zevairouter 1.0.153 → 1.0.154

package/open-sse/utils/stream.js

@@ -11,6 +11,88 @@ export { COLORS, formatSSE };
 // sharedEncoder is stateless — safe to share across streams
 const sharedEncoder = new TextEncoder();
 
+function numericHttpStatus(value) {
+  const status = Number(value);
+  return Number.isInteger(status) && status >= 400 && status <= 599 ? status : null;
+}
+
+function absoluteResetTime(value) {
+  if (value === undefined || value === null || value === "") return null;
+  if (typeof value === "string" && !/^\d+(?:\.\d+)?$/.test(value.trim())) {
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric) || numeric <= 0) return null;
+  return numeric >= 1e12 ? numeric : numeric >= 1e9 ? numeric * 1000 : null;
+}
+
+function retryAfterTime(value) {
+  if (value === undefined || value === null || value === "") return null;
+  const absolute = absoluteResetTime(value);
+  if (absolute) return absolute;
+  const seconds = Number(value);
+  return Number.isFinite(seconds) && seconds > 0 ? Date.now() + seconds * 1000 : null;
+}
+
+export function classifyStreamFailure(parsed, eventName = null) {
+  if (!parsed || typeof parsed !== "object") return null;
+  const failed = eventName === "response.failed" ||
+    parsed.type === "response.failed" ||
+    parsed.type === "error" ||
+    parsed.response?.status === "failed" ||
+    parsed.error;
+  if (!failed) return null;
+
+  const error = parsed.response?.error || parsed.error || parsed;
+  const message = typeof error === "string"
+    ? error
+    : error?.message || "Provider stream failed";
+  const code = typeof error === "object" ? (error?.code ?? parsed.code) : null;
+  const type = typeof error === "object" ? (error?.type ?? parsed.type) : parsed.type;
+  const explicitStatus = [
+    error?.http_status,
+    error?.status_code,
+    error?.status,
+    parsed.http_status,
+    parsed.status_code,
+    parsed.status,
+    code,
+  ].map(numericHttpStatus).find(Boolean);
+  const classificationText = `${type || ""} ${code || ""} ${message}`.toLowerCase();
+
+  let status = explicitStatus;
+  if (!status && /rate.?limit|too many requests|quota|resource.?exhausted|usage.?limit/.test(classificationText)) status = 429;
+  else if (!status && /unauth|invalid.?api.?key|invalid.?token|token.?expired/.test(classificationText)) status = 401;
+  else if (!status && /forbidden|permission.?denied|restricted|banned|suspended/.test(classificationText)) status = 403;
+  else if (!status && /invalid.?request|bad.?request|context.?length|input is too long|prompt is too long/.test(classificationText)) status = 400;
+  else if (!status && /overload|unavailable|internal|server.?error/.test(classificationText)) status = 503;
+  if (!status) status = 502;
+
+  const resetSource = typeof error === "object" ? error : {};
+  const responseSource = parsed.response || {};
+  const resetsAtMs = [
+    resetSource.resets_at,
+    resetSource.reset_at,
+    resetSource.resetsAt,
+    responseSource.resets_at,
+    responseSource.reset_at,
+    responseSource.resetsAt,
+  ].map(absoluteResetTime).find(Boolean) || [
+    resetSource.retry_after,
+    resetSource.retryAfter,
+    responseSource.retry_after,
+    responseSource.retryAfter,
+  ].map(retryAfterTime).find(Boolean) || null;
+  const metadata = [
+    type && type !== "error" && type !== "response.failed" ? `type ${type}` : null,
+    code !== undefined && code !== null && String(code) !== String(status) ? `code ${code}` : null,
+  ].filter(Boolean);
+  const errorText = metadata.length > 0 ? `${message} (${metadata.join(", ")})` : message;
+
+  return { status, message, errorText, resetsAtMs };
+}
+
 /**
  * Stream modes
  */
@@ -67,7 +149,57 @@ export function createSSEStream(options = {}) {
   // Track Responses API event framing for same-format passthrough (codex)
   let currentOpenAIResponsesEvent = null;
   let openAIResponsesTerminalSeen = false;
-  let openAIResponsesDoneSent = false;
+  let openAIResponsesResponseId = null;
+  let openAIResponsesCreatedAt = null;
+  let openAIResponsesSequenceNumber = null;
+  let streamDoneSent = false;
+  let translationFinalized = false;
+  let streamFailure = null;
+
+  const emitTranslatedItems = (translated, controller) => {
+    if (translated?._openaiIntermediate) {
+      for (const item of translated._openaiIntermediate) {
+        const openaiOutput = formatSSE(item, FORMATS.OPENAI);
+        reqLogger?.appendOpenAIChunk?.(openaiOutput);
+      }
+    }
+
+    if (translated?.length > 0) {
+      for (const item of translated) {
+        if (item === null || item === undefined) continue;
+        const output = formatSSE(item, sourceFormat);
+        reqLogger?.appendConvertedChunk?.(output);
+        controller.enqueue(sharedEncoder.encode(output));
+      }
+    }
+  };
+
+  const finalizeTranslatedStream = (controller) => {
+    if (translationFinalized) return;
+    translationFinalized = true;
+
+    emitTranslatedItems(translateResponse(targetFormat, sourceFormat, null, state), controller);
+
+    const keepsOpenAIResponsesFormat = targetFormat === FORMATS.OPENAI_RESPONSES && sourceFormat === FORMATS.OPENAI_RESPONSES;
+    if (keepsOpenAIResponsesFormat && !openAIResponsesTerminalSeen) {
+      streamFailure ||= { status: 502, message: "Responses stream ended before a terminal event" };
+      const failedOutput = formatIncompleteOpenAIResponsesStreamFailure({
+        responseId: openAIResponsesResponseId,
+        createdAt: openAIResponsesCreatedAt,
+        sequenceNumber: openAIResponsesSequenceNumber,
+      });
+      reqLogger?.appendConvertedChunk?.(failedOutput);
+      controller.enqueue(sharedEncoder.encode(failedOutput));
+      openAIResponsesTerminalSeen = true;
+    }
+
+    if (!streamDoneSent) {
+      const doneOutput = "data: [DONE]\n\n";
+      reqLogger?.appendConvertedChunk?.(doneOutput);
+      controller.enqueue(sharedEncoder.encode(doneOutput));
+      streamDoneSent = true;
+    }
+  };
 
