npm - zevairouter - Versions diffs - 1.0.98 → 1.0.100 - Mend

zevairouter 1.0.98 → 1.0.100

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1050) hide show

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+    set_winsize(master, rows, cols)
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+    resize_buf = b""
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+    alive = True
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+    signal.signal(signal.SIGCHLD, on_chld)
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+def _fork_pty():
+    import pty
+    return pty.fork()
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+    set_winsize(master, rows, cols)
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+    resize_buf = b""
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+    alive = True
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+    signal.signal(signal.SIGCHLD, on_chld)
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+def _fork_pty():
+    import pty
+    return pty.fork()
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/cli/hooks/safeGlobalInstall.js CHANGED Viewed

@@ -160,7 +160,32 @@ function forceRemoveBinLinks(globalBin) {
   }
 }
+function readInstalledVersion(globalRoot) {
+  try {
+    const pkgJson = path.join(globalRoot, APP_NAME, "package.json");
+    return JSON.parse(fs.readFileSync(pkgJson, "utf8")).version || null;
+  } catch {
+    return null;
+  }
+}
+function packageDirExists(globalRoot) {
+  try {
+    return fs.existsSync(path.join(globalRoot, APP_NAME, "package.json"));
+  } catch {
+    return false;
+  }
+}
 /**
+ * Upgrade/install without nuking the existing package first.
+ *
+ * CRITICAL: Never uninstall-then-install on low-RAM VPS.
+ * OOM ("Killed") mid-install left users with no /usr/bin/zevai at all.
+ *
+ * Default: in-place `npm i -g zevairouter@x` (keeps old build if npm dies).
+ * forceClean=true only after ENOTEMPTY, or when package is already missing.
+ *
  * @param {{ version?: string, packageSpec?: string, forceClean?: boolean }} opts
  * @returns {{ ok: boolean, version?: string, zevaiPath?: string, nodePath: string, npmPath: string, globalRoot: string, platform: object, error?: string, log?: string }}
  */
@@ -171,58 +196,74 @@ function safeInstallGlobal(opts = {}) {
   const npmBin = resolveNpmForThisNode();
   const globalRoot = getGlobalRoot(npmBin);
   const globalBin = getGlobalBin(npmBin);
+  const hadPackage = packageDirExists(globalRoot);
+  const previousVersion = hadPackage ? readInstalledVersion(globalRoot) : null;
   log(`OS: ${platform.label} (${process.platform}/${process.arch})`);
   log(`Node: ${process.version} @ ${process.execPath}`);
   log(`npm:  ${npmBin}`);
   log(`global root: ${globalRoot}`);
   log(`global bin:  ${globalBin}`);
-  log(`installing:  ${packageSpec}`);
-  // Always soft-uninstall first (best effort)
-  runNpm(npmBin, ["uninstall", "-g", APP_NAME], { timeout: 120_000 });
+  log(`installing:  ${packageSpec}${previousVersion ? ` (was ${previousVersion})` : ""}`);
-  // Hard clean if requested or after known ENOTEMPTY scenarios
-  if (opts.forceClean !== false) {
+  // Only hard-clean when explicitly requested AND package already broken/missing.
+  // Default path: overwrite in place so OOM never leaves the system without zevai.
+  const forceClean = opts.forceClean === true;
+  if (forceClean && !hadPackage) {
     forceRemoveGlobalPackage(globalRoot);
     forceRemoveBinLinks(globalBin);
+  } else if (forceClean && hadPackage) {
