@honlnk/image-studio-companion 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 鸿影
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,232 @@
+# GPT Image Studio Companion CLI
+
+本地 CLI 助手，为 GPT Image Studio 网页端提供安全的 API 凭据代理服务。
+
+## 安装与运行
+
+### npm 安装
+
+推荐用户通过 npm 全局安装：
+
+```bash
+npm install -g @honlnk/image-studio-companion
+gpt-image-studio login
+gpt-image-studio serve --channel stable
+```
+
+已安装 pnpm 的用户也可以使用：
+
+```bash
+pnpm add -g @honlnk/image-studio-companion
+gpt-image-studio login
+gpt-image-studio serve --channel stable
+```
+
+### 从源码开发运行
+
+项目使用 pnpm workspace。在仓库根目录执行：
+
+```bash
+pnpm install
+pnpm dev:companion
+```
+
+`pnpm dev:companion` 会以开发渠道启动服务，默认允许本地 Web App origin。
+
+### 从源码构建后运行
+
+```bash
+pnpm --filter @honlnk/image-studio-companion build
+pnpm --filter @honlnk/image-studio-companion start
+```
+
+也可以直接调用入口文件：
+
+```bash
+npx tsx companion/src/main.ts serve --port 19750
+```
+
+### 生产渠道运行
+
+通过 npm 安装后，生产渠道默认只允许正式站点访问本地 companion：
+
+```bash
+gpt-image-studio serve --channel stable
+```
+
+如需临时允许额外调试页面，必须显式提供完整 origin：
+
+```bash
+gpt-image-studio serve --channel stable --allow-origin http://localhost:5173
+```
+
+启动后监听 `127.0.0.1:19750`，等待网页端发起配对连接。
+
+## 命令
+
+### `serve` — 启动本地服务
+
+```bash
+gpt-image-studio serve
+# 源码开发时也可以直接调用入口文件
+npx tsx companion/src/main.ts serve
+```
+
+常用参数：
+
+| 参数 | 说明 |
+|------|------|
+| `--port <port>` | 指定监听端口，默认 `19750` |
+| `--channel stable|dev` | 指定安全渠道；stable 只允许正式站点，dev 额外允许本地开发 origin |
+| `--allow-origin <origin...>` | 追加允许的完整 origin，不支持通配符 |
+| `--session-ttl-days <days>` | 指定配对 session 有效天数，默认 30 天 |
+
+### `login` — 配置 API 凭据
+
+```bash
+gpt-image-studio login
+# 源码开发时
+npx tsx companion/src/main.ts login
+```
+
+交互式输入：
+
+1. **API Base URL** — 回车使用默认值 `https://api.openai.com/v1/images`
+2. **API Key** — 输入时不回显
+
+凭据保存到 `~/.gpt-image-studio/credentials.json`。
+
+### `status` — 查看状态
+
+```bash
+gpt-image-studio status
+# 源码开发时
+npx tsx companion/src/main.ts status
+```
+
+显示：
+- 凭据配置情况（Base URL + 脱敏后的 API Key）
+- 配对状态
+- 服务是否运行
+
+### `logout` — 清除凭据
+
+```bash
+gpt-image-studio logout
+# 源码开发时
+npx tsx companion/src/main.ts logout
+```
+
+删除本地保存的 API 凭据文件。
+
+### `unpair` — 清除网页端配对
+
+```bash
+gpt-image-studio unpair
+# 源码开发时
+npx tsx companion/src/main.ts unpair
+```
+
+删除本地保存的配对 session，不会清除 API 凭据。
+
+## 配对流程
+
+1. 启动 companion 服务（`pnpm dev:companion`）
+2. 在网页端设置中切换到「本地 Companion」模式
+3. 点击配对，终端会显示 6 位配对码
+4. 在网页端输入配对码完成连接
+
+配对码有效期 5 分钟。配对成功后，session token 保存在 `~/.gpt-image-studio/session.json`，默认有效期 30 天，下次启动服务时自动恢复。可以通过 `--session-ttl-days` 调整有效天数。
+
+## 数据目录
+
+所有本地状态保存在 `~/.gpt-image-studio/`：
+
+| 文件 | 内容 |
+|------|------|
+| `credentials.json` | API Base URL + API Key |
+| `session.json` | 配对 session token |
+
+## 升级
+
+### npm 安装升级
+
+使用全局安装的用户可以通过同一包管理器升级：
+
+```bash
+npm update -g @honlnk/image-studio-companion
+# 或
+pnpm update -g @honlnk/image-studio-companion
+```
+
+升级后建议运行：
+
+```bash
+gpt-image-studio status
+```
+
+### 源码升级
+
+从源码升级时，在仓库根目录拉取最新代码并重新安装依赖：
+
+```bash
+git pull
+pnpm install
+pnpm --filter @honlnk/image-studio-companion build
+```
+
+升级不会自动删除 `~/.gpt-image-studio/` 中的凭据和配对 session。升级后建议运行：
+
+```bash
+npx tsx companion/src/main.ts status
+```
+
+如果服务端口、正式站点 origin 或 session 策略发生变化，重新启动 `serve` 后按网页端提示重新配对。
+
+## 卸载与清理
+
+### npm 卸载
+
+使用全局安装的用户可以执行：
+
+```bash
+npm uninstall -g @honlnk/image-studio-companion
+# 或
+pnpm remove -g @honlnk/image-studio-companion
+```
+
+卸载 npm 包不会自动删除 `~/.gpt-image-studio/` 中的凭据和配对 session。
+
+### 本地状态清理
+
+停止 companion 进程后，可以按需要清理本地状态：
+
+```bash
+# 只清除 API 凭据
+gpt-image-studio logout
+# 源码开发时
+npx tsx companion/src/main.ts logout
+
+# 只清除网页端配对 session
+gpt-image-studio unpair
+# 源码开发时
+npx tsx companion/src/main.ts unpair
+
+# 完整删除 companion 本地状态
+rm -rf ~/.gpt-image-studio
+```
+
+如果只是切换 API key，运行 `login` 覆盖当前凭据即可，不需要删除整个目录。
+
+## 安全说明
+
+- 服务仅监听 `127.0.0.1`，不对外暴露
+- CORS 白名单默认只允许 `https://gpt-image.honlnk.com`
+- `--channel dev` 会额外允许 `http://127.0.0.1:8888` 和 `http://localhost:8888`
+- `--allow-origin` 只接受完整 origin，不支持通配符
+- 非公开端点需要配对后的 Bearer token 鉴权
+- 网页端无法读取真实 API Key，只能通过代理发起请求
+- 代理请求会限制 body 大小、引用图片数量和图片 MIME 类型
+- 日志会脱敏 Authorization、API key 和图片 base64 字段
+- 凭据和 session 文件会以 `0600` 权限写入
+- 凭据当前以明文 JSON 保存，请确保在个人设备上使用

