "gpt-5.3-codex-spark", name: "GPT 5.3 Codex Spark" },
     // Image models (uses image_generation tool, requires Plus/Pro plan)
+    { id: "gpt-5.6-image", name: "GPT 5.6 Image", type: "image", capabilities: ["text2img", "edit"], params: ["size", "quality", "background", "image_detail", "output_format"] },
     { id: "gpt-5.5-image", name: "GPT 5.5 Image", type: "image", capabilities: ["text2img", "edit"], params: ["size", "quality", "background", "image_detail", "output_format"] },
     { id: "gpt-5.4-image", name: "GPT 5.4 Image", type: "image", capabilities: ["text2img", "edit"], params: ["size", "quality", "background", "image_detail", "output_format"] },
     { id: "gpt-5.3-image", name: "GPT 5.3 Image", type: "image", capabilities: ["text2img", "edit"], params: ["size", "quality", "background", "image_detail", "output_format"] },
@@ -319,6 +327,11 @@ export const PROVIDER_MODELS = {
   // API Key Providers (alias = id)
   openai: [
     // Flagship models
+    { id: "gpt-5.6", name: "GPT-5.6", upstreamModelId: "gpt-5.6-sol" },
+    { id: "gpt-5.6-sol", name: "GPT-5.6 Sol" },
+    { id: "gpt-5.6-terra", name: "GPT-5.6 Terra" },
+    { id: "gpt-5.6-luna", name: "GPT-5.6 Luna" },
+    { id: "gpt-5.5", name: "GPT-5.5" },
     { id: "gpt-5.4", name: "GPT-5.4" },
     { id: "gpt-5.4-mini", name: "GPT-5.4 Mini" },
     { id: "gpt-5.4-nano", name: "GPT-5.4 Nano" },

package/open-sse/executors/codex.js

@@ -27,7 +27,7 @@ const SERVER_ID_PATTERN = /^(rs|fc|resp|msg)_/;
 // Hosted tool types that Codex/OpenAI Responses executes server-side
 const CODEX_HOSTED_TOOL_TYPES = new Set([
   "image_generation", "web_search", "web_search_preview", "file_search",
-  "computer", "computer_use_preview", "code_interpreter", "mcp", "local_shell"
+  "computer", "computer_use_preview", "code_interpreter", "mcp", "local_shell", "custom"
 ]);
 
 // Allowlist of fields accepted by Codex Responses API — anything else is stripped
@@ -46,6 +46,17 @@ function convertSystemToDeveloperRole(body) {
   }
 }
 
+function extractCodexAdditionalTools(body) {
+  if (!Array.isArray(body.input)) return;
+  const tools = [];
+  body.input = body.input.filter((item) => {
+    if (item?.type !== "additional_tools") return true;
+    if (Array.isArray(item.tools)) tools.push(...item.tools);
+    return false;
+  });
+  if (tools.length) body.tools = [...(Array.isArray(body.tools) ? body.tools : []), ...tools];
+}
+
 // Strip server-generated item IDs (rs_/fc_/resp_/msg_) from input — avoids 404 with store=false
 function stripStoredItemReferences(body) {
   if (!Array.isArray(body.input)) return;
@@ -387,6 +398,8 @@ export class CodexExecutor extends BaseExecutor {
       body.input = [{ type: "message", role: "user", content: [{ type: "input_text", text: "..." }] }];
     }
 
+    // Move Codex CLI's additional_tools input item into the Responses API tools field.
+    extractCodexAdditionalTools(body);
     // Keep system prompts in body.input as role=developer so they stay in the cacheable prefix
     convertSystemToDeveloperRole(body);
     // Strip server-generated item IDs (rs_/fc_/resp_/msg_) — Codex /responses can't resolve when store=false
@@ -411,17 +424,18 @@ export class CodexExecutor extends BaseExecutor {
     }
 
     // Map virtual Codex review models to the upstream Codex model before suffix parsing.
-    body.model = getModelUpstreamId("cx", body.model || model);
+    body.model = getModelUpstreamId("cx", model || body.model);
 
