ai-fly 0.4.0-alpha.3 → 0.4.0-alpha.4

package/dist/ai-fly.js

@@ -15,7 +15,7 @@ Daemon:
   ai-fly app                   launch the tray GUI (desktop app)
 
 Provider:
-  ai-fly service add <name> [--upstream <url> | --preset <id>] [--route <local>=<up>[@forms]]...
+  ai-fly service add <name> [--upstream <url> | --preset <id>] [--hooks <script>] [--route ...]...
                                [--route-pattern <match>=<template>]... [--secret <name>]
                                [--port <n>] [--match <type>:<value>]... [--data <dir>]
   ai-fly service list|get|remove <name> [--data <dir>]
@@ -26,6 +26,7 @@ Provider:
   ai-fly share --group <name> [--ttl <dur>]             mint a share link (token + key)
   ai-fly revoke <endpointId>                            eject a device (fabric-level)
   ai-fly presets [search] [--json]                      featured + models.dev long tail
+  ai-fly hooks list|get|add|remove|run                  hook scripts (builtin + ~/.aifly/hooks)
 
 Consumer:
   ai-fly join <dweb1-token> [--data <dir>] [--proxy …]  admit this device (fabric layer)
@@ -62,7 +63,7 @@ async function dispatch(command, rest) {
 	const lazy = (load) => {
 		return (argv, ctx) => load().then((m) => m.run([...argv], ctx));
 	};
-	return match(command).with("serve", () => lazy(() => import("./serve-CRcqQR0j.mjs"))(rest)).with("app", async () => {
+	return match(command).with("serve", () => lazy(() => import("./serve-CEmNAhX5.mjs"))(rest)).with("app", async () => {
 		const { join, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const { spawn } = await import("node:child_process");
@@ -77,17 +78,17 @@ async function dispatch(command, rest) {
 		return await new Promise((resolve) => {
 			child.once("exit", (c) => resolve(c ?? 0));
 		});
-	}).with("daemon", () => lazy(() => import("./daemon-CuxLimRD.mjs"))(rest)).with("presets", () => lazy(() => import("./presets-DRO5N4Vm.mjs"))(rest)).with("secret", () => lazy(() => import("./secret-DKN75Vry.mjs"))(rest)).with("settings", async () => (await import("./settings-Dho5hk5Z.mjs")).runAsSettings(rest, {})).with("relay", async () => (await import("./settings-Dho5hk5Z.mjs")).runAsRelay(rest, {})).with("test", () => lazy(() => import("./test-Dxkkc-KN.mjs"))(rest)).with("service", () => lazy(() => import("./service-CJq7aSR0.mjs"))(rest)).with("group", () => lazy(() => import("./group-CjwGDch3.mjs"))(rest)).with("share", () => lazy(() => import("./share-D7ChVNte.mjs"))(rest)).with("revoke", () => lazy(() => import("./revoke-h1X8Xr_T.mjs"))(rest)).with("join", () => lazy(() => import("./join-BJMcNGV-.mjs"))(rest)).with("import", () => lazy(() => import("./import-Zy3LL_PR.mjs"))(rest)).with("run", () => lazy(() => import("./run-W7DBz_bR.mjs"))(rest)).with("ports", () => lazy(() => import("./ports-Csv91JOD.mjs"))(rest)).with("forget", () => lazy(() => import("./forget-oMwM-SsU.mjs"))(rest)).with("key", () => {
-		if (rest[0] === "add") return lazy(() => import("./key-BcNxtRJx.mjs"))(rest);
-		return lazy(() => import("./key-TP7lZeqW.mjs"))(rest);
+	}).with("daemon", () => lazy(() => import("./daemon-z7hZDf5X.mjs"))(rest)).with("presets", () => lazy(() => import("./presets-B339R3JU.mjs"))(rest)).with("hooks", () => lazy(() => import("./hooks-Da7bL31j.mjs"))(rest)).with("secret", () => lazy(() => import("./secret-BTq8J0Oj.mjs"))(rest)).with("settings", async () => (await import("./settings-BwDXTwUJ.mjs")).runAsSettings(rest, {})).with("relay", async () => (await import("./settings-BwDXTwUJ.mjs")).runAsRelay(rest, {})).with("test", () => lazy(() => import("./test-DtOSl9gb.mjs"))(rest)).with("service", () => lazy(() => import("./service-CBURGJU1.mjs"))(rest)).with("group", () => lazy(() => import("./group-DxTSU3w2.mjs"))(rest)).with("share", () => lazy(() => import("./share-CNYqhoFY.mjs"))(rest)).with("revoke", () => lazy(() => import("./revoke-CA4VYdTU.mjs"))(rest)).with("join", () => lazy(() => import("./join-BvMm1-Qz.mjs"))(rest)).with("import", () => lazy(() => import("./import-DVD6ODYu.mjs"))(rest)).with("run", () => lazy(() => import("./run-Ckodfe9X.mjs"))(rest)).with("ports", () => lazy(() => import("./ports-Bs8NpX1c.mjs"))(rest)).with("forget", () => lazy(() => import("./forget-zXXMWRPE.mjs"))(rest)).with("key", () => {
+		if (rest[0] === "add") return lazy(() => import("./key-DHyfw_xd.mjs"))(rest);
+		return lazy(() => import("./key-BvFO4hCw.mjs"))(rest);
 	}).with("status", async () => {
 		const [scope, ...tail] = rest;
 		const wantProvider = scope === "provider" || scope !== "consumer" && providerDirExists();
 		const wantConsumer = scope === "consumer" || scope !== "provider" && consumersRootExists();
 		const argv = scope === "provider" || scope === "consumer" ? tail : rest;
 		let code = 0;
-		if (wantProvider) code = Math.max(code, await lazy(() => import("./status-0NYOen8x.mjs"))(argv));
-		if (wantConsumer) code = Math.max(code, await lazy(() => import("./status-BaRyycxh.mjs"))(argv));
+		if (wantProvider) code = Math.max(code, await lazy(() => import("./status-bV9YPNmT.mjs"))(argv));
+		if (wantConsumer) code = Math.max(code, await lazy(() => import("./status-DlB1AHty.mjs"))(argv));
 		if (!wantProvider && !wantConsumer) process.stdout.write("nothing to report: no provider storage and no imported consumers\n");
 		return code;
 	}).otherwise(() => {