package/dist/credentials.d.ts

@@ -0,0 +1,11 @@
+type Credentials = {
+    apiBaseUrl: string;
+    apiKey: string;
+    savedAt: string;
+};
+export declare function loadCredentials(): Credentials | null;
+export declare function saveCredentials(apiBaseUrl: string, apiKey: string): void;
+export declare function clearCredentials(): void;
+export declare function hasCredentials(): boolean;
+export declare function maskApiKey(apiKey: string): string;
+export {};

package/dist/credentials.js

@@ -0,0 +1,42 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const CONFIG_DIR = join(homedir(), ".gpt-image-studio");
+const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
+export function loadCredentials() {
+    try {
+        if (!existsSync(CREDENTIALS_FILE))
+            return null;
+        const data = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+        if (!data.apiBaseUrl || !data.apiKey)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveCredentials(apiBaseUrl, apiKey) {
+    if (!existsSync(CONFIG_DIR)) {
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+    const data = { apiBaseUrl, apiKey, savedAt: new Date().toISOString() };
+    writeFileSync(CREDENTIALS_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+    chmodSync(CREDENTIALS_FILE, 0o600);
+}
+export function clearCredentials() {
+    try {
+        if (existsSync(CREDENTIALS_FILE)) {
+            unlinkSync(CREDENTIALS_FILE);
+        }
+    }
+    catch { }
+}
+export function hasCredentials() {
+    return loadCredentials() !== null;
+}
+export function maskApiKey(apiKey) {
+    if (apiKey.length <= 8)
+        return "***";
+    return apiKey.slice(0, 8) + "***";
+}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/main.js

