@simonyea/holysheep-cli 1.7.3 → 1.7.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simonyea/holysheep-cli",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "description": "Claude Code/Cursor/Cline API relay for China — ¥1=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
   "keywords": [
     "openai-china",

package/src/commands/claude.js

@@ -0,0 +1,67 @@
+'use strict'
+
+const { spawn } = require('child_process')
+const {
+  BASE_URL_ANTHROPIC,
+  getApiKey,
+} = require('../utils/config')
+const {
+  closeSession,
+  getLocalProxyUrl,
+  startProcessProxy,
+  readConfig,
+} = require('../tools/claude-process-proxy')
+
+async function runClaude(args = []) {
+  const config = readConfig()
+  const apiKey = config.apiKey || getApiKey()
+  if (!apiKey) {
+    throw new Error('Missing API Key. Run hs setup first.')
+  }
+
+  const { server, port, sessionId } = startProcessProxy({})
+  const proxyUrl = getLocalProxyUrl(port)
+
+  const env = {
+    ...process.env,
+    ANTHROPIC_AUTH_TOKEN: apiKey,
+    ANTHROPIC_BASE_URL: BASE_URL_ANTHROPIC,
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+    HOLYSHEEP_CLAUDE_PROCESS_PROXY: '1',
+    HOLYSHEEP_CLAUDE_SESSION_ID: sessionId,
+    HTTP_PROXY: proxyUrl,
+    HTTPS_PROXY: proxyUrl,
+    ALL_PROXY: proxyUrl,
+    NO_PROXY: '127.0.0.1,localhost',
+  }
+
+  const child = spawn('claude', args, {
+    stdio: 'inherit',
+    env,
+    shell: process.platform === 'win32',
+  })
+
+  const cleanup = async () => {
+    try {
+      server.close()
+    } catch {}
+    await closeSession(undefined, sessionId)
+  }
+
+  process.on('SIGINT', () => child.kill('SIGINT'))
+  process.on('SIGTERM', () => child.kill('SIGTERM'))
+
+  return await new Promise((resolve, reject) => {
+    child.once('error', async (error) => {
+      await cleanup()
+      reject(error)
+    })
+    child.once('exit', async (code, signal) => {
+      await cleanup()
+      if (signal) process.kill(process.pid, signal)
+      resolve(code || 0)
+    })
+  })
+}
+
+module.exports = runClaude

package/src/commands/doctor.js

@@ -3,7 +3,7 @@
  */
 const chalk = require('chalk')
 const { execSync } = require('child_process')
-const { getApiKey, BASE_URL_ANTHROPIC, BASE_URL_OPENAI } = require('../utils/config')
+const { getApiKey, BASE_URL_ANTHROPIC, BASE_URL_OPENAI, BASE_URL_CLAUDE_RELAY } = require('../utils/config')
 const TOOLS = require('../tools')
 
 async function doctor() {
@@ -59,7 +59,7 @@ async function doctor() {
       printOpenClawDetails(tool, installState, nodeMajor)
     }
     if (tool.id === 'claude-code' && installed && configured) {
-      printClaudeBridgeDetails(tool)
+      printClaudeProcessProxyDetails(tool)
     }
   }
 
@@ -159,34 +159,13 @@ function printOpenClawDetails(tool, installState, nodeMajor) {
   })
 }
 
