billion-context 0.1.84-pr.537.356 → 0.1.84

package/README.md

@@ -112,18 +112,6 @@ turn is a semantic mismatch the model tolerates (it is clearly marked
   summaries (their tool call isn't in the agent's history and the agent's view
   skips `acp_summary`) — but that needs the id match above, which doesn't occur.
 
-### Injection priority — no files unless unavoidable
-
-How the launcher points a client at the proxy follows a strict priority
-(#535): **env vars** (`HTTPS_PROXY` cert-MITM for discovered upstream hosts,
-`HTTP_PROXY` absolute-form requests for plaintext-http upstreams, plus the
-per-client CA trust variable) > **client-native CLI flags / extension APIs**
-> **generated config files** (last resort — today omp's overlay and dsh's
-loopback exception). No real config file is ever edited, and bili never owns
-user data: clients run against their real home directory, and pre-existing
-overlay dirs from older versions (e.g. `~/.hermes-bili`) are left in place,
-unmigrated.
-
 ## Which do I need?
 
 Pick by your client:
@@ -169,8 +157,8 @@ bili codex                            # launch codex through the proxy
 bili claude                           # launch claude through the proxy
 bili omp                              # pi-style: MITM env + persistent overlay home (~/.omp/agent-bili, real config untouched)
 bili opencode                         # MITM for HTTPS + temp opencode.json (/bili/ for HTTP) + thin /acp plugin
-bili hermes                           # HTTPS_PROXY cert-MITM (HERMES_CA_BUNDLE) + HTTP_PROXY for plaintext upstreams; identity plugin in real ~/.hermes
-bili dsh                              # deepseek-harness: MITM env incl. built-in deepseek route + HTTP_PROXY for non-loopback plaintext; loopback keeps settings.yaml overlay (~/.dsh-bili); native /acp via --patch
+bili hermes                           # no MITM possible (certifi CA) — persistent overlay home (~/.hermes-bili), all traffic /bili/
+bili dsh                              # deepseek-harness: built-in deepseek route via DEEPSEEK_BASE_URL + overlay DSH_HOME (~/.dsh-bili), all traffic /bili/, native /acp command injected via --patch
 bili pi --mitm-domain api.foo.com     # add a domain to the MITM whitelist
 ```
 

package/README.zh-CN.md

@@ -88,8 +88,8 @@ bili codex                            # 拉起 codex
 bili claude                           # 拉起 claude
 bili omp                              # pi 同款 MITM 环境变量 + 隔离临时 models.yml
 bili opencode                         # HTTPS 走 MITM + 临时 opencode.json(HTTP 走 /bili/)+ 轻量 /acp 插件
-bili hermes                           # HTTPS_PROXY 证书 MITM(HERMES_CA_BUNDLE)+ HTTP_PROXY 走明文上游;身份插件装入真实 ~/.hermes
-bili dsh                              # deepseek-harness:MITM 环境变量(含内置 deepseek 路由)+ HTTP_PROXY 走非回环明文上游;回环上游保留 settings.yaml overlay(~/.dsh-bili);经 --patch 注入原生 /acp 命令
+bili hermes                           # 无法 MITM(certifi CA)—— 隔离 HERMES_HOME,全部流量 /bili/
+bili dsh                              # deepseek-harness:内置 deepseek 路由走 DEEPSEEK_BASE_URL + 隔离 DSH_HOME(~/.dsh-bili),全部流量 /bili/,经 --patch 注入原生 /acp 命令
 bili pi --mitm-domain api.foo.com     # 向 MITM 白名单追加域名
 ```
 

package/dist/index.js

@@ -56901,13 +56901,6 @@ function resolveUpstream(_opts, reqUrl, req) {
     const mitmKey = mitmUpstream.replace(/^https:\/\//, "mitm://");
     return { upstream: mitmUpstream, rewrittenUrl: mitmKey + (reqUrl ?? "") };
   }
-  if (/^https?:\/\//i.test(reqUrl)) {
-    try {
-      const u2 = new URL(reqUrl);
-      return { upstream: `${u2.protocol}//${u2.host}`, rewrittenUrl: reqUrl, tunnel: true };
-    } catch {
-    }
-  }
   const KNOWN_PROTOCOLS = ["responses", "anthropic", "openai"];
   if (reqUrl.startsWith("/bili/")) {
     let rest = reqUrl.slice(6);
@@ -62796,12 +62789,6 @@ function unwrapUpstream2(url) {
   const idx = url.indexOf("/bili/");
   return idx >= 0 ? url.slice(idx + "/bili/".length) : url;
 }
-function isLoopbackHost(host) {
-  const h = host.toLowerCase();
-  if (h === "localhost" || h === "::1" || h === "[::1]") return true;
-  const m2 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(h);
