@liuzijian625/code-cli 1.0.6 → 1.0.8

package/lib/remote.js

@@ -0,0 +1,250 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+
+const CONFIG_DIR = path.join(os.homedir(), '.code-cli');
+const REMOTE_SETTINGS_FILE = path.join(CONFIG_DIR, 'remote.json');
+const REMOTE_KEY_FILE = path.join(CONFIG_DIR, 'remote.key');
+
+const TOOLS = ['codex', 'claude', 'gemini'];
+const REMOTE_PRESETS_KDF_ITERATIONS = 200_000;
+
+function ensureConfigDir() {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  }
+}
+
+function chmod600(filePath) {
+  if (os.platform() === 'win32') return;
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {
+    // ignore
+  }
+}
+
+function writeJsonFileSecure(filePath, data) {
+  ensureConfigDir();
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), { mode: 0o600 });
+  chmod600(filePath);
+}
+
+function readJsonFileOrEmpty(filePath) {
+  if (!fs.existsSync(filePath)) return {};
+  try {
+    const raw = fs.readFileSync(filePath, 'utf-8');
+    if (!raw.trim()) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+
+function getOrCreateLocalKey() {
+  ensureConfigDir();
+
+  if (fs.existsSync(REMOTE_KEY_FILE)) {
+    const raw = fs.readFileSync(REMOTE_KEY_FILE, 'utf-8').trim();
+    try {
+      const key = Buffer.from(raw, 'base64');
+      if (key.length === 32) return key;
+    } catch {
+      // fall through to re-create
+    }
+  }
+
+  const key = crypto.randomBytes(32);
+  fs.writeFileSync(REMOTE_KEY_FILE, key.toString('base64'), { mode: 0o600 });
+  chmod600(REMOTE_KEY_FILE);
+  return key;
+}
+
+function encryptStringLocal(plaintext) {
+  const key = getOrCreateLocalKey();
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  return {
+    v: 1,
+    iv: iv.toString('base64'),
+    ct: ciphertext.toString('base64'),
+    tag: tag.toString('base64')
+  };
+}
+
+function decryptStringLocal(encrypted) {
+  if (!encrypted || typeof encrypted !== 'object' || Array.isArray(encrypted)) {
+    throw new Error('invalid encrypted data');
+  }
+  if (encrypted.v !== 1) {
+    throw new Error('unsupported encrypted data version');
+  }
+  const key = getOrCreateLocalKey();
+  const iv = Buffer.from(encrypted.iv, 'base64');
+  const ct = Buffer.from(encrypted.ct, 'base64');
+  const tag = Buffer.from(encrypted.tag, 'base64');
+
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return plaintext.toString('utf8');
+}
+
+export function getRemoteSettings() {
+  const settings = readJsonFileOrEmpty(REMOTE_SETTINGS_FILE);
+  const url = typeof settings.url === 'string' && settings.url.trim() ? settings.url.trim() : undefined;
+
+  let password;
+  if (typeof settings.password === 'string' && settings.password) {
+    password = settings.password;
+  } else if (settings.password && typeof settings.password === 'object') {
+    try {
+      password = decryptStringLocal(settings.password);
+    } catch {
+      password = undefined;
+    }
+  }
+
+  return { url, password };
+}
+
+export function setRemoteUrl(url) {
+  const settings = readJsonFileOrEmpty(REMOTE_SETTINGS_FILE);
+  settings.version = 1;
+  settings.url = url;
+  writeJsonFileSecure(REMOTE_SETTINGS_FILE, settings);
+}
+
+export function setRemotePassword(password) {
+  const settings = readJsonFileOrEmpty(REMOTE_SETTINGS_FILE);
+  settings.version = 1;
+  settings.password = encryptStringLocal(password);
+  writeJsonFileSecure(REMOTE_SETTINGS_FILE, settings);
+}
+
+export function clearRemotePassword() {
+  const settings = readJsonFileOrEmpty(REMOTE_SETTINGS_FILE);
+  delete settings.password;
+  writeJsonFileSecure(REMOTE_SETTINGS_FILE, settings);
+}
+
+function normalizePresetsShape(data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) {
+    throw new Error('预设文件格式错误：根节点必须是对象');
+  }
+
+  const normalized = {};
+  for (const tool of TOOLS) {
+    const list = data[tool];
+    if (list === undefined) {
+      normalized[tool] = [];
+      continue;
+    }
+    if (!Array.isArray(list)) {
+      throw new Error(`预设文件格式错误：${tool} 必须是数组`);
+    }
+    normalized[tool] = list.map((p, idx) => {
+      if (!p || typeof p !== 'object' || Array.isArray(p)) {
+        throw new Error(`预设文件格式错误：${tool}[${idx}] 必须是对象`);
+      }
+      const { name, url, key } = p;
+      if (typeof name !== 'string' || !name.trim()) {
+        throw new Error(`预设文件格式错误：${tool}[${idx}].name 必须是非空字符串`);
+      }
+      if (typeof url !== 'string' || !url.trim()) {
+        throw new Error(`预设文件格式错误：${tool}[${idx}].url 必须是非空字符串`);
+      }
+      if (typeof key !== 'string' || !key.trim()) {
+        throw new Error(`预设文件格式错误：${tool}[${idx}].key 必须是非空字符串`);
+      }
+      return { name: name.trim(), url: url.trim(), key: key.trim() };
+    });
+  }
+  return normalized;
+}
+
+function looksLikeEncryptedPresetsJson(obj) {
+  if (!obj || typeof obj !== 'object' || Array.isArray(obj)) return false;
+  if (obj.v !== 1 && obj.v !== 2) return false;
+  if (typeof obj.salt !== 'string' || typeof obj.iv !== 'string' || typeof obj.ct !== 'string' || typeof obj.tag !== 'string') return false;
+  if (obj.v === 2 && typeof obj.iterations !== 'number') return false;
+  return true;
+}
+
+function deriveKeyFromPasswordV1(password, salt) {
+  return crypto.scryptSync(password, salt, 32);
+}
+
+function deriveKeyFromPasswordV2(password, salt, iterations) {
+  if (!Number.isFinite(iterations) || iterations <= 0) {
+    throw new Error('invalid iterations');
+  }
+  return crypto.pbkdf2Sync(password, salt, iterations, 32, 'sha256');
+}
+
+function decryptPresetsPayload(payloadText, password) {
+  const payload = JSON.parse(payloadText);
+  if (!looksLikeEncryptedPresetsJson(payload)) {
+    // 兼容：远程文件也可以是明文 presets.json
+    return normalizePresetsShape(payload);
+  }
+
+  const salt = Buffer.from(payload.salt, 'base64');
+  const iv = Buffer.from(payload.iv, 'base64');
+  const ct = Buffer.from(payload.ct, 'base64');
+  const tag = Buffer.from(payload.tag, 'base64');
+
+  const key = payload.v === 2
+    ? deriveKeyFromPasswordV2(password, salt, payload.iterations)
+    : deriveKeyFromPasswordV1(password, salt);
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
+  const presets = JSON.parse(plaintext);
+  return normalizePresetsShape(presets);
+}
+
+export function encryptPresetsToPayload(presets, password) {
+  const normalized = normalizePresetsShape(presets);
+  const salt = crypto.randomBytes(16);
+  const iv = crypto.randomBytes(12);
+  const key = deriveKeyFromPasswordV2(password, salt, REMOTE_PRESETS_KDF_ITERATIONS);
+
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const plaintext = JSON.stringify(normalized);
+  const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  const payload = {
+    v: 2,
+    kdf: 'pbkdf2-sha256',
+    iterations: REMOTE_PRESETS_KDF_ITERATIONS,
+    cipher: 'aes-256-gcm',
+    salt: salt.toString('base64'),
+    iv: iv.toString('base64'),
+    ct: ct.toString('base64'),
+    tag: tag.toString('base64')
+  };
+
+  return JSON.stringify(payload, null, 2) + '\n';
+}
+
+export async function fetchRemotePresets(remoteUrl, password) {
+  const response = await fetch(remoteUrl, { redirect: 'follow' });
+  if (!response.ok) {
+    throw new Error(`远程请求失败：${response.status} ${response.statusText}`);
+  }
+  const text = await response.text();
+  try {
+    return decryptPresetsPayload(text, password);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`远程预设解析/解密失败：${message}`);
+  }
+}

