@simonyea/holysheep-cli 2.1.50 → 2.1.52

package/dist/index.js

@@ -12,11 +12,11 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@simonyea/holysheep-cli",
-      version: "2.1.50",
+      version: "2.1.52",
       description: "Claude Code/Cursor/Cline API relay for China \u2014 \xA51=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
       scripts: {
         build: "node scripts/build.mjs",
-        test: "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
+        test: "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/aionui-wrapper-csp-rewrite.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
         prepublishOnly: "npm run build && npm test && node scripts/check-tarball-size.js"
       },
       keywords: [
@@ -74,6 +74,7 @@ var require_package = __commonJS({
         "dist/process-proxy-inject.js",
         "dist/index.html",
         "dist/pty-hermes-wrapper.py",
+        "dist/aionui-resources/assistant",
         "README.md",
         "LICENSE"
       ],
@@ -741,7 +742,7 @@ var require_claude_process_proxy = __commonJS({
   "src/tools/claude-process-proxy.js"(exports2, module2) {
     "use strict";
     var fs = require("fs");
-    var http = require("http");
+    var http2 = require("http");
     var https = require("https");
     var net = require("net");
     var path = require("path");
@@ -1122,7 +1123,7 @@ var require_claude_process_proxy = __commonJS({
             })}`
           );
         }
-        forwardReq = http.request({
+        forwardReq = http2.request({
           host: upstream.hostname,
           port: Number(upstream.port || 80),
           method: clientReq.method,
@@ -1195,7 +1196,7 @@ var require_claude_process_proxy = __commonJS({
     function createConnectTunnel(proxyUrl, target, headers) {
       return new Promise((resolve, reject) => {
         const upstream = new URL2(proxyUrl);
-        const request = http.request({
+        const request = http2.request({
           host: upstream.hostname,
           port: Number(upstream.port || 80),
           method: "CONNECT",
@@ -1270,7 +1271,7 @@ var require_claude_process_proxy = __commonJS({
     }
     __name(pipeWithCleanup, "pipeWithCleanup");
     function createProcessProxyServer({ sessionId, configPath = CONFIG_PATH, allowAnthropicConnect = false }) {
-      const server = http.createServer(async (clientReq, clientRes) => {
+      const server = http2.createServer(async (clientReq, clientRes) => {
         if (clientReq.method === "GET" && !clientReq.url.startsWith("http")) {
           const u = clientReq.url.split("?")[0];
           if (u === LOCAL_PING_PATH) {
@@ -2481,7 +2482,7 @@ var require_openclaw_bridge = __commonJS({
   "src/tools/openclaw-bridge.js"(exports2, module2) {
     "use strict";
     var fs = require("fs");
-    var http = require("http");
+    var http2 = require("http");
     var path = require("path");
     var os = require("os");
     var fetch = global.fetch || require("node-fetch");
@@ -2540,7 +2541,13 @@ var require_openclaw_bridge = __commonJS({
     function sendJson(res, statusCode, payload) {
       res.writeHead(statusCode, {
         "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store"
+        "cache-control": "no-store",
+        // [hs36] Mirror the OPTIONS preflight ACAO so browsers can read the
+        // response from a different-port origin (e.g. the AionUi WebUI on :9876
+        // fetching /v1/models from the bridge on :18788). Without this header on
+        // the actual GET/POST response, Chrome/Firefox treat it as ERR_FAILED
+        // even though the OPTIONS preflight succeeds.
+        "access-control-allow-origin": "*"
       });
       res.end(JSON.stringify(payload));
     }
@@ -2554,7 +2561,10 @@ var require_openclaw_bridge = __commonJS({
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
-        connection: "keep-alive"
+        connection: "keep-alive",
+        // [hs36] Mirror sendJson's ACAO so SSE streams reach the WebUI from a
+        // cross-port loopback origin. See sendJson comment for rationale.
+        "access-control-allow-origin": "*"
       });
       const firstChunk = {
         id: payload.id,
@@ -2974,7 +2984,9 @@ var require_openclaw_bridge = __commonJS({
         res.writeHead(200, {
           "content-type": "text/event-stream; charset=utf-8",
           "cache-control": "no-cache, no-transform",
-          connection: "keep-alive"
+          connection: "keep-alive",
+          // [hs36] CORS for SSE byte-passthrough relay path.
