@follenfang/fupload 0.0.5 → 0.0.6

package/fupload/SKILL.md

@@ -2,7 +2,7 @@
 name: fupload
 description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox, NetEase DD, CurseForge, and Heybox Workshop, including CurseForge author project lookup, plugin ZIP upload, and Heybox client-session version management. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, CurseForge, Heybox, plugins, configurations, or WA.
 metadata:
-  version: "0.0.5"
+  version: "0.0.6"
 ---
 
 # Fupload

package/fupload/scripts/fupload_cli/__init__.py

@@ -1,3 +1,3 @@
 """Fupload Python CLI."""
 
-__version__ = "0.0.5"
+__version__ = "0.0.6"

package/fupload/scripts/fupload_cli/blackbox.py

@@ -6,19 +6,35 @@ from urllib.parse import urlencode
 from urllib.request import Request, urlopen
 from typing import Any, Mapping
 from .errors import FuploadError, ValidationError
-from .blackbox_auth import API_BASE, hkey, load_session
+from .blackbox_auth import API_BASE, CLIENT_VERSION, hkey, load_session
+
+API_MISC_BASE = "https://api.xiaoheihe.cn"
 
 class Blackbox:
     def __init__(self, config: Mapping[str, Any] | None = None, transport=None):
         self.config = dict(config or {})
         self.profile = Path(self.config.get("client_profile") or Path.home() / "AppData/Roaming/heybox-pc-launcher")
         self._transport = transport
-    def _request(self, method, path, body=None, query=None):
+    def _request(self, method, path, body=None, query=None, *, base=API_BASE):
         if self._transport: return self._transport(method, path, body or {}, query or {})
         cookies, identity = load_session(self.profile); ts=int(time.time()); nonce=hashlib.md5((str(ts)+secrets.token_hex(16)).encode()).hexdigest().upper()
-        params={**identity,"version":identity.get("version","1.12.0"),"hkey":hkey(path,ts,nonce),"_time":ts,"_chat_time":int(time.time()*1000),"nonce":nonce,**(query or {})}
-        headers={"User-Agent":"HeyboxApp/1.12.0","x_xhh_tokenid":cookies["x_xhh_tokenid"],"Cookie":"; ".join(f"{k}={v}" for k,v in cookies.items()),"Content-Type":"application/x-www-form-urlencoded"}
-        url=API_BASE+path+"?"+urlencode(params); data=urlencode(body or {},doseq=True).encode() if method=="POST" else None
+        version = identity.get("version") or CLIENT_VERSION
+        params={
+            "app": "heybox",
+            "os_type": "Windows",
+            "web_version": "",
+            **identity,
+            "version": version,
+            "hkey": hkey(path,ts + 1,nonce),
+            "_time": ts,
+            "_chat_time": int(time.time()*1000),
+            "nonce": nonce,
+            **(query or {}),
+        }
+        json_body = base == API_MISC_BASE or path.startswith("/bbs/app/api/qcloud/")
+        headers={"Referer":"https://chat.xiaoheihe.cn","User-Agent":f"HeyboxApp/{identity.get('exe_version') or version}","x_xhh_tokenid":cookies["x_xhh_tokenid"],"Cookie":" ".join(f"{k}={v};" for k,v in cookies.items()),"Content-Type":("application/json;charset=utf-8" if json_body else "application/x-www-form-urlencoded;charset=utf-8")}
+        url=base.rstrip("/")+path+"?"+urlencode(params)
+        data=(json.dumps(body or {}, separators=(",", ":")).encode() if json_body else urlencode(body or {},doseq=True).encode()) if method=="POST" else None
         try:
             with urlopen(Request(url,data=data,headers=headers,method=method),timeout=60) as r: result=json.loads(r.read().decode())
         except Exception as exc: raise FuploadError("Workshop API request failed", endpoint=path, verification_required=method=="POST") from exc
@@ -72,8 +88,10 @@ class Blackbox:
     def version_upsert(self,doc):
         aliases={"module_id":"moduleId","version_id":"versionId","game_versions":"gameVersions","file_url":"fileUrl"}
         normalized={aliases.get(k,k):v for k,v in doc.items() if k not in {"schema","dry_run"}}
+        upload_result = None
         if "file" in normalized and "fileUrl" not in normalized:
-            normalized["fileUrl"]=self.upload_zip(int(normalized["moduleId"]),str(normalized["file"]))["url"]
+            upload_result=self.upload_zip(int(normalized["moduleId"]),str(normalized["file"]))
+            normalized["fileUrl"]=upload_result["url"]
         if "fileUrl" not in normalized and "versionId" in normalized:
             existing = self._find_version(int(normalized["moduleId"]), int(normalized["versionId"]))
             if existing and existing.get("fileUrlHeybox"):
@@ -91,7 +109,10 @@ class Blackbox:
         if not found.get("fileUrlHeybox"):
             mismatches.append("fileUrl")
         if mismatches: raise FuploadError("version upsert readback mismatch",kind="verification_required",verification_required=True,details={"fields":mismatches})
-        return {"accepted":True,"verified":True,"module_id":body["moduleId"],"version_id":found.get("id"),"readback":self._redact(found),"response":self._redact(response)}
+        result={"accepted":True,"verified":True,"module_id":body["moduleId"],"version_id":found.get("id"),"readback":self._redact(found),"response":self._redact(response)}
+        if upload_result:
