npm - zevairouter - Versions diffs - 1.0.51 → 1.0.52 - Mend

zevairouter 1.0.51 → 1.0.52

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (940) hide show

package/src/app/api/terminal/auth/setup/route.js ADDED Viewed

@@ -0,0 +1,72 @@
+import { NextResponse } from "next/server";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { getSettings, updateSettings } from "@/lib/localDb";
+import { setTerminalUnlockCookie } from "@/lib/auth/terminalSession";
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+async function matchesDashboardPassword(plain, settings) {
+  if (!plain) return false;
+  if (settings.password) {
+    try {
+      return await bcrypt.compare(plain, settings.password);
+    } catch {
+      return false;
+    }
+  }
+  const initial = process.env.INITIAL_PASSWORD || "123456";
+  return plain === initial;
+}
+/**
+ * First-time (or rotate) terminal password.
+ * Body: { password, confirm, currentTerminalPassword? }
+ * Password MUST differ from dashboard password.
+ */
+export async function POST(request) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const password = String(body?.password || "");
+    const confirm = String(body?.confirm || "");
+    const currentTerminalPassword = String(body?.currentTerminalPassword || "");
+    if (password.length < 6) {
+      return NextResponse.json({ error: "Terminal password must be at least 6 characters." }, { status: 400 });
+    }
+    if (password !== confirm) {
+      return NextResponse.json({ error: "Passwords do not match." }, { status: 400 });
+    }
+    const settings = await getSettings();
+    if (await matchesDashboardPassword(password, settings)) {
+      return NextResponse.json(
+        { error: "Terminal password must be different from the dashboard password." },
+        { status: 400 }
+      );
+    }
+    // Rotating: require current terminal password
+    if (settings.terminalPassword) {
+      if (!currentTerminalPassword) {
+        return NextResponse.json({ error: "Current terminal password required." }, { status: 400 });
+      }
+      const ok = await bcrypt.compare(currentTerminalPassword, settings.terminalPassword);
+      if (!ok) {
+        return NextResponse.json({ error: "Current terminal password is incorrect." }, { status: 401 });
+      }
+    }
+    const hash = await bcrypt.hash(password, 10);
+    await updateSettings({ terminalPassword: hash });
+    const cookieStore = await cookies();
+    await setTerminalUnlockCookie(cookieStore, request);
+    return NextResponse.json({ ok: true, configured: true, unlocked: true });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "setup failed" }, { status: 500 });
+  }
+}

package/src/app/api/terminal/auth/status/route.js ADDED Viewed

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import { verifyTerminalUnlockToken } from "@/lib/auth/terminalSession";
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+export async function GET() {
+  try {
+    const settings = await getSettings();
+    const configured = !!settings.terminalPassword;
+    const cookieStore = await cookies();
+    const unlocked = configured
+      ? await verifyTerminalUnlockToken(cookieStore.get("terminal_token")?.value)
+      : false;
+    return NextResponse.json({
+      configured,
+      unlocked,
+      // Always required once feature is present — setup first, then unlock
+      required: true,
+    });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "status failed" }, { status: 500 });
+  }
+}

package/src/app/api/terminal/auth/unlock/route.js ADDED Viewed

@@ -0,0 +1,69 @@
+import { NextResponse } from "next/server";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import {
+  setTerminalUnlockCookie,
+  clearTerminalUnlockCookie,
+} from "@/lib/auth/terminalSession";
+import { checkLock, recordFail, recordSuccess, getClientIp } from "@/lib/auth/loginLimiter";
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+export async function POST(request) {
+  try {
+    const ip = getClientIp(request);
+    const lock = checkLock(ip);
+    if (lock.locked) {
+      return NextResponse.json(
+        { error: `Too many failed attempts. Try again in ${lock.retryAfter}s.`, retryAfter: lock.retryAfter },
+        { status: 429, headers: { "Retry-After": String(lock.retryAfter) } }
+      );
+    }
+    const body = await request.json().catch(() => ({}));
+    const password = String(body?.password || "");
+    const settings = await getSettings();
+    if (!settings.terminalPassword) {
+      return NextResponse.json(
+        { error: "Terminal password not configured. Set one first.", code: "NOT_CONFIGURED" },
+        { status: 400 }
+      );
+    }
+    const ok = await bcrypt.compare(password, settings.terminalPassword);
+    if (!ok) {
+      const { remainingBeforeLock } = recordFail(ip);
+      const postLock = checkLock(ip);
+      if (postLock.locked) {
+        return NextResponse.json(
+          { error: `Too many failed attempts. Try again in ${postLock.retryAfter}s.`, retryAfter: postLock.retryAfter },
+          { status: 429, headers: { "Retry-After": String(postLock.retryAfter) } }
+        );
+      }
+      return NextResponse.json(
+        { error: `Invalid terminal password. ${remainingBeforeLock} attempt(s) left.`, remainingBeforeLock },
+        { status: 401 }
+      );
+    }
+    recordSuccess(ip);
+    const cookieStore = await cookies();
+    await setTerminalUnlockCookie(cookieStore, request);
+    return NextResponse.json({ ok: true, unlocked: true });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "unlock failed" }, { status: 500 });
+  }
+}
+export async function DELETE() {
+  try {
+    const cookieStore = await cookies();
+    clearTerminalUnlockCookie(cookieStore);
+    return NextResponse.json({ ok: true, unlocked: false });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "lock failed" }, { status: 500 });
+  }
+}