-function printClaudeBridgeDetails(tool) {
-  const port = typeof tool.getBridgePort === 'function' ? tool.getBridgePort() : null
-  if (!port) return
-  const bridgeConfig = typeof tool.getBridgeConfig === 'function' ? tool.getBridgeConfig() : {}
-
-  let healthy = false
-  try {
-    execSync(
-      process.platform === 'win32'
-        ? `powershell -NonInteractive -Command "try{(Invoke-WebRequest -Uri http://127.0.0.1:${port}/health -TimeoutSec 1 -UseBasicParsing).StatusCode}catch{exit 1}"`
-        : `curl -sf http://127.0.0.1:${port}/health -o /dev/null --max-time 1`,
-      { stdio: 'ignore', timeout: 3000 }
-    )
-    healthy = true
-  } catch {}
-
-  const icon = healthy ? chalk.green('↳') : chalk.yellow('↳')
-  const text = healthy
-    ? chalk.green(`Claude Bridge 已运行：127.0.0.1:${port}`)
-    : chalk.yellow(`Claude Bridge 未运行：127.0.0.1:${port}（可运行 hs claude-bridge）`)
-  console.log(`    ${icon} ${text}`)
-
-  const relayUrl = bridgeConfig.relayUrl || bridgeConfig.controlPlaneUrl || ''
-  if (relayUrl) {
-    console.log(`    ${chalk.gray('↳')} ${chalk.gray(`Claude Relay: ${relayUrl}`)}`)
-  } else {
-    console.log(`    ${chalk.gray('↳')} ${chalk.gray('Claude Relay: 未配置，当前仍直连 Anthropic 兼容入口')}`)
-  }
+function printClaudeProcessProxyDetails(tool) {
+  const proxyConfig = typeof tool.getProcessProxyConfig === 'function' ? tool.getProcessProxyConfig() : {}
+  const relayUrl = proxyConfig.controlPlaneUrl || proxyConfig.relayUrl || BASE_URL_CLAUDE_RELAY
+  const mode = proxyConfig.proxyMode || 'unknown'
+  console.log(`    ${chalk.gray('↳')} ${chalk.gray(`Claude 启动方式：hs claude`)}`)
+  console.log(`    ${chalk.gray('↳')} ${chalk.gray(`Claude 代理模式：${mode}`)}`)
+  console.log(`    ${chalk.gray('↳')} ${chalk.gray(`Claude Relay: ${relayUrl || '未配置'}`)}`)
 }
 
 function maskKey(key) {

package/src/commands/setup.js

@@ -27,19 +27,19 @@ const AUTO_INSTALL = {
 function getWindowsImmediateLaunchCmd(tool) {
   if (process.platform !== 'win32' || !tool?.launchCmd) return null
 
-  const cmdBin = tool.launchCmd.split(' ')[0]
+  const [cmdBin, ...cmdArgs] = tool.launchCmd.split(' ')
 
   try {
     const npmPrefix = execSync('npm prefix -g', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
     if (npmPrefix) {
       const directCmd = `${npmPrefix}\\${cmdBin}.cmd`
-      return `& "${directCmd}"`
+      return `& "${directCmd}"${cmdArgs.length ? ` ${cmdArgs.join(' ')}` : ''}`
     }
   } catch {}
 
   const appData = process.env.APPDATA
   if (appData) {
-    return `& "${appData}\\npm\\${cmdBin}.cmd"`
+    return `& "${appData}\\npm\\${cmdBin}.cmd"${cmdArgs.length ? ` ${cmdArgs.join(' ')}` : ''}`
   }
 
   return null

package/src/index.js

@@ -50,6 +50,7 @@ function printBanner() {
 
 program
   .name('hs')
+  .enablePositionalOptions()
   .description('一键配置所有 AI 编程工具接入 HolySheep API')
   .version(pkg.version, '-v, --version')
   .addHelpText('before', `
@@ -167,18 +168,16 @@ program
     })
   })
 
-// ── claude-bridge ────────────────────────────────────────────────────────────
+// ── claude ──────────────────────────────────────────────────────────────────
 program
-  .command('claude-bridge')
-  .description('启动 HolySheep 的 Claude Code 本地桥接服务')
-  .option('--port <port>', '指定桥接服务端口')
-  .option('--host <host>', '指定桥接服务监听地址')
-  .action((opts) => {
-    const { startBridge } = require('./tools/claude-bridge')
-    startBridge({
-      port: opts.port ? Number(opts.port) : null,
-      host: opts.host || '127.0.0.1',
-    })
+  .command('claude [args...]')
+  .allowUnknownOption(true)
+  .passThroughOptions()
+  .description('通过 HolySheep 整进程代理启动 Claude Code')
+  .action(async (args = []) => {
+    const runClaude = require('./commands/claude')
+    const code = await runClaude(args)
+    process.exit(code)
   })
 
