@waterplus-ai/waterbuddy 0.1.17 → 0.1.34

package/lib/host/index.js

@@ -3,19 +3,59 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { WATERPLUS_PERSONA } from '../shared/persona.js'
+import { bindLlmCredential, describeLlmCredential, ensureLlmCredential, isGatewayActive, readActiveProvider, refreshLlmQuota, restoreDeviceLlmCredential, switchDefaultProviderWithRetry } from './llm-gateway.js'
 
 const WATERPLUS_ICON = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=', 'base64')
 const CLIENT_ID = '2CC7F925-07AE-4AB9-9F17-75B7378D5890'
 const PLATFORM_URL = 'https://web.shuiwujia.com'
 const AI_URL = 'https://ai.shuiwujia.com'
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+const VERIFY_CODE_PATTERN = /^\d{4,6}$/
 const sessions = new Map()
-const authFile = path.join(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), 'waterbuddy-auth.json')
 let persistedAuth
 let currentUser
+let upstreamTransport
+let llmStatus
+let llmLoginHook
+let llmLogoutHook
+
+/**
+ * Test seam only. Production always uses `https.request`; regression tests install a
+ * scripted transport so the platform contract can be asserted without network access.
+ */
+function setUpstreamTransport(transport) {
+  upstreamTransport = transport
+}
+
+/**
+ * 给「登录后换 key」这类收尾动作加一个上限。
+ *
+ * 它不该让登录失败，但也不该无限拖住登录响应——客户端拿到登录成功的那一刻
+ * 就该显示账号档余额，所以这里等一小段而不是纯后台跑。
+ */
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`${label}-timeout`)), ms)
+    promise.then(
+      value => { clearTimeout(timer); resolve(value) },
+      error => { clearTimeout(timer); reject(error) },
+    )
+  })
+}
+
+const LLM_SWAP_TIMEOUT_MS = 5000
+
+function dshHome() {
+  return process.env.DSH_HOME || path.join(os.homedir(), '.dsh')
+}
+
+function authFile() {
+  return path.join(dshHome(), 'waterbuddy-auth.json')
+}
 
 function readPersistedAuth() {
   try {
-    const value = JSON.parse(fs.readFileSync(authFile, 'utf8'))
+    const value = JSON.parse(fs.readFileSync(authFile(), 'utf8'))
     if (value?.token && value?.user) {
       currentUser = normalizeUser(value.user)
       persistedAuth = { ...value, user: currentUser }
@@ -25,9 +65,10 @@ function readPersistedAuth() {
 
 function savePersistedAuth(auth) {
   try {
-    fs.mkdirSync(path.dirname(authFile), { recursive: true })
-    fs.writeFileSync(authFile, JSON.stringify(auth), { mode: 0o600 })
-    try { fs.chmodSync(authFile, 0o600) } catch {}
+    const file = authFile()
+    fs.mkdirSync(path.dirname(file), { recursive: true })
+    fs.writeFileSync(file, JSON.stringify(auth), { mode: 0o600 })
+    try { fs.chmodSync(file, 0o600) } catch {}
   } catch (error) {
     console.warn('[WaterBuddy] failed to persist login:', error.message)
   }
@@ -35,7 +76,7 @@ function savePersistedAuth(auth) {
 
 function clearPersistedAuth() {
   persistedAuth = undefined
-  try { fs.rmSync(authFile, { force: true }) } catch {}
+  try { fs.rmSync(authFile(), { force: true }) } catch {}
 }
 
 function isSupportedAvatarUrl(url) {
@@ -79,17 +120,23 @@ function queryUrl(path, params) {
   return url.href
 }
 
