zevairouter 1.0.51 → 1.0.53

package/src/dashboardGuard.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getSettings, validateApiKey } from "@/lib/localDb";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { verifyDashboardAuthToken } from "@/lib/auth/dashboardSession";
+import { verifyTerminalUnlockToken } from "@/lib/auth/terminalSession";
 
 const CLI_TOKEN_HEADER = "x-zevai-cli-token";
 const CLI_TOKEN_SALT = "zevai-cli-auth";
@@ -91,8 +92,8 @@ const LOCAL_ONLY_PATHS = [
   "/api/pxpipe/start",
   "/api/pxpipe/stop",
   "/api/pxpipe/restart",
-  // Web shell: full host shell access — never expose over tunnel/remote.
-  "/api/terminal",
+  // Terminal shell is NOT local-only: protected by dashboard auth + secondary
+  // terminal password (and ALWAYS_PROTECTED). Users may open it over tunnel.
 ];
 
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
@@ -189,9 +190,37 @@ export async function proxy(request) {
 
   // Always protected - require valid JWT or local CLI token (machineId-based)
   if (ALWAYS_PROTECTED.some((p) => pathname.startsWith(p))) {
-    if (await hasValidCliToken(request) || await hasValidToken(request))
-      return NextResponse.next();
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const isTerminalApi = pathname.startsWith("/api/terminal");
+    // Terminal allows requireLogin=false path (still needs secondary terminal password).
+    const dashboardOk =
+      (await hasValidCliToken(request))
+      || (await hasValidToken(request))
+      || (isTerminalApi && (await isAuthenticated(request)));
+
+    if (!dashboardOk) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    // Web shell needs a second password unlock (dashboard session alone is not enough).
+    // Auth endpoints (status/setup/unlock) stay open so the lock screen can work.
+    // CLI machine token may bypass (local automation), not remote browsers.
+    if (
+      isTerminalApi
+      && !pathname.startsWith("/api/terminal/auth")
+      && !(await hasValidCliToken(request))
+    ) {
+      const terminalOk = await verifyTerminalUnlockToken(
+        request.cookies.get("terminal_token")?.value
+      );
+      if (!terminalOk) {
+        return NextResponse.json(
+          { error: "Terminal unlock required", code: "TERMINAL_LOCKED" },
+          { status: 423 }
+        );
+      }
+    }
+
+    return NextResponse.next();
   }
 
   if (isPublicLlmApi(pathname)) {

package/src/lib/auth/terminalSession.js

@@ -0,0 +1,62 @@
+import { SignJWT, jwtVerify } from "jose";
+import { shouldUseSecureCookie } from "@/lib/auth/dashboardSession";
+
+// Same secret loader pattern as dashboard — import via dynamic to share SECRET
+// We re-use createDashboardAuthToken's secret by verifying with the same module path.
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { DATA_DIR } from "@/lib/dataDir";
+
+function loadJwtSecret() {
+  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
+  const file = path.join(DATA_DIR, "jwt-secret");
+  try {
+    return fs.readFileSync(file, "utf8").trim();
+  } catch {}
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const generated = crypto.randomBytes(32).toString("hex");
+  fs.writeFileSync(file, generated, { mode: 0o600 });
+  return generated;
+}
+
+const SECRET = new TextEncoder().encode(loadJwtSecret());
+const COOKIE_NAME = "terminal_token";
+const TTL = "4h";
+
+export function getTerminalCookieName() {
+  return COOKIE_NAME;
+}
+
+export async function createTerminalUnlockToken() {
+  return new SignJWT({ terminal: true, scope: "web-shell" })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime(TTL)
+    .sign(SECRET);
+}
+
+export async function verifyTerminalUnlockToken(token) {
+  if (!token) return false;
+  try {
+    const { payload } = await jwtVerify(token, SECRET);
+    return payload?.terminal === true && payload?.scope === "web-shell";
+  } catch {
+    return false;
+  }
+}
+
+export async function setTerminalUnlockCookie(cookieStore, request) {
+  const token = await createTerminalUnlockToken();
+  cookieStore.set(COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: shouldUseSecureCookie(request),
+    sameSite: "lax",
+    path: "/",
+    maxAge: 4 * 60 * 60,
+  });
+}
+
+export function clearTerminalUnlockCookie(cookieStore) {
+  cookieStore.delete(COOKIE_NAME);
+}

