zevairouter 1.0.52 → 1.0.54

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.52",
+  "version": "1.0.54",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.52",
+  "version": "1.0.54",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.52",
+  "version": "1.0.54",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/app/(dashboard)/dashboard/terminal/TerminalPageClient.js

@@ -20,13 +20,13 @@ export default function TerminalPageClient() {
   const disposedRef = useRef(false);
   const lineBufRef = useRef("");
 
-  // gate: checking | setup | unlock | open
+  // gate: checking | setup | unlock | reset | open
   const [gate, setGate] = useState("checking");
   const [gateError, setGateError] = useState("");
   const [gateBusy, setGateBusy] = useState(false);
   const [password, setPassword] = useState("");
   const [confirm, setConfirm] = useState("");
-  const [currentTerminalPassword, setCurrentTerminalPassword] = useState("");
+  const [dashboardPassword, setDashboardPassword] = useState("");
 
   const [status, setStatus] = useState("connecting");
   const [statusText, setStatusText] = useState("Starting shell…");
@@ -39,8 +39,10 @@ export default function TerminalPageClient() {
         cache: "no-store",
         credentials: "same-origin",
       });
+      const data = await res.json().catch(() => ({}));
       if (res.status === 403) {
-        setGate("open"); // still show terminal page; session create will explain localhost
+        setGateError(data?.error || "Access forbidden.");
+        setGate("unlock");
         return;
       }
       if (res.status === 401) {
@@ -48,7 +50,6 @@ export default function TerminalPageClient() {
         setGate("unlock");
         return;
       }
-      const data = await res.json().catch(() => ({}));
       if (!data.configured) {
         setGate("setup");
         return;
@@ -80,7 +81,6 @@ export default function TerminalPageClient() {
         body: JSON.stringify({
           password,
           confirm,
-          currentTerminalPassword: currentTerminalPassword || undefined,
         }),
       });
       const data = await res.json().catch(() => ({}));
@@ -90,7 +90,6 @@ export default function TerminalPageClient() {
       }
       setPassword("");
       setConfirm("");
-      setCurrentTerminalPassword("");
       setGate("open");
     } catch (error) {
       setGateError(error?.message || "Setup failed");
@@ -124,6 +123,37 @@ export default function TerminalPageClient() {
     }
   };
 
+  const handleReset = async (event) => {
+    event.preventDefault();
+    setGateBusy(true);
+    setGateError("");
+    try {
+      const res = await fetch("/api/terminal/auth/reset", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "same-origin",
+        body: JSON.stringify({
+          dashboardPassword,
+          password,
+          confirm,
+        }),
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        setGateError(data.error || "Reset failed");
+        return;
+      }
+      setPassword("");
+      setConfirm("");
+      setDashboardPassword("");
+      setGate("open");
+    } catch (error) {
+      setGateError(error?.message || "Reset failed");
+    } finally {
+      setGateBusy(false);
+    }
+  };
+
   const handleLock = async () => {
     try {
       await fetch("/api/terminal/auth/unlock", {
@@ -346,9 +376,8 @@ export default function TerminalPageClient() {
 
       if (res.status === 403) {
         setStatus("forbidden");
-        setStatusText("Localhost only");
-        term.writeln("\x1b[33mTerminal is restricted to localhost (security).\x1b[0m");
-        term.writeln("Open the dashboard on this machine (http://127.0.0.1:1997) to use the shell.");
+        setStatusText("Forbidden");
+        term.writeln("\x1b[33mTerminal access forbidden.\x1b[0m");
         return;
       }
 
@@ -568,35 +597,58 @@ export default function TerminalPageClient() {
     );
   }
 