package/dist/app/main.js

@@ -60,7 +60,11 @@ const SERVICE_REWRITE_SCHEMA = z.strictObject({
 	hostHeader: z.string().min(1).max(2048).optional(),
 	pathPrefixStrip: z.string().min(1).max(2048).optional(),
 	pathPrefixAppend: z.string().min(1).max(2048).optional(),
-	headerSet: z.record(z.string().min(1).max(1024), z.string().max(8192)).optional(),
+	headerSet: z.record(z.string().min(1).max(1024), z.union([z.string().max(8192), z.strictObject({
+		hook: z.string().min(1).max(128),
+		args: z.record(z.string().min(1).max(128), z.string().max(2048)).optional(),
+		bearer: z.boolean().optional()
+	})])).optional(),
 	headerRemove: z.array(z.string().min(1).max(1024)).max(32).optional()
 });
 const ROUTE_FORM_SCHEMA = z.enum([
@@ -108,6 +112,7 @@ const SERVICE_SCHEMA = z.strictObject({
 	upstream: z.string().min(1).max(2048),
 	rewrite: SERVICE_REWRITE_SCHEMA.optional(),
 	routes: z.array(SERVICE_ROUTE_SCHEMA).max(3).optional(),
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),
 	defaultPort: z.number().int().min(1).max(65535)
 });
 /** services.add 输入（defaultPort 缺省规则的校验在 store，同 CLI）。 */
@@ -117,7 +122,8 @@ const SERVICE_INPUT_SCHEMA = z.strictObject({
 	match: z.array(SERVICE_MATCH_SCHEMA$1).min(1).max(64),
 	defaultPort: z.number().int().min(1).max(65535).optional(),
 	rewrite: SERVICE_REWRITE_SCHEMA.optional(),
-	routes: z.array(SERVICE_ROUTE_SCHEMA).max(3).optional()
+	routes: z.array(SERVICE_ROUTE_SCHEMA).max(3).optional(),
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional()
 });
 const GROUP_LIMITS_SCHEMA = z.strictObject({
 	maxConcurrency: z.number().int().min(1).optional(),
@@ -155,7 +161,11 @@ const SERVICE_ENTRY_SCHEMA$1 = z.object({
 			prefix: z.string().optional(),
 			headerSet: z.array(z.strictObject({
 				name: z.string(),
-				value: z.string()
+				value: z.union([z.string(), z.strictObject({
+					hook: z.string(),
+					args: z.record(z.string(), z.string()).optional(),
+					bearer: z.boolean().optional()
+				})])
 			})).optional()
 		}).optional(),
 		/** 按标准路由披露（消费侧呈现各标准本地 base 与可用性判定）。 */
@@ -206,9 +216,14 @@ const PRESET_SCHEMA = z.strictObject({
 	iconId: z.string().min(1).max(128).optional(),
 	/** 惯用环境变量名（仅用于 $env 注入建议与文档；本地运行时模板无此字段）。 */
 	keyEnv: z.string().min(1).max(256).optional(),
-	/** 预填 authorization 头值模板（如 `$file:~/.codex/auth.json#.tokens.access_token?bearer`）；
-	*  优先级：显式 secretName > authHeader > keyEnv。 */
-	authHeader: z.string().min(3).max(2048).optional(),
+	/** 选中的 hooks 脚本名（applyAsService 透传为服务 hooks 字段）。 */
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),
+	/** 预填 authorization 头的钩子调用对象；优先级：显式 secretName > authHeader > keyEnv。 */
+	authHeader: z.strictObject({
+		hook: z.string().min(1).max(128),
+		args: z.record(z.string().min(1).max(128), z.string().max(2048)).optional(),
+		bearer: z.boolean().optional()
+	}).optional(),
 	/** 使用方本地端口建议（避开 <1024 特权段）。 */
 	defaultPort: z.number().int().min(1024).max(65535),
 	/** 官方域名集（exact/suffix 建议的生成源）。 */
@@ -839,7 +854,11 @@ const SERVICE_REWRITE_STORE_SCHEMA = z.strictObject({
 	hostHeader: z.string().min(1).max(2048).optional(),
 	pathPrefixStrip: z.string().min(1).max(2048).optional(),
 	pathPrefixAppend: z.string().min(1).max(2048).optional(),
