codefree-proxy 0.1.3 → 0.1.4

package/README.md

@@ -1,138 +1,90 @@
 # codefree-proxy
 
-OpenAI-compatible local proxy for SRD Cloud CodeFree.
+把本机 **CodeFree-O** 的登录态转换成一个本地 OpenAI 兼容接口，任何支持 OpenAI API 的客户端（Cherry Studio、Open WebUI、Continue、opencode 等）都能直接用研发云的模型。
 
-## Quick start
+只监听 `127.0.0.1`，不需要填 API Key。
 
-Run in the background:
+## 前置条件
 
-```bash
-npx codefree-proxy start --port 8788 --host 127.0.0.1
-```
-
-Or install globally:
+1. **Node.js >= 18**（`node -v` 检查）
+2. **本机已安装并登录 CodeFree-O**：先跑一次 `codefree-o login`，确认能正常对话
 
-```bash
-npm install -g codefree-proxy
-codefree-proxy start --port 8788 --host 127.0.0.1
-```
+代理不保存密码，也不需要你提供任何密钥：它读取 CodeFree-O 在本机的登录态（`~/.codefree-o/.../codefree.json`，AES-256-GCM 加密），用其中的 refresh token 换取访问令牌。因此 **CodeFree-O 必须先登录过**。
 
-Foreground mode is also available when you want logs printed in the current terminal:
+## 快速开始
 
 ```bash
-npx codefree-proxy --port 8788 --host 127.0.0.1
+npx codefree-proxy doctor    # 1. 自检：Node、登录态、端口、网络
+npx codefree-proxy start     # 2. 后台启动
 ```
 
-The server prints the local base URL and endpoints after it starts.
+启动后把客户端指向：
 
 ```text
-Server running at: http://127.0.0.1:8788
-OpenAI Base URL:  http://127.0.0.1:8788/v1
-Chat endpoint:   POST http://127.0.0.1:8788/v1/chat/completions
-Models endpoint: GET  http://127.0.0.1:8788/v1/models
-Health check:    GET  http://127.0.0.1:8788/health
-Stop command:    codefree-proxy stop --port 8788
+Base URL: http://127.0.0.1:8788/v1
+API Key:  随意填或留空
 ```
 
-Use this OpenAI-compatible base URL in clients:
-
-```text
-http://127.0.0.1:8788/v1
-```
-
-Use any API key value in OpenAI-compatible clients, or omit it if the client allows.
-
-## Login
-
-The proxy first tries existing local credentials. If credentials are missing, run:
+停止与查看：
 
 ```bash
-npx codefree-proxy login
+npx codefree-proxy status    # 登录态（只读，不会触发登录）
+npx codefree-proxy stop      # 停止 8788 上的代理
 ```
 
-The login flow matches CodeFree-O: it opens SRD Cloud OAuth in a browser, waits for the local callback, fetches `encryptedApiKey`, decrypts it, and saves credentials locally.
-
-Check current credential status:
-
-```bash
-npx codefree-proxy status
-```
+## 可用模型
 
-Remove saved credentials:
+- `DeepSeek-V4-Flash-0731`
+- `DeepSeek-V4.1-Flash-1017`（支持图片）
+- `GLM-5.2`
+- `GLM-5.3`
+- `Qwen3.8-27B`（支持图片）
 
-```bash
-npx codefree-proxy logout
-```
+写错模型名会直接返回 400 并列出可用模型，不会悄悄换成别的模型。
 
-## Background mode
+## 命令
 
-Start the server in the background:
+| 命令 | 说明 |
+| --- | --- |
+| `doctor` | 环境自检，输出 ✓/✗ 与结论 |
+| `serve` | 前台启动，日志打在终端 |
+| `start` | 后台启动，并确认端口真的监听成功 |
+| `login` | 从 CodeFree-O 导入登录态 |
+| `status` | 查看登录态（不写文件、不联网） |
+| `logout` | 删除本代理保存的登录态 |
+| `stop` | 停止代理（只停自己，端口被别的程序占用会拒绝） |
 
-```bash
-npx codefree-proxy start
-npx codefree-proxy start --port 8788 --host 127.0.0.1
-```
+通用选项：`--host`（默认 127.0.0.1）、`--port`（默认 8788）、`--timeout`（秒，默认 120）、`--no-mirror`、`--help`。
 
