zevairouter 1.1.25 → 1.1.27

package/cli/app/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Unreleased
 
+# v1.1.27 (2026-09-18)
+
+## Fixes
+- **MITM log lines are no longer double-prefixed.** The MITM child formats its own output through the MITM logger, and the manager wrapped those already-formatted lines again, producing `[21:31:42] ❌ [MITM] [21:31:42] ❌ [MITM] …`. Lines carrying the child's tag now pass through verbatim; genuinely unformatted output such as a crash trace or a sudo complaint is still decorated.
+- **A withheld stream error now names the model that produced it.** When the router reports that a provider stream ended without a terminal event, MITM withholds that chunk so Antigravity's language server cannot dereference a missing `response` and segfault. The log line said only how many chunks had been forwarded, which gave no way to tell which alias slot was at fault — the usual cause being a slot whose upstream model the provider retired.
+
+# v1.1.26 (2026-09-18)
+
+## Fixes
+- **Streamed Antigravity answers are recorded in request history instead of `[Empty streaming response]`.** Same-format passthrough accumulated content only inside its `choices` branch, so a Cloud Code chunk (`{response: {candidates: [...]}}`) contributed nothing. On a live install 100 of 428 Antigravity rows had stored `[Empty streaming response]` for answers the user did receive. Token accounting was never affected — `extractUsage` already read the wrapped shape — so this was a history/observability defect, not a billing one. Thinking parts stay separated from the answer text.
+- **`requireLogin=false` no longer authenticates remote callers.** `isAuthenticated()` returned true for any caller when that setting was false, and the deny-by-default `/api` branch consumes it, so on a listener bound to `0.0.0.0` or behind a tunnel every route not hand-listed in `LOCAL_ONLY_PATHS`/`ALWAYS_PROTECTED` was anonymous to the whole network. That included `GET /api/cli-tools/claude-settings` (returns `~/.claude/settings.json` with `ANTHROPIC_AUTH_TOKEN`), `GET /api/cli-tools/codex-settings`, and the provider-credential import routes. The bypass is now gated on a loopback-bound listener and a local request, so keeping those allow-lists exhaustive by hand is no longer a safety requirement.
+- **`ag/gemini-3.6-flash-*` works again instead of returning 504 after ~45s.** Antigravity returns response headers far slower than other providers on some Flash tiers: measured time-to-first-byte on a healthy path is 12–21s for 3.6 (4 samples, 2 accounts) against 2–5s for 3.8, while the generic connect budget was 15s. A connect timeout rotates accounts, so each request burned its whole 3-attempt budget on a model that was working. The connect budget is now provider-scoped for Antigravity (45s, `ANTIGRAVITY_CONNECT_TIMEOUT_MS`); the thinking budgets stay model-scoped. Verified end to end: 3.6 now answers in ~24s with no error chunk.
+
 # v1.1.25 (2026-09-18)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.1.25",
+  "version": "1.1.27",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"

package/cli/app/src/mitm/server.js

@@ -22,12 +22,12 @@ ${c}`;qt.writeFileSync(n,v)}catch{}},file:n}}Wn.exports={log:Ku,err:Mu,dumpReque
 Private-Lines: `+u+`\r
