@raolin2025/claude-code-node 2.5.1 → 2.6.1

package/README.md

@@ -206,10 +206,24 @@ cc-node --model kimi-k2-0711 --api-base https://api.moonshot.cn/v1
 # OpenAI
 cc-node --model gpt-4o --api-base https://api.openai.com/v1
 
-# Ollama 本地
-cc-node --model qwen2.5 --api-base http://localhost:11434/v1
+# Ollama / 自建本地服务（Ollama / llama.cpp / vLLM 等）
+# 指向 localhost 或内网地址时【无需 apiKey】，直接可用
+cc-node --api-base http://localhost:11434/v1 --model qwen2.5
+
+# 内网自建服务（局域网 IP，同样无需 apiKey）
+# 将 <内网IP> 替换为你的服务器地址，如 192.168.x.x
+cc-node --api-base http://<内网IP>:11434/v1 --model qwen3.6:27b
+
+# 未指定模型 → 自动拉取服务端 /models 列表供交互选择
+cc-node --api-base http://localhost:11434/v1
 ```
 
+> 💡 **自建本地服务支持**：cc-node 会自动识别 apiBase 指向本地/内网
+> （`localhost`、回环、`192.168.x` / `10.x` / `172.16-31.x` 私有段、`.local` 域名）
+> 的自建 LLM 服务（Ollama、llama.cpp、vLLM 等 OpenAI 兼容端点），
+> 此类服务**无需 apiKey 也能正常调用**，且不会强制附加 `Bearer undefined` 头。
+> 云端厂商（DeepSeek/OpenAI/Kimi 等）仍需 apiKey。
+
 [![npm version](https://img.shields.io/npm/v/@raolin2025/claude-code-node.svg)](https://www.npmjs.com/package/@raolin2025/claude-code-node) [![GitHub](https://img.shields.io/badge/GitHub-bg1avd%2Fclaude--code--node-blue)](https://github.com/bg1avd/claude-code-node) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raolin2025/claude-code-node",
-  "version": "2.5.1",
+  "version": "2.6.1",
   "description": "Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management",
   "type": "module",
   "main": "src/index.js",

package/src/__tests__/llm-server.test.js

@@ -0,0 +1,62 @@
+/**
+ * llm-server 单元测试
+ *
+ * 覆盖 isLocalLlmServer / isLocalHostname / buildAuthHeaders
+ * 用于验证自建本地 LLM 服务（Ollama / llama.cpp / vLLM）识别逻辑
+ */
+
+import { test, describe } from 'node:test'
+import assert from 'node:assert'
+
+import { isLocalLlmServer, isLocalHostname, buildAuthHeaders } from '../utils/llm-server.js'
+
+describe('isLocalHostname', () => {
+  const localCases = ['localhost', '127.0.0.1', '192.168.1.50', '10.0.0.5', '172.20.1.1',
+    '172.16.1.1', '172.31.255.255', '169.254.1.1', 'myhost.local', 'server.lan', '::1', 'fc00::1']
+  localCases.forEach(h => {
+    test(`应识别为本地: ${h}`, () => assert.strictEqual(isLocalHostname(h), true))
+  })
+
+  // 172.5 不在私有段（172.16-31）
+  const nonLocalCases = ['172.5.1.1', '8.8.8.8', '114.114.114.114', 'api.deepseek.com', 'example.com']
+  nonLocalCases.forEach(h => {
+    test(`不应识别为本地: ${h}`, () => assert.strictEqual(isLocalHostname(h), false))
+  })
+})
+
+describe('isLocalLlmServer', () => {
+  test('Ollama 本机', () => assert.strictEqual(isLocalLlmServer('http://localhost:11434/v1'), true))
+  test('Ollama 回环', () => assert.strictEqual(isLocalLlmServer('http://127.0.0.1:11434/v1'), true))
+  test('Ollama 内网', () => assert.strictEqual(isLocalLlmServer('http://192.168.1.50:11434/v1'), true))
+  test('vLLM 内网 10.x', () => assert.strictEqual(isLocalLlmServer('http://10.0.0.5:8000/v1'), true))
+  test('llama.cpp 内网 172.x', () => assert.strictEqual(isLocalLlmServer('http://172.20.1.1:8000/v1'), true))
+  test('无端口内网', () => assert.strictEqual(isLocalLlmServer('http://192.168.1.50/v1'), true))