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+import { createInterface } from "node:readline";
+import { program } from "commander";
+import { loadCredentials, saveCredentials, clearCredentials, maskApiKey } from "./credentials.js";
+import { clearSession, getSessionInfo, loadSession } from "./pairingState.js";
+import { createSecurityConfig } from "./securityConfig.js";
+const VERSION = "0.1.0";
+program
+    .name("gpt-image-studio")
+    .description("GPT Image Studio 本地 CLI Companion")
+    .version(VERSION);
+program
+    .command("serve")
+    .description("启动本地 companion HTTP 服务")
+    .option("-p, --port <port>", "监听端口", "19750")
+    .option("--channel <channel>", "安全渠道：stable 或 dev", process.env.GPT_IMAGE_STUDIO_COMPANION_CHANNEL)
+    .option("--allow-origin <origin...>", "额外允许的完整 origin，例如 http://localhost:5173")
+    .option("--session-ttl-days <days>", "配对 session 有效天数", "30")
+    .action(async (opts) => {
+    const { startServer } = await import("./server.js");
+    await startServer({
+        port: Number(opts.port),
+        security: createSecurityConfig({
+            channel: opts.channel,
+            allowOrigins: opts.allowOrigin ?? [],
+            sessionTtlDays: Number(opts.sessionTtlDays),
+        }),
+    });
+});
+program
+    .command("login")
+    .description("配置 API 凭据")
+    .action(async () => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+    const apiBaseUrl = (await ask("API Base URL (默认 https://api.openai.com/v1/images): ")).trim()
+        || "https://api.openai.com/v1/images";
+    const apiKey = await new Promise((resolve) => {
+        process.stdout.write("API Key: ");
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw;
+        if (stdin.isTTY)
+            stdin.setRawMode(true);
+        let input = "";
+        const onData = (ch) => {
+            const c = ch.toString();
+            if (c === "\n" || c === "\r") {
+                stdin.removeListener("data", onData);
+                if (stdin.isTTY)
+                    stdin.setRawMode(wasRaw ?? false);
+                process.stdout.write("\n");
+                resolve(input);
+            }
+            else if (c === "" || c === "\b") {
+                input = input.slice(0, -1);
+            }
+            else if (c === "") {
+                process.exit(1);
+            }
+            else {
+                input += c;
+            }
+        };
+        stdin.resume();
+        stdin.on("data", onData);
+    });
+    rl.close();
+    if (!apiKey.trim()) {
+        console.log("未输入 API Key，取消操作。");
+        return;
+    }
+    saveCredentials(apiBaseUrl, apiKey.trim());
+    console.log("");
+    console.log("凭据已保存。");
+    console.log(`  API Base URL: ${apiBaseUrl}`);
+    console.log(`  API Key:      ${maskApiKey(apiKey.trim())}`);
+});
+program
+    .command("status")
+    .description("查看 companion 状态")
+    .action(async () => {
+    loadSession();
+    const creds = loadCredentials();
+    const session = getSessionInfo();
+    console.log("┌─────────────────────────────────┐");
+    console.log("│  GPT Image Studio Companion     │");
+    console.log("└─────────────────────────────────┘");
+    console.log("");
+    if (creds) {
+        console.log(`凭据:    已配置`);
+        console.log(`  Base URL: ${creds.apiBaseUrl}`);
+        console.log(`  API Key:  ${maskApiKey(creds.apiKey)}`);
+        console.log(`  保存时间: ${creds.savedAt}`);
+    }
+    else {
+        console.log("凭据:    未配置（运行 gpt-image-studio login 进行配置）");
+    }
+    console.log(`配对:    ${session.paired ? "已配对" : "未配对"}`);
+    if (session.expiresAt) {
+        console.log(`  过期时间: ${session.expiresAt}`);
+    }
+    try {
+        const res = await fetch("http://127.0.0.1:19750/health", { signal: AbortSignal.timeout(2000) });
+        if (res.ok) {
+            console.log("服务:    运行中 (127.0.0.1:19750)");
+        }
+        else {
+            console.log("服务:    未运行");
+        }
+    }
+    catch {
+        console.log("服务:    未运行");
+    }
+});
+program
+    .command("logout")
+    .description("清除已保存的凭据")
+    .action(async () => {
+    clearCredentials();
+    console.log("凭据已清除。");
+});
+program
+    .command("unpair")
+    .description("清除网页端配对 session")
+    .action(async () => {
+    clearSession();
+    console.log("配对 session 已清除。");
+});
+program.parse();