 // 默认：无命令时显示帮助 + 提示 setup

package/src/tools/claude-code.js

@@ -16,14 +16,7 @@ const {
   BASE_URL_ANTHROPIC,
   BASE_URL_CLAUDE_RELAY,
 } = require('../utils/config')
-const {
-  DEFAULT_BRIDGE_PORT,
-  getBridgeBaseUrl,
-  getConfiguredBridgePort,
-  readBridgeConfig,
-  spawnBridge,
-  writeBridgeConfig,
-} = require('./claude-bridge')
+const { readConfig, writeConfig } = require('./claude-process-proxy')
 
 const SETTINGS_FILE = path.join(os.homedir(), '.claude', 'settings.json')
 
@@ -51,21 +44,21 @@ module.exports = {
   },
   isConfigured() {
     const s = readSettings()
-    const bridge = readBridgeConfig()
-    const bridgePort = getConfiguredBridgePort(bridge)
+    const bridge = readConfig()
     return Boolean(
       s.env?.ANTHROPIC_AUTH_TOKEN &&
-      s.env?.ANTHROPIC_BASE_URL === getBridgeBaseUrl(bridgePort) &&
+      s.env?.ANTHROPIC_BASE_URL === BASE_URL_ANTHROPIC &&
       bridge.apiKey &&
-      bridge.bridgeSecret
+      bridge.bridgeSecret &&
+      bridge.controlPlaneUrl
     )
   },
   configure(apiKey, baseUrl) {
-    const bridge = readBridgeConfig()
-    const bridgePort = getConfiguredBridgePort(bridge)
+    const bridge = readConfig()
     const relayUrl = bridge.relayUrl || BASE_URL_CLAUDE_RELAY || ''
-    writeBridgeConfig({
-      port: bridgePort || DEFAULT_BRIDGE_PORT,
+    writeConfig({
+      port: bridge.port || 14555,
+      processProxyPort: bridge.processProxyPort || 14556,
       apiKey,
       baseUrlAnthropic: baseUrl || BASE_URL_ANTHROPIC,
       controlPlaneUrl: relayUrl || baseUrl || BASE_URL_ANTHROPIC,
@@ -76,20 +69,18 @@ module.exports = {
       nodeId: bridge.nodeId || '',
       sessionMode: bridge.sessionMode || 'pinned-node',
       installSource: 'holysheep-cli',
+      proxyMode: 'claude-process',
     })
 
-    if (!spawnBridge(bridgePort)) {
-      throw new Error('HolySheep Claude Bridge 启动失败')
-    }
-
     const settings = readSettings()
     if (!settings.env) settings.env = {}
     settings.env.ANTHROPIC_AUTH_TOKEN = apiKey
-    settings.env.ANTHROPIC_BASE_URL = getBridgeBaseUrl(bridgePort)
+    settings.env.ANTHROPIC_BASE_URL = BASE_URL_ANTHROPIC
     settings.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = '1'
-    settings.env.HOLYSHEEP_CLAUDE_BRIDGE = '1'
+    settings.env.HOLYSHEEP_CLAUDE_LAUNCHER = 'hs'
     // 清理旧的同义字段
     delete settings.env.ANTHROPIC_API_KEY
+    delete settings.env.HOLYSHEEP_CLAUDE_BRIDGE
     writeSettings(settings)
     return { file: SETTINGS_FILE, hot: true }
   },
@@ -101,20 +92,18 @@ module.exports = {
       delete settings.env.ANTHROPIC_BASE_URL
       delete settings.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC
       delete settings.env.HOLYSHEEP_CLAUDE_BRIDGE
+      delete settings.env.HOLYSHEEP_CLAUDE_LAUNCHER
     }
     writeSettings(settings)
   },
   getConfigPath() { return SETTINGS_FILE },
-  hint: '通过 HolySheep 本地 Bridge 接入，支持热切换，无需重启终端',
-  launchCmd: 'claude',
+  hint: '通过 hs claude 以整进程代理方式启动 Claude Code',
+  launchCmd: 'hs claude',
   installCmd: process.platform === 'win32'
     ? 'irm https://claude.ai/install.ps1 | iex'
     : 'curl -fsSL https://claude.ai/install.sh | bash',
   docsUrl: 'https://docs.anthropic.com/claude-code',
-  getBridgePort() {
-    return getConfiguredBridgePort()
-  },
-  getBridgeConfig() {
-    return readBridgeConfig()
+  getProcessProxyConfig() {
+    return readConfig()
   },
 }

