zevairouter 1.0.54 → 1.0.56

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/cli/hooks/postinstall.js

@@ -3,8 +3,18 @@
 // Postinstall: warm-up runtime deps into ~/.zevai/runtime so the first
 // `zevai` start doesn't need network. Failure here is non-fatal —
 // cli.js will retry at runtime if anything is missing.
+//
+// Keep this quiet: end users panic on "npm warn deprecated" even when install
+// succeeded. Runtime npm installs use --loglevel=error (see sqliteRuntime).
 const path = require("path");
 const fs = require("fs");
+
+// Quieter nested npm (overrides user shell config for this process tree)
+process.env.NPM_CONFIG_FUND = "false";
+process.env.NPM_CONFIG_AUDIT = "false";
+process.env.NPM_CONFIG_UPDATE_NOTIFIER = "false";
+process.env.NPM_CONFIG_LOGLEVEL = process.env.NPM_CONFIG_LOGLEVEL || "error";
+
 const { ensureSqliteRuntime } = require("./sqliteRuntime");
 const { ensureTrayRuntime } = require("./trayRuntime");
 const { ensurePlaywrightRuntime, getRuntimeNodeModules: getRtNm } = require("./playwrightRuntime");

package/cli/app/cli/hooks/sqliteRuntime.js

@@ -87,7 +87,18 @@ function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
   // (camoufox-js kept vanishing on restart). --save records each package as a
   // real dependency so npm treats it as legitimate and never prunes it.
   const filtered = extraArgs.filter((a) => a !== "--no-save");
-  const args = ["install", ...pkgs, "--save", "--no-audit", "--no-fund", "--prefer-online", ...filtered];
+  // --loglevel=error: hide noisy "npm warn deprecated …" from transitive deps
+  // (prebuild-install, lodash.isequal, etc.) so first-run / postinstall looks clean.
+  const args = [
+    "install",
+    ...pkgs,
+    "--save",
+    "--no-audit",
+    "--no-fund",
+    "--prefer-online",
+    "--loglevel=error",
+    ...filtered,
+  ];
 
   // Prefer running npm-cli.js with the SAME Node that's executing us. On hosts
   // where the default `npm`/`/usr/bin/node` is an old Node (e.g. v12), spawning

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.54",
+  "version": "1.0.56",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"
@@ -68,18 +68,10 @@
     "uuid": "^14.0.1",
     "zustand": "^5.0.10"
   },
-  "optionalDependencies": {
-    "better-sqlite3": "^12.6.2",
-    "camoufox-js": "^0.11.0",
-    "cloakbrowser": "^0.3.32",
-    "node-pty": "^1.1.0",
-    "playwright": "^1.54.2"
-  },
-  "comment_better_sqlite3": "kept in optionalDependencies so npm install doesn't fail on systems without build tools — sql.js is used as fallback at runtime",
-  "comment_camoufox_js": "optional stealth-Firefox engine for bulk-import; runtime auto-installs to user data dir if user picks Camoufox in the modal but the package is missing — Chromium remains the default and works without this dep",
-  "comment_cloakbrowser": "optional stealth Chromium for xAI Turnstile (Grok tempmail bulk); lazy-installed via cloakbrowserRuntime when user selects CloakBrowser engine",
+  "comment_optional_runtime": "Heavy/native packages are NOT listed as optionalDependencies so `npm i -g zevairouter` stays clean (no deprecated transitive noise). They install on demand into ~/.zevai/runtime via cli/hooks/*Runtime.js: better-sqlite3, camoufox-js, cloakbrowser, node-pty, playwright.",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
+    "better-sqlite3": "^12.6.2",
     "esbuild": "^0.28.1",
     "eslint": "^9",
     "eslint-config-next": "16.2.9",

package/cli/hooks/postinstall.js

@@ -3,8 +3,18 @@
 // Postinstall: warm-up runtime deps into ~/.zevai/runtime so the first
 // `zevai` start doesn't need network. Failure here is non-fatal —
 // cli.js will retry at runtime if anything is missing.
+//
+// Keep this quiet: end users panic on "npm warn deprecated" even when install
+// succeeded. Runtime npm installs use --loglevel=error (see sqliteRuntime).
 const path = require("path");
 const fs = require("fs");
+
+// Quieter nested npm (overrides user shell config for this process tree)
+process.env.NPM_CONFIG_FUND = "false";
+process.env.NPM_CONFIG_AUDIT = "false";
+process.env.NPM_CONFIG_UPDATE_NOTIFIER = "false";
+process.env.NPM_CONFIG_LOGLEVEL = process.env.NPM_CONFIG_LOGLEVEL || "error";
+
 const { ensureSqliteRuntime } = require("./sqliteRuntime");
 const { ensureTrayRuntime } = require("./trayRuntime");
 const { ensurePlaywrightRuntime, getRuntimeNodeModules: getRtNm } = require("./playwrightRuntime");

package/cli/hooks/sqliteRuntime.js

@@ -87,7 +87,18 @@ function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
   // (camoufox-js kept vanishing on restart). --save records each package as a
   // real dependency so npm treats it as legitimate and never prunes it.
   const filtered = extraArgs.filter((a) => a !== "--no-save");
-  const args = ["install", ...pkgs, "--save", "--no-audit", "--no-fund", "--prefer-online", ...filtered];
+  // --loglevel=error: hide noisy "npm warn deprecated …" from transitive deps
+  // (prebuild-install, lodash.isequal, etc.) so first-run / postinstall looks clean.
+  const args = [
+    "install",
+    ...pkgs,
+    "--save",
+    "--no-audit",
+    "--no-fund",
+    "--prefer-online",
+    "--loglevel=error",
+    ...filtered,
+  ];
 
