codexunlimit 0.0.0-stage → 0.1.0-web.10

package/config.mjs

@@ -0,0 +1,184 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+const BEGIN='# BEGIN Codexunlimit Web managed configuration';
+const END='# END Codexunlimit Web managed configuration';
+const PREVIOUS='# Codexunlimit Web saved root line: ';
+const ROOT_KEYS=new Set(['openai_base_url','model_provider','model_catalog_json']);
+const digest=value=>crypto.createHash('sha256').update(value).digest('hex');
+
+function rootKey(line){
+  const m=/^\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))\s*=/.exec(line);
+  return m?.[1]??m?.[2]??m?.[3];
+}
+function splitRoot(text){
+  const lines=text.split('\n');let end=lines.length;
+  for(let i=0;i<lines.length;i++){
+    const line=lines[i].trim();
+    if(line.startsWith('#'))continue;
+    if(line.startsWith('[')){end=i;break;}
+    // Cấu hình root nhiều dòng cần được người dùng kiểm tra; không sửa bằng suy đoán.
+    if(line.includes('"""')||line.includes("'''"))throw Error('multiline_root_config_requires_manual_setup');
+  }
+  return {lines,end};
+}
+function layout(text){
+  const bom=text.startsWith('\uFEFF')?'\uFEFF':'',crlf=text.includes('\r\n');
+  const {lines,end}=splitRoot(text.slice(bom.length).replace(/\r\n/g,'\n'));
+  const fields=new Map();
+  for(let i=0;i<end;i++){
+    const key=rootKey(lines[i]);
+    if(!ROOT_KEYS.has(key)&&key!=='profile')continue;
+    if(fields.has(key))throw Error('duplicate_provider_settings_review_required');
+    const value=lines[i].slice(lines[i].indexOf('=')+1).trim();
+    const match=/^(?:"([^"\\]*)"|'([^']*)')\s*(?:#.*)?$/.exec(value);
+    fields.set(key,{line:i,value:match?.[1]??match?.[2]});
+  }
+  return {bom,crlf,lines,end,fields,join:lines=>bom+(crlf?lines.join('\n').replace(/\n/g,'\r\n'):lines.join('\n'))};
+}
+function directRouting(text){
+  const {fields}=layout(text);
+  return !fields.has('profile')&&!fields.has('openai_base_url')&&!fields.has('model_catalog_json')&&
+    (!fields.has('model_provider')||fields.get('model_provider').value==='openai');
+}
+function directConfiguration(text,previous){
+  if(!directRouting(text))return null;
+  if(![BEGIN,END,PREVIOUS].some(marker=>text.includes(marker)))return text;
+  const {lines,end,join}=layout(text),source=layout(verifiedOriginal(previous));
+  const saved=source.lines.slice(0,source.end).filter(line=>ROOT_KEYS.has(rootKey(line)));
+  const begin=lines.filter(line=>line.trim()===BEGIN).length,finish=lines.filter(line=>line.trim()===END).length;
+  if(begin!==finish||begin>1)throw Error('managed_configuration_changed_review_required');
+  const filtered=lines.filter((line,i)=>{
+    const stripped=line.trimStart();
+    if(![BEGIN,END].includes(line.trim())&&!stripped.startsWith(PREVIOUS))return true;
+    if(i>=end)throw Error('managed_configuration_changed_review_required');
+    if(stripped.startsWith(PREVIOUS)&&!saved.some(value=>PREVIOUS+Buffer.from(value).toString('base64')===stripped))
+      throw Error('saved_root_line_corrupt');
+    return false;
+  });
+  // Reset có thể để lại comment của relay; chỉ bỏ metadata, không phục hồi provider cũ.
+  return join(filtered);
+}
+function verifiedOriginal(previous){
+  try{
+    if(fs.lstatSync(previous.backup).isSymbolicLink())throw Error();
+    const original=fs.readFileSync(previous.backup,'utf8');
+    if(digest(original)!==previous.original_hash)throw Error();
+    return original;
+  }catch{throw Error('config_backup_missing_or_changed_review_required');}
+}
+export function managedConfig(original,baseUrl){
+  if(original.includes('# BEGIN TDH Relay')||original.includes('# BEGIN Codexunlimit managed'))throw Error('existing_connector_review_required');
+  if(original.includes(BEGIN)||original.includes(END)||original.includes(PREVIOUS))throw Error('managed_configuration_already_present');
+  const bom=original.startsWith('\uFEFF')?'\uFEFF':'',crlf=original.includes('\r\n');
+  const {lines,end}=splitRoot(original.slice(bom.length).replace(/\r\n/g,'\n'));
+  const root=lines.slice(0,end).map(line=>ROOT_KEYS.has(rootKey(line))?PREVIOUS+Buffer.from(line).toString('base64'):line);
+  const block=[BEGIN,'openai_base_url = '+JSON.stringify(baseUrl),'model_provider = "openai"',END].join('\n');
+  let result=[block,...root,...lines.slice(end)].join('\n');
+  if(crlf)result=result.replace(/\n/g,'\r\n');
+  return bom+result;
+}
+export function restoreConfig(current,baseUrl,{original}={}){
+  const {lines,end,fields,join}=layout(current);
+  const begins=[],ends=[];
+  lines.forEach((line,i)=>{if(line.trim()===BEGIN)begins.push(i);if(line.trim()===END)ends.push(i);});
+  const marked=begins.length===1&&ends.length===1&&begins[0]<ends[0]&&ends[0]<end;
+  const unmarked=begins.length===0&&ends.length===0&&original!==undefined;
+  if(!marked&&!unmarked||fields.get('openai_base_url')?.value!==baseUrl||fields.get('model_provider')?.value!=='openai')
+    throw Error('managed_configuration_changed_review_required');
+  if(fields.has('model_catalog_json'))throw Error('new_provider_settings_review_required');
+  const source=original===undefined?null:layout(original);
+  const expected=source?.lines.slice(0,source.end).filter(line=>ROOT_KEYS.has(rootKey(line)))??null;
+  const restored=new Set(),result=[];
+  for(let i=0;i<lines.length;i++){
+    const line=lines[i];
+    if(begins.includes(i)||ends.includes(i)||i<end&&ROOT_KEYS.has(rootKey(line)))continue;
+    if(!line.trimStart().startsWith(PREVIOUS)){result.push(line);continue;}
