zevairouter 1.1.38 → 1.1.40

package/cli/app/skills/zevai-video/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: zevairouter-video
+description: Generate videos via ZevaiRouter /v1/videos/generations using xAI Grok Imagine or Google Flow Veo / Omni Flash. The async flow submits a job, polls request_id until done, then downloads the MP4. Use for text-to-video, long video up to 60 seconds, image-to-video, video edits, or extensions.
+---
+
+# ZevaiRouter — Video Generation
+
+Requires `ZEVAI_URL` and, when API-key auth is enabled, `ZEVAI_KEY`. See the entry skill at https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai/SKILL.md
+
+Connect an xAI account or a local Google Flow/gflow profile in the ZevaiRouter dashboard. Video jobs are asynchronous: submit, poll `request_id` until `done` or `failed`, then download `video.url`. xAI jobs are account-bound and need the returned connection header while polling; router-owned Flow job IDs (`flow_...`) poll without it.
+
+## Choosing a model
+
+If the user names a model, use exactly that one. Otherwise, for Google Flow, default to `flow/omni-flash`, and use `flow/omni-flash-long` when the user asks for more than 10 seconds. Do not switch models on your own.
+
+| Model | Length | Flow credits | Notes |
+|---|---|---|---|
+| `flow/omni-flash` | 10 s | 15 | Default for Flow |
+| `flow/omni-flash-long` | 10, 20, 30, 40, 50 or 60 s | 15 per 10 s | Segments joined into one MP4 |
+| `flow/veo-lite` | 8 s | 10 | "veo" / "veo lite" |
+| `flow/veo-fast` | 8 s | 20 | "veo fast" |
+| `flow/veo-quality` | 8 s | 100 | "veo quality" |
+| `xai/grok-imagine-video` | provider-defined | — | xAI account |
+
+## Endpoints
+
+| Endpoint | Purpose |
+|---|---|
+| `POST /v1/videos/generations` | Text-to-video or image-to-video |
+| `POST /v1/videos/edits` | Edit an existing video |
+| `POST /v1/videos/extensions` | Extend an existing video |
+| `GET /v1/videos/{request_id}` | Poll job status |
+
+Common generation fields:
+
+| Field | Required | Notes |
+|---|---|---|
+| `model` | yes | xAI: `xai/grok-imagine-video`. Flow: `flow/veo-lite`, `flow/veo-fast`, `flow/veo-quality`, `flow/omni-flash`, or `flow/omni-flash-long` |
+| `prompt` | yes for text-to-video | Video description |
+| `duration` | no | Flow Veo (8 s) and Omni (10 s) clips have a fixed length: send `duration` only with `flow/omni-flash-long` (exactly 10/20/30/40/50/60) |
+| `aspect_ratio` | no | Flow supports `16:9` or `9:16`; other providers may support more |
+| `resolution` | no | Provider-dependent |
+| `segment_prompts` | no | Flow long-video only: optional prompt per 10s segment |
+| `image` | no | Provider-dependent image-to-video input |
+| `video` | edits/extensions | Provider-dependent existing video input |
+
+## Submit and poll
+
+```bash
+curl -i -X POST "$ZEVAI_URL/v1/videos/generations" \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"xai/grok-imagine-video","prompt":"A cinematic tracking shot through a neon city at night","duration":8,"aspect_ratio":"16:9","resolution":"720p"}'
+```
+
+The JSON response includes a `request_id`. Save the response header `x-zevai-connection-id`; echo it back while polling so the same upstream account is used:
+
+```bash
+curl "$ZEVAI_URL/v1/videos/REQUEST_ID" \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "x-connection-id: CONNECTION_ID"
+```
+
+Continue polling until the response is `done` or `failed`. On success, download `video.url`.
+
+## Google Flow
+
+Always send an `Idempotency-Key`. Reuse the same key if you have to resubmit the same request, so the router returns the existing job instead of billing a second render.