package/src/dashboardGuard.js CHANGED Viewed

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getSettings, validateApiKey } from "@/lib/localDb";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { verifyDashboardAuthToken } from "@/lib/auth/dashboardSession";
+import { verifyTerminalUnlockToken } from "@/lib/auth/terminalSession";
 const CLI_TOKEN_HEADER = "x-zevai-cli-token";
 const CLI_TOKEN_SALT = "zevai-cli-auth";
@@ -189,9 +190,37 @@ export async function proxy(request) {
   // Always protected - require valid JWT or local CLI token (machineId-based)
   if (ALWAYS_PROTECTED.some((p) => pathname.startsWith(p))) {
-    if (await hasValidCliToken(request) || await hasValidToken(request))
-      return NextResponse.next();
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const isTerminalApi = pathname.startsWith("/api/terminal");
+    // Terminal allows requireLogin=false path (still needs secondary terminal password).
+    const dashboardOk =
+      (await hasValidCliToken(request))
+      || (await hasValidToken(request))
+      || (isTerminalApi && (await isAuthenticated(request)));
+    if (!dashboardOk) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    // Web shell needs a second password unlock (dashboard session alone is not enough).
+    // Auth endpoints (status/setup/unlock) stay open so the lock screen can work.
+    // CLI machine token may bypass (local automation), not remote browsers.
+    if (
+      isTerminalApi
+      && !pathname.startsWith("/api/terminal/auth")
+      && !(await hasValidCliToken(request))
+    ) {
+      const terminalOk = await verifyTerminalUnlockToken(
+        request.cookies.get("terminal_token")?.value
+      );
+      if (!terminalOk) {
+        return NextResponse.json(
+          { error: "Terminal unlock required", code: "TERMINAL_LOCKED" },
+          { status: 423 }
+        );
+      }
+    }
+    return NextResponse.next();
   }
   if (isPublicLlmApi(pathname)) {

package/src/lib/auth/terminalSession.js ADDED Viewed

@@ -0,0 +1,62 @@
+import { SignJWT, jwtVerify } from "jose";
+import { shouldUseSecureCookie } from "@/lib/auth/dashboardSession";
+// Same secret loader pattern as dashboard — import via dynamic to share SECRET
+// We re-use createDashboardAuthToken's secret by verifying with the same module path.
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { DATA_DIR } from "@/lib/dataDir";
+function loadJwtSecret() {
+  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
+  const file = path.join(DATA_DIR, "jwt-secret");
+  try {
+    return fs.readFileSync(file, "utf8").trim();
+  } catch {}
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const generated = crypto.randomBytes(32).toString("hex");
+  fs.writeFileSync(file, generated, { mode: 0o600 });
+  return generated;
+}
+const SECRET = new TextEncoder().encode(loadJwtSecret());
+const COOKIE_NAME = "terminal_token";
+const TTL = "4h";
+export function getTerminalCookieName() {
+  return COOKIE_NAME;
+}
+export async function createTerminalUnlockToken() {
+  return new SignJWT({ terminal: true, scope: "web-shell" })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime(TTL)
+    .sign(SECRET);
+}
+export async function verifyTerminalUnlockToken(token) {
+  if (!token) return false;
+  try {
+    const { payload } = await jwtVerify(token, SECRET);
+    return payload?.terminal === true && payload?.scope === "web-shell";
+  } catch {
+    return false;
+  }
+}
+export async function setTerminalUnlockCookie(cookieStore, request) {
+  const token = await createTerminalUnlockToken();
+  cookieStore.set(COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: shouldUseSecureCookie(request),
+    sameSite: "lax",
+    path: "/",
+    maxAge: 4 * 60 * 60,
+  });
+}
+export function clearTerminalUnlockCookie(cookieStore) {
+  cookieStore.delete(COOKIE_NAME);
+}

package/cli/app/.next-cli-build/static/KQ64jZ4j5lNOTZstAI3zB/_buildManifest.js DELETED Viewed