 `,s+=f;var S=ma("putty-private-key-file-mac-key",t),A=Ce.util.createBuffer();mr(A,r),mr(A,n),mr(A,a),A.putInt32(i.length()),A.putBuffer(i),A.putInt32(l.length()),A.putBuffer(l);var B=Ce.hmac.create();return B.start("sha1",S),B.update(A.bytes()),s+=`\r
 Private-MAC: `+B.digest().toHex()+`\r
-`,s};Ca.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Ca.privateKeyToOpenSSH=function(e,t){return t?Ce.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"}):Ce.pki.privateKeyToPem(e)};Ca.getPublicKeyFingerprint=function(e,t){t=t||{};var a=t.md||Ce.md.md5.create(),r="ssh-rsa",n=Ce.util.createBuffer();mr(n,r),Et(n,e.e),Et(n,e.n),a.start(),a.update(n.getBytes());var s=a.digest();if(t.encoding==="hex"){var i=s.toHex();return t.delimiter?i.match(/.{2}/g).join(t.delimiter):i}else{if(t.encoding==="binary")return s.getBytes();if(t.encoding)throw new Error('Unknown encoding "'+t.encoding+'".')}return s};function Et(e,t){var a=t.toString(16);a[0]>="8"&&(a="00"+a);var r=Ce.util.hexToBytes(a);e.putInt32(r.length),e.putBytes(r)}function mr(e,t){e.putInt32(t.length),e.putString(t)}function ma(){for(var e=Ce.md.sha1.create(),t=arguments.length,a=0;a<t;++a)e.update(arguments[a]);return e.digest()}});var ho=F((yp,co)=>{co.exports=$();wt();Rs();lt();Hr();Ir();js();sr();Zs();ao();io();rn();ea();Qt();Wa();sn();uo();un();Ja();qa();oa();tt();za();fo();pn();re()});var vo=F((vp,yo)=>{var po=require("path"),Xe=require("fs"),Je=ho(),{MITM_DIR:Ea}=ar(),Ft=po.join(Ea,"rootCA.key"),It=po.join(Ea,"rootCA.crt");function go(e){try{let t=Je.pki.certificateFromPem(Xe.readFileSync(e,"utf8")),a=new Date(Date.now()+720*60*60*1e3);return t.validity.notAfter<a}catch{return!0}}async function Lc(){let e=Xe.existsSync(Ft)&&Xe.existsSync(It);if(e&&!go(It))return console.log("\u2705 Root CA already exists"),{key:Ft,cert:It};if(e){console.log("\u{1F510} Root CA expired or expiring soon \u2014 regenerating...");try{Xe.unlinkSync(Ft)}catch{}try{Xe.unlinkSync(It)}catch{}}Xe.existsSync(Ea)||Xe.mkdirSync(Ea,{recursive:!0}),console.log("\u{1F510} Generating Root CA certificate...");let t=Je.pki.rsa.generateKeyPair(2048),a=Je.pki.createCertificate();a.publicKey=t.publicKey,a.serialNumber="01",a.validity.notBefore=new Date,a.validity.notAfter=new Date,a.validity.notAfter.setFullYear(a.validity.notBefore.getFullYear()+10);let r=[{name:"commonName",value:"ZevaiRouter MITM Root CA"},{name:"organizationName",value:"ZevaiRouter"},{name:"countryName",value:"US"}];a.setSubject(r),a.setIssuer(r),a.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),a.sign(t.privateKey,Je.md.sha256.create());let n=Je.pki.privateKeyToPem(t.privateKey),s=Je.pki.certificateToPem(a);return Xe.writeFileSync(Ft,n),Xe.writeFileSync(It,s),console.log("\u2705 Root CA generated successfully"),{key:Ft,cert:It}}function Dc(){if(!Xe.existsSync(Ft)||!Xe.existsSync(It))throw new Error("Root CA not found. Generate it first.");let e=Xe.readFileSync(Ft,"utf8"),t=Xe.readFileSync(It,"utf8");return{key:Je.pki.privateKeyFromPem(e),cert:Je.pki.certificateFromPem(t)}}function kc(e,t){let a=Je.pki.rsa.generateKeyPair(2048),r=Je.pki.createCertificate();return r.publicKey=a.publicKey,r.serialNumber=Math.floor(Math.random()*1e6).toString(),r.validity.notBefore=new Date,r.validity.notAfter=new Date,r.validity.notAfter.setFullYear(r.validity.notBefore.getFullYear()+1),r.setSubject([{name:"commonName",value:e}]),r.setIssuer(t.cert.subject.attributes),r.