zevairouter 1.0.147 → 1.0.149

package/cli/app/CHANGELOG.md

@@ -1,3 +1,22 @@
+# v1.0.149 (2026-07-27)
+
+## Fixes
+- **Accurate CodeBuddy CN restriction detection**: post-OTP sessions that retain Tencent's `login_risk_state` and repeatedly resolve to Keycloak login are now reported as `failed_restricted` instead of a generic API-key capture failure.
+- **CORS-independent console probing**: account-session checks prefer the browser context request API, preserving cookies, redirect URLs, response status, and login HTML even when in-page fetch is blocked or collapses to HTTP 0.
+- **Safe restricted-account termination**: confirmed restrictions stop OTP resubmission and skip API-key/manual fallback, while summaries count the terminal result correctly and browser resources close immediately.
+
+# v1.0.148 (2026-07-27)
+
+## Fixes
+- **Bounded CodeBuddy CN automation**: browser launch, context creation, console navigation, session probes, API-key requests, manual fallback, resource cleanup, and 5sim settlement can no longer hold a VPS worker indefinitely.
+- **Safe console-session recovery**: login HTML returned with HTTP 200 is rejected as an unauthenticated session, destructive `/login` re-entry is avoided, and OIDC/API retry budgets are shorter and explicit.
+- **Duplicate-key protection**: timed-out or response-less API-key creation is treated as an unknown outcome, stops automatic POST retries, and asks the operator to check existing keys first.
+- **CloakBrowser runtime compatibility**: stale runtime installs are detected by semantic version and upgraded to the supported `0.5.2` series before automation starts.
+
+## Improvements
+- **Lower VPS browser pressure**: low-memory hosts use bounded viewport/DPR fingerprints and skip trackers, media, and non-captcha imagery while preserving challenge resources.
+- **Visible long-request progress**: API-key creation emits a five-second heartbeat so slow CodeBuddy responses remain distinguishable from a frozen job.
+
 # v1.0.147 (2026-07-27)
 
 ## Fixes

package/cli/app/cli/hooks/cloakbrowserRuntime.js

@@ -39,6 +39,91 @@ function hasPackage(name) {
   return fs.existsSync(path.join(getRuntimeNodeModules(), name, "package.json"));
 }
 
+function parseSemver(value) {
+  const match = String(value || "").trim().match(
+    /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/
+  );
+  if (!match) return null;
+  return {
+    major: Number.parseInt(match[1], 10),
+    minor: Number.parseInt(match[2], 10),
+    patch: Number.parseInt(match[3], 10),
+    prerelease: match[4] ? match[4].split(".") : [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 && right.length === 0) return 0;
+  if (left.length === 0) return 1;
+  if (right.length === 0) return -1;
+
+  const count = Math.max(left.length, right.length);
+  for (let i = 0; i < count; i += 1) {
+    if (left[i] === undefined) return -1;
+    if (right[i] === undefined) return 1;
+    if (left[i] === right[i]) continue;
+
+    const leftNumeric = /^\d+$/.test(left[i]);
+    const rightNumeric = /^\d+$/.test(right[i]);
+    if (leftNumeric && rightNumeric) {
+      return Number.parseInt(left[i], 10) < Number.parseInt(right[i], 10) ? -1 : 1;
+    }
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
+    return left[i] < right[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function compareSemver(left, right) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (left[key] !== right[key]) return left[key] < right[key] ? -1 : 1;
+  }
+  return comparePrerelease(left.prerelease, right.prerelease);
+}
+
+function satisfiesCaretRange(version, range) {
+  const installed = parseSemver(version);
+  const rangeMatch = String(range || "").trim().match(/^\^\s*(.+)$/);
+  const minimum = parseSemver(rangeMatch?.[1]);
+  if (!installed || !minimum) return false;
+
+  // Stable runtime requirements must never accept a prerelease implicitly.
+  if (installed.prerelease.length > 0 && minimum.prerelease.length === 0) return false;
+
+  let upper;
+  if (minimum.major > 0) {
+    upper = { major: minimum.major + 1, minor: 0, patch: 0, prerelease: [] };
+  } else if (minimum.minor > 0) {
+    upper = { major: 0, minor: minimum.minor + 1, patch: 0, prerelease: [] };
+  } else {
+    upper = { major: 0, minor: 0, patch: minimum.patch + 1, prerelease: [] };
+  }
+
+  return compareSemver(installed, minimum) >= 0 && compareSemver(installed, upper) < 0;
+}
+
+function getRuntimePackageVersion(name) {
+  try {
+    const packageJson = JSON.parse(
+      fs.readFileSync(path.join(getRuntimeNodeModules(), name, "package.json"), "utf8")
+    );
+    return typeof packageJson.version === "string" ? packageJson.version : null;
+  } catch {
+    return null;
+  }
+}
+
+function isCloakbrowserRuntimeCompatible(mod, installedVersion) {
+  return !!mod?.launch && satisfiesCaretRange(installedVersion, CLOAKBROWSER_VERSION);
+}
+
+function clearRuntimePackageCache(name) {
+  const packageRoot = `${path.join(getRuntimeNodeModules(), name)}${path.sep}`;
+  for (const modulePath of Object.keys(require.cache)) {
+    if (modulePath.startsWith(packageRoot)) delete require.cache[modulePath];
+  }
+}
+
 function tryRequireCloakbrowser() {
   try {
     const rreq = getRuntimeRequire();
@@ -83,7 +168,13 @@ function loadCloakbrowserModule() {
  * playwright-core is the drive peer (no stock Chromium binary download).
  */
 function ensureCloakbrowserRuntime({ silent = false } = {}) {
-  if (cachedReady?.ok && cachedReady.module && tryRequireMmdb() && hasPackage(PLAYWRIGHT_CORE_PACKAGE)) {
+  let installedCloakVersion = getRuntimePackageVersion(CLOAKBROWSER_PACKAGE);
+  if (
+    cachedReady?.ok
+    && isCloakbrowserRuntimeCompatible(cachedReady.module, installedCloakVersion)
+    && tryRequireMmdb()
+    && hasPackage(PLAYWRIGHT_CORE_PACKAGE)
+  ) {
     return cachedReady;
   }
 