+            result["upload"]={key:upload_result[key] for key in ("protocol","bytes","sha256") if key in upload_result}
+        return result
     def version_delete(self,doc):
         version_id=doc.get("versionId",doc.get("version_id")); module_id=doc.get("moduleId",doc.get("module_id"))
         if version_id is None or module_id is None: raise ValidationError("versionId and moduleId are required")
@@ -133,6 +154,53 @@ class Blackbox:
         path=Path(file_path)
         if not path.is_file(): raise ValidationError("file does not exist",path="$.file")
         if dry_run: return {"dry_run":True,"bytes":path.stat().st_size,"sha256":hashlib.sha256(path.read_bytes()).hexdigest()}
+        try:
+            return self._upload_zip_v2(path)
+        except FuploadError:
+            # The web creator still exposes the legacy Workshop token route.
+            # Fall back to it when the desktop generic uploader is unavailable.
+            return self._upload_zip_legacy(path)
+
+    def _upload_zip_v2(self, path: Path):
+        file_info = {"name": path.name, "mimetype": "application/zip", "fsize": path.stat().st_size}
+        info = self._result(self._request(
+            "POST", "/bbs/app/api/qcloud/cos/upload/info/v2", base=API_MISC_BASE,
+            body={"file_infos": json.dumps([file_info], separators=(",", ":")), "scope": "any", "need_cache": 0},
+        ))
+        keys = info.get("keys") or []
+        if not keys or not info.get("bucket"):
+            raise FuploadError("Current COS upload info response is incomplete", endpoint="/bbs/app/api/qcloud/cos/upload/info/v2", verification_required=True)
+        key = str(keys[0])
+        token = self._result(self._request(
+            "POST", "/bbs/app/api/qcloud/cos/upload/token/v2", base=API_MISC_BASE,
+            body={"bucket": info["bucket"], "keys": json.dumps([key], separators=(",", ":")), "mimetypes": json.dumps([file_info["mimetype"]]), "is_multipart_upload": 0},
+        ))
+        credentials = token.get("credentials") or {}
+        secret_id = credentials.get("tmpSecretId") or credentials.get("TmpSecretID")
+        secret_key = credentials.get("tmpSecretKey") or credentials.get("TmpSecretKey")
+        session_token = credentials.get("sessionToken") or credentials.get("Token")
+        if not all((secret_id, secret_key, session_token)):
+            raise FuploadError("Current COS upload credentials are incomplete", endpoint="/bbs/app/api/qcloud/cos/upload/token/v2", verification_required=True)
+        try:
+            from qcloud_cos import CosConfig, CosS3Client
+        except ModuleNotFoundError as exc:
+            raise FuploadError("The managed Fuploader Python runtime is missing the Heybox COS SDK", kind="environment_error", details={"repair_command":"fupload update"}) from exc
+        try:
+            cos=CosS3Client(CosConfig(Region=info.get("region") or "ap-shanghai",SecretId=secret_id,SecretKey=secret_key,Token=session_token,Scheme="https"))
+            with path.open("rb") as stream: cos.put_object(Bucket=info["bucket"],Key=key,Body=stream)
+        except Exception as exc:
+            raise FuploadError("COS upload failed", endpoint="/bbs/app/api/qcloud/cos/upload/token/v2", verification_required=True) from exc
+        callback = self._result(self._request(
+            "POST", "/bbs/app/api/qcloud/cos/upload/callback/v2", base=API_MISC_BASE,
+            query={"is_finished": "true"}, body={"keys": json.dumps([key], separators=(",", ":"))},
+        ))
+        urls = callback.get("preview_urls") or callback.get("previewUrls") or []
+        url = urls[0] if urls else callback.get("url")
+        if not url:
+            raise FuploadError("Current COS upload callback did not return a URL", endpoint="/bbs/app/api/qcloud/cos/upload/callback/v2", verification_required=True)
+        return {"url":url,"bytes":path.stat().st_size,"sha256":hashlib.sha256(path.read_bytes()).hexdigest(),"protocol":"v2"}
+
+    def _upload_zip_legacy(self, path: Path):
         size_mb=path.stat().st_size/1024/1024
         token=self._result(self._request("POST","/wow/cos/upload/token/",body={"jsonData":json.dumps({"upload_infos":[{"filename":path.name,"file_size":size_mb,"type":"module"}]},separators=(",",":"))}))
         info=token["info"]; f=token["files"][0]; creds=info["Credentials"].get("Credentials",info["Credentials"])
@@ -148,4 +216,4 @@ class Blackbox:
             cos=CosS3Client(CosConfig(Region=info.get("region") or "ap-shanghai",SecretId=creds["TmpSecretID"],SecretKey=creds["TmpSecretKey"],Token=creds["Token"],Scheme="https"))
             with path.open("rb") as stream: cos.put_object(Bucket=info["bucket"],Key=f["key"],Body=stream)
         except Exception as exc: raise FuploadError("COS upload failed",verification_required=True) from exc
-        return {"url":"https://%s/%s"%(info["host"],f["key"]),"bytes":path.stat().st_size,"sha256":hashlib.sha256(path.read_bytes()).hexdigest()}
+        return {"url":"https://%s/%s"%(info["host"],f["key"]),"bytes":path.stat().st_size,"sha256":hashlib.sha256(path.read_bytes()).hexdigest(),"protocol":"legacy"}