+    if(i>=end)throw Error('saved_root_line_moved');
+    const encoded=line.trimStart().slice(PREVIOUS.length);
+    if(!/^[A-Za-z0-9+/]*={0,2}$/.test(encoded))throw Error('saved_root_line_corrupt');
+    const decoded=Buffer.from(encoded,'base64').toString('utf8');
+    const key=rootKey(decoded);
+    if(!ROOT_KEYS.has(key)||/[\r\n]/.test(decoded)||restored.has(key)||expected&&!expected.includes(decoded))throw Error('saved_root_line_corrupt');
+    restored.add(key);result.push(decoded);
+  }
+  // Nếu trình ghi TOML đã bỏ comment, lấy đúng root cũ từ backup đã kiểm tra hash.
+  if(expected)result.unshift(...expected.filter(line=>!restored.has(rootKey(line))));
+  return join(result);
+}
+function atomicWrite(file,content){
+  const temporary=file+'.cu-'+crypto.randomBytes(6).toString('hex');
+  fs.writeFileSync(temporary,content,{mode:0o600,flag:'wx'});
+  try{fs.renameSync(temporary,file);}catch(error){fs.unlinkSync(temporary);throw error;}
+}
+function backupConfig(state,original,label='codex-config'){
+  const backupDir=path.join(state.home,'backups');fs.mkdirSync(backupDir,{recursive:true,mode:0o700});
+  const backup=path.join(backupDir,label+'-'+Date.now()+'-'+crypto.randomBytes(4).toString('hex')+'.toml');
+  fs.writeFileSync(backup,original,{mode:0o600,flag:'wx'});return backup;
+}
+export function syncCodex(state){
+  const codexHome=state.get('codex_home');
+  if(!codexHome)throw Error('codex_home_missing');
+  fs.mkdirSync(codexHome,{recursive:true,mode:0o700});
+  const file=path.join(codexHome,'config.toml');
+  if(fs.existsSync(file)&&fs.lstatSync(file).isSymbolicLink())throw Error('config_symlink_requires_manual_setup');
+  const original=fs.existsSync(file)?fs.readFileSync(file,'utf8'):'';
+  const baseUrl='http://127.0.0.1:'+state.settings.get('relay.port')+'/v1';
+  const previous=state.get('codex_sync');
+  if(previous&&(path.resolve(previous.file)!==path.resolve(file)||previous.baseUrl!==baseUrl))throw Error('config_target_changed_review_required');
+  if(layout(original).fields.has('profile'))throw Error('active_codex_profile_requires_manual_setup');
+  const direct=previous?directConfiguration(original,previous):null;
+  if(previous&&direct===null){
+    const restored=restoreConfig(original,baseUrl,{original:verifiedOriginal(previous)});
+    const next=managedConfig(restored,baseUrl);
+    if(next===original)return {changed:false,file};
+    const backup=backupConfig(state,original,'codex-config-before-repair');
+    atomicWrite(file,next);
+    state.set('codex_sync',{...previous,managed_hash:digest(next),repair_backup:backup});
+    return {changed:true,file,backup,recovery:'equivalent_configuration'};
+  }
+  const baseline=direct??original;
+  const repairBackup=baseline!==original?backupConfig(state,original,'codex-config-before-repair'):null;
+  const next=managedConfig(baseline,baseUrl);
+  const backup=backupConfig(state,baseline);
+  state.set('codex_sync',{file,baseUrl,backup,original_hash:digest(baseline),managed_hash:digest(next),...(repairBackup?{repair_backup:repairBackup}:{})});
+  try{atomicWrite(file,next);}catch(error){state.set('codex_sync',previous);throw error;}
+  return {changed:true,file,backup,...(previous?{recovery:'direct_configuration'}:{})};
+}
+export function unsyncCodex(state){
+  const previous=state.get('codex_sync');
+  if(!previous)return {changed:false};
+  if(fs.lstatSync(previous.file).isSymbolicLink())throw Error('config_symlink_requires_manual_setup');
+  const current=fs.readFileSync(previous.file,'utf8');
+  const direct=directConfiguration(current,previous);
+  if(direct!==null){
+    if(direct!==current){backupConfig(state,current,'codex-config-before-repair');atomicWrite(previous.file,direct);}
+    state.set('codex_sync',null);return {changed:direct!==current,file:previous.file,recovery:'already_direct_configuration'};
+  }
+  atomicWrite(previous.file,restoreConfig(current,previous.baseUrl,{original:verifiedOriginal(previous)}));
+  state.set('codex_sync',null);
+  return {changed:true,file:previous.file};
+}
+export function codexConnection(state){
+  const previous=state.get('codex_sync');
+  try{
+    const codexHome=state.get('codex_home');if(!codexHome)throw Error('codex_home_missing');
+    const file=path.join(codexHome,'config.toml');
+    if(fs.existsSync(file)&&fs.lstatSync(file).isSymbolicLink())throw Error('config_symlink_requires_manual_setup');
+    const current=fs.existsSync(file)?fs.readFileSync(file,'utf8'):'';
+    const baseUrl='http://127.0.0.1:'+state.settings.get('relay.port')+'/v1';
+    if(layout(current).fields.has('profile'))throw Error('active_codex_profile_requires_manual_setup');
+    if(previous){
+      if(path.resolve(previous.file)!==path.resolve(file)||previous.baseUrl!==baseUrl)throw Error('config_target_changed_review_required');
+      if(directConfiguration(current,previous)!==null)return {configured:false,managed:true,repairable:true};
+      restoreConfig(current,baseUrl,{original:verifiedOriginal(previous)});
+      return {configured:true,managed:true,repairable:true};
+    }
+    managedConfig(current,baseUrl);
+    return {configured:false,managed:false,repairable:true};
+  }catch(error){
+    const code=['EACCES','EPERM','EBUSY'].includes(error.code)?'config_permission_denied':error.code==='ENOENT'?'config_missing':error.message;
+    return {configured:false,managed:!!previous,repairable:false,error:code};
+  }
+}

