zevairouter 1.0.52 → 1.0.53

package/cli/app/.next-cli-build/static/chunks/app/(dashboard)/dashboard/terminal/page-72854e35a9d5f79d.js

@@ -0,0 +1,4 @@
+(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[3570],{63133:(e,t,r)=>{Promise.resolve().then(r.bind(r,92072))},82407:()=>{},92072:(e,t,r)=>{"use strict";r.d(t,{default:()=>h});var n=r(95155),s=r(12115),a=r(8422),i=class{activate(e){this._terminal=e}dispose(){}fit(){let e=this.proposeDimensions();if(!e||!this._terminal||isNaN(e.cols)||isNaN(e.rows))return;let t=this._terminal._core;(this._terminal.rows!==e.rows||this._terminal.cols!==e.cols)&&(t._renderService.clear(),this._terminal.resize(e.cols,e.rows))}proposeDimensions(){if(!this._terminal||!this._terminal.element||!this._terminal.element.parentElement)return;let e=this._terminal._core._renderService.dimensions;if(0===e.css.cell.width||0===e.css.cell.height)return;let t=0===this._terminal.options.scrollback?0:this._terminal.options.overviewRuler?.width||14,r=window.getComputedStyle(this._terminal.element.parentElement),n=parseInt(r.getPropertyValue("height")),s=Math.max(0,parseInt(r.getPropertyValue("width"))),a=window.getComputedStyle(this._terminal.element),i={top:parseInt(a.getPropertyValue("padding-top")),bottom:parseInt(a.getPropertyValue("padding-bottom")),right:parseInt(a.getPropertyValue("padding-right")),left:parseInt(a.getPropertyValue("padding-left"))},l=i.top+i.bottom;return{cols:Math.max(2,Math.floor((s-(i.right+i.left)-t)/e.css.cell.width)),rows:Math.max(1,Math.floor((n-l)/e.css.cell.height))}}},l=class{constructor(e,t,r,n={}){this._terminal=e,this._regex=t,this._handler=r,this._options=n}provideLinks(e,t){let r=o.computeLink(e,this._regex,this._terminal,this._handler);t(this._addCallbacks(r))}_addCallbacks(e){return e.map(e=>(e.leave=this._options.leave,e.hover=(t,r)=>{if(this._options.hover){let{range:n}=e;this._options.hover(t,r,n)}},e))}},o=class e{static computeLink(t,r,n,s){let a=RegExp(r.source,(r.flags||"")+"g"),[i,l]=e._getWindowedLineStrings(t-1,n),o=i.join(""),c,d=[];for(;c=a.exec(o);){let t=c[0];if(!function(e){try{let t=new URL(e),r=t.password&&t.username?`${t.protocol}//${t.username}:${t.password}@${t.host}`:t.username?`${t.protocol}//${t.username}@${t.host}`:`${t.protocol}//${t.host}`;return e.toLocaleLowerCase().startsWith(r.toLocaleLowerCase())}catch{return!1}}(t))continue;let[r,a]=e._mapStrIdx(n,l,0,c.index),[i,o]=e._mapStrIdx(n,r,a,t.length);if(-1===r||-1===a||-1===i||-1===o)continue;let u={start:{x:a+1,y:r+1},end:{x:o,y:i+1}};d.push({range:u,text:t,activate:s})}return d}static _getWindowedLineStrings(e,t){let r,n=e,s=e,a=0,i="",l=[];if(r=t.buffer.active.getLine(e)){let e=r.translateToString(!0);if(r.isWrapped&&" "!==e[0]){for(a=0;(r=t.buffer.active.getLine(--n))&&a<2048&&(a+=(i=r.translateToString(!0)).length,l.push(i),!(!r.isWrapped||-1!==i.indexOf(" "))););l.reverse()}for(l.push(e),a=0;(r=t.buffer.active.getLine(++s))&&r.isWrapped&&a<2048&&(a+=(i=r.translateToString(!0)).length,l.push(i),-1===i.indexOf(" ")););}return[l,n]}static _mapStrIdx(e,t,r,n){let s=e.buffer.active,a=s.getNullCell(),i=r;for(;n;){let e=s.getLine(t);if(!e)return[-1,-1];for(let r=i;r<e.length;++r){e.getCell(r,a);let i=a.getChars();if(a.getWidth()&&(n-=i.length||1,r===e.length-1&&""===i)){let e=s.getLine(t+1);e&&e.isWrapped&&(e.getCell(0,a),2===a.getWidth()&&(n+=1))}if(n<0)return[t,r]}t++,i=0}return[t,i]}},c=/(https?|HTTPS?):[/]{2}[^\s"'!*(){}|\\\^<>`]*[^\s"':,.!?{}|\\\^~\[\]`()<>]/;function d(e,t){let r=window.open();if(r){try{r.opener=null}catch{}r.location.href=t}else console.warn("Opening link blocked as opener could not be cleared")}var u=class{constructor(e=d,t={}){this._handler=e,this._options=t}activate(e){this._terminal=e;let t=this._options,r=t.urlRegex||c;this._linkProvider=this._terminal.registerLinkProvider(new l(this._terminal,r,this._handler,t))}dispose(){this._linkProvider?.dispose()}};function h(){let e=(0,s.useRef)(null),t=(0,s.useRef)(null),r=(0,s.useRef)(null),l=(0,s.useRef)(""),o=(0,s.useRef)(""),c=(0,s.useRef)(null),d=(0,s.useRef)([]),h=(0,s.useRef)(null),m=(0,s.useRef)(!1),p=(0,s.useRef)(""),[f,b]=(0,s.useState)("checking"),[x,g]=(0,s.useState)(""),[w,y]=(0,s.useState)(!1),[v,k]=(0,s.useState)(""),[j,N]=(0,s.useState)(""),[_,S]=(0,s.useState)(""),[C,E]=(0,s.useState)("connecting"),[L,A]=(0,s.useState)("Starting