package/src/shared/components/Header.js

@@ -121,7 +121,7 @@ const getPageInfo = (pathname) => {
   if (pathname.includes("/terminal"))
     return {
       title: "Terminal",
-      description: "Localhost web shell on this machine",
+      description: "Host web shell — requires a second password",
       icon: "terminal",
       breadcrumbs: [],
     };

package/cli/app/.next-cli-build/static/KQ64jZ4j5lNOTZstAI3zB/_buildManifest.js

@@ -1 +0,0 @@
-self.__BUILD_MANIFEST=function(e,s,t){return{__rewrites:{afterFiles:[{has:e,source:"/v1/v1/:path*",destination:s},{has:e,source:"/v1/v1",destination:t},{has:e,source:"/codex/:path*",destination:"/api/v1/responses"},{has:e,source:"/v1/:path*",destination:s},{has:e,source:"/v1",destination:t}],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:175,errorRate:1e-4,numBits:3355,numHashes:14,bitArray:[0,1,0,0,1,0,0,0,1,0,1,1,0,0,1,1,1,0,0,1,1,1,1,0,0,0,1,1,1,0,0,1,0,1,0,0,1,1,0,1,1,1,1,1,1,1,0,1,1,0,1,1,0,1,0,1,0,1,1,0,1,1,0,1,1,0,0,1,0,0,1,1,0,0,1,0,1,0,1,1,0,0,1,0,0,0,0,1,1,1,0,1,1,1,1,1,0,1,1,1,1,0,0,1,0,1,0,1,0,0,0,1,1,1,0,0,1,0,1,1,1,1,1,1,1,1,0,0,1,0,0,1,1,0,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,1,0,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,1,1,0,0,0,1,0,0,1,1,0,1,1,1,1,1,1,0,1,0,1,0,1,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,0,1,0,0,1,0,1,0,0,0,0,1,0,0,1,1,1,0,1,1,1,0,1,1,0,1,1,1,1,0,0,1,0,1,0,0,1,0,1,0,0,0,1,0,1,1,0,0,1,1,1,0,1,0,0,0,1,1,0,0,1,0,0,1,1,0,0,1,0,0,1,1,1,0,1,0,0,1,1,1,1,0,0,1,1,0,1,1,1,0,1,0,1,1,1,1,1,1,1,1,0,1,1,1,0,1,0,1,0,0,0,1,0,1,0,1,1,1,0,1,0,0,1,1,1,0,1,1,1,1,0,1,0,0,0,1,0,0,1,1,1,0,0,0,0,0,0,1,0,0,0,0,0,1,1,1,0,0,1,1,0,0,1,1,1,1,1,0,1,0,0,1,1,1,0,1,1,0,0,0,0,0,1,0,0,0,0,1,0,0,1,1,1,1,1,0,0,0,0,1,0,1,0,0,1,1,1,1,1,0,0,1,1,0,1,0,1,1,0,1,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,0,0,0,1,1,0,0,0,1,1,0,0,0,0,1,1,1,1,1,1,1,1,1,0,1,1,1,1,1,0,0,1,0,1,0,0,0,0,1,1,1,1,0,1,0,0,1,1,0,1,1,0,1,0,1,1,1,1,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,1,0,0,0,1,0,0,1,0,1,1,1,1,1,1,0,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,1,0,1,1,0,0,0,0,1,0,1,0,1,0,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,1,0,1,1,1,0,0,0,0,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,0,1,1,0,0,1,0,0,1,1,0,0,1,1,1,1,0,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,1,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