zevairouter 1.0.28 → 1.0.30

package/cli/app/cli/hooks/sqliteRuntime.js

@@ -80,13 +80,14 @@ function summarizeNpmError(stderr = "") {
 }
 
 function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
-  // --no-save is critical: the runtime dir hosts multiple lazily-installed
-  // optional packages (better-sqlite3, camoufox-js, playwright). Installing one
-  // without --no-save prunes the others (npm reconciles node_modules against
-  // package.json on every install), which is why camoufox-js kept vanishing on
-  // restart. --no-save keeps each install additive.
-  const alreadyNoSave = extraArgs.includes("--no-save");
-  const args = ["install", ...pkgs, "--no-audit", "--no-fund", "--prefer-online", ...(alreadyNoSave ? [] : ["--no-save"]), ...extraArgs];
+  // Use --save (NOT --no-save): the runtime dir hosts several lazily-installed
+  // optional packages (better-sqlite3, camoufox-js, playwright, systray2). npm
+  // v11 prunes anything NOT declared in package.json on every `npm install`, so
+  // --no-save made each install wipe the previously-installed optional packages
+  // (camoufox-js kept vanishing on restart). --save records each package as a
+  // real dependency so npm treats it as legitimate and never prunes it.
+  const filtered = extraArgs.filter((a) => a !== "--no-save");
+  const args = ["install", ...pkgs, "--save", "--no-audit", "--no-fund", "--prefer-online", ...filtered];
 
   // Prefer running npm-cli.js with the SAME Node that's executing us. On hosts
   // where the default `npm`/`/usr/bin/node` is an old Node (e.g. v12), spawning

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/app/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -24,11 +24,56 @@ async function importPlaywright() {
   return playwright.chromium ?? playwright.default?.chromium ?? null;
 }
 
+const STEALTH_INIT_SCRIPT = `
+  Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+  Object.defineProperty(navigator, 'languages', { get: () => ['en-US', 'en'] });
+  Object.defineProperty(navigator, 'plugins', {
+    get: () => {
+      const plugins = [
+        { name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer', description: 'Portable Document Format' },
+        { name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai', description: '' },
+        { name: 'Native Client', filename: 'internal-nacl-plugin', description: '' },
+      ];
+      plugins.length = 3;
+      return plugins;
+    }
+  });
+  const _origQuery = window.navigator.permissions.query;
+  window.navigator.permissions.query = (parameters) =>
+    parameters.name === 'notifications'
+      ? Promise.resolve({ state: Notification.permission })
+      : _origQuery.call(window.navigator.permissions, parameters);
+  if (window.chrome) {
+    if (!window.chrome.runtime) window.chrome.runtime = {};
+    window.chrome.runtime.connect = window.chrome.runtime.connect || function() {};
+    window.chrome.runtime.sendMessage = window.chrome.runtime.sendMessage || function() {};
+  } else {
+    window.chrome = { runtime: { connect: function() {}, sendMessage: function() {} } };
+  }
+  const _origGetParameter = WebGLRenderingContext.prototype.getParameter;
+  WebGLRenderingContext.prototype.getParameter = function(parameter) {
+    if (parameter === 37445) return 'Intel Inc.';
+    if (parameter === 37446) return 'Intel Iris OpenGL Engine';
+    return _origGetParameter.call(this, parameter);
+  };
+`;
+
+function wrapBrowserWithStealth(browser) {
+  const origNewContext = browser.newContext.bind(browser);
+  browser.newContext = async function (options = {}) {
+    // Fix HeadlessChrome in User-Agent — Google detects this server-side
+    if (!options.userAgent) {
+      const ver = browser.version ? browser.version() : "131.0.0.0";
+      options.userAgent = `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
+    }
+    const ctx = await origNewContext(options);
+    await ctx.addInitScript(STEALTH_INIT_SCRIPT);
+    return ctx;
+  };
+  return browser;
+}
+
 async function launchChromium({ proxyUrl } = {}) {
-  // Try the real import FIRST. In the bundled standalone server this resolves
-  // playwright correctly (Next externalizes it), whereas the runtime helper's
-  // internal require() can return a false negative. We only consult the helper
-  // if the direct import genuinely fails.
   let chromium = null;
   let importErr = null;
   try {
@@ -42,7 +87,6 @@ async function launchChromium({ proxyUrl } = {}) {
     if (runtime?.ensurePlaywrightRuntime) {
       const ready = runtime.ensurePlaywrightRuntime({ silent: false });
       if (ready.ok) {
-        // Helper may have lazily installed playwright / downloaded chromium.
         try {
           chromium = await importPlaywright();
         } catch (err) {
@@ -68,16 +112,38 @@ async function launchChromium({ proxyUrl } = {}) {
     throw friendly;
   }
 
