@lightharu/krouter 1.8.0

package/out-server/main/registration/tlsClientPool.js

@@ -0,0 +1,70 @@
+"use strict";
+// TLS 客户端进程级共享池
+//
+// 背景：tlsclientwrapper 的 ModuleClient 内部是 piscina worker pool + 加载 DLL，
+// 每次新建 + open() 大约要 1-3 秒，批量注册时累计可达数十秒。
+// 由于 DLL 路径 / customLibraryPath 在整个应用生命周期内是稳定的，所有 Registrar 完全可以共用同一个 ModuleClient
+// （SessionClient 才是真正"按注册"独立的 TLS 会话/指纹层）。
+//
+// 设计：
+//   - 首次 acquireModuleClient() 时 open，之后所有调用直接拿同一个实例
+//   - 用 openPromise 防止并发首调导致重复 open
+//   - 主进程退出前统一 shutdownTlsClientPool() 释放 worker pool
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acquireModuleClient = acquireModuleClient;
+exports.isModuleClientReady = isModuleClientReady;
+exports.getModuleClientPoolStats = getModuleClientPoolStats;
+exports.shutdownTlsClientPool = shutdownTlsClientPool;
+const tlsclientwrapper_1 = require("tlsclientwrapper");
+let shared = null;
+let openPromise = null;
+/**
+ * 获取共享 ModuleClient。首次调用 open()，之后所有调用都拿同一个实例。
+ * 注意：传入的 opts 仅在首次有效；后续调用会忽略 opts 直接复用。
+ */
+async function acquireModuleClient(opts) {
+    if (shared)
+        return shared;
+    if (openPromise)
+        return openPromise;
+    openPromise = (async () => {
+        const mc = new tlsclientwrapper_1.ModuleClient(opts);
+        await mc.open();
+        shared = mc;
+        openPromise = null;
+        return mc;
+    })();
+    try {
+        return await openPromise;
+    }
+    catch (err) {
+        openPromise = null;
+        throw err;
+    }
+}
+/** 是否已经开启了共享池（用于诊断 / 日志） */
+function isModuleClientReady() {
+    return shared !== null;
+}
+/** 调试用：拿到 piscina 池统计 */
+function getModuleClientPoolStats() {
+    return shared ? shared.getPoolStats() : null;
+}
+/**
+ * 应用退出前统一清理：terminate 共享 ModuleClient。
+ * 带超时保护（5s），避免 DLL 内残留请求把退出卡住。
+ */
+async function shutdownTlsClientPool() {
+    const mc = shared;
+    shared = null;
+    openPromise = null;
+    if (!mc)
+        return;
+    try {
+        await Promise.race([
+            mc.terminate(),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('terminate timeout')), 5000))
+        ]);
+    }
+    catch { /* 超时 / piscina 终止错误均忽略 */ }
+}