+          "access-control-allow-origin": "*"
         });
         try {
           await pipeStream(upstream.body, (chunk) => res.write(chunk));
@@ -3048,7 +3060,10 @@ var require_openclaw_bridge = __commonJS({
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
-        connection: "keep-alive"
+        connection: "keep-alive",
+        // [hs36] Mirror sendJson's ACAO so SSE streams reach the WebUI from a
+        // cross-port loopback origin. See sendJson comment for rationale.
+        "access-control-allow-origin": "*"
       });
       const msgId = `chatcmpl_${Date.now()}`;
       const created = Math.floor(Date.now() / 1e3);
@@ -3217,9 +3232,9 @@ var require_openclaw_bridge = __commonJS({
       const host = config.gatewayHost || "127.0.0.1";
       const timeout = Number((_a = config.watchdog) == null ? void 0 : _a.requestTimeoutMs) || DEFAULT_WATCHDOG_REQUEST_TIMEOUT_MS;
       try {
-        const http2 = require("http");
+        const http3 = require("http");
         await new Promise((resolve, reject) => {
-          const req = http2.get({ hostname: host, port: gatewayPort, path: "/", family: 4 }, resolve);
+          const req = http3.get({ hostname: host, port: gatewayPort, path: "/", family: 4 }, resolve);
           req.setTimeout(timeout, () => {
             req.destroy();
             reject(new Error("timeout"));
@@ -3276,7 +3291,7 @@ var require_openclaw_bridge = __commonJS({
     }
     __name(startGatewayWatchdog, "startGatewayWatchdog");
     function createBridgeServer(configPath = BRIDGE_CONFIG_FILE) {
-      return http.createServer(async (req, res) => {
+      return http2.createServer(async (req, res) => {
         if (req.method === "OPTIONS") {
           res.writeHead(204, {
             "access-control-allow-origin": "*",
@@ -4268,6 +4283,18 @@ var require_hermes = __commonJS({
     __name(readConfig, "readConfig");
     function patchConfigYaml(apiKey, baseUrlOpenAI, primaryModel) {
       if (!fs.existsSync(CONFIG_YAML)) {
+        const cleanBase2 = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
+        const model2 = primaryModel || "claude-sonnet-4-6";
+        const minimal = `model:
+  base_url: ${cleanBase2}
+  api_key: ${apiKey}
+  default: ${model2}
+providers:
+  custom:
+    base_url: ${cleanBase2}
+    api_key: ${apiKey}
+`;
+        fs.writeFileSync(CONFIG_YAML, minimal, "utf8");
         return;
       }
       const cleanBase = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
@@ -4311,7 +4338,6 @@ var require_hermes = __commonJS({
         "  custom:",
         `    base_url: ${cleanBase}`,
         `    api_key: ${apiKey}`,
-        `    default_model: ${model}`,
         "    type: openai"
       ];
       let start = -1, end = -1;
@@ -4424,7 +4450,7 @@ var require_hermes = __commonJS({
     __name(writeConfig, "writeConfig");
     function buildHolySheepBlock(apiKey, baseUrlOpenAI, primaryModel) {
       const cleanBase = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
-      const model = primaryModel || "gpt-5.4";
+      const model = primaryModel || "gpt-4o";
       return [
         "[providers.holysheep]",
         "# Managed by @simonyea/holysheep-cli. Do not edit by hand \u2014 run `hs setup`.",
@@ -4491,10 +4517,11 @@ var require_hermes = __commonJS({
         return commandExists2("hermes");
       },
       isConfigured() {
-        return isConfiguredInToml(readConfig());
+        return isConfiguredInToml(readConfig()) && fs.existsSync(CONFIG_YAML);
       },
       configure(apiKey, _baseUrlAnthropic, baseUrlOpenAI, primaryModel) {
-        const hermesPrimaryModel = /^claude-/i.test(primaryModel || "") ? "gpt-5.4" : primaryModel || "gpt-5.4";
+        const THINKING_MODELS = /^(gpt-5|o[0-9]|claude-)/i;