-function cookieHeader(response) {
-  if (typeof response.headers.getSetCookie !== 'function') return ''
-  return response.headers.getSetCookie().map(value => value.split(';', 1)[0]).join('; ')
+function aiUrl(path, params) {
+  const url = new URL(path, AI_URL)
+  for (const [key, value] of Object.entries(params || {})) url.searchParams.set(key, value)
+  return url.href
+}
+
+function joinCookies(...values) {
+  return values.filter(Boolean).join('; ')
 }
 
 async function requestJson(url, options = {}) {
   const parsed = new URL(url)
   const headers = { plaform: 'PC', ...(options.headers || {}) }
   const body = options.body
+  const send = options.request || upstreamTransport || https.request
   return await new Promise((resolve, reject) => {
-    const request = https.request(parsed, { method: options.method || 'GET', headers, insecureHTTPParser: true }, response => {
+    const request = send(parsed, { method: options.method || 'GET', headers, insecureHTTPParser: true }, response => {
       const chunks = []
       response.on('data', chunk => chunks.push(chunk))
       response.on('end', () => {
@@ -106,13 +153,145 @@ async function requestJson(url, options = {}) {
   })
 }
 
+function postAiJson(path, payload, options = {}) {
+  return requestJson(aiUrl(path, options.query), {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...(options.headers || {}) },
+    body: JSON.stringify(payload),
+  })
+}
+
+function extractToken(result) {
+  if (typeof result === 'string') return result
+  if (!result || typeof result !== 'object') return ''
+  for (const key of ['token', 'accessToken', 'access_token']) {
+    if (typeof result[key] === 'string' && result[key]) return result[key]
+  }
+  return ''
+}
+
+async function fetchUserInfo(token) {
+  const profile = await requestJson(aiUrl('/swj-waterplusai-api/client/user/info'), { headers: { Authorization: `Bearer ${token}` } })
+  return normalizeUser(profile.body.result)
+}
+
+async function finalizeLogin(token) {
+  if (!token) throw new AuthUpstreamError('登录凭证无效')
+  const user = await fetchUserInfo(token)
+  currentUser = user
+  persistedAuth = { token, user }
+  savePersistedAuth(persistedAuth)
+  // 登录即换账号档 key（额度升档）。**等它完成再返回**：客户端拿到登录成功就会
+  // 立刻查余额，若此时 key 还没换，读到的还是设备档（实测会显示 $0.00 且误判耗尽）。
+  // best-effort 不变——失败或超时只告警，绝不让登录失败。
+  if (llmLoginHook) {
+    try {
+      await withTimeout(Promise.resolve().then(() => llmLoginHook(token)), LLM_SWAP_TIMEOUT_MS, 'llm-bind')
+    } catch (error) {
+      console.warn('[WaterBuddy] llm bind after login failed:', error.message)
+    }
+  }
+  return { token, user }
+}
+
+/** A rejected local payload: a retry cannot succeed, so the route answers 400. */
+class InvalidAuthRequest extends Error {}
+
+/** A failed upstream call: the platform may recover, so the route answers 502. */
+class AuthUpstreamError extends Error {}
+
+function requireString(value, message) {
+  const text = typeof value === 'string' ? value.trim() : ''
+  if (!text) throw new InvalidAuthRequest(message)
+  return text
+}
+
+function isLocalValidation(error) {
+  return error instanceof InvalidAuthRequest
+}
+
+async function accountLogin(body) {
+  const loginId = requireString(body.loginId, '请输入账号')
+  const password = requireString(body.password, '请输入密码')
+  const response = await requestJson(aiUrl('/swj-waterplusai-api/client/user/login'), {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ loginId, password }),
+  })
+  const { user } = await finalizeLogin(extractToken(response.body.result))
+  return { status: 'SUCCESS', user }
+}
+
+async function sendRegisterCode(body) {
+  const email = requireString(body.email, '请输入邮箱')
+  if (!EMAIL_PATTERN.test(email)) throw new InvalidAuthRequest('邮箱格式不正确')
+  const response = await postAiJson('/swj-waterplusai-api/client/user/register/code', { email })
+  return { ok: true, message: response.body.message || '验证码已发送' }
+}
+
+async function registerAccount(body) {
+  const email = requireString(body.email, '请输入邮箱')
+  if (!EMAIL_PATTERN.test(email)) throw new InvalidAuthRequest('邮箱格式不正确')
+  const verifyCode = requireString(body.verifyCode, '请输入验证码')
+  if (!VERIFY_CODE_PATTERN.test(verifyCode)) throw new InvalidAuthRequest('验证码格式不正确')
+  const password = requireString(body.password, '请输入密码')
+  const name = typeof body.name === 'string' ? body.name.trim() : ''
+  const payload = { email, verifyCode, password, ...(name ? { name } : {}) }
+  const response = await postAiJson('/swj-waterplusai-api/client/user/register', payload)