-  const options = { headless: true };
+  const options = {
+    channel: "chrome",
+    headless: true,
+    args: [
+      "--disable-blink-features=AutomationControlled",
+      "--disable-features=IsolateOrigins,site-per-process,AutomationControlled",
+      "--disable-infobars",
+      "--no-first-run",
+      "--no-default-browser-check",
+      "--disable-extensions",
+      "--disable-popup-blocking",
+      "--disable-backgrounding-occluded-windows",
+      "--disable-renderer-backgrounding",
+      "--disable-background-timer-throttling",
+      "--disable-ipc-flooding-protection",
+      "--password-store=basic",
+      "--use-mock-keychain",
+      "--window-size=1920,1080",
+    ],
+    ignoreDefaultArgs: ["--enable-automation"],
+  };
   if (proxyUrl) options.proxy = { server: proxyUrl };
-  return chromium.launch(options);
+
+  const browser = await chromium.launch(options);
+  return wrapBrowserWithStealth(browser);
 }
 
 async function launchCamoufox({ proxyUrl } = {}) {
   const runtime = loadRuntimeHelper("camoufoxRuntime");
   if (!runtime?.ensureCamoufoxRuntime) {
     const err = new Error(
-      `Camoufox runtime helper missing. Reinstall zevairouter or pick the Chromium engine.`
+      `Camoufox runtime helper missing. Reinstall z‍evairouter or pick the Chromium engine.`
     );
     err.code = "CAMOUFOX_RUNTIME_HELPER_MISSING";
     throw err;

package/cli/hooks/sqliteRuntime.js

@@ -80,13 +80,14 @@ function summarizeNpmError(stderr = "") {
 }
 
 function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
-  // --no-save is critical: the runtime dir hosts multiple lazily-installed
-  // optional packages (better-sqlite3, camoufox-js, playwright). Installing one
-  // without --no-save prunes the others (npm reconciles node_modules against
-  // package.json on every install), which is why camoufox-js kept vanishing on
-  // restart. --no-save keeps each install additive.
-  const alreadyNoSave = extraArgs.includes("--no-save");
-  const args = ["install", ...pkgs, "--no-audit", "--no-fund", "--prefer-online", ...(alreadyNoSave ? [] : ["--no-save"]), ...extraArgs];
+  // Use --save (NOT --no-save): the runtime dir hosts several lazily-installed
+  // optional packages (better-sqlite3, camoufox-js, playwright, systray2). npm
+  // v11 prunes anything NOT declared in package.json on every `npm install`, so
+  // --no-save made each install wipe the previously-installed optional packages
+  // (camoufox-js kept vanishing on restart). --save records each package as a
+  // real dependency so npm treats it as legitimate and never prunes it.
+  const filtered = extraArgs.filter((a) => a !== "--no-save");
+  const args = ["install", ...pkgs, "--save", "--no-audit", "--no-fund", "--prefer-online", ...filtered];
 
   // Prefer running npm-cli.js with the SAME Node that's executing us. On hosts
   // where the default `npm`/`/usr/bin/node` is an old Node (e.g. v12), spawning

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -24,11 +24,56 @@ async function importPlaywright() {
   return playwright.chromium ?? playwright.default?.chromium ?? null;
 }
 
