zevairouter 1.0.89 → 1.0.91

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.89",
+  "version": "1.0.91",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.89",
+  "version": "1.0.91",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.89",
+  "version": "1.0.91",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/cloudflareAiBulkImportManager.js

@@ -15,56 +15,72 @@ import {
   KIRO_BULK_IMPORT_MAX_CONCURRENCY,
   KIRO_BULK_IMPORT_MIN_CONCURRENCY,
 } from "./kiroBulkImportManager.js";
-import { runGoogleAccountAutomation } from "./kiroGoogleAutomation.js";
+import { runGoogleAccountAutomation, __test__ as googleTest } from "./kiroGoogleAutomation.js";
 
 const CLOUDFLARE_AI_PROVIDER_ID = "cloudflare-ai";
 const CLOUDFLARE_AI_LABEL = "Cloudflare Workers AI";
 const CF_LOGIN_URL = "https://dash.cloudflare.com/login";
 const CF_HARVEST_TIMEOUT_MS = 4 * 60_000;
 
-function wait(ms) {
+const { dismissCookieBanners, clickGoogleLoginRole, waitUntil: waitUntilUi } = googleTest;
+
+function yieldMs(ms = 50) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
+async function waitUntil(checkFn, { timeout = 8_000, interval = 80 } = {}) {
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
+    try {
+      if (await checkFn()) return true;
+    } catch {
+      /* retry */
+    }
+    await yieldMs(interval);
+  }
+  return false;
+}
+
 function isCloudflareDashboard(url) {
   try {
     const u = new URL(url);
-    return (
-      u.hostname === "dash.cloudflare.com"
-      && !u.pathname.includes("/login")
-      && !u.href.includes("oidcJwt")
-    );
+    if (u.hostname !== "dash.cloudflare.com") return false;
+    // Still on OAuth return /login/google?oidcJwt=… — not ready for token API
+    if (u.pathname.includes("/login")) return false;
+    if (u.href.includes("oidcJwt")) return false;
+    return true;
   } catch {
     return false;
   }
 }
 
 async function dismissCloudflarePostLogin(page) {
+  // Only dismiss known post-login modals — never generic Allow/Continue/Accept
+  // (those match OneTrust "Allow All" and random dashboard actions, which
+  // thrash the page and starve the token harvest evaluate for ~60s).
   const labels = [
-    /i understand/i,
-    /got it/i,
-    /continue/i,
-    /allow/i,
-    /accept/i,
-    /log in/i,
-    /login/i,
+    /^i understand$/i,
+    /^got it$/i,
+    /^dismiss$/i,
+    /^close$/i,
+    /^not now$/i,
+    /^skip$/i,
   ];
   for (const re of labels) {
     try {
       const btn = page.getByRole("button", { name: re }).first();
-      if (await btn.isVisible({ timeout: 300 }).catch(() => false)) {
+      if (await btn.isVisible({ timeout: 120 }).catch(() => false)) {
         const text = ((await btn.innerText().catch(() => "")) || "").toLowerCase();
-        if (/google/.test(text)) continue;
-        await btn.click({ timeout: 3_000 }).catch(() => null);
-        await wait(400);
+        if (/google|apple|github|sso|sign in|log in|allow all|accept all|reject/i.test(text)) {
+          continue;
+        }
+        await btn.click({ timeout: 2_000, noWaitAfter: true }).catch(() => null);
         return true;
       }
     } catch {
       /* next */
     }
   }
-  // Scroll bottom — CF sometimes parks allow off-screen
-  await page.keyboard.press("End").catch(() => null);
   return false;
 }
 