+
+```bash
+curl -sS -X POST "$ZEVAI_URL/v1/videos/generations" \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -H "Idempotency-Key: my-video-001" \
+  -d '{"model":"flow/omni-flash","prompt":"Handheld footage of waves rolling onto a beach at sunset","aspect_ratio":"16:9"}'
+# -> {"request_id":"flow_...","status":"pending"}
+```
+
+Poll every 15 s. A 10 s clip usually takes 1–3 minutes; a 60 s video can take 15+ minutes and may first wait in the queue:
+
+```bash
+curl -sS "$ZEVAI_URL/v1/videos/flow_..." -H "Authorization: Bearer $ZEVAI_KEY"
+# -> {"status":"done","video":{"url":"https://.../v1/videos/flow_.../content?token=...","duration":10}}
+```
+
+`video.url` carries its own token, so it downloads without the API key: `curl -o video.mp4 "$URL"`.
+
+Long video (10–60 s) with optional per-segment prompts:
+
+```bash
+curl -sS -X POST "$ZEVAI_URL/v1/videos/generations" \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -H "Idempotency-Key: stable-story-key" \
+  -d '{"model":"flow/omni-flash-long","prompt":"One continuous dolly shot through a space station","duration":30,"aspect_ratio":"16:9",
+       "segment_prompts":["Opening: the camera drifts past docking ports","Middle: crew float through a corridor","End: a window reveals Earth"]}'
+```
+
+ZevaiRouter generates the first segment as text-to-video, extracts its last frame, generates every later segment as I2V, and joins the MP4 streams without re-encoding. It checks the account's credits before accepting the job. Long video needs `ffmpeg` and the connection's **I2V upload consent confirmed** setting.
+
+Prompting tips for Flow: write the shot as real camera footage (lens, light, camera movement) for realism. Describe products and people by their look instead of naming brands or celebrities, which Flow often refuses, and describe new designs in detail because the model may not know them.
+
+## Zevai CLI
+
+```bash
+zevai xai video \
+  --prompt "A cinematic tracking shot through a neon city at night" \
+  --output video.mp4
+```
+
+Useful options include `--model`, `--duration`, `--aspect-ratio`, `--resolution`, `--image`, `--timeout`, `--port`, and `--api-key`.
+
+## Safety and retry behavior
+
+- Flow runs one generation at a time across all accounts; submit one job and wait for it instead of submitting several in parallel.
+- On `failed`, report the error. Do not resubmit with a new `Idempotency-Key` unless the user asks: the clip may already have been billed.
+- HTTP 402: every Flow account is out of credits. HTTP 423: Flow is busy with another render; wait a minute and retry the same request.
+- ZevaiRouter rotates to another account only for failures that cannot have been billed (authentication, credits, Flow refusing the account).
+- xAI: poll using the connection ID returned when the job was created.
+- Video models are separate from chat model lists and chat combos.

package/cli/app/skills/zevai-web-fetch/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: zevairouter-web-fetch
+description: Fetch URL → markdown / text / HTML via ZevaiRouter /v1/web/fetch using Firecrawl / Jina Reader / Tavily Extract / Exa Contents. Use when the user wants to scrape a webpage, extract URL content, read article, or convert a URL to markdown.
+---
+
+# ZevaiRouter — Web Fetch
+
+Requires `ZEVAI_URL` (and `ZEVAI_KEY` if auth enabled). See https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai/SKILL.md for setup.
+
+## Discover
+
+```bash
+curl $ZEVAI_URL/v1/models/web | jq '.data[] | select(.kind=="webFetch") | .id'
+# Per-provider params
+curl "$ZEVAI_URL/v1/models/info?id=firecrawl/fetch"
+```
+
+IDs end in `/fetch` (e.g. `firecrawl/fetch`, `jina/fetch`). `fetch-combo` chains providers with auto-fallback.