package/dist/middleware/auth.d.ts

@@ -0,0 +1,2 @@
+import type { FastifyInstance } from "fastify";
+export declare function authMiddleware(app: FastifyInstance): Promise<void>;

package/dist/middleware/auth.js

@@ -0,0 +1,16 @@
+import { validateToken } from "../pairingState.js";
+const PUBLIC_PATHS = ["/health", "/pair/start", "/pair/confirm"];
+export async function authMiddleware(app) {
+    app.addHook("onRequest", async (req, reply) => {
+        if (PUBLIC_PATHS.includes(req.url))
+            return;
+        const authHeader = req.headers.authorization;
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+            return reply.status(401).send({ error: "未授权：缺少 session token" });
+        }
+        const token = authHeader.slice(7);
+        if (!validateToken(token)) {
+            return reply.status(401).send({ error: "未授权：token 无效" });
+        }
+    });
+}

package/dist/pairingState.d.ts

@@ -0,0 +1,16 @@
+export declare function loadSession(): void;
+export declare function isPaired(): boolean;
+export declare function getSessionInfo(): {
+    paired: boolean;
+    expiresAt: string | null;
+};
+export declare function startPairing(): {
+    pairingCode: string;
+    expiresInSeconds: number;
+};
+export declare function confirmPairing(code: string, ttlMs?: number): {
+    sessionToken: string;
+    expiresAt: string;
+} | null;
+export declare function validateToken(token: string): boolean;
+export declare function clearSession(): void;