-Background logs are written to:
+## 接口
 
-```text
-~/.codefree-proxy/logs/proxy.log
-```
+- `POST /v1/chat/completions`（支持 `stream`）
+- `POST /v1/messages`（Anthropic 兼容）
+- `GET /v1/models`
+- `GET /health`
 
-The process id is written to:
+## 常见问题
 
-```text
-~/.codefree-proxy/proxy.pid
-```
+**提示"未找到可用的 CodeFree-O 登录态"**
+运行 `codefree-proxy login`：它会自动调用 `codefree-o login` 打开研发云登录页，登录成功后把登录态导入，再 `codefree-proxy start` 即可。
 
-## Stop the server
+**`codefree-proxy login` 是什么行为**
+有可导入的登录态就直接导入；没有就代跑一次原生 `codefree-o login`（会弹浏览器，需要你完成登录）。`start` / `serve` 不会自动弹浏览器，只在未登录时立刻报错并提示上一步。
 
-Default port:
+**提示"登录态已失效，无法续期"**
+CodeFree-O 的 refresh token 过期了，重新 `codefree-o login` 后重启代理。
 
-```bash
-npx codefree-proxy stop
-```
+**端口被占用**
+`codefree-proxy start --port 8789`，或按提示确认占用进程。
 
-Custom port:
+**不想让代理动 CodeFree-O 的登录态**
+默认会把轮换后的 token 回写到 CodeFree-O，让两边都能继续用。若你同时在跑原生 CLI，可加 `--no-mirror` 关闭回写（此时原生 CLI 可能需要重新登录）。
 
-```bash
-npx codefree-proxy stop --port 8788
-```
+**日志**
+`~/.codefree-proxy/logs/proxy.log`；登录态缓存在 `~/.codefree-proxy/config.json`（权限 0600）。
 
-## Commands
+## 更新
 
 ```bash
-codefree-proxy --port 8788 --host 127.0.0.1
-codefree-proxy start
-codefree-proxy start --port 8788 --host 127.0.0.1
-codefree-proxy login
-codefree-proxy logout
-codefree-proxy status
-codefree-proxy stop
-codefree-proxy stop --port 8788
+npm i -g codefree-proxy@latest
 ```
-
-## Endpoints
-
-- `POST /v1/chat/completions`
-- `GET /v1/models`
-- `GET /health`
-- `GET /auth/status`
-- `POST /auth/refresh`
-
-## Models
-
-- `GLM-5.1`
-- `GLM-4.7`
-- `Qwen3.5-122B-A10B`
-
-Unknown model names are mapped to `GLM-5.1`.
-
-## Credentials
-
-Credentials are stored at:
-
-- macOS/Linux: `~/.codefree-proxy/config.json`
-- Windows: `%USERPROFILE%\.codefree-proxy\config.json`
-
-The proxy can also import CodeFree-O credentials from `~/.codefree-o/.local/share/codefree.json` when available.