+
+## Endpoint
+
+`POST $ZEVAI_URL/v1/web/fetch`
+
+| Field | Required | Notes |
+|---|---|---|
+| `model` (or `provider`) | yes | from `/v1/models/web` (e.g. `firecrawl` or `jina-reader`) |
+| `url` | yes | URL to extract |
+| `format` | no | `markdown` (default) / `text` / `html` |
+| `max_characters` | no | truncate output |
+
+## Examples
+
+### Jina Reader
+```bash
+curl -X POST $ZEVAI_URL/v1/web/fetch \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"jina-reader","url":"http://localhost:1997","format":"markdown"}'
+```
+
+### Exa
+```bash
+curl -X POST $ZEVAI_URL/v1/web/fetch \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"exa","url":"https://example.com","format":"markdown","max_characters":0}'
+```
+
+### Firecrawl
+```bash
+curl -X POST $ZEVAI_URL/v1/web/fetch \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"firecrawl","url":"https://example.com","format":"markdown","max_characters":0}'
+```
+
+### Tavily
+```bash
+curl -X POST $ZEVAI_URL/v1/web/fetch \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"tavily","url":"https://example.com","format":"markdown","max_characters":0}'
+```
+
+
+JS:
+
+```js
+const r = await fetch(`${process.env.ZEVAI_URL}/v1/web/fetch`, {
+  method: "POST",
+  headers: { "Authorization": `Bearer ${process.env.ZEVAI_KEY}`, "Content-Type": "application/json" },
+  body: JSON.stringify({ model: "fetch-combo", url: "https://example.com", format: "markdown", max_characters: 5000 }),
+});
+const { data } = await r.json();
+console.log(data.title, data.content.length);
+```
+
+## Response shape
+
+```json
+{
+  "provider": "jina-reader",
+  "url": "...",
+  "title": "...",
+  "content": { "format": "markdown", "text": "...", "length": 1234 },
+  "metadata": { "author": null, "published_at": null, "language": null },
+  "usage": { "fetch_cost_usd": 0 },
+  "metrics": { "response_time_ms": 850, "upstream_latency_ms": 700 }
+}
+```
+
+## Provider quirks
+
+| Provider | Auth | Best for |
+|---|---|---|
+| `firecrawl` | Bearer | JS-rendered pages, `format=markdown/html` |
+| `jina-reader` | Bearer (optional) | Free tier (~1M chars/mo); fastest plain markdown |
+| `tavily` | Bearer | Bulk extract; returns `raw_content` |
+| `exa` | `x-api-key` | Pre-indexed pages; fast text extraction |

package/cli/app/skills/zevai-web-search/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: zevairouter-web-search
+description: Web search via ZevaiRouter /v1/search using Tavily / Exa / Brave / Serper / SearXNG / Google PSE / Linkup / SearchAPI / You.com / Perplexity. Use when the user wants to search the web, look up information, find articles, or query a search engine.
+---
+
+# ZevaiRouter — Web Search
+
+Requires `ZEVAI_URL` (and `ZEVAI_KEY` if auth enabled). See https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai/SKILL.md for setup.
+
+## Discover
+
+```bash
+curl $ZEVAI_URL/v1/models/web | jq '.data[] | select(.kind=="webSearch") | .id'
+# Per-provider params (searchTypes, maxResults, required options like cx for google-pse)
+curl "$ZEVAI_URL/v1/models/info?id=tavily/search"
+```
+
+IDs end in `/search` (e.g. `tavily/search`). Combos (`owned_by:"combo"`) chain providers with auto-fallback.