@@ -94,7 +185,6 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
       process.env.NODE_PATH = env.NODE_PATH;
       // Re-init module paths for already-running process
       try {
-        // eslint-disable-next-line no-underscore-dangle
         require("module").Module._initPaths();
       } catch {
         /* ignore */
@@ -105,7 +195,7 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
   }
 
   let mod = tryRequireCloakbrowser();
-  const needCloak = !mod?.launch;
+  const needCloak = !isCloakbrowserRuntimeCompatible(mod, installedCloakVersion);
   const needMmdb = !tryRequireMmdb() && !hasPackage(MMDB_PACKAGE);
   const needPwCore = !hasPackage(PLAYWRIGHT_CORE_PACKAGE);
 
@@ -133,9 +223,12 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
       err.code = "CLOAKBROWSER_INSTALL_FAILED";
       return { ok: false, error: err };
     }
+
+    if (needCloak) clearRuntimePackageCache(CLOAKBROWSER_PACKAGE);
   }
 
   mod = tryRequireCloakbrowser();
+  installedCloakVersion = getRuntimePackageVersion(CLOAKBROWSER_PACKAGE);
   if (!mod?.launch) {
     const err = new Error(
       `cloakbrowser installed but launch() is missing. Reinstall: cd "${getRuntimeDir()}" && npm install ${CLOAKBROWSER_PACKAGE}@${CLOAKBROWSER_VERSION} ${MMDB_PACKAGE}@${MMDB_VERSION} ${PLAYWRIGHT_CORE_PACKAGE}@${PLAYWRIGHT_CORE_VERSION}`
@@ -144,6 +237,14 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
     return { ok: false, error: err };
   }
 
+  if (!satisfiesCaretRange(installedCloakVersion, CLOAKBROWSER_VERSION)) {
+    const err = new Error(
+      `cloakbrowser version mismatch: installed ${installedCloakVersion || "unknown"}, required ${CLOAKBROWSER_VERSION}. Reinstall: cd "${getRuntimeDir()}" && npm install ${CLOAKBROWSER_PACKAGE}@${CLOAKBROWSER_VERSION}`
+    );
+    err.code = "CLOAKBROWSER_VERSION_MISMATCH";
+    return { ok: false, error: err };
+  }
+
   if (!tryRequireMmdb() && !hasPackage(MMDB_PACKAGE)) {
     const err = new Error(
       `mmdb-lib is required for geoip: true. Install: cd "${getRuntimeDir()}" && npm install ${MMDB_PACKAGE}@${MMDB_VERSION}`
@@ -152,7 +253,7 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
     return { ok: false, error: err };
   }
 
-  cachedReady = { ok: true, module: mod };
+  cachedReady = { ok: true, module: mod, version: installedCloakVersion };
   return cachedReady;
 }
 
@@ -165,4 +266,10 @@ module.exports = {
   MMDB_VERSION,
   PLAYWRIGHT_CORE_PACKAGE,
   PLAYWRIGHT_CORE_VERSION,
+  __test__: {
+    parseSemver,
+    compareSemver,
+    satisfiesCaretRange,
+    isCloakbrowserRuntimeCompatible,
+  },
 };