     // Extract thinking level from model name suffix
-    // e.g., gpt-5.3-codex-high → high, gpt-5.3-codex → medium (default)
-    const effortLevels = ['none', 'low', 'medium', 'high', 'xhigh'];
+    // e.g., gpt-5.3-codex-high → high, gpt-5.6-sol-max → max, gpt-5.6-sol → low (default)
+    // Check longest first so "xhigh" wins over "high", "minimal" over "none" prefixes, etc.
+    const effortLevels = ['minimal', 'xhigh', 'none', 'low', 'medium', 'high', 'max'];
     let modelEffort = null;
     for (const level of effortLevels) {
       if (body.model.endsWith(`-${level}`)) {
         modelEffort = level;
         // Strip suffix from model name for actual API call
-        body.model = body.model.replace(`-${level}`, '');
+        body.model = body.model.slice(0, -(level.length + 1));
         break;
       }
     }

package/open-sse/utils/thinkingSuffix.js

@@ -4,7 +4,7 @@
  */
 
 const KNOWN_LEVELS = new Set([
-  "none", "off", "auto", "minimal", "low", "medium", "high", "xhigh", "max", "on", "thinking",
+  "none", "off", "auto", "minimal", "low", "medium", "high", "xhigh", "max", "ultra", "on", "thinking",
 ]);
 
 /** Strip trailing `model(value)` → `model` (no-op when absent). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.127",
+  "version": "1.0.129",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/app/(dashboard)/dashboard/cli-tools/components/CodexToolCard.js

@@ -355,8 +355,8 @@ model = "${effectiveSubagentModel}"
                   <div className="flex min-w-0 flex-col gap-2">
                     <div className="flex flex-wrap gap-1.5">
                       <button type="button" onClick={() => applyGatewayPreset("auto-codex")} className="rounded border border-border bg-surface px-2 py-1 text-xs text-text-main transition-colors hover:border-primary/60 hover:bg-primary/5">Auto Codex</button>
-                      <button type="button" onClick={() => applyGatewayPreset("router/gpt-5.5")} className="rounded border border-border bg-surface px-2 py-1 text-xs text-text-main transition-colors hover:border-primary/60 hover:bg-primary/5">Router Pool</button>
-                      <button type="button" title={gatewayOriginal?.label ? `Original: ${gatewayOriginal.label}` : "Original Codex account"} onClick={() => applyGatewayPreset("original/gpt-5.5")} className="rounded border border-border bg-surface px-2 py-1 text-xs text-text-main transition-colors hover:border-primary/60 hover:bg-primary/5">
+                      <button type="button" onClick={() => applyGatewayPreset("router/gpt-5.6")} className="rounded border border-border bg-surface px-2 py-1 text-xs text-text-main transition-colors hover:border-primary/60 hover:bg-primary/5">Router Pool</button>
+                      <button type="button" title={gatewayOriginal?.label ? `Original: ${gatewayOriginal.label}` : "Original Codex account"} onClick={() => applyGatewayPreset("original/gpt-5.6")} className="rounded border border-border bg-surface px-2 py-1 text-xs text-text-main transition-colors hover:border-primary/60 hover:bg-primary/5">
                         Original
                       </button>
                     </div>

package/src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.js

@@ -59,6 +59,9 @@ export default function APIPageClient({ machineId }) {
   const [confirmState, setConfirmState] = useState(null);
   const [keyPending, setKeyPending] = useState(null);
   const [keyStatus, setKeyStatus] = useState(null);
+  // Which keys are currently unmasked in the UI + cached secrets after reveal
+  const [visibleKeys, setVisibleKeys] = useState(() => new Set());
+  const [revealedSecrets, setRevealedSecrets] = useState(() => ({}));
 
   const [requireApiKey, setRequireApiKey] = useState(false);
   const [requireLogin, setRequireLogin] = useState(true);
@@ -659,6 +662,10 @@ export default function APIPageClient({ machineId }) {
       const data = await res.json();
       if (!res.ok) throw new Error(data.error || `Failed to create key (${res.status})`);
       setCreatedKey(data.key);
+      // Cache secret so the eye/copy controls work immediately after create
+      if (data.id && data.key) {
+        setRevealedSecrets((prev) => ({ ...prev, [data.id]: data.key }));
+      }
       await fetchData();
       setNewKeyName("");
       setShowAddModal(false);
@@ -688,6 +695,12 @@ export default function APIPageClient({ machineId }) {
             next.delete(id);
             return next;
           });
+          setRevealedSecrets((prev) => {
+            if (!(id in prev)) return prev;
+            const next = { ...prev };
+            delete next[id];
+            return next;
+          });
           setKeyStatus({ type: "success", message: "API key deleted" });
         } catch (error) {
           setKeyStatus({ type: "error", message: error.message });
@@ -744,6 +757,58 @@ export default function APIPageClient({ machineId }) {
     return fullKey.length > 8 ? fullKey.slice(0, 8) + "..." : fullKey;
   };
 