+
+## Endpoint
+
+`POST $ZEVAI_URL/v1/search`
+
+| Field | Required | Notes |
+|---|---|---|
+| `model` (or `provider`) | yes | from `/v1/models/web` (e.g. `tavily` or `brave`) |
+| `query` | yes | search query |
+| `max_results` | no | default 5 |
+| `search_type` | no | `web` (default) / `news` |
+| `country`, `language`, `time_range`, `domain_filter` | no | provider-dependent |
+
+## Examples
+
+```bash
+curl -X POST $ZEVAI_URL/v1/search \
+  -H "Authorization: Bearer $ZEVAI_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"tavily","query":"ZevaiRouter open source","max_results":5}'
+```
+
+JS:
+
+```js
+const r = await fetch(`${process.env.ZEVAI_URL}/v1/search`, {
+  method: "POST",
+  headers: { "Authorization": `Bearer ${process.env.ZEVAI_KEY}`, "Content-Type": "application/json" },
+  body: JSON.stringify({ model: "search-combo", query: "latest LLM benchmarks", max_results: 10 }),
+});
+console.log(await r.json());
+```
+
+## Response shape
+
+```json
+{
+  "provider": "tavily",
+  "query": "ZevaiRouter open source",
+  "results": [
+    {
+      "title": "...", "url": "https://...", "display_url": "github.com/...",
+      "snippet": "...", "position": 1, "score": 0.92,
+      "published_at": null, "favicon_url": null, "content": null,
+      "metadata": { "author": null, "language": null, "source_type": null, "image_url": null },
+      "citation": { "provider": "tavily", "retrieved_at": "2026-...", "rank": 1 }
+    }
+  ],
+  "answer": null,
+  "usage": { "queries_used": 1, "search_cost_usd": 0.008 },
+  "metrics": { "response_time_ms": 850, "upstream_latency_ms": 700, "total_results_available": 12 },
+  "errors": []
+}
+```
+
+## Provider quirks
+
+All accept `query` + `max_results`. Optional fields vary:
+
+| Provider | Supports | Required extras |
+|---|---|---|
+| `tavily` | country, domain_filter, news topic | — |
+| `exa` | domain_filter (incl/excl), news category | — |
+| `brave-search` | country, language | — |
+| `serper` | country, language, news endpoint | — |
+| `perplexity` | country, language, domain_filter | — |
+| `linkup` | domain_filter, time_range | `depth: fast/standard/deep` (option) |
+| `google-pse` | country, language, time_range, offset | **`cx` required** (providerOptions) |
+| `searchapi` | country, language, pagination | — |
+| `youcom` | country, language, time_range, domain_filter, full_page | — |
+| `searxng` | language, time_range | Self-hosted, **noAuth** |
+
+Provider IS the model — `"provider":"tavily" ≡ "model":"tavily"`.

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.1.38",
+  "version": "1.1.40",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.1.38",
+  "version": "1.1.40",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"
@@ -15,6 +15,8 @@
     "cli/LICENSE",
     "scripts/start-standalone.mjs",
     "scripts/gflow-reply-capture.py",
+    "scripts/flow-vps-setup.sh",
+    "skills/",
     "README.md",
     "README.zh-CN.md",
     "DOCKER.md",

package/scripts/flow-vps-setup.sh

@@ -0,0 +1,270 @@
+#!/usr/bin/env bash
+# One-command Google Flow setup for a headless Ubuntu/Debian VPS running ZevaiRouter.
+#
+#   sudo bash "$(npm root -g)/zevairouter/scripts/flow-vps-setup.sh"
+#
+# Installs real Google Chrome, Xvfb, x11vnc, ffmpeg and gflow-cli for a
+# dedicated non-root user, applies ZevaiRouter's gflow patch, and runs the gflow
+# daemon on 127.0.0.1 with a 6-hourly session renew. It also installs:
+#   flow-login <profile>   log one Google account in through a VNC window
+#   gflow-as-<user>        lets a root-run router list that user's gflow profiles
+# Safe to re-run: the daemon token, logged-in accounts and existing files are kept.