shell…"),[T,$]=(0,s.useState)({shell:"",mode:""}),P=(0,s.useCallback)(async()=>{g("");try{let e=await fetch("/api/terminal/auth/status",{cache:"no-store",credentials:"same-origin"}),t=await e.json().catch(()=>({}));if(403===e.status){g(t?.error||"Access forbidden."),b("unlock");return}if(401===e.status){g("Log in to the dashboard first."),b("unlock");return}if(!t.configured)return void b("setup");if(t.unlocked)return void b("open");b("unlock")}catch(e){g(e?.message||"Failed to check terminal lock"),b("unlock")}},[]);(0,s.useEffect)(()=>{P()},[P]);let R=async e=>{e.preventDefault(),y(!0),g("");try{let e=await fetch("/api/terminal/auth/setup",{method:"POST",headers:{"Content-Type":"application/json"},credentials:"same-origin",body:JSON.stringify({password:v,confirm:j,currentTerminalPassword:_||void 0})}),t=await e.json().catch(()=>({}));if(!e.ok)return void g(t.error||"Setup failed");k(""),N(""),S(""),b("open")}catch(e){g(e?.message||"Setup failed")}finally{y(!1)}},O=async e=>{e.preventDefault(),y(!0),g("");try{let e=await fetch("/api/terminal/auth/unlock",{method:"POST",headers:{"Content-Type":"application/json"},credentials:"same-origin",body:JSON.stringify({password:v})}),t=await e.json().catch(()=>({}));if(!e.ok)return void g(t.error||"Unlock failed");k(""),b("open")}catch(e){g(e?.message||"Unlock failed")}finally{y(!1)}},M=async()=>{try{await fetch("/api/terminal/auth/unlock",{method:"DELETE",credentials:"same-origin"})}catch{}let e=l.current;if(l.current="",e&&fetch(`/api/terminal/session/${e}`,{method:"DELETE",credentials:"same-origin",keepalive:!0}).catch(()=>{}),c.current){try{c.current.close()}catch{}c.current=null}k(""),b("unlock")},D=(0,s.useCallback)(async()=>{let e=l.current;if(!e||0===d.current.length)return;let r=d.current.join("");d.current=[];try{let n=await fetch(`/api/terminal/session/${e}/input`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({data:r}),cache:"no-store",credentials:"same-origin"});!n.ok&&t.current&&(423===n.status?(t.current.write("\r\n\x1b[31m[terminal locked]\x1b[0m\r\n"),b("unlock")):(403===n.status||401===n.status)&&t.current.write(`\r
+\x1b[31m[input blocked: ${n.status}]\x1b[0m\r
+`))}catch{}},[]),z=(0,s.useCallback)(e=>{e&&l.current&&(d.current.push(e),h.current||(h.current=setTimeout(()=>{h.current=null,D()},8)))},[D]),F=(0,s.useCallback)(e=>{let r=t.current;if(!r)return;let n=o.current;if(!("pipe"===n||!n))return void z(e);if("\x03"===e){p.current="",r.write("^C\r\n"),z("\x03\n");return}if("\r"===e||"\n"===e||"\r\n"===e){let e=p.current;p.current="",r.write("\r\n"),z(`${e}
+`);return}if(""===e||"\b"===e){p.current.length>0&&(p.current=p.current.slice(0,-1),r.write("\b \b"));return}32>e.charCodeAt(0)||e.startsWith("\x1b")||(p.current+=e,r.write(e))},[z]),I=(0,s.useCallback)(async()=>{let e=l.current,r=t.current;if(e&&r)try{await fetch(`/api/terminal/session/${e}/resize`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({cols:r.cols,rows:r.rows}),cache:"no-store",credentials:"same-origin"})}catch{}},[]),W=(0,s.useCallback)(()=>{try{t.current?.focus()}catch{}},[]),U=(0,s.useCallback)((e,t)=>{if(c.current)try{c.current.close()}catch{}let r=new EventSource(`/api/terminal/session/${e}/stream`,{withCredentials:!0});c.current=r,r.onopen=()=>{m.current||(E("ready"),A("Connected — click terminal & type"),W())},r.onmessage=e=>{let r;if(!m.current){try{r=JSON.parse(e.data)}catch{return}"data"===r.type&&"string"==typeof r.data?t.write(r.data):"ready"===r.type?