,1,1,1,0,0,1,1,0,0,0,0,1,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,0,0,0,1,0,0,1,1,0,1,1,0,0,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,0,0,0,0,0,1,1,1,0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,1,0,1,0,0,1,0,1,1,1,0,1,0,1,0,0,1,1,1,0,0,1,1,0,0,1,0,1,0,0,1,0,0,1,1,0,1,0,1,1,1,1,0,1,0,1,1,0,1,1,1,1,1,1,1,0,0,1,1,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,1,1,1,1,1,0,1,1,1,1,1,1,1,1,0,1,0,0,1,0,1,1,1,1,0,1,1,1,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,1,0,0,0,0,1,1,0,1,1,0,0,1,1,1,0,1,1,0,1,1,1,0,0,1,0,0,0,1,0,1,1,1,1,1,0,1,0,1,0,0,1,0,0,1,1,1,0,1,0,1,1,1,1,0,0,1,0,0,0,1,1,1,0,1,1,1,1,1,0,0,1,1,0,0,0,1,1,0,0,0,0,1,1,1,0,1,1,1,1,0,1,0,1,0,1,1,0,1,1,0,0,0,1,1,0,1,1,1,1,0,1,1,1,1,0,1,0,0,1,0,1,0,0,1,0,1,1,1,0,0,0,1,1,0,1,0,0,0,0,0,1,0,1,0,0,0,0,0,0,1,0,1,1,1,0,1,1,0,1,0,0,1,1,1,1,0,1,1,0,1,0,0,1,0,0,1,1,0,1,1,0,1,1,0,1,0,1,0,1,0,0,0,1,0,0,1,1,1,0,1,0,1,1,1,1,0,0,0,0,0,0,0,1,0,0,0,0,1,1,0,0,1,1,1,1,0,0,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,0,0,0,1,1,1,1,1,0,1,0,0,1,0,0,0,1,1,0,1,0,1,0,0,0,0,1,0,0,1,1,0,0,1,0,0,1,1,1,0,0,0,1,1,1,1,0,0,1,1,0,1,1,1,0,0,1,1,1,0,1,1,1,0,0,0,0,0,1,0,0,1,0,1,0,1,0,0,0,0,0,0,0,1,0,1,1,0,1,1,1,1,1,0,0,0,1,1,0,1,1,0,1,1,0,1,1,0,0,0,0,0,0,1,0,1,1,1,0,0,1,0,0,1,0,1,1,0,1,0,0,0,1,0,1,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,0,1,1,0,1,0,0,1,0,0,1,0,1,1,0,1,0,0,1,0,0,1,1,1,0,1,1,1,0,1,1,0,1,1,0,1,1,1,1,0,1,0,1,1,0,0,1,1,1,0,0,0,0,0,0,1,1,1,1,0,0,1,0,1,0,1,0,1,0,0,1,1,1,0,1,0,0,1,0,0,0,1,0,0,0,0,1,0,1,1,1,1,1,0,0,1,0,0,0,1,1,1,0,1,1,1,1,0,0,1,0,0,1,1,0,0,0,0,1,0,1,1,1,0,1,1,1,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,0,1,1,1,0,1,1,0,0,1,0,0,1,0,1,0,1,0,1,0,1,1,1,1,1,0,0,1,1,0,1,0,1,0,0,0,1,0,0,1,1,0,1,1,1,0,1,0,1,1,1,1,0,1,0,0,1,1,1,0,0,0,0,1,1,0,0,1,1,0,0,1,1,1,0,1,1,0,1,1,0,0,1,0,1,1,1,0,0,0,0,1,1,0,0,0,1,0,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,1,0,0,0,0,1,0,0,1,0,1,1,0,0,0,0,1,0,1,1,0,0,1,0,1,1,0,0,0,0,0,0,0,1,1,0,0,0,1,0,1,0,1,0,1,0,0,1,1,0,1,0,1,1,1,0,0,1,0,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,0,1,1,1,1,1,1,1,0,0,0,0,1,0,0,1,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0,1,0,0,0,1,0,0,0,1,1,1,1,0,1,1,1,1,0,1,0,0,0,1,0,1,1,0,0,1,1,1,0,0,0,0,0,0,1,0,1,0,1,1,0,1,1,0,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,0,0,1,1,1,0,1,1,1,1,1,1,1,0,0,1,1,0,1,1,1,0,1