+  test('.local 域名', () => assert.strictEqual(isLocalLlmServer('http://myhost.local:11434/v1'), true))
+  test('无 /v1 前缀也可', () => assert.strictEqual(isLocalLlmServer('http://192.168.1.50:11434'), true))
+
+  test('DeepSeek 云端', () => assert.strictEqual(isLocalLlmServer('https://api.deepseek.com/v1'), false))
+  test('OpenAI 云端', () => assert.strictEqual(isLocalLlmServer('https://api.openai.com/v1'), false))
+  test('通义云端', () => assert.strictEqual(isLocalLlmServer('https://dashscope.aliyuncs.com/v1'), false))
+  test('公网 IP', () => assert.strictEqual(isLocalLlmServer('http://114.114.114.114:11434/v1'), false))
+  test('空值', () => assert.strictEqual(isLocalLlmServer(''), false))
+})
+
+describe('buildAuthHeaders', () => {
+  test('本地服务 + 有 key → 带 Bearer', () => {
+    assert.deepStrictEqual(buildAuthHeaders('http://192.168.1.50:11434/v1', 'secret'),
+      { 'Authorization': 'Bearer secret' })
+  })
+  test('本地服务 + 无 key → 空对象(不带Authorization)', () => {
+    assert.deepStrictEqual(buildAuthHeaders('http://192.168.1.50:11434/v1', ''), {})
+  })
+  test('云端 + 有 key → 带 Bearer', () => {
+    assert.deepStrictEqual(buildAuthHeaders('https://api.deepseek.com/v1', 'sk-x'),
+      { 'Authorization': 'Bearer sk-x' })
+  })
+  test('云端 + 无 key → undefined', () => {
+    assert.strictEqual(buildAuthHeaders('https://api.deepseek.com/v1', ''), undefined)
+  })
+  test('空 apiBase + 无 key → undefined', () => {
+    assert.strictEqual(buildAuthHeaders('', ''), undefined)
+  })
+})

package/src/core/cli.js

@@ -4,7 +4,7 @@
  * 
  * v1.2: 增加 Unix socket 服务，让 cc-notify 能发现并转发消息
  */
-import { createInterface } from 'readline'
+import * as readline from 'readline'
 import { createServer as createNetServer } from 'net'
 import { writeFileSync, unlinkSync, existsSync, mkdirSync, readFileSync, chmodSync } from 'fs'
 import { join } from 'path'
@@ -16,6 +16,7 @@ import { TokenBudget } from './token-budget.js'
 import { ChannelManager } from '../channel/index.js'
 import { CostTracker } from './cost-tracker.js'
 import { autoCompact } from './compact.js'
+import { isLocalLlmServer } from '../utils/index.js'
 import { SOCK_DIR, SOCK_PATH, CC_NODE_PID } from './paths.js'
 
 // ============================================================
@@ -408,15 +409,23 @@ export async function main() {
   await config.load(process.cwd())
 
   const apiBase = cliArgs.apiBase || config.get('apiBase') || process.env.LLM_API_BASE || ''
+  // apiBase 指向自建本地服务（Ollama / llama.cpp / vLLM 等）时允许缺省 apiKey
+  const localApiBase = isLocalLlmServer(apiBase)
   let model = cliArgs.model || config.get('model') || ''
   // 未指定模型 → 自动从 API 拉取模型列表让用户选择
+  // 本地自建服务即使无 key 也尝试拉取（这些服务通常无需认证）
   if (!model && apiBase) {
     const apiKeyForModels = cliArgs.apiKey || config.get('apiKey') || process.env.LLM_API_KEY || process.env.DEEPSEEK_API_KEY || ''
-    if (apiKeyForModels) {
+    if (apiKeyForModels || localApiBase) {
       try {
         const modelsUrl = apiBase.replace(/\/+$/, '') + '/models'
         console.log('⚠️  未指定模型，正在从 API 获取可用模型列表...')