+#
+# Optional environment:
+#   FLOW_USER=flow           system user that owns Chrome profiles
+#   FLOW_DISPLAY=98          Xvfb display number
+#   FLOW_DAEMON_PORT=8077    gflow daemon port (127.0.0.1 only)
+#   FLOW_VNC_PORT=5998       VNC port used by flow-login (127.0.0.1 only)
+#   FLOW_GFLOW_SPEC="gflow-cli>=0.88,<0.90"   gflow-cli versions the patch supports
+#   FLOW_SKIP_ROUTER_ENV=1   do not touch /etc/zevairouter/zevairouter.env
+
+set -Eeuo pipefail
+
+FLOW_USER="${FLOW_USER:-flow}"
+FLOW_DISPLAY="${FLOW_DISPLAY:-98}"
+FLOW_DAEMON_PORT="${FLOW_DAEMON_PORT:-8077}"
+FLOW_VNC_PORT="${FLOW_VNC_PORT:-5998}"
+FLOW_GFLOW_SPEC="${FLOW_GFLOW_SPEC:-gflow-cli>=0.88,<0.90}"
+FLOW_SKIP_ROUTER_ENV="${FLOW_SKIP_ROUTER_ENV:-0}"
+ROUTER_ENV=/etc/zevairouter/zevairouter.env
+
+ok()   { printf '  OK %s\n' "$*"; }
+warn() { printf '  WARN %s\n' "$*" >&2; }
+fail() { printf '  ERROR %s\n' "$*" >&2; exit 1; }
+log()  { printf '\n=== %s ===\n' "$*"; }
+have() { command -v "$1" >/dev/null 2>&1; }
+
+[ "$(uname -s 2>/dev/null || true)" = Linux ] || fail "flow-vps-setup.sh supports Linux only"
+[ "$(id -u)" -eq 0 ] || fail "run as root: sudo bash $0"
+have apt-get || fail "Ubuntu/Debian with apt-get is required"
+have systemctl && [ -d /run/systemd/system ] || fail "systemd is required"
+[[ "$FLOW_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || fail "FLOW_USER must be a valid user name"
+for n in FLOW_DISPLAY FLOW_DAEMON_PORT FLOW_VNC_PORT; do
+  [[ "${!n}" =~ ^[0-9]+$ ]] || fail "$n must be a number"
+done
+[ "$(dpkg --print-architecture)" = amd64 ] || fail "Google Chrome for Linux needs an amd64 (x86_64) VPS"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PATCH_SCRIPT="$SCRIPT_DIR/gflow-reply-capture.py"
+[ -f "$PATCH_SCRIPT" ] || fail "missing $PATCH_SCRIPT (run this from an installed zevairouter package)"
+
+# Units and helper commands get a suffix for any user other than the default,
+# so a second setup on the same host never overwrites the first.
+if [ "$FLOW_USER" = flow ]; then UNIT=gflow; SUFFIX=""; else UNIT="gflow-$FLOW_USER"; SUFFIX="-$FLOW_USER"; fi
+HOME_DIR="/home/$FLOW_USER"
+RUNUSER="$(command -v runuser)"
+LOGIN_BIN="/usr/local/bin/flow-login$SUFFIX"
+WRAPPER_BIN="/usr/local/bin/gflow-as-$FLOW_USER"
+
+log "System packages"
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq curl ca-certificates openssl xvfb x11vnc xdotool ffmpeg >/dev/null
+if ! have google-chrome; then
+  chrome_deb="$(mktemp --suffix=.deb)"
+  curl --proto '=https' --tlsv1.2 -fsSL -o "$chrome_deb" \
+    https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
+  apt-get install -y -qq "$chrome_deb" >/dev/null
+  rm -f "$chrome_deb"
+fi
+ok "$(google-chrome --version)"
+
+log "User $FLOW_USER"
+id "$FLOW_USER" >/dev/null 2>&1 || useradd --create-home --shell /bin/bash "$FLOW_USER"
+install -d -o "$FLOW_USER" -g "$FLOW_USER" -m 700 "$HOME_DIR/.gflow-agent"
+install -d -o "$FLOW_USER" -g "$FLOW_USER" -m 755 "$HOME_DIR/gflow-out"
