@wwkit/llmproxy 1.0.1

package/src/providers/codearts/auth.js

@@ -0,0 +1,325 @@
+// providers/codearts/auth.js — CodeArts OAuth 2.0 PKCE + DPoP 鉴权
+//
+// 流程：
+//   1. 生成 PKCE pair + DPoP ES256 密钥对
+//   2. 启动本地 HTTP 回调服务器
+//   3. 用系统浏览器打开登录页（手动完成）
+//   4. 浏览器重定向到回调，拿到 authorization code
+//   5. POST sts.cn-north-4.myhuaweicloud.com/v1/oauth2/tokens 换 AK/SK + securityToken + refresh_token
+//   6. 后续用 refresh_token 自动续期
+//
+// 凭证存储：~/.config/llmproxy/.creds.json 的 providers.codearts 子树。
+
+import crypto from "node:crypto"
+import http from "node:http"
+import fs from "node:fs"
+import path from "node:path"
+import process from "node:process"
+import { getXdgConfigDir } from "@wwkit/shared"
+import { status as cftStatus } from "@wwkit/cft"
+import { AuthProvider } from "../../core/auth.js"
+import { log } from "../../util.js"
+
+const CREDS_FILE = path.join(getXdgConfigDir("llmproxy"), ".creds.json")
+
+// 获取 Chrome 路径（优先用 @wwkit/cft 安装的 Chrome for Testing）
+function getChromePath() {
+  try {
+    const info = cftStatus()
+    if (info?.chrome_path && fs.existsSync(info.chrome_path)) {
+      return info.chrome_path
+    }
+  } catch {}
+  return null
+}
+
+const STS_HOST = "https://sts.cn-north-4.myhuaweicloud.com";
+const TOKEN_API = "/v1/oauth2/tokens";
+const PORTAL_HOST = "https://codearts.huaweicloud.com/portal";
+const IAM_LOGIN = "https://auth.huaweicloud.com/authui/login.html";
+const CLIENT_ID = "codearts-agent";
+const PLUGIN_NAME = "snap_AIIDE";
+const PLUGIN_VERSION = "5.3.0";
+const REFRESH_MARGIN_MS = 5 * 60 * 1000;
+
+export default class CodeartsAuth extends AuthProvider {
+  constructor(opts) {
+    super(opts);
+    this.account = opts.config.account || "";
+    this.password = opts.config.password || "";
+    this._cred = null;
+    this._loginContext = null;
+  }
+
+  async getCredentials(opts = {}) {
+    const autoLogin = opts.autoLogin !== false;
+    if (this._cred && Date.now() < this._cred.expiresAt - REFRESH_MARGIN_MS) {
+      return this._cred;
+    }
+    if (!this._cred) await this._loadFromFile();
+    if (this._cred && this._loginContext) {
+      try {
+        await this._refresh();
+        return this._cred;
+      } catch (e) {
+        log(`[auth:${this.id}] refresh 失败: ${e.message}，${autoLogin ? "重新登录" : "需重新 pnpm run login"}`);
+        if (!autoLogin) throw new Error(`auth:${this.id} refresh 失败: ${e.message}`);
+      }
+    }
+    if (!autoLogin) {
+      throw new Error(`auth:${this.id} 无凭证，请先执行 pnpm run login --provider ${this.id}`);
+    }
+    await this.login({ manual: true });
+    return this._cred;
+  }
+
+  async login(opts = {}) {
+    log(`[auth:${this.id}] 开始浏览器登录...`);
+
+    const pkcePair = this._generatePKCE();
+    const dpopKeyPair = await this._generateDPoPKeyPair();
+    this._loginContext = { pkcePair, dpopKeyPair };
+
+    const { port, codePromise, server } = await this._startCallbackServer();
+
+    const authorizeUrl = this._buildAuthorizeUrl(port, pkcePair);
+    const loginUrl = `${IAM_LOGIN}?service=${encodeURIComponent(authorizeUrl)}`;
+    log(`[auth:${this.id}] 登录 URL: ${loginUrl.slice(0, 100)}...`);
+
+    if (opts.manual !== false) {
+      const { execSync } = await import("node:child_process");
+      const chromePath = getChromePath();
+      if (chromePath) {
+        try { execSync(`"${chromePath}" "${loginUrl}"`); } catch {}
+        log(`[auth:${this.id}] 已打开 Chrome，请手动完成登录...`);
+} else {
+        const openCmd = process.platform === 'darwin' ? 'open' : 'xdg-open'
+        try { execSync(`${openCmd} "${loginUrl}"`) } catch {}
+        log(`[auth:${this.id}] 已打开浏览器，请手动完成登录...`)
+      }
+    } else {
+      throw new Error(`auth:${this.id} 当前仅支持手动登录`);
+    }
+
+    log(`[auth:${this.id}] 等待登录回调...`);
+    const code = await codePromise;
+    server.close();
+    log(`[auth:${this.id}] 收到 authorization code: ${code.slice(0, 12)}...`);
+
+    await this._exchangeCode(code, pkcePair, dpopKeyPair, port);
+    await this._saveToFile();