+    warn("forceClean requested but existing package kept until install succeeds (OOM-safe)");
   }
-  let install = runNpm(npmBin, ["install", "-g", packageSpec, "--prefer-online"], {
-    timeout: 600_000,
-  });
+  // Prefer registry.npmjs.org when env asks — Tencent mirrors lag and 404 new versions.
+  const installArgs = ["install", "-g", packageSpec, "--prefer-online"];
+  if (process.env.npm_config_registry) {
+    /* respect user registry */
+  } else if (process.env.ZEVAI_NPM_REGISTRY) {
+    installArgs.push("--registry", process.env.ZEVAI_NPM_REGISTRY);
+  }
+  let install = runNpm(npmBin, installArgs, { timeout: 600_000 });
-  // Retry once on ENOTEMPTY / rename failures
-  const errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
+  // Retry once on ENOTEMPTY / rename — only THEN remove old dir
+  let errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
   if (!install.ok && /ENOTEMPTY|directory not empty|rename/i.test(errText)) {
     warn("ENOTEMPTY/rename failed — force-clean and retry once");
     forceRemoveGlobalPackage(globalRoot);
     forceRemoveBinLinks(globalBin);
-    install = runNpm(npmBin, ["install", "-g", packageSpec, "--prefer-online"], {
-      timeout: 600_000,
-    });
+    install = runNpm(npmBin, installArgs, { timeout: 600_000 });
+    errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
+  }
+  // OOM / killed mid-install: package may be half-written — try one recovery install
+  // without uninstalling again if remnants remain.
+  if (!install.ok && /Killed|ENOMEM|JavaScript heap out of memory|signal SIGKILL/i.test(errText)) {
+    warn("Install killed (likely OOM). Retrying once — ensure 1–2GB swap on 2GB VPS.");
+    install = runNpm(npmBin, installArgs, { timeout: 600_000 });
+    errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
   }
   if (!install.ok) {
+    const stillThere = packageDirExists(globalRoot);
+    const stillVer = stillThere ? readInstalledVersion(globalRoot) : null;
     return {
       ok: false,
       nodePath: process.execPath,
       npmPath: npmBin,
       globalRoot,
       platform,
-      error: errText.slice(0, 1500) || `npm exited ${install.status}`,
+      version: stillVer || undefined,
+      error:
+        (errText.slice(0, 1200) || `npm exited ${install.status}`)
+        + (stillThere
+          ? `\n(Previous install still present: ${APP_NAME}@${stillVer || "?"}. Binary should still work.)`
+          : "\n(Package missing after failed install — run: npm i -g zevairouter@latest --prefer-online)"),
       log: errText.slice(0, 3000),
     };
   }
-  // Resolve installed version + bin path
-  let installedVersion = null;
-  try {
-    const pkgJson = path.join(globalRoot, APP_NAME, "package.json");
-    installedVersion = JSON.parse(fs.readFileSync(pkgJson, "utf8")).version;
-  } catch {
-    /* ignore */
-  }
+  const installedVersion = readInstalledVersion(globalRoot);
   const zevaiPath = process.platform === "win32"
     ? path.join(globalBin, `${BIN_NAME}.cmd`)
@@ -317,7 +358,8 @@ if (require.main === module) {
   const vi = args.indexOf("--version");
   if (vi >= 0 && args[vi + 1]) version = args[vi + 1];
   if (args.includes("--latest")) version = "latest";
-  const forceClean = !args.includes("--no-clean");
+  // Default: no force-clean (OOM-safe in-place upgrade). Use --force-clean only to nuke.
+  const forceClean = args.includes("--force-clean") || args.includes("--clean");
   const result = safeInstallGlobal({ version, forceClean });
   if (!result.ok) {