+as_user() { (cd "$HOME_DIR" && "$RUNUSER" -u "$FLOW_USER" -- /usr/bin/env HOME="$HOME_DIR" PATH="$HOME_DIR/.local/bin:/usr/bin:/bin" "$@"); }
+ok "$(id "$FLOW_USER")"
+
+log "gflow-cli"
+if [ ! -x "$HOME_DIR/.local/bin/uv" ]; then
+  as_user bash -c 'curl --proto "=https" --tlsv1.2 -LsSf https://astral.sh/uv/install.sh | sh' >/dev/null
+fi
+if [ ! -x "$HOME_DIR/.local/bin/gflow" ]; then
+  as_user uv tool install "$FLOW_GFLOW_SPEC" >/dev/null
+fi
+GFLOW_PY="$(as_user uv tool dir)/gflow-cli/bin/python"
+[ -x "$GFLOW_PY" ] || fail "gflow-cli python not found at $GFLOW_PY"
+as_user "$GFLOW_PY" "$PATCH_SCRIPT"
+ok "$(as_user gflow --version)"
+
+TOKEN_FILE="$HOME_DIR/.gflow-agent/token"
+if [ ! -s "$TOKEN_FILE" ]; then
+  (umask 077; openssl rand -hex 32 > "$TOKEN_FILE")
+  chown "$FLOW_USER:$FLOW_USER" "$TOKEN_FILE"
+  ok "created daemon token"
+else
+  ok "kept existing daemon token"
+fi
+
+log "systemd services"
+cat > "/etc/systemd/system/$UNIT-xvfb.service" <<EOF
+[Unit]
+Description=Xvfb display :$FLOW_DISPLAY for gflow (headed Chrome)
+After=network.target
+
+[Service]
+User=$FLOW_USER
+ExecStart=/usr/bin/Xvfb :$FLOW_DISPLAY -screen 0 1280x900x24 -nolisten tcp
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat > "/etc/systemd/system/$UNIT-daemon.service" <<EOF
+[Unit]
+Description=gflow MCP daemon (Google Flow via headed Chrome on Xvfb)
+Requires=$UNIT-xvfb.service
+After=$UNIT-xvfb.service network-online.target
+
+[Service]
+User=$FLOW_USER
+WorkingDirectory=$HOME_DIR
+Environment=DISPLAY=:$FLOW_DISPLAY
+Environment=HOME=$HOME_DIR
+Environment=PATH=$HOME_DIR/.local/bin:/usr/bin:/bin
+Environment=GFLOW_CLI_OUTPUT_DIR=$HOME_DIR/gflow-out
+Environment=GFLOW_CLI_LEASE_WAIT_SECONDS=600
+Environment=GFLOW_CLI_BROWSER_WINDOW_POSITION=0,0
+ExecStartPre=-$GFLOW_PY $PATCH_SCRIPT
+ExecStart=/bin/bash -c 'export GFLOW_DAEMON_TOKEN="\$(cat $TOKEN_FILE)"; exec $HOME_DIR/.local/bin/gflow serve --port $FLOW_DAEMON_PORT --host 127.0.0.1'
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat > "/etc/systemd/system/$UNIT-renew.service" <<EOF
+[Unit]
+Description=Refresh all gflow Google sessions for $FLOW_USER
+
+[Service]
+Type=oneshot
+User=$FLOW_USER
+WorkingDirectory=$HOME_DIR
+Environment=DISPLAY=:$FLOW_DISPLAY
+Environment=HOME=$HOME_DIR
+Environment=PATH=$HOME_DIR/.local/bin:/usr/bin:/bin
+ExecStart=$HOME_DIR/.local/bin/gflow auth renew --all
+EOF
+cat > "/etc/systemd/system/$UNIT-renew.timer" <<EOF
+[Unit]
+Description=Refresh gflow sessions for $FLOW_USER every 6 hours
+
+[Timer]
+OnBootSec=10min
+OnUnitActiveSec=6h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+systemctl daemon-reload
+systemctl enable --now "$UNIT-xvfb.service" "$UNIT-renew.timer" >/dev/null 2>&1
+systemctl enable "$UNIT-daemon.service" >/dev/null 2>&1
+systemctl restart "$UNIT-daemon.service"
+
+log "Helper commands"
+cat > "$WRAPPER_BIN" <<EOF
+#!/bin/sh
+# Runs gflow as $FLOW_USER so a root-run ZevaiRouter can list its profiles.
