abelworkflow 1.1.0 → 1.1.1

package/extensions/pi-gpt-responses-compat/index.ts

@@ -1,23 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { createNodeInsecureDispatcher, installProviderTlsFetch } from "./tls-fetch.mjs";
-
-let nodeInsecureDispatcher: unknown;
-
-function getNodeInsecureDispatcher() {
-  if (nodeInsecureDispatcher) return nodeInsecureDispatcher;
-  nodeInsecureDispatcher = createNodeInsecureDispatcher();
-  return nodeInsecureDispatcher;
-}
 
 export default function (pi: ExtensionAPI) {
-  if (typeof globalThis.fetch === "function") {
-    const runtime = typeof (globalThis as any).Bun === "undefined" ? "node" : "bun";
-    installProviderTlsFetch({
-      runtime,
-      insecureDispatcher: runtime === "node" ? getNodeInsecureDispatcher : undefined
-    });
-  }
-
   pi.on("before_provider_request", (event, ctx) => {
     const payload = event.payload as any;
     if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;

package/lib/providers/claude.mjs

@@ -62,23 +62,12 @@ function mergeClaudeSettingsWithDefaults(settings) {
   };
 }
 
-function applyClaudeInsecureTlsSetting(env = {}, enabled = false) {
-  const nextEnv = { ...env };
-  if (enabled) {
-    nextEnv.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  } else if (nextEnv.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
-    delete nextEnv.NODE_TLS_REJECT_UNAUTHORIZED;
-  }
-  return nextEnv;
-}
-
 function getExistingClaudeApiConfig(settings) {
   const env = mergeClaudeSettingsWithDefaults(settings).env;
   return {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
     key: env.ANTHROPIC_API_KEY || "",
-    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || "",
-    insecureTls: env.NODE_TLS_REJECT_UNAUTHORIZED === "0"
+    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || ""
   };
 }
 
@@ -109,14 +98,9 @@ function ensureApprovedClaudeApiKey(config, apiKey) {
 function buildClaudeApiSettings(settings, {
   baseUrl,
   key,
-  model,
-  insecureTls = false
+  model
 }) {
   const nextSettings = mergeClaudeSettingsWithDefaults(settings);
-  nextSettings.env = applyClaudeInsecureTlsSetting(
-    nextSettings.env && typeof nextSettings.env === "object" ? nextSettings.env : {},
-    insecureTls
-  );
   nextSettings.env.ANTHROPIC_BASE_URL = baseUrl;
   nextSettings.env.ANTHROPIC_API_KEY = key;
   delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
@@ -134,7 +118,6 @@ async function persistClaudeConfiguration(paths, { settings, metaConfig }) {
 async function configureClaudeApi(paths = defaultPaths, promptApi) {
   const {
     assertNotCancelled,
-    confirmOrCancel,
     passwordPromptOptions,
     required,
     requiredUnlessExisting,
@@ -158,11 +141,6 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   assertNotCancelled(key);
   const finalKey = resolvePasswordValue(key, existing.key);
 
-  const insecureTls = await confirmOrCancel({
-    message: "是否跳过 Claude Code TLS 证书校验？仅证书无法修复时启用（会放宽该进程全部 HTTPS 请求）",
-    initialValue: existing.insecureTls
-  });
-
   const model = await p.text({
     message: "Claude Code 模型",
     initialValue: existing.model || undefined,
@@ -173,8 +151,7 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   const apiSettings = buildClaudeApiSettings(settings, {
     baseUrl,
     key: finalKey,
-    model,
-    insecureTls
+    model
   });
   const metaConfig = await readJsonFileSafe(paths.claudeMetaConfigPath, {}, { sensitive: true });
   metaConfig.hasCompletedOnboarding = true;
@@ -188,7 +165,6 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
 }
 
 export {
-  applyClaudeInsecureTlsSetting,
   buildClaudeApiSettings,
   buildDefaultClaudeSettings,
   configureClaudeApi,

package/lib/providers/pi.mjs

@@ -1,7 +1,6 @@
 import { spawn, spawnSync } from "node:child_process";
 import { join } from "node:path";
 import * as p from "@clack/prompts";
-import { piInsecureTlsHeader } from "../../extensions/pi-gpt-responses-compat/tls-fetch.mjs";
 import {
   readJsonFileSafe,
   readJsoncFileSafe,
@@ -310,36 +309,17 @@ function buildPiModelConfig(modelId, existingModel = {}) {
   };
 }
 