package/src/tools/claude-process-proxy.js

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+'use strict'
+
+const fs = require('fs')
+const http = require('http')
+const https = require('https')
+const net = require('net')
+const path = require('path')
+const os = require('os')
+const crypto = require('crypto')
+const { URL } = require('url')
+const fetch = global.fetch || require('node-fetch')
+
+const HOLYSHEEP_DIR = path.join(os.homedir(), '.holysheep')
+const CONFIG_PATH = path.join(HOLYSHEEP_DIR, 'claude-proxy.json')
+const DEFAULT_PROXY_PORT = 14556
+
+function ensureDir() {
+  if (!fs.existsSync(HOLYSHEEP_DIR)) fs.mkdirSync(HOLYSHEEP_DIR, { recursive: true })
+}
+
+function readConfig() {
+  try {
+    return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'))
+  } catch {
+    return {}
+  }
+}
+
+function writeConfig(data) {
+  ensureDir()
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(data, null, 2), 'utf8')
+}
+
+function getProcessProxyPort(config = readConfig()) {
+  const value = Number(config.processProxyPort)
+  return Number.isInteger(value) && value > 0 ? value : DEFAULT_PROXY_PORT
+}
+
+function getLocalProxyUrl(port = getProcessProxyPort()) {
+  return `http://127.0.0.1:${port}`
+}
+
+function getControlPlaneUrl(config) {
+  return String(config.controlPlaneUrl || config.relayUrl || '').replace(/\/+$/, '')
+}
+
+const leaseCache = new Map()
+
+async function readJsonResponse(response) {
+  const chunks = []
+  for await (const chunk of response) chunks.push(Buffer.from(chunk))
+  if (!chunks.length) return null
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  } catch {
+    return null
+  }
+}
+
+async function requestSessionLease(config, sessionId) {
+  const cached = leaseCache.get(sessionId)
+  if (cached?.expiresAt && new Date(cached.expiresAt).getTime() - Date.now() > 30_000) {
+    return cached
+  }
+
+  const controlPlaneUrl = getControlPlaneUrl(config)
+  if (!controlPlaneUrl) throw new Error('Claude relay control plane is not configured')
+
+  const response = await fetch(`${controlPlaneUrl}/session/open`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      sessionId,
+      bridgeId: config.bridgeId || 'local-bridge',
+      deviceId: config.deviceId || '',
+      installSource: config.installSource || 'holysheep-cli',
+      proxyMode: 'claude-process',
+    }),
+  })
+
+  const payload = await response.json().catch(() => null)
+  if (!response.ok || !payload?.success || !payload?.data?.ticket) {
+    throw new Error(payload?.error?.message || `Failed to open Claude session (HTTP ${response.status})`)
+  }
+  leaseCache.set(sessionId, payload.data)
+  return payload.data
+}
+
+function buildAuthHeaders(config, lease) {
+  return {
+    'x-hs-bridge-id': config.bridgeId || 'local-bridge',
+    'x-hs-device-id': config.deviceId || '',
+    'x-hs-install-source': config.installSource || 'holysheep-cli',
+    'x-hs-session-id': lease.sessionId,
+    'x-hs-bridge-ticket': lease.ticket,
+    'x-hs-node-id': lease.nodeId || '',
+  }
+}
+
+function deriveNodeProxyUrl(lease) {
+  if (lease.nodeProxyUrl) return String(lease.nodeProxyUrl)
+  if (!lease.nodeBaseUrl) throw new Error('Lease does not include node proxy information')
+  const upstream = new URL(String(lease.nodeBaseUrl))
+  const proxyPort = upstream.port === '3101' ? '3129' : upstream.port
+  upstream.port = proxyPort || '3129'
+  upstream.pathname = ''
+  upstream.search = ''
+  upstream.hash = ''
+  return upstream.toString().replace(/\/+$/, '')
+}
+
+function createConnectTunnel(proxyUrl, target, headers) {
+  return new Promise((resolve, reject) => {
+    const upstream = new URL(proxyUrl)
+    const request = http.request({
+      host: upstream.hostname,
+      port: Number(upstream.port || 80),
+      method: 'CONNECT',
+      path: target,
+      headers,
+    })
+
+    request.once('connect', (response, socket, head) => {
+      if (response.statusCode !== 200) {