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:e},{type:2,value:`*.${e}`}]}]),r.sign(t.key,Je.md.sha256.create()),{key:Je.pki.privateKeyToPem(a.privateKey),cert:Je.pki.certificateToPem(r)}}yo.exports={generateRootCA:Lc,loadRootCA:Dc,generateLeafCert:kc,isCertExpired:go,ROOT_CA_CERT_PATH:It,ROOT_CA_KEY_PATH:Ft}});var Co=F((xp,mo)=>{var mp=require("path"),Cp=require("fs"),{MITM_DIR:Ep}=ar(),{generateRootCA:Uc,loadRootCA:Pc,generateLeafCert:Oc}=vo();async function Vc(){return await Uc()}function Fc(e){try{let t=Pc(),a=Oc(e,t);return{key:a.key,cert:a.cert}}catch(t){return console.error(`Failed to generate cert for ${e}:`,t.message),null}}mo.exports={generateCert:Vc,getCertForDomain:Fc}});var To=F((Sp,So)=>{var Eo=require("fs"),Kc=require("path"),{DATA_DIR:Mc}=ar(),xo=Kc.join(Mc,"mitm","aliases.json");function qc(){try{return Eo.existsSync(xo)?JSON.parse(Eo.readFileSync(xo,"utf-8")):null}catch{return null}}function Hc(e){return qc()?.[e]||null}So.exports={getMitmAlias:Hc}});var Bo=F((Tp,Io)=>{"use strict";var er="1.28.0";function Gc(e){return!e||typeof e!="object"||Array.isArray(e)?!1:String(e.ideName||"").toLowerCase()==="antigravity"||String(e.ideType||"").toUpperCase()==="ANTIGRAVITY"?!0:Object.prototype.hasOwnProperty.call(e,"ideVersion")}function Ao(e,t){return typeof e!="string"||!e.includes("antigravity/")?e:e.replace(/antigravity\/[^\s]+/,`antigravity/${t}`)}function zc(e,t){return{bodyBuffer:e,headers:t,applied:!1,version:er}}Io.exports={ANTIGRAVITY_IDE_VERSION:er,applyAntigravityIdeVersionOverride:zc,rewriteAntigravityUserAgent:Ao}});var Ro=F((Ap,wo)=>{var bo="forward",_o="sentinel",No="error",xa="malformed";function Qc(e){if(e==="[DONE]")return{action:_o};let t;try{t=JSON.parse(e)}catch{return{action:xa}}return!t||typeof t!="object"||Array.isArray(t)?{action:xa}:t.response&&typeof t.response=="object"?{action:bo}:t.error!==void 0?{action:No,error:t.error}:{action:xa}}wo.exports={classifyGeminiSseData:Qc,FORWARD:bo,SENTINEL:_o,ERROR:No,MALFORMED:xa}});var Ta=F((Ip,ko)=>{var{log:Sa,err:$c}=Gt(),{classifyGeminiSseData:Yc,FORWARD:jc,ERROR:Wc}=Ro(),Lo="http://localhost:1997",Xc=String(process.env.MITM_ROUTER_BASE||Lo).trim().replace(/\/+$/,"")||Lo,Do=process.env.ROUTER_API_KEY,Jc=new Set(["host","content-length","connection","transfer-encoding","content-type","authorization"]);async function Zc(e,t="/v1/chat/completions",a={}){let r={};for(let[s,i]of Object.entries(a))Jc.has(s.toLowerCase())||(r[s]=i);return await fetch(`${Xc}${t}`,{method:"POST",headers:{...r,"Content-Type":"application/json",...Do&&{Authorization:`Bearer ${Do}`}},body:JSON.stringify(e)})}async function ed(e,t,a){let r=e.headers.get("content-type")||"application/json",n=e.status||200,s={"Content-Type":r,"Cache-Control":"no-cache",Connection:"keep-alive"};if(r.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(n,s),a&&a.writeHeader(e.status,Object.fromEntries(e.headers)),!e.body){let u=await e.text().catch(()=>"");a&&(a.writeChunk(u),a.end()),t.end(u);return}let i=e.body.getReader(),o=new TextDecoder;for(;;){let{done:u,value:l}=await i.read();if(u){a&&a.end(),t.end();break}a&&a.writeChunk(l),t.write(o.decode(l,{stream:!0}))}}async function td(e,t,a){let r=e.headers.get("content-type")||"application/json",n=e.status||200,s={"Content-Type":r,"Cache-Control":"no-cache",Connection:"keep-alive"};if(r.