+        const hermesPrimaryModel = THINKING_MODELS.test(primaryModel || "") ? "gpt-4o" : primaryModel || "gpt-4o";
         const merged = mergeConfig(apiKey, baseUrlOpenAI, hermesPrimaryModel);
         writeConfig(merged);
         try {
@@ -4626,6 +4653,7 @@ var require_env_config = __commonJS({
     module2.exports = {
       name: "\u5168\u5C40\u73AF\u5883\u53D8\u91CF",
       id: "env-config",
+      installCmd: "\u5185\u7F6E\u529F\u80FD\uFF08\u65E0\u9700\u5B89\u88C5\uFF09",
       checkInstalled() {
         return true;
       },
@@ -6004,7 +6032,7 @@ var require_aionui_runtime_fetcher = __commonJS({
     var os = require("os");
     var crypto = require("crypto");
     var https = require("https");
-    var http = require("http");
+    var http2 = require("http");
     var USER_CACHE_DIR = path.join(os.homedir(), ".holysheep", "aionui-runtime");
     var VENDOR_DIR = path.join(__dirname, "vendor", "aionui");
     var DEFAULT_RUNTIME_URL = "https://mail.holysheep.ai/app/cli/aionui-runtime-v1.9.18-holysheep-hs35.tar.gz";
@@ -6179,7 +6207,7 @@ var require_aionui_runtime_fetcher = __commonJS({
       return new Promise((resolve, reject) => {
         const tmpFile = path.join(os.tmpdir(), `aionui-runtime-${Date.now()}.tar.gz`);
         logger(`Downloading HolySheep runtime from ${url}`);
-        const client = url.startsWith("https:") ? https : http;
+        const client = url.startsWith("https:") ? https : http2;
         const file = fs.createWriteStream(tmpFile);
         const hasher = crypto.createHash("sha256");
         let totalBytes = 0;
@@ -7325,7 +7353,7 @@ var require_server = __commonJS({
     "use strict";
     var dns = require("dns");
     dns.setServers([.../* @__PURE__ */ new Set([...dns.getServers(), "1.1.1.1", "223.5.5.5"])]);
-    var http = require("http");
+    var http2 = require("http");
     var fs = require("fs");
     var path = require("path");
     var { execSync, spawn } = require("child_process");
@@ -8339,7 +8367,7 @@ ${AUTO_INSTALL[toolId].cmd}
           }
         }
       }
-      json(res, { ok: true, type: "terminal", cmd });
+      json(res, { ok: true, type: "terminal", cmd, launchCmd: cmd });
     }
     __name(handleToolLaunch, "handleToolLaunch");
     async function handleClaudeProxyStart(_req, res) {
@@ -8657,7 +8685,7 @@ ${AUTO_INSTALL[toolId].cmd}
     __name(handleRequest, "handleRequest");
     function startServer(port) {
       return new Promise((resolve, reject) => {
-        const server = http.createServer(handleRequest);
+        const server = http2.createServer(handleRequest);
         server.on("error", (err) => {
           var _a;
           if (err.code === "EADDRINUSE") {
@@ -8677,7 +8705,7 @@ ${AUTO_INSTALL[toolId].cmd}
             } catch {
             }
             setTimeout(() => {
-              const retry = http.createServer(handleRequest);
+              const retry = http2.createServer(handleRequest);
               retry.on("error", (err2) => reject(err2));
               retry.listen(port, "127.0.0.1", () => {
                 workspaceRuntime.startScheduler();
@@ -8706,9 +8734,9 @@ ${AUTO_INSTALL[toolId].cmd}
           const bridgePort = ((_a = openclawTool.getBridgePort) == null ? void 0 : _a.call(openclawTool)) || 18788;
           let bridgeAlive = false;
           try {
-            const http2 = require("http");
+            const http3 = require("http");
             await new Promise((resolve, reject) => {
-              const req = http2.get({ hostname: "127.0.0.1", port: bridgePort, path: "/health", family: 4 }, resolve);
+              const req = http3.get({ hostname: "127.0.0.1", port: bridgePort, path: "/health", family: 4 }, resolve);
