WildDragonLLC/9router
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
9router/package.json

66 lines
2 KiB
JSON
Raw Normal View History

Initial commit
2026-01-04 21:58:59 -05:00
{
"name": "9router-app",
# v0.5.50 (2026-08-05) ## Features - **Providers**: add TokenRouter (300+ models via OpenAI-compatible gateway) with exact per-model pricing for 110 models and `reasoning_effort` thinking config - **Providers**: add Self-hosted STT / TTS / Embedding — point 9Router at your own OpenAI-compatible speech and embedding servers (whisper.cpp, faster-whisper, Kokoro-FastAPI, llama-server, vLLM, Infinity). Unlike the named cloud providers these read `baseUrl` per connection, so one provider can front several machines - **Combos**: default-enable vision/audio capacity adapter (auto-routes to a vision/audio-capable model when the target lacks that capability, falling back to `oc/mimo-v2.5-free`), wired into chat handler routing - **Endpoint**: auto-provision a "Default Key" for first-time users so `/v1` works without a manual dashboard step - **Codex**: support GPT-5.6 Max/Ultra reasoning-level overrides (cx/ routes only) - **Qoder**: support PAT (Personal Access Token) connections end-to-end, alongside OAuth device flow - **CLI tools**: add OpenDesign (manalkaff/opendesign) support - **Headroom**: report effective payload savings (tool schema/history bytes broken out, byte-savings % reflects actual outbound reduction) - **Ollama**: Cloud quota tracker (session + weekly) + proactive background OAuth token refresh scheduler for all providers ## Fixes - **Providers**: remove Qwen (OAuth flow stopped working reliably) - **Passthrough**: detect codex-tui/Codex Desktop as native Codex client — they were falling through to the translator and losing fields like `reasoning.summary` - **OAuth**: scope antigravity header fixes to loadCodeAssist/onboardUser only - **OAuth**: keep `open` external in the build so xAI/Grok token refresh works on Windows - **OAuth**: declare missing `searchParams` in register-session handler (was a 500 instead of JSON on error) - **DB**: `ENABLE_REQUEST_LOGS` env var now overrides the UI setting correctly; observability defaults to off (opt-in) - **Translator**: preserve Codex Responses Lite tool use across chat-native OpenAI-compatible providers - **Translator**: don't drop image-only user messages in `prepareClaudeRequest` - **Translator**: drop JSON Schema keywords Gemini rejects (`uniqueItems`, `contains`, `multipleOf`, `unevaluatedProperties`, `unevaluatedItems`, `contentSchema`) - **Claude**: remove global header cache that leaked one client's identity headers onto another client/account sharing the server; gate `anthropic-beta` by model instead - **Antigravity**: drop retired Gemini 3.0 quota tiers, show Gemini 3.6 Flash usage bars - **Cloudflare AI**: declare API key authentication (dashboard showed "No connections" despite an active key) - **GitHub Copilot**: hold monthly-exhausted accounts until UTC month reset instead of only cooling down 120s - **CodeBuddy**: dodge Tencent CN content filter, add usage tracking, normalize codebuddy-intl messages - **Usage**: stop losing cached prompt tokens in the forced-SSE→JSON path - **Grok CLI**: display the public subscription tier from the OAuth token claim - **Providers**: count apikey connections for Ollama free-tier card; free-tier/ apikey providers without `authModes` now default to apikey (were treated oauth-only) - **Build**: include static/public assets in standalone output (login page hung on 404s when run via PM2) - **Server**: support IntelliJ IDEA OpenAI-compatible clients over HTTP (h2c upgrade handling) - **Auth**: redirect already-logged-in sessions away from `/login` - **CLI tools**: enable Apply button for dynamic OpenAI/Anthropic-compatible provider connections - **CLI**: include complete API artifacts in the CLI package - **TTS**: a bare self-hosted model name is the MODEL, not the voice — `kokoro` was parsed as a voice against a default model, 404ing or synthesising with the wrong one endpoint that drops packets never returns headers, so the request previously hung indefinitely
2026-08-05 05:49:14 -04:00
"version": "0.5.50",
Initial commit
2026-01-04 21:58:59 -05:00
"description": "9Router web dashboard",
"private": true,
"scripts": {