-  if (gate === "setup" || gate === "unlock") {
+  if (gate === "setup" || gate === "unlock" || gate === "reset") {
     const isSetup = gate === "setup";
+    const isReset = gate === "reset";
+    const title = isSetup
+      ? "Set terminal password"
+      : isReset
+        ? "Reset terminal password"
+        : "Unlock terminal";
+    const subtitle = isSetup
+      ? "First time — pick a password different from dashboard login."
+      : isReset
+        ? "Prove dashboard login, then set a new terminal password."
+        : "Dashboard login is not enough. Enter your terminal password.";
+
     return (
       <div className="flex h-full min-h-0 w-full flex-col items-center justify-center bg-[#0d0d0d] px-4">
         <div className="w-full max-w-md rounded-2xl border border-white/10 bg-white/[0.03] p-6 shadow-xl">
           <div className="mb-4 flex items-center gap-3">
             <div className="flex size-10 items-center justify-center rounded-xl bg-[color:var(--brand,#E56A4A)]/15 text-[color:var(--brand,#E56A4A)]">
               <span className="material-symbols-outlined text-[22px]">
-                {isSetup ? "key" : "lock"}
+                {isSetup || isReset ? "key" : "lock"}
               </span>
             </div>
             <div>
-              <h1 className="text-base font-semibold text-white/95">
-                {isSetup ? "Set terminal password" : "Unlock terminal"}
-              </h1>
-              <p className="text-xs text-white/45">
-                {isSetup
-                  ? "Separate from dashboard password — double protection for the host shell."
-                  : "Dashboard login is not enough. Enter your terminal password."}
-              </p>
+              <h1 className="text-base font-semibold text-white/95">{title}</h1>
+              <p className="text-xs text-white/45">{subtitle}</p>
             </div>
           </div>
 
-          <form onSubmit={isSetup ? handleSetup : handleUnlock} className="space-y-3">
-            {isSetup && currentTerminalPassword !== undefined && (
-              // current only needed when rotating — hide on first setup (no configured pw)
-              null
-            )}
-            {isSetup ? (
+          <form
+            onSubmit={isSetup ? handleSetup : isReset ? handleReset : handleUnlock}
+            className="space-y-3"
+          >
+            {isReset ? (
+              <label className="block space-y-1">
+                <span className="text-[11px] font-medium uppercase tracking-wide text-white/40">
+                  Dashboard password
+                </span>
+                <input
+                  type="password"
+                  autoFocus
+                  autoComplete="current-password"
+                  value={dashboardPassword}
+                  onChange={(e) => setDashboardPassword(e.target.value)}
+                  className="w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60"
+                  placeholder="Your dashboard login password"
+                  required
+                />
+              </label>
+            ) : null}
+
+            {isSetup || isReset ? (
               <>
                 <label className="block space-y-1">
                   <span className="text-[11px] font-medium uppercase tracking-wide text-white/40">
@@ -604,7 +656,7 @@ export default function TerminalPageClient() {
                   </span>
                   <input
                     type="password"
-                    autoFocus
+                    autoFocus={!isReset}
                     autoComplete="new-password"
                     value={password}
                     onChange={(e) => setPassword(e.target.value)}
@@ -631,7 +683,7 @@ export default function TerminalPageClient() {
                 </label>
                 <p className="text-[11px] leading-relaxed text-white/35">
                   Must <strong className="text-white/55">not</strong> match the dashboard password.
-                  Cookie unlock lasts ~4 hours on this browser.
+                  Unlock lasts ~4 hours on this browser.
                 </p>
               </>
             ) : (
@@ -663,12 +715,50 @@ export default function TerminalPageClient() {
               disabled={gateBusy}
               className="w-full rounded-lg bg-[color:var(--brand,#E56A4A)] px-3 py-2.5 text-sm font-semibold text-white transition hover:brightness-110 disabled:opacity-50"
             >
-              {gateBusy ? "Please wait…" : isSetup ? "Save & open terminal" : "Unlock"}
+              {gateBusy
+                ? "Please wait…"
+                : isSetup
+                  ? "Save & open terminal"
+                  : isReset
+                    ? "Reset & open"
+                    : "Unlock"}
             </button>
           </form>
 