@@ -1 +0,0 @@

- self.__BUILD_MANIFEST=function(e,s,t){return{__rewrites:{afterFiles:[{has:e,source:"/v1/v1/:path*",destination:s},{has:e,source:"/v1/v1",destination:t},{has:e,source:"/codex/:path*",destination:"/api/v1/responses"},{has:e,source:"/v1/:path*",destination:s},{has:e,source:"/v1",destination:t}],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:175,errorRate:1e-4,numBits:3355,numHashes:14,bitArray:[0,1,0,0,1,0,0,0,1,0,1,1,0,0,1,1,1,0,0,1,1,1,1,0,0,0,1,1,1,0,0,1,0,1,0,0,1,1,0,1,1,1,1,1,1,1,0,1,1,0,1,1,0,1,0,1,0,1,1,0,1,1,0,1,1,0,0,1,0,0,1,1,0,0,1,0,1,0,1,1,0,0,1,0,0,0,0,1,1,1,0,1,1,1,1,1,0,1,1,1,1,0,0,1,0,1,0,1,0,0,0,1,1,1,0,0,1,0,1,1,1,1,1,1,1,1,0,0,1,0,0,1,1,0,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,1,0,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,1,1,0,0,0,1,0,0,1,1,0,1,1,1,1,1,1,0,1,0,1,0,1,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,0,1,0,0,1,0,1,0,0,0,0,1,0,0,1,1,1,0,1,1,1,0,1,1,0,1,1,1,1,0,0,1,0,1,0,0,1,0,1,0,0,0,1,0,1,1,0,0,1,1,1,0,1,0,0,0,1,1,0,0,1,0,0,1,1,0,0,1,0,0,1,1,1,0,1,0,0,1,1,1,1,0,0,1,1,0,1,1,1,0,1,0,1,1,1,1,1,1,1,1,0,1,1,1,0,1,0,1,0,0,0,1,0,1,0,1,1,1,0,1,0,0,1,1,1,0,1,1,1,1,0,1,0,0,0,1,0,0,1,1,1,0,0,0,0,0,0,1,0,0,0,0,0,1,1,1,0,0,1,1,0,0,1,1,1,1,1,0,1,0,0,1,1,1,0,1,1,0,0,0,0,0,1,0,0,0,0,1,0,0,1,1,1,1,1,0,0,0,0,1,0,1,0,0,1,1,1,1,1,0,0,1,1,0,1,0,1,1,0,1,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,0,0,0,1,1,0,0,0,1,1,0,0,0,0,1,1,1,1,1,1,1,1,1,0,1,1,1,1,1,0,0,1,0,1,0,0,0,0,1,1,1,1,0,1,0,0,1,1,0,1,1,0,1,0,1,1,1,1,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,1,0,0,0,1,0,0,1,0,1,1,1,1,1,1,0,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,1,0,1,1,0,0,0,0,1,0,1,0,1,0,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,1,0,1,1,1,0,0,0,0,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,0,1,1,0,0,1,0,0,1,1,0,0,1,1,1,1,0,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,1,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,1,1,1,0,0,1,1,0,0,0,0,1,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,0,0,0,1,0,0,1,1,0,1,1,0,0,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,0,0,0,0,0,1,1,1,0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,1,0,1,0,0,1,0,1,1,1,0,1,0,1,0,0,1,1,1,0,0,1,1,0,0,1,0,1,0,0,1,0,0,1,1,0,1,0,1,1,1,1,0,1,0,1,1,0,1,1,1,1,1,1,1,0,0,1,1,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,1,1,1,1,1,0,1,1,1,1,1,1,1,1,0,1,0,0,1,0,1,1,1,1,0,1,1,1,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,1,0,0,0,0,1,1,0,1,1,0,0,1,1,1,0,1,1,0,1,1,1,0,0,1,0,0,0,1,0,1,1,1,1,1,0,1,0,1,0,0,1,0,0,1,1,1,0,1,0,1,1,1,1,0,0,1,0,0,0,1,1,1,0,1,1,1,1,1,0,0,1,1,0,0,0,1,1,0,0,0,0,1,1,1,0,1,1,1,1,0,1,0,1,0,1,1,0,1,1,0,0,0,1,1,0,1,1,1,1,0,1,1,1,1,0,1,0,0,1,0,1,0,0,1,0,1,1,1,0,0,0,1,1,0,1,0,0,0,0,0,1,0,1,0,0,0,0,0,0,1,0,1,1,1,0,1,1,0,1,0,0,1,1,1,1,0,1,1,0,1,0,0,1,0,0,1,1,0,1,1,0,1,1,0,1,0,1,0,1,0,0,0,1,0,0,1,1,1,0,1,0,1,1,1,1,0,0,0,0,0,0,0,1,0,0,0,0,1,1,0,0,1,1,1,1,0,0,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,0,0,0,1,1,1,1,1,0,1,0,0,1,0,0,0,1,1,0,1,0,1,0