package/device.ps1

@@ -0,0 +1,22 @@
+$ErrorActionPreference = 'Stop'
+try {
+    $Request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+    Add-Type -AssemblyName System.Security
+    if ($Request.action -eq 'identity') {
+        $Value = (Get-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Cryptography' -Name MachineGuid).MachineGuid
+    } elseif ($Request.action -eq 'protect' -or $Request.action -eq 'unprotect') {
+        $Bytes = [Convert]::FromBase64String($Request.value)
+        $Entropy = [Text.Encoding]::UTF8.GetBytes('CodexunlimitWeb.device.v1')
+        if ($Request.action -eq 'protect') {
+            $Result = [Security.Cryptography.ProtectedData]::Protect($Bytes,$Entropy,[Security.Cryptography.DataProtectionScope]::CurrentUser)
+        } else {
+            $Result = [Security.Cryptography.ProtectedData]::Unprotect($Bytes,$Entropy,[Security.Cryptography.DataProtectionScope]::CurrentUser)
+        }
+        $Value = [Convert]::ToBase64String($Result)
+        [Array]::Clear($Bytes,0,$Bytes.Length)
+    } else { throw 'unsupported_action' }
+    [Console]::Out.Write($Value)
+} catch {
+    [Console]::Error.Write('device_protection_failed')
+    exit 1
+}

package/doctor.mjs

@@ -0,0 +1,20 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {execFileSync} from 'node:child_process';
+import {codexExecutable} from './codex-account-client.mjs';
+import {VERSION} from './product.mjs';
+
+export async function diagnoseRuntime(){
+  const version=process.versions.node.split('.').map(Number),checks=[{name:'Node.js',ok:version[0]===22&&version[1]>=15||version[0]>=24,version:process.versions.node},{name:'Codex Unlimit',ok:true,version:VERSION}];
+  try{await import('node:sqlite');checks.push({name:'SQLite',ok:true});}catch{checks.push({name:'SQLite',ok:false});}
+  const home=fs.mkdtempSync(path.join(os.tmpdir(),'cu-runtime-check-'));
+  try{
+    const env={...process.env,CODEX_HOME:home};for(const key of Object.keys(env))if(/^(OPENAI_|CHATGPT_|CODEX_API_KEY|NODE_OPTIONS|NODE_PATH|NODE_AUTH_TOKEN)/i.test(key))delete env[key];
+    const expected=JSON.parse(fs.readFileSync(new URL('./package.json',import.meta.url),'utf8')).dependencies['@openai/codex'];
+    const output=execFileSync(codexExecutable(),['--version'],{env,encoding:'utf8',windowsHide:true,timeout:20000,stdio:['ignore','pipe','pipe']});
+    const actual=output.match(/codex-cli (\d+\.\d+\.\d+)/)?.[1];checks.push({name:'Codex runtime',ok:actual===expected,...(actual?{version:actual}:{})});
+  }catch{checks.push({name:'Codex runtime',ok:false});}
+  finally{if(path.dirname(home)===os.tmpdir())fs.rmSync(home,{recursive:true,force:true,maxRetries:5,retryDelay:100});}
+  return {ok:checks.every(check=>check.ok),platform:process.platform,architecture:process.arch,checks,accountCredentialsRead:false};
+}

package/image-http.mjs

@@ -0,0 +1,22 @@
+import http from 'node:http';
+import https from 'node:https';
+import {Readable} from 'node:stream';
+
+export const isImageRoute=route=>/^\/(?:v1\/)?images\/(?:generations|edits)$/.test(route);
+export function imageRequest(value,options={}){
+  const url=new URL(value);
+  if(url.username||url.password||url.hash||url.search||!isImageRoute(url.pathname)||!(url.protocol==='https:'||url.protocol==='http:'&&url.hostname==='127.0.0.1'))throw Error('image_destination_denied');
+  const body=Buffer.from(options.body??''),headers=new Headers(options.headers);headers.set('content-length',String(body.length));headers.set('accept-encoding','identity');
+  for(const name of ['host','proxy-authorization','proxy-connection'])headers.delete(name);
+  return new Promise((resolve,reject)=>{
+    const request=(url.protocol==='https:'?https:http).request(url,{method:'POST',headers:Object.fromEntries(headers),signal:options.signal,agent:false,rejectUnauthorized:true},response=>{
+      clearTimeout(timer);const responseHeaders=new Headers();
+      for(const [name,value]of Object.entries(response.headers))if(value!==undefined)responseHeaders.set(name,Array.isArray(value)?value.join(', '):String(value));
+      if([204,205,304].includes(response.statusCode)){response.resume();resolve(new Response(null,{status:response.statusCode,headers:responseHeaders}));}
+      else resolve(new Response(Readable.toWeb(response),{status:response.statusCode,headers:responseHeaders}));
+    });
+    const timer=setTimeout(()=>request.destroy(Error('image_header_timeout')),600000);timer.unref();
+    request.once('error',error=>{clearTimeout(timer);reject(error);});request.end(body);
+  });
+}
+export const gatewayRequest=(url,options)=>isImageRoute(new URL(url).pathname)?imageRequest(url,options):fetch(url,options);

