zevairouter 1.1.33 → 1.1.35

package/cli/app/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Unreleased
 
+# v1.1.35 (2026-10-23)
+
+## Features
+- **Kiro provider page has a Live Probe Models button.** It reads Kiro's `ListAvailableModels` for the selected connection (no credits) and lists each base model with its live context/output limits and credit multiplier, merged with saved and `kr/*` alias candidates. Selected models can then be probed with a real pinned completion (max 3 concurrent, stops if the credential is rejected); only an explicit invalid-model answer marks a model unavailable. API-key logins without a CodeWhisperer profile can save the verified models to the connection. CodeBuddy and Kiro discovery now share one probe scanner.
+
+## Changed
+- **Kiro no longer ships a hardcoded model list.** `kr/*` models come only from each account's live `ListAvailableModels` answer, and `/v1/models` advertises Kiro's own context/output limits (for example `kr/gpt-5.6-sol` is now 922K/128K instead of 272K) and image support. Text-only Kiro models are detected from the live catalog instead of a static strip list. The provider page, model picker, CLI tool mapping and `/v1/models/info` read the live list. **API-key Kiro accounts (no CodeWhisperer profile) advertise no models until you run Live Probe Models and save the verified ones**; they previously got the static list. Explicitly requested `kr/<model>` IDs still route as before.
+
+# v1.1.34 (2026-10-23)
+
+## Removed
+- **Notion AI (Experimental) provider.** The `notion-ai` provider and its `na/` models, the "Experimental Web Providers" dashboard section, the Notion workspace fields in the connection dialogs, and the optional `tls-client-node` runtime that postinstall and every launch tried to install are gone. Existing Notion connections stay in the database but no longer route; delete them from the dashboard if you added one.
+
+## Security
+- **Requests for an unknown provider no longer go to OpenAI.** The default executor fell back to the OpenAI endpoint for any provider it did not recognize, so a stored connection for a removed provider (for example a Notion `token_v2` cookie) would be sent as a Bearer token to `api.openai.com`. Unknown providers now fail with `400 Unknown provider` and no outbound request; `openai-compatible-*` and `anthropic-compatible-*` are unaffected.
+- **Grok Build config is owner-only and written atomically.** `~/.grok/config.toml` holds the API key, but `0600` was only applied when the file was created, so an existing `0644` file stayed world-readable, and a crash or two concurrent saves could truncate it.
+- **`/codex/*` now requires an API key like `/v1/*`.** The path is rewritten to `/api/v1/responses` after the guard runs, and the guard did not list `/codex`, so a remote caller reached the Responses API with only the handler's own check. With **Require API key** off, that check passes without a key.
+- **Root CA private key is owner-only.** `~/.zevai/mitm/rootCA.key` was written with default permissions (usually `0644`). That CA is installed as a trusted root, so any local user could mint certificates the machine trusts. New keys are written `0600` in a `0700` directory, and existing keys are repaired on startup.
+- **Database and backups are owner-only.** `data.sqlite`, its `-wal`/`-shm` files, the sql.js temp file and every backup hold provider tokens and API keys but used default permissions. The `db` and `backups` directories are now `0700` and the files `0600`, repaired on startup.
+- **Update and Shutdown only kill the router's own processes.** Process cleanup matched any `ps` line containing `zevai`, `next-server` or `cloudflared` and sent `kill -9`, which killed unrelated dev servers, the user's own tunnels, and editors with files open under the repo. It now kills the process tree of the CLI that launched the server, plus binaries the router installed under `~/.zevai/bin` and `~/.zevai/runtime`.
+- **`/v1/models` no longer advertises hidden no-auth providers.** Devin CLI (`dv/`), Coqui and Tortoise are hidden from the Providers page but need no connection, so every client that discovers models from the list (Hermes, OMP) picked up all 35 `dv/` models. Picking one runs the local `devin acp` binary on the router host, which can execute shell commands. They are now left out of the list; an explicit `devin-cli/<model>` request still resolves.
+
+## Fixes