package/fupload/scripts/fupload_cli/blackbox_auth.py

@@ -1,11 +1,13 @@
 """Authentication helpers for the Heybox desktop Workshop client."""
 from __future__ import annotations
-import hashlib, json, secrets, sqlite3, time
+import hashlib, json, platform, secrets, sqlite3, time
 from pathlib import Path
 from urllib.parse import parse_qs, urlparse
 from .errors import FuploadError
 
 API_BASE = "https://workshopapi.xiaoheihe.cn"
+CLIENT_VERSION = "1.14.1"
+_CONFIG_AES_KEY = bytes.fromhex("5f1d7f11e6e90dbb5c2f0c1e614a6a8c4b9e16b50fa724e4c54d6f25b1208b93")
 _ALPHABET = "AB45STUVWZEFGJ6CH01D237IXYPQRKLMN89"
 
 def _n8(value: str, limit: int) -> str:
@@ -28,27 +30,130 @@ def hkey(path: str, timestamp: int, nonce: str) -> str:
     digest = hashlib.md5(_interleave([_n8(str(timestamp), -2), _i8(normalized), _i8(nonce)]).encode()).hexdigest()
     return _n8(digest[:5], -4) + "%02d" % (sum(_mix([ord(x) for x in digest[-6:]])) % 100)
 
