zevairouter 1.0.152 → 1.0.154

package/src/app/api/providers/route.js

@@ -9,9 +9,74 @@ import {
 import { APIKEY_PROVIDERS } from "@/shared/constants/config";
 import { AI_PROVIDERS, FREE_PROVIDERS, FREE_TIER_PROVIDERS, WEB_COOKIE_PROVIDERS, isOpenAICompatibleProvider, isAnthropicCompatibleProvider, isCustomEmbeddingProvider } from "@/shared/constants/providers";
 import { normalizeProviderId, normalizeProviderSpecificData } from "@/lib/providerNormalization";
+import { sanitizeProviderConnection } from "@/lib/providerConnectionSanitizer";
 
 export const dynamic = "force-dynamic";
 
+function isJsonObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function validateProviderCreateBody(body) {
+  if (!isJsonObject(body)) return "JSON body must be an object";
+  if (typeof body.provider !== "string" || !body.provider.trim()) {
+    return "provider must be a non-empty string";
+  }
+
+  for (const field of [
+    "apiKey", "name", "displayName", "defaultModel", "testStatus",
+    "connectionProxyUrl", "connectionNoProxy", "baseUrl", "baseURL",
+    "ollamaHostUrl",
+  ]) {
+    if (body[field] !== undefined && typeof body[field] !== "string") {
+      return `${field} must be a string`;
+    }
+  }
+  if (
+    body.connectionProxyEnabled !== undefined
+    && typeof body.connectionProxyEnabled !== "boolean"
+  ) {
+    return "connectionProxyEnabled must be a boolean";
+  }
+  if (
+    body.priority !== undefined
+    && (typeof body.priority !== "number" || !Number.isFinite(body.priority) || body.priority <= 0)
+  ) {
+    return "priority must be a positive number";
+  }
+  if (
+    body.globalPriority !== undefined
+    && body.globalPriority !== null
+    && (typeof body.globalPriority !== "number" || !Number.isFinite(body.globalPriority) || body.globalPriority < 0)
+  ) {
+    return "globalPriority must be null or a non-negative number";
+  }
+  if (
+    body.proxyPoolId !== undefined
+    && body.proxyPoolId !== null
+    && typeof body.proxyPoolId !== "string"
+  ) {
+    return "proxyPoolId must be a string or null";
+  }
+  if (
+    body.providerSpecificData !== undefined
+    && body.providerSpecificData !== null
+    && !isJsonObject(body.providerSpecificData)
+  ) {
+    return "providerSpecificData must be an object or null";
+  }
+
+  const providerData = body.providerSpecificData;
+  if (isJsonObject(providerData)) {
+    for (const field of ["baseUrl", "azureEndpoint", "apiVersion", "deployment", "organization", "accountId", "region"]) {
+      if (providerData[field] !== undefined && typeof providerData[field] !== "string") {
+        return `providerSpecificData.${field} must be a string`;
+      }
+    }
+  }
+  return null;
+}
+
 function normalizeProxyConfig(body = {}) {
   const enabled = body?.connectionProxyEnabled === true;
   const url = typeof body?.connectionProxyUrl === "string" ? body.connectionProxyUrl.trim() : "";
@@ -60,20 +125,16 @@ export async function GET() {
       }
     } catch { }
 
-    // Hide sensitive fields, enrich name for compatible providers
+    // Enrich compatible-provider names before shaping the browser-safe response.
     const safeConnections = connections.map(c => {
       const isCompatible = isOpenAICompatibleProvider(c.provider) || isAnthropicCompatibleProvider(c.provider);
       const name = isCompatible
         ? (c.name || nodeNameMap[c.provider] || c.providerSpecificData?.nodeName || c.provider)
         : c.name;
-      return {
+      return sanitizeProviderConnection({
         ...c,
         name,
-        apiKey: undefined,
-        accessToken: undefined,
-        refreshToken: undefined,
-        idToken: undefined,
-      };
+      });
     });
 
     return NextResponse.json({ connections: safeConnections });
@@ -85,8 +146,19 @@ export async function GET() {
 
