zevairouter 1.0.48 → 1.0.50

package/src/app/api/dashboard/chat/completions/route.js

@@ -0,0 +1,74 @@
+import { handleChat } from "@/sse/handlers/chat.js";
+import { initTranslators } from "open-sse/translator/index.js";
+import { getApiKeys, getSettings } from "@/lib/localDb";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+let initialized = false;
+
+async function ensureInitialized() {
+  if (!initialized) {
+    await initTranslators();
+    initialized = true;
+  }
+}
+
+/**
+ * Dashboard Playground chat endpoint.
+ * Requires dashboard login (via dashboardGuard PROTECTED_API_PATHS).
+ * If requireApiKey is on, injects the first active API key so the UI
+ * does not need the user to paste a key into the playground.
+ */
+export async function POST(request) {
+  await ensureInitialized();
+
+  const bodyText = await request.text();
+  let body;
+  try {
+    body = JSON.parse(bodyText || "{}");
+  } catch {
+    return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const headers = new Headers(request.headers);
+  headers.set("content-type", "application/json");
+  headers.set("accept", headers.get("accept") || "text/event-stream");
+
+  // Inject API key when enforcement is on and browser session has no key
+  if (!headers.get("authorization") && !headers.get("x-api-key")) {
+    try {
+      const settings = await getSettings();
+      if (settings?.requireApiKey) {
+        const keys = await getApiKeys();
+        const active = (keys || []).find((k) => k?.isActive !== false && k?.key);
+        if (active?.key) {
+          headers.set("authorization", `Bearer ${active.key}`);
+        }
+      }
+    } catch {
+      // fall through — handleChat will reject if key truly required and missing
+    }
+  }
+
+  const url = new URL(request.url);
+  url.pathname = "/api/v1/chat/completions";
+
+  const proxied = new Request(url.toString(), {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+
+  return handleChat(proxied);
+}
+
+export async function OPTIONS() {
+  return new Response(null, {
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": "POST, OPTIONS",
+      "Access-Control-Allow-Headers": "*",
+    },
+  });
+}

package/src/app/api/oauth/grok-cli/bulk-import/[jobId]/cancel/route.js

@@ -1,13 +1,9 @@
 import { NextResponse } from "next/server";
 import { getGrokCliBulkImportManager } from "@/lib/oauth/services/grokCliBulkImportManager";
-import { requireGrokAutomationKey } from "@/lib/oauth/services/grokAutomationGate";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(request, { params }) {
-  const denied = await requireGrokAutomationKey(request);
-  if (denied) return denied;
-
+export async function POST(_request, { params }) {
   const { jobId } = await params;
   const manager = getGrokCliBulkImportManager();
   const job = manager.cancelJob(jobId);

package/src/app/api/oauth/grok-cli/bulk-import/[jobId]/manual/[workerId]/route.js

@@ -1,13 +1,9 @@
 import { NextResponse } from "next/server";
 import { getGrokCliBulkImportManager } from "@/lib/oauth/services/grokCliBulkImportManager";
-import { requireGrokAutomationKey } from "@/lib/oauth/services/grokAutomationGate";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(request, { params }) {
-  const denied = await requireGrokAutomationKey(request);
-  if (denied) return denied;
-
+export async function POST(_request, { params }) {
   const { jobId, workerId } = await params;
   const manager = getGrokCliBulkImportManager();
   const result = await manager.openManualSession(jobId, workerId);

package/src/app/api/oauth/grok-cli/bulk-import/[jobId]/route.js

@@ -1,13 +1,9 @@
 import { NextResponse } from "next/server";
 import { getGrokCliBulkImportManager, buildLookupResponse } from "@/lib/oauth/services/grokCliBulkImportManager";
-import { requireGrokAutomationKey } from "@/lib/oauth/services/grokAutomationGate";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request, { params }) {
-  const denied = await requireGrokAutomationKey(request);
-  if (denied) return denied;
-
+export async function GET(_request, { params }) {
   const { jobId } = await params;
   const manager = getGrokCliBulkImportManager();
   const job = await manager.getJobWithPreview(jobId);

package/src/app/api/oauth/grok-cli/bulk-import/latest/route.js

@@ -1,13 +1,9 @@
 import { NextResponse } from "next/server";
 import { getGrokCliBulkImportManager, buildLookupResponse } from "@/lib/oauth/services/grokCliBulkImportManager";
-import { requireGrokAutomationKey } from "@/lib/oauth/services/grokAutomationGate";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(request) {
-  const denied = await requireGrokAutomationKey(request);
-  if (denied) return denied;
-
   const manager = getGrokCliBulkImportManager();
   const searchParams = new URL(request.url).searchParams;
   const scope = searchParams.get("scope");