   return new TransformStream({
     transform(chunk, controller) {
@@ -96,12 +228,18 @@ export function createSSEStream(options = {}) {
 
         // Passthrough mode: normalize and forward
         if (mode === STREAM_MODE.PASSTHROUGH) {
+          // Preserve the blank separator after [DONE], but discard any later
+          // provider events so clients see one unambiguous terminal sentinel.
+          if (streamDoneSent && trimmed) continue;
+
           let output;
           let injectedUsage = false;
+          const isDoneLine = trimmed.startsWith("data:") && trimmed.slice(5).trim() === "[DONE]";
 
           if (trimmed.startsWith("data:") && trimmed.slice(5).trim() !== "[DONE]") {
             try {
               const parsed = JSON.parse(trimmed.slice(5).trim());
+              streamFailure ||= classifyStreamFailure(parsed);
 
               const idFixed = fixInvalidId(parsed);
 
@@ -190,11 +328,13 @@ export function createSSEStream(options = {}) {
 
           reqLogger?.appendConvertedChunk?.(output);
           controller.enqueue(sharedEncoder.encode(output));
+          if (isDoneLine) streamDoneSent = true;
           continue;
         }
 
         // Translate mode
         if (!trimmed) continue;
+        if (streamDoneSent) continue;
 
         const parsed = parseSSELine(trimmed, targetFormat);
         if (!parsed) continue;
@@ -205,27 +345,34 @@ export function createSSEStream(options = {}) {
         const openAIResponsesEventName = isOpenAIResponsesStream
           ? getOpenAIResponsesEventName(currentOpenAIResponsesEvent, parsed)
           : null;
+        streamFailure ||= classifyStreamFailure(parsed, openAIResponsesEventName);
+        const terminalAlreadySeen = openAIResponsesTerminalSeen;
 
         if (isOpenAIResponsesStream && isOpenAIResponsesTerminalEvent(openAIResponsesEventName, parsed)) {
           openAIResponsesTerminalSeen = true;
         }
+        if (isOpenAIResponsesStream) {
+          openAIResponsesResponseId = parsed?.response?.id || openAIResponsesResponseId;
+          openAIResponsesCreatedAt = parsed?.response?.created_at || openAIResponsesCreatedAt;
+          if (Number.isFinite(parsed?.sequence_number)) {
+            openAIResponsesSequenceNumber = parsed.sequence_number + 1;
+          }
+        }
+
+        // A Responses stream may have exactly one terminal event. Ignore any
+        // contradictory provider events after the first, while still allowing
+        // the [DONE] sentinel through below.
+        if (keepsOpenAIResponsesFormat && terminalAlreadySeen && !parsed.done) {
+          currentOpenAIResponsesEvent = null;
+          continue;
+        }
 