,1,0,1,1,1,0,0,0,1,1,1,1,0,0,0,1,1,0,0,1,0,0,0,0,1,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,1,1,0,1,0,1,0,1,1,0,0,1,0,0,1,0,0,0,1,0,1,1,0,0,1,1,0,1,1,0,1,0,0,1,1,1,1,0,0,0,1,1,0,1,1,0,0,1,0,0,0,1,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,1,0,1,0,0,0,0,1,0,1,1,1,1,0,0,1,0,1,0,1,1,1,1,1,0,1,0,1,0,1,1,0,1,1,0,1,0,1,1,1,0,0,0,1,0,0,0,1,0,0,1,1,0,1,0,1,1,1,1,0,1,0,1,0,0,1,1,0,1,1,1,0,0,0,0,0,1,0,1,0,0,0,1,1,0,0,0,1,1,0,1,0,0,1,1,0,1,1,1,1,0,0,0,1,1,0,0,1,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,1,1,0,0,0,1,1,0,1,0,1,1,1,1,0,1,1,0,0,1,0,0,1,1,1,0,1,1,1,1,0,1,1,0,0,1,0,1,0,1,1,0,1,0,0,0,1,1,0,0,1,1,1,1,0,1,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,1,0,1,1,0,0,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,0,0,0,1,1,1,1,1,0,0,0,0,1,0,1,1,1,1,1,0,0,1,1,0,1,0,1,1,1,1,1,1,0,0,1,0,1,1,0,0,1,1,0,1,1,1,1,0,0,0,1,0,1,1,1,1,0,1,1,1,0,0,1,0,0,1,0,0,1,1,1,0,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,0,0,1,1,0,1,0,1,0,0,1,1,0,0,0,0,0,0,1,0,0,1,0,1,1,1,1,0,0,1,0,0,0,1,1,0,1,1,1,1,1,0,1,1,0,1,1,1,1,0,0,1,0,0,0,1,0,1,0,1,0,0,0,1,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,1,1,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,1,0,1,0,0,0,1,1,1,0,1,1,1,0,0,1,1,1,0,1,0,1,1,1,1,1,0,0,1,0,1,0,1,0,0,0,1,1,1,1,0,1,1,0,0,1,1,0,0,1,1,0,1,1,1,0,0,0,0,1,1,1,0,1,1,1,0,0,0,0,1,0,1,1,0,1,0,1,0,0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,0,1,0,1,1,1,0,0,0,1,0,0,1,0,0,0,0,1,1,1,1,1,1,1,0,0,1,0,0,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1,1,1,0,0,0,1,1,0,0,0,0,1,1,0,0,1,1,0,0,1,0,0,1,1,0,0,1,0,1,0,0,1,0,1,1,0,0,1,0,1,1,0,0,1,0,0,1,0,0,1,0,1,1,0,0,1,1,0,0,0,0,0,0,0,1,1,0,1,0,0,1,1,0,0,0,1,1,1,0,1,0,1,0,1,0,0,1,0,0,1,0,0,0,0,1,1,0,1,1,0,1,0,0,0,0,1,0,0,0,1,1,1,1,0,0,1,1,0,1,1,0,0,0,0,1,0,0,0,0,0,0,1,1,0,0,1,0,1,0,0,0,1,0,1,1,0,1,0,1,1,0,1,1,1,0,0,1,1,0,1,1,1,1,0,0,0,1,1,1,0,0,0,1,0,1,1,0,1,0,1,1,0,0,1,0,1,0,0,0,0,1,1,1,0,0,1,1,1,1,1,1,1,0,0,0,0,0,0,1,1,1,0,1,0,0,1,0,1,1,1,0,0,0,1,1,0,0,0,0,1,0,1,0,1,1,0,0,0,0,0,1,1,0,0,0,0,0,1,0,1,1,0,0,1,0,0,1,0,0,0,0,0,1,1,1,1,1,1,1,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,1,1,0,1,1,0,1,1,1,1,0,0,1,0,0,1,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,1,1,0,1,1,1,1,0,1,0,0,0,0,1,1,0,1,1,1,1,1,1,0,0,0,0,0,1,0,0,1,0,1,1,1,0,0,1,0,0,0,0,1,0,0,1,1,1,0,1,1,0,1,1,1,0,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