package/src/app/api/oauth/grok-cli/bulk-import/route.js

@@ -1,15 +1,11 @@
 import { NextResponse } from "next/server";
 import { getGrokCliBulkImportManager } from "@/lib/oauth/services/grokCliBulkImportManager";
-import { requireGrokAutomationKey } from "@/lib/oauth/services/grokAutomationGate";
 
 export const dynamic = "force-dynamic";
 
 export async function POST(request) {
   try {
     const body = await request.json();
-    const denied = await requireGrokAutomationKey(request, body);
-    if (denied) return denied;
-
     const accounts = Array.isArray(body?.accounts) ? body.accounts : [];
 
     if (!accounts.length) {

package/src/app/api/settings/route.js

@@ -14,13 +14,9 @@ const SETTINGS_RESPONSE_HEADERS = {
 export async function GET() {
   try {
     const settings = await getSettings();
-    const { password, oidcClientSecret, fiveSimApiKey, grokAutomationAccessKey, ...safeSettings } = settings;
+    const { password, oidcClientSecret, fiveSimApiKey, ...safeSettings } = settings;
     safeSettings.oidcConfigured = !!(safeSettings.oidcIssuerUrl && safeSettings.oidcClientId && oidcClientSecret);
     safeSettings.fiveSimApiKeyConfigured = !!fiveSimApiKey;
-    safeSettings.grokAutomationAccessKeyConfigured = !!(
-      grokAutomationAccessKey || process.env.GROK_AUTOMATION_ACCESS_KEY
-    );
-    safeSettings.grokAutomationAccessKeyFromEnv = !!String(process.env.GROK_AUTOMATION_ACCESS_KEY || "").trim();
     
     const enableRequestLogs = process.env.ENABLE_REQUEST_LOGS === "true";
     const enableTranslator = process.env.ENABLE_TRANSLATOR === "true";
@@ -82,18 +78,6 @@ export async function PATCH(request) {
       }
     }
 
-    // Empty grokAutomationAccessKey = keep existing; "__clear__" removes it
-    if (Object.prototype.hasOwnProperty.call(body, "grokAutomationAccessKey")) {
-      const raw = body.grokAutomationAccessKey;
-      if (raw === "__clear__") {
-        body.grokAutomationAccessKey = "";
-      } else if (!raw || !String(raw).trim()) {
-        delete body.grokAutomationAccessKey;
-      } else {
-        body.grokAutomationAccessKey = String(raw).trim();
-      }
-    }
-
     const settings = await updateSettings(body);
 
     // Apply outbound proxy settings immediately (no restart required)
@@ -114,13 +98,9 @@ export async function PATCH(request) {
       resetComboRotation();
     }
 
-    const { password, oidcClientSecret, fiveSimApiKey, grokAutomationAccessKey, ...safeSettings } = settings;
+    const { password, oidcClientSecret, fiveSimApiKey, ...safeSettings } = settings;
     safeSettings.oidcConfigured = !!(safeSettings.oidcIssuerUrl && safeSettings.oidcClientId && oidcClientSecret);
     safeSettings.fiveSimApiKeyConfigured = !!fiveSimApiKey;
-    safeSettings.grokAutomationAccessKeyConfigured = !!(
-      grokAutomationAccessKey || process.env.GROK_AUTOMATION_ACCESS_KEY
-    );
-    safeSettings.grokAutomationAccessKeyFromEnv = !!String(process.env.GROK_AUTOMATION_ACCESS_KEY || "").trim();
     return NextResponse.json(safeSettings, { headers: SETTINGS_RESPONSE_HEADERS });
   } catch (error) {
     console.log("Error updating settings:", error);

package/src/app/api/terminal/session/[id]/input/route.js

@@ -0,0 +1,29 @@
+import { NextResponse } from "next/server";
+import { writeTerminalInput } from "@/lib/terminal/sessionManager";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(request, { params }) {
+  const { id } = await params;
+  let data = "";
+
+  const contentType = request.headers.get("content-type") || "";
+  if (contentType.includes("application/json")) {
+    const body = await request.json().catch(() => ({}));
+    data = typeof body?.data === "string" ? body.data : "";
+  } else {
+    data = await request.text().catch(() => "");
+  }
+
+  // Cap single write to avoid abuse
+  if (data.length > 64 * 1024) {
+    return NextResponse.json({ error: "Input too large" }, { status: 413 });
+  }
+
+  const result = writeTerminalInput(id, data);
+  if (!result.ok) {
+    return NextResponse.json({ error: result.error || "Write failed" }, { status: 404 });
+  }
+  return NextResponse.json({ ok: true });
+}