-def load_session(profile: Path | None = None):
-    profile = profile or Path.home() / "AppData/Roaming/heybox-pc-launcher"
+def _decrypt_user_pkey(value: str) -> str:
+    """Decrypt the desktop config's ``iv:ciphertext`` AES-256-CBC value.
+
+    Older Chromium cookie databases contain the already decrypted pkey, so this
+    helper deliberately returns ordinary values unchanged and only attempts
+    crypto for the new config format.
+    """
+    if not isinstance(value, str) or ":" not in value:
+        return value
+    iv_hex, ciphertext_hex = value.split(":", 1)
+    try:
+        iv = bytes.fromhex(iv_hex)
+        ciphertext = bytes.fromhex(ciphertext_hex)
+        if len(iv) != 16 or not ciphertext or len(ciphertext) % 16:
+            return value
+    except ValueError:
+        return value
+    try:
+        from Crypto.Cipher import AES
+        plaintext = AES.new(_CONFIG_AES_KEY, AES.MODE_CBC, iv).decrypt(ciphertext)
+    except ImportError:
+        try:
+            from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+            decryptor = Cipher(algorithms.AES(_CONFIG_AES_KEY), modes.CBC(iv)).decryptor()
+            plaintext = decryptor.update(ciphertext) + decryptor.finalize()
+        except ImportError as exc:
+            raise FuploadError(
+                "AES support is required to read the Heybox desktop session",
+                kind="environment_error",
+                details={"install": "Crypto or cryptography"},
+            ) from exc
+    if not plaintext:
+        return value
+    pad = plaintext[-1]
+    if not 1 <= pad <= 16 or plaintext[-pad:] != bytes([pad]) * pad:
+        raise FuploadError("Heybox desktop pkey could not be decrypted", kind="authentication_error")
+    try:
+        return plaintext[:-pad].decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise FuploadError("Heybox desktop pkey is invalid", kind="authentication_error") from exc
+
+
+def _read_json(path: Path) -> dict:
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, ValueError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _load_cookie_db(profile: Path) -> dict[str, str]:
     db = profile / "Network/Cookies"
     try:
         with sqlite3.connect("file:%s?mode=ro" % db, uri=True) as con:
             rows = con.execute("select name,value from cookies where host_key like '%xiaoheihe.cn'").fetchall()
-    except (OSError, sqlite3.Error) as exc:
-        raise FuploadError("Heybox desktop Cookie DB is missing", kind="authentication_error") from exc
-    cookies = {str(k): str(v) for k,v in rows if k in {"user_heybox_id","user_pkey","x_xhh_tokenid"} and v}
-    if not {"user_heybox_id","user_pkey","x_xhh_tokenid"} <= set(cookies):
-        raise FuploadError("Heybox desktop login state is incomplete", kind="authentication_error")
-    identity = {}
+    except (OSError, sqlite3.Error):
+        return {}
+    return {str(k): str(v) for k, v in rows if k in {"user_heybox_id", "user_pkey", "x_xhh_tokenid"} and v}
+
+
+def _read_sentry_identity(profile: Path) -> dict[str, str]:
+    identity: dict[str, str] = {}
     scope = profile / "sentry/scope_v3.json"
     try:
-        crumbs = json.loads(scope.read_text(encoding="utf-8")).get("scope",{}).get("breadcrumbs",[])
+        crumbs = _read_json(scope).get("scope", {}).get("breadcrumbs", [])
         for crumb in reversed(crumbs):
             raw = crumb.get("data",{}).get("url","")
             if "x_app=heybox_pc" in raw:
                 query = parse_qs(urlparse(raw).query)
-                allowed = {"x_client_type","x_os_type","x_app","version","exe_version","os_version","device_id","channel","heybox_id"}
-                identity = {k:v[-1] for k,v in query.items() if k in allowed and v}; break
+                allowed = {
+                    "app", "client_type", "device_id", "exe_version", "heybox_id",
+                    "os_type", "os_version", "version", "web_version", "x_app",
+                    "x_client_type", "x_client_version", "x_os_type",
+                }
+                identity = {k: v[-1] for k, v in query.items() if k in allowed and v}
+                break
     except (OSError, ValueError, TypeError):
         pass
+    return identity
+
+
+def load_session(profile: Path | None = None):
+    """Load the current desktop session without exposing credential material.
+
+    Heybox 1.14 stores its authoritative session in ``config.json``.  The
+    Chromium database is retained as a compatibility fallback because older
+    installations and upgrade paths may not have written the new config yet.
+    """
+    profile = profile or Path.home() / "AppData/Roaming/heybox-pc-launcher"
+    config = _read_json(profile / "config.json")
+    db_cookies = _load_cookie_db(profile)
+    cookies: dict[str, str] = dict(db_cookies)
+    config_cookies = config.get("cookies")
+    if isinstance(config_cookies, list):
+        for item in config_cookies:
+            if not isinstance(item, dict):
+                continue
+            name, value = item.get("name"), item.get("value")
+            if isinstance(name, str) and isinstance(value, str) and value:
+                if name in {"user_heybox_id", "user_pkey", "x_xhh_tokenid"}:
+                    cookies[name] = value
+    acc_config = config.get("acc_config")
+    if isinstance(acc_config, dict) and acc_config.get("xhh_token_id"):
+        cookies["x_xhh_tokenid"] = str(acc_config["xhh_token_id"])
+    if cookies.get("user_pkey"):
+        cookies["user_pkey"] = _decrypt_user_pkey(cookies["user_pkey"])
+    account = config.get("account") if isinstance(config.get("account"), dict) else {}
+    if not cookies.get("user_heybox_id") and account.get("heybox_id"):
+        cookies["user_heybox_id"] = str(account["heybox_id"])
+    if not {"user_heybox_id", "user_pkey", "x_xhh_tokenid"} <= set(cookies):
+        raise FuploadError("Heybox desktop login state is incomplete", kind="authentication_error")
+
+    identity = _read_sentry_identity(profile)
+    version = identity.get("version") or CLIENT_VERSION
+    identity = {
+        "x_client_type": "pc",
+        "x_os_type": "Windows",
+        "x_app": "heybox_pc",
+        "version": version,
+        "exe_version": identity.get("exe_version") or version,
+        "os_version": identity.get("os_version") or platform.platform(aliased=True),
+        **identity,
+    }
+    identity["version"] = version
+    identity["exe_version"] = identity.get("exe_version") or version
+    identity["heybox_id"] = cookies["user_heybox_id"]
     return cookies, identity