-	headerSet: z.record(z.string().min(1).max(1024), z.string().max(8192)).optional(),
+	headerSet: z.record(z.string().min(1).max(1024), z.union([z.string().max(8192), z.strictObject({
+		hook: z.string().min(1).max(128),
+		args: z.record(z.string().min(1).max(128), z.string().max(2048)).optional(),
+		bearer: z.boolean().optional()
+	})])).optional(),
 	headerRemove: z.array(z.string().min(1).max(1024)).max(32).optional()
 });
 /** 路径路由（M3-r7）：按声明顺序命中的转发规则——prefix 模式（默认，
@@ -863,6 +882,8 @@ const SERVICE_STORE_SCHEMA = z.strictObject({
 	match: z.array(SERVICE_MATCH_STORE_SCHEMA).max(64),
 	upstream: z.string().min(1).max(2048),
 	rewrite: SERVICE_REWRITE_STORE_SCHEMA.optional(),
+	/** 选中的 hooks 脚本名（内建库或 ~/.aifly/hooks/<name>.cjs）。 */
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),
 	routes: z.array(SERVICE_ROUTE_STORE_SCHEMA).max(3).optional(),
 	defaultPort: z.number().int().min(1).max(65535)
 });
@@ -1014,6 +1035,7 @@ var ProviderStore = class ProviderStore {
 			match: input.match.map((m) => ({ ...m })),
 			upstream: upstreamUrl.href,
 			rewrite,
+			...input.hooks !== void 0 ? { hooks: input.hooks } : {},
 			...routes !== void 0 ? { routes } : {},
 			defaultPort
 		};
@@ -1613,6 +1635,7 @@ const SERVICE_ENTRY_SCHEMA = z.strictObject({
 	name: z.string().min(1).max(256),
 	match: z.array(SERVICE_MATCH_SCHEMA).max(64),
 	defaultPort: z.number().int().min(1).max(65535),
+	hooks: z.string().optional(),
 	detail: SERVICE_DETAIL_SCHEMA.optional()
 });
 const GROUP_ENTRY_SCHEMA = z.strictObject({
@@ -2417,7 +2440,7 @@ function buildServiceDetail(service) {
 		if (prefix !== void 0) rewrite.prefix = prefix;
 		if (service.rewrite.headerSet !== void 0) rewrite.headerSet = Object.entries(service.rewrite.headerSet).map(([name, value]) => ({
 			name,
-			value: isMaskedRef(value) ? "●" : value
+			value: typeof value === "string" ? isMaskedRef(value) ? "●" : value : "●"
 		}));
 	}
 	return {
@@ -2555,6 +2578,122 @@ var KeySessionIndex = class {
 	}
 };
 //#endregion
+//#region src/provider/hook.ts
+var HookMissingError = class extends Error {
+	constructor() {
+		super("credential source missing");
+		this.name = "HookMissingError";
+	}
+};
+/** 包根（向上找 name=ai-fly 的 package.json；dev 仓库与安装布局皆成立）。 */
+function packageRoot(start = dirname(fileURLToPath(import.meta.url))) {
+	let dir = resolve(start);
+	for (let hops = 0; hops < 12; hops += 1) {
+		const pkg = join(dir, "package.json");
+		if (existsSync(pkg)) try {
+			const parsed = JSON.parse(readFileSync(pkg, "utf8"));
+			if (parsed !== null && typeof parsed === "object" && parsed.name === "ai-fly") return dir;
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return process.cwd();
+}
+function hookScriptPaths(home = homedir()) {
+	return {
+		userDir: join(home, ".aifly", "hooks"),
+		builtinDir: join(packageRoot(), "hooks")
+	};
+}
+function scriptCandidates(name, paths) {
+	const bases = [join(paths.userDir, name), join(paths.builtinDir, name)];
+	const out = [];
+	for (const b of bases) out.push(`${b}.cjs`, b.endsWith(".cjs") || b.endsWith(".js") ? b : `${b}.js`);
+	return out;
+}
+/** 加载 hooks 脚本模块（用户库优先于内建库；缺席返回 undefined）。 */
+function loadHookScript(name, home = homedir()) {
+	if (name === "" || name.includes("/") || name.includes("..")) return void 0;
