zevairouter 1.0.187 → 1.0.188

package/cli/app/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Unreleased
 
+# v1.0.188 (2026-08-02)
+
+## Fixes
+- **Restoring a backup no longer rewinds this install's schema version**: `importDb()` cleared and repopulated `_meta` from the payload, so restoring a backup taken under an older schema reset `schemaVersion` and replayed migrations on the next boot — harmless only while every migration happens to be idempotent. The same path overwrote `totalRequestsLifetime`, which counts the `usageHistory` a restore deliberately preserves, leaving the counter disagreeing with the history still on disk. `_meta` records install identity rather than config, so a restore now leaves it untouched.
+- **`INSERT ... RETURNING` no longer silently applies to one row on the sql.js fallback driver**: `run()` stepped each statement once, which is enough for a plain `INSERT`/`UPDATE` but leaves a `RETURNING` statement partly unapplied, since it yields one row per affected record. The remaining rows were dropped and `changes` undercounted, with no error raised. Statements are now drained.
+- **A failed first write no longer leaves the sql.js driver running without its schema**: recovery rewinds memory to the last image that reached disk, but when no file exists yet that image is an empty database — consistent with disk, and stripped of the schema the migration had just created. Every later query then failed with a bare "no such table". The adapter now refuses further work and reports the original write failure.
+- **An abandoned stream no longer locks a budgeted API key out**: the slot that serializes budgeted requests was freed only by SSE stream completion, so a client that neither drained nor cancelled its stream pinned it until the process restarted. Slots now carry a short idle deadline that each streamed chunk refreshes, so long-running completions keep their slot while abandoned ones release it.
+- **Failed web-shell unlocks no longer lock you out of the dashboard**: dashboard login and terminal unlock are separate credentials but shared one lockout bucket, so wrong terminal-unlock attempts counted toward the dashboard lockout — locking an operator out over a password they never typed. Buckets are now scoped per surface. This affected the default configuration most, where every caller already shares a single bucket.
+- **The MITM proxy no longer restarts itself after a deliberate stop or a failed start**: a killed child reports exit code `null` rather than `0`, which read as a crash. A start that had already failed its health check would begin a restart loop behind the error it was raising, and a deliberate stop could bring the proxy straight back up. Exits from a child that a restart had already replaced also cleared the live server's handle and deleted its pid file. Intentional kills are now tracked, and each exit handler only acts for the child it belongs to.
+
 # v1.0.187 (2026-08-02)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.187",
+  "version": "1.0.188",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"

package/cli/app/src/lib/db/adapters/sqljsAdapter.js

@@ -57,6 +57,19 @@ export async function createSqlJsAdapter(filePath, options = {}) {
 
   let dirty = false;
   let transactionDepth = 0;
+  // Set when a rewind could only restore an empty database, i.e. the schema this
+  // process created never reached disk. Every later call rejects rather than
+  // running against a database that silently lost its tables.
+  let unusableReason = null;
+
+  function assertUsable() {
+    if (!unusableReason) return;
+    const error = new Error(
+      `sql.js database at ${filePath} is unusable: the initial write failed and no persisted image exists to recover from`
+    );
+    error.cause = unusableReason;
+    throw error;
+  }
 
   function persist() {
     const data = db.export();
@@ -106,9 +119,19 @@ export async function createSqlJsAdapter(filePath, options = {}) {
       throw cause;
     }
     restoreSnapshot(image);
+
+    // No file yet means the very first persist() failed, so the rewind lands on
+    // an empty database: consistent with disk, but stripped of the schema
+    // migrate.js had just created. A caller that swallows this error would then
+    // hit bare "no such table" failures on every later query. Fail loudly
+    // instead, naming the original cause.
+    if (image === null) {
+      unusableReason = cause;
+    }
   }
 
   function runWithPersistence(operation) {
+    assertUsable();
     if (transactionDepth > 0) return operation();
 
     try {
@@ -131,7 +154,11 @@ export async function createSqlJsAdapter(filePath, options = {}) {
       const stmt = db.prepare(sql);
       try {
         stmt.bind(paramsObj(params));
-        stmt.step();
+        // Drain the statement rather than stepping once. A plain INSERT/UPDATE
+        // completes on the first step, but `INSERT ... RETURNING` yields one row
+        // per affected record and stopping early left the rest unapplied — and
+        // getRowsModified() undercounting — with no error raised.
+        while (stmt.step()) { /* drain */ }
         const changes = db.getRowsModified();
         const lastInsertRowid = db.exec("SELECT last_insert_rowid() as id")[0]?.values?.[0]?.[0] ?? null;
         return { changes, lastInsertRowid };
@@ -142,6 +169,7 @@ export async function createSqlJsAdapter(filePath, options = {}) {
   }
 
   function get(sql, params = []) {
+    assertUsable();
     const stmt = db.prepare(sql);
     try {
       stmt.bind(paramsObj(params));
@@ -153,6 +181,7 @@ export async function createSqlJsAdapter(filePath, options = {}) {
   }
 
   function all(sql, params = []) {
+    assertUsable();
     const stmt = db.prepare(sql);
     try {
       stmt.bind(paramsObj(params));
@@ -169,6 +198,7 @@ export async function createSqlJsAdapter(filePath, options = {}) {
   }
 
   function transaction(fn) {
+    assertUsable();
     const sp = `sp_${Math.random().toString(36).slice(2)}`;
     const outermost = transactionDepth === 0;
     db.exec(`SAVEPOINT ${sp}`);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.187",
+  "version": "1.0.188",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.187",
+  "version": "1.0.188",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"