+- **Adaptive routing no longer freezes a circuit until restart.** A half-open circuit's recovery probe was released only by the attempt lease. A failed token refresh, a planner error, or an exhausted attempt budget skipped that, the probe stayed "in flight" forever, and every candidate behind that circuit was rejected until the process restarted. Those paths now hand the probe back.
+- **Budgeted keys no longer get 429 for a minute after a failed embeddings, image, audio or video request.** When one of those handlers threw, the key's budget slot stayed held until the 60s idle reclaim. The slot is now released immediately, as chat already did.
+- **Streamed Claude responses report real prompt tokens.** Anthropic sends input and cache tokens in `message_start` and only output tokens in `message_delta`, so OpenAI-format clients and usage/cost accounting saw `prompt_tokens: 0` on every streamed Claude request.
+- **A revoked refresh token no longer turns embeddings and image requests into a 500.** The refresh error escaped the handler, so the account was never marked unavailable and the next request picked it again. The upstream 401 now reaches the normal account fallback.
+- **Background token refresh resumes after re-authorization.** One permanent refresh failure parked the connection until restart, even after the user reconnected it. A new refresh token now makes it eligible again.
+- **MITM hosts entries never delete the user's own lines.** Matching used substrings, so stopping MITM removed any line mentioning a target host (blocklists, comments), and `cloudcode-pa.googleapis.com` counted as active when only `daily-cloudcode-pa.googleapis.com` was present. Hosts are matched exactly, router lines are tagged `# zevairouter`, and only router lines are removed.
+- **A corrupt legacy `db.json` no longer loses all accounts.** A file that failed to parse was treated as missing; the import committed without providers, keys or settings and was marked done, so a repaired file was never imported. The import is now skipped with an error and retried on the next start.
+- **Grok Build settings no longer corrupt `config.toml`.** The editor only recognized double-quoted values and bare `[section]` headers, so `default = 'x'` gained a duplicate key and `[models] # comment` a second `[models]` table, and Grok could no longer read the file. It now parses and writes real TOML; comments other than ZevaiRouter's restore markers are not preserved.
+- **sql.js startup no longer stays locked after a crash.** An empty lock file, or one holding the current PID after a restart (PID 1 in Docker), was treated as owned by a live process and the database refused to open. Stale locks are reclaimed; a lock held by another live process is still respected.
+- **Linux re-trusts a regenerated MITM root CA.** The install check only tested that the anchor file existed, so after the CA was regenerated the old one stayed trusted and every intercepted connection failed. It now compares fingerprints.
+- **A crash while saving tunnel state no longer changes the public tunnel URL.** `state.json` was written in place and a parse error read as "no state", so a new tunnel ID was generated. It is now written atomically with mode `0600`, and a corrupt file falls back to the last good copy.
+- **Claude-format clients get the provider's real usage from OpenAI-style streams.** Providers that send usage in a separate final chunk after `finish_reason` (qwen and iflow request this) had that chunk dropped, so Claude Code saw estimated token counts. `message_delta` and `message_stop` now wait for the usage chunk or the end of the stream, and are still sent exactly once when no usage arrives.
+- **A 401 from a provider that cannot refresh no longer waits 3s before failing over.** Cursor, Qoder, Trae, Windsurf, Zed and connections without a refresh token went through two retry delays for a refresh that could never succeed. The refresh is now skipped; providers that can refresh keep their retries.
+- **Terminal UI works with `--host <address>`.** It always called `localhost`, so a server bound to a specific address answered every menu with "Failed to fetch".
+- **IPv6 loopback is recognized.** `HOSTNAME=::1` and `Host: [::1]:port` were never treated as local, so local-only routes and the login-disabled shortcut were refused.
+- **`PATCH /api/settings` answers 400 for a non-object body** instead of a 500 with the raw error.
+
+## Internal
+- **`npm run release` refuses to run outside `main`.** The release commit was made on the current branch but `main` was pushed, so a release from another branch published a tree whose commit never reached `origin/main`.
+
 # v1.1.33 (2026-10-22)
 