package/dist/auth/auth-manager.js

@@ -1,61 +1,141 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { deleteCredentials, loadCredentials, saveCredentials } from './config-store.js';
-import { loadCodeFreeOCredentials } from './codefree-o.js';
-import { authorizeWithBrowser } from './browser-login.js';
+import { inspectCodeFreeOStore, loadCodeFreeOCredentials } from './codefree-o.js';
+
+const CACHE_TTL_MS = 30_000;
+const NATIVE_KEEP_FIELDS = ['userId', 'refreshCfToken', 'refreshCfTokenExpiresAt', 'baseUrlSnapshot', 'clientId'];
+
+export function nativeCredentialPaths(homeDir = homedir()) {
+    return [
+        join(homeDir, '.codefree-o', '.local', 'share', 'codefree.json'),
+        join(homeDir, '.codefree-o', '.config', 'codefree.json'),
+    ];
+}
+
+export class CredentialsError extends Error {
+    constructor(message, detail = {}) {
+        super(message);
+        this.name = 'CredentialsError';
+        this.code = 'CODEFREE_NO_CREDENTIALS';
+        this.detail = detail;
+    }
+}
+
+const LOGIN_HINT = '请运行 codefree-proxy login 完成登录（它会调用 codefree-o login）。';
+
 export class AuthManager {
     cache = null;
+    cacheAt = 0;
     source;
+    nativeState = null;
     deps;
     constructor(deps = {}) {
         this.deps = {
             loadConfig: deps.loadConfig ?? loadCredentials,
             saveConfig: deps.saveConfig ?? saveCredentials,
             deleteConfig: deps.deleteConfig ?? deleteCredentials,
-            loadCodeFreeO: deps.loadCodeFreeO ?? loadCodeFreeOCredentials,
-            browserLogin: deps.browserLogin ?? authorizeWithBrowser
+            loadCodeFreeO: deps.loadCodeFreeO ?? ((path) => loadCodeFreeOCredentials(path)),
+            paths: deps.paths ?? nativeCredentialPaths()
+        };
+    }
+    /** Read every known CodeFree-O store; first usable one wins. */
+    async readNative() {
+        const checked = [];
+        for (const path of this.deps.paths) {
+            const info = await inspectCodeFreeOStore(path);
+            checked.push(info);
+            if (info.ok) {
+                const creds = await this.deps.loadCodeFreeO(path);
+                if (creds) {
+                    this.nativeState = { ok: true, path, checked, userId: creds.userId };
+                    return { creds, checked };
+                }
+                info.ok = false;
+                info.reason = '登录态无法读取，请重新运行 codefree-o login';
+            }
+        }
+        const credentialFile = checked.find((c) => c.exists && c.credentialFile);
+        this.nativeState = {
+            ok: false,
+            checked,
+            reason: credentialFile?.reason ?? `未找到 CodeFree-O 登录态文件（已检查 ${checked.map((c) => c.path).join('、')}）`
         };
+        return { creds: null, checked };
     }
     async getCredentials() {
-        if (this.cache)
+        if (this.cache && Date.now() - this.cacheAt < CACHE_TTL_MS)
             return this.cache;
         const config = await this.deps.loadConfig();
-        if (config) {
+        const { creds: native, checked } = await this.readNative();
+        if (native?.refreshCfToken) {
+            const preserved = {};
+            for (const field of NATIVE_KEEP_FIELDS) {
+                if (native[field] !== undefined)
+                    preserved[field] = native[field];
+            }
+            this.cache = { ...(config ?? {}), ...native, ...preserved };
+            this.cacheAt = Date.now();
+            this.source = config ? 'config+codefree-o' : 'codefree-o';
+            await this.deps.saveConfig(this.cache);
+            return this.cache;
+        }
+        if (config?.refreshCfToken) {
             this.cache = config;
+            this.cacheAt = Date.now();
             this.source = 'config';
             return config;
         }
-        const codefreeO = await this.deps.loadCodeFreeO();
-        if (codefreeO) {
-            this.cache = codefreeO;
-            this.source = 'codefree-o';
-            await this.deps.saveConfig(codefreeO);
-            return codefreeO;
+        if (config?.apiKey) {
+            throw new CredentialsError(`本机保存的是旧版 CodeFree-O 登录态（只有 apiKey，无法续期）。${LOGIN_HINT}`, { checked });
         }
-        return this.login();
+        const reason = this.nativeState?.reason ? `${this.nativeState.reason}。` : '';
+        const hint = reason.includes('codefree-proxy login') ? '' : LOGIN_HINT;
+        throw new CredentialsError(`未找到可用的 CodeFree-O 登录态。${reason}${hint}`, { checked });
     }
-    async login() {
-        const credentials = await this.deps.browserLogin();
-        this.cache = credentials;
-        this.source = 'browser';
-        await this.deps.saveConfig(credentials);
-        return credentials;
+    async invalidate() {
+        this.cache = null;
+        this.cacheAt = 0;
+        return true;
     }
     async logout() {
         this.cache = null;
+        this.cacheAt = 0;
         this.source = undefined;
         await this.deps.deleteConfig();
     }
     async refresh() {
-        this.cache = null;
+        this.invalidate();
         return this.getCredentials();
     }
+    /** Read-only: never logs in, never writes, never touches the network. */
     async status() {
-        try {
-            const credentials = await this.getCredentials();
-            return { status: 'ok', source: this.source, userId: credentials.userId };
-        }
-        catch {
-            return { status: 'missing' };
+        const config = await this.deps.loadConfig().catch(() => null);
+        const { checked } = await this.readNative();
+        const usable = Boolean(config?.refreshCfToken) || Boolean(this.nativeState?.ok);
+        return {
+            status: usable ? 'ok' : 'missing',
+            source: this.nativeState?.ok ? 'codefree-o' : (config?.refreshCfToken ? 'config' : null),
+            userId: this.nativeState?.userId ?? config?.userId ?? null,
+            codefreeO: this.nativeState?.ok
+                ? { ok: true, path: this.nativeState.path }
+                : { ok: false, reason: this.nativeState?.reason ?? '未找到登录态文件', checked: checked.map((c) => ({ path: c.path, exists: c.exists, ok: c.ok, reason: c.reason })) },
+            proxyConfig: config
+                ? { ok: Boolean(config.refreshCfToken), userId: config.userId ?? null, updatedAt: config.updatedAt ?? null }
+                : { ok: false },
+            ...(usable ? {} : { hint: LOGIN_HINT })
+        };
+    }
+    /** Explicit import of the native CodeFree-O store (used by `login`). */
+    async login() {
+        const { creds, checked } = await this.readNative();
+        if (!creds?.refreshCfToken) {
+            throw new CredentialsError(`未找到可导入的 CodeFree-O 登录态。${LOGIN_HINT}`, { checked });
         }
+        this.cache = creds;
+        this.cacheAt = Date.now();
+        this.source = 'codefree-o';
+        await this.deps.saveConfig(creds);
+        return creds;
     }
 }
-//# sourceMappingURL=auth-manager.js.map