+  const { user } = await finalizeLogin(extractToken(response.body.result))
+  return { status: 'SUCCESS', user, message: response.body.message || '注册成功' }
+}
+
+async function sendPasswordCode(body) {
+  const email = requireString(body.email, '请输入邮箱')
+  if (!EMAIL_PATTERN.test(email)) throw new InvalidAuthRequest('邮箱格式不正确')
+  const response = await postAiJson('/swj-waterplusai-api/client/user/password/code', { email })
+  return { ok: true, message: response.body.message || '验证码已发送' }
+}
+
+async function changePassword(body) {
+  const email = requireString(body.email, '请输入邮箱')
+  if (!EMAIL_PATTERN.test(email)) throw new InvalidAuthRequest('邮箱格式不正确')
+  const verifyCode = requireString(body.verifyCode, '请输入验证码')
+  if (!VERIFY_CODE_PATTERN.test(verifyCode)) throw new InvalidAuthRequest('验证码格式不正确')
+  const password = requireString(body.password, '请输入密码')
+  const response = await postAiJson('/swj-waterplusai-api/client/user/password/change', { email, verifyCode, password })
+  return { ok: true, message: response.body.message || '密码修改成功' }
+}
+
+function readJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    req.on('data', chunk => chunks.push(chunk))
+    req.on('end', () => {
+      const text = Buffer.concat(chunks).toString('utf8').trim()
+      if (!text) return resolve({})
+      try {
+        const parsed = JSON.parse(text)
+        resolve(parsed && typeof parsed === 'object' ? parsed : {})
+      } catch { reject(new InvalidAuthRequest('请求参数格式不正确')) }
+    })
+    req.on('error', reject)
+  })
+}
+
+async function handleAuthAction(req, res, action) {
+  if (req.method !== 'POST') return json(res, 405, { error: 'method-not-allowed' })
+  try {
+    const body = await readJsonBody(req)
+    json(res, 200, await action(body))
+  } catch (error) {
+    json(res, isLocalValidation(error) ? 400 : 502, { error: error.message })
+  }
+}
+
 async function createLogin() {
   const login = await requestJson(queryUrl('/swj-platform-api/waterplusUser/login', { orgId: CLIENT_ID }))
   const scene = login.body.result?.scene
   if (!scene) throw new Error('登录场景创建失败')
   const qr = await requestJson(`${PLATFORM_URL}/swj-platform-api/platformWxappUser/getQRCode`, { method: 'POST', headers: { 'content-type': 'application/json', ...(login.cookie ? { cookie: login.cookie } : {}) }, body: JSON.stringify({ page: 'main/home/index', scene, check_path: true, env_version: 'release' }) })
   const sessionId = crypto.randomUUID()
-  sessions.set(sessionId, { scene, cookie: [login.cookie, qr.cookie].filter(Boolean).join('; '), createdAt: Date.now() })
+  sessions.set(sessionId, { scene, cookie: joinCookies(login.cookie, qr.cookie), createdAt: Date.now() })
   const encoded = String(qr.body.result)
   return { sessionId, qrCode: `data:${encoded.startsWith('/9j/') ? 'image/jpeg' : 'image/png'};base64,${encoded}`, status: 'WAITING' }
 }
@@ -121,19 +300,15 @@ async function pollLogin(session) {
   if (Date.now() - session.createdAt > 5 * 60_000) return { status: 'EXPIRED' }
   const statusResponse = await requestJson(queryUrl('/swj-platform-api/platformWxappUser/findRegisterStatus', { scene: session.scene }), { headers: session.cookie ? { cookie: session.cookie } : {} })
   const status = statusResponse.body.result || 'WAITING'
-  session.cookie = [session.cookie, statusResponse.cookie].filter(Boolean).join('; ')
+  session.cookie = joinCookies(session.cookie, statusResponse.cookie)
   if (status !== 'SUCCESS') return { status }
   if (session.user) return { status: 'SUCCESS', user: session.user }
   const auth = await requestJson(queryUrl('/swj-platform-api/platformUser/authAI', { clientId: CLIENT_ID }), { headers: session.cookie ? { cookie: session.cookie } : {} })
   const validated = await requestJson(`${AI_URL}/swj-waterplusai-api/client/user/sso/validate?authInfo=${encodeURIComponent(String(auth.body.result).replace(/ /g, '+'))}&clientId=${CLIENT_ID}`)
-  const token = validated.body.result
-  const profile = await requestJson(`${AI_URL}/swj-waterplusai-api/client/user/info`, { headers: { Authorization: `Bearer ${token}` } })
+  const { token, user } = await finalizeLogin(extractToken(validated.body.result))
   session.token = token
-  session.user = normalizeUser(profile.body.result)
-  currentUser = session.user
-  persistedAuth = { token, user: currentUser }
-  savePersistedAuth(persistedAuth)
-  return { status: 'SUCCESS', user: currentUser }
+  session.user = user
+  return { status: 'SUCCESS', user }
 }
 
