zevairouter 1.0.149 → 1.0.151

package/cli/app/CHANGELOG.md

@@ -1,3 +1,17 @@
+# v1.0.151 (2026-07-27)
+
+## Fixes
+- **Deterministic DataImpulse sticky sessions**: CodeBuddy CN now initializes pasted proxies with sequential CN-accessible exit checks, preventing parallel first requests from racing sticky-port assignment and falsely reporting an immediate rotation.
+- **Exit-aligned CloakBrowser identity**: the verified residential exit is applied directly to WebRTC, timezone, and locale flags instead of allowing failed foreign echo services to substitute the proxy gateway address.
+- **Safe pre-purchase verification**: browser-context checks use the same sequential fallback order and compare the initial exit with the exit immediately before the 5sim purchase, without modifying pasted credentials or Proxy Pool data.
+
+# v1.0.150 (2026-07-27)
+
+## Fixes
+- **Coherent pasted-proxy browser identity**: CodeBuddy CN manual-proxy jobs now preserve CloakBrowser's binary-level exit IP, WebRTC, timezone, locale, and native viewport instead of overwriting them from the SMS number region.
+- **Safe sticky-egress preflight**: manual proxies are verified against multiple exit-IP services at launch and immediately before the 5sim purchase, so unverifiable, rotating, or changed exits fail before a phone number is ordered.
+- **Isolated manual registrations**: pasted-proxy jobs enforce one worker and recycle the complete CloakBrowser process between accounts, including cleanup after unexpected worker failures, without changing Proxy Pool selection or data.
+
 # v1.0.149 (2026-07-27)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.149",
+  "version": "1.0.151",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.149",
+  "version": "1.0.151",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.149",
+  "version": "1.0.151",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
+import net from "node:net";
+import { ProxyAgent, fetch as undiciFetch } from "undici";
 
 const requireFromHere = createRequire(import.meta.url);
 
@@ -12,6 +14,28 @@ const requireFromHere = createRequire(import.meta.url);
 export const DEFAULT_BULK_IMPORT_ENGINE = "cloakbrowser";
 
 const SUPPORTED_ENGINES = new Set(["cloakbrowser"]);
+const CLOAK_PROXY_PROFILES = new WeakMap();
+
+export const PROXY_EGRESS_ECHO_URLS = Object.freeze([
+  "https://myip.ipip.net",
+  "https://ip.3322.net",
+  "https://cip.cc",
+]);
+
+const PROXY_GEO_PROFILES = Object.freeze({
+  CN: { timezone: "Asia/Shanghai", locale: "zh-CN" },
+  HK: { timezone: "Asia/Hong_Kong", locale: "zh-HK" },
+  MO: { timezone: "Asia/Macau", locale: "zh-MO" },
+  TW: { timezone: "Asia/Taipei", locale: "zh-TW" },
+  SG: { timezone: "Asia/Singapore", locale: "en-SG" },
+  JP: { timezone: "Asia/Tokyo", locale: "ja-JP" },
+  KR: { timezone: "Asia/Seoul", locale: "ko-KR" },
+  US: { locale: "en-US" },
+  GB: { locale: "en-GB" },
+});
+
+const DEFAULT_PROXY_PROBE_TIMEOUT_MS = 8_000;
+const DEFAULT_PROXY_GEO_TIMEOUT_MS = 5_000;
 
 export function normalizeBulkImportEngine(value) {
   if (typeof value !== "string" || !value.trim()) return DEFAULT_BULK_IMPORT_ENGINE;
@@ -207,12 +231,250 @@ export async function newStealthContext(browser, options = {}) {
   return context;
 }
 