package/out-server/main/registration/xxtea.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshAppJSConfig = refreshAppJSConfig;
+exports.getTESVersion = getTESVersion;
+exports.getIdentifier = getIdentifier;
+exports.getActiveKey = getActiveKey;
+exports.encryptFingerprint = encryptFingerprint;
+const DELTA = 0x9e3779b9 >>> 0;
+const FALLBACK_KEY = [1888420705, 2576816180, 2347232058, 874813317];
+const FALLBACK_VER = '4.0.0';
+const FALLBACK_IDENTIFIER = 'ECdITeCs';
+let cachedKey = null;
+let cachedVersion = '';
+let cachedIdentifier = '';
+let refreshPromise = null;
+function extractFromAppJS(js) {
+    let key = null;
+    let identifier = '';
+    let version = '';
+    const keyMatch = js.match(/var\s+\w+\s*=\s*\[(\d+),\s*"([A-Za-z0-9]+)",\s*(\d+),\s*(\d+),\s*(\d+)\]/);
+    if (keyMatch) {
+        const nums = [keyMatch[1], keyMatch[3], keyMatch[4], keyMatch[5]].map(Number);
+        key = [nums[2], nums[0], nums[3], nums[1]];
+        identifier = keyMatch[2];
+    }
+    const verMatch = js.match(/FWCIM_VERSION\s*=\s*"(\d+\.\d+\.\d+)"/);
+    if (verMatch) {
+        version = verMatch[1];
+    }
+    return { key, identifier, version };
+}
+async function refreshAppJSConfig(fetchFn) {
+    if (cachedKey)
+        return;
+    if (refreshPromise)
+        return refreshPromise;
+    refreshPromise = (async () => {
+        if (cachedKey)
+            return;
+        try {
+            const resp = await fetchFn('https://us-east-1.signin.aws/assets/js/app.js', {
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36',
+                    Accept: '*/*',
+                    Referer: 'https://us-east-1.signin.aws/'
+                }
+            });
+            const js = await resp.text();
+            if (js) {
+                const result = extractFromAppJS(js);
+                if (result.key)
+                    cachedKey = result.key;
+                if (result.identifier)
+                    cachedIdentifier = result.identifier;
+                if (result.version)
+                    cachedVersion = result.version;
+            }
+        }
+        catch (err) {
+            console.log('[xxtea] 下载 app.js 失败:', err);
+        }
+        if (!cachedKey) {
+            console.log('[xxtea] 使用 fallback 密钥');
+            cachedKey = [...FALLBACK_KEY];
+        }
+        if (!cachedVersion)
+            cachedVersion = FALLBACK_VER;
+        if (!cachedIdentifier)
+            cachedIdentifier = FALLBACK_IDENTIFIER;
+    })();
+    return refreshPromise;
+}
+function getTESVersion() {
+    return cachedVersion || FALLBACK_VER;
+}
+function getIdentifier() {
+    return cachedIdentifier || FALLBACK_IDENTIFIER;
+}
+function getActiveKey() {
+    return cachedKey
+        ? [...cachedKey]
+        : [...FALLBACK_KEY];
+}
+function xxteaEncryptCore(plaintext, key) {
+    if (!plaintext.length)
+        return Buffer.alloc(0);
+    const n = Math.ceil(plaintext.length / 4);
+    const v = new Uint32Array(n);
+    for (let i = 0; i < n; i++) {
+        let b0 = 0, b1 = 0, b2 = 0, b3 = 0;
+        if (4 * i < plaintext.length)
+            b0 = plaintext.charCodeAt(4 * i);
+        if (4 * i + 1 < plaintext.length)
+            b1 = plaintext.charCodeAt(4 * i + 1);
+        if (4 * i + 2 < plaintext.length)
+            b2 = plaintext.charCodeAt(4 * i + 2);
+        if (4 * i + 3 < plaintext.length)
+            b3 = plaintext.charCodeAt(4 * i + 3);
+        v[i] = (b0 | (b1 << 8) | (b2 << 16) | (b3 << 24)) >>> 0;
+    }
+    const rounds = 6 + Math.floor(52 / n);
+    let z = v[n - 1];
+    let total = 0;
+    for (let r = 0; r < rounds; r++) {
+        total = (total + DELTA) >>> 0;
+        const e = (total >>> 2) & 3;
+        for (let p = 0; p < n; p++) {
+            const y = v[(p + 1) % n];
+            const part1 = ((z >>> 5) ^ (y << 2)) >>> 0;
+            const part2 = ((y >>> 3) ^ (z << 4)) >>> 0;
+            const group1 = (part1 + part2) >>> 0;
+            const part3 = (total ^ y) >>> 0;
+            const part4 = (key[(p & 3) ^ e] ^ z) >>> 0;
+            const group2 = (part3 + part4) >>> 0;
+            const mx = (group1 ^ group2) >>> 0;
+            v[p] = (v[p] + mx) >>> 0;
+            z = v[p];
+        }
+    }
+    const result = Buffer.alloc(n * 4);
+    for (let i = 0; i < n; i++) {
+        result[4 * i] = v[i] & 0xff;
+        result[4 * i + 1] = (v[i] >>> 8) & 0xff;
+        result[4 * i + 2] = (v[i] >>> 16) & 0xff;
+        result[4 * i + 3] = (v[i] >>> 24) & 0xff;
+    }
+    return result;
+}
+/** 加密指纹 JSON: JSON -> CRC32前缀 -> XXTEA加密 -> base64 -> identifier:结果 */
+function encryptFingerprint(jsonStr) {
+    const crc = crc32(jsonStr);
+    const crcHex = crc.toString(16).toUpperCase().padStart(8, '0');
+    const plaintext = crcHex + '#' + jsonStr;
+    const key = getActiveKey();
+    const encrypted = xxteaEncryptCore(plaintext, key);
+    const encoded = encrypted.toString('base64');
+    return getIdentifier() + ':' + encoded;
+}
+/** CRC32 (IEEE) */
+function crc32(str) {
+    const table = crc32Table();
+    let crc = 0xffffffff >>> 0;
+    for (let i = 0; i < str.length; i++) {
+        crc = ((crc >>> 8) ^ table[(crc ^ str.charCodeAt(i)) & 0xff]) >>> 0;
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+let _crc32Table = null;
+function crc32Table() {
+    if (_crc32Table)
+        return _crc32Table;
+    _crc32Table = new Uint32Array(256);
+    for (let i = 0; i < 256; i++) {
+        let c = i >>> 0;
+        for (let j = 0; j < 8; j++) {
+            c = c & 1 ? (0xedb88320 ^ (c >>> 1)) >>> 0 : c >>> 1;
+        }
+        _crc32Table[i] = c;
+    }
+    return _crc32Table;
+}