+    log(`[auth:${this.id}] 登录成功! AK=${mask(this._cred.accessKeyId)} expires=${new Date(this._cred.expiresAt).toISOString()}`);
+  }
+
+  _generatePKCE() {
+    const codeVerifier = crypto.randomBytes(64).toString("hex");
+    const sha256 = crypto.createHash("sha256").update(codeVerifier).digest("base64");
+    const codeChallenge = sha256.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    return { codeVerifier, codeChallenge, codeChallengeMethod: "SHA-256" };
+  }
+
+  async _generateDPoPKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const pubJwk = publicKey.export({ format: "jwk" });
+    const privJwk = privateKey.export({ format: "jwk" });
+    return { privateKeyJwk: privJwk, publicKeyJwk: pubJwk, privateKey, publicKey };
+  }
+
+  _signDPoP(dpopKeyPair, method, url) {
+    const payload = {
+      htm: method,
+      htu: url,
+      iat: Math.floor(Date.now() / 1000),
+      jti: crypto.randomBytes(32).toString("hex"),
+    };
+    const header = { alg: "ES256", typ: "dpop+jwt", jwk: dpopKeyPair.publicKeyJwk };
+    const headerB64 = base64url(JSON.stringify(header));
+    const payloadB64 = base64url(JSON.stringify(payload));
+    const data = `${headerB64}.${payloadB64}`;
+    const sign = crypto.createSign("SHA256");
+    sign.update(data);
+    const derSig = sign.sign(dpopKeyPair.privateKey);
+    const rawSig = derToRawRS(derSig);
+    return `${data}.${base64urlBuf(rawSig)}`;
+  }
+
+  _startCallbackServer() {
+    return new Promise((resolve) => {
+      let codeResolve;
+      const codePromise = new Promise((r) => { codeResolve = r; });
+      const server = http.createServer((req, res) => {
+        const url = new URL(req.url, "http://127.0.0.1");
+        if (url.pathname === "/oauth/callback") {
+          const code = url.searchParams.get("code");
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+          res.end("<html><body><h1>登录成功，可关闭此页面</h1></body></html>");
+          if (code) codeResolve(code);
+        } else {
+          res.writeHead(404);
+          res.end();
+        }
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const port = server.address().port;
+        log(`[auth:${this.id}] callback server listening on 127.0.0.1:${port}`);
+        resolve({ port, codePromise, server });
+      });
+    });
+  }
+
+  _buildAuthorizeUrl(port, pkcePair) {
+    const ticketId = crypto.randomBytes(16).toString("hex");
+    const params = new URLSearchParams({
+      theme: "Dark",
+      locale: "zh-cn",
+      uri_scheme: CLIENT_ID,
+      client_id: CLIENT_ID,
+      port: String(port),
+      code_challenge: pkcePair.codeChallenge,
+      code_challenge_method: pkcePair.codeChallengeMethod,
+      ticket_id: ticketId,
+      "plugin-name": PLUGIN_NAME,
+      "plugin-version": PLUGIN_VERSION,
+    });
+    return `${PORTAL_HOST}/authorize?${params.toString()}`;
+  }
+
+  async _exchangeCode(code, pkcePair, dpopKeyPair, port) {
+    const body = new URLSearchParams({
+      client_id: CLIENT_ID,
+      code,
+      code_verifier: pkcePair.codeVerifier,
+      grant_type: "authorization_code",
+      redirect_uri: `http://127.0.0.1:${port}/oauth/callback`,
+    });
+    await this._requestToken(body, dpopKeyPair);
+  }
+
+  async _refresh() {
+    if (!this._cred?.refreshToken || !this._loginContext) {
+      throw new Error("无 refresh_token 或 loginContext");
+    }
+    const body = new URLSearchParams({
+      client_id: CLIENT_ID,
+      code_verifier: this._loginContext.pkcePair.codeVerifier,
+      grant_type: "refresh_token",
+      refresh_token: this._cred.refreshToken,
+    });
+    await this._requestToken(body, this._loginContext.dpopKeyPair);
+    await this._saveToFile();
+    log(`[auth:${this.id}] 续期成功 AK=${mask(this._cred.accessKeyId)} expires=${new Date(this._cred.expiresAt).toISOString()}`);
+  }
+
+  async _requestToken(body, dpopKeyPair) {
+    const url = `${STS_HOST}${TOKEN_API}`;
+    const dpop = this._signDPoP(dpopKeyPair, "POST", url);