               req.setTimeout(2e3, () => {
                 req.destroy();
                 reject();
@@ -8780,7 +8808,7 @@ ${AUTO_INSTALL[toolId].cmd}
 var require_aionui_wrapper = __commonJS({
   "src/webui/aionui-wrapper.js"(exports2, module2) {
     "use strict";
-    var http = require("http");
+    var http2 = require("http");
     var net = require("net");
     var fs = require("fs");
     var path = require("path");
@@ -8801,6 +8829,7 @@ var require_aionui_wrapper = __commonJS({
     var codexTool = require_codex();
     var droidTool = require_droid();
     var hermesTool = require_hermes();
+    var openclawTool = require_openclaw();
     var BRIDGE_DIR = path.join(os.homedir(), ".holysheep");
     var BRIDGE_CRED_FILE = path.join(BRIDGE_DIR, "aionui-bridge.json");
     var TOKEN_TTL_MS = 3e4;
@@ -8906,6 +8935,79 @@ var require_aionui_wrapper = __commonJS({
       }
     }
     __name(loadBridgeCredentials, "loadBridgeCredentials");
+    function copyDirRecursive(src, dest) {
+      fs.mkdirSync(path.dirname(dest), { recursive: true });
+      fs.cpSync(src, dest, { recursive: true, force: true });
+    }
+    __name(copyDirRecursive, "copyDirRecursive");
+    function countFiles(dir) {
+      let total = 0;
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, entry.name);
+        if (entry.isDirectory()) total += countFiles(p);
+        else if (entry.isFile()) total++;
+      }
+      return total;
+    }
+    __name(countFiles, "countFiles");
+    function findBundledAssistantResources() {
+      try {
+        const { PACKAGE_ROOT } = require_paths();
+        const candidates = [
+          path.join(PACKAGE_ROOT, "dist", "aionui-resources", "assistant"),
+          path.join(PACKAGE_ROOT, "aionui-fork", "src", "process", "resources", "assistant")
+        ];
+        return candidates.find((dir) => fs.existsSync(dir)) || null;
+      } catch {
+        return null;
+      }
+    }
+    __name(findBundledAssistantResources, "findBundledAssistantResources");
+    function ensureRuntimeAssistantResources(runtimeDir) {
+      const dest = path.join(runtimeDir, "src", "process", "resources", "assistant");
+      try {
+        if (fs.existsSync(dest) && countFiles(dest) > 0) {
+          return { copied: false, dest, reason: "already-present" };
+        }
+      } catch {
+      }
+      const src = findBundledAssistantResources();
+      if (!src) {
+        log("warn: bundled AionUi assistant resources not found; builtin assistant rules may be unavailable");
+        return { copied: false, dest, reason: "source-missing" };
+      }
+      copyDirRecursive(src, dest);
+      const files = countFiles(dest);
+      log(`hydrated AionUi assistant resources (${files} files) \u2192 ${dest}`);
+      return { copied: true, src, dest, files };
+    }
+    __name(ensureRuntimeAssistantResources, "ensureRuntimeAssistantResources");
+    function ensureRuntimeSkillsResources(runtimeDir) {
+      const dest = path.join(runtimeDir, "src", "process", "resources", "skills");
+      try {
+        if (fs.existsSync(dest) && countFiles(dest) > 0) {
+          return { copied: false, dest, reason: "already-present" };
+        }
+      } catch {
+      }
+      const src = path.join(runtimeDir, "dist-server", "skills");
+      if (!fs.existsSync(src)) {
+        log("warn: AionUi runtime skills resources not found; builtin skills may be unavailable");
+        return { copied: false, dest, reason: "source-missing" };
+      }
+      copyDirRecursive(src, dest);
+      const files = countFiles(dest);
+      log(`hydrated AionUi skills resources (${files} files) \u2192 ${dest}`);
+      return { copied: true, src, dest, files };
+    }
+    __name(ensureRuntimeSkillsResources, "ensureRuntimeSkillsResources");