-function hasPiInsecureTlsSetting(modelsConfig = {}, providerId) {
-  const headers = modelsConfig.providers?.[requirePiProviderId(providerId)]?.headers;
-  return headers && typeof headers === "object"
-    ? Object.keys(headers).some((key) => key.toLowerCase() === piInsecureTlsHeader)
-    : false;
-}
-
 function buildPiModelsConfig(modelsConfig = {}, {
   providerId,
   baseUrl,
   api,
-  modelIds,
-  insecureTls = false
+  modelIds
 }) {
   const targetProviderId = requirePiProviderId(providerId);
   const providers = modelsConfig.providers && typeof modelsConfig.providers === "object" ? modelsConfig.providers : {};
   const currentProvider = providers[targetProviderId] && typeof providers[targetProviderId] === "object"
     ? providers[targetProviderId]
     : {};
-  const headers = currentProvider.headers && typeof currentProvider.headers === "object"
-    ? { ...currentProvider.headers }
-    : {};
-  for (const key of Object.keys(headers)) {
-    if (key.toLowerCase() === piInsecureTlsHeader) {
-      delete headers[key];
-    }
-  }
-  if (insecureTls) {
-    headers[piInsecureTlsHeader] = new URL(baseUrl).origin;
-  }
   const existingModels = new Map(
     (Array.isArray(currentProvider.models) ? currentProvider.models : [])
       .filter((model) => model?.id)
@@ -357,11 +337,6 @@ function buildPiModelsConfig(modelsConfig = {}, {
     models: modelIds.map((modelId) => buildPiModelConfig(modelId, existingModels.get(modelId)))
   };
   delete provider.apiKey;
-  if (Object.keys(headers).length) {
-    provider.headers = headers;
-  } else {
-    delete provider.headers;
-  }
 
   return {
     ...modelsConfig,
@@ -413,7 +388,6 @@ function buildPiConfiguration({ auth, models, settings }, {
   baseUrl,
   api,
   modelIds,
-  insecureTls,
   defaultModel
 }) {
   const targetProviderId = requirePiProviderId(providerId);
@@ -425,8 +399,7 @@ function buildPiConfiguration({ auth, models, settings }, {
       providerId: targetProviderId,
       baseUrl,
       api,
-      modelIds,
-      insecureTls
+      modelIds
     }),
     settings: buildPiSettingsConfig(settings, targetProviderId, defaultModel)
   };
@@ -455,7 +428,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   }
   const {
     assertNotCancelled,
-    confirmOrCancel,
     passwordPromptOptions,
     required,
     requiredUnlessExisting,
@@ -495,11 +467,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   const inferredApi = inferPiApiFromBaseUrl(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
-  const insecureTls = await confirmOrCancel({
-    message: `是否仅为 ${providerLabel} 中转请求跳过 TLS 证书校验？仅证书无法修复时启用`,
-    initialValue: hasPiInsecureTlsSetting(modelsConfig, providerId)
-  });
-
   const piApiOptions = getPiApiPromptOptions();
   const initialApi = piApiOptions.some((option) => option.value === existing.api)
     ? existing.api
@@ -542,7 +509,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
     baseUrl,
     api,
     modelIds,
-    insecureTls,
     defaultModel: finalDefaultModel
   });
   await ensurePiResourcesLinked(paths);
@@ -564,7 +530,6 @@ export {
   configurePiApi,
   detectPiEffectiveModel,
   getPiApiPromptOptions,
-  hasPiInsecureTlsSetting,
   inferPiApiFromBaseUrl,
   normalizeOpenAiBaseUrl,
   parsePiRpcEffectiveModel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abelworkflow",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Install AbelWorkflow into ~/.agents and create Claude/Codex symlinks.",
   "type": "module",
   "scripts": {