+    log(`[auth:${this.id}] 请求 STS token: ${url} (DPoP 头长度=${dpop.length})`);
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "DPoP": dpop,
+      },
+      body: body.toString(),
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(`auth:${this.id} STS token 请求失败 ${res.status}: ${text}`);
+    }
+    const data = await res.json();
+    const c = data.credentials || {};
+    this._cred = {
+      accessKeyId: c.access_key_id,
+      secretAccessKey: c.secret_access_key,
+      securityToken: c.security_token,
+      expiresAt: c.expiration ? Date.parse(c.expiration) : Date.now() + 3600_000,
+      refreshToken: data.refresh_token || this._cred?.refreshToken || "",
+      domainId: data.domain_id || this._cred?.domainId || "",
+      userId: data.user_id || "",
+      userName: data.user_name || "",
+    };
+    if (!this._cred.accessKeyId || !this._cred.secretAccessKey) {
+      throw new Error(`auth:${this.id} token 响应缺少 access_key_id/secret_access_key`);
+    }
+  }
+
+  async _saveToFile() {
+    let all = {};
+    if (fs.existsSync(CREDS_FILE)) {
+      try { all = JSON.parse(fs.readFileSync(CREDS_FILE, "utf8")); } catch {}
+    }
+    if (!all.providers) all.providers = {};
+    all.providers[this.id] = {
+      accessKeyId: this._cred.accessKeyId,
+      secretAccessKey: this._cred.secretAccessKey,
+      securityToken: this._cred.securityToken,
+      expiresAt: this._cred.expiresAt,
+      refreshToken: this._cred.refreshToken,
+      domainId: this._cred.domainId,
+      loginContext: this._loginContext,
+    };
+    fs.writeFileSync(CREDS_FILE, JSON.stringify(all, null, 2), { mode: 0o600 });
+  }
+
+  async _loadFromFile() {
+    if (!fs.existsSync(CREDS_FILE)) return;
+    try {
+      const all = JSON.parse(fs.readFileSync(CREDS_FILE, "utf8"));
+      const data = all.providers?.[this.id];
+      if (!data) return;
+      this._cred = {
+        accessKeyId: data.accessKeyId,
+        secretAccessKey: data.secretAccessKey,
+        securityToken: data.securityToken,
+        expiresAt: data.expiresAt,
+        refreshToken: data.refreshToken,
+        domainId: data.domainId,
+      };
+      if (data.loginContext?.dpopKeyPair?.privateKeyJwk) {
+        const privateKey = crypto.createPrivateKey({ key: data.loginContext.dpopKeyPair.privateKeyJwk, format: "jwk" });
+        const publicKey = crypto.createPublicKey({ key: data.loginContext.dpopKeyPair.publicKeyJwk, format: "jwk" });
+        this._loginContext = {
+          pkcePair: data.loginContext.pkcePair,
+          dpopKeyPair: { ...data.loginContext.dpopKeyPair, privateKey, publicKey },
+        };
+      } else {
+        this._loginContext = data.loginContext || null;
+      }
+      log(`[auth:${this.id}] 从 .creds.json 加载凭证 AK=${mask(this._cred.accessKeyId)} expires=${new Date(this._cred.expiresAt).toISOString()}`);
+    } catch (e) {
+      log(`[auth:${this.id}] 加载 .creds.json 失败: ${e.message}`);
+    }
+  }
+}
+
+function base64url(s) {
+  return Buffer.from(s, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64urlBuf(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function derToRawRS(der) {
+  const buf = Buffer.from(der);
+  let idx = 0;
+  if (buf[idx++] !== 0x30) throw new Error("invalid DER: expected SEQUENCE");
+  idx++;
+  if (buf[idx++] !== 0x02) throw new Error("invalid DER: expected INTEGER for R");
+  const rLen = buf[idx++];
+  const r = buf.slice(idx, idx + rLen);
+  idx += rLen;
+  if (buf[idx++] !== 0x02) throw new Error("invalid DER: expected INTEGER for S");
+  const sLen = buf[idx++];
+  const s = buf.slice(idx, idx + sLen);
+  const rFixed = fixLen(r, 32);
+  const sFixed = fixLen(s, 32);
+  return Buffer.concat([rFixed, sFixed]);
+}
+function fixLen(buf, len) {
+  if (buf.length === len) return buf;
+  if (buf.length > len) return buf.slice(buf.length - len);
+  return Buffer.concat([Buffer.alloc(len - buf.length), buf]);
+}
+function mask(s) {
+  if (!s || s.length < 6) return "****";
+  return s.slice(0, 2) + "****" + s.slice(-3);
+}