+    function ensureRuntimeBuiltinResources(runtimeDir) {
+      return {
+        assistant: ensureRuntimeAssistantResources(runtimeDir),
+        skills: ensureRuntimeSkillsResources(runtimeDir)
+      };
+    }
+    __name(ensureRuntimeBuiltinResources, "ensureRuntimeBuiltinResources");
     function detectHolySheepAionUi(runtimeDir) {
       try {
         const serverPath = path.join(runtimeDir, "dist-server", "server.mjs");
@@ -8933,7 +9035,7 @@ var require_aionui_wrapper = __commonJS({
     function aionuiInternalLoginWithApiKey({ internalPort, apiKey }) {
       return new Promise((resolve, reject) => {
         const body = JSON.stringify({ apiKey });
-        const req = http.request({
+        const req = http2.request({
           host: "127.0.0.1",
           port: internalPort,
           path: "/login",
@@ -9040,6 +9142,58 @@ var require_aionui_wrapper = __commonJS({
       return legacyModule;
     }
     __name(legacy, "legacy");
+    var _cachedOpenClawOrigins = null;
+    var _cachedOpenClawOriginsAt = 0;
+    var OPENCLAW_ORIGIN_TTL_MS = 6e4;
+    function getOpenClawOrigins() {
+      if (_cachedOpenClawOrigins && nowMs() - _cachedOpenClawOriginsAt < OPENCLAW_ORIGIN_TTL_MS) {
+        return _cachedOpenClawOrigins;
+      }
+      const origins = [];
+      try {
+        const bridgePort = openclawTool.getBridgePort();
+        const gatewayPort = openclawTool.getGatewayPort();
+        if (bridgePort) origins.push(`http://127.0.0.1:${bridgePort}`);
+        if (gatewayPort) origins.push(`http://127.0.0.1:${gatewayPort}`);
+      } catch {
+      }
+      _cachedOpenClawOrigins = origins;
+      _cachedOpenClawOriginsAt = nowMs();
+      return origins;
+    }
+    __name(getOpenClawOrigins, "getOpenClawOrigins");
+    function appendOriginsToDirective(directiveValue, origins) {
+      const tokens = new Set(directiveValue.trim().split(/\s+/).filter(Boolean));
+      for (const o of origins) tokens.add(o);
+      return Array.from(tokens).join(" ");
+    }
+    __name(appendOriginsToDirective, "appendOriginsToDirective");
+    function rewriteCspHeaders(outHeaders) {
+      const origins = getOpenClawOrigins();
+      if (origins.length === 0) return;
+      for (const key of Object.keys(outHeaders)) {
+        const lower = key.toLowerCase();
+        if (lower !== "content-security-policy" && lower !== "content-security-policy-report-only") {
+          continue;
+        }
+        const value = outHeaders[key];
+        const cspString = Array.isArray(value) ? value.join("; ") : String(value || "");
+        if (!cspString) continue;
+        const directives = cspString.split(";").map((s) => s.trim()).filter(Boolean);
+        let foundConnect = false;
+        const rewritten = directives.map((d) => {
+          const m = d.match(/^(connect-src)\s+(.*)$/i);
+          if (!m) return d;
+          foundConnect = true;
+          return `connect-src ${appendOriginsToDirective(m[2], origins)}`;
+        });
+        if (!foundConnect) {
+          rewritten.push(`connect-src 'self' ws: wss: blob: ${origins.join(" ")}`);
+        }
+        outHeaders[key] = rewritten.join("; ");
+      }
+    }
+    __name(rewriteCspHeaders, "rewriteCspHeaders");
     var BODYLESS_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     function proxyHttp(req, res, internalPort) {
       const headers = { ...req.headers };
@@ -9051,7 +9205,7 @@ var require_aionui_wrapper = __commonJS({
       delete headers["trailer"];
       delete headers["transfer-encoding"];
       delete headers["upgrade"];
-      const upstream = http.request({
+      const upstream = http2.request({
         host: "127.0.0.1",
         port: internalPort,
