@simonyea/holysheep-cli 2.1.33 → 2.1.35

package/.gitea/workflows/sanity.yml

@@ -0,0 +1,123 @@
+name: CI sanity
+
+# [HolySheep fork] Minimal Gitea-side CI for holysheep-cli.
+# Mirrors the sanity check pattern from holysheep-webui.
+# Runs on every push to main, guards against regressions in:
+#   - package.json version format
+#   - runtime fetcher URL/SHA/VERSION consistency
+#   - key source files present (claude-process-proxy, pty-hermes-wrapper, droid)
+#   - aionui-wrapper brand strings (must not contain [aionui-wrapper] prefix)
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  sanity:
+    name: Sanity check (version + key files + invariants)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (host deploy-cache mode)
+        run: |
+          set -e
+          REPO_DIR="/opt/act_runner/deploy-cache/holysheep-cli"
+          BRANCH="${{ github.ref_name }}"
+          BRANCH="${BRANCH:-${GITHUB_REF_NAME:-main}}"
+          echo "branch: $BRANCH"
+          if [ -d "$REPO_DIR/.git" ]; then
+            cd "$REPO_DIR"
+            git fetch origin "$BRANCH"
+            git reset --hard "origin/$BRANCH"
+          else
+            mkdir -p "$REPO_DIR"
+            git clone --depth 1 -b "$BRANCH" \
+              http://simon:123123aa@localhost:3000/simon/holysheep-cli.git "$REPO_DIR"
+          fi
+          cd "$REPO_DIR"
+          echo "head: $(git rev-parse --short HEAD)"
+          echo "msg:  $(git log -1 --pretty=%s)"
+
+      - name: Version format check
+        run: |
+          set -e
+          cd /opt/act_runner/deploy-cache/holysheep-cli
+          VER=$(node -e "console.log(require('./package.json').version)")
+          echo "version: $VER"
+          if ! echo "$VER" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::package.json version '$VER' does not match semver"
+            exit 1
+          fi
+          echo "  ok: version $VER"
+
+      - name: Key source files present
+        run: |
+          set -e
+          cd /opt/act_runner/deploy-cache/holysheep-cli
+          for f in \
+            src/webui/aionui-wrapper.js \
+            src/webui/aionui-runtime-fetcher.js \
+            src/tools/claude-process-proxy.js \
+            src/tools/pty-hermes-wrapper.py \
+            src/tools/droid.js \
+            src/tools/hermes.js; do
+            if [ ! -f "$f" ]; then
+              echo "::error::required file missing: $f"
+              exit 1
+            fi
+            echo "  ok: $f"
+          done
+
+      - name: Runtime fetcher URL/SHA/VERSION consistency
+        run: |
+          set -e
+          cd /opt/act_runner/deploy-cache/holysheep-cli
+          URL=$(grep "DEFAULT_RUNTIME_URL" src/webui/aionui-runtime-fetcher.js | grep -o "holysheep-hs[0-9]*" | head -1)
+          VER=$(grep "DEFAULT_RUNTIME_VERSION" src/webui/aionui-runtime-fetcher.js | grep -o "holysheep-hs[0-9]*" | head -1)
+          echo "URL tag: $URL"
+          echo "VERSION tag: $VER"
+          if [ -z "$URL" ] || [ -z "$VER" ]; then
+            echo "::error::DEFAULT_RUNTIME_URL or DEFAULT_RUNTIME_VERSION missing hs-tag"
+            exit 1
+          fi
+          if [ "$URL" != "$VER" ]; then
+            echo "::error::URL tag ($URL) != VERSION tag ($VER) — run pack-runtime.mjs and update fetcher"
+            exit 1
+          fi
+          echo "  ok: URL and VERSION both reference $URL"
+
+      - name: Invariant grep (brand + proxy)
+        run: |
+          set -e
+          cd /opt/act_runner/deploy-cache/holysheep-cli
+
+          # Brand: wrapper must NOT use old [aionui-wrapper] prefix
+          if grep -q "\[aionui-wrapper\]" src/webui/aionui-wrapper.js; then
+            echo "::error::aionui-wrapper.js still contains [aionui-wrapper] log prefix (should be [holysheep-web])"
+            exit 1
+          fi
+          echo "  ok: no [aionui-wrapper] prefix"
+
+          # mode field must be holysheep-webui
+          if ! grep -q "holysheep-webui" src/webui/aionui-wrapper.js; then
+            echo "::error::aionui-wrapper.js missing mode=holysheep-webui"
+            exit 1
+          fi
+          echo "  ok: holysheep-webui mode present"
+
+          # claude-process-proxy: sanitizeClaudeClientHeaders must exist
+          if ! grep -q "sanitizeClaudeClientHeaders" src/tools/claude-process-proxy.js; then
+            echo "::error::claude-process-proxy.js missing sanitizeClaudeClientHeaders (UA-rewrite regression)"
+            exit 1
+          fi
+          echo "  ok: sanitizeClaudeClientHeaders present"
+
+          # pty-hermes-wrapper: ICANON must be disabled
+          if ! grep -q "ICANON" src/tools/pty-hermes-wrapper.py; then
+            echo "::error::pty-hermes-wrapper.py missing ICANON disable (PTY truncation regression)"
+            exit 1
+          fi
+          echo "  ok: ICANON disabled in pty-hermes-wrapper.py"
+
+          echo "all invariants passed"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@simonyea/holysheep-cli",
-  "version": "2.1.33",
-  "description": "Claude Code/Cursor/Cline API relay for China \u2014 \u00a51=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
+  "version": "2.1.35",
+  "description": "Claude Code/Cursor/Cline API relay for China — ¥1=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
   "scripts": {
     "test": "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js",
     "prepublishOnly": "node scripts/check-tarball-size.js"