+        socket.destroy()
+        return reject(new Error(`Upstream proxy CONNECT failed (HTTP ${response.statusCode})`))
+      }
+      if (head?.length) socket.unshift(head)
+      resolve(socket)
+    })
+    request.once('error', reject)
+    request.end()
+  })
+}
+
+function pipeWithCleanup(a, b) {
+  a.pipe(b)
+  b.pipe(a)
+  const close = () => {
+    a.destroy()
+    b.destroy()
+  }
+  a.once('error', close)
+  b.once('error', close)
+  a.once('close', close)
+  b.once('close', close)
+}
+
+function createProcessProxyServer({ sessionId, configPath = CONFIG_PATH }) {
+  const server = http.createServer(async (clientReq, clientRes) => {
+    try {
+      const config = readConfig(configPath)
+      const lease = await requestSessionLease(config, sessionId)
+      const nodeProxyUrl = deriveNodeProxyUrl(lease)
+      const headers = {
+        ...buildAuthHeaders(config, lease),
+        host: new URL(clientReq.url).host,
+      }
+
+      const upstream = new URL(nodeProxyUrl)
+      const forwardReq = http.request({
+        host: upstream.hostname,
+        port: Number(upstream.port || 80),
+        method: clientReq.method,
+        path: clientReq.url,
+        headers: {
+          ...clientReq.headers,
+          ...headers,
+          connection: 'close',
+        },
+      }, (forwardRes) => {
+        clientRes.writeHead(forwardRes.statusCode || 502, forwardRes.headers)
+        forwardRes.pipe(clientRes)
+      })
+
+      forwardReq.once('error', (error) => {
+        clientRes.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+        clientRes.end(error.message || 'Proxy error')
+      })
+
+      clientReq.pipe(forwardReq)
+    } catch (error) {
+      clientRes.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' })
+      clientRes.end(error.message || 'Proxy error')
+    }
+  })
+
+  server.on('connect', async (req, clientSocket, head) => {
+    try {
+      const config = readConfig(configPath)
+      const lease = await requestSessionLease(config, sessionId)
+      const target = String(req.url || '').trim()
+      const [host, rawPort] = target.split(':')
+      const port = Number(rawPort || 443)
+      if (!host || !Number.isInteger(port) || ![80, 443].includes(port)) {
+        clientSocket.write('HTTP/1.1 403 Forbidden\r\n\r\n')
+        return clientSocket.destroy()
+      }
+
+      const upstreamSocket = await createConnectTunnel(
+        deriveNodeProxyUrl(lease),
+        target,
+        buildAuthHeaders(config, lease)
+      )
+
+      clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+      if (head?.length) upstreamSocket.write(head)
+      pipeWithCleanup(clientSocket, upstreamSocket)
+    } catch (error) {
+      clientSocket.write(`HTTP/1.1 502 Bad Gateway\r\ncontent-type: text/plain; charset=utf-8\r\n\r\n${error.message}`)
+      clientSocket.destroy()
+    }
+  })
+
+  return server
+}
+
+function startProcessProxy({ port = null, sessionId = null, configPath = CONFIG_PATH } = {}) {
+  const config = readConfig(configPath)
+  const listenPort = port || getProcessProxyPort(config)
+  const effectiveSessionId = sessionId || crypto.randomUUID()
+  const server = createProcessProxyServer({ sessionId: effectiveSessionId, configPath })
+  server.listen(listenPort, '127.0.0.1')
+  return { server, port: listenPort, sessionId: effectiveSessionId }
+}
+
+async function closeSession(configPath, sessionId) {
+  if (!sessionId) return
+  const config = readConfig(configPath)
+  const controlPlaneUrl = getControlPlaneUrl(config)
+  if (!controlPlaneUrl) return
+  try {
+    await fetch(`${controlPlaneUrl}/session/close`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ sessionId }),
+    })
+  } catch {}
+}
+
+module.exports = {
+  CONFIG_PATH,
+  DEFAULT_PROXY_PORT,
+  closeSession,
+  getLocalProxyUrl,
+  getProcessProxyPort,
+  getControlPlaneUrl,
+  readConfig,
+  requestSessionLease,
+  startProcessProxy,
+  writeConfig,
+}