         method: req.method,
@@ -9063,6 +9217,7 @@ var require_aionui_wrapper = __commonJS({
         delete outHeaders["connection"];
         delete outHeaders["keep-alive"];
         delete outHeaders["proxy-connection"];
+        rewriteCspHeaders(outHeaders);
         res.writeHead(upRes.statusCode, upRes.statusMessage, outHeaders);
         upRes.pipe(res);
       });
@@ -9139,7 +9294,7 @@ var require_aionui_wrapper = __commonJS({
       const startedAt = nowMs();
       return new Promise((resolve, reject) => {
         const tick = /* @__PURE__ */ __name(() => {
-          const req = http.get({
+          const req = http2.get({
             host: "127.0.0.1",
             port: internalPort,
             path: "/",
@@ -9274,7 +9429,7 @@ var require_aionui_wrapper = __commonJS({
             socket.end();
           } catch {
           }
-          const req = http.request({
+          const req = http2.request({
             host: "127.0.0.1",
             port,
             method: "GET",
@@ -9453,7 +9608,50 @@ var require_aionui_wrapper = __commonJS({
       }
     }
     __name(ensureClaudeProcessProxyRunning, "ensureClaudeProcessProxyRunning");
+    function ensureOpenClawBridgeRunning() {
+      let bridgePort;
+      try {
+        if (typeof openclawTool.isConfigured === "function" && !openclawTool.isConfigured()) {
+          log("OpenClaw bridge pre-start skipped: openclaw not configured (run `hs setup` to enable)");
+          return { skipped: true, reason: "not-configured" };
+        }
+        bridgePort = openclawTool.getBridgePort();
+      } catch (e) {
+        log(`OpenClaw bridge pre-start skipped: cannot read openclaw config (${e && e.message ? e.message : e})`);
+        return { skipped: true, reason: "config-read-failed" };
+      }
+      try {
+        disableBridgeWatchdog();
+      } catch (e) {
+        log(`warn: failed to disable bridge watchdog (continuing): ${e && e.message ? e.message : e}`);
+      }
+      try {
+        const ok = openclawTool.ensureBridgeRunning(bridgePort);
+        if (ok) {
+          log(`OpenClaw bridge ready on 127.0.0.1:${bridgePort} (watchdog disabled \u2014 gateway-less mode)`);
+          return { started: true, port: bridgePort };
+        }
+        log(`OpenClaw bridge failed to start on :${bridgePort} \u2014 OpenClaw chat panel will be unavailable`);
+        return { skipped: true, reason: "start-failed", port: bridgePort };
+      } catch (e) {
+        log(`OpenClaw bridge pre-start error (continuing): ${e && e.message ? e.message : e}`);
+        return { skipped: true, reason: "spawn-error" };
+      }
+    }
+    __name(ensureOpenClawBridgeRunning, "ensureOpenClawBridgeRunning");
+    function disableBridgeWatchdog() {
+      const { BRIDGE_CONFIG_FILE } = require_openclaw_bridge();
+      if (!fs.existsSync(BRIDGE_CONFIG_FILE)) return;
+      const raw = JSON.parse(fs.readFileSync(BRIDGE_CONFIG_FILE, "utf8"));
+      if (!raw.watchdog) raw.watchdog = {};
+      if (raw.watchdog.enabled === false && raw.gatewayPid == null) return;
+      raw.watchdog.enabled = false;
+      raw.gatewayPid = null;
+      fs.writeFileSync(BRIDGE_CONFIG_FILE, JSON.stringify(raw, null, 2), "utf8");
+    }
+    __name(disableBridgeWatchdog, "disableBridgeWatchdog");
     async function startWrapper({ port, runtimeDir, runtimeVersion, runtimeSource, bunPath }) {
+      ensureRuntimeBuiltinResources(runtimeDir);
       const hsNative = detectHolySheepAionUi(runtimeDir);
       log(`/login mode: ${hsNative ? "holysheep-native (apiKey)" : "legacy (username/password bridge)"}`);
       if (!hsNative) {
@@ -9475,6 +9673,7 @@ var require_aionui_wrapper = __commonJS({