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(n,s),a&&a.writeHeader(e.status,Object.fromEntries(e.headers)),!e.body||!r.includes("text/event-stream")){let g=await e.text().catch(()=>"");a&&(a.writeChunk(g),a.end()),t.end(g);return}let i=e.body.getReader(),o=new TextDecoder("utf-8",{fatal:!1}),u="",l=0,f=null,c=g=>{let v=g.trim();if(!v||!v.startsWith("data:"))return;let y=v.slice(5).trim();if(!y)return;let{action:x,error:S}=Yc(y);if(x===jc){l+=1,t.write(`data: ${y}
+`,s};Ca.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Ca.privateKeyToOpenSSH=function(e,t){return t?Ce.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"}):Ce.pki.privateKeyToPem(e)};Ca.getPublicKeyFingerprint=function(e,t){t=t||{};var a=t.md||Ce.md.md5.create(),r="ssh-rsa",n=Ce.util.createBuffer();mr(n,r),Et(n,e.e),Et(n,e.n),a.start(),a.update(n.getBytes());var s=a.digest();if(t.encoding==="hex"){var i=s.toHex();return t.delimiter?i.match(/.{2}/g).join(t.delimiter):i}else{if(t.encoding==="binary")return s.getBytes();if(t.encoding)throw new Error('Unknown encoding "'+t.encoding+'".')}return s};function Et(e,t){var a=t.toString(16);a[0]>="8"&&(a="00"+a);var r=Ce.util.hexToBytes(a);e.putInt32(r.length),e.putBytes(r)}function mr(e,t){e.putInt32(t.length),e.putString(t)}function ma(){for(var e=Ce.md.sha1.create(),t=arguments.length,a=0;a<t;++a)e.update(arguments[a]);return e.digest()}});var ho=F((yp,co)=>{co.exports=$();wt();Rs();lt();Hr();Ir();js();sr();Zs();ao();io();rn();ea();Qt();Wa();sn();uo();un();Ja();qa();oa();tt();za();fo();pn();re()});var vo=F((vp,yo)=>{var po=require("path"),Xe=require("fs"),Je=ho(),{MITM_DIR:Ea}=ar(),Ft=po.join(Ea,"rootCA.key"),It=po.join(Ea,"rootCA.crt");function go(e){try{let t=Je.pki.certificateFromPem(Xe.readFileSync(e,"utf8")),a=new Date(Date.now()+720*60*60*1e3);return t.validity.notAfter<a}catch{return!0}}async function Lc(){let e=Xe.existsSync(Ft)&&Xe.existsSync(It);if(e&&!go(It))return console.log("\u2705 Root CA already exists"),{key:Ft,cert:It};if(e){console.log("\u{1F510} Root CA expired or expiring soon \u2014 regenerating...");try{Xe.unlinkSync(Ft)}catch{}try{Xe.unlinkSync(It)}catch{}}Xe.existsSync(Ea)||Xe.mkdirSync(Ea,{recursive:!0}),console.log("\u{1F510} Generating Root CA certificate...");let t=Je.pki.rsa.generateKeyPair(2048),a=Je.pki.createCertificate();a.publicKey=t.publicKey,a.serialNumber="01",a.validity.notBefore=new Date,a.validity.notAfter=new Date,a.validity.notAfter.setFullYear(a.validity.notBefore.getFullYear()+10);let r=[{name:"commonName",value:"ZevaiRouter MITM Root CA"},{name:"organizationName",value:"ZevaiRouter"},{name:"countryName",value:"US"}];a.setSubject(r),a.setIssuer(r),a.