-        const res = await fetch(modelsUrl, { headers: { 'Authorization': `Bearer ${apiKeyForModels}` } })
+        const res = await fetch(modelsUrl, {
+          headers: {
+            'Content-Type': 'application/json',
+            ...(apiKeyForModels ? { 'Authorization': `Bearer ${apiKeyForModels}` } : {}),
+          },
+        })
         if (res.ok) {
           const data = await res.json()
           const models = data.data || []
@@ -428,7 +437,7 @@ export async function main() {
             })
             console.log('输入编号选择，或直接输入模型名（回车跳过用 deepseek-chat）:')
             // 用 readline 等待输入（此时 REPL 还没启动，需要临时创建）
-            const tmpRl = createInterface({ input: process.stdin, output: process.stdout })
+            const tmpRl = readline.createInterface({ input: process.stdin, output: process.stdout })
             const answer = await new Promise(resolve => tmpRl.question('> ', resolve))
             tmpRl.close()
             const num = parseInt(answer, 10)
@@ -541,52 +550,29 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
   // REPL 模式 — 启动 Unix socket 让 cc-notify 能发现
   startSocketServer(engine, session, sessionManager, channelManager, verbose)
 
-  const rl = createInterface({ input: process.stdin, output: process.stdout, prompt: '> ' })
-
-  // 将 readline 注入引擎配置，用于 ask 模式确认和 AskUserQuestion 工具
-  if (permissionMode === 'ask') {
-    engine.config.onConfirmTool = async (toolName, input) => {
-      // 如果已经启用会话全局自动允许，直接通过
-      if (engine.permissionChecker.sessionAllowAll) return true
-
-      const snippet = JSON.stringify(input).slice(0, 120) || '(no params)'
-      return new Promise((resolve) => {
-        rl.question(`\n⚠️  Allow tool "${toolName}"?\n   Input: ${snippet}\n   (y/N/a) a=all session `, (answer) => {
-          const a = answer.toLowerCase()
-          if (a === 'a') {
-            engine.permissionChecker.allowAllForSession()
-            resolve(true)
-          } else {
-            resolve(a === 'y')
-          }
-        })
-      })
-    }
-  }
-  engine.config.readline = rl
-
-  console.log(buildBanner({ model, permissionMode, session, maxTokens: tokenBudget.maxTokens }))
-  console.log(`Model: ${model} | Permission: ${permissionMode} | Tools: ${registry.getNames().join(', ')}`)
-  console.log(`Socket: ${SOCK_PATH} (cc-notify can connect)`)
-  if (channelManager.list().length > 0) {
-    const chList = channelManager.list().join(', ')
-    const def = channelManager.defaultChannel ? ` (default: ${channelManager.defaultChannel})` : ''
-    console.log(`Channels: ${chList}${def}`)
-  }
-  console.log()
-  rl.prompt()
-
-  // REPL 消息处理包装（留作扩展点）
-  async function processInput(input) {
-    return engine.processMessage(input)
+  // ============================================================
+  // REPL 输入处理
+  //
+  // 使用标准 readline 的 line 事件（terminal: true）实现输入读取：
+  //   - 字符回显、退格删除、行回绕、方向键历史由 readline 原生处理，
+  //     行为与 v2.5 一致，避免手动 keypress 回显导致的显示错乱。
+  //   - Enter 提交；Ctrl+C 退出。
+  //   - 非 TTY（管道/重定向）模式复用同一 readline 接口。
+  // ============================================================
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, prompt: '> ' })
+
+  // 显示提示符
+  function showPrompt() {
+    rl.prompt()
   }
 
-  rl.on('line', async (line) => {
-    const input = line.trim()
-    if (!input) { rl.prompt(); return }
+  // 处理输入行
+  async function processInputLine(input) {
+    const trimmed = input.trim()
+    if (!trimmed) { showPrompt(); return }
 
-    if (input.startsWith('/')) {
-      const [cmd, ...rest] = input.slice(1).split(' ')