package/dist/pairingState.js

@@ -0,0 +1,106 @@
+import { randomUUID, randomInt } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const CONFIG_DIR = join(homedir(), ".gpt-image-studio");
+const SESSION_FILE = join(CONFIG_DIR, "session.json");
+const PAIRING_CODE_EXPIRY_MS = 5 * 60 * 1000;
+const DEFAULT_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+let activePairingCode = null;
+let pairingCodeExpiresAt = 0;
+let sessionToken = null;
+let sessionExpiresAt = null;
+export function loadSession() {
+    try {
+        if (existsSync(SESSION_FILE)) {
+            const data = JSON.parse(readFileSync(SESSION_FILE, "utf-8"));
+            if (!data.token || !data.expiresAt) {
+                sessionToken = null;
+                sessionExpiresAt = null;
+                return;
+            }
+            const expiresAt = Date.parse(data.expiresAt);
+            if (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) {
+                clearSession();
+                return;
+            }
+            sessionToken = data.token;
+            sessionExpiresAt = expiresAt;
+        }
+    }
+    catch {
+        sessionToken = null;
+        sessionExpiresAt = null;
+    }
+}
+function saveSession(token, ttlMs) {
+    if (!existsSync(CONFIG_DIR)) {
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+    const createdAt = new Date();
+    const expiresAt = new Date(createdAt.getTime() + ttlMs);
+    const data = {
+        token,
+        createdAt: createdAt.toISOString(),
+        expiresAt: expiresAt.toISOString(),
+    };
+    writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+    chmodSync(SESSION_FILE, 0o600);
+    sessionExpiresAt = expiresAt.getTime();
+}
+export function isPaired() {
+    return getSessionInfo().paired;
+}
+export function getSessionInfo() {
+    if (!sessionToken || !sessionExpiresAt) {
+        return { paired: false, expiresAt: null };
+    }
+    if (Date.now() >= sessionExpiresAt) {
+        clearSession();
+        return { paired: false, expiresAt: null };
+    }
+    return { paired: true, expiresAt: new Date(sessionExpiresAt).toISOString() };
+}
+export function startPairing() {
+    activePairingCode = String(randomInt(100000, 999999));
+    pairingCodeExpiresAt = Date.now() + PAIRING_CODE_EXPIRY_MS;
+    console.log("");
+    console.log("┌─────────────────────────────────┐");
+    console.log("│  配对码: " + activePairingCode + "                  │");
+    console.log("│  请在网页端输入此配对码          │");
+    console.log("│  有效期 5 分钟                   │");
+    console.log("└─────────────────────────────────┘");
+    console.log("");
+    return {
+        pairingCode: activePairingCode,
+        expiresInSeconds: Math.floor(PAIRING_CODE_EXPIRY_MS / 1000),
+    };
+}
+export function confirmPairing(code, ttlMs = DEFAULT_SESSION_TTL_MS) {
+    if (!activePairingCode)
+        return null;
+    if (Date.now() > pairingCodeExpiresAt) {
+        activePairingCode = null;
+        return null;
+    }
+    if (code !== activePairingCode)
+        return null;
+    activePairingCode = null;
+    sessionToken = randomUUID();
+    saveSession(sessionToken, ttlMs);
+    console.log("配对成功！");
+    return { sessionToken, expiresAt: getSessionInfo().expiresAt };
+}
+export function validateToken(token) {
+    return getSessionInfo().paired && token === sessionToken;
+}
+export function clearSession() {
+    sessionToken = null;
+    sessionExpiresAt = null;
+    try {
+        if (existsSync(SESSION_FILE)) {
+            unlinkSync(SESSION_FILE);
+        }
+    }
+    catch { }
+}

package/dist/routes/auth.d.ts

@@ -0,0 +1,2 @@
+import type { FastifyInstance } from "fastify";
+export declare function authRoutes(app: FastifyInstance): Promise<void>;

package/dist/routes/auth.js

@@ -0,0 +1,20 @@
+import { loadCredentials, maskApiKey } from "../credentials.js";
+export async function authRoutes(app) {
+    app.get("/auth/status", async () => {
+        const creds = loadCredentials();
+        if (!creds) {
+            return {
+                provider: "openai",
+                mode: "api_key",
+                ready: false,
+                accountLabel: "",
+            };
+        }
+        return {
+            provider: "openai",
+            mode: "api_key",
+            ready: true,
+            accountLabel: maskApiKey(creds.apiKey),
+        };
+    });
+}

package/dist/routes/images.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance } from "fastify";
+import type { CompanionSecurityConfig } from "../securityConfig.js";
+type ImagesRoutesOptions = {
+    security: CompanionSecurityConfig;
+};
+export declare function imagesRoutes(app: FastifyInstance, opts: ImagesRoutesOptions): Promise<void>;
+export declare function validateEditMultipart(body: Buffer, security: CompanionSecurityConfig): string | null;
+export {};

