zevairouter 1.0.148 → 1.0.150

package/cli/app/CHANGELOG.md

@@ -1,3 +1,17 @@
+# v1.0.150 (2026-07-27)
+
+## Fixes
+- **Coherent pasted-proxy browser identity**: CodeBuddy CN manual-proxy jobs now preserve CloakBrowser's binary-level exit IP, WebRTC, timezone, locale, and native viewport instead of overwriting them from the SMS number region.
+- **Safe sticky-egress preflight**: manual proxies are verified against multiple exit-IP services at launch and immediately before the 5sim purchase, so unverifiable, rotating, or changed exits fail before a phone number is ordered.
+- **Isolated manual registrations**: pasted-proxy jobs enforce one worker and recycle the complete CloakBrowser process between accounts, including cleanup after unexpected worker failures, without changing Proxy Pool selection or data.
+
+# v1.0.149 (2026-07-27)
+
+## Fixes
+- **Accurate CodeBuddy CN restriction detection**: post-OTP sessions that retain Tencent's `login_risk_state` and repeatedly resolve to Keycloak login are now reported as `failed_restricted` instead of a generic API-key capture failure.
+- **CORS-independent console probing**: account-session checks prefer the browser context request API, preserving cookies, redirect URLs, response status, and login HTML even when in-page fetch is blocked or collapses to HTTP 0.
+- **Safe restricted-account termination**: confirmed restrictions stop OTP resubmission and skip API-key/manual fallback, while summaries count the terminal result correctly and browser resources close immediately.
+
 # v1.0.148 (2026-07-27)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.148",
+  "version": "1.0.150",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.148",
+  "version": "1.0.150",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.148",
+  "version": "1.0.150",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -12,6 +12,7 @@ const requireFromHere = createRequire(import.meta.url);
 export const DEFAULT_BULK_IMPORT_ENGINE = "cloakbrowser";
 
 const SUPPORTED_ENGINES = new Set(["cloakbrowser"]);
+const CLOAK_PROXY_PROFILES = new WeakMap();
 
 export function normalizeBulkImportEngine(value) {
   if (typeof value !== "string" || !value.trim()) return DEFAULT_BULK_IMPORT_ENGINE;
@@ -212,7 +213,31 @@ export async function newStealthContext(browser, options = {}) {
  * Prefer headed (headless=false); Turnstile / Google bot checks often fail headless.
  * Auto-installs into ~/.zevai/runtime via cloakbrowserRuntime.
  */
-async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = null } = {}) {
+export function extractCloakProxyProfile(args = []) {
+  const readFlag = (name) => {
+    const prefix = `${name}=`;
+    const value = (args || []).find((arg) => String(arg).startsWith(prefix));
+    return value ? String(value).slice(prefix.length) : null;
+  };
+  return {
+    egressIp: readFlag("--fingerprint-webrtc-ip"),
+    timezone: readFlag("--fingerprint-timezone"),
+    locale: readFlag("--fingerprint-locale") || readFlag("--lang"),
+  };
+}
+
+export function getCloakProxyProfile(browser) {
+  return browser && typeof browser === "object"
+    ? CLOAK_PROXY_PROFILES.get(browser) || null
+    : null;
+}
+
+async function launchCloakbrowser({
+  proxyUrl,
+  headless = false,
+  windowSize = null,
+  requireProxyGeoip = false,
+} = {}) {
   const { ensureDisplayForHeadedBrowser } = await import("./displayEnv.js");
 
   const runtime = loadRuntimeHelper("cloakbrowserRuntime");
@@ -259,18 +284,65 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
     launchOpts.geoip = true;
   }
   if (windowSize?.width && windowSize?.height) {
-    launchOpts.viewport = { width: windowSize.width, height: windowSize.height };
+    // Keep headed contexts at viewport:null so dimensions follow the real Xvfb
+    // window. A Playwright viewport here overrides CloakBrowser's coherent window.
+    launchOpts.args = [`--window-size=${windowSize.width},${windowSize.height}`];
+  }
+
+  let effectiveLaunchOpts = launchOpts;
+  let proxyProfile = null;
+  if (proxyUrl && requireProxyGeoip) {
+    if (typeof cloak.buildLaunchOptions !== "function") {
+      const error = new Error("CloakBrowser runtime cannot verify proxy GeoIP before launch");
+      error.code = "CLOAKBROWSER_PROXY_GEOIP_UNSUPPORTED";
+      throw error;
+    }
+    // Slow residential CONNECT handshakes regularly exceed CloakBrowser's 5s
+    // default. Resolve once with a bounded 12s budget, then reuse those flags.
+    const previousGeoipTimeout = process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS;
+    if (!previousGeoipTimeout) process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS = "12";
+    let resolved;
+    try {
+      resolved = await cloak.buildLaunchOptions(launchOpts);
+    } finally {
+      if (previousGeoipTimeout === undefined) {
+        delete process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS;
+      } else {
+        process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS = previousGeoipTimeout;
+      }
+    }
+    proxyProfile = extractCloakProxyProfile(resolved?.args || []);
+    if (!proxyProfile.egressIp || !proxyProfile.timezone || !proxyProfile.locale) {
+      const error = new Error(
+        "Manual proxy exit GeoIP could not be verified; no phone number was purchased",
+      );
+      error.code = "CLOAKBROWSER_PROXY_GEOIP_UNAVAILABLE";
+      throw error;
+    }
+    effectiveLaunchOpts = {
+      ...launchOpts,
+      args: resolved.args || launchOpts.args,
+      geoip: false,
+    };
   }
 
   try {
     // Do not wrap with stock stealth scripts — CloakBrowser patches at binary level.
-    return await cloak.launch(launchOpts);
+    const browser = await cloak.launch(effectiveLaunchOpts);
+    if (proxyProfile) {
+      CLOAK_PROXY_PROFILES.set(browser, Object.freeze({ ...proxyProfile }));
+    }
+    return browser;
   } catch (error) {
     const msg = String(error?.message || error || "");
     if (!useHeadless && /XServer|DISPLAY|Missing X server|headed browser|no DISPLAY/i.test(msg)) {
       const display = ensureDisplayForHeadedBrowser();
       if (display.ok) {
-        return cloak.launch(launchOpts);
+        const browser = await cloak.launch(effectiveLaunchOpts);
+        if (proxyProfile) {
+          CLOAK_PROXY_PROFILES.set(browser, Object.freeze({ ...proxyProfile }));
+        }
+        return browser;
       }
       const friendly = new Error(
         `${msg}\n\nVPS has no display. Install a virtual screen then retry:\n` +
@@ -299,6 +371,7 @@ export async function launchBulkImportBrowser({
   proxyUrl,
   headless = false,
   windowSize = null,
+  requireProxyGeoip = false,
 } = {}) {
   // engine arg kept for API compatibility; always cloakbrowser.
   void normalizeBulkImportEngine(engine);
@@ -306,6 +379,7 @@ export async function launchBulkImportBrowser({
     proxyUrl,
     headless: headless === true,
     windowSize,
+    requireProxyGeoip,
   });
 }