package/dist/auth/codefree-o.js

@@ -1,25 +1,123 @@
-import { readFile } from 'node:fs/promises';
+import { readFile, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { createDecipheriv } from 'node:crypto';
-const AES_KEY = Buffer.from('Xtpa6sS&+D.NAo%CP8LA:7pk', 'utf8');
-const AES_IV = Buffer.from('%1KJIrl3!XUxr04V', 'utf8');
+import { createDecipheriv, createCipheriv, createHash, randomBytes } from 'node:crypto';
+// CodeFree-O >= 0.3 stores its refresh token as v1:<iv>:<ciphertext>:<tag>,
+// AES-256-GCM with a fixed local key derived from a constant string. The key is
+// part of the on-disk format, so every CodeFree-O build derives the same one.
+const MODERN_KEY = createHash('sha256')
+    .update('codefree-o-refresh-token-local-encryption-key-v1', 'utf8')
+    .digest();
 export function getCodeFreeOCredentialPath(homeDir = homedir()) {
     return join(homeDir, '.codefree-o', '.local', 'share', 'codefree.json');
 }
-export function decryptApiKey(encrypted) {
-    const decipher = createDecipheriv('aes-192-cbc', AES_KEY, AES_IV);
-    return Buffer.concat([decipher.update(Buffer.from(encrypted, 'base64')), decipher.final()]).toString('utf8');
+export function decryptRefreshCfToken(encrypted) {
+    const parts = String(encrypted).split(':');
+    if (parts.length !== 4 || parts[0] !== 'v1')
+        throw new Error('unsupported token format');
+    const decipher = createDecipheriv('aes-256-gcm', MODERN_KEY, Buffer.from(parts[1], 'base64'));
+    decipher.setAuthTag(Buffer.from(parts[3], 'base64'));
+    return Buffer.concat([decipher.update(Buffer.from(parts[2], 'base64')), decipher.final()]).toString('utf8');
+}
+export function encryptRefreshCfToken(refreshCfToken) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', MODERN_KEY, iv);
+    const ciphertext = Buffer.concat([cipher.update(String(refreshCfToken), 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `v1:${iv.toString('base64')}:${ciphertext.toString('base64')}:${tag.toString('base64')}`;
+}
+/**
+ * Persist a rotated refresh token back into the native CodeFree-O store so the
+ * native CLI keeps working after the proxy refreshes. Merges into the existing
+ * file (mode 0600) instead of replacing it, so userId/version survive.
+ */
+export async function saveCodeFreeORefreshToken(refreshCfToken, refreshCfTokenExpiresAt, path = getCodeFreeOCredentialPath()) {
+    let existing = {};
+    try {
+        existing = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    const next = {
+        ...existing,
+        encryptedRefreshCfToken: encryptRefreshCfToken(refreshCfToken),
+        refreshCfTokenExpiresAt: Number(refreshCfTokenExpiresAt) || existing.refreshCfTokenExpiresAt || 0
+    };
+    delete next.refreshCfToken;
+    await writeFile(path, JSON.stringify(next), { mode: 0o600 });
+    return true;
+}
+/**
+ * Read-only inspection for `doctor` / `status`. Never throws; reports why a
+ * store cannot be used so the CLI can fail fast with an actionable message.
+ */
+export async function inspectCodeFreeOStore(path = getCodeFreeOCredentialPath()) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        const code = error?.code;
+        return {
+            path,
+            exists: false,
+            ok: false,
+            reason: code === 'ENOENT'
+                ? '未找到 CodeFree-O 登录态文件，请运行 codefree-proxy login 完成登录'
+                : `读取 CodeFree-O 登录态文件失败（${code ?? 'unknown'}）`
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { path, exists: true, ok: false, reason: 'CodeFree-O 登录态文件不是合法 JSON，请运行 codefree-proxy login 重新登录' };