         // For Ollama: done=true is the final chunk with finish_reason/usage, must translate
         // For other formats: done=true is the [DONE] sentinel, skip
         if (parsed && parsed.done && targetFormat !== FORMATS.OLLAMA) {
-          // Synthesize response.failed if the Responses stream never sent a terminal event
-          if (keepsOpenAIResponsesFormat && !openAIResponsesTerminalSeen) {
-            const failedOutput = formatIncompleteOpenAIResponsesStreamFailure();
-            reqLogger?.appendConvertedChunk?.(failedOutput);
-            controller.enqueue(sharedEncoder.encode(failedOutput));
-            openAIResponsesTerminalSeen = true;
-            sseEmittedCount++;
-          }
-
-          const output = "data: [DONE]\n\n";
-          reqLogger?.appendConvertedChunk?.(output);
-          controller.enqueue(sharedEncoder.encode(output));
-          if (keepsOpenAIResponsesFormat) openAIResponsesDoneSent = true;
+          // Flush any client-format terminal events before emitting [DONE].
+          // This also lets clients stop even if upstream keeps the socket open.
+          finalizeTranslatedStream(controller);
           continue;
         }
 
@@ -331,11 +478,14 @@ export function createSSEStream(options = {}) {
         if (remaining) buffer += remaining;
 
         if (mode === STREAM_MODE.PASSTHROUGH) {
-          if (buffer) {
+          if (buffer && (!streamDoneSent || !buffer.trim())) {
             let output = buffer;
             if (buffer.startsWith("data:") && !buffer.startsWith("data: ")) {
               output = "data: " + buffer.slice(5);
             }
+            const isDoneBuffer = buffer.trim().startsWith("data:") && buffer.trim().slice(5).trim() === "[DONE]";
+            if (isDoneBuffer) streamDoneSent = true;
+            if (output && !output.endsWith("\n\n")) output += "\n\n";
             reqLogger?.appendConvertedChunk?.(output);
             controller.enqueue(sharedEncoder.encode(output));
           }
@@ -344,7 +494,9 @@ export function createSSEStream(options = {}) {
             usage = estimateUsage(body, totalContentLength, FORMATS.OPENAI);
           }
 
-          if (hasValidUsage(usage)) {
+          if (streamFailure) {
+            appendRequestLog({ model, provider, connectionId, tokens: usage, status: `FAILED ${streamFailure.status}` }).catch(() => { });
+          } else if (hasValidUsage(usage)) {
             logUsage(provider, usage, model, connectionId, apiKey, {
               persistUsage: typeof onStreamComplete !== "function",
             });
@@ -356,80 +508,38 @@ export function createSSEStream(options = {}) {
           // Some clients (e.g. OpenClaw) expect the OpenAI-style sentinel:
           //   data: [DONE]\n\n
           // Without it they can hang until timeout and trigger failover.
-          const doneOutput = "data: [DONE]\n\n";
-          reqLogger?.appendConvertedChunk?.(doneOutput);
-          controller.enqueue(sharedEncoder.encode(doneOutput));
+          if (!streamDoneSent) {
+            const doneOutput = "data: [DONE]\n\n";
+            reqLogger?.appendConvertedChunk?.(doneOutput);
+            controller.enqueue(sharedEncoder.encode(doneOutput));
+            streamDoneSent = true;
+          }
 
           if (onStreamComplete) {
             onStreamComplete({
               content: accumulatedContent,
               thinking: accumulatedThinking
-            }, usage, ttftAt);
+            }, usage, ttftAt, { failed: !!streamFailure, error: streamFailure });
           }
           return;
         }
 