,0,0,0,1,0,0,1,1,0,0,1,0,0,1,1,1,0,0,0,1,1,1,1,0,0,1,1,0,1,1,1,0,0,1,1,1,0,1,1,1,0,0,0,0,0,1,0,0,1,0,1,0,1,0,0,0,0,0,0,0,1,0,1,1,0,1,1,1,1,1,0,0,0,1,1,0,1,1,0,1,1,0,1,1,0,0,0,0,0,0,1,0,1,1,1,0,0,1,0,0,1,0,1,1,0,1,0,0,0,1,0,1,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,0,1,1,0,1,0,0,1,0,0,1,0,1,1,0,1,0,0,1,0,0,1,1,1,0,1,1,1,0,1,1,0,1,1,0,1,1,1,1,0,1,0,1,1,0,0,1,1,1,0,0,0,0,0,0,1,1,1,1,0,0,1,0,1,0,1,0,1,0,0,1,1,1,0,1,0,0,1,0,0,0,1,0,0,0,0,1,0,1,1,1,1,1,0,0,1,0,0,0,1,1,1,0,1,1,1,1,0,0,1,0,0,1,1,0,0,0,0,1,0,1,1,1,0,1,1,1,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,0,1,1,1,0,1,1,0,0,1,0,0,1,0,1,0,1,0,1,0,1,1,1,1,1,0,0,1,1,0,1,0,1,0,0,0,1,0,0,1,1,0,1,1,1,0,1,0,1,1,1,1,0,1,0,0,1,1,1,0,0,0,0,1,1,0,0,1,1,0,0,1,1,1,0,1,1,0,1,1,0,0,1,0,1,1,1,0,0,0,0,1,1,0,0,0,1,0,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,1,0,0,0,0,1,0,0,1,0,1,1,0,0,0,0,1,0,1,1,0,0,1,0,1,1,0,0,0,0,0,0,0,1,1,0,0,0,1,0,1,0,1,0,1,0,0,1,1,0,1,0,1,1,1,0,0,1,0,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,0,1,1,1,1,1,1,1,0,0,0,0,1,0,0,1,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0,1,0,0,0,1,0,0,0,1,1,1,1,0,1,1,1,1,0,1,0,0,0,1,0,1,1,0,0,1,1,1,0,0,0,0,0,0,1,0,1,0,1,1,0,1,1,0,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,0,0,1,1,1,0,1,1,1,1,1,1,1,0,0,1,1,0,1,1,1,0,1,1,0,1,1,1,0,0,0,1,1,1,1,0,0,0,1,1,0,0,1,0,0,0,0,1,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,1,1,0,1,0,1,0,1,1,0,0,1,0,0,1,0,0,0,1,0,1,1,0,0,1,1,0,1,1,0,1,0,0,1,1,1,1,0,0,0,1,1,0,1,1,0,0,1,0,0,0,1,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,1,0,1,0,0,0,0,1,0,1,1,1,1,0,0,1,0,1,0,1,1,1,1,1,0,1,0,1,0,1,1,0,1,1,0,1,0,1,1,1,0,0,0,1,0,0,0,1,0,0,1,1,0,1,0,1,1,1,1,0,1,0,1,0,0,1,1,0,1,1,1,0,0,0,0,0,1,0,1,0,0,0,1,1,0,0,0,1,1,0,1,0,0,1,1,0,1,1,1,1,0,0,0,1,1,0,0,1,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,1,1,0,0,0,1,1,0,1,0,1,1,1,1,0,1,1,0,0,1,0,0,1,1,1,0,1,1,1,1,0,1,1,0,0,1,0,1,0,1,1,0,1,0,0,0,1,1,0,0,1,1,1,1,0,1,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,1,0,1,1,0,0,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,0,0,0,1,1,1,1,1,0,0,0,0,1,0,1,1,1,1,1,0,0,1,1,0,1,0,1,1,1,1,1,1,0,0,1,0,1,1,0,0,1,1,0,1,1,1,1,0,0,0,1,0,1,1,1,1,0,1,1,1,0,0,1,0,0,1,0,0,1,1,1,0,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,0,0,1,1,0,1,0,1,0,0,1,1,0,0,0,0,0,0,1,0,0,1,0,1,1,1,1,0,0,1,0,0,0,1,1,0,1,1,1,1,1,0,1,1,0,1,1,1,1,0,0,1,0,0,0,1,0,1,0,1,0,0,0,1,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,1,1,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,1,0,1,0,0,0,1,1,1,0,1,1,1,0,0,1,1,1,0,1,0,1,1,1,1,1,0,0,1,0,1,0,1,0,0,0,1,1,1,1,0,1,1,0,0,1,1,0,0,1,1,0,1,1,1,0,0,0,0,1,1,1,0,1,1,1,0,0,0,0,1,0,1,1,0,1,0,1,0,0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,0,1,0,1,1,1,0,0,0,1,0,0,1,0,0,0,0,1,1,1,1,1,1,1,0,0,1,0,0,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1,1,1,0,0,0,1,1,0,0,0,0,1,1,0,0,1,1,0,0,1,0,0,1,1,0,0,1,0,1,0,0,1,0,1,1,0,0,1,0,1,1,0,0,1,0,0,1,0,0,1,0,1,1,0,0,1,1,0,0,0,0,0,0,0,1,1,0,1,0,0,1,1,0,0,0,1,1,1,0,1,0,1,0,1,0,0,1,0,0,1,0,0,0,0,1,1,0,1,