package/src/app/api/terminal/session/[id]/resize/route.js

@@ -0,0 +1,15 @@
+import { NextResponse } from "next/server";
+import { resizeTerminalSession } from "@/lib/terminal/sessionManager";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(request, { params }) {
+  const { id } = await params;
+  const body = await request.json().catch(() => ({}));
+  const result = resizeTerminalSession(id, body?.cols, body?.rows);
+  if (!result.ok) {
+    return NextResponse.json({ error: result.error || "Resize failed" }, { status: 404 });
+  }
+  return NextResponse.json(result);
+}

package/src/app/api/terminal/session/[id]/route.js

@@ -0,0 +1,32 @@
+import { NextResponse } from "next/server";
+import { getTerminalSession, killTerminalSession } from "@/lib/terminal/sessionManager";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function GET(_request, { params }) {
+  const { id } = await params;
+  const session = getTerminalSession(id);
+  if (!session) {
+    return NextResponse.json({ error: "Session not found" }, { status: 404 });
+  }
+  return NextResponse.json({
+    id: session.id,
+    shell: session.shell,
+    mode: session.mode,
+    cols: session.cols,
+    rows: session.rows,
+    alive: session.alive,
+    createdAt: session.createdAt,
+    lastActive: session.lastActive,
+  });
+}
+
+export async function DELETE(_request, { params }) {
+  const { id } = await params;
+  const killed = killTerminalSession(id);
+  if (!killed) {
+    return NextResponse.json({ error: "Session not found" }, { status: 404 });
+  }
+  return NextResponse.json({ ok: true });
+}

package/src/app/api/terminal/session/[id]/stream/route.js

@@ -0,0 +1,92 @@
+import { getTerminalSession, subscribeTerminalOutput } from "@/lib/terminal/sessionManager";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function GET(request, { params }) {
+  const { id } = await params;
+  const session = getTerminalSession(id);
+
+  if (!session) {
+    return new Response(JSON.stringify({ error: "Session not found" }), {
+      status: 404,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const encoder = new TextEncoder();
+  const state = { closed: false, unsubscribe: null, keepalive: null };
+
+  const cleanup = () => {
+    if (state.closed) return;
+    state.closed = true;
+    try { state.unsubscribe?.(); } catch { /* ignore */ }
+    if (state.keepalive) clearInterval(state.keepalive);
+  };
+
+  request.signal.addEventListener("abort", cleanup, { once: true });
+
+  const stream = new ReadableStream({
+    start(controller) {
+      const send = (payload) => {
+        if (state.closed) return;
+        try {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(payload)}\n\n`));
+        } catch {
+          cleanup();
+        }
+      };
+
+      // Replay buffered output once (welcome banner + early stdout), then clear so
+      // EventSource auto-reconnects don't dump the same history again.
+      if (session.buffer) {
+        send({ type: "data", data: session.buffer });
+        session.buffer = "";
+      }
+
+      send({
+        type: "ready",
+        id: session.id,
+        shell: session.shell,
+        mode: session.mode,
+        cols: session.cols,
+        rows: session.rows,
+        alive: session.alive,
+      });
+
+      state.unsubscribe = subscribeTerminalOutput(id, {
+        onData: (text) => send({ type: "data", data: text }),
+        onExit: (info) => {
+          send({ type: "exit", ...info });
+          cleanup();
+          try { controller.close(); } catch { /* ignore */ }
+        },
+      });
+
+      state.keepalive = setInterval(() => {
+        if (state.closed) {
+          clearInterval(state.keepalive);
+          return;
+        }
+        try {
+          controller.enqueue(encoder.encode(": ping\n\n"));
+        } catch {
+          cleanup();
+        }
+      }, 20000);
+      state.keepalive.unref?.();
+    },
+    cancel() {
+      cleanup();
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no",
+    },
+  });
+}