-  return m2 !== null && m2[1] === "127";
-}
 function resolveCaCertPath(env) {
   const base = env.XDG_DATA_HOME || path15.join(os5.homedir(), ".local/share");
   return path15.join(base, "billion-context", "ca", "root-ca.pem");
@@ -62814,8 +62801,6 @@ function discoverRoutes(client, config) {
   const httpsDomains = [];
   const httpRewrites = [];
   const httpsRewrites = [];
-  const httpEnvRoutes = [];
-  const providerKeys = [];
   const httpsSeen = /* @__PURE__ */ new Set();
   const rewriteKeys = /* @__PURE__ */ new Set();
   const httpsRewriteKeys = /* @__PURE__ */ new Set();
@@ -62872,25 +62857,14 @@ function discoverRoutes(client, config) {
     for (const [name, prov] of Object.entries(config.hermes?.providers ?? {})) {
       if (!nonEmpty2(prov.api)) continue;
       const real = unwrapUpstream2(prov.api);
-      let url;
       try {
-        url = new URL(real);
+        const url = new URL(real);
+        if (url.protocol !== "http:" && url.protocol !== "https:") continue;
+        if (hermesSeen.has(name)) continue;
+        hermesSeen.add(name);
+        rewriteKeys.add(name);
+        httpRewrites.push({ key: name, realUpstream: real });
       } catch {
-        continue;
-      }
-      if (url.protocol !== "http:" && url.protocol !== "https:") continue;
-      if (hermesSeen.has(name)) continue;
-      hermesSeen.add(name);
-      rewriteKeys.add(name);
-      providerKeys.push(name);
-      if (url.protocol === "https:") {
-        const host = url.hostname;
-        if (host && !httpsSeen.has(host.toLowerCase())) {
-          httpsSeen.add(host.toLowerCase());
-          httpsDomains.push(host);
-        }
-      } else {
-        httpEnvRoutes.push(real);
       }
     }
   } else if (client === "dsh") {
@@ -62898,27 +62872,15 @@ function discoverRoutes(client, config) {
     let anon = 0;
     for (const raw of config.dsh?.baseUrls ?? []) {
       const real = unwrapUpstream2(raw);
-      let url;
       try {
-        url = new URL(real);
-      } catch {
-        continue;
-      }
-      if (url.protocol !== "http:" && url.protocol !== "https:") continue;
-      if (dshSeen.has(real)) continue;
-      dshSeen.add(real);
-      if (isLoopbackHost(url.hostname)) {
+        const url = new URL(real);
+        if (url.protocol !== "http:" && url.protocol !== "https:") continue;
+        if (dshSeen.has(real)) continue;
+        dshSeen.add(real);
         anon += 1;
         rewriteKeys.add(`dsh-${anon}`);
         httpRewrites.push({ key: `dsh-${anon}`, realUpstream: real });
-      } else if (url.protocol === "https:") {
-        const host = url.hostname;
-        if (!httpsSeen.has(host.toLowerCase())) {
-          httpsSeen.add(host.toLowerCase());
-          httpsDomains.push(host);
-        }
-      } else {
-        httpEnvRoutes.push(real);
+      } catch {
       }
     }
   } else {
@@ -62927,7 +62889,7 @@ function discoverRoutes(client, config) {
     }
     classify(config.codex?.openaiBaseUrl, "openai_base_url");
   }
-  return { httpsDomains, httpRewrites, httpsRewrites, httpEnvRoutes, providerKeys };
+  return { httpsDomains, httpRewrites, httpsRewrites };
 }
 function discoverDomains(client, config) {
   return discoverRoutes(client, config).httpsDomains;
@@ -63707,12 +63669,53 @@ function prepareOmpHttpRewrite(ompHome, origin, httpRewrites, httpsRewrites) {
   writeOmpCompactionDisabledConfig(ompHome, overlay);
   return overlay;
 }
-function writeHermesIdentityPlugin(hermesHome, providerKeys) {
-  const dir = path15.join(hermesHome, "plugins", "model-providers", "bili-session-identity");
+function prepareHermesHome(hermesHome, origin, rewrites) {
+  if (rewrites.length === 0) return void 0;
+  const cfgPath = path15.join(hermesHome, "config.yaml");
+  let txt;
   try {
-    fs12.mkdirSync(dir, { recursive: true });
-    fs12.writeFileSync(path15.join(dir, "__init__.py"), hermesIdentityPluginSource(providerKeys));
-    fs12.writeFileSync(path15.join(dir, "plugin.yaml"), [
+    txt = fs12.readFileSync(cfgPath, "utf8");