+	const req = createRequire(import.meta.url);
+	for (const candidate of scriptCandidates(name, hookScriptPaths(home))) {
+		if (!existsSync(candidate)) continue;
+		try {
+			const mod = req(candidate);
+			if (mod !== null && typeof mod === "object") return mod;
+		} catch {}
+	}
+}
+function isAsyncIterable(v) {
+	return v !== null && typeof v === "object" && Symbol.asyncIterator in v;
+}
+const subscriptions = /* @__PURE__ */ new Map();
+/** 建立订阅并等待首个 yield：返回首值（后续值由后台循环更新 latest）。 */
+function startSubscription(key, stream, sub) {
+	sub.iterator = stream[Symbol.asyncIterator]();
+	return new Promise((resolveFirst) => {
+		let firstSettled = false;
+		(async () => {
+			try {
+				const it = sub.iterator;
+				for (;;) {
+					const r = await it.next();
+					if (r.done === true) break;
+					if (typeof r.value === "string" && r.value !== "") {
+						sub.latest = r.value;
+						if (firstSettled === false) {
+							firstSettled = true;
+							resolveFirst(r.value);
+						}
+					}
+				}
+			} catch {}
+			if (firstSettled === false) {
+				firstSettled = true;
+				resolveFirst(void 0);
+			}
+		})();
+	});
+}
+/**
+* 解析一次钩子取值（headerSet 的 {hook,...} 协议消费点）。
+* 订阅键 = script|fn —— 同键首个请求建立订阅，后续读 latest。
+* 任何未命中（脚本/函数缺席、调用抛错、非字符串、空串、订阅未出首值）
+* 抛 HookMissingError（零上游请求；信息不含脚本路径与值）。
+*/
+async function resolveHookValue(fnName, opts) {
+	const home = opts.home ?? homedir();
+	const raw = (opts.loader ?? loadHookScript)(opts.script, home)?.[fnName];
+	if (typeof raw !== "function") throw new HookMissingError();
+	let result;
+	try {
+		result = raw({
+			homedir: home,
+			args: opts.args ?? {},
+			secrets: (n) => opts.secrets?.(n),
+			env: (n) => opts.env?.(n) ?? process.env[n]
+		});
+	} catch {
+		throw new HookMissingError();
+	}
+	const key = `${opts.script}|${fnName}`;
+	if (isAsyncIterable(result)) {
+		let sub = subscriptions.get(key);
+		if (sub === void 0) {
+			sub = {};
+			subscriptions.set(key, sub);
+			const first = await startSubscription(key, result, sub);
+			if (first === void 0) throw new HookMissingError();
+			return first;
+		}
+		if (sub.latest === void 0) throw new HookMissingError();
+		return sub.latest;
+	}
+	const awaited = await result;
+	if (typeof awaited !== "string" || awaited === "") throw new HookMissingError();
+	return awaited;
+}
+//#endregion
 //#region src/provider/rewrite.ts
 /** 拼接/断言失败（protocol_error 语义）。 */
 var RewriteError = class extends Error {
@@ -2585,149 +2724,45 @@ var SecretMissingError = class extends Error {
 	}
 };
 /**
-* 解析 `$file:` 引用。path 支持 `~` 前缀（解析时展开）；jsonPath 为 jq 风格
-* 点径（`.tokens.access_token`，支持 `[n]` 数组下标）；`?bearer` 后缀给非空
-* 值拼 `Bearer ` 前缀。格式非法（缺 `#`）抛 SecretMissingError 同族的
-* UsageError 语义由调用方决定——此处返回 null 交由上层按未命中处理。
-*/
-function parseFileRef(value) {
-	const body = value.slice(6);
-	const hash = body.indexOf("#");
-	if (hash <= 0) return null;
-	let spec = body.slice(hash + 1);
-	let bearer = false;
-	if (spec.endsWith("?bearer")) {
-		bearer = true;
-		spec = spec.slice(0, -7);
-	}
-	if (spec === "" || !spec.startsWith(".")) return null;
-	return {
-		path: body.slice(0, hash),
-		jsonPath: spec,
-		bearer
-	};
-}
-/** jq 风格点径求值（`.a.b` / `.a[0].b`；起点须以 `.` 开头）。未命中返回 undefined。 */