package/npm/skill-manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "fupload.npm-skill-manifest.v1",
   "package_name": "@follenfang/fupload",
-  "package_version": "0.0.5",
-  "skill_version": "0.0.5",
-  "tree_sha256": "0a6d0f91197fbaaff3266c7b78f6f894eb8eac38bdf899581909344393d79afd",
+  "package_version": "0.0.6",
+  "skill_version": "0.0.6",
+  "tree_sha256": "89170e9d93a44d9aa72a1c041f93d941609eb9d762375358090c5a96129405d9",
   "files": [
     {
       "path": "agents/openai.yaml",
@@ -108,17 +108,17 @@
     {
       "path": "scripts/fupload_cli/__init__.py",
       "bytes": 49,
-      "sha256": "219d361d9b7f13dc9ff7f9eab399b0696fd3de9adcd6ecae755f5724262f12e6"
+      "sha256": "acf9b050750b58742981c5b9ae836149b89bb86daad01d18dd1948e71817d2c2"
     },
     {
       "path": "scripts/fupload_cli/blackbox_auth.py",
-      "bytes": 2874,
-      "sha256": "e018a33dce4babd1dc739af68c58499412474c7e1f1e3c0640dc53dbe46fce29"
+      "bytes": 7211,
+      "sha256": "797ca228c57d2b845a7105f132891b71d3e494adcdb8f44027ce835125206177"
     },
     {
       "path": "scripts/fupload_cli/blackbox.py",
-      "bytes": 12499,
-      "sha256": "5b46c38f8c5f8a352f261f2c3751b51f16827f62410d2124e0147073e8308350"
+      "bytes": 16666,
+      "sha256": "c6a793cacc7d9ceb8995cac62a076c1944345eaa113bed21068c75a05b1b0ee6"
     },
     {
       "path": "scripts/fupload_cli/cli.py",
@@ -188,7 +188,7 @@
     {
       "path": "SKILL.md",
       "bytes": 22890,
-      "sha256": "937bbee45d18e8ef257a8071f63951aede681628bb951e40793de81d763f85f3"
+      "sha256": "af700f4e6eb924d955c8e5ae1205934c0bc08b425c85ce5f279eb0c630a0f77a"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@follenfang/fupload",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Install and run the Fuploader Agent Skill and Python CLI.",
   "type": "module",
   "bin": {