(o.current=r.mode||o.current,$({shell:r.shell||"",mode:r.mode||""}),E(!1===r.alive?"closed":"ready"),A(!1===r.alive?"Shell exited":"Connected — click terminal & type"),W()):"exit"===r.type&&(E("closed"),A("Shell exited"),t.write("\r\n\x1b[90m[session ended]\x1b[0m\r\n"))}},r.onerror=()=>{m.current||(E(e=>"ready"===e?"connecting":e),A("Reconnecting…"))}},[W]),q=(0,s.useCallback)(async(e,t)=>{let r;E("connecting"),A("Starting shell…"),p.current="";try{t.fit()}catch{}let n=e.cols||120,s=e.rows||40;try{r=await fetch("/api/terminal/session",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({cols:n,rows:s}),cache:"no-store",credentials:"same-origin"})}catch(t){E("error"),A(t?.message||"Failed to reach server"),e.writeln(`\x1b[31mFailed to create session: ${t?.message||"network error"}\x1b[0m`);return}if(403===r.status){E("forbidden"),A("Forbidden"),e.writeln("\x1b[33mTerminal access forbidden.\x1b[0m");return}if(401===r.status){E("error"),A("Unauthorized"),e.writeln("\x1b[31mUnauthorized — log in to the dashboard first.\x1b[0m");return}if(423===r.status){E("error"),A("Locked"),b("unlock");return}let a=await r.json().catch(()=>({}));if(!r.ok||!a?.session?.id){E("error"),A(a?.error||"Create failed"),e.writeln(`\x1b[31m${a?.error||"Failed to create terminal session"}\x1b[0m`);return}l.current=a.session.id,o.current=a.session.mode||"pipe",$({shell:a.session.shell||"",mode:a.session.mode||""}),U(a.session.id,e),W()},[U,W]),J=(0,s.useCallback)(async()=>{let e=l.current;if(l.current="",o.current="",p.current="",d.current=[],c.current){try{c.current.close()}catch{}c.current=null}e&&fetch(`/api/terminal/session/${e}`,{method:"DELETE",credentials:"same-origin"}).catch(()=>{});let n=t.current,s=r.current;n&&s&&(n.reset(),n.clear(),await q(n,s))},[q]);if((0,s.useEffect)(()=>{if("open"!==f)return;m.current=!1;let n=e.current;if(!n)return;let s=new a.B({cursorBlink:!0,cursorStyle:"bar",fontSize:13,fontFamily:'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace',lineHeight:1.25,scrollback:5e3,allowProposedApi:!0,disableStdin:!1,theme:{background:"#0d0d0d",foreground:"#e8e8e8",cursor:"#E56A4A",cursorAccent:"#0d0d0d",selectionBackground:"rgba(229, 106, 74, 0.35)",black:"#1a1a1a",red:"#f87171",green:"#4ade80",yellow:"#fbbf24",blue:"#60a5fa",magenta:"#c084fc",cyan:"#22d3ee",white:"#e5e5e5",brightBlack:"#737373",brightRed:"#fca5a5",brightGreen:"#86efac",brightYellow:"#fde68a",brightBlue:"#93c5fd",brightMagenta:"#d8b4fe",brightCyan:"#67e8f9",brightWhite:"#fafafa"}}),o=new i,d=new u;s.loadAddon(o),s.loadAddon(d),s.open(n);try{n.tabIndex=0;let e=n.querySelector("textarea");e&&(e.tabIndex=0,e.setAttribute("autocomplete","off"),e.setAttribute("spellcheck","false"))}catch{}t.current=s,r.current=o;try{o.fit()}catch{}let p=s.onData(e=>F(e)),b=()=>{try{o.fit(),I()}catch{}},x=()=>W();n.addEventListener("mousedown",x),n.addEventListener("click",x),n.addEventListener("focus",W);let g="u">typeof ResizeObserver?new ResizeObserver(b):null;return g?.observe(n),window.addEventListener("resize",b),requestAnimationFrame(()=>{try{o.fit()}catch{}W()}),q(s,o),()=>{m.current=!0,g?.disconnect(),window.removeEventListener("resize",b),n.removeEventListener("mousedown",x),n.removeEventListener("click",x),n.removeEventListener("focus",W);try{p.dispose()}catch{}if(h.current&&(clearTimeout(h.current),h.current=null),c.current){try{c.current.close()}catch{}c.current=null}let e=l.current;l.current="",e&&fetch(`/api/terminal/session/${e}`,{method:"DELETE",keepalive:!0,credentials:"same-origin"}).catch(()=>{});try{s.dispose()}catch{}t.current=null,r.current=null}},[f,F,I,q,W]),"checking"===f)return(0,n.jsx)("div",{className:"flex h-full min-h-0 w-full items-center justify-center bg-[#0d0d0d] text-sm text-white/50",children:"Checking terminal lock…"});if("setup"===f||"unlock"===f){let e="setup"===f;return(0,n.jsx)("div",{className:"flex h-full min-h-0 w-full flex-col items-center justify-center bg-[#0d0d0d] px-4",children:(0,n.jsxs)("div",{className:"w-full max-w-md rounded-2xl border border-white/10 bg-white/[0.03] p-6 shadow-xl",children:[(0,n.jsxs)("div",{className:"mb-4 flex items-center gap-3",children:[(0,n.jsx)("div",{className:"flex size-10 items-center justify-center rounded-xl bg-[color:var(--brand,#E56A4A)]/15 text-[color:var(--brand,#E56A4A)]",children:(0,n.jsx)("span",{className:"material-symbols-outlined text-[22px]",children:e?"key":"lock"})}),(0,n.jsxs)("div",{children:[(0,n.jsx)("h1",{className:"text-base font-semibold text-white/95",children:e?"Set terminal password":"Unlock terminal"}),(0,n.jsx)("p",{className:"text-xs text-white/45",children:e?"Separate from dashboard password — double protection for the host shell.":"Dashboard login is not enough. Enter your terminal password."