zevairouter 1.0.58 → 1.0.60

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.58",
+  "version": "1.0.60",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.58",
+  "version": "1.0.60",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.58",
+  "version": "1.0.60",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/displayEnv.js

@@ -20,10 +20,17 @@ function which(bin) {
 }
 
 export function hasUsableDisplay() {
+  // Desktop OS: headed Chromium/Playwright works without $DISPLAY
+  // (macOS GUI session / Windows). Only bare Linux servers need Xvfb.
+  if (process.platform === "darwin" || process.platform === "win32") {
+    return true;
+  }
+
   const d = process.env.DISPLAY;
   if (!d || !String(d).trim()) return false;
+
   // On Linux, verify something is listening if xdpyinfo exists
-  if (process.platform === "linux" && which("xdpyinfo")) {
+  if (which("xdpyinfo")) {
     try {
       execFileSync("xdpyinfo", ["-display", d], {
         stdio: "ignore",
@@ -51,16 +58,17 @@ function findFreeDisplayNumber() {
  */
 export function ensureDisplayForHeadedBrowser() {
   if (hasUsableDisplay()) {
-    return { ok: true, display: process.env.DISPLAY, managed: false };
+    return {
+      ok: true,
+      display: process.env.DISPLAY || (process.platform === "darwin" ? "aqua" : ""),
+      managed: false,
+    };
   }
 
-  // macOS/Windows usually have a session display or use headless; don't invent Xvfb
+  // Only Linux VPS needs a virtual framebuffer
   if (process.platform !== "linux") {
-    const err = new Error(
-      "Headed browser needs a graphical display. On servers without a UI, use a Linux VPS with Xvfb or force headless."
-    );
-    err.code = "NO_DISPLAY";
-    return { ok: false, error: err };
+    // Should not reach here (hasUsableDisplay is true on darwin/win32)
+    return { ok: true, display: process.env.DISPLAY || "", managed: false };
   }
 
   if (g.display && g.proc && !g.proc.killed) {

package/src/lib/oauth/services/grokXaiEmailAutomation.js

@@ -189,6 +189,96 @@ export async function runXaiEmailSignup(page, {
   return { status: "success", email, password, url };
 }
 
+async function clickRoleButton(page, nameRe) {
+  try {
+    const btn = page.getByRole("button", { name: nameRe }).first();
+    if (await btn.isVisible({ timeout: 600 }).catch(() => false)) {
+      await btn.click({ timeout: 4_000 });
+      return true;
+    }
+  } catch {
+    /* next */
+  }
+  return false;
+}
+
+/** Aggressive consent / continue clicks for xAI device pages. */
+async function clickDeviceAuthorizeControls(page) {
+  // Prefer role-based names (more reliable than CSS text on SPA)
+  const roles = [
+    /^(Allow|Authorize|Approve|Confirm|Yes|Accept)$/i,
+    /Allow|Authorize|Approve|Confirm/i,
+    /^Continue$/i,
+    /Continue/i,
+    /^Next$/i,
+    /Sign in|Log in|Login/i,
+  ];
+  for (const re of roles) {
+    if (await clickRoleButton(page, re)) return true;
+  }
+
+  // Links styled as buttons
+  try {
+    const link = page.getByRole("link", { name: /Allow|Authorize|Continue|Confirm/i }).first();
+    if (await link.isVisible({ timeout: 400 }).catch(() => false)) {
+      await link.click({ timeout: 3_000 });
+      return true;
+    }
+  } catch {
+    /* ignore */
+  }
+
+  return Boolean(
+    await clickFirst(page, [
+      'button:has-text("Allow")',
+      'button:has-text("Authorize")',
+      'button:has-text("Approve")',
+      'button:has-text("Confirm")',
+      'button:has-text("Continue")',
+      'button:has-text("Next")',
+      'button[type=submit]',
+      'input[type=submit]',
+    ])
+  );
+}
+
+async function ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp }) {
+  const report = (step, message) => onStep?.(step, message);
+
+  if (await page.getByRole("button", { name: /Login with email/i }).count()) {
+    await page.getByRole("button", { name: /Login with email/i }).click().catch(() => null);
+    await wait(800);
+  }
+
+  if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
+    report("device_login_email", "Entering email on device page");
+    await typeSlow(page.locator("input[type=email]").first(), email, 40);
+    await clickDeviceAuthorizeControls(page);
+    await wait(1_200);
+  }
+  if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
+    report("device_login_password", "Entering password on device page");
+    await typeSlow(page.locator("input[type=password]").first(), password, 40);
+    await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
+    await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")', 'button[type=submit]']);
+    await wait(2_500);
+  }
+
+  let text = await pageText(page);
+  if (/security code|Verify your email|one time|confirmation code/i.test(text)) {
+    report("login_otp", "Login requires OTP — polling tempmail");
+    const otp = await pollOtp(email, { timeoutMs: 90_000 });
+    if (otp?.code) {
+      const codeInput = page.locator("input[name=code], input[autocomplete=one-time-code], input[type=text]").first();
+      if (await codeInput.isVisible().catch(() => false)) {
+        await typeSlow(codeInput, otp.code, 80);
+      }
+      await clickDeviceAuthorizeControls(page);
+      await wait(2_000);
+    }
+  }
+}
+
 /**
  * Login with email+password (session), then authorize a Grok CLI device code.
  */
@@ -203,78 +293,55 @@ export async function runXaiEmailDeviceAuthorize(page, {
   cancelCheck,
 } = {}) {
   const report = (step, message) => onStep?.(step, message);
+  const authorized = { done: false };
 