1,0,1,0,0,0,0,1,0,0,0,1,1,1,1,0,0,1,1,0,1,1,0,0,0,0,1,0,0,0,0,0,0,1,1,0,0,1,0,1,0,0,0,1,0,1,1,0,1,0,1,1,0,1,1,1,0,0,1,1,0,1,1,1,1,0,0,0,1,1,1,0,0,0,1,0,1,1,0,1,0,1,1,0,0,1,0,1,0,0,0,0,1,1,1,0,0,1,1,1,1,1,1,1,0,0,0,0,0,0,1,1,1,0,1,0,0,1,0,1,1,1,0,0,0,1,1,0,0,0,0,1,0,1,0,1,1,0,0,0,0,0,1,1,0,0,0,0,0,1,0,1,1,0,0,1,0,0,1,0,0,0,0,0,1,1,1,1,1,1,1,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,1,1,0,1,1,0,1,1,1,1,0,0,1,0,0,1,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,1,1,0,1,1,1,1,0,1,0,0,0,0,1,1,0,1,1,1,1,1,1,0,0,0,0,0,1,0,0,1,0,1,1,1,0,0,1,0,0,0,0,1,0,0,1,1,1,0,1,1,0,1,1,1,0,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,1,1,1,1,0,1,1,0,0,1,1,1,0,0,0,1,0,0,0,1,0,1,1,1,1,1,1,1,1,1,0,1,0,1,1,0,0,1,1,0,1,0,0,1,1,0,0,0,1,0,1,1,1,0,0,0,0,1,1,1,0,0,1,1,1,1,1,0,0,0,0,1,1,0,1,1,1,1,0,1,1,1,1,1,1,0,1,1,0,0,0,0,1,1,0,0,0,1,0,1,0,0,1,1,0,0,0,0,1,1,1,0,0,0,1,0,0,1,1,1,0,0,1,0,0,0,0,1,0,0,0,1,1,0,1,0,1,1,0,1,1,0,0,1,0,1,0,1,0,1,0,0,0,0,1,0,1,1,0,0,1,1,1,1,0,0,1,1,1,1,0,0,0,0,1,0,0,0,0,0,1,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,0,0,1,0,0,1,1,1,1,1,0,1,1,0,1,1,1,1,0,1,1,0,1,0,1,0,1,1,0,1,0,0,1,1,0,1,1,1,0,1,1,1,0,0,0,1,1,0,0,1,1,0,1,1,1,1,0,0,0,0,1,1,0,0,1,1,0,1,1,0,1,0,1,0,0,1,1,1,0,0,0,0,0,0,0,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,0,1,0,1,1,1,0,1,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,1,0,1,1,0,0,0,1,1,1,0,1,0,0,1,0,1,0,0,0,1,0,0,1,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,1,0,1,1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,1,1,1,0,0,1,0,0,1,0,1,0,1,1,1,1,0,1,1,1,1,1,1,0,1,0,1,0,1,0,1,1,0,0,1,1,0,1,0,0,1,0,0,0,0,1,1,1,0,0,0,1,0,1,0,0,0,0,1,0,1,0,1,1,1,0,1,0,0,0,0,0,0,1,1,0,1,1,1,0,0,1,1,1,1,0,1,0,1,0,1,1,1,1,0,1,0,0,1,0,0,0,1,1,0,0,1,1,0,0,0,0,1,0,1,0,1,1,1,0,1,1,0,0,0,0,0,1,0,0,0,0,1,1]},__routerFilterDynamic:{numItems:24,errorRate:1e-4,numBits:461,numHashes:14,bitArray:[1,1,0,0,1,0,0,1,0,1,0,1,0,1,0,1,0,0,0,1,1,0,0,1,1,1,1,1,0,1,0,0,1,1,0,1,0,0,0,0,1,1,1,1,0,0,0,1,0,0,1,1,1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,1,0,0,0,1,0,1,1,0,1,1,1,1,1,0,0,1,0,0,1,1,0,0,0,0,1,0,1,0,1,1,1,1,1,1,1,0,0,1,0,0,1,1,0,1,0,0,0,0,1,1,0,0,1,1,0,1,1,1,0,1,1,0,1,0,0,0,0,1,0,1,0,0,1,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,0,0,0,0,1,0,0,0,1,0,0,1,1,1,1,1,1,0,0,1,1,1,0,1,0,0,0,1,0,1,0,0,1,0,0,1,1,1,1,1,0,0,1,0,0,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,0,0,0,1,1,1,1,0,0,1,0,0,0,1,1,1,1,1,0,1,0,0,0,0,0,0,0,0,1,1,0,1,0,0,0,1,0,0,0,1,1,1,0,0,1,0,1,1,1,1,0,1,0,1,1,1,1,0,0,1,1,0,0,0,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,0,1,1,1,0,0,0,0,1,1,1,0,0,1,1,1,1,1,0,0,1,1,1,0,0,0,1,1,1,1,1,1,1,0,0,1,0,0,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,1,1,0,1,1,1,1,1,0,0,1,1,1,0,1,1,1,0,0,1,0,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,1,1,0,1,1,1,0,1,1,1,1,1,1,0,0,0,1,1,1,1,1,1,1,1,0,0,1,0,1,1,0,0,0,1,0,1,1,0,1,1,1,0,0,1,1,0,0,0,1,1,0,1,1,1]},sortedPages:["/_app"]}}(void 0,"/api/v1/:path*","/api/v1"),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