+    if (trimmed.startsWith('/')) {
+      const [cmd, ...rest] = trimmed.slice(1).split(' ')
       switch (cmd) {
         case 'help':
           if (rest[0]) {
@@ -604,11 +590,18 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
         case 'models': {
           const apiBase = engine.config.apiBase
           const apiKey = engine.config.apiKey
-          if (!apiKey) { console.log('❌ API key not configured'); break }
+          // 自建本地服务（Ollama/llama.cpp/vLLM）无需 apiKey 也能拉取模型列表
+          const localServer = isLocalLlmServer(apiBase)
+          if (!apiKey && !localServer) { console.log('❌ API key not configured'); break }
           const modelsUrl = apiBase.replace(/\/+$/, '') + '/models'
           console.log(`📡 Fetching models from ${modelsUrl}...`)
           try {
-            const res = await fetch(modelsUrl, { headers: { 'Authorization': `Bearer ${apiKey}` } })
+            const res = await fetch(modelsUrl, {
+              headers: {
+                'Content-Type': 'application/json',
+                ...(apiKey ? { 'Authorization': `Bearer ${apiKey}` } : {}),
+              },
+            })
             if (!res.ok) { console.log(`❌ API error: ${res.status}`); break }
             const data = await res.json()
             const models = data.data || []
@@ -656,7 +649,6 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
           }
           const target = rest.join(' ')
           let sessionId = target
-          // 支持数字序号选择（从 /sessions 列表中）
           if (/^\d+$/.test(target)) {
             const idx = parseInt(target, 10) - 1
             const list = await sessionManager.list()
@@ -671,19 +663,16 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
             console.log(`❌ Session not found: ${sessionId}`)
             break
           }
-          // 恢复会话内容
           session.id = loaded.id
           session.title = loaded.title
           session.messages = loaded.messages
           session.state = loaded.state || {}
-          // 恢复引擎消息历史
           engine.state.messages = loaded.messages.map(m => ({
             role: m.role,
             content: m.content,
             toolCalls: m.toolCalls,
             toolCallId: m.toolCallId,
           }))
-          // 恢复计数和预算
           engine.state.turnCount = loaded.state?.turnCount || 0
           if (engine.tokenBudget && loaded.state?.budgetUsed != null) {
             engine.tokenBudget.used = loaded.state.budgetUsed
@@ -791,7 +780,7 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
         default:
           console.log(`Unknown command: /${cmd}. Type /help for available commands.`)
       }
-      rl.prompt()
+      showPrompt()
       return
     }
 
@@ -803,13 +792,11 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
       console.log()
       await sessionManager.appendMessage({ role: 'user', content: input })
       await sessionManager.appendMessage({ role: 'assistant', content: result.response })
-      // 保存引擎状态到会话
       session.state = session.state || {}
       session.state.turnCount = engine.state.turnCount
       session.state.costHistory = engine.costTracker.history.slice(-50)
       await sessionManager.save(session)
       if (verbose) console.log(`[Turns: ${result.turns} | Tools: ${result.toolResults.length}]`)
-      // 显示费用（即使非 verbose 也显示）
       if (engine.costTracker && engine.costTracker.totalApiCalls > 0) {
         console.log(engine.costTracker.formatShort())
       }
@@ -821,8 +808,72 @@ const systemPrompt = cliArgs.systemPrompt || DEFAULT_SYSTEM_PROMPT