+  const displayKeyValue = (key) => {
+    if (visibleKeys.has(key.id) && revealedSecrets[key.id]) {
+      return revealedSecrets[key.id];
+    }
+    return key.maskedKey || maskKey(key.key) || "••••••••";
+  };
+
+  const ensureSecret = async (keyId) => {
+    if (revealedSecrets[keyId]) return revealedSecrets[keyId];
+    const res = await fetch(`/api/keys/${keyId}?reveal=1`, { cache: "no-store" });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data.error || `Failed to reveal key (${res.status})`);
+    const secret = data.key?.key || data.key;
+    if (typeof secret !== "string" || !secret) {
+      throw new Error("Key secret is not available");
+    }
+    setRevealedSecrets((prev) => ({ ...prev, [keyId]: secret }));
+    return secret;
+  };
+
+  const toggleKeyVisibility = async (keyId) => {
+    if (visibleKeys.has(keyId)) {
+      setVisibleKeys((prev) => {
+        const next = new Set(prev);
+        next.delete(keyId);
+        return next;
+      });
+      return;
+    }
+    try {
+      await ensureSecret(keyId);
+      setVisibleKeys((prev) => {
+        const next = new Set(prev);
+        next.add(keyId);
+        return next;
+      });
+      setKeyStatus(null);
+    } catch (error) {
+      setKeyStatus({ type: "error", message: error.message });
+    }
+  };
+
+  const handleCopyKey = async (keyId) => {
+    try {
+      const secret = await ensureSecret(keyId);
+      copy(secret, keyId);
+      setKeyStatus(null);
+    } catch (error) {
+      setKeyStatus({ type: "error", message: error.message });
+    }
+  };
+
   const [baseUrl, setBaseUrl] = useState("/v1");
 
   // Hydration fix: Only access window on client side
@@ -1093,10 +1158,32 @@ export default function APIPageClient({ machineId }) {
               >
                 <div className="flex-1 min-w-0">
                   <p className="text-sm font-medium">{key.name}</p>
-                  <div className="flex items-center gap-2 mt-1">
-                    <code className="text-xs text-text-muted font-mono">
-                      {key.maskedKey || maskKey(key.key)}
+                  <div className="flex items-center gap-2 mt-1 min-w-0">
+                    <code className="text-xs text-text-muted font-mono truncate max-w-[min(100%,28rem)]">
+                      {displayKeyValue(key)}
                     </code>
+                    <button
+                      type="button"
+                      onClick={() => toggleKeyVisibility(key.id)}
+                      className="p-1 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary opacity-100 sm:opacity-0 sm:group-hover:opacity-100 transition-all shrink-0"
+                      title={visibleKeys.has(key.id) ? "Hide key" : "Show key"}
+                      aria-label={visibleKeys.has(key.id) ? "Hide API key" : "Show API key"}
+                    >
+                      <span className="material-symbols-outlined text-[14px]">
+                        {visibleKeys.has(key.id) ? "visibility_off" : "visibility"}
+                      </span>
+                    </button>
+                    <button
+                      type="button"
+                      onClick={() => handleCopyKey(key.id)}
+                      className="p-1 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary opacity-100 sm:opacity-0 sm:group-hover:opacity-100 transition-all shrink-0"
+                      title="Copy key"
+                      aria-label="Copy API key"
+                    >
+                      <span className="material-symbols-outlined text-[14px]">
+                        {copied === key.id ? "check" : "content_copy"}
+                      </span>
+                    </button>
                   </div>
                   <p className="text-xs text-text-muted mt-1">
                     Created {new Date(key.createdAt).toLocaleDateString()}

package/src/app/api/cli-tools/codex-settings/route.js

@@ -130,7 +130,7 @@ export async function POST(request) {
 
     // Update only ZevaiRouter related fields (api_key goes to auth.json, not config.toml)
     parsed.model = model;
-    parsed.model_provider = "zevairouter";
+    parsed.model_provider = "zevai";
 
     // Update or create zevairouter provider section (no api_key - Codex reads from auth.json)
     // Ensure /v1 suffix is added only once
@@ -197,7 +197,7 @@ export async function DELETE() {
     }
 
     // Remove ZevaiRouter related root fields only if they point to zevairouter
-    if (parsed.model_provider === "zevairouter") {
+    if (parsed.model_provider === "zevai" || parsed.model_provider === "zevairouter") {
       delete parsed.model;
       delete parsed.model_provider;
     }

package/src/app/api/keys/[id]/route.js

@@ -2,10 +2,12 @@ import { NextResponse } from "next/server";
 import { deleteApiKey, getApiKeyById, updateApiKey } from "@/lib/localDb";
 