-        if (buffer.trim()) {
-          const parsed = parseSSELine(buffer.trim());
+        if (buffer.trim() && !translationFinalized) {
+          const parsed = parseSSELine(buffer.trim(), targetFormat);
           if (parsed && !parsed.done) {
-            const translated = translateResponse(targetFormat, sourceFormat, parsed, state);
-
-            if (translated?._openaiIntermediate) {
-              for (const item of translated._openaiIntermediate) {
-                const openaiOutput = formatSSE(item, FORMATS.OPENAI);
-                reqLogger?.appendOpenAIChunk?.(openaiOutput);
-              }
-            }
-
-            if (translated?.length > 0) {
-              for (const item of translated) {
-                if (item === null || item === undefined) continue;
-                const output = formatSSE(item, sourceFormat);
-                reqLogger?.appendConvertedChunk?.(output);
-                controller.enqueue(sharedEncoder.encode(output));
-              }
-            }
-          }
-        }
-
-        const flushed = translateResponse(targetFormat, sourceFormat, null, state);
-
-        if (flushed?._openaiIntermediate) {
-          for (const item of flushed._openaiIntermediate) {
-            const openaiOutput = formatSSE(item, FORMATS.OPENAI);
-            reqLogger?.appendOpenAIChunk?.(openaiOutput);
+            emitTranslatedItems(translateResponse(targetFormat, sourceFormat, parsed, state), controller);
           }
         }
 
-        if (flushed?.length > 0) {
-          for (const item of flushed) {
-            if (item === null || item === undefined) continue;
-            const output = formatSSE(item, sourceFormat);
-            reqLogger?.appendConvertedChunk?.(output);
-            controller.enqueue(sharedEncoder.encode(output));
-          }
-        }
-
-        // Synthesize response.failed if a Responses passthrough stream never reached a terminal event
-        const keepsOpenAIResponsesFormat = targetFormat === FORMATS.OPENAI_RESPONSES && sourceFormat === FORMATS.OPENAI_RESPONSES;
-        if (keepsOpenAIResponsesFormat && !openAIResponsesTerminalSeen) {
-          const failedOutput = formatIncompleteOpenAIResponsesStreamFailure();
-          reqLogger?.appendConvertedChunk?.(failedOutput);
-          controller.enqueue(sharedEncoder.encode(failedOutput));
-          openAIResponsesTerminalSeen = true;
-        }
-
-        if (!keepsOpenAIResponsesFormat || !openAIResponsesDoneSent) {
-          const doneOutput = "data: [DONE]\n\n";
-          reqLogger?.appendConvertedChunk?.(doneOutput);
-          controller.enqueue(sharedEncoder.encode(doneOutput));
-        }
+        finalizeTranslatedStream(controller);
 
         if (!hasValidUsage(state?.usage) && totalContentLength > 0) {
           state.usage = estimateUsage(body, totalContentLength, sourceFormat);
         }
 
-        if (hasValidUsage(state?.usage)) {
+        if (streamFailure) {
+          appendRequestLog({ model, provider, connectionId, tokens: state?.usage, status: `FAILED ${streamFailure.status}` }).catch(() => { });
+        } else if (hasValidUsage(state?.usage)) {
           logUsage(state.provider || targetFormat, state.usage, model, connectionId, apiKey, {
             persistUsage: typeof onStreamComplete !== "function",
           });
@@ -441,7 +551,7 @@ export function createSSEStream(options = {}) {
           onStreamComplete({
             content: accumulatedContent,
             thinking: accumulatedThinking
-          }, state?.usage, ttftAt);
+          }, state?.usage, ttftAt, { failed: !!streamFailure, error: streamFailure });
         }
       } catch (error) {
         console.log("Error in flush:", error);

package/open-sse/utils/streamHandler.js

@@ -110,13 +110,19 @@ export function createDisconnectAwareStream(transformStream, streamController, o
   const reader = transformStream.readable.getReader();
   const writer = transformStream.writable.getWriter();
   let terminalEmitted = false;
+  const buildAbortTerminal = typeof onAbortTerminal === "function"
+    ? onAbortTerminal
+    : onAbortTerminal?.build?.bind(onAbortTerminal);
+  const observeOutput = typeof onAbortTerminal === "object"
+    ? onAbortTerminal?.observe?.bind(onAbortTerminal)
+    : null;
 
   // Emit a synthesized terminal payload (e.g. Responses response.failed + [DONE]) once
   const emitTerminal = (controller) => {
-    if (terminalEmitted || !onAbortTerminal) return;
+    if (terminalEmitted || !buildAbortTerminal) return;
     terminalEmitted = true;
     try {
-      const bytes = onAbortTerminal();
+      const bytes = buildAbortTerminal();
       if (bytes) controller.enqueue(bytes);
     } catch { /* best-effort terminal */ }
   };
@@ -124,6 +130,10 @@ export function createDisconnectAwareStream(transformStream, streamController, o
   return new ReadableStream({
     async pull(controller) {
       if (!streamController.isConnected()) {
+        await Promise.allSettled([
+          reader.cancel("stream_disconnected"),
+          writer.abort("stream_disconnected"),
+        ]);
         emitTerminal(controller);
         controller.close();
         return;
@@ -137,6 +147,7 @@ export function createDisconnectAwareStream(transformStream, streamController, o
           controller.close();
           return;
         }
+        try { observeOutput?.(value); } catch { /* terminal tracking is best-effort */ }
         controller.enqueue(value);
       } catch (error) {
         const wasConnected = streamController.isConnected();
@@ -172,10 +183,12 @@ export function createDisconnectAwareStream(transformStream, streamController, o
       }
     },
 