         }).catch(() => {})
       }
     }
-    rl.prompt()
+    showPrompt()
+  }
+
+  // REPL 主循环 — 由 readline 原生处理回显、退格、行回绕与 Enter 提交
+  rl.on('line', (line) => {
+    processInputLine(line)
   })
 
-  rl.on('close', () => { console.log('\nGoodbye!'); process.exit(0) })
+  // 将 readline 注入引擎配置，用于 ask 模式确认和 AskUserQuestion 工具
+  if (permissionMode === 'ask') {
+    engine.config.onConfirmTool = async (toolName, input) => {
+      // 如果已经启用会话全局自动允许，直接通过
+      if (engine.permissionChecker.sessionAllowAll) return true
+
+      const snippet = JSON.stringify(input).slice(0, 120) || '(no params)'
+      return new Promise((resolve) => {
+        rl.question(`\n⚠️  Allow tool "${toolName}"?\n   Input: ${snippet}\n   (y/N/a) a=all session `, (answer) => {
+          const a = answer.toLowerCase()
+          if (a === 'a') {
+            engine.permissionChecker.allowAllForSession()
+            resolve(true)
+          } else {
+            resolve(a === 'y')
+          }
+        })
+      })
+    }
+  }
+  engine.config.readline = rl
+
+  console.log(buildBanner({ model, permissionMode, session, maxTokens: tokenBudget.maxTokens }))
+  console.log(`Model: ${model} | Permission: ${permissionMode} | Tools: ${registry.getNames().join(', ')}`)
+  console.log(`Socket: ${SOCK_PATH} (cc-notify can connect)`)
+  if (channelManager.list().length > 0) {
+    const chList = channelManager.list().join(', ')
+    const def = channelManager.defaultChannel ? ` (default: ${channelManager.defaultChannel})` : ''
+    console.log(`Channels: ${chList}${def}`)
+  }
+  console.log()
+  // 显示初始提示符
+  showPrompt()
+
+  // REPL 消息处理包装（留作扩展点）
+  async function processInput(input) {
+    return engine.processMessage(input)
+  }
 }
+
+// ============================================================
+// 全局退出处理 — 回收 stdin 的 raw mode
+// ============================================================
+function cleanupStdin() {
+  try {
+    if (process.stdin.isTTY) process.stdin.setRawMode(false)
+    process.stdin.removeAllListeners('keypress')
+  } catch {}
+}
+
+process.on('SIGINT', () => {
+  cleanupStdin()
+  process.exit(0)
+})
+process.on('SIGTERM', () => {
+  cleanupStdin()
+  process.exit(0)
+})
+process.on('exit', () => {
+  cleanupStdin()
+})

package/src/core/query-engine.js

@@ -17,6 +17,7 @@ import { parseStream, parseNonStreamResponse } from './streaming.js'
 import { autoCompact } from './compact.js'
 import { CostTracker } from './cost-tracker.js'
 import { EnhancedPermissionChecker } from '../security/enhanced-permission.js'
+import { isLocalLlmServer, buildAuthHeaders } from '../utils/index.js'
 
 /**
  * 配置选项
@@ -265,7 +266,9 @@ export class QueryEngine {
     const apiKey = this.config.apiKey
     const apiBase = this.config.apiBase
 
-    if (!apiKey) {
+    // apiBase 指向自建本地服务（Ollama / llama.cpp / vLLM 等）时，允许缺省 apiKey
+    const isLocalServer = isLocalLlmServer(apiBase)
+    if (!isLocalServer && !apiKey) {
       throw new Error(
         `未设置 API Key。请设置以下环境变量之一:\n` +
         `  LLM_API_KEY=xxx (通用，推荐)\n` +
@@ -331,7 +334,7 @@ export class QueryEngine {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
-            'Authorization': `Bearer ${apiKey}`,
+            ...buildAuthHeaders(apiBase, apiKey),
           },
           body: JSON.stringify(body),
           signal: this.abortController?.signal,

package/src/tools/qqbot-media.js

@@ -10,8 +10,8 @@
  *   qqbot_media: { action: 'upload', path: '/home/.../image.png', scope: 'group', targetId: '群OPENID' }