package/src/tools/claude-bridge.js

@@ -1,331 +0,0 @@
-#!/usr/bin/env node
-'use strict'
-
-const fs = require('fs')
-const http = require('http')
-const path = require('path')
-const os = require('os')
-const crypto = require('crypto')
-const { spawn, execSync } = require('child_process')
-const fetch = global.fetch || require('node-fetch')
-
-const HOLYSHEEP_DIR = path.join(os.homedir(), '.holysheep')
-const CLAUDE_BRIDGE_CONFIG_FILE = path.join(HOLYSHEEP_DIR, 'claude-bridge.json')
-const DEFAULT_BRIDGE_PORT = 14555
-const isWin = process.platform === 'win32'
-const leaseCache = new Map()
-
-function ensureDir() {
-  if (!fs.existsSync(HOLYSHEEP_DIR)) fs.mkdirSync(HOLYSHEEP_DIR, { recursive: true })
-}
-
-function parseArgs(argv) {
-  const args = { port: null, host: '127.0.0.1', config: CLAUDE_BRIDGE_CONFIG_FILE }
-  for (let i = 0; i < argv.length; i++) {
-    const value = argv[i]
-    if (value === '--port') args.port = Number(argv[++i])
-    else if (value === '--host') args.host = argv[++i]
-    else if (value === '--config') args.config = argv[++i]
-  }
-  return args
-}
-
-function readBridgeConfig(configPath = CLAUDE_BRIDGE_CONFIG_FILE) {
-  try {
-    return JSON.parse(fs.readFileSync(configPath, 'utf8'))
-  } catch {
-    return {}
-  }
-}
-
-function writeBridgeConfig(data, configPath = CLAUDE_BRIDGE_CONFIG_FILE) {
-  ensureDir()
-  fs.writeFileSync(configPath, JSON.stringify(data, null, 2), 'utf8')
-}
-
-function getConfiguredBridgePort(config = readBridgeConfig()) {
-  const port = Number(config.port)
-  return Number.isInteger(port) && port > 0 ? port : DEFAULT_BRIDGE_PORT
-}
-
-function getBridgeBaseUrl(port = getConfiguredBridgePort()) {
-  return `http://127.0.0.1:${port}`
-}
-
-function sendJson(res, statusCode, payload) {
-  res.writeHead(statusCode, {
-    'content-type': 'application/json; charset=utf-8',
-    'cache-control': 'no-store',
-  })
-  res.end(JSON.stringify(payload))
-}
-
-function readRawBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = []
-    let size = 0
-    req.on('data', (chunk) => {
-      size += chunk.length
-      if (size > 20 * 1024 * 1024) {
-        reject(new Error('Request body too large'))
-        req.destroy()
-        return
-      }
-      chunks.push(chunk)
-    })
-    req.on('end', () => resolve(Buffer.concat(chunks)))
-    req.on('error', reject)
-  })
-}
-
-function stripBearer(value) {
-  const raw = String(value || '').trim()
-  if (!raw) return ''
-  if (/^Bearer\s+/i.test(raw)) return raw.replace(/^Bearer\s+/i, '').trim()
-  return raw
-}
-
-function buildBodyHash(body) {
-  return crypto.createHash('sha256').update(body || Buffer.alloc(0)).digest('hex')
-}
-
-function buildBridgeSignature(req, config, body, timestamp) {
-  const secret = String(config.bridgeSecret || '').trim()
-  if (!secret) return ''
-
-  const url = new URL(req.url, `http://${req.headers.host || '127.0.0.1'}`)
-  const canonical = [
-    String(req.method || 'GET').toUpperCase(),
-    url.pathname + (url.search || ''),
-    String(timestamp),
-    buildBodyHash(body),
-    String(config.bridgeId || '')
-  ].join('\n')
-
-  return crypto.createHmac('sha256', secret).update(canonical).digest('hex')
-}
-
-function getBridgeUpstream(config) {
-  return String(config.relayUrl || config.controlPlaneUrl || config.baseUrlAnthropic || '').replace(/\/+$/, '')
-}
-
-function parseJsonBody(body) {
-  if (!body || !body.length) return null
-  try {
-    return JSON.parse(body.toString('utf8'))
-  } catch {
-    return null
-  }
-}
-
-function extractSessionId(parsedBody, config) {
-  const headerSessionId =
-    parsedBody?.metadata?.session_id ||