-    cancel(reason) {
+    async cancel(reason) {
       streamController.handleDisconnect(reason || "cancelled");
-      reader.cancel();
-      writer.abort();
+      await Promise.allSettled([
+        reader.cancel(reason),
+        writer.abort(reason),
+      ]);
     }
   });
 }
@@ -259,4 +272,3 @@ export function pipeWithDisconnect(providerResponse, transformStream, streamCont
     onAbortTerminal
   );
 }
-

package/open-sse/utils/usageTracking.js

@@ -81,7 +81,7 @@ export function filterUsageForFormat(usage, targetFormat) {
       'estimated'
     ],
     [FORMATS.OPENAI_RESPONSES]: [
-      'input_tokens', 'output_tokens',
+      'input_tokens', 'output_tokens', 'total_tokens',
       'input_tokens_details', 'output_tokens_details',
       'estimated'
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.153",
+  "version": "1.0.154",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"
@@ -72,10 +72,12 @@
   },
   "comment_optional_runtime": "Heavy packages are installed into ~/.zevai/runtime instead of the published tarball. Automation uses Playwright Chromium only; ZEVAI_MINIMAL_POSTINSTALL=1 skips its browser download. Other lazy runtimes are better-sqlite3 and node-pty.",
   "overrides": {
+    "body-parser": "^2.3.0",
     "dompurify": "^3.4.12",
-    "postcss": "^8.5.10"
+    "postcss": "^8.5.10",
+    "sharp": "^0.35.0"
   },
-  "comment_overrides": "dompurify: monaco-editor@0.55.1 pins vulnerable dompurify@3.2.7 (multiple mXSS advisories, all fixed in 3.4.x). Override forces the patched 3.4.12 until monaco ships a stable release with the fix (currently only in 0.56.0-dev). We don't use dompurify directly; monaco only uses it to sanitize HTML hover/completion output.",
+  "comment_overrides": "Security floors for transitive runtime dependencies. Monaco still pins an old DOMPurify; Express and Next may resolve vulnerable body-parser/sharp releases without these minimums. Recheck and remove overrides once their parent packages require fixed versions.",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
     "better-sqlite3": "^12.6.2",

package/postcss.config.mjs

@@ -3,10 +3,12 @@ import { fileURLToPath } from "node:url";
 
 const projectRoot = path.dirname(fileURLToPath(import.meta.url));
 
-export default {
+const postcssConfig = {
   plugins: {
     "@tailwindcss/postcss": {
       base: projectRoot,
     },
   },
 };
+
+export default postcssConfig;

package/src/app/(dashboard)/dashboard/cli-tools/CLIToolsPageClient.js

@@ -25,7 +25,10 @@ export default function CLIToolsPageClient({ machineId }) {
 
   useEffect(() => {
     let controller = new AbortController();
-    fetchStatuses(controller.signal);
+    const initialController = controller;
+    const initialRequest = window.setTimeout(() => {
+      fetchStatuses(initialController.signal);
+    }, 0);
     const onFocus = () => {
       controller.abort();
       controller = new AbortController();
@@ -33,6 +36,7 @@ export default function CLIToolsPageClient({ machineId }) {
     };
     window.addEventListener("focus", onFocus);
     return () => {
+      window.clearTimeout(initialRequest);
       controller.abort();
       window.removeEventListener("focus", onFocus);
     };

package/src/app/(dashboard)/dashboard/cli-tools/[toolId]/ToolDetailClient.js

@@ -34,7 +34,7 @@ export default function ToolDetailClient({ toolId, machineId }) {
           fetch("/api/providers"),
           fetch("/api/settings"),
           fetch("/api/tunnel/status"),
-          fetch("/api/keys"),
+          fetch("/api/dashboard/cli-tools/keys", { cache: "no-store" }),
         ]);
         if (!mounted) return;
         if (provRes.ok) {