+# gflow reads ./.env from its working directory, so run it from that home.
+cd $HOME_DIR || exit 1
+exec $RUNUSER -u $FLOW_USER -- /usr/bin/env HOME=$HOME_DIR PATH=$HOME_DIR/.local/bin:/usr/bin:/bin $HOME_DIR/.local/bin/gflow "\$@"
+EOF
+chmod 755 "$WRAPPER_BIN"
+
+cat > "$LOGIN_BIN" <<EOF
+#!/bin/bash
+# Log one Google account into gflow on this headless VPS: flow-login$SUFFIX <profile>
+# Opens a password-protected VNC on 127.0.0.1:$FLOW_VNC_PORT only (reach it through
+# an SSH tunnel), runs gflow auth login on display :$FLOW_DISPLAY, then closes VNC.
+set -euo pipefail
+PROFILE="\${1:-}"
+if [[ ! "\$PROFILE" =~ ^[A-Za-z0-9._-]{1,64}\$ ]]; then
+  echo "usage: flow-login$SUFFIX <profile-name>   (letters, digits, . _ -)" >&2
+  exit 2
+fi
+[ "\$(id -u)" -eq 0 ] || { echo "run as root" >&2; exit 1; }
+VPS_IP="\${FLOW_LOGIN_HOST:-\$(curl -s -m 5 https://api.ipify.org 2>/dev/null || true)}"
+VPS_IP="\${VPS_IP:-<this-vps-ip>}"
+PASS=\$(openssl rand -hex 4)
+$RUNUSER -u $FLOW_USER -- mkdir -p $HOME_DIR/.vnc
+$RUNUSER -u $FLOW_USER -- x11vnc -storepasswd "\$PASS" $HOME_DIR/.vnc/passwd >/dev/null 2>&1
+cleanup() {
+  pkill -u $FLOW_USER -f "x11vnc -display :$FLOW_DISPLAY " 2>/dev/null || true
+  rm -f $HOME_DIR/.vnc/passwd
+}
+trap cleanup EXIT
+$RUNUSER -u $FLOW_USER -- x11vnc -display :$FLOW_DISPLAY -localhost -rfbport $FLOW_VNC_PORT -forever -shared \\
+  -rfbauth $HOME_DIR/.vnc/passwd -quiet -bg -o /tmp/flow-vnc-$FLOW_USER.log >/dev/null
+cat <<MSG
+
+  1. On your computer, in a second terminal (Windows PowerShell or macOS Terminal):
+       ssh -L $FLOW_VNC_PORT:127.0.0.1:$FLOW_VNC_PORT root@\${VPS_IP}
+  2. Open a VNC viewer at 127.0.0.1:$FLOW_VNC_PORT   (password: \${PASS})
+       macOS: Finder > Go > Connect to Server > vnc://127.0.0.1:$FLOW_VNC_PORT
+       Windows: TigerVNC or RealVNC Viewer
+  3. In the Chrome window, sign in to Flow until the editor opens.
+     Chrome closes by itself when the session is saved.
+
+MSG
+cd $HOME_DIR
+$RUNUSER -u $FLOW_USER -- /usr/bin/env HOME=$HOME_DIR DISPLAY=:$FLOW_DISPLAY \\
+  PATH=$HOME_DIR/.local/bin:/usr/bin:/bin \\
+  GFLOW_CLI_BROWSER_WINDOW_POSITION=0,0 GFLOW_CLI_AUTH_LOGIN_TIMEOUT=1800 \\
+  bash -c '
+    ( while sleep 2; do
+        for w in \$(xdotool search --onlyvisible --class google-chrome 2>/dev/null); do
+          xdotool windowmove "\$w" 0 0 windowsize "\$w" 1280 900
+        done
+      done ) & FIT=\$!
+    gflow auth login --profile "\$1" --browser chrome; RC=\$?
+    kill "\$FIT" 2>/dev/null
+    exit "\$RC"
+  ' _ "\$PROFILE"
+echo
+echo "Done. In the ZevaiRouter dashboard: Providers > Google Flow > Import local profiles."