package/io.mjs

@@ -0,0 +1,5 @@
+export async function boundedJson(response,limit,code='invalid_remote_response'){
+  const chunks=[];let size=0;
+  for await(const chunk of response.body){size+=chunk.length;if(size>limit)throw Object.assign(Error(code),{status:502});chunks.push(chunk);}
+  try{return JSON.parse(Buffer.concat(chunks).toString('utf8'));}catch{throw Object.assign(Error(code),{status:502});}
+}

package/license-client.mjs

@@ -0,0 +1,150 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import {execFileSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {LICENSE_PUBLIC_KEY,LICENSE_ORIGIN} from './product.mjs';
+import {hash,publicText,signProof,verifyEnvelope} from './protocol.mjs';
+import {boundedJson} from './io.mjs';
+class RelayError extends Error{constructor(status,code){super(code);this.status=status;this.code=code;}}
+const TERMINAL_DENIALS=new Set(['license_invalid_or_expired','device_revoked','activation_invalid','device_already_bound_or_revoked']);
+const LOCAL_DENIALS=new Set(['activation_required','license_signature_invalid','clock_rollback_detected','license_invalid_or_expired','license_revoked']);
+function serviceError(code,status=503,retryAfter=1){const error=new RelayError(status,code);error.transient=true;error.authoritative=false;error.retryAfter=retryAfter;return error;}
+function normalizeFailure(error){
+  const code=typeof error?.code==='string'?error.code:error?.message;
+  if(code==='license_lease_expired')return serviceError(code,503,error?.retryAfter??1);
+  if(error?.transient||error?.status>=500||error?.status===429||['license_server_unavailable','license_response_invalid','license_service_busy','try_later','ingress_rate_limit','ingress_busy','ingress_capacity'].includes(code))return serviceError(code==='license_service_busy'||error?.status===429?'license_service_busy':'license_server_unavailable',error?.status===429?429:503,error?.retryAfter??1);
+  if(TERMINAL_DENIALS.has(code)||LOCAL_DENIALS.has(code)){const failure=new RelayError(403,code);failure.authoritative=error?.authoritative!==false;return failure;}
+  return serviceError('license_server_unavailable');
+}
+
+function windowsDevice(action,value){
+  const executable=path.join(process.env.SystemRoot??'C:/Windows','System32/WindowsPowerShell/v1.0/powershell.exe');
+  try{return execFileSync(executable,['-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',fileURLToPath(new URL('./device.ps1',import.meta.url))],
+    {input:JSON.stringify({action,value}),encoding:'utf8',windowsHide:true,timeout:15000,stdio:['pipe','pipe','pipe']}).trim();}
+  catch{throw Error('device_protection_failed');}
+}
+export function machineIdentity(){
+  let value;
+  if(process.platform==='win32')value=windowsDevice('identity');
+  else if(process.platform==='darwin'){
+    const text=execFileSync('/usr/sbin/ioreg',['-rd1','-c','IOPlatformExpertDevice'],{encoding:'utf8',timeout:10000});
+    value=text.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)?.[1];
+  }else{
+    const file=fs.existsSync('/run/tdh-machine-id')?'/run/tdh-machine-id':'/etc/machine-id';
+    value=fs.readFileSync(file,'utf8').trim();
+  }
+  if(!value||value.length<16)throw Error('stable_machine_identity_required');
+  return hash('cu-web-device-v1:'+process.platform+':'+value.trim().toLowerCase());
+}
+export function loadDevice(state){
+  const deviceId=machineIdentity();let saved=state.get('license.device');
+  if(!saved){
+    const pair=crypto.generateKeyPairSync('ed25519');
+    const raw=pair.privateKey.export({type:'pkcs8',format:'der'}).toString('base64');
+    saved={deviceId,publicKey:publicText(pair.privateKey),format:process.platform==='win32'?'dpapi':'owner-permissions',
+      privateKey:process.platform==='win32'?windowsDevice('protect',raw):raw};
+    state.set('license.device',saved);
+  }
+  if(saved.deviceId!==deviceId)throw Error('activation_belongs_to_another_device');
+  const raw=saved.format==='dpapi'?windowsDevice('unprotect',saved.privateKey):saved.privateKey;
+  const privateKey=crypto.createPrivateKey({key:Buffer.from(raw,'base64'),format:'der',type:'pkcs8'});
+  if(publicText(privateKey)!==saved.publicKey)throw Error('device_key_mismatch');
+  return {deviceId,publicKey:saved.publicKey,privateKey};
+}
+export async function requestLicense(route,body,{request=fetch}={}){
+  if(!['challenge','activate','renew'].includes(route))throw Error('invalid_license_route');
+  let response;
+  try{response=await request(LICENSE_ORIGIN+'/api/licenses/'+route,{method:'POST',redirect:'error',
+    headers:{'content-type':'application/json'},body:JSON.stringify(body),signal:AbortSignal.timeout(10000)});}
+  catch{throw serviceError('license_server_unavailable');}
+  if(response.status===429||response.status>=500||response.status===408){response.body?.cancel().catch(()=>{});const value=Number(response.headers.get('retry-after'));throw serviceError(response.status===429?'license_service_busy':'license_server_unavailable',response.status===429?429:503,Number.isFinite(value)&&value>0?Math.min(60,Math.ceil(value)):1);}
+  let data;try{data=await boundedJson(response,16384,'license_response_invalid');}catch{throw serviceError('license_response_invalid');}
+  if(!response.ok){const error=new RelayError(403,typeof data.error==='string'&&/^[a-z_]+$/.test(data.error)?data.error:'license_request_rejected');error.authoritative=true;throw error;}
+  return data;
+}
+export class LicenseClient {
+  constructor(state,{publicKey=LICENSE_PUBLIC_KEY,request=requestLicense,device,now=Date.now}={}){