+          {gate === "unlock" ? (
+            <button
+              type="button"
+              onClick={() => {
+                setGateError("");
+                setPassword("");
+                setConfirm("");
+                setDashboardPassword("");
+                setGate("reset");
+              }}
+              className="mt-3 w-full text-center text-[12px] text-white/45 transition hover:text-white/80"
+            >
+              Forgot terminal password? Reset with dashboard password
+            </button>
+          ) : null}
+
+          {gate === "reset" ? (
+            <button
+              type="button"
+              onClick={() => {
+                setGateError("");
+                setPassword("");
+                setConfirm("");
+                setDashboardPassword("");
+                setGate("unlock");
+              }}
+              className="mt-3 w-full text-center text-[12px] text-white/45 transition hover:text-white/80"
+            >
+              Back to unlock
+            </button>
+          ) : null}
+
           <p className="mt-4 text-center text-[11px] text-white/30">
-            Still protected by localhost-only + dashboard login
+            Protected by dashboard login + terminal password
           </p>
         </div>
       </div>
@@ -713,7 +803,7 @@ export default function TerminalPageClient() {
       </div>
 
       <div className="shrink-0 border-t border-white/10 px-4 py-1.5 text-[11px] text-white/35">
-        Localhost only · second password · click the black area then type · idle sessions close after 30m
+        Dashboard login + terminal password · click the black area then type · idle sessions close after 30m
       </div>
     </div>
   );

package/src/app/api/terminal/auth/reset/route.js

@@ -0,0 +1,72 @@
+import { NextResponse } from "next/server";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { getSettings, updateSettings } from "@/lib/localDb";
+import {
+  setTerminalUnlockCookie,
+  clearTerminalUnlockCookie,
+} from "@/lib/auth/terminalSession";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+async function matchesDashboardPassword(plain, settings) {
+  if (!plain) return false;
+  if (settings.password) {
+    try {
+      return await bcrypt.compare(plain, settings.password);
+    } catch {
+      return false;
+    }
+  }
+  // No dashboard password hash yet — accept INITIAL_PASSWORD / default
+  const initial = process.env.INITIAL_PASSWORD || "123456";
+  return plain === initial;
+}
+
+/**
+ * Reset terminal password using dashboard password (recovery).
+ * Body: { dashboardPassword, password, confirm }
+ * Or clear only: { dashboardPassword, clear: true }
+ */
+export async function POST(request) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const dashboardPassword = String(body?.dashboardPassword || "");
+    const settings = await getSettings();
+
+    if (!(await matchesDashboardPassword(dashboardPassword, settings))) {
+      return NextResponse.json({ error: "Dashboard password is incorrect." }, { status: 401 });
+    }
+
+    const cookieStore = await cookies();
+
+    if (body?.clear === true) {
+      await updateSettings({ terminalPassword: null });
+      clearTerminalUnlockCookie(cookieStore);
+      return NextResponse.json({ ok: true, configured: false, unlocked: false, cleared: true });
+    }
+
+    const password = String(body?.password || "");
+    const confirm = String(body?.confirm || "");
+    if (password.length < 6) {
+      return NextResponse.json({ error: "Terminal password must be at least 6 characters." }, { status: 400 });
+    }
+    if (password !== confirm) {
+      return NextResponse.json({ error: "Passwords do not match." }, { status: 400 });
+    }
+    if (await matchesDashboardPassword(password, settings)) {
+      return NextResponse.json(
+        { error: "Terminal password must be different from the dashboard password." },
+        { status: 400 }
+      );
+    }
+
+    const hash = await bcrypt.hash(password, 10);
+    await updateSettings({ terminalPassword: hash });
+    await setTerminalUnlockCookie(cookieStore, request);
+    return NextResponse.json({ ok: true, configured: true, unlocked: true });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "reset failed" }, { status: 500 });
+  }
+}

package/src/dashboardGuard.js

@@ -92,8 +92,8 @@ const LOCAL_ONLY_PATHS = [
   "/api/pxpipe/start",
   "/api/pxpipe/stop",
   "/api/pxpipe/restart",
-  // Web shell: full host shell access — never expose over tunnel/remote.
-  "/api/terminal",
+  // Terminal shell is NOT local-only: protected by dashboard auth + secondary
+  // terminal password (and ALWAYS_PROTECTED). Users may open it over tunnel.
 ];
 
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);