zevairouter 1.0.79 → 1.0.80

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.79",
+  "version": "1.0.80",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.79",
+  "version": "1.0.80",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.79",
+  "version": "1.0.80",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -26,66 +26,132 @@ async function importPlaywright() {
   return playwright.chromium ?? playwright.default?.chromium ?? null;
 }
 
-const STEALTH_INIT_SCRIPT = `
-  Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
-  Object.defineProperty(navigator, 'languages', { get: () => ['en-US', 'en'] });
-  Object.defineProperty(navigator, 'plugins', {
-    get: () => {
-      const plugins = [
-        { name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer', description: 'Portable Document Format' },
-        { name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai', description: '' },
-        { name: 'Native Client', filename: 'internal-nacl-plugin', description: '' },
-      ];
-      plugins.length = 3;
-      return plugins;
-    }
-  });
-  const _origQuery = window.navigator.permissions.query;
-  window.navigator.permissions.query = (parameters) =>
-    parameters.name === 'notifications'
-      ? Promise.resolve({ state: Notification.permission })
-      : _origQuery.call(window.navigator.permissions, parameters);
-  if (window.chrome) {
-    if (!window.chrome.runtime) window.chrome.runtime = {};
-    window.chrome.runtime.connect = window.chrome.runtime.connect || function() {};
-    window.chrome.runtime.sendMessage = window.chrome.runtime.sendMessage || function() {};
-  } else {
-    window.chrome = { runtime: { connect: function() {}, sendMessage: function() {} } };
-  }
-  const _origGetParameter = WebGLRenderingContext.prototype.getParameter;
-  WebGLRenderingContext.prototype.getParameter = function(parameter) {
-    if (parameter === 37445) return 'Intel Inc.';
-    if (parameter === 37446) return 'Intel Iris OpenGL Engine';
-    return _origGetParameter.call(this, parameter);
-  };
-`;
-
-function getStealthUserAgent(browserVersion) {
-  const ver = browserVersion || "131.0.0.0";
-  // Match the UA platform string to the actual OS so Google doesn't flag a
-  // mismatch between the User-Agent header and navigator.platform / other
-  // client-side signals that leak the real OS.
+/**
+ * WebGL / UA / platform must match. Spoofing Intel Iris on a Linux VPS UA is a
+ * classic bot signal and triggers Google CAPTCHA even at high concurrency.
+ * (Used to work when fingerprint was consistent or less checked.)
+ */
+function getStealthPlatformProfile() {
   const platform = typeof process !== "undefined" ? process.platform : "linux";
   if (platform === "darwin") {
-    return `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
+    return {
+      platform,
+      languages: ["en-US", "en"],
+      webglVendor: "Google Inc. (Apple)",
+      webglRenderer: "ANGLE (Apple, ANGLE Metal Renderer: Apple M1, Unspecified Version)",
+      uaPlatform: "Macintosh; Intel Mac OS X 10_15_7",
+    };
   }
   if (platform === "win32") {
-    return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
+    return {
+      platform,
+      languages: ["en-US", "en"],
+      webglVendor: "Google Inc. (NVIDIA)",
+      webglRenderer: "ANGLE (NVIDIA, NVIDIA GeForce GTX 1660 Direct3D11 vs_5_0 ps_5_0, D3D11)",
+      uaPlatform: "Windows NT 10.0; Win64; x64",
+    };
   }
-  // Linux (the VPS default)
-  return `Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
+  // Linux VPS / Xvfb — Mesa/SwiftShader style, NOT Mac Iris
+  return {
+    platform: "linux",
+    languages: ["en-US", "en"],
+    webglVendor: "Google Inc. (Google)",
+    webglRenderer: "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver)",
+    uaPlatform: "X11; Linux x86_64",
+  };
+}
+
+function buildStealthInitScript() {
+  const p = getStealthPlatformProfile();
+  // Inject as JSON so quotes in renderer strings stay safe.
+  return `
+  (() => {
+    const profile = ${JSON.stringify({
+      languages: p.languages,
+      webglVendor: p.webglVendor,
+      webglRenderer: p.webglRenderer,
+    })};
+    try {
+      Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+    } catch {}
+    try {
+      Object.defineProperty(navigator, 'languages', { get: () => profile.languages.slice() });
+    } catch {}
+    try {
+      Object.defineProperty(navigator, 'plugins', {
+        get: () => {
+          const plugins = [
+            { name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer', description: 'Portable Document Format' },
+            { name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai', description: '' },
+            { name: 'Native Client', filename: 'internal-nacl-plugin', description: '' },
+          ];
+          plugins.length = 3;
+          return plugins;
+        }
+      });
+    } catch {}
+    try {
+      const _origQuery = window.navigator.permissions.query.bind(window.navigator.permissions);
+      window.navigator.permissions.query = (parameters) =>
+        parameters && parameters.name === 'notifications'
+          ? Promise.resolve({ state: Notification.permission })
+          : _origQuery(parameters);
+    } catch {}
+    try {
+      if (!window.chrome) window.chrome = {};
+      if (!window.chrome.runtime) window.chrome.runtime = {};
+      window.chrome.runtime.connect = window.chrome.runtime.connect || function() {};
+      window.chrome.runtime.sendMessage = window.chrome.runtime.sendMessage || function() {};
+    } catch {}
+    try {
+      const patch = (Proto) => {
+        if (!Proto || !Proto.prototype || !Proto.prototype.getParameter) return;
+        const orig = Proto.prototype.getParameter;
+        Proto.prototype.getParameter = function(parameter) {
+          // UNMASKED_VENDOR_WEBGL / UNMASKED_RENDERER_WEBGL
+          if (parameter === 37445) return profile.webglVendor;
+          if (parameter === 37446) return profile.webglRenderer;
+          return orig.call(this, parameter);
+        };
+      };
+      patch(WebGLRenderingContext);
+      if (typeof WebGL2RenderingContext !== 'undefined') patch(WebGL2RenderingContext);
+    } catch {}
+  })();
+`;
+}
+
+function normalizeChromeVersion(browserVersion) {
+  const raw = String(browserVersion || "131.0.0.0");
+  // Playwright returns "131.0.6778.33" or sometimes "Chrome/131.0.6778.33"
+  const m = raw.match(/(\d+\.\d+\.\d+\.\d+|\d+\.\d+\.\d+)/);
+  return m ? m[1] : "131.0.0.0";
+}
+
+function getStealthUserAgent(browserVersion) {
+  const ver = normalizeChromeVersion(browserVersion);
+  const { uaPlatform } = getStealthPlatformProfile();
+  return `Mozilla/5.0 (${uaPlatform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
 }
 