-function evalJsonPath(root, jsonPath) {
-	if (!jsonPath.startsWith(".")) return void 0;
-	let cur = root;
-	const segments = jsonPath.slice(1).split(/(?=\[)|\./).filter((s) => s !== "");
-	for (const seg of segments) {
-		if (cur === null || cur === void 0) return void 0;
-		const arr = /^\[(\d+)\]$/.exec(seg);
-		if (arr !== null) {
-			if (!Array.isArray(cur)) return void 0;
-			cur = cur[Number(arr[1])];
-			continue;
-		}
-		if (typeof cur !== "object") return void 0;
-		cur = cur[seg];
-	}
-	return cur;
-}
-function parseScriptRef(value) {
-	let body = value.slice(8);
-	let bearer = false;
-	if (body.endsWith("?bearer")) {
-		bearer = true;
-		body = body.slice(0, -7);
-	}
-	if (body === "") return null;
-	return {
-		path: body,
-		bearer
-	};
-}
-/**
-* 默认脚本凭据源：createRequire 同步加载 CJS 模块并返回其导出——
-* 函数导出由 resolveHeaderValue 每请求调用（值按调用计算，token 刷新即刻生效）；
-* 脚本文件本身的修改需重启 daemon（require 缓存，跨 Node/Bun/Deno 一致）。
-* 信任模型与 $cmd 等价：脚本以 ai-fly 同权限执行宿主 IO（无 VM 隔离——
-* node:vm 非安全边界且 Bun/Deno 支持残缺，Owner 裁决 2026-09-12 取简方案）。
+* 头值解析（两协议，Owner 裁决 2026-09-12 最终形态）：
+* - string 字面量：原样（空串 = 省略该头）
+* - 对象 = 钩子调用：{ hook: <函数名>, args?, bearer? }——脚本取
+*   ctx.script（service.hooks），缺席时按 args 形态推导内建
+*   （var→env / name→secret / path→file）；经 resolveHookValue 三态取值
+*   （string/Promise 每请求拉取；AsyncIterable 订阅 latest）；bearer 拼
+*   前缀。未命中抛 SecretMissingError（零上游请求；不泄脚本路径与值）。
 */
-const defaultScriptCredentialSource = (modulePath) => {
-	try {
-		return createRequire(import.meta.url)(modulePath);
-	} catch {
-		return;
-	}
-};
-/** 脚本导出归一：函数 / {default: fn} 取函数；其余视为无效（undefined）。 */
-function scriptExportFn(mod) {
-	if (typeof mod === "function") return mod;
-	if (mod !== null && typeof mod === "object" && "default" in mod) {
-		const d = mod.default;
-		if (typeof d === "function") return d;
+async function resolveHeaderEntry(entry, ctx) {
+	if (typeof entry === "string") return entry === "" ? void 0 : entry;
+	const args = entry.args ?? {};
+	let script = ctx.script;
+	if (script === void 0 || script === "") {
+		if (args.var !== void 0) script = "env";
+		else if (args.name !== void 0) script = "secret";
+		else if (args.path !== void 0) script = "file";
+		else throw new SecretMissingError();
 	}
-}
-/** 默认文件凭据源：读文件 + JSON 解析 + 点径求值（仅字符串值；`~` 已在上层展开）。 */
-const defaultFileCredentialSource = (path, jsonPath) => {
 	let raw;
 	try {
-		raw = readFileSync(path, "utf8");
-	} catch {
-		return;
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
+		raw = await resolveHookValue(entry.hook, {
+			script,
+			...ctx.home !== void 0 ? { home: ctx.home } : {},
+			...Object.keys(args).length > 0 ? { args } : {},
+			...ctx.secrets !== void 0 ? { secrets: ctx.secrets } : {},
+			...ctx.env !== void 0 ? { env: (n) => ctx.env?.[n] } : {},
+			...ctx.loader !== void 0 ? { loader: ctx.loader } : {}
+		});
 	} catch {
-		return;
-	}
-	const value = evalJsonPath(parsed, jsonPath);
-	return typeof value === "string" && value !== "" ? value : void 0;
-};
-/**
-* 头值解析：literal 原样；`$secret:<name>` 优先于 `$env:`/`$file:` 判定——命中
-* 密钥库返回完整值，未命中（含空名/空值/未注入密钥源）抛 SecretMissingError
-* （不回退空值、不省略该头）；`$file:<path>#<json-path>[?bearer]` 每请求读盘
-* （文件/键/空值未命中同抛 SecretMissingError；`?bearer` 拼前缀）；
-* `$env:<VAR>` 语义保持——空串/未设置返回 undefined（= 省略该头）。