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),a.sign(t.privateKey,Je.md.sha256.create());let n=Je.pki.privateKeyToPem(t.privateKey),s=Je.pki.certificateToPem(a);return Xe.writeFileSync(Ft,n),Xe.writeFileSync(It,s),console.log("\u2705 Root CA generated successfully"),{key:Ft,cert:It}}function Dc(){if(!Xe.existsSync(Ft)||!Xe.existsSync(It))throw new Error("Root CA not found. Generate it first.");let e=Xe.readFileSync(Ft,"utf8"),t=Xe.readFileSync(It,"utf8");return{key:Je.pki.privateKeyFromPem(e),cert:Je.pki.certificateFromPem(t)}}function kc(e,t){let a=Je.pki.rsa.generateKeyPair(2048),r=Je.pki.createCertificate();return r.publicKey=a.publicKey,r.serialNumber=Math.floor(Math.random()*1e6).toString(),r.validity.notBefore=new Date,r.validity.notAfter=new Date,r.validity.notAfter.setFullYear(r.validity.notBefore.getFullYear()+1),r.setSubject([{name:"commonName",value:e}]),r.setIssuer(t.cert.subject.attributes),r.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:e},{type:2,value:`*.${e}`}]}]),r.sign(t.key,Je.md.sha256.create()),{key:Je.pki.privateKeyToPem(a.privateKey),cert:Je.pki.certificateToPem(r)}}yo.exports={generateRootCA:Lc,loadRootCA:Dc,generateLeafCert:kc,isCertExpired:go,ROOT_CA_CERT_PATH:It,ROOT_CA_KEY_PATH:Ft}});var Co=F((xp,mo)=>{var mp=require("path"),Cp=require("fs"),{MITM_DIR:Ep}=ar(),{generateRootCA:Uc,loadRootCA:Pc,generateLeafCert:Oc}=vo();async function Vc(){return await Uc()}function Fc(e){try{let t=Pc(),a=Oc(e,t);return{key:a.key,cert:a.cert}}catch(t){return console.error(`Failed to generate cert for ${e}:`,t.message),null}}mo.exports={generateCert:Vc,getCertForDomain:Fc}});var To=F((Sp,So)=>{var Eo=require("fs"),Kc=require("path"),{DATA_DIR:Mc}=ar(),xo=Kc.join(Mc,"mitm","aliases.json");function qc(){try{return Eo.existsSync(xo)?JSON.parse(Eo.readFileSync(xo,"utf-8")):null}catch{return null}}function Hc(e){return qc()?.[e]||null}So.exports={getMitmAlias:Hc}});var Bo=F((Tp,Io)=>{"use strict";var er="1.28.0";function Gc(e){return!e||typeof e!="object"||Array.isArray(e)?!1:String(e.ideName||"").toLowerCase()==="antigravity"||String(e.ideType||"").toUpperCase()==="ANTIGRAVITY"?!0:Object.prototype.hasOwnProperty.call(e,"ideVersion")}function Ao(e,t){return typeof e!="string"||!e.includes("antigravity/")?e:e.replace(/antigravity\/[^\s]+/,`antigravity/${t}`)}function zc(e,t){return{bodyBuffer:e,headers:t,applied:!1,version:er}}Io.exports={ANTIGRAVITY_IDE_VERSION:er,applyAntigravityIdeVersionOverride:zc,rewriteAntigravityUserAgent:Ao}});var Ro=F((Ap,wo)=>{var bo="forward",_o="sentinel",No="error",xa="malformed";function Qc(e){if(e==="[DONE]")return{action:_o};let t;try{t=JSON.parse(e)}catch{return{action:xa}}return!t||typeof t!="object"||Array.isArray(t)?{action:xa}:t.response&&typeof t.response=="object"?{action:bo}:t.error!==void 0?{action:No,error:t.error}:{action:xa}}wo.exports={classifyGeminiSseData:Qc,FORWARD:bo,SENTINEL:_o,ERROR:No,MALFORMED:xa}});var Ta=F((Ip,ko)=>{var{log:Sa,err:$c}=Gt(),{classifyGeminiSseData:Yc,FORWARD:jc,ERROR:Wc}=Ro(),Lo="http://localhost:1997",Xc=String(process.env.MITM_ROUTER_BASE||Lo).trim().replace(/\/+$/,"")||Lo,Do=process.env.ROUTER_API_KEY,Jc=new Set(["host","content-length","connection","transfer-encoding","content-type","authorization"]);async function Zc(e,t="/v1/chat/completions",a={}){let r={};for(let[s,i]of Object.entries(a))Jc.has(s.toLowerCase())||(r[s]=i);return await fetch(`${Xc}${t}`,{method:"POST",headers:{...r,"Content-Type":"application/json",...Do&&{Authorization:`Bearer ${Do}`}},body:JSON.stringify(e)})}async function ed(e,t,a){let r=e.headers.get("content-type")||"application/json",n=e.status||200,s={"Content-Type":r,"Cache-Control":"no-cache",Connection:"keep-alive"};if(r.