})]})]}),(0,n.jsxs)("form",{onSubmit:e?R:O,className:"space-y-3",children:[e&&void 0!==_&&null,e?(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)("label",{className:"block space-y-1",children:[(0,n.jsx)("span",{className:"text-[11px] font-medium uppercase tracking-wide text-white/40",children:"New terminal password"}),(0,n.jsx)("input",{type:"password",autoFocus:!0,autoComplete:"new-password",value:v,onChange:e=>k(e.target.value),className:"w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60",placeholder:"Min 6 characters",required:!0,minLength:6})]}),(0,n.jsxs)("label",{className:"block space-y-1",children:[(0,n.jsx)("span",{className:"text-[11px] font-medium uppercase tracking-wide text-white/40",children:"Confirm"}),(0,n.jsx)("input",{type:"password",autoComplete:"new-password",value:j,onChange:e=>N(e.target.value),className:"w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60",placeholder:"Repeat password",required:!0,minLength:6})]}),(0,n.jsxs)("p",{className:"text-[11px] leading-relaxed text-white/35",children:["Must ",(0,n.jsx)("strong",{className:"text-white/55",children:"not"})," match the dashboard password. Cookie unlock lasts ~4 hours on this browser."]})]}):(0,n.jsxs)("label",{className:"block space-y-1",children:[(0,n.jsx)("span",{className:"text-[11px] font-medium uppercase tracking-wide text-white/40",children:"Terminal password"}),(0,n.jsx)("input",{type:"password",autoFocus:!0,autoComplete:"current-password",value:v,onChange:e=>k(e.target.value),className:"w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60",placeholder:"••••••••",required:!0})]}),x?(0,n.jsx)("p",{className:"rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-300",children:x}):null,(0,n.jsx)("button",{type:"submit",disabled:w,className:"w-full rounded-lg bg-[color:var(--brand,#E56A4A)] px-3 py-2.5 text-sm font-semibold text-white transition hover:brightness-110 disabled:opacity-50",children:w?"Please wait…":e?"Save & open terminal":"Unlock"})]}),(0,n.jsx)("p",{className:"mt-4 text-center text-[11px] text-white/30",children:"Protected by dashboard login + terminal password"})]})})}return(0,n.jsxs)("div",{className:"flex h-full min-h-0 w-full flex-col bg-[#0d0d0d]",children:[(0,n.jsxs)("div",{className:"flex shrink-0 items-center justify-between gap-3 border-b border-white/10 px-4 py-2.5",children:[(0,n.jsxs)("div",{className:"flex min-w-0 items-center gap-3",children:[(0,n.jsxs)("div",{className:"flex items-center gap-2",children:[(0,n.jsx)("span",{className:`inline-block size-2 rounded-full ${"ready"===C?"bg-emerald-500":"connecting"===C?"bg-amber-400 animate-pulse":"forbidden"===C?"bg-amber-500":"bg-red-500"}`}),(0,n.jsx)("span",{className:"text-sm font-semibold text-white/90",children:"Terminal"})]}),(0,n.jsxs)("span",{className:"truncate text-xs text-white/45",children:[L,T.shell?` \xb7 ${T.shell}`:"",T.mode?` \xb7 ${T.mode}`:""]})]}),(0,n.jsxs)("div",{className:"flex items-center gap-2",children:[(0,n.jsx)("button",{type:"button",onClick:M,className:"rounded-lg border border-white/10 bg-white/5 px-3 py-1.5 text-xs font-medium text-white/70 transition hover:border-white/20 hover:text-white",title:"Lock terminal (require password again)",children:"Lock"}),(0,n.jsx)("button",{type:"button",onClick:J,className:"rounded-lg border border-white/10 bg-white/5 px-3 py-1.5 text-xs font-medium text-white/80 transition hover:border-[color:var(--brand,#E56A4A)]/50 hover:bg-white/10 hover:text-white",children:"New session"})]})]}),(0,n.jsx)("div",{className:"relative min-h-0 flex-1",onMouseDown:W,children:(0,n.jsx)("div",{ref:e,className:"absolute inset-0 px-2 py-2 outline-none"})}),(0,n.jsx)("div",{className:"shrink-0 border-t border-white/10 px-4 py-1.5 text-[11px] text-white/35",children:"Dashboard login + terminal password \xb7 click the black area then type \xb7 idle sessions close after 30m"})]})}r(82407)}},e=>{e.O(0,[1838,1507,8441,3794,7358],()=>e(e.s=63133)),_N_E=e.O()}]);