+  } catch {
+    return void 0;
+  }
+  const wrapSet = new Set(rewrites.map((r) => r.realUpstream));
+  const eol = txt.includes("\r\n") ? "\r\n" : "\n";
+  const lines = txt.split(/\r?\n/);
+  let changed = false;
+  for (let i = 0; i < lines.length; i++) {
+    const rawLine = lines[i];
+    const m2 = /^(\s*(?:api|base_url|url):\s*)(\S+)(\s+#.*)?$/.exec(rawLine);
+    if (!m2) continue;
+    const rawUrl = m2[2].replace(/^["']|["']$/g, "");
+    if (!/^https?:\/\//i.test(rawUrl)) continue;
+    const real = unwrapUpstream2(rawUrl);
+    if (!wrapSet.has(real)) continue;
+    lines[i] = `${m2[1]}${wrapUpstream(origin, real)}${m2[3] ?? ""}`;
+    changed = true;
+  }
+  if (!changed) return void 0;
+  const overlay = `${hermesHome}-bili`;
+  if (!refreshOverlayHome(hermesHome, overlay, "config.yaml")) return void 0;
+  writeOverlayFileAtomic(overlay, "config.yaml", lines.join(eol));
+  return overlay;
+}
+function writeHermesIdentityPlugin(hermesHome, overlay, rewrites) {
+  try {
+    if (fs12.existsSync(path15.join(hermesHome, "plugins"))) return false;
+  } catch {
+    return false;
+  }
+  const dir = path15.join("plugins", "model-providers", "bili-session-identity");
+  try {
+    fs12.mkdirSync(path15.join(overlay, dir), { recursive: true });
+  } catch {
+    return false;
+  }
+  const keys = rewrites.map((r) => r.key);
+  const pluginDir = path15.join(overlay, dir);
+  try {
+    fs12.writeFileSync(path15.join(pluginDir, "__init__.py"), hermesIdentityPluginSource(keys));
+    fs12.writeFileSync(path15.join(pluginDir, "plugin.yaml"), [
       "name: bili-session-identity",
       "kind: model-provider",
       "version: 1.0.0",
@@ -63724,7 +63727,7 @@ function writeHermesIdentityPlugin(hermesHome, providerKeys) {
     return false;
   }
   try {
-    return fs12.existsSync(path15.join(dir, "__init__.py"));
+    return fs12.existsSync(path15.join(overlay, dir, "__init__.py"));
   } catch {
     return false;
   }
@@ -63947,17 +63950,6 @@ function stripInheritedProxy(env) {
   for (const key of INHERITED_PROXY_VARS) delete cleaned[key];
   return cleaned;
 }
-function stripLoopbackNoProxy(env) {
-  const out = { ...env };
-  for (const key of ["NO_PROXY", "no_proxy"]) {
-    const value = out[key];
-    if (typeof value !== "string" || value.length === 0) continue;
-    const kept = value.split(",").map((s3) => s3.trim()).filter((s3) => s3.length > 0 && !isLoopbackHost(s3));
-    if (kept.length > 0) out[key] = kept.join(",");
-    else delete out[key];
-  }
-  return out;
-}
 function proxyStartArgs(opts) {
   const args = ["start", "--host", opts.host, "--port", String(opts.port)];
   if (opts.passthrough) args.push("--passthrough");
@@ -64110,11 +64102,10 @@ async function runLaunch(params, deps = {}) {
   const base = baseClientName(params.client);
   const routes = discoverRoutes(base, config);
   const biliRoutes = loadRoutes(process.env);
-  const builtinDomains = base === "dsh" ? ["api.deepseek.com"] : [];
-  const domains = dedupeInOrder([...routes.httpsDomains, ...builtinDomains, ...params.mitmDomains ?? []]);
+  const domains = dedupeInOrder([...routes.httpsDomains, ...params.mitmDomains ?? []]);
   const handle2 = await ensureProxyRunning({ host, port, passthrough, debug, mitmDomains: domains, modelWindows: collectModelWindows(config, base) }, deps);
   console.error(
-    `bili: started proxy at ${handle2.origin} (MITM domains: ${domains.length ? domains.join(", ") : "defaults"})` + (routes.httpRewrites.length > 0 ? ` (HTTP /bili/ rewrites: ${routes.httpRewrites.length})` : "") + (routes.httpsRewrites.length > 0 ? ` (HTTPS cert rewrites: ${routes.httpsRewrites.length})` : "") + (routes.httpEnvRoutes.length > 0 ? ` (HTTP proxy-env routes: ${routes.httpEnvRoutes.length})` : "") + (params.client === "pi-test" ? " (no extensions)" : "")
+    `bili: started proxy at ${handle2.origin} (MITM domains: ${domains.length ? domains.join(", ") : "defaults"})` + (routes.httpRewrites.length > 0 ? ` (HTTP /bili/ rewrites: ${routes.httpRewrites.length})` : "") + (routes.httpsRewrites.length > 0 ? ` (HTTPS cert rewrites: ${routes.httpsRewrites.length})` : "") + (params.client === "pi-test" ? " (no extensions)" : "")