package/out-server/main/runtimePaths.js

@@ -0,0 +1,19 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRuntimeUserDataPath = getRuntimeUserDataPath;
+const path_1 = __importDefault(require("path"));
+function getRuntimeUserDataPath() {
+    try {
+        const electron = require('electron');
+        const electronPath = electron.app?.getPath?.('userData');
+        if (electronPath)
+            return electronPath;
+    }
+    catch {
+        // Running as the VPS web backend without Electron installed.
+    }
+    return path_1.default.resolve(process.env.KROUTER_DATA_DIR || process.env.KAM_DATA_DIR || process.env.KIRO_RUNTIME_DATA_DIR || process.env.KIRO_WEB_DATA_DIR || '.web-data');
+}

package/out-server/main/utils/redact.js

@@ -0,0 +1,95 @@
+"use strict";
+// 统一敏感信息脱敏工具
+//
+// 用途：在写日志 / 推送日志到 UI 前，把代理账密、token、password、apiKey 等敏感字段脱敏，
+// 避免凭据明文落到磁盘日志或在界面/控制台暴露。
+//
+// 设计：
+//   - redactString：处理裸字符串里的代理 URL 账密、Bearer token、长 JWT 串
+//   - redactValue：递归处理对象/数组，对"敏感键名"整体打码，并对字符串值套用 redactString
+//   - 防御递归深度与循环引用，避免日志路径上出问题
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactString = redactString;
+exports.redactValue = redactValue;
+/** 命中即整体打码的敏感键名（小写匹配） */
+const SENSITIVE_KEYS = [
+    'password', 'passwd', 'pwd',
+    'accesstoken', 'access_token',
+    'refreshtoken', 'refresh_token',
+    'idtoken', 'id_token',
+    'bearertoken', 'bearer',
+    'authorization', 'auth',
+    'apikey', 'api_key', 'x-api-key',
+    'clientsecret', 'client_secret',
+    'secret', 'epin', 'cookie', 'set-cookie',
+    'proxyauthorization', 'proxy-authorization'
+];
+/** 白名单：这些键虽然包含敏感子串但本身是安全的计量/统计字段 */
+const SAFE_KEYS = new Set([
+    'inputtokens', 'outputtokens', 'cachetokens',
+    'cachereadtokens', 'cachewritetokens', 'reasoningtokens',
+    'totaltokens', 'maxtokens', 'tokensused', 'tokencount'
+]);
+/** 仅保留头尾少量字符，中间打码；过短直接全打码 */
+function maskMiddle(value, head = 3, tail = 2) {
+    if (!value)
+        return value;
+    if (value.length <= head + tail + 2)
+        return '***';
+    return `${value.slice(0, head)}***${value.slice(-tail)}`;
+}
+/** 脱敏裸字符串中的常见敏感片段 */
+function redactString(input) {
+    if (!input)
+        return input;
+    let out = input;
+    // 1) 代理 / 任意 URL 里的 user:pass@host → user:***@host
+    out = out.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/gi, (_m, scheme, user) => {
+        return `${scheme}${user}:***@`;
+    });
+    // 2) Authorization: Bearer xxx / Basic xxx
+    out = out.replace(/(authorization\s*[:=]\s*)(bearer|basic)\s+([A-Za-z0-9._\-+/=]+)/gi, (_m, p, scheme) => {
+        return `${p}${scheme} ***`;
+    });
+    // 3) JWT（三段 base64url）整体打码
+    out = out.replace(/\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g, (m) => maskMiddle(m, 6, 4));
+    // 4) 形如 accessToken=xxx / "refreshToken":"xxx" 的内联键值（兜底，针对已被 JSON.stringify 的串）
+    out = out.replace(/("?(?:access_?token|refresh_?token|id_?token|password|api_?key|client_?secret|secret|epin)"?\s*[:=]\s*"?)([^",}\s]+)("?)/gi, (_m, prefix, val, suffix) => `${prefix}${maskMiddle(String(val))}${suffix}`);
+    return out;
+}
+function isSensitiveKey(key) {
+    const k = key.toLowerCase().replace(/[_-]/g, '');
+    if (SAFE_KEYS.has(k))
+        return false;
+    return SENSITIVE_KEYS.some((s) => k === s.replace(/[_-]/g, '') || k.includes(s.replace(/[_-]/g, '')));
+}
+/** 递归脱敏任意值（对象/数组/字符串）。maxDepth 防御过深结构与循环引用 */
+function redactValue(value, maxDepth = 6, seen = new WeakSet()) {
+    if (value == null)
+        return value;
+    if (typeof value === 'string')
+        return redactString(value);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (maxDepth <= 0)
+        return '[depth-limit]';
+    if (Array.isArray(value)) {
+        return value.map((v) => redactValue(v, maxDepth - 1, seen));
+    }
+    if (typeof value === 'object') {
+        if (seen.has(value))
+            return '[circular]';
+        seen.add(value);
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (isSensitiveKey(k)) {
+                out[k] = typeof v === 'string' ? maskMiddle(v) : '***';
+            }
+            else {
+                out[k] = redactValue(v, maxDepth - 1, seen);
+            }
+        }
+        return out;
+    }
+    return value;
+}