+const STEALTH_INIT_SCRIPT = `
+  Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+  Object.defineProperty(navigator, 'languages', { get: () => ['en-US', 'en'] });
+  Object.defineProperty(navigator, 'plugins', {
+    get: () => {
+      const plugins = [
+        { name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer', description: 'Portable Document Format' },
+        { name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai', description: '' },
+        { name: 'Native Client', filename: 'internal-nacl-plugin', description: '' },
+      ];
+      plugins.length = 3;
+      return plugins;
+    }
+  });
+  const _origQuery = window.navigator.permissions.query;
+  window.navigator.permissions.query = (parameters) =>
+    parameters.name === 'notifications'
+      ? Promise.resolve({ state: Notification.permission })
+      : _origQuery.call(window.navigator.permissions, parameters);
+  if (window.chrome) {
+    if (!window.chrome.runtime) window.chrome.runtime = {};
+    window.chrome.runtime.connect = window.chrome.runtime.connect || function() {};
+    window.chrome.runtime.sendMessage = window.chrome.runtime.sendMessage || function() {};
+  } else {
+    window.chrome = { runtime: { connect: function() {}, sendMessage: function() {} } };
+  }
+  const _origGetParameter = WebGLRenderingContext.prototype.getParameter;
+  WebGLRenderingContext.prototype.getParameter = function(parameter) {
+    if (parameter === 37445) return 'Intel Inc.';
+    if (parameter === 37446) return 'Intel Iris OpenGL Engine';
+    return _origGetParameter.call(this, parameter);
+  };
+`;
+
+function wrapBrowserWithStealth(browser) {
+  const origNewContext = browser.newContext.bind(browser);
+  browser.newContext = async function (options = {}) {
+    // Fix HeadlessChrome in User-Agent — Google detects this server-side
+    if (!options.userAgent) {
+      const ver = browser.version ? browser.version() : "131.0.0.0";
+      options.userAgent = `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
+    }
+    const ctx = await origNewContext(options);
+    await ctx.addInitScript(STEALTH_INIT_SCRIPT);
+    return ctx;
+  };
+  return browser;
+}
+
 async function launchChromium({ proxyUrl } = {}) {
-  // Try the real import FIRST. In the bundled standalone server this resolves
-  // playwright correctly (Next externalizes it), whereas the runtime helper's
-  // internal require() can return a false negative. We only consult the helper
-  // if the direct import genuinely fails.
   let chromium = null;
   let importErr = null;
   try {
@@ -42,7 +87,6 @@ async function launchChromium({ proxyUrl } = {}) {
     if (runtime?.ensurePlaywrightRuntime) {
       const ready = runtime.ensurePlaywrightRuntime({ silent: false });
       if (ready.ok) {
-        // Helper may have lazily installed playwright / downloaded chromium.
         try {
           chromium = await importPlaywright();
         } catch (err) {
@@ -68,16 +112,38 @@ async function launchChromium({ proxyUrl } = {}) {
     throw friendly;
   }
 
-  const options = { headless: true };
+  const options = {
+    channel: "chrome",
+    headless: true,
+    args: [
+      "--disable-blink-features=AutomationControlled",
+      "--disable-features=IsolateOrigins,site-per-process,AutomationControlled",
+      "--disable-infobars",
+      "--no-first-run",
+      "--no-default-browser-check",
+      "--disable-extensions",
+      "--disable-popup-blocking",
+      "--disable-backgrounding-occluded-windows",
+      "--disable-renderer-backgrounding",
+      "--disable-background-timer-throttling",
+      "--disable-ipc-flooding-protection",
+      "--password-store=basic",
+      "--use-mock-keychain",
+      "--window-size=1920,1080",
+    ],
+    ignoreDefaultArgs: ["--enable-automation"],
+  };
   if (proxyUrl) options.proxy = { server: proxyUrl };
-  return chromium.launch(options);
+
+  const browser = await chromium.launch(options);
+  return wrapBrowserWithStealth(browser);
 }
 
 async function launchCamoufox({ proxyUrl } = {}) {
   const runtime = loadRuntimeHelper("camoufoxRuntime");
   if (!runtime?.ensureCamoufoxRuntime) {
     const err = new Error(
-      `Camoufox runtime helper missing. Reinstall zevairouter or pick the Chromium engine.`
+      `Camoufox runtime helper missing. Reinstall z‍evairouter or pick the Chromium engine.`
     );
     err.code = "CAMOUFOX_RUNTIME_HELPER_MISSING";
     throw err;

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -402,10 +402,28 @@ async function waitForFirstVisibleLocator(page, selector, { timeout = 15_000, po
 async function fillInputResilient(locator, value, { timeout = 15_000 } = {}) {
   if (!locator || value == null) return false;
 
+  // Primary: click + type with human-like random delay to avoid CAPTCHA triggers.
+  // Avoid fill() as primary — it sets the value instantly which Google detects.
   try {
-    await locator.fill(value, { timeout });
+    await locator.click({ timeout: 5_000 });
+  } catch {
+    /* noop */
+  }
+  try {
+    await locator.fill("", { timeout: 3_000 });
+  } catch {
+    /* noop */
+  }
+  try {
+    const delay = Math.floor(40 + Math.random() * 80); // 40-120ms per keystroke
+    await locator.type(value, { delay, timeout });
   } catch {
-    // swallow; verification + fallback below will decide
+    // If type() fails, fall back to fill()
+    try {
+      await locator.fill(value, { timeout });
+    } catch {
+      return false;
+    }
   }
 
   let observed = "";
@@ -416,8 +434,7 @@ async function fillInputResilient(locator, value, { timeout = 15_000 } = {}) {
   }
   if (observed === value) return true;
 
-  // Fallback for React/Vue-controlled inputs where .fill() bypasses the
-  // framework's onChange wiring and the value snaps back to empty.
+  // Final fallback for React/Vue-controlled inputs
   try {
     await locator.click({ timeout: 5_000 });
   } catch {