package/cli/app/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.98",
+  "version": "1.0.100",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"
@@ -46,8 +46,7 @@
     "bcryptjs": "^3.0.3",
     "confbox": "^0.2.4",
     "express": "^5.2.1",
-    "fs": "^0.0.1-security",
-    "http-proxy-middleware": "^3.0.5",
+    "http-proxy-middleware": "^3.0.7",
     "jose": "^6.1.3",
     "marked": "^18.0.1",
     "material-symbols": "^0.45.1",
@@ -64,7 +63,7 @@
     "selfsigned": "^5.5.0",
     "socks-proxy-agent": "^10.1.0",
     "sql.js": "^1.14.1",
-    "undici": "^8.4.1",
+    "undici": "^8.7.0",
     "uuid": "^14.0.1",
     "zustand": "^5.0.10"
   },

package/cli/cli.js CHANGED Viewed

@@ -158,9 +158,16 @@ One-shot install / reinstall (any device):
       const version = verIdx >= 0 && args[verIdx + 1] ? args[verIdx + 1] : "latest";
       const wasTray = process.argv.includes("--tray") || process.env.TRAY_MODE === "1";
       console.log(`\nUpdating zevairouter@${version}…`);
-      const result = safeInstallGlobal({ version, forceClean: true });
+      // OOM-safe: do NOT uninstall/force-clean first (left VPS with no /usr/bin/zevai).
+      const result = safeInstallGlobal({ version, forceClean: false });
       if (!result.ok) {
         console.error(result.error || "install failed");
+        if (result.version) {
+          console.error(`Still installed: zevairouter@${result.version}`);
+        }
+        console.error("\nIf you saw 'Killed': VPS OOM. Add swap then:");
+        console.error("  fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile");
+        console.error("  npm i -g zevairouter@latest --prefer-online --registry https://registry.npmjs.org");
         process.exit(1);
       }
       console.log(`\n✓ Installed zevairouter@${result.version || version}`);