package/cli/app/.next-cli-build/static/chunks/app/(dashboard)/dashboard/terminal/page-6a5df47510051a5f.js DELETED Viewed

@@ -1,4 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[3570],{63133:(e,t,r)=>{Promise.resolve().then(r.bind(r,92072))},82407:()=>{},92072:(e,t,r)=>{"use strict";r.d(t,{default:()=>h});var n=r(95155),s=r(12115),i=r(8422),a=class{activate(e){this._terminal=e}dispose(){}fit(){let e=this.proposeDimensions();if(!e||!this._terminal||isNaN(e.cols)||isNaN(e.rows))return;let t=this._terminal._core;(this._terminal.rows!==e.rows||this._terminal.cols!==e.cols)&&(t._renderService.clear(),this._terminal.resize(e.cols,e.rows))}proposeDimensions(){if(!this._terminal||!this._terminal.element||!this._terminal.element.parentElement)return;let e=this._terminal._core._renderService.dimensions;if(0===e.css.cell.width||0===e.css.cell.height)return;let t=0===this._terminal.options.scrollback?0:this._terminal.options.overviewRuler?.width||14,r=window.getComputedStyle(this._terminal.element.parentElement),n=parseInt(r.getPropertyValue("height")),s=Math.max(0,parseInt(r.getPropertyValue("width"))),i=window.getComputedStyle(this._terminal.element),a={top:parseInt(i.getPropertyValue("padding-top")),bottom:parseInt(i.getPropertyValue("padding-bottom")),right:parseInt(i.getPropertyValue("padding-right")),left:parseInt(i.getPropertyValue("padding-left"))},l=a.top+a.bottom;return{cols:Math.max(2,Math.floor((s-(a.right+a.left)-t)/e.css.cell.width)),rows:Math.max(1,Math.floor((n-l)/e.css.cell.height))}}},l=class{constructor(e,t,r,n={}){this._terminal=e,this._regex=t,this._handler=r,this._options=n}provideLinks(e,t){let r=o.computeLink(e,this._regex,this._terminal,this._handler);t(this._addCallbacks(r))}_addCallbacks(e){return e.map(e=>(e.leave=this._options.leave,e.hover=(t,r)=>{if(this._options.hover){let{range:n}=e;this._options.hover(t,r,n)}},e))}},o=class e{static computeLink(t,r,n,s){let i=RegExp(r.source,(r.flags||"")+"g"),[a,l]=e._getWindowedLineStrings(t-1,n),o=a.join(""),c,u=[];for(;c=i.exec(o);){let t=c[0];if(!function(e){try{let t=new URL(e),r=t.password&&t.username?`${t.protocol}//${t.username}:${t.password}@${t.host}`:t.username?`${t.protocol}//${t.username}@${t.host}`:`${t.protocol}//${t.host}`;return e.toLocaleLowerCase().startsWith(r.toLocaleLowerCase())}catch{return!1}}(t))continue;let[r,i]=e._mapStrIdx(n,l,0,c.index),[a,o]=e._mapStrIdx(n,r,i,t.length);if(-1===r||-1===i||-1===a||-1===o)continue;let d={start:{x:i+1,y:r+1},end:{x:o,y:a+1}};u.push({range:d,text:t,activate:s})}return u}static _getWindowedLineStrings(e,t){let r,n=e,s=e,i=0,a="",l=[];if(r=t.buffer.active.getLine(e)){let e=r.translateToString(!0);if(r.isWrapped&&" "!==e[0]){for(i=0;(r=t.buffer.active.getLine(--n))&&i<2048&&(i+=(a=r.translateToString(!0)).length,l.push(a),!(!r.isWrapped||-1!==a.indexOf(" "))););l.reverse()}for(l.push(e),i=0;(r=t.buffer.active.getLine(++s))&&r.isWrapped&&i<2048&&(i+=(a=r.translateToString(!0)).length,l.push(a),-1===a.indexOf(" ")););}return[l,n]}static _mapStrIdx(e,t,r,n){let s=e.buffer.active,i=s.getNullCell(),a=r;for(;n;){let e=s.getLine(t);if(!e)return[-1,-1];for(let r=a;r<e.length;++r){e.getCell(r,i);let a=i.getChars();if(i.getWidth()&&(n-=a.length||1,r===e.length-1&&""===a)){let e=s.getLine(t+1);e&&e.isWrapped&&(e.getCell(0,i),2===i.getWidth()&&(n+=1))}if(n<0)return[t,r]}t++,a=0}return[t,a]}},c=/(https?|HTTPS?):[/]{2}[^\s"'!*(){}|\\\^<>`]*[^\s"':,.!?{}|\\\^~\[\]`()<>]/;function u(e,t){let r=window.open();if(r){try{r.opener=null}catch{}r.location.href=t}else console.warn("Opening link blocked as opener could not be cleared")}var d=class{constructor(e=u,t={}){this._handler=e,this._options=t}activate(e){this._terminal=e;let t=this._options,r=t.urlRegex||c;this._linkProvider=this._terminal.registerLinkProvider(new l(this._terminal,r,this._handler,t))}dispose(){this._linkProvider?.dispose()}};function h(){let e=(0,s.useRef)(null),t=(0,s.useRef)(null),r=(0,s.useRef)(null),l=(0,s.useRef)(""),o=(0,s.useRef)(""),c=(0,s.useRef)(null),u=(0,s.useRef)([]),h=(0,s.useRef)(null),m=(0,s.useRef)(!1),p=(0,s.useRef)(""),[f,g]=(0,s.useState)("connecting"),[b,w]=(0,s.useState)("Starting shell…"),[x,y]=(0,s.useState)({shell:"",mode:""}),v=(0,s.useCallback)(async()=>{let e=l.current;if(!e||0===u.current.length)return;let r=u.current.join("");u.current=[];try{let n=await fetch(`/api/terminal/session/${e}/input`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({data:r}),cache:"no-store",credentials:"same-origin"});!n.ok&&t.current&&(403===n.status||401===n.status)&&t.current.write(`\r
-\x1b[31m[input blocked: ${n.status}]\x1b[0m\r
-`)}catch{}},[]),_=(0,s.useCallback)(e=>{e&&l.current&&(u.current.push(e),h.current||(h.current=setTimeout(()=>{h.current=null,v()},8)))},[v]),k=(0,s.useCallback)(e=>{let r=t.current;if(!r)return;let n=o.current;if(!("pipe"===n||!n))return void _(e);if("\x03"===e){p.current="",r.write("^C\r\n"),_("\x03\n");return}if("\r"===e||"\n"===e||"\r\n"===e){let e=p.current;p.current="",r.write("\r\n"),_(`${e}