-* 各源可并存于不同头（逐头独立解析）。
-*/
-function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSource, scripts = defaultScriptCredentialSource) {
-	if (value.startsWith("$secret:")) {
-		const name = value.slice(8);
-		const resolved = secrets?.(name);
-		if (resolved === void 0 || resolved === "") throw new SecretMissingError();
-		return resolved;
-	}
-	if (value.startsWith("$file:")) {
-		const ref = parseFileRef(value);
-		if (ref === null) throw new SecretMissingError();
-		const resolved = files(ref.path.startsWith("~/") ? join(homedir(), ref.path.slice(1)) : ref.path, ref.jsonPath);
-		if (resolved === void 0 || resolved === "") throw new SecretMissingError();
-		return ref.bearer ? `Bearer ${resolved}` : resolved;
-	}
-	if (value.startsWith("$script:")) {
-		const ref = parseScriptRef(value);
-		if (ref === null) throw new SecretMissingError();
-		const fn = scriptExportFn(scripts(ref.path.startsWith("~/") ? join(homedir(), ref.path.slice(1)) : ref.path));
-		if (fn === void 0) throw new SecretMissingError();
-		let resolved;
-		try {
-			resolved = fn({ homedir: homedir() });
-		} catch {
-			throw new SecretMissingError();
-		}
-		if (typeof resolved !== "string" || resolved === "") throw new SecretMissingError();
-		return ref.bearer ? `Bearer ${resolved}` : resolved;
+		throw new SecretMissingError();
 	}
-	if (!value.startsWith("$env:")) return value;
-	const name = value.slice(5);
-	if (name === "") return void 0;
-	const resolved = env[name];
-	return resolved === void 0 || resolved === "" ? void 0 : resolved;
+	return entry.bearer === true ? `Bearer ${raw}` : raw;
 }
-/** 服务声明的全部 $env 变量名（启动横幅 WARNING 用）。 */
+/** 服务声明的 env 钩子变量名（启动横幅 WARNING 用：声明而未设置）。 */
 function collectEnvVarNames(service) {
 	const names = /* @__PURE__ */ new Set();
 	const headerSet = service.rewrite?.headerSet;
 	if (headerSet === void 0) return [];
-	for (const value of Object.values(headerSet)) if (value.startsWith("$env:")) {
-		const name = value.slice(5);
-		if (name !== "") names.add(name);
-	}
+	for (const entry of Object.values(headerSet)) if (typeof entry === "object" && entry.args?.var !== void 0 && (service.hooks === void 0 || service.hooks === "env")) names.add(entry.args.var);
 	return [...names];
 }
 /** HTTP hop-by-hop / 传输层自管头（普通 HTTP 转发路径剥离；WS 路径另行挑选）。 */
@@ -2806,7 +2841,7 @@ function isWebSocketUpgradeRequest(headers) {
 	if (connection === void 0 || upgrade === void 0) return false;
 	return connection.split(",").map((t) => t.trim().toLowerCase()).includes("upgrade") && upgrade.trim().toLowerCase() === "websocket";
 }
-function buildUpstreamRequest(service, req, env = process.env, secrets) {
+async function buildUpstreamRequest(service, req, env = process.env, secrets) {
 	const upstream = parseUpstreamUrl(service.upstream);
 	assertFramePathShape(req.path);
 	const split = splitQuery(req.path);
@@ -2870,7 +2905,11 @@ function buildUpstreamRequest(service, req, env = process.env, secrets) {
 	for (const name of service.rewrite?.headerRemove ?? []) delete headers[name];
 	const headerSet = service.rewrite?.headerSet;
 	if (headerSet !== void 0) for (const [name, value] of Object.entries(headerSet)) {
-		const resolved = resolveHeaderValue(value, env, secrets);