  */
 
-import { QQBotEnhanced } from '../src/channel/qqbot-enhanced.js'
-import { parseQQMediaTags } from '../src/channel/qqbot-enhanced.js'
+import { QQBotEnhanced } from '../channel/qqbot-enhanced.js'
+import { parseQQMediaTags } from '../channel/qqbot-enhanced.js'
 
 const API_BASE = 'https://api.sgroup.qq.com'
 

package/src/utils/index.js

@@ -5,3 +5,4 @@ export { unifiedDiff, inlineDiff } from './diff.js'
 export { safeReadFile, safeWriteFile, editFile, pathExists, removeRecursive, getMtime, resolvePath } from './file-ops.js'
 export { execCommand, spawnProcess, commandExists, sendInput } from './process.js'
 export { format, codeBlock, formatPath, formatToolCall, formatToolResult, formatTokenUsage, formatDuration, formatBytes, formatTable, progressBar } from './format.js'
+export { isLocalLlmServer, isLocalHostname, buildAuthHeaders } from './llm-server.js'

package/src/utils/llm-server.js

@@ -0,0 +1,106 @@
+/**
+ * LLM 服务器识别工具
+ *
+ * 用于判断一个 `--api-base` 是否是「自建本地 LLM 服务」。
+ * 自建服务（Ollama / llama.cpp / vLLM 等）通常运行在 localhost 或内网，
+ * 且默认【不需要 apiKey】（认证是可选配置）。
+ *
+ * 用途：当 apiBase 指向自建服务时，允许缺省 apiKey 运行，
+ *      并将旧的 `Authorization: Bearer undefined` 替换为不附带该头。
+ *      这解决了公共项目接入 Ollama / llama.cpp / vLLM 时被强制要求
+ *      假 apiKey 的问题。
+ */
+
+// RFC1918 私有段 + 回环
+const PRIVATE_PATTERNS = [
+  /^127\./,        // 127.0.0.0/8 回环
+  /^10\./,         // 10.0.0.0/8
+  /^192\.168\./,   // 192.168.0.0/16
+  /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12
+  /^169\.254\./,   // 链路本地
+  /^::1$/,         // IPv6 回环
+  /^fc[0-9a-f]{2}:/i, // IPv6 ULA fc00::/7
+  /^fe[89ab][0-9a-f]:/i, // IPv6 link-local fe80::/10
+]
+
+// 明确视为「本地自建」的主机名关键词
+const LOCAL_HOSTNAME_KEYWORDS = [
+  'localhost',
+  '127.0.0.1',
+  '::1',
+  '.local',
+  '.lan',
+  '.localdomain',
+]
+
+let cachedHost = null
+
+/**
+ * 从 URL 中提取 host（含端口），便于可读性判断
+ */
+function parseUrl(apiBase) {
+  try {
+    return new URL(apiBase)
+  } catch {
+    // 非标准 URL（可能缺 scheme），尝试补 http:// 再解析
+    try {
+      return new URL(apiBase.startsWith('http') ? apiBase : `http://${apiBase}`)
+    } catch {
+      return null
+    }
+  }
+}
+
+/**
+ * 判断主机是否为「本地/内网/回环」地址
+ * @param {string} hostname - 无端口的主机名或 IP
+ */
+export function isLocalHostname(hostname) {
+  if (!hostname) return false
+  const h = hostname.toLowerCase()
+
+  // 主机名关键词
+  for (const kw of LOCAL_HOSTNAME_KEYWORDS) {
+    if (kw.startsWith('.') ? h.endsWith(kw) : (h === kw || h.startsWith(kw + '.'))) {
+      return true
+    }
+  }
+
+  // IPv4 / IPv6 私有段
+  for (const re of PRIVATE_PATTERNS) {
+    if (re.test(h)) return true
+  }
+
+  return false
+}
+
+/**
+ * 判断一个 apiBase 是否指向「自建本地 LLM 服务」（无需强制 apiKey）
+ * @param {string} apiBase - 如 http://192.168.1.50:11434/v1
+ */
+export function isLocalLlmServer(apiBase) {
+  if (!apiBase) return false
+  const url = parseUrl(apiBase)
+  if (!url || !url.hostname) return false
+  return isLocalHostname(url.hostname)
+}
+
+/**
+ * 计算请求应携带的 Authorization 头。
+ * - 若提供了 apiKey → 正常 Bearer
+ * - 若未提供 apiKey 且目标是【自建本地服务】 → 不附带该头（返回 null/undefined）
+ * - 若未提供 apiKey 且目标是【云端服务】 → 返回 null（由上层决定是否报错）
+ * @param {string} apiBase
+ * @param {string} apiKey
+ * @returns {{ Authorization: string } | undefined} 返回 undefined 表示不附带 Authorization 头
+ */
+export function buildAuthHeaders(apiBase, apiKey) {
+  if (apiKey) {
+    return { 'Authorization': `Bearer ${apiKey}` }
+  }
+  // 无 key：本地自建服务返回空对象（不带 Authorization），云端返回 undefined（保持不变，交由上层判断）
+  if (isLocalLlmServer(apiBase)) {
+    return {}
+  }
+  return undefined
+}