 function wrapBrowserWithStealth(browser) {
   const origNewContext = browser.newContext.bind(browser);
+  const stealthScript = buildStealthInitScript();
   browser.newContext = async function (options = {}) {
     // Fix HeadlessChrome in User-Agent — Google detects this server-side
     if (!options.userAgent) {
-      const ver = browser.version ? browser.version() : "131.0.0.0";
+      let ver = "131.0.0.0";
+      try {
+        ver = typeof browser.version === "function" ? browser.version() : ver;
+      } catch {
+        /* ignore */
+      }
       options.userAgent = getStealthUserAgent(ver);
     }
+    // Keep locale consistent with UA language list (en-US)
+    if (!options.locale) options.locale = "en-US";
     const ctx = await origNewContext(options);
-    await ctx.addInitScript(STEALTH_INIT_SCRIPT);
+    await ctx.addInitScript(stealthScript);
     return ctx;
   };
   return browser;

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -437,13 +437,14 @@ export async function createFreshContext(browser, proxy) {
   }
 
   const page = await context.newPage();
-  // Abort third-party trackers only. Do NOT intercept "**/*" with continue() —
-  // Playwright route interception on every request breaks Google→Cognito OAuth
-  // redirect chains (consent 302 → idpresponse 302 → kiro:// Location is dropped
-  // and the main frame parks forever on empty SetSID).
+  // Abort NON-Google trackers only. Do NOT block googletagmanager / gstatic /
+  // googleadservices / google-analytics — Google sign-in / reCAPTCHA enterprise
+  // load beacons from those hosts; aborting them raises CAPTCHA rate vs the
+  // old high-concurrency bulk that left Google domains alone.
+  // Also never intercept "**/*" with continue() (breaks OAuth Location:kiro://).
   try {
     await page.route(
-      /googletagmanager|googleadservices|google-analytics|doubleclick|facebook\.net|hotjar|clarity\.ms|hm\.baidu|sentry\.io|browser\.sentry-cdn/i,
+      /facebook\.net|hotjar|clarity\.ms|hm\.baidu|sentry\.io|browser\.sentry-cdn|doubleclick\.net/i,
       (route) => route.abort(),
     );
   } catch {

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -221,9 +221,18 @@ const MANUAL_ASSIST_MARKERS = [
   "suspicious sign-in prevented",
   "unusual activity detected",
   "captcha",
+  "i'm not a robot",
+  "im not a robot",
+  "not a robot",
+  "recaptcha",
+  "select all images",
+  "select all squares",
   "try again later",
   "browser or app may not be secure",
   "try using a different browser",
+  "couldn\u2019t sign you in",
+  "couldn't sign you in",
+  "this browser or app may not be secure",
 ];
 
 const RESTRICTED_ACCOUNT_MARKERS = [
@@ -1666,10 +1675,18 @@ export async function runGoogleAccountAutomation({
     }
 
     if (includesAny(text, MANUAL_ASSIST_MARKERS)) {
-      reportStep("manual_assist_required", "Google requested CAPTCHA, 2FA, or recovery verification");
+      const isCaptcha = /captcha|recaptcha|not a robot|select all images|select all squares/i.test(text);
+      reportStep(
+        isCaptcha ? "google_captcha" : "manual_assist_required",
+        isCaptcha
+          ? "Google CAPTCHA / bot check"
+          : "Google requested CAPTCHA, 2FA, or recovery verification",
+      );
       return {
         status: "needs_manual",
-        error: "Manual assist required in the browser session (CAPTCHA, 2FA, recovery, or suspicious-login challenge).",
+        error: isCaptcha
+          ? "Google CAPTCHA (bot check). Not fixed by lowering workers — use headed Chromium+Xvfb or Camoufox, residential proxy, and avoid blocking Google domains. Open manual assist to solve CAPTCHA once."
+          : "Manual assist required in the browser session (CAPTCHA, 2FA, recovery, or suspicious-login challenge).",
       };
     }