+		const resolved = await resolveHeaderEntry(value, {
+			script: service.hooks,
+			env,
+			secrets
+		});
 		if (resolved === void 0) continue;
 		headers[name] = resolved;
 	}
@@ -3210,7 +3249,7 @@ function mergeTimeouts(overrides) {
 async function forwardRequest(ctx) {
 	let plan;
 	try {
-		plan = buildUpstreamRequest(ctx.service, ctx.req, ctx.env ?? process.env, ctx.secrets);
+		plan = await buildUpstreamRequest(ctx.service, ctx.req, ctx.env ?? process.env, ctx.secrets);
 	} catch (err) {
 		const code = err instanceof SecretMissingError ? ERROR_CODE.secret_missing : err instanceof PathNotOfferedError ? ERROR_CODE.path_not_offered : ERROR_CODE.protocol_error;
 		const message = err instanceof RewriteError || err instanceof SecretMissingError || err instanceof PathNotOfferedError ? err.message : "request rewrite failed";
@@ -6231,9 +6270,13 @@ var providers_default = {
 				"localPrefix": "/codex",
 				"upstreamPrefix": "/backend-api/codex"
 			}],
-			"authHeader": "$file:~/.codex/auth.json#.tokens.access_token?bearer",
+			"authHeader": {
+				"hook": "authHeader",
+				"bearer": true
+			},
 			"notes": "ChatGPT Codex backend (Responses API). Auth reads ~/.codex/auth.json per request (codex CLI login state; no key needed). Point agents at OPENAI_BASE_URL=http://127.0.0.1:<port>/codex with wire_api=responses. WS clients: ws://127.0.0.1:<port>/codex/responses upgrades to wss upstream.",
-			"source": "https://github.com/openai/codex (~/.codex/auth.json login state)"
+			"source": "https://github.com/openai/codex (~/.codex/auth.json login state)",
+			"hooks": "codex"
 		}
 	]
 };
@@ -7044,7 +7087,7 @@ async function testServiceRoute(input) {
 		bodyLen: 0
 	};
 	try {
-		const plan = buildUpstreamRequest(input.service, req, input.env, input.secrets);
+		const plan = await buildUpstreamRequest(input.service, req, input.env, input.secrets);
 		const response = await fetchImpl(plan.url, {
 			method: "POST",
 			headers: plan.headers,
@@ -7507,7 +7550,20 @@ function presetToServiceInput(preset, input) {
 		})),
 		...preset.routes !== void 0 && preset.routes.length > 0 ? { routes: preset.routes } : {},
 		...input.port !== void 0 ? { defaultPort: input.port } : { defaultPort: preset.defaultPort },
-		...input.secretName !== void 0 ? { rewrite: { headerSet: { authorization: `$secret:${input.secretName}` } } } : preset.authHeader !== void 0 ? { rewrite: { headerSet: { authorization: preset.authHeader } } } : keyEnv !== void 0 ? { rewrite: { headerSet: { authorization: `$env:${keyEnv}` } } } : {}
+		...preset.hooks !== void 0 ? { hooks: preset.hooks } : {},
+		...input.secretName !== void 0 ? {
+			hooks: "secret",
+			rewrite: { headerSet: { authorization: {
+				hook: "authHeader",
+				args: { name: input.secretName }
+			} } }
+		} : preset.authHeader !== void 0 ? { rewrite: { headerSet: { authorization: preset.authHeader } } } : keyEnv !== void 0 ? {
+			hooks: "env",
+			rewrite: { headerSet: { authorization: {
+				hook: "authHeader",
+				args: { var: keyEnv }
+			} } }
+		} : {}
 	};
 	const envHint = input.secretName === void 0 && keyEnv !== void 0 ? `export ${keyEnv}='Bearer <your-api-key>' (full header value; the provider injects it upstream)` : void 0;
 	return {