package/src/providers/codearts/client.js

@@ -0,0 +1,64 @@
+// providers/codearts/client.js — CodeArts 推理客户端
+//
+// 封装：auth 拿凭证 + sign 签名 + fetch 发请求
+// 上游 host / path 从 sign config 读
+// undici Agent 关闭 keep-alive 避免上游会话池占用
+
+import { Agent, fetch } from "undici";
+
+const upstreamAgent = new Agent({
+  connections: 1,
+  keepAliveTimeout: 100,
+  keepAliveMaxTimeout: 100,
+  pipelining: 0,
+});
+
+export default class CodeartsClient {
+  constructor({ id, signProvider, authProvider, host, basePath }) {
+    this.id = id;
+    this.signProvider = signProvider;
+    this.authProvider = authProvider;
+    this.host = host;
+    this.basePath = basePath;
+  }
+
+  /**
+   * POST /chat/completions
+   * @param {object} body     OpenAI 风格请求体
+   * @param {object} [opts]   { headers?, signal? }
+   * @returns {Promise<Response>}
+   */
+  async chatCompletions(body, opts = {}) {
+    const url = `https://${this.host}${this.basePath}/chat/completions`;
+    const bodyStr = JSON.stringify(body);
+    // chat 路径上不允许自动登录（避免阻塞请求路径）——凭证缺失直接抛错
+    const cred = await this.authProvider.getCredentials({ autoLogin: false });
+
+    const headers = {
+      "Content-Type": "application/json",
+      "Host": this.host,
+      ...opts.headers,
+    };
+    if (cred.securityToken) {
+      headers["X-Security-Token"] = cred.securityToken;
+    }
+
+    const signHeaders = this.signProvider.sign({
+      method: "POST",
+      url,
+      headers,
+      bodyStr,
+      accessKeyId: cred.accessKeyId,
+      secretAccessKey: cred.secretAccessKey,
+    });
+    Object.assign(headers, signHeaders);
+
+    return await fetch(url, {
+      method: "POST",
+      headers,
+      body: bodyStr,
+      signal: opts.signal || undefined,
+      dispatcher: upstreamAgent,
+    });
+  }
+}

package/src/providers/codearts/config.js

@@ -0,0 +1,8 @@
+// providers/codearts/config.js — CodeArts provider 固定配置
+//
+// 每日额度模型：请求会自动附加 maas_type: benefit（消耗每日 10M free compute）
+export const BENEFIT_MODELS = [
+  "glm-5.3-flash",
+  "deepseek-v4-flash-0731",
+  "deepseek-v4-pro-0813",
+]