perf: faster dev startup and lighter bundle - Switch dev default to Turbopack (5-14x faster compile); keep webpack as dev:webpack - Tailwind v4 source() base so JIT scans identically under both bundlers - Lazy-load @xyflow/react via next/dynamic to keep it out of the shared bundle - optimizePackageImports for heavy barrel imports (xyflow, dnd-kit, material-symbols, marked) - Replace blind setTimeout waits with TCP health-check (waitServerReady) - Run checkForUpdate in parallel instead of blocking server spawn - Background MITM/tunnel/cloudflared kills off the critical path Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-10 02:08:02 -04:00
"dev": "next dev --port 20127",
"dev:webpack": "next dev --webpack --port 20127",
Fix Cowork model selection and Windows CLI packaging (#1129) Cherry-picked from upstream PR #1129 + local improvements: - dedupe inline remove-model handler -> use handleRemoveModel - add .next-cli-build/ and cli/.build-home/ to .gitignore
2026-05-14 22:30:31 -04:00
"build": "next build --webpack",
fix(build): include assets in standalone output With output: "standalone", next build writes server.js under .next/standalone but leaves generated static/public assets in the project root, so starting the standalone server directly (e.g. via PM2) 404s on JS/CSS/font/favicon requests and /login stays stuck loading. Add a postbuild step that copies .next/static and public into the standalone directory, skipping the workspace-traced CLI build which already copies its own assets.
2026-08-04 23:31:34 -04:00
"postbuild": "node scripts/copy-standalone-assets.mjs",
"postbuild:bun": "node scripts/copy-standalone-assets.mjs",
fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6) x-9r-real-ip and the Host fallback were trusted from client-controlled headers whenever custom-server.js was not in the request path (npm run start, start:bun), letting a remote caller pose as local to skip API key auth and reach LOCAL_ONLY_PATHS (/api/mcp/*, /api/tunnel/enable, /api/auth/reset-password). custom-server.js now generates a per-process secret at boot and stamps it as x-9r-peer-token on every request it sanitizes. hasTrustedPeerHeaders() (src/lib/auth/trustedPeer.js) gates trust in x-9r-real-ip on that secret; otherwise the guard falls back to Host only in development, and fails closed in production. Same gate on loginLimiter.getClientIp() so a spoofed header cannot rotate the login lockout bucket. Also: fix isLoopbackHostname for IPv6 (::1, ::ffff:127.0.0.1) which the old split(":")[0] reduced to empty string; route npm run start / start:bun through custom-server.js (postbuild copies it into .next/standalone, build-cli.js fails without it) so documented deployments keep passwordless local access.
2026-08-14 05:32:40 -04:00
"start": "node custom-server.js --port 20127",
Refactor
2026-06-15 07:18:04 -04:00
"dev:bun": "bun --bun next dev --webpack --port 20127",
Fix Cowork model selection and Windows CLI packaging (#1129) Cherry-picked from upstream PR #1129 + local improvements: - dedupe inline remove-model handler -> use handleRemoveModel - add .next-cli-build/ and cli/.build-home/ to .gitignore
2026-05-14 22:30:31 -04:00
"build:bun": "bun --bun next build --webpack",
fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6) x-9r-real-ip and the Host fallback were trusted from client-controlled headers whenever custom-server.js was not in the request path (npm run start, start:bun), letting a remote caller pose as local to skip API key auth and reach LOCAL_ONLY_PATHS (/api/mcp/*, /api/tunnel/enable, /api/auth/reset-password). custom-server.js now generates a per-process secret at boot and stamps it as x-9r-peer-token on every request it sanitizes. hasTrustedPeerHeaders() (src/lib/auth/trustedPeer.js) gates trust in x-9r-real-ip on that secret; otherwise the guard falls back to Host only in development, and fails closed in production. Same gate on loginLimiter.getClientIp() so a spoofed header cannot rotate the login lockout bucket. Also: fix isLoopbackHostname for IPv6 (::1, ::ffff:127.0.0.1) which the old split(":")[0] reduced to empty string; route npm run start / start:bun through custom-server.js (postbuild copies it into .next/standalone, build-cli.js fails without it) so documented deployments keep passwordless local access.