 // POST /api/providers - Create new connection (API Key only, OAuth via separate flow)
 export async function POST(request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const validationError = validateProviderCreateBody(body);
+  if (validationError) {
+    return NextResponse.json({ error: validationError }, { status: 400 });
+  }
+
   try {
-    const body = await request.json();
     const provider = normalizeProviderId(body.provider);
     const { apiKey, name, displayName, priority, globalPriority, defaultModel, testStatus } = body;
     const proxyConfig = normalizeProxyConfig(body);
@@ -114,7 +186,7 @@ export async function POST(request) {
     if (!provider || !isValidProvider) {
       return NextResponse.json({ error: "Invalid provider" }, { status: 400 });
     }
-    if (!apiKey && provider !== "ollama-local") {
+    if ((!apiKey || !apiKey.trim()) && provider !== "ollama-local") {
       return NextResponse.json({ error: `${isWebCookieProvider ? "Cookie value" : "API Key"} is required` }, { status: 400 });
     }
     const connectionName = name || displayName || AI_PROVIDERS[provider]?.name;
@@ -187,19 +259,18 @@ export async function POST(request) {
       authType: isWebCookieProvider ? "cookie" : "apikey",
       name: connectionName,
       apiKey: apiKey || "",
-      priority: priority || 1,
-      globalPriority: globalPriority || null,
+      priority: priority ?? 1,
+      globalPriority: globalPriority ?? null,
       defaultModel: defaultModel || null,
       providerSpecificData: mergedProviderSpecificData,
       isActive: true,
       testStatus: testStatus || "unknown",
     });
 
-    // Hide sensitive fields
-    const result = { ...newConnection };
-    delete result.apiKey;
-
-    return NextResponse.json({ connection: result }, { status: 201 });
+    return NextResponse.json(
+      { connection: sanitizeProviderConnection(newConnection) },
+      { status: 201 }
+    );
   } catch (error) {
     console.log("Error creating provider:", error);
     return NextResponse.json({ error: "Failed to create provider" }, { status: 500 });

package/src/app/api/providers/suggested-models/route.js

@@ -21,6 +21,7 @@ export async function GET(request) {
   try {
     const res = await safeFetch(url, { signal: AbortSignal.timeout(10_000) });
     if (!res.ok) {
+      await res.body?.cancel?.();
       return NextResponse.json({ data: [] });
     }
     const json = await readJsonResponse(res, 5_000_000);

package/src/app/api/proxy-pools/[id]/route.js

@@ -5,6 +5,7 @@ import {
   getProxyPoolById,
   updateProxyPool,
 } from "@/models";
+import { sanitizeProxyPool } from "@/lib/providerConnectionSanitizer";
 
 function normalizeProxyPoolUpdate(body = {}) {
   const updates = {};
@@ -38,7 +39,7 @@ function normalizeProxyPoolUpdate(body = {}) {
   }
 
   if (Object.prototype.hasOwnProperty.call(body, "type")) {
-    const validTypes = ["http", "vercel", "cloudflare"];
+    const validTypes = ["http", "vercel", "cloudflare", "deno"];
     updates.type = validTypes.includes(body?.type) ? body.type : "http";
   }
 
@@ -59,7 +60,8 @@ export async function GET(request, { params }) {
       return NextResponse.json({ error: "Proxy pool not found" }, { status: 404 });
     }
 
-    return NextResponse.json({ proxyPool });
+    const revealProxyUrl = new URL(request.url).searchParams.get("reveal") === "1";
+    return NextResponse.json({ proxyPool: sanitizeProxyPool(proxyPool, { revealProxyUrl }) });
   } catch (error) {
     console.log("Error fetching proxy pool:", error);
     return NextResponse.json({ error: "Failed to fetch proxy pool" }, { status: 500 });
@@ -68,6 +70,17 @@ export async function GET(request, { params }) {
 
 // PUT /api/proxy-pools/[id] - Update proxy pool
 export async function PUT(request, { params }) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return NextResponse.json({ error: "JSON body must be an object" }, { status: 400 });
+  }
+
   try {
     const { id } = await params;
     const existing = await getProxyPoolById(id);
@@ -76,7 +89,6 @@ export async function PUT(request, { params }) {
       return NextResponse.json({ error: "Proxy pool not found" }, { status: 404 });
     }
 
-    const body = await request.json();
     const normalized = normalizeProxyPoolUpdate(body);
 
     if (normalized.error) {
@@ -84,7 +96,7 @@ export async function PUT(request, { params }) {
     }
 
     const updated = await updateProxyPool(id, normalized.updates);
-    return NextResponse.json({ proxyPool: updated });
+    return NextResponse.json({ proxyPool: sanitizeProxyPool(updated) });
   } catch (error) {
     console.log("Error updating proxy pool:", error);
     return NextResponse.json({ error: "Failed to update proxy pool" }, { status: 500 });

package/src/app/api/proxy-pools/[id]/test/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { getProxyPoolById, updateProxyPool } from "@/models";
 import { testProxyUrl } from "@/lib/network/proxyTest";
+import { redactCredentialText } from "@/lib/providerConnectionSanitizer";
 import { fetch as undiciFetch } from "undici";
 