package/extensions/pi-gpt-responses-compat/tls-fetch.mjs

@@ -1,188 +0,0 @@
-export const piInsecureTlsHeader = "x-abelworkflow-insecure-tls";
-
-const installedFetchMarker = Symbol.for("abelworkflow.pi-provider-tls-fetch");
-const undiciGlobalDispatchers = [
-  Symbol.for("undici.globalDispatcher.2"),
-  Symbol.for("undici.globalDispatcher.1")
-];
-const redirectStatuses = new Set([301, 302, 303, 307, 308]);
-const maxRedirects = 5;
-
-function getMarkedHeaders(input, init) {
-  const source = init?.headers !== undefined
-    ? init.headers
-    : typeof Request !== "undefined" && input instanceof Request
-      ? input.headers
-      : undefined;
-  if (source === undefined) return null;
-
-  const headers = new Headers(source);
-  if (!headers.has(piInsecureTlsHeader)) return null;
-  const allowedOrigin = headers.get(piInsecureTlsHeader);
-  headers.delete(piInsecureTlsHeader);
-  return { allowedOrigin, headers };
-}
-
-function getRequestUrl(input) {
-  return typeof Request !== "undefined" && input instanceof Request
-    ? input.url
-    : input instanceof URL
-      ? input.href
-      : input;
-}
-
-function getRequestOrigin(input) {
-  try {
-    return new URL(getRequestUrl(input)).origin;
-  } catch {
-    return null;
-  }
-}
-
-function redirectRequestInit(input, init, status) {
-  const method = String(init.method ?? (
-    typeof Request !== "undefined" && input instanceof Request ? input.method : "GET"
-  )).toUpperCase();
-  const switchToGet = status === 303 && method !== "HEAD"
-    || (status === 301 || status === 302) && method === "POST";
-  if (!switchToGet) {
-    if (typeof Request !== "undefined" && input instanceof Request && method !== "GET" && method !== "HEAD") {
-      throw new Error("Pi insecure TLS cannot safely replay a redirected Request body");
-    }
-    return init;
-  }
-
-  const headers = new Headers(init.headers);
-  for (const name of ["content-encoding", "content-language", "content-length", "content-location", "content-type"]) {
-    headers.delete(name);
-  }
-  const nextInit = { ...init, method: "GET", headers };
-  delete nextInit.body;
-  return nextInit;
-}
-
-async function fetchWithSameOriginRedirects({ fetchOnce, input, init, allowedOrigin }) {
-  let nextInput = input;
-  let nextInit = init;
-
-  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount += 1) {
-    const response = await fetchOnce(nextInput, nextInit);
-    const location = redirectStatuses.has(response?.status) ? response.headers?.get?.("location") : null;
-    if (!location) return response;
-    if (redirectCount === maxRedirects) {
-      await response.body?.cancel?.();
-      throw new Error(`Pi insecure TLS exceeded ${maxRedirects} same-origin redirects`);
-    }
-
-    const target = new URL(location, getRequestUrl(nextInput));
-    if (target.origin !== allowedOrigin) {
-      await response.body?.cancel?.();
-      throw new Error(`Pi insecure TLS blocked cross-origin redirect to ${target.origin}`);
-    }
-    await response.body?.cancel?.();
-    nextInit = redirectRequestInit(nextInput, nextInit, response.status);
-    nextInput = target.href;
-  }
-}
-
-function applyNodeDispatcher(fetchImpl, input, init, dispatcherSource) {
-  let dispatcher;
-  try {
-    dispatcher = typeof dispatcherSource === "function" ? dispatcherSource() : dispatcherSource;
-  } catch (error) {
-    return Promise.reject(error);
-  }
-
-  if (dispatcher && typeof dispatcher.then === "function") {
-    return dispatcher.then((resolved) => applyNodeDispatcher(fetchImpl, input, init, resolved));
-  }
-  if (!dispatcher || typeof dispatcher.dispatch !== "function") {
-    return Promise.reject(new Error("Pi insecure TLS requires an injected Undici dispatcher"));
-  }
-  return fetchImpl(input, { ...init, dispatcher });
-}
-
-function getUndiciDispatcherConstructor(target) {
-  return undiciGlobalDispatchers
-    .map((symbol) => target[symbol]?.constructor)
-    .find((constructor) => typeof constructor === "function");
-}
-
-function initializeUndiciGlobalDispatcher(target) {
-  if (typeof target.fetch !== "function") return;
-  try {
-    void Promise.resolve(target.fetch("data:,")).catch(() => {});
-  } catch {
-  }
-}
-
-export function createNodeInsecureDispatcher(target = globalThis) {
-  let Dispatcher = getUndiciDispatcherConstructor(target);
-  if (typeof Dispatcher !== "function") {
-    initializeUndiciGlobalDispatcher(target);
-    Dispatcher = getUndiciDispatcherConstructor(target);
-  }
-  if (typeof Dispatcher !== "function") {
-    throw new Error("Pi insecure TLS requires the active Undici dispatcher");
-  }
-  return new Dispatcher({
-    allowH2: false,
-    connect: { rejectUnauthorized: false },
-    requestTls: { rejectUnauthorized: false }
-  });
-}
-
-export function createProviderTlsFetch({
-  fetchImpl = globalThis.fetch,
-  runtime = typeof globalThis.Bun === "undefined" ? "node" : "bun",
-  insecureDispatcher
-} = {}) {
-  if (typeof fetchImpl !== "function") {
-    throw new TypeError("A fetch implementation is required");
-  }
-
-  return function providerTlsFetch(input, init) {
-    const marked = getMarkedHeaders(input, init);
-    if (!marked) return fetchImpl(input, init);
-
-    const nextInit = { ...(init ?? {}), headers: marked.headers };
-    if (!marked.allowedOrigin || getRequestOrigin(input) !== marked.allowedOrigin) {
-      return fetchImpl(input, nextInit);
-    }
-
-    nextInit.redirect = "manual";
-    const fetchOnce = runtime === "bun"
-      ? (nextInput, redirectInit) => {
-          const tls = redirectInit.tls && typeof redirectInit.tls === "object" ? redirectInit.tls : {};
-          return fetchImpl(nextInput, {
-            ...redirectInit,
-            tls: { ...tls, rejectUnauthorized: false }
-          });
-        }
-      : (nextInput, redirectInit) => applyNodeDispatcher(
-          fetchImpl,
-          nextInput,
-          redirectInit,
-          insecureDispatcher
-        );
-
-    return fetchWithSameOriginRedirects({
-      fetchOnce,
-      input,
-      init: nextInit,
-      allowedOrigin: marked.allowedOrigin
-    });
-  };
-}
-
-export function installProviderTlsFetch({ target = globalThis, ...options } = {}) {
-  if (target.fetch?.[installedFetchMarker]) return target.fetch;
-
-  const wrapped = createProviderTlsFetch({
-    ...options,
-    fetchImpl: target.fetch.bind(target)
-  });
-  Object.defineProperty(wrapped, installedFetchMarker, { value: true });
-  target.fetch = wrapped;
-  return wrapped;
-}