 ## Features

package/cli/app/cli/hooks/postinstall.js

@@ -29,7 +29,6 @@ process.env.NPM_CONFIG_LOGLEVEL = process.env.NPM_CONFIG_LOGLEVEL || "error";
 const { ensureSqliteRuntime, runNpmInstall, getRuntimeDir } = require("./sqliteRuntime");
 const { ensureTrayRuntime } = require("./trayRuntime");
 const { ensureCloakbrowserRuntime } = require("./cloakbrowserRuntime");
-const { ensureNotionTlsRuntime } = require("./notionTlsRuntime");
 const { hasBuiltInNodeSqlite } = require("./startupRuntime");
 
 const minimalSetting = String(process.env.ZEVAI_MINIMAL_POSTINSTALL || "").toLowerCase();
@@ -124,17 +123,6 @@ async function main() {
     warn(`Tray warm-up skipped: ${error.message}`);
   }
 
-  // Notion inference needs the Chrome-TLS transport even in bounded/minimal
-  // installs. It is a small provider runtime, not the browser automation
-  // bundle that MINIMAL intentionally defers.
-  try {
-    const notionTls = ensureNotionTlsRuntime({ silent: true });
-    if (notionTls.ok) log("✓ Notion Chrome TLS transport ready");
-    else warn("Notion Chrome TLS transport unavailable — the HTTP fallback remains available");
-  } catch (error) {
-    warn(`Notion TLS warm-up skipped: ${error.message}`);
-  }
-
   if (MINIMAL) {
     log("Done (minimal). Automation downloads CloakBrowser on first use.");
     return;

package/cli/app/cli/hooks/startupRuntime.js

@@ -9,7 +9,6 @@ function prepareStartupRuntime({
   modules = builtinModules,
   loadSqliteRuntime = () => require("./sqliteRuntime"),
   loadTrayRuntime = () => require("./trayRuntime"),
-  loadNotionTlsRuntime = null,
 } = {}) {
   const sqliteRuntime = loadSqliteRuntime();
 
@@ -19,15 +18,6 @@ function prepareStartupRuntime({
     try { sqliteRuntime.ensureSqliteRuntime({ silent: true }); } catch {}
   }
 
-  // Repair interrupted/minimal installs before the router can dispatch a
-  // Notion request. Keep startup bounded when the registry is unavailable;
-  // notionTlsClient still has its HTTP fallback.
-  if (loadNotionTlsRuntime) {
-    try {
-      loadNotionTlsRuntime().ensureNotionTlsRuntime({ silent: true, timeout: 30_000 });
-    } catch {}
-  }
-
   if (trayMode) {
     try { loadTrayRuntime().ensureTrayRuntime({ silent: true }); } catch {}
   }

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.1.33",
+  "version": "1.1.35",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"

package/cli/app/src/lib/db/adapters/sqljsAdapter.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import initSqlJs from "sql.js";
 import { PRAGMA_SQL } from "../schema.js";
@@ -10,26 +11,92 @@ async function loadSql() {
   return SQL;
 }
 
-export async function createSqlJsAdapter(filePath, options = {}) {
-  const lockPath = `${filePath}.sqljs.lock`;
-  let lockFd;
+// Lock paths held by this process. Shared through globalThis so separately
+// bundled copies of this module still see one another's locks.
+const HELD_LOCKS_KEY = Symbol.for("zevairouter.sqljs.heldLocks");
+const heldLocks = (globalThis[HELD_LOCKS_KEY] ||= new Set());
+
+function ownedError(ownerPid) {
+  return new Error(`sql.js database is already owned by process ${ownerPid}`);
+}
+
+// The lock is linked into place from a fully written temp file, so it never
+// exists empty or partially written.
+function tryCreateLock(lockPath) {
+  const tempPath = `${lockPath}.${process.pid}.${randomUUID()}.tmp`;
+  fs.writeFileSync(tempPath, String(process.pid), { mode: 0o600 });
+  try {
+    fs.linkSync(tempPath, lockPath);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    fs.rmSync(tempPath, { force: true });
+  }
+}
+
+function readLockOwner(lockPath) {
+  try {
+    return fs.readFileSync(lockPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+// A lock is stale when it names no valid PID (empty or torn file from an older
+// build), names this PID without this process holding it (restart reused the
+// PID, e.g. PID 1 in Docker), or names a process that no longer exists. EPERM
+// means a live process of another user has that PID, so it stays owned.
+function isStaleLock(content, lockPath) {
+  const ownerPid = /^\d+$/.test(content.trim()) ? Number(content.trim()) : 0;
+  if (!Number.isSafeInteger(ownerPid) || ownerPid <= 0) return true;
+  if (ownerPid === process.pid) {
+    if (heldLocks.has(lockPath)) throw ownedError(ownerPid);
+    return true;
+  }
   try {
-    lockFd = fs.openSync(lockPath, "wx");
+    process.kill(ownerPid, 0);
   } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-    const ownerPid = Number.parseInt(fs.readFileSync(lockPath, "utf8"), 10);
+    if (error.code === "ESRCH") return true;
+    if (error.code !== "EPERM") throw error;
+  }
+  throw ownedError(ownerPid);
+}
+
+function acquireLock(lockPath) {
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    if (tryCreateLock(lockPath)) return;
+    const content = readLockOwner(lockPath);
+    if (content === null || !isStaleLock(content, lockPath)) continue;
+    // Move the stale lock aside instead of deleting it so a concurrent
+    // reclaimer can never remove a lock another process just created.
+    const stalePath = `${lockPath}.${process.pid}.${randomUUID()}.stale`;
     try {
-      if (Number.isInteger(ownerPid) && ownerPid > 0) process.kill(ownerPid, 0);
-      throw new Error(`sql.js database is already owned by process ${ownerPid || "unknown"}`);
-    } catch (ownerError) {
-      if (ownerError.code !== "ESRCH") throw ownerError;
-      fs.rmSync(lockPath, { force: true });
-      lockFd = fs.openSync(lockPath, "wx");
+      fs.renameSync(lockPath, stalePath);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
     }
+    const moved = fs.readFileSync(stalePath, "utf8");
+    if (moved !== content) {
+      // Another process replaced the stale lock first: put its lock back.
+      try { fs.linkSync(stalePath, lockPath); } catch {}
+      fs.rmSync(stalePath, { force: true });
+      throw ownedError(moved.trim() || "unknown");
+    }
+    fs.rmSync(stalePath, { force: true });
   }
-  fs.writeFileSync(lockFd, String(process.pid));
-  fs.closeSync(lockFd);
+  throw new Error(`Could not acquire sql.js database lock ${lockPath}`);
+}
+
+export async function createSqlJsAdapter(filePath, options = {}) {
+  const lockPath = `${filePath}.sqljs.lock`;
+  acquireLock(lockPath);
+  heldLocks.add(lockPath);
   const releaseLock = () => {
+    heldLocks.delete(lockPath);
     try {
       if (fs.readFileSync(lockPath, "utf8") === String(process.pid)) fs.rmSync(lockPath, { force: true });
     } catch {}
@@ -77,7 +144,7 @@ export async function createSqlJsAdapter(filePath, options = {}) {
     dirty = true;
     try {
       options.beforePersist?.({ filePath, tempPath });
-      fs.writeFileSync(tempPath, Buffer.from(data));
+      fs.writeFileSync(tempPath, Buffer.from(data), { mode: 0o600 });
       fs.renameSync(tempPath, filePath);
       dirty = false;
     } catch (error) {