         log("warn: CLI auto-config error (continuing): " + (e && e.message ? e.message : e));
       }
       const claudeProxyHandle = await ensureClaudeProcessProxyRunning();
+      ensureOpenClawBridgeRunning();
       const debug = process.env.HS_WEB_DEBUG === "1";
       const { PACKAGE_ROOT, cliVersion, ptyHermesWrapperPath } = require_paths();
       const cliRoot = PACKAGE_ROOT;
@@ -9581,7 +9780,7 @@ ${tail.split(/\r?\n/).map((ln) => `  ${ln}`).join("\n")}
       }
       log(`runtime ready (version=${runtimeVersion}, source=${runtimeSource})`);
       const ctx = { internalPort, runtimeDir, runtimeVersion, runtimeSource, bunPath };
-      const server = http.createServer(buildRouter(ctx));
+      const server = http2.createServer(buildRouter(ctx));
       server.on("upgrade", (req, socket, head) => {
         try {
           proxyWebSocket(req, socket, head, internalPort);
@@ -9620,9 +9819,17 @@ ${tail.split(/\r?\n/).map((ln) => `  ${ln}`).join("\n")}
       _tokens: bootstrapTokens,
       TOKEN_TTL_MS,
       BRIDGE_CRED_FILE,
+      ensureRuntimeAssistantResources,
+      ensureRuntimeSkillsResources,
+      ensureRuntimeBuiltinResources,
       // [HolySheep v2.1.43] Exported for aionui-wrapper-claude-proxy.test.js
       ensureClaudeProcessProxyRunning,
-      probeLocalPort
+      probeLocalPort,
+      // [HolySheep v2.1.51 / hs36] Exported for tests
+      ensureOpenClawBridgeRunning,
+      rewriteCspHeaders,
+      getOpenClawOrigins,
+      appendOriginsToDirective
     };
   }
 });
@@ -9635,7 +9842,6 @@ var require_webui = __commonJS({
     var { execSync, spawn } = require("child_process");
     var fs = require("fs");
     var path = require("path");
-    var http = require("http");
     var { scheduleUpgradeBannerCheck } = require_version_check();
     function isLegacy(opts) {
       return process.env.HOLYSHEEP_WEBUI_LEGACY === "1";
@@ -9742,59 +9948,16 @@ var require_webui = __commonJS({
       return null;
     }
     __name(readHolySheepApiKey, "readHolySheepApiKey");
-    function httpRequest(options, body) {
-      return new Promise((resolve, reject) => {
-        const req = http.request(options, (res) => {
-          const chunks = [];
-          res.on("data", (c) => chunks.push(c));
-          res.on("end", () => {
-            const buf = Buffer.concat(chunks);
-            resolve({ status: res.statusCode || 0, headers: res.headers, body: buf.toString("utf8") });
-          });
-        });
-        req.on("error", reject);
-        if (body) req.write(body);
-        req.end();
-      });
-    }
-    __name(httpRequest, "httpRequest");
-    async function fetchCsrfToken(port) {
-      const r = await httpRequest({ host: "127.0.0.1", port, path: "/", method: "GET" });
-      const setCookie = r.headers["set-cookie"] || [];
-      for (const sc of setCookie) {
-        const m = sc.match(/csrfToken=([^;]+);/);
-        if (m) return { csrfToken: m[1], allCookies: setCookie.map((s) => s.split(";")[0]).join("; ") };
-      }
-      return null;
+    function maskApiKey(apiKey) {
+      if (!apiKey || apiKey.length < 10) return "****";
+      return `${apiKey.slice(0, 6)}...${apiKey.slice(-4)}`;
     }
-    __name(fetchCsrfToken, "fetchCsrfToken");
-    async function loginWithApiKey(port, apiKey) {
-      const csrf = await fetchCsrfToken(port);
-      if (!csrf) throw new Error("Failed to acquire CSRF token from HolySheep runtime");
-      const body = JSON.stringify({ apiKey, csrfToken: decodeURIComponent(csrf.csrfToken) });
-      const r = await httpRequest(
-        {
-          host: "127.0.0.1",
-          port,
-          path: "/login",
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Content-Length": Buffer.byteLength(body),
-            Cookie: csrf.allCookies,