package/dist/{common-Cr7D8JyX.mjs → common-BerjPDN0.mjs}

@@ -1,6 +1,6 @@
 import { n as resolveRelayUrls, t as loadConfig } from "./config-BlZnFqx7.mjs";
 import { n as loadSdk, t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { t as loadSettings } from "./settings-BAa8I7Ww.mjs";
+import { t as loadSettings } from "./settings-D1Ukj8bF.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/common.ts
 function ctxOut(ctx) {

package/dist/{common-BwKEJKOZ.mjs → common-DGktbuQT.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as resolveRelayUrls, t as loadConfig } from "./config-BlZnFqx7.mjs";
-import { t as ProviderStore } from "./store-YUMvMCBg.mjs";
-import { t as loadSettings } from "./settings-BAa8I7Ww.mjs";
+import { t as ProviderStore } from "./store-z7qZO_5S.mjs";
+import { t as loadSettings } from "./settings-D1Ukj8bF.mjs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 //#region src/cli/commands/provider/common.ts
@@ -56,13 +56,24 @@ function parseMatchSpec(raw) {
 		value
 	};
 }
-/** "Name=value"（首个 = 分割；Name 小写化）。 */
 function parseHeaderSetSpec(raw) {
 	const idx = raw.indexOf("=");
-	if (idx <= 0) throw new UsageError(`error: invalid --header-set value: ${raw} (expected <name>=<value>, value may be $env:VAR)`);
+	if (idx <= 0) throw new UsageError(`error: invalid --header-set value: ${raw} (expected <name>=<value> or <name>={"hook":...}; value is a literal or hook invocation JSON)`);
+	const name = raw.slice(0, idx).trim().toLowerCase();
+	const rawValue = raw.slice(idx + 1);
+	if (rawValue.startsWith("{")) try {
+		const parsed = JSON.parse(rawValue);
+		if (parsed === null || typeof parsed !== "object" || typeof parsed.hook !== "string") throw new Error("not a hook invocation");
+		return {
+			name,
+			value: parsed
+		};
+	} catch {
+		throw new UsageError(`error: invalid --header-set hook JSON for '${name}' (expected {"hook":"authHeader",...})`);
+	}
 	return {
-		name: raw.slice(0, idx).trim().toLowerCase(),
-		value: raw.slice(idx + 1)
+		name,
+		value: rawValue
 	};
 }
 /** 各命令的 rewrite 组装（仅在存在任一重写选项时构造）。 */

package/dist/{daemon-CuxLimRD.mjs → daemon-z7hZDf5X.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError, t as CliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { r as settingsPath, t as loadSettings } from "./settings-BAa8I7Ww.mjs";
+import { r as settingsPath, t as loadSettings } from "./settings-D1Ukj8bF.mjs";
 import { a as killHard, c as terminateGracefully, i as isAlive, l as writeLastStart, n as daemonDir, o as readLastStart, r as ensureDaemonDir, s as readPid, t as clearPid, u as writePid } from "./daemon-state-CYkiW3SA.mjs";
-import { r as openStore } from "./common-BwKEJKOZ.mjs";
+import { r as openStore } from "./common-DGktbuQT.mjs";
 import { openSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, resolve } from "node:path";
@@ -99,7 +99,7 @@ async function start(startArgv, home) {
 	process.on("exit", () => {
 		clearPid(home);
 	});
-	const { run: serveRun } = await import("./serve-CRcqQR0j.mjs");
+	const { run: serveRun } = await import("./serve-CEmNAhX5.mjs");
 	return serveRun([...startArgv], { homedir: home });
 }
 /** 后台 pid（活性核验；陈旧 pidfile 就地清理返回 null）。 */

package/dist/{forget-oMwM-SsU.mjs → forget-zXXMWRPE.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as removeKeyring, n as consumersRoot } from "./store-jmpkM28T.mjs";
-import { n as ctxHomedir, r as ctxOut } from "./common-Cr7D8JyX.mjs";
+import { d as removeKeyring, n as consumersRoot } from "./store-DUMRSQVn.mjs";
+import { n as ctxHomedir, r as ctxOut } from "./common-BerjPDN0.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/forget.ts
 async function run(argv, ctx = {}) {

package/dist/{frames-BDqvhB2Y.mjs → frames-BDz8buix.mjs}

@@ -235,6 +235,7 @@ const SERVICE_ENTRY_SCHEMA = z.strictObject({
 	name: z.string().min(1).max(256),
 	match: z.array(SERVICE_MATCH_SCHEMA).max(64),
 	defaultPort: z.number().int().min(1).max(65535),
+	hooks: z.string().optional(),
 	detail: SERVICE_DETAIL_SCHEMA.optional()
 });
 const GROUP_ENTRY_SCHEMA = z.strictObject({

package/dist/{group-CjwGDch3.mjs → group-DxTSU3w2.mjs}

@@ -1,6 +1,6 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as str, l as resolveDataDir, n as multi, r as openStore, s as parsePositiveInt } from "./common-BwKEJKOZ.mjs";
+import { d as str, l as resolveDataDir, n as multi, r as openStore, s as parsePositiveInt } from "./common-DGktbuQT.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/group.ts
 const SPEC = {