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(n,s),a&&a.writeHeader(e.status,Object.fromEntries(e.headers)),!e.body){let u=await e.text().catch(()=>"");a&&(a.writeChunk(u),a.end()),t.end(u);return}let i=e.body.getReader(),o=new TextDecoder;for(;;){let{done:u,value:l}=await i.read();if(u){a&&a.end(),t.end();break}a&&a.writeChunk(l),t.write(o.decode(l,{stream:!0}))}}async function td(e,t,a,r={}){let n=e.headers.get("content-type")||"application/json",s=e.status||200,i={"Content-Type":n,"Cache-Control":"no-cache",Connection:"keep-alive"};if(n.includes("text/event-stream")&&(i["X-Accel-Buffering"]="no"),t.writeHead(s,i),a&&a.writeHeader(e.status,Object.fromEntries(e.headers)),!e.body||!n.includes("text/event-stream")){let v=await e.text().catch(()=>"");a&&(a.writeChunk(v),a.end()),t.end(v);return}let o=e.body.getReader(),u=new TextDecoder("utf-8",{fatal:!1}),l="",f=0,c=null,g=v=>{let y=v.trim();if(!y||!y.startsWith("data:"))return;let x=y.slice(5).trim();if(!x)return;let{action:S,error:A}=Yc(x);if(S===jc){f+=1,t.write(`data: ${x}
 
-`);return}x===Wc&&(f=S)};for(;;){let{done:g,value:v}=await i.read();if(g)break;a&&a.writeChunk(v),u+=o.decode(v,{stream:!0});let y=u.split(`
-`);u=y.pop()||"";for(let x of y)c(x)}if(u&&c(u),a&&a.end(),f){let g=typeof f=="string"?f:f?.message||JSON.stringify(f);$c(`[gemini-sse] router reported an error after ${l} chunk(s): ${g}`)}t.end()}async function rd(e,t,a,r){let n=e.headers.get("content-type")||"application/json",s={"Content-Type":n,"Cache-Control":"no-cache",Connection:"keep-alive"};if(n.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(200,s),!e.body){t.end(await e.text().catch(()=>""));return}let i=e.body.getReader(),o=new TextDecoder("utf-8",{fatal:!1}),u="";for(;;){let{done:l,value:f}=await i.read();if(l)break;u+=o.decode(f,{stream:!0});let c=u.split(`
+`);return}S===Wc&&(c=A)};for(;;){let{done:v,value:y}=await o.read();if(v)break;a&&a.writeChunk(y),l+=u.decode(y,{stream:!0});let x=l.split(`
+`);l=x.pop()||"";for(let S of x)g(S)}if(l&&g(l),a&&a.end(),c){let v=typeof c=="string"?c:c?.message||JSON.stringify(c),y=r.model?` for ${r.model}`:"";$c(`[gemini-sse] router reported an error after ${f} chunk(s)${y}: ${v}`)}t.end()}async function rd(e,t,a,r){let n=e.headers.get("content-type")||"application/json",s={"Content-Type":n,"Cache-Control":"no-cache",Connection:"keep-alive"};if(n.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(200,s),!e.body){t.end(await e.text().catch(()=>""));return}let i=e.body.getReader(),o=new TextDecoder("utf-8",{fatal:!1}),u="";for(;;){let{done:l,value:f}=await i.read();if(l)break;u+=o.decode(f,{stream:!0});let c=u.split(`
 `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Sa(`[SSE in] ${y.slice(0,200)}`);try{let x=JSON.parse(y),S=a(x,r);if(S!=null){let A=Array.isArray(S)?S:[S];for(let B of A){if(process.env.DEBUG_MITM){let b=B.length||B.byteLength||0;Sa(`[write binary frame] (${b}B) first 20B: ${Array.from(B.slice(0,20)).join(",")}`)}t.write(Buffer.from(B))}}}catch{}}}}try{let l=a(null,r);if(l!=null){let f=Array.isArray(l)?l:[l];for(let c of f)t.write(c)}}catch{}t.end()}async function ad(e,t,a,r){let n={"Content-Type":"application/vnd.amazon.eventstream","Cache-Control":"no-cache",Connection:"keep-alive"};if(t.writeHead(200,n),!e.body){t.end(await e.text().catch(()=>""));return}let s=e.body.getReader(),i=new TextDecoder("utf-8",{fatal:!1}),o="";for(;;){let{done:u,value:l}=await s.read();if(u)break;o+=i.decode(l,{stream:!0});let f=o.split(`