+EOF
+chmod 755 "$LOGIN_BIN"
+ok "$LOGIN_BIN"
+ok "$WRAPPER_BIN"
+
+if [ "$FLOW_SKIP_ROUTER_ENV" != 1 ] && [ -f "$ROUTER_ENV" ]; then
+  if grep -q '^GFLOW_BIN=' "$ROUTER_ENV"; then
+    ok "router already has $(grep '^GFLOW_BIN=' "$ROUTER_ENV")"
+  else
+    printf 'GFLOW_BIN=%s\n' "$WRAPPER_BIN" >> "$ROUTER_ENV"
+    ok "set GFLOW_BIN in $ROUTER_ENV"
+    if systemctl is-active --quiet zevairouter; then
+      systemctl restart zevairouter
+      ok "restarted zevairouter"
+    fi
+  fi
+fi
+
+log "Check"
+for _ in $(seq 1 30); do
+  (exec 3<>"/dev/tcp/127.0.0.1/$FLOW_DAEMON_PORT") 2>/dev/null && break
+  sleep 1
+done
+if (exec 3<>"/dev/tcp/127.0.0.1/$FLOW_DAEMON_PORT") 2>/dev/null; then
+  ok "gflow daemon listening on 127.0.0.1:$FLOW_DAEMON_PORT"
+else
+  warn "gflow daemon is not listening yet: journalctl -u $UNIT-daemon -n 50"
+fi
+
+cat <<EOF
+
+Google Flow is ready on this VPS.
+
+  Daemon URL:    http://127.0.0.1:$FLOW_DAEMON_PORT/mcp
+  Daemon token:  $(cat "$TOKEN_FILE")
+                 (shown again any time with: cat $TOKEN_FILE)
+
+Add a Google account:
+  1. ssh root@<this-vps-ip> $(basename "$LOGIN_BIN") akun1
+  2. Dashboard > Providers > Google Flow > Import local profiles,
+     paste the daemon URL and token above, then Import.
+EOF

package/skills/README.md

@@ -0,0 +1,43 @@
+# ZevaiRouter — Agent Skills
+
+Drop-in skills for any AI agent (Claude, Cursor, ChatGPT, custom SDK). Just **copy a link** below and paste it to your AI — it will fetch the skill and use ZevaiRouter for you.
+
+> Tip: start with the **zevairouter** entry skill — it covers setup and links to all capability skills.
+
+## Skills
+
+| Capability | Copy link below and paste to your AI |
+|---|---|
+| **Entry / Setup** (start here) | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai/SKILL.md |
+| Chat / code-gen | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-chat/SKILL.md |
+| Image generation | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-image/SKILL.md |
+| Video generation | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-video/SKILL.md |
+| Text-to-speech | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-tts/SKILL.md |
+| Speech-to-text | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-stt/SKILL.md |
+| Embeddings | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-embeddings/SKILL.md |
+| Web search | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-web-search/SKILL.md |
+| Web fetch (URL → markdown) | https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai-web-fetch/SKILL.md |
+
+## How to use
+
+Paste to your AI (Claude, Cursor, ChatGPT, …):
+
+```
+Read this skill and use it: https://raw.githubusercontent.com/verifiedlabs/zevairouter/refs/heads/main/skills/zevai/SKILL.md
+```
+
+Then ask normally — *"generate an image of a cat"*, *"transcribe this URL"*, etc.
+
+## Configure your shell once
+
+```bash
+export ZEVAI_URL="http://localhost:1997"   # local default, or your VPS / tunnel URL
+export ZEVAI_KEY="sk-..."                   # from Dashboard → Keys (only if requireApiKey=true)
+```
+
+Verify: `curl $ZEVAI_URL/api/health` → `{"ok":true}`.
+
+## Links
+
+- Source: https://github.com/Verifiedlabs/zevairouter
+- Local dashboard: http://localhost:1997/dashboard