package/package.json

@@ -1,11 +1,18 @@
 {
   "name": "@liuzijian625/code-cli",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "AI CLI 配置管理工具 - 管理 Codex、Claude Code、Gemini CLI 的配置",
   "main": "bin/cli.js",
   "bin": {
     "code-cli": "bin/cli.js"
   },
+  "files": [
+    "bin/",
+    "lib/",
+    "remote-server/main.go",
+    "remote-server/go.mod",
+    "remote-server/README.md"
+  ],
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },

package/remote-server/README.md

@@ -0,0 +1,56 @@
+# code-cli 远程预设服务（Go 单二进制）
+
+这个服务用于在一台公网服务器上集中维护加密后的 `presets.enc`，并提供网页在线预览/编辑；各台机器的 `code-cli` 每次从远程拉取 `presets.enc`，用同一套密码解密后应用配置。
+
+## 构建
+
+在有 Go 的机器上构建出单个可执行文件：
+
+```bash
+cd remote-server
+go build -o code-cli-remote .
+```
+
+把 `code-cli-remote` 拷贝到服务器即可部署（运行时不依赖其它文件，只有你指定的 `config` / `data` 会落盘）。
+
+## 启动
+
+```bash
+./code-cli-remote -listen :8080
+```
+
+打开浏览器访问 `http://<服务器>:8080/`：
+
+- 第一次打开：会提示你设置密码（同一套密码：网页登录 + presets 文件加密），并自动创建 `config` 和加密后的 `presets.enc`（默认写在可执行文件同目录）
+- 之后：使用该密码登录即可预览/编辑/保存
+
+页面会显示并提供“一键复制”远程拉取 URL：`http(s)://<服务器>:8080/presets.enc`
+
+如需自定义文件路径：
+
+```bash
+./code-cli-remote -listen :8080 -config /path/to/code-cli-remote.json -data /path/to/presets.enc
+```
+
+## （可选）命令行初始化
+
+如果你不想通过网页初始化，也可以用命令行初始化：
+
+```bash
+export CODECLI_REMOTE_PASSWORD='your-strong-password'
+./code-cli-remote -init -config ./code-cli-remote.json -data ./presets.enc
+```
+
+## 配置到各台机器（code-cli）
+
+在每台机器运行 `code-cli`：
+
+- 进入 `远程配置`
+- 设置远程 URL 为上面的 `.../presets.enc`
+- 设置/保存密码（本机加密保存）
+- 然后用 `应用远程配置` 来选择预设并应用
+
+## 安全建议
+
+- 强烈建议配合 HTTPS（例如用 Nginx/Caddy 反代到 `:8080`），避免密码在公网明文传输。
+- `presets.enc` 本身是密文（即使被下载也需要密码解密），但仍建议使用强密码并限制服务器访问来源（防火墙/安全组）。

package/remote-server/go.mod

@@ -0,0 +1,3 @@
+module code-cli-remote
+
+go 1.22