-`);o=f.pop()||"";for(let c of f){let g=c.trim();if(!g||!g.startsWith("data:"))continue;let v=g.slice(5).trim();if(v!=="[DONE]"){process.env.DEBUG_MITM&&Sa(`[SSE in] ${v.slice(0,200)}`);try{let y=JSON.parse(v),x=a(y,r);if(x!=null){let S=Array.isArray(x)?x:[x];for(let A of S){if(process.env.DEBUG_MITM){let B=A.length||A.byteLength||0;Sa(`[write binary frame] (${B}B) first 20B: ${Array.from(A.slice(0,20)).join(",")}`)}t.write(Buffer.from(A))}}}catch{}}}}try{let u=a(null,r);if(u!=null){let l=Array.isArray(u)?u:[u];for(let f of l)t.write(f)}}catch{}t.end()}ko.exports={fetchRouter:Zc,pipeSSE:ed,pipeGeminiSSE:td,pipeTransformedSSE:rd,pipeTransformedEventStream:ad}});var Po=F((Bp,Uo)=>{var{err:nd,createResponseDumper:id}=Gt(),{IS_DEV:sd}=Er(),{fetchRouter:od,pipeGeminiSSE:ud}=Ta();async function ld(e,t,a,r){let n=sd?id(e,"intercept-antigravity"):null,s=e.url.includes(":streamGenerateContent");try{let i=JSON.parse(a.toString());i.model&&(i.model=r);let o=await od(i,"/v1/chat/completions",e.headers);await ud(o,t,n)}catch(i){nd(`[antigravity] ${i.message}`),n&&(n.writeChunk(`
+`);o=f.pop()||"";for(let c of f){let g=c.trim();if(!g||!g.startsWith("data:"))continue;let v=g.slice(5).trim();if(v!=="[DONE]"){process.env.DEBUG_MITM&&Sa(`[SSE in] ${v.slice(0,200)}`);try{let y=JSON.parse(v),x=a(y,r);if(x!=null){let S=Array.isArray(x)?x:[x];for(let A of S){if(process.env.DEBUG_MITM){let B=A.length||A.byteLength||0;Sa(`[write binary frame] (${B}B) first 20B: ${Array.from(A.slice(0,20)).join(",")}`)}t.write(Buffer.from(A))}}}catch{}}}}try{let u=a(null,r);if(u!=null){let l=Array.isArray(u)?u:[u];for(let f of l)t.write(f)}}catch{}t.end()}ko.exports={fetchRouter:Zc,pipeSSE:ed,pipeGeminiSSE:td,pipeTransformedSSE:rd,pipeTransformedEventStream:ad}});var Po=F((Bp,Uo)=>{var{err:nd,createResponseDumper:id}=Gt(),{IS_DEV:sd}=Er(),{fetchRouter:od,pipeGeminiSSE:ud}=Ta();async function ld(e,t,a,r){let n=sd?id(e,"intercept-antigravity"):null,s=e.url.includes(":streamGenerateContent");try{let i=JSON.parse(a.toString());i.model&&(i.model=r);let o=await od(i,"/v1/chat/completions",e.headers);await ud(o,t,n,{model:r})}catch(i){nd(`[antigravity] ${i.message}`),n&&(n.writeChunk(`
 [ERROR] ${i.message}
 `),n.end()),s?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream"}),t.end()):(t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:i.message,type:"mitm_error"}})))}}Uo.exports={intercept:ld}});var Vo=F((bp,Oo)=>{var{err:fd}=Gt(),{fetchRouter:cd,pipeSSE:dd}=Ta(),hd={"/chat/completions":"/v1/chat/completions","/v1/messages":"/v1/messages","/responses":"/v1/responses"};function pd(e){for(let[t,a]of Object.entries(hd))if(e.includes(t))return a;return"/v1/chat/completions"}async function gd(e,t,a,r){try{let n=JSON.parse(a.toString());n.model=r;let s=pd(e.url),i=await cd(n,s,e.headers);await dd(i,t)}catch(n){fd(`[copilot] ${n.message}`),t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:n.message,type:"mitm_error"}}))}}Oo.exports={intercept:gd}});var qo=F((_p,Mo)=>{"use strict";var Fo=[{open:"<thinking>",close:"</thinking>"},{open:"<think>",close:"</think>"}];function yd(){return{mode:"text",closeTag:null,buffer:""}}function Or(e,t,a){if(!a)return;let r=e[e.length-1];r?.type===t?r.text+=a:e.push({type:t,text:a})}function Ko(e,t){let a=e.toLowerCase(),r=0;for(let n of t){let s=Math.min(a.length,n.length-1);for(let i=s;i>r;i--)if(a.endsWith(n.slice(0,i))){r=i;break}}return r}function vd(e,t){if(!e||typeof t!