@@ -72,95 +88,143 @@ async function dismissCloudflarePostLogin(page) {
  * Create Workers AI API token while page holds CF dashboard session cookies.
  */
 export async function harvestCloudflareWorkersAiToken(page) {
-  return page.evaluate(async () => {
-    const getJson = async (path, init) => {
-      const resp = await fetch(path, {
-        credentials: "include",
-        headers: { Accept: "application/json", ...(init?.headers || {}) },
-        ...init,
-      });
-      const data = await resp.json().catch(() => null);
-      return { status: resp.status, ok: resp.ok, data };
+  // Use browser context request (same cookies + proxy as the session). Avoids
+  // page.evaluate contention with the automation loop, and avoids Node fetch
+  // which would bypass the residential proxy.
+  const origin = "https://dash.cloudflare.com";
+  const request = page.context().request;
+  const cookies = await page.context().cookies(origin).catch(() => []);
+  if (!cookies || cookies.length < 2) {
+    throw new Error("Cloudflare session cookies not ready yet");
+  }
+
+  const getJson = async (path, init = {}) => {
+    const method = String(init.method || "GET").toUpperCase();
+    // Token create is slower through residential proxy than GET accounts.
+    const timeout = method === "POST" ? 15_000 : 8_000;
+    const opts = {
+      headers: {
+        Accept: "application/json",
+        ...(init.headers || {}),
+      },
+      timeout,
     };
+    if (init.body != null) opts.data = typeof init.body === "string" ? JSON.parse(init.body) : init.body;
+    const resp = method === "POST"
+      ? await request.post(`${origin}${path}`, opts)
+      : await request.get(`${origin}${path}`, opts);
+    const data = await resp.json().catch(() => null);
+    return { status: resp.status(), ok: resp.ok(), data };
+  };
 
-    const accountsRes = await getJson("/api/v4/accounts");
-    if (accountsRes.status !== 200 || !accountsRes.data?.success) {
-      throw new Error(
-        `Account list failed (${accountsRes.status}): ${JSON.stringify(accountsRes.data?.errors || []).slice(0, 200)}`,
-      );
-    }
-    const accounts = accountsRes.data?.result || [];
-    if (!accounts.length) throw new Error("No Cloudflare accounts found for this user");
-    const accountId = accounts[0]?.id;
-    if (!accountId) throw new Error("Empty Cloudflare account ID");
-
-    const permRes = await getJson("/api/v4/user/tokens/permission_groups");
-    if (permRes.status !== 200 || !permRes.data?.success) {
-      throw new Error(
-        `Permission groups failed (${permRes.status}): ${JSON.stringify(permRes.data?.errors || []).slice(0, 200)}`,
-      );
-    }
-    const groups = permRes.data?.result || [];
-    const workersAiGroups = groups
-      .filter((g) => String(g.name || "").toLowerCase().includes("workers ai"))
-      .map((g) => ({ id: g.id, name: g.name || "" }));
-    if (!workersAiGroups.length) {
-      throw new Error("No Workers AI permission groups found (account may lack Workers AI)");
-    }
+  const accountsRes = await getJson("/api/v4/accounts");
+  if (accountsRes.status === 401 || accountsRes.status === 403) {
+    throw new Error(`Not authenticated yet (${accountsRes.status})`);
+  }
+  if (accountsRes.status !== 200 || !accountsRes.data?.success) {
+    throw new Error(
+      `Account list failed (${accountsRes.status}): ${JSON.stringify(accountsRes.data?.errors || []).slice(0, 200)}`,
+    );
+  }
+  const accounts = accountsRes.data?.result || [];
+  if (!accounts.length) throw new Error("No Cloudflare accounts found for this user");
+  const accountId = accounts[0]?.id;
+  if (!accountId) throw new Error("Empty Cloudflare account ID");
 