-    parsedBody?.session_id ||
-    parsedBody?.metadata?.conversation_id ||
-    null
-  if (headerSessionId) return String(headerSessionId)
-
-  const metadataUserId = parsedBody?.metadata?.user_id
-  if (typeof metadataUserId === 'string' && metadataUserId.trim()) {
-    return metadataUserId.trim()
-  }
-
-  return `${config.bridgeId || 'local-bridge'}:default`
-}
-
-function isRelayMode(config) {
-  const upstream = getBridgeUpstream(config)
-  return /\/claude-relay(?:\/|$)/.test(upstream)
-}
-
-async function requestSessionLease(config, sessionId, parsedBody) {
-  const controlPlaneUrl = getBridgeUpstream(config)
-  const cached = leaseCache.get(sessionId)
-  if (cached && cached.expiresAt && new Date(cached.expiresAt).getTime() - Date.now() > 30_000) {
-    return cached
-  }
-
-  const response = await fetch(`${controlPlaneUrl}/session/open`, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-    },
-    body: JSON.stringify({
-      sessionId,
-      bridgeId: config.bridgeId || 'local-bridge',
-      deviceId: config.deviceId || '',
-      model: parsedBody?.model || null,
-      installSource: config.installSource || 'holysheep-cli',
-    }),
-  })
-
-  const payload = await response.json().catch(() => null)
-  if (!response.ok || !payload?.success || !payload?.data?.nodeBaseUrl || !payload?.data?.ticket) {
-    const message =
-      payload?.error?.message ||
-      payload?.message ||
-      `Failed to open Claude relay session (HTTP ${response.status})`
-    throw new Error(message)
-  }
-
-  leaseCache.set(sessionId, payload.data)
-  return payload.data
-}
-
-function buildUpstreamHeaders(req, config, body) {
-  const headers = {}
-  for (const [key, value] of Object.entries(req.headers || {})) {
-    const normalized = key.toLowerCase()
-    if (normalized === 'host') continue
-    if (normalized === 'content-length') continue
-    headers[normalized] = value
-  }
-
-  const token = stripBearer(headers.authorization) || headers['x-api-key'] || config.apiKey || ''
-  delete headers.authorization
-  if (token) headers['x-api-key'] = token
-  if (!headers['anthropic-version']) headers['anthropic-version'] = '2023-06-01'
-  headers['user-agent'] = 'holysheep-claude-bridge/1.0'
-  headers['x-hs-bridge-id'] = config.bridgeId || 'local-bridge'
-  headers['x-hs-install-source'] = config.installSource || 'holysheep-cli'
-  if (config.deviceId) headers['x-hs-device-id'] = config.deviceId
-  if (config.userToken) headers['x-hs-user-token'] = config.userToken
-  if (config.nodeId) headers['x-hs-node-id'] = config.nodeId
-  if (config.sessionMode) headers['x-hs-session-mode'] = config.sessionMode
-  const timestamp = Math.floor(Date.now() / 1000)
-  headers['x-hs-bridge-timestamp'] = String(timestamp)
-  const signature = buildBridgeSignature(req, config, body, timestamp)
-  if (signature) headers['x-hs-bridge-signature'] = signature
-  if (body && body.length > 0) headers['content-length'] = String(body.length)
-
-  return headers
-}
-
-function createBridgeServer(configPath = CLAUDE_BRIDGE_CONFIG_FILE) {
-  return http.createServer(async (req, res) => {
-    if (req.method === 'OPTIONS') {
-      res.writeHead(204, {
-        'access-control-allow-origin': '*',
-        'access-control-allow-methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',
-        'access-control-allow-headers': 'content-type,authorization,x-api-key,anthropic-version',
-      })
-      return res.end()
-    }
-
-    try {
-      const config = readBridgeConfig(configPath)
-      const url = new URL(req.url, `http://${req.headers.host || '127.0.0.1'}`)
-      const port = getConfiguredBridgePort(config)
-