package/dist/routes/images.js

@@ -0,0 +1,107 @@
+import { loadCredentials } from "../credentials.js";
+export async function imagesRoutes(app, opts) {
+    app.post("/images/generations", async (req, reply) => {
+        const creds = loadCredentials();
+        if (!creds) {
+            return reply.status(503).send({ error: "Companion 未配置凭据，请先运行 login" });
+        }
+        if (!isJsonRequest(req.headers["content-type"])) {
+            return reply.status(415).send({ error: "请求 Content-Type 必须是 application/json" });
+        }
+        const body = req.body;
+        const validationError = validateGenerationBody(body);
+        if (validationError) {
+            return reply.status(400).send({ error: validationError });
+        }
+        const apiUrl = `${creds.apiBaseUrl.replace(/\/+$/, "")}/generations`;
+        const response = await fetch(apiUrl, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${creds.apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(body),
+        });
+        const payload = await response.text();
+        return reply.status(response.status).header("content-type", "application/json").send(payload);
+    });
+    app.addContentTypeParser("multipart/form-data", function (_req, payload, done) {
+        const chunks = [];
+        payload.on("data", (chunk) => chunks.push(chunk));
+        payload.on("end", () => done(null, Buffer.concat(chunks)));
+        payload.on("error", done);
+    });
+    app.post("/images/edits", { bodyLimit: opts.security.maxEditBodyBytes }, async (req, reply) => {
+        const creds = loadCredentials();
+        if (!creds) {
+            return reply.status(503).send({ error: "Companion 未配置凭据，请先运行 login" });
+        }
+        if (!isMultipartRequest(req.headers["content-type"])) {
+            return reply.status(415).send({ error: "请求 Content-Type 必须是 multipart/form-data" });
+        }
+        const apiUrl = `${creds.apiBaseUrl.replace(/\/+$/, "")}/edits`;
+        const contentType = req.headers["content-type"];
+        const rawBody = req.body;
+        const validationError = validateEditMultipart(rawBody, opts.security);
+        if (validationError) {
+            return reply.status(400).send({ error: validationError });
+        }
+        const response = await fetch(apiUrl, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${creds.apiKey}`,
+                "Content-Type": contentType,
+            },
+            body: new Uint8Array(rawBody),
+        });
+        const payload = await response.text();
+        return reply.status(response.status).header("content-type", "application/json").send(payload);
+    });
+}
+function isJsonRequest(contentType) {
+    return contentType?.toLowerCase().split(";")[0]?.trim() === "application/json";
+}
+function isMultipartRequest(contentType) {
+    return contentType?.toLowerCase().startsWith("multipart/form-data") ?? false;
+}
+function validateGenerationBody(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        return "请求体必须是 JSON object";
+    }
+    if (typeof body.model !== "string" || !body.model.trim()) {
+        return "缺少 model";
+    }
+    if (typeof body.prompt !== "string" || !body.prompt.trim()) {
+        return "缺少 prompt";
+    }
+    if ("b64_json" in body || "image" in body || "image[]" in body) {
+        return "文生图请求不能包含图片内容";
+    }
+    return null;
+}
+export function validateEditMultipart(body, security) {
+    const text = body.toString("latin1");
+    const imagePartNames = [...text.matchAll(/name="image(?:\[\])?"/g)];
+    if (imagePartNames.length === 0) {
+        return "编辑请求至少需要一张引用图片";
+    }
+    if (imagePartNames.length > security.maxEditImages) {
+        return `编辑请求最多支持 ${security.maxEditImages} 张引用图片`;
+    }
+    const partHeaders = text.match(/Content-Disposition:[\s\S]*?(?=\r\n\r\n)/g) ?? [];
+    for (const header of partHeaders) {
+        if (!/name="(?:image(?:\[\])?|mask)"/.test(header))
+            continue;
+        const mime = /Content-Type:\s*([^\r\n]+)/i.exec(header)?.[1]?.trim().toLowerCase();
+        if (!mime) {
+            return "图片 part 缺少 Content-Type";
+        }
+        if (/name="mask"/.test(header) && mime !== "image/png") {
+            return "mask 必须是 image/png";
+        }
+        if (/name="image(?:\[\])?"/.test(header) && !security.allowedEditImageMimeTypes.includes(mime)) {
+            return `不支持的图片类型：${mime}`;
+        }
+    }
+    return null;
+}

package/dist/routes/pair.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyInstance } from "fastify";
+type PairRoutesOptions = {
+    sessionTtlMs: number;
+};
+export declare function pairRoutes(app: FastifyInstance, opts: PairRoutesOptions): Promise<void>;
+export {};