,1,1,1,1,0,1,1,0,0,1,1,1,0,0,0,1,0,0,0,1,0,1,1,1,1,1,1,1,1,1,0,1,0,1,1,0,0,1,1,0,1,0,0,1,1,0,0,0,1,0,1,1,1,0,0,0,0,1,1,1,0,0,1,1,1,1,1,0,0,0,0,1,1,0,1,1,1,1,0,1,1,1,1,1,1,0,1,1,0,0,0,0,1,1,0,0,0,1,0,1,0,0,1,1,0,0,0,0,1,1,1,0,0,0,1,0,0,1,1,1,0,0,1,0,0,0,0,1,0,0,0,1,1,0,1,0,1,1,0,1,1,0,0,1,0,1,0,1,0,1,0,0,0,0,1,0,1,1,0,0,1,1,1,1,0,0,1,1,1,1,0,0,0,0,1,0,0,0,0,0,1,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,0,0,1,0,0,1,1,1,1,1,0,1,1,0,1,1,1,1,0,1,1,0,1,0,1,0,1,1,0,1,0,0,1,1,0,1,1,1,0,1,1,1,0,0,0,1,1,0,0,1,1,0,1,1,1,1,0,0,0,0,1,1,0,0,1,1,0,1,1,0,1,0,1,0,0,1,1,1,0,0,0,0,0,0,0,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,0,1,0,1,1,1,0,1,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,1,0,1,1,0,0,0,1,1,1,0,1,0,0,1,0,1,0,0,0,1,0,0,1,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,1,0,1,1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,1,1,1,0,0,1,0,0,1,0,1,0,1,1,1,1,0,1,1,1,1,1,1,0,1,0,1,0,1,0,1,1,0,0,1,1,0,1,0,0,1,0,0,0,0,1,1,1,0,0,0,1,0,1,0,0,0,0,1,0,1,0,1,1,1,0,1,0,0,0,0,0,0,1,1,0,1,1,1,0,0,1,1,1,1,0,1,0,1,0,1,1,1,1,0,1,0,0,1,0,0,0,1,1,0,0,1,1,0,0,0,0,1,0,1,0,1,1,1,0,1,1,0,0,0,0,0,1,0,0,0,0,1,1]},__routerFilterDynamic:{numItems:24,errorRate:1e-4,numBits:461,numHashes:14,bitArray:[1,1,0,0,1,0,0,1,0,1,0,1,0,1,0,1,0,0,0,1,1,0,0,1,1,1,1,1,0,1,0,0,1,1,0,1,0,0,0,0,1,1,1,1,0,0,0,1,0,0,1,1,1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,1,0,0,0,1,0,1,1,0,1,1,1,1,1,0,0,1,0,0,1,1,0,0,0,0,1,0,1,0,1,1,1,1,1,1,1,0,0,1,0,0,1,1,0,1,0,0,0,0,1,1,0,0,1,1,0,1,1,1,0,1,1,0,1,0,0,0,0,1,0,1,0,0,1,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,0,0,0,0,1,0,0,0,1,0,0,1,1,1,1,1,1,0,0,1,1,1,0,1,0,0,0,1,0,1,0,0,1,0,0,1,1,1,1,1,0,0,1,0,0,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,0,0,0,1,1,1,1,0,0,1,0,0,0,1,1,1,1,1,0,1,0,0,0,0,0,0,0,0,1,1,0,1,0,0,0,1,0,0,0,1,1,1,0,0,1,0,1,1,1,1,0,1,0,1,1,1,1,0,0,1,1,0,0,0,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,0,1,1,1,0,0,0,0,1,1,1,0,0,1,1,1,1,1,0,0,1,1,1,0,0,0,1,1,1,1,1,1,1,0,0,1,0,0,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,1,1,0,1,1,1,1,1,0,0,1,1,1,0,1,1,1,0,0,1,0,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,1,1,0,1,1,1,0,1,1,1,1,1,1,0,0,0,1,1,1,1,1,1,1,1,0,0,1,0,1,1,0,0,0,1,0,1,1,0,1,1,1,0,0,1,1,0,0,0,1,1,0,1,1,1]},sortedPages:["/_app"]}}(void 0,"/api/v1/:path*","/api/v1"),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();