 async function testVercelRelay(relayUrl, timeoutMs = 10000) {
@@ -47,11 +48,12 @@ export async function POST(request, { params }) {
       ? await testVercelRelay(proxyPool.proxyUrl)
       : await testProxyUrl({ proxyUrl: proxyPool.proxyUrl });
     const now = new Date().toISOString();
+    const safeError = redactCredentialText(result.error) || null;
 
     await updateProxyPool(id, {
       testStatus: result.ok ? "active" : "error",
       lastTestedAt: now,
-      lastError: result.ok ? null : (result.error || `Proxy test failed with status ${result.status}`),
+      lastError: result.ok ? null : (safeError || `Proxy test failed with status ${result.status}`),
       isActive: result.ok,
     });
 
@@ -59,7 +61,7 @@ export async function POST(request, { params }) {
       ok: result.ok,
       status: result.status,
       statusText: result.statusText || null,
-      error: result.error || null,
+      error: safeError,
       elapsedMs: result.elapsedMs || 0,
       testedAt: now,
     });

package/src/app/api/proxy-pools/route.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { createProxyPool, getProviderConnections, getProxyPools } from "@/models";
+import { sanitizeProxyPool } from "@/lib/providerConnectionSanitizer";
 
 function toBoolean(value) {
   if (value === "true") return true;
@@ -56,7 +57,7 @@ export async function GET(request) {
     const proxyPools = await getProxyPools(filter);
 
     if (!includeUsage) {
-      return NextResponse.json({ proxyPools });
+      return NextResponse.json({ proxyPools: proxyPools.map((pool) => sanitizeProxyPool(pool)) });
     }
 
     const connections = await getProviderConnections();
@@ -67,7 +68,7 @@ export async function GET(request) {
       boundConnectionCount: usageMap.get(pool.id) || 0,
     }));
 
-    return NextResponse.json({ proxyPools: enrichedProxyPools });
+    return NextResponse.json({ proxyPools: enrichedProxyPools.map((pool) => sanitizeProxyPool(pool)) });
   } catch (error) {
     console.log("Error fetching proxy pools:", error);
     return NextResponse.json({ error: "Failed to fetch proxy pools" }, { status: 500 });
@@ -76,16 +77,34 @@ export async function GET(request) {
 
 // POST /api/proxy-pools - Create proxy pool
 export async function POST(request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return NextResponse.json({ error: "JSON body must be an object" }, { status: 400 });
+  }
+
   try {
-    const body = await request.json();
     const normalized = normalizeProxyPoolInput(body);
 
     if (normalized.error) {
       return NextResponse.json({ error: normalized.error }, { status: 400 });
     }
 
+    const existingPools = await getProxyPools();
+    const duplicate = existingPools.find((pool) => (
+      pool.proxyUrl === normalized.proxyUrl && (pool.noProxy || "") === normalized.noProxy
+    ));
+    if (duplicate) {
+      return NextResponse.json({ error: "Proxy pool already exists", id: duplicate.id }, { status: 409 });
+    }
+
     const proxyPool = await createProxyPool(normalized);
-    return NextResponse.json({ proxyPool }, { status: 201 });
+    return NextResponse.json({ proxyPool: sanitizeProxyPool(proxyPool) }, { status: 201 });
   } catch (error) {
     console.log("Error creating proxy pool:", error);
     return NextResponse.json({ error: "Failed to create proxy pool" }, { status: 500 });

package/src/app/api/usage/aggregate/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { getAllQuotaSnapshots } from "@/lib/db/repos/quotaCacheRepo";
 import { getProviderConnections } from "@/lib/localDb";
+import { refreshQuotaConnections } from "@/lib/usage/quotaRefresh";
 
 /**
  * GET /api/usage/aggregate?provider=antigravity
@@ -17,6 +18,7 @@ export async function GET(request) {
   try {
     const { searchParams } = new URL(request.url);
     const provider = searchParams.get("provider");
+    const force = searchParams.get("refresh") === "1";
 
     if (!provider) {
       return NextResponse.json({ error: "provider query param required" }, { status: 400 });
@@ -26,6 +28,10 @@ export async function GET(request) {
     const allConnections = await getProviderConnections({ provider });
     const activeConnections = allConnections.filter((c) => c.isActive ?? true);
 