package/dist/routes/pair.js

@@ -0,0 +1,15 @@
+import { startPairing, confirmPairing } from "../pairingState.js";
+export async function pairRoutes(app, opts) {
+    app.post("/pair/start", async (_req, reply) => {
+        const result = startPairing();
+        return reply.send(result);
+    });
+    app.post("/pair/confirm", async (req, reply) => {
+        const { pairingCode } = req.body;
+        const result = confirmPairing(pairingCode, opts.sessionTtlMs);
+        if (!result) {
+            return reply.status(401).send({ error: "配对码无效或已过期" });
+        }
+        return reply.send(result);
+    });
+}

package/dist/securityConfig.d.ts

@@ -0,0 +1,19 @@
+export type CompanionChannel = "stable" | "dev";
+export type CompanionSecurityConfig = {
+    channel: CompanionChannel;
+    allowedOrigins: string[];
+    sessionTtlMs: number;
+    maxJsonBodyBytes: number;
+    maxEditBodyBytes: number;
+    maxEditImages: number;
+    allowedEditImageMimeTypes: string[];
+};
+export declare function resolveChannel(value: string | undefined): CompanionChannel;
+export declare function normalizeOrigin(origin: string): string;
+export declare function parseAllowOrigins(values?: string[]): string[];
+export declare function createSecurityConfig(opts?: {
+    channel?: string;
+    allowOrigins?: string[];
+    sessionTtlDays?: number;
+}): CompanionSecurityConfig;
+export declare function isOriginAllowed(origin: string | undefined, allowedOrigins: string[]): boolean;

package/dist/securityConfig.js

@@ -0,0 +1,67 @@
+const STABLE_ORIGINS = ["https://gpt-image.honlnk.com"];
+const DEV_ORIGINS = [
+    "https://gpt-image.honlnk.com",
+    "http://127.0.0.1:8888",
+    "http://localhost:8888",
+];
+const DEFAULT_SESSION_TTL_DAYS = 30;
+const DEFAULT_JSON_BODY_BYTES = 1024 * 1024;
+const DEFAULT_EDIT_BODY_BYTES = 50 * 1024 * 1024;
+const DEFAULT_MAX_EDIT_IMAGES = 16;
+const DEFAULT_EDIT_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp"];
+export function resolveChannel(value) {
+    return value === "dev" ? "dev" : "stable";
+}
+export function normalizeOrigin(origin) {
+    const trimmed = origin.trim();
+    if (!trimmed || trimmed === "*") {
+        throw new Error("Origin 必须是完整 origin，不能为空或使用通配符。");
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`Origin 格式无效：${origin}`);
+    }
+    if (!["http:", "https:"].includes(url.protocol)) {
+        throw new Error(`Origin 只支持 http 或 https：${origin}`);
+    }
+    if (url.pathname !== "/" || url.search || url.hash) {
+        throw new Error(`Origin 不能包含路径、查询或 hash：${origin}`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`Origin 不能包含用户名或密码：${origin}`);
+    }
+    return url.origin;
+}
+export function parseAllowOrigins(values = []) {
+    return values.map(normalizeOrigin);
+}
+export function createSecurityConfig(opts = {}) {
+    const channel = resolveChannel(opts.channel);
+    const baseOrigins = channel === "dev" ? DEV_ORIGINS : STABLE_ORIGINS;
+    const extraOrigins = parseAllowOrigins(opts.allowOrigins);
+    const sessionTtlDays = Number.isFinite(opts.sessionTtlDays)
+        ? opts.sessionTtlDays
+        : DEFAULT_SESSION_TTL_DAYS;
+    return {
+        channel,
+        allowedOrigins: Array.from(new Set([...baseOrigins, ...extraOrigins])),
+        sessionTtlMs: Math.max(1, sessionTtlDays) * 24 * 60 * 60 * 1000,
+        maxJsonBodyBytes: DEFAULT_JSON_BODY_BYTES,
+        maxEditBodyBytes: DEFAULT_EDIT_BODY_BYTES,
+        maxEditImages: DEFAULT_MAX_EDIT_IMAGES,
+        allowedEditImageMimeTypes: DEFAULT_EDIT_IMAGE_MIME_TYPES,
+    };
+}
+export function isOriginAllowed(origin, allowedOrigins) {
+    if (!origin)
+        return true;
+    try {
+        return allowedOrigins.includes(normalizeOrigin(origin));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/server.d.ts