   // Ensure session via sign-in if not already on account
   const cur = page.url();
-  if (!/\/account/i.test(cur)) {
+  if (!/\/account/i.test(cur) && !/accounts\.x\.ai/i.test(cur)) {
     report("opening_signin", "Opening xAI email login");
     await page.goto("https://accounts.x.ai/sign-in", { waitUntil: "domcontentloaded", timeout: 60_000 });
     await wait(1_000);
     await dismissCookies(page);
-
-    if (await page.getByRole("button", { name: /Login with email/i }).count()) {
-      await page.getByRole("button", { name: /Login with email/i }).click();
-      await wait(800);
-    }
-
-    if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=email]").first(), email, 40);
-      await clickFirst(page, ['button:has-text("Next")', 'button:has-text("Continue")']);
-      await wait(1_500);
-    }
-    if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=password]").first(), password, 40);
-      await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
-      await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")']);
-      await wait(3_000);
-    }
-
-    let text = await pageText(page);
-    if (/security code|Verify your email|one time/i.test(text)) {
-      report("login_otp", "Login requires OTP — polling tempmail");
-      const otp = await pollOtp(email, { timeoutMs: 90_000 });
-      if (otp?.code) {
-        await typeSlow(page.locator("input[name=code]").first(), otp.code, 80);
-        await clickFirst(page, ['button:has-text("Confirm email")', 'button:has-text("Continue")']);
-        await wait(2_500);
-      }
-    }
+    await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
   }
 
   report("opening_device", "Opening Grok Build device authorization");
   await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-  await wait(1_200);
+  await wait(1_500);
   await dismissCookies(page);
-  await clickFirst(page, ['button:has-text("Continue")']);
+  await clickDeviceAuthorizeControls(page);
   await wait(2_000);
 
   // If bounced to login again, do email login on this page
-  if (await page.getByRole("button", { name: /Login with email/i }).count()) {
-    await page.getByRole("button", { name: /Login with email/i }).click();
-    await wait(800);
-    if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=email]").first(), email, 40);
-      await clickFirst(page, ['button:has-text("Next")']);
-      await wait(1_200);
-    }
-    if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=password]").first(), password, 40);
-      await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
-      await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")']);
-      await wait(3_000);
-    }
-    // re-open device after login
+  const bounced = await page.getByRole("button", { name: /Login with email/i }).count()
+    || await page.locator("input[type=email]").first().isVisible().catch(() => false);
+  if (bounced) {
+    report("device_needs_login", "Device page requires login — signing in");
+    await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
     await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-    await wait(1_200);
-    await clickFirst(page, ['button:has-text("Continue")']);
+    await wait(1_500);
+    await dismissCookies(page);
+    await clickDeviceAuthorizeControls(page);
     await wait(2_000);
   }
 
+  // Snapshot first device page for debugging stuck authorize
+  try {
+    const snap = (await pageText(page)).replace(/\s+/g, " ").slice(0, 160);
+    report("device_page", `Device page: ${page.url().slice(0, 80)} · ${snap}`);
+  } catch {
+    /* ignore */
+  }
+
   const pollPromise = (async () => {
     const start = Date.now();
-    let interval = 5_000;
-    while (Date.now() - start < 15 * 60_000) {
+    let interval = 4_000;
+    while (Date.now() - start < 12 * 60_000) {
       if (cancelCheck?.()) throw new Error("Job cancelled during token polling");
+      if (authorized.done) {
+        // short burst after UI says authorized
+        await wait(1_500);
+      }
       const result = await pollToken(deviceCode);
       if (result?.success && result.tokens) return { tokens: result.tokens };
       if (result?.pending || result?.error === "authorization_pending") {
@@ -287,57 +354,99 @@ export async function runXaiEmailDeviceAuthorize(page, {
         continue;
       }
       if (result?.error && !["authorization_pending", "slow_down"].includes(result.error)) {
-        // keep polling a bit — page may still authorize
+        report("token_poll_note", `Poll: ${result.error}`);
         await wait(interval);
         continue;
       }
       await wait(interval);
     }
-    throw new Error("Timed out waiting for Grok CLI OAuth token");
+    throw new Error("Timed out waiting for Grok CLI OAuth token (device may not have been authorized in the browser)");
   })();
 