 async function proxyMcp(req, res) {
@@ -163,10 +338,31 @@ async function proxyAvatar(req, res) {
   res.end()
 }
 
-export const inject = ['webServer', 'systemPrompt']
-export { normalizeAvatar }
+/**
+ * 领取设备凭证并写入 harness 凭据存储，再把默认提供方指向 waterplus-ai。
+ *
+ * 全流程尽力而为：网关不可达时插件其余功能照常，只是模型不可用。
+ */
+export async function bootstrapLlmCredential(ctx, config) {
+  try {
+    const { deviceId, credential } = await ensureLlmCredential(ctx, { config })
+    llmStatus = describeLlmCredential(credential, deviceId)
+    try {
+      await switchDefaultProviderWithRetry(ctx)
+    } catch (error) {
+      console.warn('[WaterBuddy] default provider not switched:', error.message)
+    }
+  } catch (error) {
+    console.warn('[WaterBuddy] LLM credential bootstrap failed:', error.message)
+    llmStatus = { ...(llmStatus || {}), error: error.message }
+  }
+  return llmStatus || null
+}
+
+export const inject = ['webServer', 'systemPrompt', 'credentials', 'settings']
+export { normalizeAvatar, setUpstreamTransport }
 
-export function apply(ctx) {
+export function apply(ctx, config) {
   readPersistedAuth()
   ctx.effect(() => {
     const routes = [
@@ -174,14 +370,45 @@ export function apply(ctx) {
       { kind: 'exact', path: '/manifest.webmanifest', handler: (_req, res) => { res.writeHead(200, { 'content-type': 'application/manifest+json; charset=utf-8', 'cache-control': 'public, max-age=3600' }); res.end(MANIFEST) } },
       { kind: 'exact', path: '/api/waterbuddy/auth/qr', handler: async (req, res) => { if (req.method !== 'POST') return json(res, 405, { error: 'method-not-allowed' }); try { json(res, 200, await createLogin()) } catch (error) { json(res, 502, { error: error.message }) } } },
       { kind: 'exact', path: '/api/waterbuddy/auth/status', handler: async (req, res) => { if (req.method !== 'GET') return json(res, 405, { error: 'method-not-allowed' }); const sessionId = new URL(req.url, 'http://127.0.0.1').searchParams.get('sessionId'); const session = sessionId && sessions.get(sessionId); if (!session) return json(res, 404, { error: 'session-not-found' }); try { json(res, 200, await pollLogin(session)) } catch (error) { json(res, 502, { error: error.message }) } } },
+      { kind: 'exact', path: '/api/waterbuddy/auth/login', handler: (req, res) => handleAuthAction(req, res, accountLogin) },
+      { kind: 'exact', path: '/api/waterbuddy/auth/register/code', handler: (req, res) => handleAuthAction(req, res, sendRegisterCode) },
+      { kind: 'exact', path: '/api/waterbuddy/auth/register', handler: (req, res) => handleAuthAction(req, res, registerAccount) },
+      { kind: 'exact', path: '/api/waterbuddy/auth/password/code', handler: (req, res) => handleAuthAction(req, res, sendPasswordCode) },
+      { kind: 'exact', path: '/api/waterbuddy/auth/password/change', handler: (req, res) => handleAuthAction(req, res, changePassword) },
       { kind: 'exact', path: '/api/waterbuddy/user', handler: (_req, res) => json(res, 200, { user: currentUser || null }) },