+    this.state=state;this.publicKey=publicKey;this.request=request;this.device=device??loadDevice(state);this.now=now;this.pending=null;this.nextAttempt=0;this.lastFailure=null;this.failures=0;
+    this.wallStart=now();this.monotonicStart=performance.now();
+  }
+  check(envelope=this.state.get('license.lease'),feature='desktop',{allowExpired=false}={}){
+    let claims;try{claims=verifyEnvelope(envelope,this.publicKey);}catch{throw Error('license_signature_invalid');}
+    const now=this.now(),last=this.state.get('license.clock')??0;
+    if(now<last-30000||now<this.wallStart+performance.now()-this.monotonicStart-30000)throw Error('clock_rollback_detected');
+    if(claims.kind!=='tdh-relay-lease-v1'||claims.product!=='tdh-relay'||claims.deviceId!==this.device.deviceId||
+      claims.keyHash!==hash(this.device.publicKey)||!Array.isArray(claims.features)||!claims.features.includes(feature)||!Number.isFinite(claims.licenseExpiresAt)||
+      !Number.isFinite(claims.issuedAt)||!Number.isFinite(claims.expiresAt)||claims.issuedAt>now+60000||
+      claims.expiresAt<=claims.issuedAt||claims.expiresAt>claims.issuedAt+600000||claims.expiresAt>claims.licenseExpiresAt)throw Error('license_invalid_or_expired');
+    if(!allowExpired&&claims.expiresAt<=now)throw serviceError('license_lease_expired');
+    if(now>last+10000)this.state.set('license.clock',now);
+    return claims;
+  }
+  async proof(action){
+    const challenge=await this.request('challenge',{deviceId:this.device.deviceId,publicKey:this.device.publicKey});
+    if(typeof challenge.id!=='string'||typeof challenge.nonce!=='string'||challenge.nonce.length>100)throw Error('challenge_invalid');
+    return {challengeId:challenge.id,proof:signProof(action,challenge.nonce,this.device.deviceId,this.device.publicKey,this.device.privateKey)};
+  }
+  save(response){
+    const claims=this.check(response.lease);
+    this.state.transaction(()=>{this.state.set('license.lease',response.lease);this.state.set('license.activation',claims.activationId);this.state.set('license.denied',false);});
+    this.nextAttempt=0;this.lastFailure=null;this.failures=0;return claims;
+  }
+  async activate(key){
+    if(typeof key!=='string'||!/^TDH-[A-Za-z0-9_-]{32}$/.test(key.trim()))throw Error('invalid_activation_key');
+    key=key.trim();const proof=await this.proof('activate:'+hash(key));
+    return this.save(await this.request('activate',{...proof,key}));
+  }
+  async renew(){
+    if(this.pending)return this.pending;
+    const activationId=this.state.get('license.activation');if(!activationId)throw Error('activation_required');
+    this.pending=(async()=>{
+      try{
+        for(let attempt=0;;attempt++){
+          const proof=await this.proof('renew:'+activationId);
+          const response=await this.request('renew',{...proof,activationId});
+          try{return this.save(response);}
+          catch(error){error.authoritative=false;if(error.code!=='license_lease_expired'||attempt>=1)throw error;}
+        }
+      }catch(error){
+        const failure=normalizeFailure(error);this.lastFailure=failure;
+        if(TERMINAL_DENIALS.has(failure.code)&&failure.authoritative){
+          this.state.set('license.denied',true);this.state.set('license.lease',null);
+        }
+        this.failures=Math.min(this.failures+1,6);const delay=failure.transient?Math.max((failure.retryAfter??1)*1000,Math.min(30000,1000*2**(this.failures-1))):30000;
+        this.nextAttempt=this.now()+delay;failure.retryAfter=Math.ceil(delay/1000);throw failure;
+      }finally{this.pending=null;}
+    })();
+    return this.pending;
+  }
+  async ensure(feature='desktop',{online=false}={}){
+    let current;try{if(!this.state.get('license.denied'))current=this.check(undefined,feature);}catch{}
+    if(online||!current||current.expiresAt-this.now()<300000){
+      if(this.now()>=this.nextAttempt){
+        try{await this.renew();}
+        catch(error){if(!current||this.state.get('license.denied')||online)throw normalizeFailure(error);}
+      }else if((!current||online)&&this.lastFailure)throw this.lastFailure;
+    }
+    if(this.state.get('license.denied'))throw new RelayError(403,'license_revoked');
+    try{return this.check(undefined,feature);}catch(error){if(this.lastFailure?.transient)throw this.lastFailure;throw normalizeFailure(error);}
+  }
+  async forRequest(feature='desktop'){
+    try{if(!this.state.get('license.denied'))return this.check(undefined,feature,{allowExpired:true});}catch{}
+    return this.ensure(feature);
+  }
+  acceptLease(encoded){
+    if(typeof encoded!=='string'||encoded.length>4096||this.state.get('license.denied'))return false;
+    try{
+      const envelope=JSON.parse(Buffer.from(encoded,'base64url')),claims=this.check(envelope);
+      if(claims.activationId!==this.state.get('license.activation'))return false;
+      const current=this.check(undefined,'desktop',{allowExpired:true});
+      if(claims.licenseId!==current.licenseId||claims.issuedAt<current.issuedAt||claims.issuedAt===current.issuedAt&&claims.expiresAt<=current.expiresAt)return false;
+      this.save({lease:envelope});return true;
+    }catch{return false;}
+  }
+  status(){
+    try{const c=this.check();return {active:!this.state.get('license.denied'),licenseId:c.licenseId,activationId:c.activationId,
+      leaseUntil:new Date(c.expiresAt).toISOString(),expiresAt:new Date(c.licenseExpiresAt).toISOString()};}
+    catch{return {active:false,activationRequired:!this.state.get('license.activation')};}
+  }
+}