-            "x-csrf-token": decodeURIComponent(csrf.csrfToken)
-          }
-        },
-        body
-      );
-      if (r.status !== 200) {
-        throw new Error(`/login returned ${r.status}: ${r.body.slice(0, 200)}`);
-      }
-      const setCookie = r.headers["set-cookie"] || [];
-      const cookieLine = setCookie.map((s) => s.split(";")[0]).join("; ");
-      return { cookieLine, body: JSON.parse(r.body) };
+    __name(maskApiKey, "maskApiKey");
+    function maskToken(token) {
+      if (!token || token.length < 12) return "****";
+      return `${token.slice(0, 8)}...${token.slice(-6)}`;
     }
-    __name(loginWithApiKey, "loginWithApiKey");
+    __name(maskToken, "maskToken");
     var AIONUI_STARTUP_TIMEOUT_MS = Number(process.env.HS_WEB_STARTUP_TIMEOUT_MS) || 6e4;
     async function startAionUiMode(opts) {
       const port = Number(opts.port) || 9876;
@@ -9913,25 +10076,26 @@ var require_webui = __commonJS({
         return startLegacyMode(opts);
       }
       const baseUrl = `http://127.0.0.1:${port}`;
-      const internalPort = wrapper.internalPort;
       const apiKey = readHolySheepApiKey();
       let launchUrl = baseUrl;
+      let displayUrl = baseUrl;
       if (apiKey) {
         try {
-          const { cookieLine } = await loginWithApiKey(internalPort, apiKey);
-          if (cookieLine) {
-            launchUrl = `${baseUrl}/login#apiKey=${encodeURIComponent(apiKey)}`;
-            console.log(chalk2.green("\u2713 HolySheep API key detected \u2014 auto-filled on login page"));
-          }
+          const token = wrapper.mintBootstrapToken();
+          launchUrl = `${baseUrl}/api/auth/holysheep-bootstrap?token=${encodeURIComponent(token)}`;
+          displayUrl = `${baseUrl}/api/auth/holysheep-bootstrap?token=${encodeURIComponent(maskToken(token))}`;
+          console.log(chalk2.green(`\u2713 HolySheep API key detected (${maskApiKey(apiKey)}) \u2014 using one-time browser login link`));
         } catch (e) {
-          console.log(chalk2.yellow(`  (auto-login pre-check failed: ${e.message} \u2014 will open /login manually)`));
+          console.log(chalk2.yellow(`  (auto-login link creation failed: ${e.message} \u2014 will open /login manually)`));
           launchUrl = `${baseUrl}/login`;
+          displayUrl = launchUrl;
         }
       } else {
         launchUrl = `${baseUrl}/login`;
+        displayUrl = launchUrl;
         console.log(chalk2.yellow("  No HolySheep API key saved yet. Run `hs login` first to enable auto-fill."));
       }
-      console.log(chalk2.green(`\u2713 WebUI \u5DF2\u542F\u52A8: ${chalk2.cyan.bold(launchUrl)}`));
+      console.log(chalk2.green(`\u2713 WebUI \u5DF2\u542F\u52A8: ${chalk2.cyan.bold(displayUrl)}`));
       console.log(chalk2.gray("  Mode: HolySheep WebUI (HolySheep \u767B\u5F55)"));
       console.log(chalk2.gray("  Press Ctrl+C to stop"));
       console.log();

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@simonyea/holysheep-cli",
-  "version": "2.1.50",
+  "version": "2.1.52",
   "description": "Claude Code/Cursor/Cline API relay for China — ¥1=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
   "scripts": {
     "build": "node scripts/build.mjs",
-    "test": "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
+    "test": "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/aionui-wrapper-csp-rewrite.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
     "prepublishOnly": "npm run build && npm test && node scripts/check-tarball-size.js"
   },
   "keywords": [
@@ -62,6 +62,7 @@
     "dist/process-proxy-inject.js",
     "dist/index.html",
     "dist/pty-hermes-wrapper.py",
+    "dist/aionui-resources/assistant",
     "README.md",
     "LICENSE"
   ],