+    if (force) {
+      await refreshQuotaConnections(activeConnections, { force: true });
+    }
+
     // Get all cached quota snapshots for this provider
     const snapshots = await getAllQuotaSnapshots(provider);
 

package/src/app/api/usage/stream/route.js

@@ -2,70 +2,133 @@ import { getUsageStats, statsEmitter, getActiveRequests } from "@/lib/usageDb";
 
 export const dynamic = "force-dynamic";
 
-export async function GET() {
+export async function GET(request) {
   const encoder = new TextEncoder();
-  const state = { closed: false, keepalive: null, send: null, sendPending: null, cachedStats: null };
+  const state = {
+    cachedStats: null,
+    closed: false,
+    drainScheduled: false,
+    draining: false,
+    fullRequested: false,
+    keepalive: null,
+    pendingRequested: false,
+    send: null,
+    sendPending: null,
+  };
+
+  let cleanup = () => {};
 
   const stream = new ReadableStream({
-    async start(controller) {
-      // Full stats refresh (heavy) + immediate lightweight push
-      state.send = async () => {
-        if (state.closed) return;
+    start(controller) {
+      const enqueue = (payload) => {
+        if (state.closed) return false;
         try {
-          // Push lightweight update immediately so UI reflects changes fast
-          if (state.cachedStats) {
-            const { activeRequests, recentRequests, errorProvider } = await getActiveRequests();
-            const quickStats = { ...state.cachedStats, activeRequests, recentRequests, errorProvider };
-            controller.enqueue(encoder.encode(`data: ${JSON.stringify(quickStats)}\n\n`));
-          }
-          // Then do full recalc and update cache
-          const stats = await getUsageStats();
-          state.cachedStats = stats;
-          controller.enqueue(encoder.encode(`data: ${JSON.stringify(stats)}\n\n`));
+          controller.enqueue(encoder.encode(payload));
+          return true;
         } catch {
-          state.closed = true;
-          statsEmitter.off("update", state.send);
-          statsEmitter.off("pending", state.sendPending);
-          clearInterval(state.keepalive);
+          cleanup();
+          return false;
         }
       };
 
-      // Lightweight push: only refresh activeRequests + recentRequests on pending changes
-      state.sendPending = async () => {
-        if (state.closed || !state.cachedStats) return;
-        try {
-          const { activeRequests, recentRequests, errorProvider } = await getActiveRequests();
-          const stats = { ...state.cachedStats, activeRequests, recentRequests, errorProvider };
-          controller.enqueue(encoder.encode(`data: ${JSON.stringify(stats)}\n\n`));
-        } catch {
-          state.closed = true;
-          statsEmitter.off("update", state.send);
-          statsEmitter.off("pending", state.sendPending);
+      cleanup = () => {
+        if (state.closed) return;
+        state.closed = true;
+        statsEmitter.off("update", state.send);
+        statsEmitter.off("pending", state.sendPending);
+        if (state.keepalive !== null) {
           clearInterval(state.keepalive);
+          state.keepalive = null;
         }
+        request?.signal?.removeEventListener("abort", cleanup);
       };
 
-      await state.send();
+      const sendPendingStats = async () => {
+        if (!state.cachedStats || state.closed) return;
+        const { activeRequests, recentRequests, errorProvider } = await getActiveRequests();
+        if (state.closed) return;
+        enqueue(`data: ${JSON.stringify({
+          ...state.cachedStats,
+          activeRequests,
+          recentRequests,
+          errorProvider,
+        })}\n\n`);
+      };
+
+      function scheduleDrain() {
+        if (state.closed || state.draining || state.drainScheduled) return;
+        state.drainScheduled = true;
+        queueMicrotask(() => {
+          state.drainScheduled = false;
+          void drain();
+        });
+      }
+
+      async function drain() {
+        if (state.draining || state.closed) return;
+        state.draining = true;
+
+        try {
+          while (!state.closed && (state.fullRequested || state.pendingRequested)) {
+            const fullRefresh = state.fullRequested;
+            state.fullRequested = false;
+            state.pendingRequested = false;
+
+            if (!fullRefresh) {
+              await sendPendingStats();
+              continue;
+            }
+
+            // Keep the UI responsive from cached totals while the heavier aggregate refresh runs.
+            await sendPendingStats();
+            if (state.closed) break;
+
+            const stats = await getUsageStats();
+            if (state.closed) break;
+            state.cachedStats = stats;
+            enqueue(`data: ${JSON.stringify(stats)}\n\n`);
+          }
+        } catch (error) {
+          cleanup();
+          try { controller.error(error); } catch {}
+        } finally {
+          state.draining = false;
+          if (!state.closed && (state.fullRequested || state.pendingRequested)) {
+            scheduleDrain();
+          }
+        }
+      }
+
+      state.send = () => {
+        if (state.closed) return;
+        state.fullRequested = true;
+        scheduleDrain();
+      };
+      state.sendPending = () => {
+        if (state.closed) return;
+        state.pendingRequested = true;
+        scheduleDrain();
+      };
 