 // GET /api/keys/[id] - Get single key
+// ?reveal=1 returns the full secret (dashboard auth only — used by eye toggle)
 export async function GET(request, { params }) {
   try {
     const { id } = await params;
-    const key = await getApiKeyById(id);
+    const reveal = new URL(request.url).searchParams.get("reveal") === "1";
+    const key = await getApiKeyById(id, reveal);
     if (!key) {
       return NextResponse.json({ error: "Key not found" }, { status: 404 });
     }

package/src/app/api/oauth/antigravity/bulk-import/route.js

@@ -30,7 +30,6 @@ export async function POST(request) {
     const job = await manager.startJob({
       accounts,
       concurrency: body?.concurrency,
-      engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode,
       proxyPoolId: body?.proxyPoolId,
     });

package/src/app/api/oauth/cloudflare-ai/bulk-import/route.js

@@ -34,7 +34,6 @@ export async function POST(request) {
     const job = await manager.startJob({
       accounts,
       concurrency: body?.concurrency,
-      engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode,
       proxyPoolId: body?.proxyPoolId,
     });

package/src/app/api/oauth/codebuddy/bulk-import/route.js

@@ -30,7 +30,6 @@ export async function POST(request) {
     const job = await manager.startJob({
       accounts,
       concurrency: body?.concurrency,
-      engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode || "none",
       proxyPoolId: body?.proxyPoolId || null,
     });

package/src/app/api/oauth/codebuddy-cn/bulk-import/route.js

@@ -41,7 +41,6 @@ export async function POST(request) {
     const job = await manager.startJob({
       count: countNum,
       concurrency: body?.concurrency,
-      engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode,
       proxyPoolId: body?.proxyPoolId,
       manualProxyUrl: typeof body?.manualProxyUrl === "string" && body.manualProxyUrl.trim() ? body.manualProxyUrl.trim() : null,

package/src/app/api/oauth/kiro/bulk-import/route.js

@@ -30,7 +30,6 @@ export async function POST(request) {
     const job = await manager.startJob({
       accounts,
       concurrency: body?.concurrency,
-      engine: body?.engine,
       proxyPoolMode: body?.proxyPoolMode || "none",
       proxyPoolId: body?.proxyPoolId || null,
     });

package/src/app/api/oauth/qoder/bulk-import/route.js

@@ -30,7 +30,6 @@ export async function POST(request) {
     const job = await manager.startJob({
       accounts,
       concurrency: body?.concurrency,
-      engine: body?.engine,
     });
 
     return NextResponse.json({

package/src/lib/db/repos/apiKeysRepo.js

@@ -38,10 +38,10 @@ export async function getApiKeys(includeSecrets = false) {
   return rows.map((row) => rowToKey(row, includeSecrets));
 }
 
-export async function getApiKeyById(id) {
+export async function getApiKeyById(id, includeSecret = false) {
   const db = await getAdapter();
   const row = db.get(`SELECT * FROM apiKeys WHERE id = ?`, [id]);
-  return rowToKey(row);
+  return rowToKey(row, includeSecret);
 }
 
 export async function createApiKey(name, machineId) {

package/src/lib/oauth/services/antigravityBulkImportManager.js

@@ -103,19 +103,10 @@ async function defaultSaveAntigravityConnection({ tokens, email }) {
 
 async function defaultBrowserLauncher(job) {
   const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
-  const engine = job?.engine || "chromium";
-  // Same Google OAuth surface as Kiro: stock headless Chromium gets
-  // /v3/signin/rejected or CAPTCHA. Default headed (Xvfb on Linux).
-  // Override: ZEVAI_ANTIGRAVITY_HEADLESS=0|1 or ZEVAI_KIRO_HEADLESS=0|1.
   const envHeadless =
     process.env.ZEVAI_ANTIGRAVITY_HEADLESS ?? process.env.ZEVAI_KIRO_HEADLESS;
-  let headless;
-  if (envHeadless === "1" || envHeadless === "true") headless = true;
-  else if (envHeadless === "0" || envHeadless === "false") headless = false;
-  else if (engine === "camoufox") headless = true;
-  else headless = false;
+  const headless = envHeadless === "1" || envHeadless === "true";
   return launchBulkImportBrowser({
-    engine,
     headless,
     windowSize: { width: 1280, height: 900 },
   });