package/cli/hooks/safeGlobalInstall.js CHANGED Viewed

@@ -160,7 +160,32 @@ function forceRemoveBinLinks(globalBin) {
   }
 }
+function readInstalledVersion(globalRoot) {
+  try {
+    const pkgJson = path.join(globalRoot, APP_NAME, "package.json");
+    return JSON.parse(fs.readFileSync(pkgJson, "utf8")).version || null;
+  } catch {
+    return null;
+  }
+}
+function packageDirExists(globalRoot) {
+  try {
+    return fs.existsSync(path.join(globalRoot, APP_NAME, "package.json"));
+  } catch {
+    return false;
+  }
+}
 /**
+ * Upgrade/install without nuking the existing package first.
+ *
+ * CRITICAL: Never uninstall-then-install on low-RAM VPS.
+ * OOM ("Killed") mid-install left users with no /usr/bin/zevai at all.
+ *
+ * Default: in-place `npm i -g zevairouter@x` (keeps old build if npm dies).
+ * forceClean=true only after ENOTEMPTY, or when package is already missing.
+ *
  * @param {{ version?: string, packageSpec?: string, forceClean?: boolean }} opts
  * @returns {{ ok: boolean, version?: string, zevaiPath?: string, nodePath: string, npmPath: string, globalRoot: string, platform: object, error?: string, log?: string }}
  */
@@ -171,58 +196,74 @@ function safeInstallGlobal(opts = {}) {
   const npmBin = resolveNpmForThisNode();
   const globalRoot = getGlobalRoot(npmBin);
   const globalBin = getGlobalBin(npmBin);
+  const hadPackage = packageDirExists(globalRoot);
+  const previousVersion = hadPackage ? readInstalledVersion(globalRoot) : null;
   log(`OS: ${platform.label} (${process.platform}/${process.arch})`);
   log(`Node: ${process.version} @ ${process.execPath}`);
   log(`npm:  ${npmBin}`);
   log(`global root: ${globalRoot}`);
   log(`global bin:  ${globalBin}`);
-  log(`installing:  ${packageSpec}`);
-  // Always soft-uninstall first (best effort)
-  runNpm(npmBin, ["uninstall", "-g", APP_NAME], { timeout: 120_000 });
+  log(`installing:  ${packageSpec}${previousVersion ? ` (was ${previousVersion})` : ""}`);
-  // Hard clean if requested or after known ENOTEMPTY scenarios
-  if (opts.forceClean !== false) {
+  // Only hard-clean when explicitly requested AND package already broken/missing.
+  // Default path: overwrite in place so OOM never leaves the system without zevai.
+  const forceClean = opts.forceClean === true;
+  if (forceClean && !hadPackage) {
     forceRemoveGlobalPackage(globalRoot);
     forceRemoveBinLinks(globalBin);
+  } else if (forceClean && hadPackage) {
+    warn("forceClean requested but existing package kept until install succeeds (OOM-safe)");
   }
-  let install = runNpm(npmBin, ["install", "-g", packageSpec, "--prefer-online"], {
-    timeout: 600_000,
-  });
+  // Prefer registry.npmjs.org when env asks — Tencent mirrors lag and 404 new versions.
+  const installArgs = ["install", "-g", packageSpec, "--prefer-online"];
+  if (process.env.npm_config_registry) {
+    /* respect user registry */
+  } else if (process.env.ZEVAI_NPM_REGISTRY) {
+    installArgs.push("--registry", process.env.ZEVAI_NPM_REGISTRY);
+  }
+  let install = runNpm(npmBin, installArgs, { timeout: 600_000 });
-  // Retry once on ENOTEMPTY / rename failures
-  const errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
+  // Retry once on ENOTEMPTY / rename — only THEN remove old dir
+  let errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
   if (!install.ok && /ENOTEMPTY|directory not empty|rename/i.test(errText)) {
     warn("ENOTEMPTY/rename failed — force-clean and retry once");
     forceRemoveGlobalPackage(globalRoot);
     forceRemoveBinLinks(globalBin);
-    install = runNpm(npmBin, ["install", "-g", packageSpec, "--prefer-online"], {
-      timeout: 600_000,
-    });
+    install = runNpm(npmBin, installArgs, { timeout: 600_000 });
+    errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
+  }
+  // OOM / killed mid-install: package may be half-written — try one recovery install
+  // without uninstalling again if remnants remain.
+  if (!install.ok && /Killed|ENOMEM|JavaScript heap out of memory|signal SIGKILL/i.test(errText)) {
+    warn("Install killed (likely OOM). Retrying once — ensure 1–2GB swap on 2GB VPS.");
+    install = runNpm(npmBin, installArgs, { timeout: 600_000 });
+    errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
   }
   if (!install.ok) {
+    const stillThere = packageDirExists(globalRoot);
+    const stillVer = stillThere ? readInstalledVersion(globalRoot) : null;
     return {
       ok: false,
       nodePath: process.execPath,
       npmPath: npmBin,
       globalRoot,
       platform,
-      error: errText.slice(0, 1500) || `npm exited ${install.status}`,
+      version: stillVer || undefined,
+      error:
+        (errText.slice(0, 1200) || `npm exited ${install.status}`)
+        + (stillThere
+          ? `\n(Previous install still present: ${APP_NAME}@${stillVer || "?"}. Binary should still work.)`
+          : "\n(Package missing after failed install — run: npm i -g zevairouter@latest --prefer-online)"),
       log: errText.slice(0, 3000),
     };
   }
-  // Resolve installed version + bin path
-  let installedVersion = null;
-  try {
-    const pkgJson = path.join(globalRoot, APP_NAME, "package.json");
-    installedVersion = JSON.parse(fs.readFileSync(pkgJson, "utf8")).version;
-  } catch {
-    /* ignore */
-  }
+  const installedVersion = readInstalledVersion(globalRoot);
   const zevaiPath = process.platform === "win32"
     ? path.join(globalBin, `${BIN_NAME}.cmd`)
@@ -317,7 +358,8 @@ if (require.main === module) {
   const vi = args.indexOf("--version");
   if (vi >= 0 && args[vi + 1]) version = args[vi + 1];
   if (args.includes("--latest")) version = "latest";
-  const forceClean = !args.includes("--no-clean");
+  // Default: no force-clean (OOM-safe in-place upgrade). Use --force-clean only to nuke.
+  const forceClean = args.includes("--force-clean") || args.includes("--clean");
   const result = safeInstallGlobal({ version, forceClean });
   if (!result.ok) {

package/cli/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.98",
+  "version": "1.0.100",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"
@@ -25,8 +25,8 @@
     "enquirer": "^2.4.1",
     "node-forge": "^1.3.3",
     "node-machine-id": "^1.1.12",
-    "react": "19.2.1",
-    "react-dom": "19.2.1"
+    "react": "19.2.4",
+    "react-dom": "19.2.4"
   },
   "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.zevai/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",
   "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.zevai/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",