-      if (req.method === 'GET' && url.pathname === '/health') {
-        return sendJson(res, 200, {
-          ok: true,
-          port,
-          upstream: getBridgeUpstream(config),
-          relayUrl: config.relayUrl || '',
-          mode: config.relayUrl ? 'relay' : 'direct',
-          bridgeId: config.bridgeId || null,
-          nodeId: config.nodeId || null,
-          installSource: config.installSource || 'holysheep-cli',
-        })
-      }
-
-      let upstreamBase = getBridgeUpstream(config)
-      if (!upstreamBase) {
-        return sendJson(res, 500, { error: { message: 'Bridge upstream is not configured' } })
-      }
-
-      const body = await readRawBody(req)
-      const parsedBody = parseJsonBody(body)
-      if (isRelayMode(config) && req.method !== 'GET' && url.pathname !== '/health') {
-        const sessionId = extractSessionId(parsedBody, config)
-        const lease = await requestSessionLease(config, sessionId, parsedBody)
-        upstreamBase = String(lease.nodeBaseUrl || '').replace(/\/+$/, '')
-        req.headers['x-hs-session-id'] = sessionId
-        req.headers['x-hs-bridge-ticket'] = lease.ticket
-        req.headers['x-hs-node-id'] = lease.nodeId || ''
-      }
-      const upstreamUrl = `${upstreamBase}${url.pathname}${url.search || ''}`
-      const upstream = await fetch(upstreamUrl, {
-        method: req.method,
-        headers: buildUpstreamHeaders(req, config, body),
-        body: body.length > 0 ? body : undefined,
-      })
-
-      res.writeHead(upstream.status, {
-        'content-type': upstream.headers.get('content-type') || 'application/json; charset=utf-8',
-        'cache-control': upstream.headers.get('cache-control') || 'no-store',
-      })
-
-      if (upstream.body && typeof upstream.body.pipe === 'function') {
-        upstream.body.pipe(res)
-        return
-      }
-
-      const text = await upstream.text()
-      res.end(text)
-    } catch (error) {
-      return sendJson(res, 500, { error: { message: error.message || 'Claude bridge error' } })
-    }
-  })
-}
-
-function waitForBridge(port) {
-  for (let i = 0; i < 12; i++) {
-    const t0 = Date.now()
-    while (Date.now() - t0 < 500) {}
-
-    try {
-      execSync(
-        isWin
-          ? `powershell -NonInteractive -Command "try{(Invoke-WebRequest -Uri http://127.0.0.1:${port}/health -TimeoutSec 1 -UseBasicParsing).StatusCode}catch{exit 1}"`
-          : `curl -sf http://127.0.0.1:${port}/health -o /dev/null --max-time 1`,
-        { stdio: 'ignore', timeout: 3000 }
-      )
-      return true
-    } catch {}
-  }
-
-  return false
-}
-
-function startBridge(args = parseArgs(process.argv.slice(2))) {
-  const config = readBridgeConfig(args.config)
-  const port = args.port || getConfiguredBridgePort(config)
-  const host = args.host || '127.0.0.1'
-  const server = createBridgeServer(args.config)
-
-  server.listen(port, host, () => {
-    process.stdout.write(`HolySheep Claude bridge listening on http://${host}:${port}\n`)
-  })
-
-  return server
-}
-
-function spawnBridge(port = getConfiguredBridgePort()) {
-  if (waitForBridge(port)) return true
-
-  const scriptPath = path.join(__dirname, '..', 'index.js')
-  const child = spawn(process.execPath, [scriptPath, 'claude-bridge', '--port', String(port)], {
-    detached: true,
-    stdio: 'ignore',
-  })
-  child.unref()
-
-  return waitForBridge(port)
-}
-
-module.exports = {
-  CLAUDE_BRIDGE_CONFIG_FILE,
-  DEFAULT_BRIDGE_PORT,
-  createBridgeServer,
-  getBridgeBaseUrl,
-  getConfiguredBridgePort,
-  parseArgs,
-  readBridgeConfig,
-  spawnBridge,
-  startBridge,
-  waitForBridge,
-  writeBridgeConfig,
-}