-  // UI authorize loop in parallel with poll
+  // UI authorize loop — keep going until poll succeeds or timeout (~same window)
   const uiLoop = (async () => {
-    for (let i = 0; i < 20; i++) {
+    const start = Date.now();
+    let i = 0;
+    while (Date.now() - start < 11 * 60_000) {
       if (cancelCheck?.()) return;
+      if (authorized.done) {
+        await wait(2_000);
+        continue;
+      }
+
       const text = await pageText(page);
-      if (/Device Authorized|device has been authorized|you can close/i.test(text)) {
+      const url = page.url();
+
+      if (/Device Authorized|device has been authorized|you can close|successfully authorized/i.test(text)) {
+        authorized.done = true;
         report("device_authorized", "Device authorized in browser");
         return;
       }
-      // signed-in consent
-      if (/Authorize Grok Build|Verify your identity|Confirm your identity/i.test(text)) {
-        await clickFirst(page, [
-          'button:has-text("Allow")',
-          'button:has-text("Authorize")',
-          'button:has-text("Approve")',
-          'button:has-text("Continue")',
-          'button:has-text("Confirm")',
-        ]);
+
+      // Login wall again mid-flow
+      if (/Login with email|Sign in to continue|log in to continue/i.test(text)
+        || await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
+        report("device_relogin", "Re-login required on device page");
+        await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
+        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
         await wait(1_500);
         continue;
       }
-      if (/Redirecting/i.test(text) || /\/account/i.test(page.url())) {
+
+      // Consent / identity
+      if (/Authorize Grok|Grok Build|Verify your identity|Confirm your identity|device code|user code/i.test(text)
+        || /oauth2\/device|device\/verify/i.test(url)) {
+        const clicked = await clickDeviceAuthorizeControls(page);
+        if (clicked && i % 3 === 0) {
+          report("device_click", `Clicked authorize control (${i + 1})`);
+        }
+        // Turnstile sometimes reappears on consent
+        await waitForTurnstile(page, { timeoutMs: 12_000, onStep: i % 5 === 0 ? onStep : undefined });
+        await wait(1_800);
+        i += 1;
+        continue;
+      }
+
+      // Redirected away from device flow
+      if (/Redirecting/i.test(text) || (/\/account/i.test(url) && !/device/i.test(url))) {
+        report("device_reopen", "Re-opening device authorization URL");
         await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
         await wait(1_500);
-        await clickFirst(page, ['button:has-text("Continue")']);
+        await dismissCookies(page);
+        await clickDeviceAuthorizeControls(page);
         await wait(1_500);
+        i += 1;
         continue;
       }
-      await clickFirst(page, [
-        'button:has-text("Continue")',
-        'button:has-text("Allow")',
-        'button:has-text("Authorize")',
-      ]);
-      await wait(1_500);
+
+      // Generic: keep trying primary actions + occasional reload
+      await clickDeviceAuthorizeControls(page);
+      if (i > 0 && i % 8 === 0) {
+        report("device_reload", `Reload device page (attempt ${i}) · ${url.slice(0, 60)}`);
+        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
+        await wait(1_200);
+        await clickDeviceAuthorizeControls(page);
+      }
+      await wait(1_800);
+      i += 1;
     }
   })();
 
   report("polling_token", "Waiting for device token after authorization");
-  const [tokenResult] = await Promise.all([
-    pollPromise,
-    uiLoop.catch(() => null),
-  ]);
-
-  return { status: "success", tokens: tokenResult.tokens };
+  try {
+    const [tokenResult] = await Promise.all([
+      pollPromise,
+      uiLoop.catch((e) => {
+        report("device_ui_note", String(e?.message || e).slice(0, 120));
+        return null;
+      }),
+    ]);
+    return { status: "success", tokens: tokenResult.tokens };
+  } catch (error) {
+    const snap = (await pageText(page).catch(() => "")).replace(/\s+/g, " ").slice(0, 200);
+    return {
+      status: "failed",
+      error: `${error.message || error} · page: ${page.url()} · ${snap}`,
+    };
+  }
 }