package/src/providers/codearts/error.js

@@ -0,0 +1,17 @@
+// providers/codearts/error.js — CodeArts / snap-access 错误模式识别
+//
+// sessionLimit:  body 含 "TM.00001041" 即并发会话超限
+
+import { ErrorPatterns } from "../../core/error.js";
+
+// 错误模式配置（固定值，无需用户配置）
+export const ERROR_CONFIG = {
+  sessionLimit: "TM.00001041",
+};
+
+export default class CodeartsError extends ErrorPatterns {
+  isSessionLimit(_status, bodyText) {
+    const marker = this.config.sessionLimit || ERROR_CONFIG.sessionLimit;
+    return Boolean(bodyText && bodyText.includes(marker));
+  }
+}

package/src/providers/codearts/sign.js

@@ -0,0 +1,75 @@
+// providers/codearts/sign.js — 华为云 SDK-HMAC-SHA256 签名
+//
+// 对每个 chat 请求做签名（AK + body hash + canonical request），
+// 返回 { Authorization, X-Sdk-Date } 头。
+
+import crypto from "node:crypto";
+import { SignProvider } from "../../core/sign.js";
+
+// 签名配置（固定值，无需用户配置）
+export const SIGN_CONFIG = {
+  host: "snap-access.cn-north-4.myhuaweicloud.com",
+  basePath: "/api/v2",
+};
+
+export default class CodeartsSign extends SignProvider {
+  /**
+   * @param {object} req  { method, url, headers, bodyStr }
+   * @returns {object}    { Authorization, X-Sdk-Date }
+   */
+  sign(req) {
+    const u = new URL(req.url);
+    const sdkDate = formatSdkDate(new Date());
+    const bodyHash = crypto.createHash("sha256").update(req.bodyStr || "").digest("hex");
+
+    const reqHeaders = { ...req.headers };
+    reqHeaders["host"] = u.host;
+    reqHeaders["x-sdk-date"] = sdkDate;
+
+    const headerLower = {};
+    for (const [k, v] of Object.entries(reqHeaders)) {
+      headerLower[k.toLowerCase()] = String(v).trim();
+    }
+    headerLower["host"] = u.host;
+    headerLower["x-sdk-date"] = sdkDate;
+
+    const signedHeaderKeys = Object.keys(headerLower).sort();
+    const signedHeadersStr = signedHeaderKeys.join(";");
+    const canonicalHeaders = signedHeaderKeys.map(k => `${k}:${headerLower[k]}\n`).join("");
+    const canonicalUri = u.pathname.endsWith("/") ? u.pathname : u.pathname + "/";
+
+    const queryParams = {};
+    u.searchParams.forEach((v, k) => { queryParams[k] = v; });
+    const canonicalQueryString = Object.keys(queryParams).sort()
+      .map(k => `${encodeURIComponent(k)}=${encodeURIComponent(queryParams[k])}`)
+      .join("&");
+
+    const canonicalRequest = [
+      req.method.toUpperCase(),
+      canonicalUri,
+      canonicalQueryString,
+      canonicalHeaders,
+      signedHeadersStr,
+      bodyHash,
+    ].join("\n");
+
+    const canonicalRequestHash = crypto.createHash("sha256").update(canonicalRequest).digest("hex");
+    const stringToSign = [
+      "SDK-HMAC-SHA256",
+      sdkDate,
+      canonicalRequestHash,
+    ].join("\n");
+
+    const secretAccessKey = req.secretAccessKey;
+    const accessKeyId = req.accessKeyId;
+    const signature = crypto.createHmac("sha256", secretAccessKey).update(stringToSign).digest("hex");
+    const authorization = `SDK-HMAC-SHA256 Access=${accessKeyId}, SignedHeaders=${signedHeadersStr}, Signature=${signature}`;
+
+    return { Authorization: authorization, "X-Sdk-Date": sdkDate };
+  }
+}
+
+function formatSdkDate(d) {
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`;
+}