package/src/tools/claude-process-proxy.js

@@ -229,8 +229,17 @@ function deriveNodeProxyUrl(lease) {
   if (process.env.HS_CLAUDE_NODE_PROXY_OVERRIDE) {
     return String(process.env.HS_CLAUDE_NODE_PROXY_OVERRIDE).replace(/\/+$/, '')
   }
-  if (lease.nodeProxyUrl) return String(lease.nodeProxyUrl)
-  if (!lease.nodeBaseUrl) throw new Error('Lease does not include node proxy information')
+  // [HolySheep fork v2.1.34 / hs23] Distinguish "field present but empty"
+  // (sub2api nodes have no process-proxy) from "field absent" (old lease format).
+  // Control plane sets nodeProxyUrl:"" for sub2api nodes = no process proxy exists.
+  // Return null so callers skip node-proxy and go straight to direct-https.
+  // Only fall through to port inference when field is entirely absent (legacy leases).
+  if (Object.prototype.hasOwnProperty.call(lease, 'nodeProxyUrl')) {
+    if (!lease.nodeProxyUrl) return null  // explicit empty = no proxy on this node
+    return String(lease.nodeProxyUrl)
+  }
+  // Legacy fallback: field absent → infer proxy port from nodeBaseUrl
+  if (!lease.nodeBaseUrl) return null
   const upstream = new URL(String(lease.nodeBaseUrl))
   const proxyPort = upstream.port === '3101' ? '3129' : upstream.port
   upstream.port = proxyPort || '3129'
@@ -678,6 +687,16 @@ function createProcessProxyServer({ sessionId, configPath = CONFIG_PATH, allowAn
       const config = readConfig(configPath)
       const nodeProxyUrl = deriveNodeProxyUrl(lease)
 
+      // [HolySheep fork v2.1.34 / hs23] nodeProxyUrl===null means the control
+      // plane signalled this node has no process proxy (sub2api nodes).
+      // Skip node-proxy entirely and go straight to direct-https. This avoids
+      // the ECONNREFUSED → retry × MAX_PROXY_RETRIES delay that was burning
+      // ~5 s before falling back.
+      if (nodeProxyUrl === null) {
+        logProxyTiming('request.direct-noproxy', { sessionId, nodeId: lease.nodeId || '', attempt })
+        return forwardDirectHttps({ config, lease, clientReq, clientRes, trace: null })
+      }
+
       if (isDirect) {
         const crsBase = config.baseUrlAnthropic || 'https://api.holysheep.ai'
         const target = new URL(clientReq.url, crsBase)
@@ -824,8 +843,23 @@ function createProcessProxyServer({ sessionId, configPath = CONFIG_PATH, allowAn
     }
 
     const doConnect = async (lease) => {
+      const nodeProxyUrl = deriveNodeProxyUrl(lease)
+      // [HolySheep fork v2.1.34 / hs23] No process proxy on this node (sub2api).
+      // CONNECT tunnels go directly to the target host — no bridge headers needed.
+      if (nodeProxyUrl === null) {
+        logProxyTiming('connect.direct-noproxy', { sessionId, nodeId: lease.nodeId || '', target })
+        const upstreamSocket = await new Promise((resolve, reject) => {
+          const sock = net.connect(port, host, () => resolve(sock))
+          sock.once('error', reject)
+          sock.setTimeout(15000, () => sock.destroy(new Error('CONNECT direct tunnel timeout')))
+        })
+        clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+        if (head?.length) upstreamSocket.write(head)
+        pipeWithCleanup(clientSocket, upstreamSocket)
+        return
+      }
       const upstreamSocket = await createConnectTunnel(
-        deriveNodeProxyUrl(lease),
+        nodeProxyUrl,
         target,
         buildAuthHeaders(readConfig(configPath), lease)
       )

package/src/webui/aionui-runtime-fetcher.js

@@ -60,10 +60,10 @@ const VENDOR_DIR = path.join(__dirname, 'vendor', 'aionui')
 // new CLI release, the next `hs web` invocation on user machines will detect
 // the version drift and upgrade the cache in place.
 const DEFAULT_RUNTIME_URL =
-  'https://mail.holysheep.ai/app/cli/aionui-runtime-v1.9.18-holysheep-hs23.tar.gz'
+  'https://mail.holysheep.ai/app/cli/aionui-runtime-v1.9.18-holysheep-hs24.tar.gz'
 const DEFAULT_RUNTIME_SHA256 =
-  '96bcf47a06c4cdda206ed6d258edd9d347a587ef300c053e7679df469ccf8856'
-const DEFAULT_RUNTIME_VERSION = '1.9.18-holysheep-hs23'
+  '8b3c4fa1bed93b938193321b1817c6e950cdbbfcef64c73a9283b3bb589a768c'
+const DEFAULT_RUNTIME_VERSION = '1.9.18-holysheep-hs24'
 
 function isValidRuntimeDir(dir) {
   if (!dir) return false