-    const payload = {
-      name: `zevai-cf-ai-${Math.floor(Date.now() / 1000)}`,
-      policies: [
-        {
-          effect: "allow",
-          permission_groups: workersAiGroups.map((p) => ({ id: p.id })),
-          resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
-        },
-      ],
-    };
+  const permRes = await getJson("/api/v4/user/tokens/permission_groups");
+  if (permRes.status !== 200 || !permRes.data?.success) {
+    throw new Error(
+      `Permission groups failed (${permRes.status}): ${JSON.stringify(permRes.data?.errors || []).slice(0, 200)}`,
+    );
+  }
+  const groups = permRes.data?.result || [];
+  const workersAiGroups = groups
+    .filter((g) => String(g.name || "").toLowerCase().includes("workers ai"))
+    .map((g) => ({ id: g.id, name: g.name || "" }));
+  if (!workersAiGroups.length) {
+    throw new Error("No Workers AI permission groups found (account may lack Workers AI)");
+  }
 
-    const tokenRes = await getJson("/api/v4/user/tokens", {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify(payload),
-    });
-    if (tokenRes.status !== 200 || !tokenRes.data?.success) {
-      throw new Error(
-        `Token create failed (${tokenRes.status}): ${JSON.stringify(tokenRes.data?.errors || []).slice(0, 240)}`,
-      );
-    }
-    const apiKey = tokenRes.data?.result?.value;
-    if (!apiKey) throw new Error("Empty API token value from Cloudflare");
+  const payload = {
+    name: `zevai-cf-ai-${Math.floor(Date.now() / 1000)}`,
+    policies: [
+      {
+        effect: "allow",
+        permission_groups: workersAiGroups.map((p) => ({ id: p.id })),
+        resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+      },
+    ],
+  };
 
-    return {
-      accountId,
-      apiKey,
-      accountName: accounts[0]?.name || "",
-    };
+  const tokenRes = await getJson("/api/v4/user/tokens", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify(payload),
   });
+  if (tokenRes.status !== 200 || !tokenRes.data?.success) {
+    throw new Error(
+      `Token create failed (${tokenRes.status}): ${JSON.stringify(tokenRes.data?.errors || []).slice(0, 240)}`,
+    );
+  }
+  const apiKey = tokenRes.data?.result?.value;
+  if (!apiKey) throw new Error("Empty API token value from Cloudflare");
+
+  return {
+    accountId,
+    apiKey,
+    accountName: accounts[0]?.name || "",
+  };
 }
 
 function createCloudflareHarvestPromise(page, { timeoutMs = CF_HARVEST_TIMEOUT_MS, onStep, cancelCheck } = {}) {
   return (async () => {
     const start = Date.now();
     let lastErr = "";
+    let failBackoffMs = 100;
     while (Date.now() - start < timeoutMs) {
       if (cancelCheck?.()) throw new Error("Job cancelled during Cloudflare harvest");
       const url = page.url?.() || "";
-      if (isCloudflareDashboard(url)) {
-        await dismissCloudflarePostLogin(page);
-        try {
-          onStep?.("harvesting_cf_token", "Creating Cloudflare Workers AI API token");
-          const result = await harvestCloudflareWorkersAiToken(page);
-          if (result?.apiKey && result?.accountId) return result;
-        } catch (e) {
-          lastErr = String(e?.message || e);
-          onStep?.("harvest_retry", lastErr.slice(0, 140));
+
+      if (!isCloudflareDashboard(url)) {
+        // OAuth return /login/google?oidcJwt=… — wait for CF to finish routing.
+        if (url.includes("oidcJwt") || /\/login\//i.test(url)) {
+          onStep?.(
+            "waiting_cf_dashboard",
+            "Waiting for Cloudflare dashboard after Google OAuth",
+          );
         }
-      } else {
         await dismissCloudflarePostLogin(page);
+        // Event-driven: wait for dash (not a blind 1.2s sleep).
+        const landed = await waitUntil(
+          () => isCloudflareDashboard(page.url?.() || ""),
+          { timeout: 1_500, interval: 80 },
+        );
+        if (!landed) await yieldMs(80);
+        continue;
       }
-      await wait(1_200);
+
+      await dismissCloudflarePostLogin(page);
+      try {
+        onStep?.("harvesting_cf_token", "Creating Cloudflare Workers AI API token");
+        // Cap evaluate network work so a hung CF API cannot stall the job for minutes.
+        // Through residential proxy account/token APIs usually finish in a few seconds;
+        // 12s is enough — fail fast and retry with fresh session settle.
+        const result = await Promise.race([
+          harvestCloudflareWorkersAiToken(page),
+          yieldMs(12_000).then(() => {
+            throw new Error("Cloudflare token harvest timed out (12s)");
+          }),
+        ]);
+        if (result?.apiKey && result?.accountId) return result;
+      } catch (e) {
+        lastErr = String(e?.message || e);
+        onStep?.("harvest_retry", lastErr.slice(0, 140));
+        // Session may still be settling — short backoff only on error.
+        await yieldMs(failBackoffMs);
+        failBackoffMs = Math.min(failBackoffMs + 150, 800);
+        continue;
+      }
+      await yieldMs(80);
     }
     throw new Error(
       lastErr
@@ -244,6 +308,48 @@ class CloudflareAiBulkImportManager extends KiroBulkImportManager {
       );
       await this.persistJobSnapshot(job, { forcePreview: true });
 