-`);return}if(""===e||"\b"===e){p.current.length>0&&(p.current=p.current.slice(0,-1),r.write("\b \b"));return}32>e.charCodeAt(0)||e.startsWith("\x1b")||(p.current+=e,r.write(e))},[_]),C=(0,s.useCallback)(async()=>{let e=l.current,r=t.current;if(e&&r)try{await fetch(`/api/terminal/session/${e}/resize`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({cols:r.cols,rows:r.rows}),cache:"no-store",credentials:"same-origin"})}catch{}},[]),S=(0,s.useCallback)(()=>{try{t.current?.focus()}catch{}},[]),L=(0,s.useCallback)((e,t)=>{if(c.current)try{c.current.close()}catch{}let r=new EventSource(`/api/terminal/session/${e}/stream`,{withCredentials:!0});c.current=r,r.onopen=()=>{m.current||(g("ready"),w("Connected — click terminal & type"),S())},r.onmessage=e=>{let r;if(!m.current){try{r=JSON.parse(e.data)}catch{return}"data"===r.type&&"string"==typeof r.data?t.write(r.data):"ready"===r.type?(o.current=r.mode||o.current,y({shell:r.shell||"",mode:r.mode||""}),g(!1===r.alive?"closed":"ready"),w(!1===r.alive?"Shell exited":"Connected — click terminal & type"),S()):"exit"===r.type&&(g("closed"),w("Shell exited"),t.write("\r\n\x1b[90m[session ended]\x1b[0m\r\n"))}},r.onerror=()=>{m.current||(g(e=>"ready"===e?"connecting":e),w("Reconnecting…"))}},[S]),N=(0,s.useCallback)(async(e,t)=>{let r;g("connecting"),w("Starting shell…"),p.current="";try{t.fit()}catch{}let n=e.cols||120,s=e.rows||40;try{r=await fetch("/api/terminal/session",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({cols:n,rows:s}),cache:"no-store",credentials:"same-origin"})}catch(t){g("error"),w(t?.message||"Failed to reach server"),e.writeln(`\x1b[31mFailed to create session: ${t?.message||"network error"}\x1b[0m`);return}if(403===r.status){g("forbidden"),w("Localhost only"),e.writeln("\x1b[33mTerminal is restricted to localhost (security).\x1b[0m"),e.writeln("Open the dashboard on this machine (http://127.0.0.1:1997) to use the shell.");return}if(401===r.status){g("error"),w("Unauthorized"),e.writeln("\x1b[31mUnauthorized — log in to the dashboard first.\x1b[0m");return}let i=await r.json().catch(()=>({}));if(!r.ok||!i?.session?.id){g("error"),w(i?.error||"Create failed"),e.writeln(`\x1b[31m${i?.error||"Failed to create terminal session"}\x1b[0m`);return}l.current=i.session.id,o.current=i.session.mode||"pipe",y({shell:i.session.shell||"",mode:i.session.mode||""}),L(i.session.id,e),S()},[L,S]),E=(0,s.useCallback)(async()=>{let e=l.current;if(l.current="",o.current="",p.current="",u.current=[],c.current){try{c.current.close()}catch{}c.current=null}e&&fetch(`/api/terminal/session/${e}`,{method:"DELETE",credentials:"same-origin"}).catch(()=>{});let n=t.current,s=r.current;n&&s&&(n.reset(),n.clear(),await N(n,s))},[N]);return(0,s.useEffect)(()=>{m.current=!1;let n=e.current;if(!n)return;let s=new i.B({cursorBlink:!0,cursorStyle:"bar",fontSize:13,fontFamily:'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace',lineHeight:1.25,scrollback:5e3,allowProposedApi:!0,disableStdin:!1,theme:{background:"#0d0d0d",foreground:"#e8e8e8",cursor:"#E56A4A",cursorAccent:"#0d0d0d",selectionBackground:"rgba(229, 106, 74, 0.35)",black:"#1a1a1a",red:"#f87171",green:"#4ade80",yellow:"#fbbf24",blue:"#60a5fa",magenta:"#c084fc",cyan:"#22d3ee",white:"#e5e5e5",brightBlack:"#737373",brightRed:"#fca5a5",brightGreen:"#86efac",brightYellow:"#fde68a",brightBlue:"#93c5fd",brightMagenta:"#d8b4fe",brightCyan:"#67e8f9",brightWhite:"#fafafa"}}),o=new a,u=new d;s.loadAddon(o),s.loadAddon(u),s.open(n);try{n.tabIndex=0;let e=n.querySelector("textarea");e&&(e.tabIndex=0,e.setAttribute("autocomplete","off"),e.setAttribute("autocorrect","off"),e.setAttribute("autocapitalize","off"),e.setAttribute("spellcheck","false"))}catch{}t.current=s,r.current=o;try{o.fit()}catch{}let p=s.onData(e=>k(e)),f=()=>{try{o.fit(),C()}catch{}},g=()=>S();n.addEventListener("mousedown",g),n.addEventListener("click",g),n.addEventListener("focus",S);let b="u">typeof ResizeObserver?new ResizeObserver(f):null;return b?.observe(n),window.addEventListener("resize",f),requestAnimationFrame(()=>{try{o.fit()}catch{}S()}),N(s,o),()=>{m.current=!0,b?.disconnect(),window.removeEventListener("resize",f),n.removeEventListener("mousedown",g),n.removeEventListener("click",g),n.removeEventListener("focus",S);try{p.dispose()}catch{}if(h.current&&(clearTimeout(h.current),h.current=null),c.current){try{c.current.close()}catch{}c.current=null}let e=l.current;l.current="",e&&fetch(`/api/terminal/session/${e}`,{method:"DELETE",keepalive:!0,credentials:"same-origin"}).catch(()=>{});try{s.dispose()}catch{}t.current=null,r.current=null}},[k,C,N,S]),(0,n.jsxs)("div",{className:"flex h-full min-h-0 w-full flex-col bg-[#0d0d0d]",children:[(0,n.jsxs)("div",{className:"flex shrink-0 items-center justify-between gap-3 border-b border-white/10 px-4 py-2.5",children:[(0,n.jsxs)("div",{className:"flex min-w-0 items-center gap-3",children:[(0,n.jsxs)("div",{className:"flex items-center gap-2",children:[(0,n.jsx)("span",{className:`inline-block size-2 rounded-full ${"ready"===f?"bg-emerald-500":"connecting"===f?"bg-amber-400 animate-pulse":"forbidden"===f?"bg-amber-500":"bg-red-500"}`}),(0,n.jsx)("span",{className:"text-sm font-semibold text-white/90",children:"Terminal"})]}),(0,n.jsxs)("span",{className:"truncate text-xs text-white/45",children:[b,x.shell?` \xb7 ${x.shell}`:"",x.mode?` \xb7 ${x.mode}`:""]})]}),(0,n.jsx)("div",{className:"flex items-center gap-2",children:(0,n.jsx)("button",{type:"button",onClick:E,className:"rounded-lg border border-white/10 bg-white/5 px-3 py-1.5 text-xs font-medium text-white/80 transition hover:border-[color:var(--brand,#E56A4A)]/50 hover:bg-white/10 hover:text-white",children:"New session"})})]}),(0,n.jsx)("div",{className:"relative min-h-0 flex-1",onMouseDown:S,children:(0,n.jsx)("div",{ref:e,className:"absolute inset-0 px-2 py-2 outline-none"})}),(0,n.jsx)("div",{className:"shrink-0 border-t border-white/10 px-4 py-1.5 text-[11px] text-white/35",children:"Localhost only \xb7 click the black area then type \xb7 idle sessions close after 30m"})]})}r(82407)}},e=>{e.O(0,[1838,1507,8441,3794,7358],()=>e(e.s=63133)),_N_E=e.O()}]);