+export function parseProxyEgressIp(value) {
+  const raw = String(value || "").trim();
+  if (!raw) return null;
+  if (net.isIP(raw)) return raw;
+
+  try {
+    const parsed = JSON.parse(raw);
+    for (const key of ["ip", "query", "address", "origin"]) {
+      const candidate = String(parsed?.[key] || "").trim();
+      if (net.isIP(candidate)) return candidate;
+    }
+  } catch {
+    // Plain-text echo services are expected here.
+  }
+
+  for (const match of raw.matchAll(/(?:\d{1,3}\.){3}\d{1,3}/g)) {
+    if (net.isIP(match[0])) return match[0];
+  }
+
+  const tokens = raw.split(/[\s,;()[\]{}<>"'=\uFF1A]+/);
+  for (const token of tokens) {
+    const candidate = token.replace(/^[^0-9a-f:]+|[^0-9a-f:]+$/gi, "");
+    if (candidate.includes(":") && net.isIP(candidate)) return candidate;
+  }
+  return null;
+}
+
+function inferProxyRegionalProfile(proxyUrl) {
+  try {
+    const parsed = new URL(String(proxyUrl || "").trim());
+    const username = decodeURIComponent(parsed.username || "");
+    const matches = [...username.matchAll(/(?:^|__)cr\.([a-z]{2})(?=__|$)/gi)];
+    const countryCode = matches.at(-1)?.[1]?.toUpperCase() || null;
+    const regional = countryCode ? PROXY_GEO_PROFILES[countryCode] : null;
+    return regional?.timezone && regional?.locale
+      ? { countryCode, ...regional, source: "proxy-country" }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+async function closeProxyAgent(agent) {
+  if (!agent) return;
+  if (typeof agent.close === "function") {
+    await Promise.resolve(agent.close()).catch(() => null);
+    return;
+  }
+  if (typeof agent.destroy === "function") {
+    await Promise.resolve(agent.destroy()).catch(() => null);
+  }
+}
+
+/**
+ * Pin a fresh sticky proxy with one request at a time. Parallel first-use
+ * requests can race session assignment on providers such as DataImpulse.
+ */
+export async function probeProxyEgressBeforeLaunch(
+  proxyUrl,
+  {
+    timeoutMs = DEFAULT_PROXY_PROBE_TIMEOUT_MS,
+    urls = PROXY_EGRESS_ECHO_URLS,
+    fetchImpl = undiciFetch,
+    createProxyAgent = (url) => new ProxyAgent(url),
+  } = {},
+) {
+  let agent = null;
+  const attemptedUrls = [];
+  let lastError = null;
+
+  try {
+    try {
+      agent = createProxyAgent(proxyUrl);
+    } catch {
+      return {
+        ok: false,
+        ip: null,
+        url: null,
+        attempts: 0,
+        attemptedUrls,
+        error: "proxy agent setup failed",
+      };
+    }
+
+    for (const url of urls) {
+      attemptedUrls.push(url);
+      try {
+        const response = await fetchImpl(url, {
+          dispatcher: agent,
+          redirect: "follow",
+          signal: AbortSignal.timeout(timeoutMs),
+          headers: {
+            Accept: "text/plain, application/json;q=0.9, */*;q=0.1",
+            "Cache-Control": "no-cache",
+          },
+        });
+        if (!response?.ok) {
+          lastError = `HTTP ${response?.status || 0}`;
+          continue;
+        }
+        const ip = parseProxyEgressIp(await response.text());
+        if (!ip) {
+          lastError = "exit-IP response was not recognized";
+          continue;
+        }
+        return {
+          ok: true,
+          ip,
+          url,
+          attempts: attemptedUrls.length,
+          attemptedUrls,
+          error: null,
+        };
+      } catch (error) {
+        lastError = error?.name === "TimeoutError"
+          ? `timed out after ${timeoutMs}ms`
+          : "request failed";
+      }
+    }
+
+    return {
+      ok: false,
+      ip: null,
+      url: null,
+      attempts: attemptedUrls.length,
+      attemptedUrls,
+      error: lastError || "all exit-IP services failed",
+    };
+  } finally {
+    await closeProxyAgent(agent);
+  }
+}
+
+async function lookupProxyGeoProfile(
+  egressIp,
+  { timeoutMs = DEFAULT_PROXY_GEO_TIMEOUT_MS, fetchImpl = undiciFetch } = {},
+) {
+  try {
+    const response = await fetchImpl(`https://ipwho.is/${encodeURIComponent(egressIp)}`, {
+      redirect: "follow",
+      signal: AbortSignal.timeout(timeoutMs),
+      headers: { Accept: "application/json" },
+    });
+    if (!response?.ok) return null;
+    const data = await response.json();
+    if (data?.success === false) return null;
+    const countryCode = String(data?.country_code || "").trim().toUpperCase();
+    const timezone = String(data?.timezone?.id || "").trim();
+    const locale = PROXY_GEO_PROFILES[countryCode]?.locale
+      || (countryCode ? `en-${countryCode}` : "");
+    return timezone && locale
+      ? { countryCode: countryCode || null, timezone, locale, source: "ip-geo" }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function resolveProxyLaunchProfile(proxyUrl, options = {}) {
+  const probe = await probeProxyEgressBeforeLaunch(proxyUrl, options);
+  if (!probe.ok || !probe.ip) {
+    const error = new Error(
+      `Manual proxy exit IP could not be verified before browser launch (${probe.error || "no response"}); no phone number was purchased`,
+    );
+    error.code = "CLOAKBROWSER_PROXY_EGRESS_UNAVAILABLE";
+    throw error;
+  }
+
+  const regional = inferProxyRegionalProfile(proxyUrl)
+    || await lookupProxyGeoProfile(probe.ip, options);
+  if (!regional?.timezone || !regional?.locale) {
+    const error = new Error(
+      "Manual proxy region could not be aligned with CloakBrowser; no phone number was purchased",
+    );
+    error.code = "CLOAKBROWSER_PROXY_GEOIP_UNAVAILABLE";
+    throw error;
+  }
+
+  return Object.freeze({
+    egressIp: probe.ip,
+    timezone: regional.timezone,
+    locale: regional.locale,
+    countryCode: regional.countryCode || null,
+    source: regional.source,
+    probeUrl: probe.url,
+    probeAttempts: probe.attempts,
+  });
+}
+
+export function buildVerifiedProxyLaunchOptions(launchOpts, proxyProfile) {
+  const managedPrefixes = [
+    "--fingerprint-webrtc-ip=",
+    "--fingerprint-timezone=",
+    "--fingerprint-locale=",
+    "--lang=",
+  ];
+  const args = (launchOpts?.args || []).filter(
+    (arg) => !managedPrefixes.some((prefix) => String(arg).startsWith(prefix)),
+  );
+  args.push(
+    `--fingerprint-webrtc-ip=${proxyProfile.egressIp}`,
+    `--fingerprint-timezone=${proxyProfile.timezone}`,
+    `--lang=${proxyProfile.locale}`,
+    `--fingerprint-locale=${proxyProfile.locale}`,
+  );
+  return {
+    ...launchOpts,
+    args,
+    timezone: proxyProfile.timezone,
+    locale: proxyProfile.locale,
+    geoip: false,
+  };
+}
+
 /**
  * CloakBrowser — sole bulk-import engine (patched stealth Chromium).
  * Prefer headed (headless=false); Turnstile / Google bot checks often fail headless.
  * Auto-installs into ~/.zevai/runtime via cloakbrowserRuntime.
  */
-async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = null } = {}) {
+export function extractCloakProxyProfile(args = []) {
+  const readFlag = (name) => {
+    const prefix = `${name}=`;
+    const value = (args || []).find((arg) => String(arg).startsWith(prefix));
+    return value ? String(value).slice(prefix.length) : null;
+  };
+  return {
+    egressIp: readFlag("--fingerprint-webrtc-ip"),
+    timezone: readFlag("--fingerprint-timezone"),
+    locale: readFlag("--fingerprint-locale") || readFlag("--lang"),
+  };
+}
+
+export function getCloakProxyProfile(browser) {
+  return browser && typeof browser === "object"
+    ? CLOAK_PROXY_PROFILES.get(browser) || null
+    : null;
+}
+
+async function launchCloakbrowser({
+  proxyUrl,
+  headless = false,
+  windowSize = null,
+  requireProxyGeoip = false,
+} = {}) {
   const { ensureDisplayForHeadedBrowser } = await import("./displayEnv.js");
 