="string"||t.length===0)return[];e.buffer+=t;let a=[];for(;e.buffer;){let r=e.buffer.toLowerCase();if(e.mode==="text"){let o=null;for(let l of Fo){let f=r.indexOf(l.open);f>=0&&(!o||f<o.index)&&(o={...l,index:f})}if(o){Or(a,"text",e.buffer.slice(0,o.index)),e.buffer=e.buffer.slice(o.index+o.open.length),e.mode="reasoning",e.closeTag=o.close;continue}let u=Ko(e.buffer,Fo.map(l=>l.open));Or(a,"text",e.buffer.slice(0,e.buffer.length-u)),e.buffer=u?e.buffer.slice(-u):"";break}let n=e.closeTag||"</thinking>",s=r.indexOf(n);if(s>=0){Or(a,"reasoning",e.buffer.slice(0,s)),e.buffer=e.buffer.slice(s+n.length),e.mode="text",e.closeTag=null;continue}let i=Ko(e.buffer,[n]);Or(a,"reasoning",e.buffer.slice(0,e.buffer.length-i)),e.buffer=i?e.buffer.slice(-i):"";break}return a}function md(e){if(!e)return[];let t=[];return Or(t,e.mode==="reasoning"?"reasoning":"text",e.buffer),e.mode="text",e.closeTag=null,e.buffer="",t}Mo.exports={createTaggedThinkingState:yd,flushTaggedThinking:md,pushTaggedThinking:vd}});var $o=F((Np,Qo)=>{var{err:Cd}=Gt(),{IS_DEV:Ed}=Er(),{fetchRouter:xd,pipeTransformedEventStream:Sd}=Ta(),Td=require("fs"),Ad=require("path"),{createTaggedThinkingState:Id,flushTaggedThinking:Bd,pushTaggedThinking:bd}=qo(),_d=Ad.join(__dirname,"../../../data/logs/mitm/kiro-debug.log");function Ho(e){if(Ed)try{Td.appendFileSync(_d,`${new Date().toISOString()} ${e}
 `)}catch{}}var Nd=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Go(e){let t=4294967295;for(let a=0;a<e.length;a++)t=t>>>8^Nd[(t^e[a])&255];return(t^4294967295)>>>0}function wd(e){return{modelId:e||null,toolCallInit:{},hasToolCalls:!1,finishSent:!1,usage:null,taggedThinking:Id()}}function Rd(e,t,a){return bd(t.taggedThinking,e).map(r=>Bt(r.type==="reasoning"?"reasoningContentEvent":"assistantResponseEvent",{content:r.text,modelId:a}))}function Rn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8"),n=Buffer.alloc(1+a.length+1+2+r.length),s=0;return n[s++]=a.length,a.copy(n,s),s+=a.length,n[s++]=7,n.writeUInt16BE(r.length,s),s+=2,r.copy(n,s),n}function Bt(e,t){let a=Buffer.from(typeof t=="string"?t:JSON.stringify(t),"utf8"),r=Buffer.concat([Rn(":message-type","event"),Rn(":event-type",e),Rn(":content-type","application/json")]),n=r.length,s=12+n+a.length+4,i=Buffer.alloc(s);return i.writeUInt32BE(s,0),i.writeUInt32BE(n,4),i.writeUInt32BE(Go(i.slice(0,8)),8),r.copy(i,12),a.copy(i,12+n),i.writeUInt32BE(Go(i.slice(0,s-4)),s-4),i}function Ld(e){if(typeof e=="string")return e;if(e==null)return"{}";try{return JSON.stringify(e)}catch{return"{}"}}function zo(e){let t=[],a=e.userInputMessageContext?.toolResults||[];for(let n of a){let s=(n.content||[]).map(i=>i.text||"").join(`

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.1.25",
+  "version": "1.1.27",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.1.25",
+  "version": "1.1.27",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"