@simonyea/holysheep-cli 1.7.48 → 1.7.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simonyea/holysheep-cli",
-  "version": "1.7.48",
+  "version": "1.7.50",
   "description": "Claude Code/Cursor/Cline API relay for China \u2014 \u00a51=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
   "keywords": [
     "openai-china",

package/src/commands/claude.js

@@ -49,12 +49,12 @@ async function runClaude(args = []) {
     ...process.env,
     ANTHROPIC_API_KEY: undefined,
     ANTHROPIC_AUTH_TOKEN: apiKey,
-    ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`,
+    ANTHROPIC_BASE_URL: BASE_URL_ANTHROPIC,
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
     HOLYSHEEP_CLAUDE_PROCESS_PROXY: '1',
     HOLYSHEEP_CLAUDE_SESSION_ID: sessionId,
-    NODE_OPTIONS: undefined,
-    HS_PROXY_URL: undefined,
+    NODE_OPTIONS: `--require ${INJECT_PATH}`,
+    HS_PROXY_URL: proxyUrl,
     HTTP_PROXY: undefined,
     HTTPS_PROXY: undefined,
     ALL_PROXY: undefined,

package/src/tools/process-proxy-inject.js

@@ -1,8 +1,13 @@
 'use strict'
 /**
  * 进程级代理注入 — 通过 NODE_OPTIONS=--require 加载
- * patch sock.emit 拦截 'connect' 事件，强制所有 TCP 连接走 CONNECT 隧道
- * 无论 TLSSocket 用何种方式注册监听器都无法绕过
+ *
+ * Node.js v22+ 中 tls.connect / undici 不走 net.createConnection，
+ * 直接调用 net.Socket.prototype.connect，因此同时 patch 两者。
+ *
+ * 原理：将所有非本地 TCP 连接重定向到本地 bridge（CONNECT 代理），
+ * bridge 再通过 relay-control 分配的 node 节点出口，使 CRS 看到
+ * 可信的节点 IP。
  */
 const net = require('net')
 const { URL } = require('url')
@@ -21,54 +26,90 @@ const PROXY_HOST = parsed.hostname
 const PROXY_PORT = Number(parsed.port) || 80
 const SKIP = new Set(['127.0.0.1', '::1', 'localhost', '0.0.0.0', PROXY_HOST])
 
-const _orig = net.createConnection
+function shouldProxy(host, port) {
+  return !!(port && host && !SKIP.has(host))
+}
+
+function setupTunnel(sock, host, port, origEmit) {
+  sock.write(`CONNECT ${host}:${port} HTTP/1.1\r\nHost: ${host}:${port}\r\n\r\n`)
+  let buf = Buffer.alloc(0)
+  sock.on('data', function onData(chunk) {
+    buf = Buffer.concat([buf, chunk])
+    const i = buf.indexOf('\r\n\r\n')
+    if (i === -1) return
+    sock.removeListener('data', onData)
+    if (!buf.slice(0, i).toString().includes(' 200 ')) {
+      sock.emit = origEmit
+      sock.destroy(new Error(`CONNECT ${host}:${port} failed: ${buf.slice(0, buf.indexOf('\r\n')).toString()}`))
+      return
+    }
+    const rest = buf.slice(i + 4)
+    if (rest.length) sock.unshift(rest)
+    sock.emit = origEmit
+    origEmit('connect')
+  })
+}
+
+function patchEmitAndConnect(sock, host, port, connectFn) {
+  let tunnelReady = false
+  const origEmit = sock.emit.bind(sock)
+
+  sock.emit = function(type) {
+    if (type === 'connect' && !tunnelReady) {
+      tunnelReady = true
+      setupTunnel(sock, host, port, origEmit)
+      return false
+    }
+    return origEmit.apply(null, arguments)
+  }
+
+  return connectFn()
+}
+
+// ── patch net.Socket.prototype.connect (Node.js v22+ TLS / undici) ───────────
+const _origSocketConnect = net.Socket.prototype.connect
+
+net.Socket.prototype.connect = function(options) {
+  const isObj = options !== null && typeof options === 'object'
+  const host = isObj ? String(options.host || options.hostname || '') : String(options || '')
+  const port = isObj ? Number(options.port || 0) : Number(arguments[1] || 0)
+
+  if (!shouldProxy(host, port)) return _origSocketConnect.apply(this, arguments)
+
+  const sock = this
+  const proxyOpts = isObj
+    ? { ...options, host: PROXY_HOST, port: PROXY_PORT }
+    : { host: PROXY_HOST, port: PROXY_PORT }
+
+  return patchEmitAndConnect(sock, host, port, () =>
+    _origSocketConnect.call(sock, proxyOpts)
+  )
+}
+
+// ── patch net.createConnection (兼容直接调用的旧代码) ─────────────────────────
+const _origCreate = net.createConnection
 
 function proxied(options, cb) {
   const isObj = options !== null && typeof options === 'object'
-  const host = isObj
-    ? String(options.host || options.hostname || 'localhost')
-    : String(options || 'localhost')
-  const port = isObj
-    ? Number(options.port || 0)
-    : Number(arguments[1] || 0)
+  const host = isObj ? String(options.host || options.hostname || 'localhost') : String(options || 'localhost')
+  const port = isObj ? Number(options.port || 0) : Number(arguments[1] || 0)
 
-  if (!port || SKIP.has(host)) return _orig.apply(this, arguments)
+  if (!shouldProxy(host, port)) return _origCreate.apply(this, arguments)
+
+  const sock = _origCreate({ host: PROXY_HOST, port: PROXY_PORT })
+  if (typeof cb === 'function') sock.once('connect', cb)
 
-  const sock = _orig({ host: PROXY_HOST, port: PROXY_PORT })
   let tunnelReady = false
   const origEmit = sock.emit.bind(sock)
-
-  // patch emit 而不是 on/once：无论监听器怎么注册都能拦截
   sock.emit = function(type) {
     if (type === 'connect' && !tunnelReady) {
-      // proxy TCP 已建立，发起 CONNECT 隧道
-      sock.write(`CONNECT ${host}:${port} HTTP/1.1\r\nHost: ${host}:${port}\r\n\r\n`)
-      let buf = Buffer.alloc(0)
-      sock.on('data', function onData(chunk) {
-        buf = Buffer.concat([buf, chunk])
-        const i = buf.indexOf('\r\n\r\n')
-        if (i === -1) return
-        sock.removeListener('data', onData)
-        const header = buf.slice(0, i).toString()
-        if (!header.includes(' 200 ')) {
-          sock.emit = origEmit
-          sock.destroy(new Error(`CONNECT ${host}:${port} failed: ${header.split('\r\n')[0]}`))
-          return
-        }
-        const rest = buf.slice(i + 4)
-        if (rest.length) sock.unshift(rest)
-        // 隧道就绪：恢复 emit，触发所有注册的 connect 监听器（含 TLSSocket）
-        tunnelReady = true
-        sock.emit = origEmit
-        origEmit('connect')
-      })
+      tunnelReady = true
+      setupTunnel(sock, host, port, origEmit)
       return false
     }
-    // eslint-disable-next-line prefer-rest-params
     return origEmit.apply(null, arguments)
   }
 
-  if (typeof cb === 'function') sock.once('connect', cb)
   return sock
 }