+      // Fast open: CF login has its own email/password form + cookie wall.
+      // Dismiss cookies and click Google SSO BEFORE shared automation so we
+      // don't sit 30–40s matching the wrong email field / Allow All button.
+      // Critical: SSO click must use noWaitAfter (proxy makes Google nav >5s).
+      this.setAccountStep(account, "opening_cloudflare_login", "Opening Cloudflare login");
+      await page.goto(CF_LOGIN_URL, { waitUntil: "domcontentloaded", timeout: 60_000 });
+      await dismissCookieBanners(page, (step, message) => {
+        this.setAccountStep(account, step, message);
+        void this.persistJobSnapshot(job, { forcePreview: false });
+      });
+      // Wait for CF React shell to paint the Google SSO control (after domcontentloaded).
+      this.setAccountStep(account, "waiting_google_sso", "Waiting for Continue with Google on Cloudflare");
+      await this.persistJobSnapshot(job, { forcePreview: false });
+      const googleBtnReady = await waitUntilUi(
+        async () => {
+          try {
+            const btn = page.locator('button[aria-label*="Google" i]').first();
+            return (await btn.isVisible().catch(() => false))
+              && (await btn.isEnabled().catch(() => true));
+          } catch {
+            return false;
+          }
+        },
+        { timeout: 12_000, interval: 80 },
+      );
+      this.setAccountStep(
+        account,
+        "selecting_google_login",
+        googleBtnReady
+          ? "Clicking Continue with Google on Cloudflare"
+          : "Google SSO not ready yet — retrying via automation",
+      );
+      await this.persistJobSnapshot(job, { forcePreview: true });
+      let clickedGoogle = googleBtnReady ? await clickGoogleLoginRole(page) : false;
+      if (!clickedGoogle && googleBtnReady) {
+        // One more pass after a short paint settle (OT / SPA re-render).
+        await dismissCookieBanners(page, (step, message) => {
+          this.setAccountStep(account, step, message);
+          void this.persistJobSnapshot(job, { forcePreview: false });
+        });
+        clickedGoogle = await clickGoogleLoginRole(page);
+      }
       const automationResult = await runGoogleAccountAutomation({
         page,
         authUrl: CF_LOGIN_URL,
@@ -256,6 +362,9 @@ class CloudflareAiBulkImportManager extends KiroBulkImportManager {
         openingMessage: "Opening Cloudflare dashboard (Google login)",
         successStep: "cloudflare_token_created",
         successMessage: "Cloudflare Workers AI API token created",
+        // Already on CF login (and often already clicked Google) — don't re-goto.
+        skipGoto: true,
+        expectGoogleSoon: clickedGoogle,
         onStep: (step, message) => {
           this.setAccountStep(account, step, message);
           void this.persistJobSnapshot(job, { forcePreview: false });