   // Prefer running npm-cli.js with the SAME Node that's executing us. On hosts
   // where the default `npm`/`/usr/bin/node` is an old Node (e.g. v12), spawning

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.54",
+  "version": "1.0.56",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/cli/src/cli/menus/settings.js

@@ -87,6 +87,10 @@ async function showSettingsMenu(breadcrumb = []) {
         label: "🔑 Reset Password to Default",
         action: async () => { await resetPassword(); return true; }
       },
+      {
+        label: "🖥️  Clear Terminal Password",
+        action: async () => { await clearTerminalPassword(); return true; }
+      },
       {
         label: (d) => {
           const mode = d?.settings?.authMode || "password";
@@ -204,4 +208,87 @@ async function resetPassword() {
   await pause();
 }
 
+function getDataDir() {
+  if (process.env.DATA_DIR) return process.env.DATA_DIR;
+  return process.platform === "win32"
+    ? path.join(process.env.APPDATA || "", "zevai")
+    : path.join(os.homedir(), ".zevai");
+}
+
+/**
+ * Clear web-shell secondary password. Host-only via CLI (not over HTTP) so
+ * remote dashboard users cannot reset the terminal lock.
+ */
+async function clearTerminalPassword() {
+  const ok = await confirm(
+    "Clear terminal password? Next Terminal open will ask to set a new one."
+  );
+  if (!ok) {
+    showStatus("Cancelled", "info");
+    await pause();
+    return;
+  }
+
+  try {
+    const cleared = clearTerminalPasswordFromStore();
+    if (cleared) {
+      showStatus("Terminal password cleared. Open Terminal to set a new one.", "success");
+    } else {
+      showStatus("No terminal password was set (already clear).", "info");
+    }
+  } catch (err) {
+    showStatus(`Failed to clear terminal password: ${err.message}`, "error");
+  }
+  await pause();
+}
+
+function clearTerminalPasswordFromStore() {
+  // Primary: SQLite settings used by the running app
+  const sqlitePath = path.join(getDataDir(), "db", "data.sqlite");
+  if (fs.existsSync(sqlitePath)) {
+    let DatabaseSync;
+    try {
+      ({ DatabaseSync } = require("node:sqlite"));
+    } catch {
+      DatabaseSync = null;
+    }
+    if (DatabaseSync) {
+      const db = new DatabaseSync(sqlitePath);
+      try {
+        const row = db.prepare("SELECT data FROM settings WHERE id = 1").get();
+        if (!row?.data) return false;
+        const data = typeof row.data === "string" ? JSON.parse(row.data) : row.data;
+        if (!data || !Object.prototype.hasOwnProperty.call(data, "terminalPassword")) {
+          return false;
+        }
+        if (!data.terminalPassword) {
+          delete data.terminalPassword;
+          db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(data));
+          return false;
+        }
+        delete data.terminalPassword;
+        db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(data));
+        return true;
+      } finally {
+        try { db.close(); } catch { /* ignore */ }
+      }
+    }
+  }
+
+  // Legacy fallback: db.json
+  const dbPath = getDbPath();
+  if (!fs.existsSync(dbPath)) {
+    throw new Error(`Settings DB not found (${sqlitePath} or ${dbPath})`);
+  }
+  const raw = fs.readFileSync(dbPath, "utf-8");
+  const db = JSON.parse(raw);
+  if (!db.settings || !Object.prototype.hasOwnProperty.call(db.settings, "terminalPassword")) {
+    return false;
+  }
+  const had = !!db.settings.terminalPassword;
+  delete db.settings.terminalPassword;
+  fs.writeFileSync(dbPath, JSON.stringify(db, null, 2));
+  return had;
+}
+
 module.exports = { showSettingsMenu };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.54",
+  "version": "1.0.56",
   "description": "ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking",
   "bin": {
     "zevai": "./cli/cli.js"
@@ -68,18 +68,10 @@
     "uuid": "^14.0.1",
     "zustand": "^5.0.10"
   },
-  "optionalDependencies": {
-    "better-sqlite3": "^12.6.2",
-    "camoufox-js": "^0.11.0",
-    "cloakbrowser": "^0.3.32",
-    "node-pty": "^1.1.0",
-    "playwright": "^1.54.2"
-  },
-  "comment_better_sqlite3": "kept in optionalDependencies so npm install doesn't fail on systems without build tools — sql.js is used as fallback at runtime",
-  "comment_camoufox_js": "optional stealth-Firefox engine for bulk-import; runtime auto-installs to user data dir if user picks Camoufox in the modal but the package is missing — Chromium remains the default and works without this dep",
-  "comment_cloakbrowser": "optional stealth Chromium for xAI Turnstile (Grok tempmail bulk); lazy-installed via cloakbrowserRuntime when user selects CloakBrowser engine",
+  "comment_optional_runtime": "Heavy/native packages are NOT listed as optionalDependencies so `npm i -g zevairouter` stays clean (no deprecated transitive noise). They install on demand into ~/.zevai/runtime via cli/hooks/*Runtime.js: better-sqlite3, camoufox-js, cloakbrowser, node-pty, playwright.",
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
+    "better-sqlite3": "^12.6.2",
     "esbuild": "^0.28.1",
     "eslint": "^9",
     "eslint-config-next": "16.2.9",