package/package.json

@@ -1,6 +1,14 @@
-{
-  "name": "codexunlimit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "codexunlimit",
+  "version": "0.1.0-web.10",
+  "private": false,
+  "description": "Codex Unlimit — trò chuyện và quản lý kết nối trên máy của bạn",
+  "type": "module",
+  "license": "UNLICENSED",
+  "homepage": "https://codexunlimit.tudonghoa.me",
+  "publishConfig": {"registry":"https://registry.npmjs.org","access":"public"},
+  "engines": {"node": "^22.15.0 || >=24.0.0"},
+  "bin": {"codexunlimit": "cli.mjs"},
+  "dependencies": {"@openai/codex":"0.166.0","markdown-it":"15.0.3"},
+  "files": ["app.mjs","account-pool.mjs","codex-account-client.mjs","quota.mjs","cli.mjs","config.mjs","device.ps1","doctor.mjs","image-http.mjs","license-client.mjs","io.mjs","product.mjs","protocol.mjs","relay.mjs","state.mjs","windows.mjs","windows.ps1","updates.mjs","web/","README.md"]
+}

package/product.mjs

@@ -0,0 +1,5 @@
+export const VERSION='0.1.0-web.10';
+export const PRODUCT='codexunlimit-connector';
+export const DEFAULT_PORT=18457;
+export const LICENSE_ORIGIN='https://codexunlimit.tudonghoa.me';
+export const LICENSE_PUBLIC_KEY='MCowBQYDK2VwAyEAnOW-TAyqv57sVI-ZOW3m0jurLc6hHzzeJ-KbiU_9hxk';

package/protocol.mjs

@@ -0,0 +1,28 @@
+import crypto from 'node:crypto';
+
+export const hash=value=>crypto.createHash('sha256').update(value).digest('hex');
+export const publicText=key=>crypto.createPublicKey(key).export({type:'spki',format:'der'}).toString('base64url');
+export function readPublic(text){
+  if(typeof text!=='string'||text.length>150)throw Error('invalid_device_key');
+  const key=crypto.createPublicKey({key:Buffer.from(text,'base64url'),type:'spki',format:'der'});
+  if(key.asymmetricKeyType!=='ed25519'&&!(key.asymmetricKeyType==='ec'&&key.asymmetricKeyDetails?.namedCurve==='prime256v1'))throw Error('invalid_device_key');
+  return key;
+}
+export function signEnvelope(value,privateKey){
+  const payload=Buffer.from(JSON.stringify(value)).toString('base64url');
+  return {payload,signature:crypto.sign(null,Buffer.from(payload),privateKey).toString('base64url')};
+}
+export function verifyEnvelope(envelope,publicKey){
+  if(!envelope||typeof envelope.payload!=='string'||envelope.payload.length>100000||
+    typeof envelope.signature!=='string'||!crypto.verify(null,Buffer.from(envelope.payload),readPublic(publicKey),Buffer.from(envelope.signature,'base64url')))throw Error('signature_invalid');
+  return JSON.parse(Buffer.from(envelope.payload,'base64url'));
+}
+export function proofText(action,nonce,deviceId,publicKey){
+  return Buffer.from(JSON.stringify(['tdh-relay-license-v1',action,nonce,deviceId,publicKey]));
+}
+export function signProof(action,nonce,deviceId,publicKey,privateKey){
+  return crypto.sign(privateKey.asymmetricKeyType==='ec'?'sha256':null,proofText(action,nonce,deviceId,publicKey),privateKey).toString('base64url');
+}
+export function verifyProof(action,nonce,deviceId,publicKey,signature){
+  try{const key=readPublic(publicKey);return crypto.verify(key.asymmetricKeyType==='ec'?'sha256':null,proofText(action,nonce,deviceId,publicKey),key,Buffer.from(signature,'base64url'));}catch{return false;}
+}