2026-08-14 05:32:40 -04:00
"start:bun": "bun ./.next/standalone/custom-server.js",
fix(auth): real client IP rate-limiting + remote default-password guard - Add custom-server.js: inject unspoofable socket IP, strip client XFF (wired into Docker CMD + CLI spawn + build-cli copy) - loginLimiter: key on trusted x-9r-real-ip, TRUST_PROXY opt-in, global fallback - Force password change on first remote login while default is in use - Add /api/auth/reset-password (local-only) so CLI reset writes live SQLite - CLI settings: reset via API instead of stale db.json - Fix OAuth modals opening duplicate browser tabs on add-connection - Add cli:pack / cli:publish scripts Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-08 01:10:02 -04:00
"cli:pack": "npm --prefix cli run pack:cli",
"cli:publish": "npm --prefix cli run publish:cli"
Initial commit
2026-01-04 21:58:59 -05:00
},
"dependencies": {
feat: add drag-and-drop reordering for combo models (#1056) (#1108)
2026-05-13 22:54:52 -04:00
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/modifiers": "^9.0.0",
"@dnd-kit/sortable": "^10.0.0",
"@dnd-kit/utilities": "^3.2.2",
ok
2026-01-26 22:49:16 -05:00
"@monaco-editor/react": "^4.7.0",
Fix AG, Kiro, Xiaomi Provider
2026-06-18 03:58:00 -04:00
"@next/third-parties": "^16.2.9",
feat(auth): add native SAML 2.0 SSO integration Add SAML 2.0 as a second SSO protocol alongside OIDC under a unified authMode/ssoType model. SP flows via @node-saml/node-saml: AuthnRequest generation, ACS POST assertion handling, SP metadata export, and admin config test endpoint. Replay-protected via saml_state cookie (httpOnly, SameSite=Lax) matched against InResponseTo; wantAssertionsSigned enforced. - src/lib/auth/saml.js: SAML instance builder, X.509 cert formatter, claim pickers - 4 routes under src/app/api/auth/saml/: start, acs, metadata, test - settingsRepo: ssoType + saml* defaults; login/status routes dispatch by type - profile page: SSO protocol switcher, IdP metadata XML + cert uploaders - login page: dynamic SAML sign-in button; Header: SAML user badge
2026-08-13 06:53:17 -04:00
"@node-saml/node-saml": "^5.1.0",
Fixed Codex
2026-02-21 02:36:06 -05:00
"@xyflow/react": "^12.10.1",
feat: add password change functionality and dependencies
2026-01-09 05:29:11 -05:00
"bcryptjs": "^3.0.3",
fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction - resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search) - fresh-install remote login with default password returns 403 without issuing a JWT - /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads - declare chalk and prop-types in package.json (used but previously undeclared)
2026-08-13 00:50:00 -04:00
"chalk": "^5.6.2",
feat: add confbox dependency and refactor TOML parsing in codex settings (#282) fix: update JSDoc for refreshAndUpdateCredentials return type
2026-03-11 06:00:49 -04:00
"confbox": "^0.2.4",
ReadMe
2026-01-05 03:55:56 -05:00
"express": "^5.2.1",
"http-proxy-middleware": "^3.0.5",
feat: add password change functionality and dependencies
2026-01-09 05:29:11 -05:00
"jose": "^6.1.3",
Add marked package, update Qwen executor for OAuth handling, and enhance changelog styles
2026-04-17 00:33:36 -04:00
"marked": "^18.0.1",
# v0.4.29 (2026-05-10) ## Features - Add Cline & Kilo Code tool cards - Tailscale TUN mode for stable Funnel TLS - Sort APIKEY providers by usage, collapse to top 20 ## Improvements - Local Material Symbols font (no Google Fonts) - Docker base: Bun → Node 22-alpine - MITM reads aliases from JSON cache (no native sqlite) - Stream stall timeout (2 min) in open-sse ## Fixes - Fal.ai key test: use stable models endpoint
2026-05-10 10:54:54 -04:00
"material-symbols": "^0.44.6",
ok
2026-01-26 22:49:16 -05:00
"monaco-editor": "^0.55.1",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"next": "^16.1.6",
fix: custom model compatibility with antigravity/mitm (PR #250)
2026-03-06 04:41:02 -05:00
"node-forge": "^1.3.3",
Initial commit
2026-01-04 21:58:59 -05:00
"node-machine-id": "^1.1.12",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"open": "^11.0.0",
"ora": "^9.1.0",
fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction - resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search) - fresh-install remote login with default password returns 403 without issuing a JWT - /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads - declare chalk and prop-types in package.json (used but previously undeclared)
2026-08-13 00:50:00 -04:00
"prop-types": "^15.8.1",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"react": "19.2.4",
"react-dom": "19.2.4",
feat: - Introduced per-provider strategy overrides in settings, allowing for more flexible connection management. - Added new provider models: DeepSeek 3.1, DeepSeek 3.2, and Qwen3 Coder Next. - Implemented UI changes to support round-robin strategy with sticky limits in the provider detail page. - Improved logging to display connection names instead of IDs for better clarity.