package/cli/app/src/lib/db/migrate.js

@@ -38,10 +38,14 @@ function importWithAssertion(adapter, tableName, rows, insertFn, rowMeta) {
   }
 }
 
+// Returns null only when the file is absent. A file that exists but does not
+// parse is reported, because treating it as "missing" would import nothing
+// and then mark the one-time migration as done.
 function readJsonSafe(file) {
   if (!fs.existsSync(file)) return null;
-  try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return null; }
+  try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return CORRUPT_JSON; }
 }
+const CORRUPT_JSON = Symbol("corrupt-json");
 
 function isFreshDb(adapter) {
   // Table _meta may not exist yet on truly fresh DB
@@ -254,9 +258,27 @@ export async function runMigrationOnce(adapter) {
   const legacyUsage = readJsonSafe(LEGACY_FILES.usage);
   const legacyDisabled = readJsonSafe(LEGACY_FILES.disabled);
   const legacyDetails = readJsonSafe(LEGACY_FILES.details);
-  const hasLegacy = !!(legacyMain || legacyUsage || legacyDisabled || legacyDetails);
+  const legacy = [legacyMain, legacyUsage, legacyDisabled, legacyDetails];
+  const hasLegacy = legacy.some(Boolean);
+
+  // `fresh` is false on every boot after the first, because the versioned
+  // migrations above stamp schemaVersion. A skipped or aborted import records
+  // this flag so the retry promised to the user actually happens.
+  const importPending = getMetaSync(adapter, "legacyImportPending", null) === "1";
+  const importEligible = (fresh || importPending) && !alreadyImported;
+
+  if (importEligible && legacy.includes(CORRUPT_JSON)) {
+    const unreadable = Object.entries(LEGACY_FILES)
+      .filter(([, file]) => readJsonSafe(file) === CORRUPT_JSON)
+      .map(([, file]) => file);
+    // Leave the marker unwritten so a repaired file is imported on the next
+    // start instead of being skipped forever.
+    setMetaSync(adapter, "legacyImportPending", "1");
+    console.error(`[DB][migrate] legacy JSON import skipped: cannot parse ${unreadable.join(", ")} | fix or remove the file and restart`);
+    return;
+  }
 
-  if (fresh && hasLegacy && !alreadyImported) {
+  if (importEligible && hasLegacy) {
     const t0 = Date.now();
     const backupDir = makeBackupDir("migrate-from-json");
     for (const f of Object.values(LEGACY_FILES)) backupFile(f, backupDir);
@@ -269,9 +291,11 @@ export async function runMigrationOnce(adapter) {
         importLegacyDetails(adapter, legacyDetails);
         setMetaSync(adapter, "appVersion", getAppVersion());
         setMetaSync(adapter, "migratedAt", new Date().toISOString());
+        setMetaSync(adapter, "legacyImportPending", "0");
       });
     } catch (err) {
       if (err instanceof MigrationAborted) {
+        setMetaSync(adapter, "legacyImportPending", "1");
         console.error(`[DB][migrate] aborted: ${err.message} | legacy JSON kept | backup: ${backupDir}`);
         return;
       }