package/quota.mjs

@@ -0,0 +1,34 @@
+import crypto from 'node:crypto';
+
+export function accountIdentity(credentials){
+  let claims={};try{claims=JSON.parse(Buffer.from(credentials.token.split('.')[1],'base64url'));}catch{}
+  const auth=claims['https://api.openai.com/auth']??{},profile=claims['https://api.openai.com/profile']??{};
+  const accountId=credentials.accountId??auth.chatgpt_account_id,subject=typeof claims.sub==='string'?claims.sub:'';
+  const email=typeof (claims.email??profile.email)==='string'?(claims.email??profile.email).slice(0,254):null;
+  return {ref:crypto.createHash('sha256').update(subject||accountId?JSON.stringify([subject,accountId??'']):credentials.token).digest('hex'),email,plan:typeof auth.chatgpt_plan_type==='string'?auth.chatgpt_plan_type.slice(0,40):null,accountId};
+}
+function windowValue(minutes,used,resetAt){
+  if(![300,10080].includes(minutes)||typeof used!=='number'||!Number.isFinite(used)||used<0||used>100)return null;
+  return {minutes,used,resetAt:Number.isSafeInteger(resetAt)&&resetAt>0&&resetAt<8640000000000000?resetAt:null};
+}
+export function headerWindows(headers,now=Date.now()){
+  const number=value=>typeof value==='string'&&/^\d+(?:\.\d+)?$/.test(value)&&Number.isFinite(Number(value))?Number(value):null;
+  return ['primary','secondary'].map(prefix=>{
+    const get=name=>number(headers.get('x-codex-'+prefix+'-'+name));
+    const reset=get('reset-at'),after=get('reset-after-seconds');return windowValue(get('window-minutes'),get('used-percent'),reset!==null?reset*1000:after!==null?now+after*1000:null);
+  }).filter(Boolean);
+}
+export function rateLimitWindows(result){
+  const bucket=result?.rateLimitsByLimitId?.codex??result?.rateLimits;
+  if(!bucket||bucket.limitId&&bucket.limitId!=='codex')return [];
+  return [bucket.primary,bucket.secondary].filter(Boolean).map(window=>windowValue(window.windowDurationMins,window.usedPercent,typeof window.resetsAt==='number'?window.resetsAt*1000:null)).filter(Boolean);
+}
+export class LocalQuota{
+  constructor(state,{now=Date.now}={}){this.db=state.db;this.now=now;this.db.exec('CREATE TABLE IF NOT EXISTS local_account_quota(account_ref TEXT NOT NULL,minutes INTEGER NOT NULL,used REAL NOT NULL,reset_at INTEGER,observed_at INTEGER NOT NULL,source TEXT NOT NULL,PRIMARY KEY(account_ref,minutes))');}
+  save(ref,windows,source){
+    const now=this.now();for(const window of windows)this.db.prepare('INSERT INTO local_account_quota VALUES(?,?,?,?,?,?) ON CONFLICT(account_ref,minutes) DO UPDATE SET used=excluded.used,reset_at=excluded.reset_at,observed_at=excluded.observed_at,source=excluded.source WHERE excluded.observed_at>=observed_at').run(ref,window.minutes,window.used,window.resetAt,now,source);
+    this.db.prepare('DELETE FROM local_account_quota WHERE observed_at<?').run(now-30*86400000);
+  }
+  observe(credentials,response){if(response.ok||response.status===429)this.save(accountIdentity(credentials).ref,headerWindows(response.headers,this.now()),'response_headers');}
+  read(ref){return this.db.prepare('SELECT minutes,used,reset_at,observed_at,source FROM local_account_quota WHERE account_ref=? ORDER BY minutes').all(ref).map(window=>({...window,stale:this.now()-window.observed_at>15*60000||window.reset_at!==null&&window.reset_at<=this.now()}));}
+}