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.52",
+  "version": "1.0.53",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.52",
+  "version": "1.0.53",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.52",
+  "version": "1.0.53",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/app/(dashboard)/dashboard/terminal/TerminalPageClient.js

@@ -39,8 +39,10 @@ export default function TerminalPageClient() {
         cache: "no-store",
         credentials: "same-origin",
       });
+      const data = await res.json().catch(() => ({}));
       if (res.status === 403) {
-        setGate("open"); // still show terminal page; session create will explain localhost
+        setGateError(data?.error || "Access forbidden.");
+        setGate("unlock");
         return;
       }
       if (res.status === 401) {
@@ -48,7 +50,6 @@ export default function TerminalPageClient() {
         setGate("unlock");
         return;
       }
-      const data = await res.json().catch(() => ({}));
       if (!data.configured) {
         setGate("setup");
         return;
@@ -346,9 +347,8 @@ export default function TerminalPageClient() {
 
       if (res.status === 403) {
         setStatus("forbidden");
-        setStatusText("Localhost only");
-        term.writeln("\x1b[33mTerminal is restricted to localhost (security).\x1b[0m");
-        term.writeln("Open the dashboard on this machine (http://127.0.0.1:1997) to use the shell.");
+        setStatusText("Forbidden");
+        term.writeln("\x1b[33mTerminal access forbidden.\x1b[0m");
         return;
       }
 