@@ -0,0 +1,5 @@
+import type { CompanionSecurityConfig } from "./securityConfig.js";
+export declare function startServer(opts: {
+    port: number;
+    security: CompanionSecurityConfig;
+}): Promise<void>;

package/dist/server.js

@@ -0,0 +1,50 @@
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import { loadSession, isPaired } from "./pairingState.js";
+import { pairRoutes } from "./routes/pair.js";
+import { authRoutes } from "./routes/auth.js";
+import { imagesRoutes } from "./routes/images.js";
+import { authMiddleware } from "./middleware/auth.js";
+import { isOriginAllowed } from "./securityConfig.js";
+export async function startServer(opts) {
+    loadSession();
+    const app = Fastify({
+        bodyLimit: opts.security.maxJsonBodyBytes,
+        logger: {
+            redact: [
+                "req.headers.authorization",
+                "req.headers.cookie",
+                "res.headers.authorization",
+                "headers.authorization",
+                "apiKey",
+                "api_key",
+                "b64_json",
+            ],
+        },
+    });
+    await app.register(cors, {
+        origin: (origin, cb) => {
+            cb(null, isOriginAllowed(origin, opts.security.allowedOrigins));
+        },
+        credentials: true,
+    });
+    await authMiddleware(app);
+    await app.register(pairRoutes, { sessionTtlMs: opts.security.sessionTtlMs });
+    await app.register(authRoutes);
+    await app.register(imagesRoutes, { security: opts.security });
+    app.get("/health", async () => {
+        return {
+            app: "gpt-image-studio-companion",
+            version: "0.1.0",
+            paired: isPaired(),
+        };
+    });
+    await app.listen({ host: "127.0.0.1", port: opts.port });
+    console.log(`Companion 服务已启动: http://127.0.0.1:${opts.port}`);
+    console.log(`安全渠道: ${opts.security.channel}`);
+    console.log("允许的 Origin:");
+    opts.security.allowedOrigins.forEach((origin) => console.log(`  - ${origin}`));
+    if (!isPaired()) {
+        console.log("等待网页端发起配对...");
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,22 @@
+export type CompanionHealthResponse = {
+    app: "gpt-image-studio-companion";
+    version: string;
+    paired: boolean;
+};
+export type CompanionAuthStatus = {
+    provider: string;
+    mode: "api_key";
+    ready: boolean;
+    accountLabel: string;
+};
+export type PairStartResponse = {
+    pairingCode: string;
+    expiresInSeconds: number;
+};
+export type PairConfirmRequest = {
+    pairingCode: string;
+};
+export type PairConfirmResponse = {
+    sessionToken: string;
+    expiresAt?: string;
+};

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@honlnk/image-studio-companion",
+  "version": "0.1.0",
+  "description": "Local CLI companion for GPT Image Studio image API credential proxying.",
+  "type": "module",
+  "bin": {
+    "gpt-image-studio": "dist/main.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/honlnk/gpt-image-studio.git",
+    "directory": "companion"
+  },
+  "keywords": [
+    "gpt-image-studio",
+    "openai",
+    "images",
+    "cli",
+    "companion"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "dev": "tsx src/main.ts serve --channel dev",
+    "prepack": "pnpm build",
+    "build": "tsc",
+    "start": "node dist/main.js serve",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@fastify/cors": "^11.0.0",
+    "commander": "^13.1.0",
+    "fastify": "^5.3.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "tsx": "^4.19.0",
+    "typescript": "^6.0.3"
+  }
+}