zevairouter 1.1.24 → 1.1.26

package/cli/app/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Unreleased
 
+# v1.1.26 (2026-09-18)
+
+## Fixes
+- **Streamed Antigravity answers are recorded in request history instead of `[Empty streaming response]`.** Same-format passthrough accumulated content only inside its `choices` branch, so a Cloud Code chunk (`{response: {candidates: [...]}}`) contributed nothing. On a live install 100 of 428 Antigravity rows had stored `[Empty streaming response]` for answers the user did receive. Token accounting was never affected — `extractUsage` already read the wrapped shape — so this was a history/observability defect, not a billing one. Thinking parts stay separated from the answer text.
+- **`requireLogin=false` no longer authenticates remote callers.** `isAuthenticated()` returned true for any caller when that setting was false, and the deny-by-default `/api` branch consumes it, so on a listener bound to `0.0.0.0` or behind a tunnel every route not hand-listed in `LOCAL_ONLY_PATHS`/`ALWAYS_PROTECTED` was anonymous to the whole network. That included `GET /api/cli-tools/claude-settings` (returns `~/.claude/settings.json` with `ANTHROPIC_AUTH_TOKEN`), `GET /api/cli-tools/codex-settings`, and the provider-credential import routes. The bypass is now gated on a loopback-bound listener and a local request, so keeping those allow-lists exhaustive by hand is no longer a safety requirement.
+- **`ag/gemini-3.6-flash-*` works again instead of returning 504 after ~45s.** Antigravity returns response headers far slower than other providers on some Flash tiers: measured time-to-first-byte on a healthy path is 12–21s for 3.6 (4 samples, 2 accounts) against 2–5s for 3.8, while the generic connect budget was 15s. A connect timeout rotates accounts, so each request burned its whole 3-attempt budget on a model that was working. The connect budget is now provider-scoped for Antigravity (45s, `ANTIGRAVITY_CONNECT_TIMEOUT_MS`); the thinking budgets stay model-scoped. Verified end to end: 3.6 now answers in ~24s with no error chunk.
+
+# v1.1.25 (2026-09-18)
+
+## Fixes
+- **Antigravity CLI shows every model tier again while MITM is active.** MITM forced a single hardcoded `ideVersion`/User-Agent (`1.28.0`) on every forwarded request, and CLI 1.2.5 hides whole tiers when it believes it is an older IDE. Measured against a live account: 14 models with the override off, 8 with it on — the 3.8 and 3.7 tiers disappeared entirely, which is why they were visible without MITM but missing with it. The catalog response is byte-identical either way, so this was not a catalog problem: the same `tieredModelIds` payload is simply rendered differently by the client. The override is disabled; re-enabling it requires a per-client version the installed CLI actually reports, verified against the rendered model list rather than the catalog payload.
+  This also corrects the reasoning recorded for v1.1.23 and v1.1.24: `gemini-3.8-flash-*` was never dropped by the account. It moved to the `tieredModelIds` scheme, which earlier catalog inspection did not check.
+
 # v1.1.24 (2026-09-18)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.1.24",
+  "version": "1.1.26",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"