package/src/app/api/terminal/session/route.js

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { createTerminalSession, listTerminalSessions } from "@/lib/terminal/sessionManager";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function GET() {
+  return NextResponse.json({ sessions: listTerminalSessions() });
+}
+
+export async function POST(request) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const cols = Number(body?.cols) || 120;
+    const rows = Number(body?.rows) || 40;
+    const session = createTerminalSession({ cols, rows });
+    return NextResponse.json({ ok: true, session });
+  } catch (error) {
+    const status = error?.code === "MAX_SESSIONS" ? 429 : 500;
+    return NextResponse.json(
+      { ok: false, error: error?.message || "Failed to create terminal session" },
+      { status }
+    );
+  }
+}

package/src/app/globals.css

@@ -566,6 +566,81 @@ button {
     0 44px 80px -28px rgba(0, 0, 0, 0.72);
 }
 
+/* Playground assistant markdown (Grok/ChatGPT-like readability) */
+.playground-md {
+  word-break: break-word;
+}
+.playground-md p {
+  margin: 0 0 0.75em;
+}
+.playground-md p:last-child {
+  margin-bottom: 0;
+}
+.playground-md ul,
+.playground-md ol {
+  margin: 0.5em 0 0.75em;
+  padding-left: 1.35em;
+}
+.playground-md li {
+  margin: 0.25em 0;
+}
+.playground-md code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  font-size: 0.88em;
+  padding: 0.12em 0.35em;
+  border-radius: 6px;
+  background: color-mix(in srgb, var(--color-surface-2) 90%, transparent);
+  border: 1px solid var(--color-border-subtle);
+}
+.playground-md pre {
+  margin: 0.75em 0;
+  padding: 0.85em 1em;
+  overflow-x: auto;
+  border-radius: 10px;
+  background: var(--color-bg);
+  border: 1px solid var(--color-border);
+}
+.playground-md pre code {
+  padding: 0;
+  border: 0;
+  background: transparent;
+  font-size: 0.84em;
+  line-height: 1.55;
+}
+.playground-md a {
+  color: var(--color-primary);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.playground-md h1,
+.playground-md h2,
+.playground-md h3 {
+  font-weight: 600;
+  margin: 1em 0 0.4em;
+  line-height: 1.3;
+}
+.playground-md h1 { font-size: 1.15em; }
+.playground-md h2 { font-size: 1.08em; }
+.playground-md h3 { font-size: 1.02em; }
+.playground-md blockquote {
+  margin: 0.75em 0;
+  padding: 0.25em 0 0.25em 0.9em;
+  border-left: 3px solid var(--color-primary);
+  color: var(--color-text-muted);
+}
+.playground-md table {
+  width: 100%;
+  border-collapse: collapse;
+  margin: 0.75em 0;
+  font-size: 0.9em;
+}
+.playground-md th,
+.playground-md td {
+  border: 1px solid var(--color-border);
+  padding: 0.4em 0.6em;
+  text-align: left;
+}
+
 /* Respect reduced-motion: keep depth, drop the movement */
 @media (prefers-reduced-motion: reduce) {
   .card-3d { transition: box-shadow 0.3s ease; }

package/src/dashboardGuard.js

@@ -42,6 +42,7 @@ const ALWAYS_PROTECTED = [
   "/api/version/update",
   "/api/oauth/cursor/auto-import",
   "/api/oauth/kiro/auto-import",
+  "/api/terminal",
 ];
 
 // Require auth, but allow through if requireLogin is disabled
@@ -65,6 +66,8 @@ const PROTECTED_API_PATHS = [
   "/api/tunnel",
   "/api/headroom",
   "/api/pxpipe",
+  "/api/dashboard",
+  "/api/terminal",
 ];
 
 // Routes that spawn child processes or read host secrets — restrict to localhost.
@@ -88,6 +91,8 @@ const LOCAL_ONLY_PATHS = [
   "/api/pxpipe/start",
   "/api/pxpipe/stop",
   "/api/pxpipe/restart",
+  // Web shell: full host shell access — never expose over tunnel/remote.
+  "/api/terminal",
 ];
 
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);

package/src/lib/db/repos/settingsRepo.js

@@ -50,8 +50,6 @@ const DEFAULT_SETTINGS = {
   contextInjectionEnabled: false,
   // 5sim.net API key for CodeBuddy CN phone bulk registration (never expose raw in GET)
   fiveSimApiKey: "",
-  // Shared secret required for Grok CLI bulk automation (never expose raw in GET)
-  grokAutomationAccessKey: "",
 };
 
 async function readRaw() {

package/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)