       { kind: 'exact', path: '/api/waterbuddy/avatar', handler: async (req, res) => { try { await proxyAvatar(req, res) } catch (error) { json(res, 502, { error: error.message }) } } },
-      { kind: 'exact', path: '/api/waterbuddy/logout', handler: (_req, res) => { currentUser = undefined; for (const session of sessions.values()) delete session.token; clearPersistedAuth(); json(res, 200, { ok: true }) } },
+      { kind: 'exact', path: '/api/waterbuddy/llm/status', handler: async (_req, res) => {
+        try {
+          const token = persistedAuth?.token
+          const { quota } = await refreshLlmQuota({ config, token })
+          if (quota) {
+            // 余额是权威读数，每次刷新都覆盖；subjectType 跟随当前是否登录。
+            llmStatus = { ...(llmStatus || {}), ...quota, subjectType: token ? 'user' : 'device', isAnonymous: !token }
+          }
+        } catch (error) {
+          // 额度查询失败沿用上次读数，不打扰用户
+        }
+        // 用别人的模型时额度不归我们管，客户端据此隐藏额度展示。
+        const activeProvider = readActiveProvider(ctx)
+        json(res, 200, {
+          llm: llmStatus
+            ? { ...llmStatus, activeProvider, managesQuota: isGatewayActive(ctx) }
+            : { activeProvider, managesQuota: isGatewayActive(ctx) },
+        })
+      } },
+      { kind: 'exact', path: '/api/waterbuddy/llm/refresh', handler: async (req, res) => { if (req.method !== 'POST') return json(res, 405, { error: 'method-not-allowed' }); try { json(res, 200, { llm: await bootstrapLlmCredential(ctx, config) }) } catch (error) { json(res, 502, { error: error.message }) } } },
+      { kind: 'exact', path: '/api/waterbuddy/logout', handler: async (_req, res) => { currentUser = undefined; for (const session of sessions.values()) delete session.token; clearPersistedAuth(); if (llmLogoutHook) { try { await withTimeout(Promise.resolve().then(() => llmLogoutHook()), LLM_SWAP_TIMEOUT_MS, 'llm-unbind') } catch (error) { console.warn('[WaterBuddy] llm restore after logout failed:', error.message) } } json(res, 200, { ok: true }) } },
       { kind: 'prefix', path: '/api/waterbuddy/mcp', handler: async (req, res) => { try { await proxyMcp(req, res) } catch (error) { json(res, 502, { error: error.message }) } } },
     ]
     const disposers = routes.map(route => ctx.webServer.register(route))
     const disposeTitle = ctx.webServer.tapIndex(html => html.replace(/<title>[^<]*<\/title>/i, '<title>WaterBuddy</title>').replace(/<link[^>]+rel=["']icon["'][^>]*>/i, '<link rel="icon" type="image/png" href="/waterplus-mark.png" />'))
     const disposePersona = ctx.systemPrompt.section({ name: 'waterplus:persona', order: 100, text: WATERPLUS_PERSONA })
+    // 尽力而为：宿主没有 credentials 服务（例如测试替身）时直接跳过，不发网络请求。
+    if (ctx.credentials?.set) {
+      llmLoginHook = token => bindLlmCredential(ctx, token, { config })
+      llmLogoutHook = () => restoreDeviceLlmCredential(ctx, { config })
+      void bootstrapLlmCredential(ctx, config)
+    }
     return () => { for (const dispose of disposers) dispose(); disposeTitle(); disposePersona(); sessions.clear(); currentUser = undefined; persistedAuth = undefined }
   }, 'waterbuddy: identity and auth')
 }