+    }
+    const encrypted = parsed.encryptedRefreshCfToken;
+    const userId = parsed.userId ? String(parsed.userId) : undefined;
+    if (!encrypted) {
+        return { path, exists: true, ok: false, userId, credentialFile: Boolean(parsed.encryptedApiKey || parsed.refreshCfToken),
+            reason: parsed.encryptedApiKey || parsed.refreshCfToken
+                ? '登录态里没有 refreshCfToken（CodeFree-O 版本过旧），请升级 CodeFree-O 后重新登录'
+                : '该文件不是 CodeFree-O 登录态（缺少 refreshCfToken）' };
+    }
+    let token;
+    try {
+        token = decryptRefreshCfToken(encrypted);
+    }
+    catch (error) {
+        return { path, exists: true, ok: false, userId, credentialFile: true,
+            reason: `登录态无法解密（${error?.message ?? '格式不支持'}），请运行 codefree-proxy login 重新登录` };
+    }
+    if (!token) {
+        return { path, exists: true, ok: false, userId, credentialFile: true, reason: '登录态里的 refreshCfToken 为空，请运行 codefree-proxy login 重新登录' };
+    }
+    const expiresAt = Number(parsed.refreshCfTokenExpiresAt) || 0;
+    return {
+        path,
+        exists: true,
+        ok: true,
+        userId,
+        expiresAt,
+        expiresAtIso: expiresAt > 0 ? new Date(expiresAt).toISOString() : undefined
+    };
 }
 export async function loadCodeFreeOCredentials(path = getCodeFreeOCredentialPath()) {
     try {
         const parsed = JSON.parse(await readFile(path, 'utf8'));
-        if (!parsed.userId || !parsed.encryptedApiKey)
+        if (!parsed.userId || !parsed.encryptedRefreshCfToken)
+            return null;
+        const refreshCfToken = decryptRefreshCfToken(parsed.encryptedRefreshCfToken);
+        if (typeof refreshCfToken !== 'string' || refreshCfToken.length === 0)
             return null;
         return {
-            userId: parsed.userId,
-            apiKey: decryptApiKey(parsed.encryptedApiKey),
-            sessionId: parsed.sessionId ?? '',
+            userId: String(parsed.userId),
+            refreshCfToken,
+            refreshCfTokenExpiresAt: Number(parsed.refreshCfTokenExpiresAt) || 0,
+            ...(parsed.baseUrlSnapshot ? { baseUrlSnapshot: parsed.baseUrlSnapshot } : {}),
+            ...(parsed.clientId ? { clientId: parsed.clientId } : {}),
             updatedAt: Date.now()
         };
     }
@@ -27,4 +125,3 @@ export async function loadCodeFreeOCredentials(path = getCodeFreeOCredentialPath
         return null;
     }
 }
-//# sourceMappingURL=codefree-o.js.map

package/dist/auth/config-store.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 function isStoredCredentials(value) {
@@ -27,8 +27,18 @@ export async function loadCredentials(path = getConfigPath()) {
     }
 }
 export async function saveCredentials(credentials, path = getConfigPath()) {
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify(credentials, null, 2)}\n`, 'utf8');
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    let previous = {};
+    try {
+        previous = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        // A first login has no prior record; write the new credentials below.
+    }
+    const merged = { ...previous, ...credentials };
+    // Credentials file holds cfToken / refreshCfToken: keep it owner-only.
+    await writeFile(path, `${JSON.stringify(merged, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await chmod(path, 0o600).catch(() => { });
 }
 export async function deleteCredentials(path = getConfigPath()) {
     await rm(path, { force: true });