@@ -668,7 +668,7 @@ export default function TerminalPageClient() {
           </form>
 
           <p className="mt-4 text-center text-[11px] text-white/30">
-            Still protected by localhost-only + dashboard login
+            Protected by dashboard login + terminal password
           </p>
         </div>
       </div>
@@ -713,7 +713,7 @@ export default function TerminalPageClient() {
       </div>
 
       <div className="shrink-0 border-t border-white/10 px-4 py-1.5 text-[11px] text-white/35">
-        Localhost only · second password · click the black area then type · idle sessions close after 30m
+        Dashboard login + terminal password · click the black area then type · idle sessions close after 30m
       </div>
     </div>
   );

package/src/dashboardGuard.js

@@ -92,8 +92,8 @@ const LOCAL_ONLY_PATHS = [
   "/api/pxpipe/start",
   "/api/pxpipe/stop",
   "/api/pxpipe/restart",
-  // Web shell: full host shell access — never expose over tunnel/remote.
-  "/api/terminal",
+  // Terminal shell is NOT local-only: protected by dashboard auth + secondary
+  // terminal password (and ALWAYS_PROTECTED). Users may open it over tunnel.
 ];
 
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);

package/src/shared/components/Header.js

@@ -121,7 +121,7 @@ const getPageInfo = (pathname) => {
   if (pathname.includes("/terminal"))
     return {
       title: "Terminal",
-      description: "Localhost web shell on this machine",
+      description: "Host web shell — requires a second password",
       icon: "terminal",
       breadcrumbs: [],
     };