   const runtime = loadRuntimeHelper("cloakbrowserRuntime");
@@ -259,18 +521,37 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
     launchOpts.geoip = true;
   }
   if (windowSize?.width && windowSize?.height) {
-    launchOpts.viewport = { width: windowSize.width, height: windowSize.height };
+    // Keep headed contexts at viewport:null so dimensions follow the real Xvfb
+    // window. A Playwright viewport here overrides CloakBrowser's coherent window.
+    launchOpts.args = [`--window-size=${windowSize.width},${windowSize.height}`];
+  }
+
+  let effectiveLaunchOpts = launchOpts;
+  let proxyProfile = null;
+  if (proxyUrl && requireProxyGeoip) {
+    // Resolve the exit ourselves through CN-accessible endpoints. CloakBrowser's
+    // foreign echo fallbacks can time out and mistake the gateway IP for the exit.
+    proxyProfile = await resolveProxyLaunchProfile(proxyUrl);
+    effectiveLaunchOpts = buildVerifiedProxyLaunchOptions(launchOpts, proxyProfile);
   }
 
   try {
     // Do not wrap with stock stealth scripts — CloakBrowser patches at binary level.
-    return await cloak.launch(launchOpts);
+    const browser = await cloak.launch(effectiveLaunchOpts);
+    if (proxyProfile) {
+      CLOAK_PROXY_PROFILES.set(browser, Object.freeze({ ...proxyProfile }));
+    }
+    return browser;
   } catch (error) {
     const msg = String(error?.message || error || "");
     if (!useHeadless && /XServer|DISPLAY|Missing X server|headed browser|no DISPLAY/i.test(msg)) {
       const display = ensureDisplayForHeadedBrowser();
       if (display.ok) {
-        return cloak.launch(launchOpts);
+        const browser = await cloak.launch(effectiveLaunchOpts);
+        if (proxyProfile) {
+          CLOAK_PROXY_PROFILES.set(browser, Object.freeze({ ...proxyProfile }));
+        }
+        return browser;
       }
       const friendly = new Error(
         `${msg}\n\nVPS has no display. Install a virtual screen then retry:\n` +
@@ -299,6 +580,7 @@ export async function launchBulkImportBrowser({
   proxyUrl,
   headless = false,
   windowSize = null,
+  requireProxyGeoip = false,
 } = {}) {
   // engine arg kept for API compatibility; always cloakbrowser.
   void normalizeBulkImportEngine(engine);
@@ -306,6 +588,7 @@ export async function launchBulkImportBrowser({
     proxyUrl,
     headless: headless === true,
     windowSize,
+    requireProxyGeoip,
   });
 }