       statsEmitter.on("update", state.send);
       statsEmitter.on("pending", state.sendPending);
+      request?.signal?.addEventListener("abort", cleanup, { once: true });
+
+      if (request?.signal?.aborted) {
+        cleanup();
+        return;
+      }
 
       state.keepalive = setInterval(() => {
-        if (state.closed) { clearInterval(state.keepalive); return; }
-        try {
-          controller.enqueue(encoder.encode(": ping\n\n"));
-        } catch {
-          state.closed = true;
-          clearInterval(state.keepalive);
-        }
+        enqueue(": ping\n\n");
       }, 25000);
+      state.keepalive.unref?.();
+
+      state.send();
     },
 
     cancel() {
-      state.closed = true;
-      statsEmitter.off("update", state.send);
-      statsEmitter.off("pending", state.sendPending);
-      clearInterval(state.keepalive);
+      cleanup();
     },
   });
 

package/src/app/api/v1/responses/compact/route.js

@@ -26,12 +26,30 @@ export async function OPTIONS() {
  */
 export async function POST(request) {
   await ensureInitialized();
-  const body = await request.json();
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json(
+      { error: { message: "Invalid JSON body", type: "invalid_request_error" } },
+      { status: 400, headers: { "Access-Control-Allow-Origin": "*" } },
+    );
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return Response.json(
+      { error: { message: "Invalid request body", type: "invalid_request_error" } },
+      { status: 400, headers: { "Access-Control-Allow-Origin": "*" } },
+    );
+  }
+
   body._compact = true;
+  const headers = new Headers(request.headers);
+  headers.delete("content-length");
   const newRequest = new Request(request.url, {
     method: "POST",
-    headers: request.headers,
-    body: JSON.stringify(body)
+    headers,
+    body: JSON.stringify(body),
+    signal: request.signal,
   });
   return await handleChat(newRequest);
 }

package/src/lib/db/adapters/betterSqliteAdapter.js

@@ -26,17 +26,19 @@ export function createBetterSqliteAdapter(filePath) {
   }, CHECKPOINT_INTERVAL_MS);
   if (typeof checkpointTimer.unref === "function") checkpointTimer.unref();
 
+  let closed = false;
   function gracefulClose() {
+    if (closed) return;
+    closed = true;
     try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {}
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
 
-  // Ensure WAL is flushed and -wal/-shm files removed on shutdown
+  // The app bootstrap owns SIGINT/SIGTERM so it can flush buffered writes
+  // before closing the database. This hook only covers a natural event-loop exit.
   const onShutdown = () => gracefulClose();
   process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
 
   return {
     driver: "better-sqlite3",
@@ -48,6 +50,7 @@ export function createBetterSqliteAdapter(filePath) {
     checkpoint() { db.pragma("wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
+      process.removeListener("beforeExit", onShutdown);
       gracefulClose();
     },
     raw: db,

package/src/lib/db/adapters/bunSqliteAdapter.js

@@ -25,15 +25,16 @@ export async function createBunSqliteAdapter(filePath) {
   }, CHECKPOINT_INTERVAL_MS);
   if (typeof checkpointTimer.unref === "function") checkpointTimer.unref();
 
+  let closed = false;
   function gracefulClose() {
+    if (closed) return;
+    closed = true;
     try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
   const onShutdown = () => gracefulClose();
   process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
 
   return {
     driver: "bun:sqlite",
@@ -56,6 +57,7 @@ export async function createBunSqliteAdapter(filePath) {
     checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
+      process.removeListener("beforeExit", onShutdown);
       gracefulClose();
     },
     raw: db,

package/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -38,15 +38,16 @@ export async function createNodeSqliteAdapter(filePath) {
   }, CHECKPOINT_INTERVAL_MS);
   if (typeof checkpointTimer.unref === "function") checkpointTimer.unref();
 
+  let closed = false;
   function gracefulClose() {
+    if (closed) return;
+    closed = true;
     try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
   const onShutdown = () => gracefulClose();
   process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
 
   return {
     driver: "node:sqlite",
@@ -77,6 +78,7 @@ export async function createNodeSqliteAdapter(filePath) {
     checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
     close() {
       clearInterval(checkpointTimer);
+      process.removeListener("beforeExit", onShutdown);
       gracefulClose();
     },
     raw: db,