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.147",
+  "version": "1.0.149",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/hooks/cloakbrowserRuntime.js

@@ -39,6 +39,91 @@ function hasPackage(name) {
   return fs.existsSync(path.join(getRuntimeNodeModules(), name, "package.json"));
 }
 
+function parseSemver(value) {
+  const match = String(value || "").trim().match(
+    /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/
+  );
+  if (!match) return null;
+  return {
+    major: Number.parseInt(match[1], 10),
+    minor: Number.parseInt(match[2], 10),
+    patch: Number.parseInt(match[3], 10),
+    prerelease: match[4] ? match[4].split(".") : [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 && right.length === 0) return 0;
+  if (left.length === 0) return 1;
+  if (right.length === 0) return -1;
+
+  const count = Math.max(left.length, right.length);
+  for (let i = 0; i < count; i += 1) {
+    if (left[i] === undefined) return -1;
+    if (right[i] === undefined) return 1;
+    if (left[i] === right[i]) continue;
+
+    const leftNumeric = /^\d+$/.test(left[i]);
+    const rightNumeric = /^\d+$/.test(right[i]);
+    if (leftNumeric && rightNumeric) {
+      return Number.parseInt(left[i], 10) < Number.parseInt(right[i], 10) ? -1 : 1;
+    }
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
+    return left[i] < right[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function compareSemver(left, right) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (left[key] !== right[key]) return left[key] < right[key] ? -1 : 1;
+  }
+  return comparePrerelease(left.prerelease, right.prerelease);
+}
+
+function satisfiesCaretRange(version, range) {
+  const installed = parseSemver(version);
+  const rangeMatch = String(range || "").trim().match(/^\^\s*(.+)$/);
+  const minimum = parseSemver(rangeMatch?.[1]);
+  if (!installed || !minimum) return false;
+
+  // Stable runtime requirements must never accept a prerelease implicitly.
+  if (installed.prerelease.length > 0 && minimum.prerelease.length === 0) return false;
+
+  let upper;
+  if (minimum.major > 0) {
+    upper = { major: minimum.major + 1, minor: 0, patch: 0, prerelease: [] };
+  } else if (minimum.minor > 0) {
+    upper = { major: 0, minor: minimum.minor + 1, patch: 0, prerelease: [] };
+  } else {
+    upper = { major: 0, minor: 0, patch: minimum.patch + 1, prerelease: [] };
+  }
+
+  return compareSemver(installed, minimum) >= 0 && compareSemver(installed, upper) < 0;
+}
+
+function getRuntimePackageVersion(name) {
+  try {
+    const packageJson = JSON.parse(
+      fs.readFileSync(path.join(getRuntimeNodeModules(), name, "package.json"), "utf8")
+    );
+    return typeof packageJson.version === "string" ? packageJson.version : null;
+  } catch {
+    return null;
+  }
+}
+
+function isCloakbrowserRuntimeCompatible(mod, installedVersion) {
+  return !!mod?.launch && satisfiesCaretRange(installedVersion, CLOAKBROWSER_VERSION);
+}
+
+function clearRuntimePackageCache(name) {
+  const packageRoot = `${path.join(getRuntimeNodeModules(), name)}${path.sep}`;
+  for (const modulePath of Object.keys(require.cache)) {
+    if (modulePath.startsWith(packageRoot)) delete require.cache[modulePath];
+  }
+}
+
 function tryRequireCloakbrowser() {
   try {
     const rreq = getRuntimeRequire();
@@ -83,7 +168,13 @@ function loadCloakbrowserModule() {
  * playwright-core is the drive peer (no stock Chromium binary download).
  */
 function ensureCloakbrowserRuntime({ silent = false } = {}) {
-  if (cachedReady?.ok && cachedReady.module && tryRequireMmdb() && hasPackage(PLAYWRIGHT_CORE_PACKAGE)) {
+  let installedCloakVersion = getRuntimePackageVersion(CLOAKBROWSER_PACKAGE);
+  if (
+    cachedReady?.ok
+    && isCloakbrowserRuntimeCompatible(cachedReady.module, installedCloakVersion)
+    && tryRequireMmdb()
+    && hasPackage(PLAYWRIGHT_CORE_PACKAGE)
+  ) {
     return cachedReady;
   }
 