2026-03-11 07:04:38 -04:00
"react-is": "^16.13.1",
Fixed Codex
2026-02-21 02:36:06 -05:00
"recharts": "^3.7.0",
feat(antigravity): integrate Antigravity tool with MITM support and update CLI tools
2026-02-08 04:28:13 -05:00
"selfsigned": "^5.5.0",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"socks-proxy-agent": "^8.0.5",
- Enhance passthrough function to support response inspection - Add cursor tool configuration and update related components
2026-03-19 04:32:29 -04:00
"sql.js": "^1.14.1",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"undici": "^7.19.2",
Initial commit
2026-01-04 21:58:59 -05:00
"uuid": "^13.0.0",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"zustand": "^5.0.10"
Initial commit
2026-01-04 21:58:59 -05:00
},
fix: externalize better-sqlite3 for Next.js standalone builds Move better-sqlite3 to optionalDependencies so npm install doesn't fail on platforms without native build tools. Add it to serverExternalPackages so Next.js doesn't try to bundle the native addon into webpack chunks. Fixes #243
2026-03-18 09:25:48 -04:00
"optionalDependencies": {
"better-sqlite3": "^12.6.2"
},
feat(db): migrate from lowdb to SQLite with repos pattern - Add modular DB layer (adapters, migrations, repos, helpers) - Replace localDb/usageDb/requestDetailsDb monoliths with repos - Add Tailscale tunnel integration & status check API - Add /api/cli-tools/all-statuses aggregated endpoint - Add settingsStore (Zustand) and mitm/dbReader - Add DB unit tests (benchmark, concurrent, migration, vs-lowdb)
2026-05-09 06:48:20 -04:00
"comment_better_sqlite3": "kept in optionalDependencies so npm install doesn't fail on systems without build tools — sql.js is used as fallback at runtime",
Initial commit
2026-01-04 21:58:59 -05:00
"devDependencies": {
"@tailwindcss/postcss": "^4.1.18",
"eslint": "^9",
feat(codex): Cursor compatibility + Next.js 16 proxy migration - Force streaming for Codex/OpenAI models to fix non-streaming bug - Strip unsupported params (user, metadata, stream_options, prompt_cache_retention) - Force response translation from openai-responses to openai format - Migrate middleware.js to proxy.js for Next.js 16 - Use webpack explicitly in dev/build scripts - Updated Codex User-Agent
2026-02-01 21:17:15 -05:00
"eslint-config-next": "16.1.6",
feat: cherry-pick PR #183 — multi-provider support, PWA, dynamic models, UI improvements Cherry-picked from decolua/9router PR #183. Note: open-sse changes included but need further review due to extensive modifications. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 23:40:50 -05:00
"postcss": "^8.5.6",
Initial commit
2026-01-04 21:58:59 -05:00
"tailwindcss": "^4"
}
Fix antigravity
2026-02-26 21:17:49 -05:00
}
Reference in a new issue Copy permalink