   );
   if (handle2.logPath) {
     console.error(`bili: proxy log: ${handle2.logPath}`);
@@ -64125,6 +64116,7 @@ async function runLaunch(params, deps = {}) {
   let piOverlayHome;
   let ompOverlayHome;
   let opencodeTmpFile;
+  let hermesOverlayHome;
   let dshOverlayHome;
   const tmpFiles = [];
   const directUrl = launcherDirectUrl(process.env);
@@ -64174,42 +64166,36 @@ async function runLaunch(params, deps = {}) {
     opencodeTmpFile = prepareOpencodeHttpRewrite(resolveOpencodeConfigFile(process.env), origin, routes.httpRewrites, routes.httpsRewrites, opencodePluginPath);
     if (opencodeTmpFile) env.OPENCODE_CONFIG = opencodeTmpFile;
   } else if (base === "hermes") {
-    env = stripLoopbackNoProxy({
-      ...process.env,
-      HTTPS_PROXY: origin,
-      HERMES_CA_BUNDLE: resolveCombinedCaPath(process.env),
-      ...routes.httpEnvRoutes.length > 0 ? { HTTP_PROXY: origin } : {}
-    });
-    if (routes.providerKeys.length > 0) {
-      if (!writeHermesIdentityPlugin(resolveHermesHome(process.env), routes.providerKeys)) {
+    env = { ...process.env };
+    hermesOverlayHome = prepareHermesHome(resolveHermesHome(process.env), origin, routes.httpRewrites);
+    if (hermesOverlayHome) {
+      env.HERMES_HOME = hermesOverlayHome;
+      if (!writeHermesIdentityPlugin(resolveHermesHome(process.env), hermesOverlayHome, routes.httpRewrites)) {
         console.error(
-          "bili: could not install the session-identity plugin into ~/.hermes/plugins \u2014 hermes requests will be rejected by the proxy without an identity (see #286)."
+          "bili: ~/.hermes has its own plugins/ \u2014 skipping the session-identity plugin; hermes requests will be rejected by the proxy without an identity (see #286)."
         );
       }
     } else {
       console.error(
-        "bili: no hermes providers found in ~/.hermes/config.yaml \u2014 LLM traffic will NOT go through the proxy (configure a provider first)."
+        routes.httpRewrites.length === 0 ? "bili: no hermes providers found in ~/.hermes/config.yaml \u2014 traffic will NOT go through the proxy (configure a provider first)." : "bili: hermes config.yaml could not be rewritten (unreadable or no matching provider endpoints) \u2014 traffic will NOT go through the proxy."
       );
     }
   } else if (base === "dsh") {
-    env = stripLoopbackNoProxy({
-      ...process.env,
-      BILLION_CONTEXT_PROXY: origin,
-      HTTPS_PROXY: origin,
-      NODE_EXTRA_CA_CERTS: ca,
-      ...routes.httpEnvRoutes.length > 0 ? { HTTP_PROXY: origin } : {}
-    });
+    env = { ...process.env, BILLION_CONTEXT_PROXY: origin };
+    env.DEEPSEEK_BASE_URL = wrapUpstream(origin, "https://api.deepseek.com");
     env.PI_CACHE_RETENTION = "long";
     const dshHomeDir = resolveDshHome(process.env);
-    if (routes.httpRewrites.length > 0) {
-      dshOverlayHome = prepareDshHome(dshHomeDir, origin, routes.httpRewrites);
-      if (dshOverlayHome) {
-        env.DSH_HOME = dshOverlayHome;
-      } else {
-        console.error(
-          "bili: dsh settings.yaml could not be rewritten (unreadable or no matching loopback endpoints) \u2014 loopback custom providers will NOT go through the proxy."
-        );
-      }
+    dshOverlayHome = prepareDshHome(dshHomeDir, origin, routes.httpRewrites);
+    if (dshOverlayHome) {
+      env.DSH_HOME = dshOverlayHome;
+    } else if (routes.httpRewrites.length > 0) {
+      console.error(
+        "bili: dsh settings.yaml could not be rewritten (unreadable or no matching endpoints) \u2014 custom providers will NOT go through the proxy; the built-in deepseek route still does."
+      );
+    } else {
+      console.error(
+        "bili: no custom providers found in ~/.dsh/settings.yaml \u2014 proxying the built-in deepseek route via DEEPSEEK_BASE_URL only."
+      );
     }
     const dshAcpPatch = writeDshAcpPatch(dshHomeDir);
     if (dshAcpPatch) clientArgs = dshArgsWithPatch(clientArgs, dshAcpPatch);