@@ -94,7 +185,6 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
       process.env.NODE_PATH = env.NODE_PATH;
       // Re-init module paths for already-running process
       try {
-        // eslint-disable-next-line no-underscore-dangle
         require("module").Module._initPaths();
       } catch {
         /* ignore */
@@ -105,7 +195,7 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
   }
 
   let mod = tryRequireCloakbrowser();
-  const needCloak = !mod?.launch;
+  const needCloak = !isCloakbrowserRuntimeCompatible(mod, installedCloakVersion);
   const needMmdb = !tryRequireMmdb() && !hasPackage(MMDB_PACKAGE);
   const needPwCore = !hasPackage(PLAYWRIGHT_CORE_PACKAGE);
 
@@ -133,9 +223,12 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
       err.code = "CLOAKBROWSER_INSTALL_FAILED";
       return { ok: false, error: err };
     }
+
+    if (needCloak) clearRuntimePackageCache(CLOAKBROWSER_PACKAGE);
   }
 
   mod = tryRequireCloakbrowser();
+  installedCloakVersion = getRuntimePackageVersion(CLOAKBROWSER_PACKAGE);
   if (!mod?.launch) {
     const err = new Error(
       `cloakbrowser installed but launch() is missing. Reinstall: cd "${getRuntimeDir()}" && npm install ${CLOAKBROWSER_PACKAGE}@${CLOAKBROWSER_VERSION} ${MMDB_PACKAGE}@${MMDB_VERSION} ${PLAYWRIGHT_CORE_PACKAGE}@${PLAYWRIGHT_CORE_VERSION}`
@@ -144,6 +237,14 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
     return { ok: false, error: err };
   }
 
+  if (!satisfiesCaretRange(installedCloakVersion, CLOAKBROWSER_VERSION)) {
+    const err = new Error(
+      `cloakbrowser version mismatch: installed ${installedCloakVersion || "unknown"}, required ${CLOAKBROWSER_VERSION}. Reinstall: cd "${getRuntimeDir()}" && npm install ${CLOAKBROWSER_PACKAGE}@${CLOAKBROWSER_VERSION}`
+    );
+    err.code = "CLOAKBROWSER_VERSION_MISMATCH";
+    return { ok: false, error: err };
+  }
+
   if (!tryRequireMmdb() && !hasPackage(MMDB_PACKAGE)) {
     const err = new Error(
       `mmdb-lib is required for geoip: true. Install: cd "${getRuntimeDir()}" && npm install ${MMDB_PACKAGE}@${MMDB_VERSION}`
@@ -152,7 +253,7 @@ function ensureCloakbrowserRuntime({ silent = false } = {}) {
     return { ok: false, error: err };
   }
 
-  cachedReady = { ok: true, module: mod };
+  cachedReady = { ok: true, module: mod, version: installedCloakVersion };
   return cachedReady;
 }
 
@@ -165,4 +266,10 @@ module.exports = {
   MMDB_VERSION,
   PLAYWRIGHT_CORE_PACKAGE,
   PLAYWRIGHT_CORE_VERSION,
+  __test__: {
+    parseSemver,
+    compareSemver,
+    satisfiesCaretRange,
+    isCloakbrowserRuntimeCompatible,
+  },
 };

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.147",
+  "version": "1.0.149",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.147",
+  "version": "1.0.149",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -94,6 +94,42 @@ export function buildAccountFingerprint(seed) {
   };
 }
 
+/**
+ * Keep stealth dimensions internally consistent while bounding renderer cost on
+ * memory-constrained VPS hosts. Large DPR + 1440p fingerprints can consume most
+ * of a 2GB server before the login SPA finishes booting.
+ */
+export function compactAccountFingerprint(
+  fingerprint,
+  { maxWidth = 1280, maxHeight = 800, maxDeviceScaleFactor = 1.25 } = {},
+) {
+  if (!fingerprint || typeof fingerprint !== "object") return fingerprint;
+
+  const viewport = fingerprint.viewport || {};
+  const screen = fingerprint.screen || {};
+  const width = Math.min(Number(viewport.width) || maxWidth, maxWidth);
+  const height = Math.min(Number(viewport.height) || maxHeight, maxHeight);
+  const originalScreenHeight = Number(screen.height) || height;
+  const originalAvailHeight = Number(screen.availHeight) || originalScreenHeight;
+  const taskbarHeight = Math.max(0, originalScreenHeight - originalAvailHeight);
+
+  return {
+    ...fingerprint,
+    viewport: { width, height },
+    deviceScaleFactor: Math.min(
+      Number(fingerprint.deviceScaleFactor) || 1,
+      maxDeviceScaleFactor,
+    ),
+    screen: {
+      ...screen,
+      width,
+      height,
+      availWidth: width,
+      availHeight: Math.max(0, height - Math.min(taskbarHeight, 48)),
+    },
+  };
+}
+
 /**
  * Light init script for per-account HW/screen noise.
  * Avoids webdriver/WebGL patches that conflict with CloakBrowser binary stealth.