package/cli/app/.next-cli-build/static/chunks/app/_global-error/page-36eea29d57f959c4.js DELETED Viewed

@@ -1 +0,0 @@

- (self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[39,122,174,204,335,342,387,501,516,543,552,641,649,675,742,747,748,869,907,931,948,992,997,1077,1088,1091,1110,1118,1200,1288,1321,1337,1382,1446,1451,1512,1557,1566,1659,1666,1674,1697,1747,1860,1898,1907,1910,1946,1949,2121,2154,2198,2284,2296,2366,2536,2757,2772,2785,2795,2797,2833,2845,2919,2922,3025,3038,3078,3079,3295,3397,3399,3472,3549,3562,3568,3648,3705,3883,3888,4010,4061,4093,4245,4286,4422,4444,4527,4612,4656,4674,4761,4829,4896,4993,5018,5107,5162,5177,5211,5226,5460,5466,5637,5685,5745,5746,5805,5922,5990,6089,6091,6102,6107,6121,6268,6278,6319,6454,6463,6479,6529,6580,6594,6644,6664,6724,6740,6743,6819,6872,6919,6988,7046,7111,7131,7158,7241,7254,7306,7311,7423,7429,7445,7473,7508,7520,7758,7777,7824,7851,7858,8018,8026,8057,8141,8165,8167,8207,8246,8264,8338,8453,8489,8573,8648,8736,8791,8814,8826,8870,8879,8918,8948,8974,8975,9027,9056,9069,9088,9120,9123,9141,9199,9321,9338,9359,9461,9515,9606,9678,9709,9762,9817,9903],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/cli/app/.next-cli-build/static/chunks/app/api/auth/login/route-36eea29d57f959c4.js DELETED Viewed

@@ -1 +0,0 @@