package/relay.mjs

@@ -0,0 +1,83 @@
+import http from 'node:http';
+import crypto from 'node:crypto';
+import {Readable} from 'node:stream';
+import {pipeline} from 'node:stream/promises';
+import {PRODUCT,VERSION,LICENSE_ORIGIN} from './product.mjs';
+import {hash} from './protocol.mjs';
+import {isImageRoute,gatewayRequest} from './image-http.mjs';
+
+const CONTEXT_HEADERS=['content-type','content-encoding','chatgpt-account-id','session_id','session-id','conversation_id','originator','version','openai-beta','x-codex-beta-features','x-codex-parent-thread-id','x-codex-turn-metadata','x-codex-turn-state'];
+export function signedHeaders(license,state,method,route,authorization,body=Buffer.alloc(0),headers=new Headers()){
+  const envelope=state.get('license.lease');license.check(envelope,'desktop',{allowExpired:true});
+  const timestamp=Date.now(),nonce=crypto.randomBytes(24).toString('base64url'),key=license.device.privateKey;
+  const bodyHash=hash(body??Buffer.alloc(0));
+  const contextHeaders=isImageRoute(route)?[...CONTEXT_HEADERS,'x-codex-image-turn-id']:CONTEXT_HEADERS;
+  const text=Buffer.from(JSON.stringify(['cu-request-v2',envelope.payload,method,route,timestamp,nonce,hash(authorization),bodyHash,contextHeaders.map(name=>[name,headers.get(name)??''])]));
+  return {'x-cu-lease':Buffer.from(JSON.stringify(envelope)).toString('base64url'),'x-cu-time':String(timestamp),'x-cu-nonce':nonce,
+    'x-cu-proof-version':'2','x-cu-body-sha256':bodyHash,
+    'x-cu-proof':crypto.sign(key.asymmetricKeyType==='ec'?'sha256':null,text,key).toString('base64url')};
+}
+export function createConnector(state,{license,localApp,pool,onStop=()=>{},prepareStop=()=>{},origin=LICENSE_ORIGIN,request=gatewayRequest,maxBufferedBytes=128*1024*1024,bodyTimeoutMs=60000}={}){
+  if(new URL(origin).protocol!=='https:')throw Error('https_required');
+  let active=0,buffered=0;
+  const server=http.createServer(async(req,res)=>{
+    const controller=new AbortController(),started=Date.now();let counted=false,status=503,reserved=0,bodyTimer;
+    req.on('aborted',()=>controller.abort());res.on('close',()=>{if(!res.writableFinished)controller.abort();});
+    const json=(code,data)=>{res.writeHead(code,{'content-type':'application/json','cache-control':'no-store'});res.end(JSON.stringify(data));};
+    try{
+      if(!['127.0.0.1:'+server.address().port,'localhost:'+server.address().port].includes(req.headers.host))return json(403,{error:{code:'local_request_denied'}});
+      if(localApp&&await localApp(req,res,server))return;
+      if(req.headers.origin)return json(403,{error:{code:'local_request_denied'}});
+      if(req.method==='GET'&&req.url==='/healthz')return json(200,{ok:true,service:PRODUCT,version:VERSION,mode:'desktop'});
+      if(req.method==='GET'&&req.url==='/control/identity'){
+        const nonce=String(req.headers['x-cu-nonce']??'');if(!/^[a-f0-9]{48}$/.test(nonce))return json(400,{error:{code:'invalid_nonce'}});
+        return json(200,{proof:crypto.createHmac('sha256',state.get('control_token')).update('cu-instance:'+nonce).digest('hex')});
+      }
+      if(req.method==='POST'&&req.url==='/control/stop'){
+        const a=Buffer.from(state.get('control_token')??''),b=Buffer.from(String(req.headers['x-cu-control']??''));
+        if(!a.length||a.length!==b.length||!crypto.timingSafeEqual(a,b))return json(403,{error:{code:'control_denied'}});
+        const mode=req.headers['x-cu-stop-mode']??'exit';if(!['exit','update'].includes(mode))return json(400,{error:{code:'invalid_stop_mode'}});
+        await prepareStop(mode);json(200,{stopped:true});setImmediate(onStop);return;
+      }
+      if(!(req.method==='GET'&&/^\/v1\/models(?:\?client_version=[a-zA-Z0-9._%-]{1,100})?$/.test(req.url))&&!(req.method==='POST'&&(['/v1/responses','/v1/responses/compact'].includes(req.url)||isImageRoute(req.url))))return json(404,{error:{code:'route_not_found'}});
+      let authorization=req.headers.authorization??'';
+      const selectedAccount=pool?.active();
+      if(!/^Bearer [^\s]{16,32768}$/.test(authorization)||authorization.startsWith('Bearer sk-'))return json(401,{error:{code:'chatgpt_sign_in_required'}});
+      if(active>=state.settings.get('relay.max_concurrency'))return json(429,{error:{code:'too_many_requests'}});
+      const limit=state.settings.get('relay.max_body_bytes');if(Number(req.headers['content-length']??0)>limit){req.resume();return json(413,{error:{code:'request_too_large'}});}
+      const length=Number(req.headers['content-length']??limit);
+      if(!Number.isSafeInteger(length)||length<0)return json(400,{error:{code:'invalid_body_length'}});
+      // Account for input chunks and their contiguous copy together.
+      reserved=req.method==='POST'?2*length:0;
+      if(buffered+reserved>maxBufferedBytes){req.resume();return json(503,{error:{code:'client_memory_busy'}});}
+      buffered+=reserved;active++;counted=true;
+      bodyTimer=setTimeout(()=>{controller.abort();req.destroy();},bodyTimeoutMs);bodyTimer.unref();
+      const headers=new Headers();
+      for(const name of ['authorization','content-type','content-encoding','chatgpt-account-id','session_id','session-id','conversation_id','originator','user-agent','version','openai-beta','x-codex-beta-features','x-codex-parent-thread-id','x-codex-turn-metadata','x-codex-turn-state','x-codex-image-turn-id'])if(typeof req.headers[name]==='string')headers.set(name,req.headers[name]);
+      const localToken=Buffer.from(String(req.headers['x-cu-control']??'')),expectedToken=Buffer.from(state.get('control_token')??'');
+      const fromLocalApp=expectedToken.length>0&&localToken.length===expectedToken.length&&crypto.timingSafeEqual(localToken,expectedToken);
+      if(pool&&selectedAccount!=='codex'&&!fromLocalApp){
+        if(!state.get('web.privacyAcceptedAt'))throw Object.assign(Error('privacy_required'),{status:403});
+        const credentials=await pool.credentials(selectedAccount);authorization='Bearer '+credentials.token;headers.set('authorization',authorization);headers.delete('chatgpt-account-id');if(credentials.accountId)headers.set('chatgpt-account-id',credentials.accountId);
+      }
+      // Bound input in the connector too, before forwarding. No request content is persisted.
+      const chunks=[];let size=0;for await(const chunk of req){size+=chunk.length;if(size>limit)throw Object.assign(Error('request_too_large'),{status:413});chunks.push(chunk);}
+      clearTimeout(bodyTimer);const payload=req.method==='POST'?Buffer.concat(chunks):undefined;chunks.length=0;
+      // Sign only after upload completes, so a slow upload cannot age the proof out.
+      controller.signal.throwIfAborted();await license.forRequest('desktop');controller.signal.throwIfAborted();
+      for(const [key,value]of Object.entries(signedHeaders(license,state,req.method,req.url,authorization,payload,headers)))headers.set(key,value);
+      const response=await request(origin+req.url,{method:req.method,headers,body:payload,redirect:'error',signal:AbortSignal.any([controller.signal,AbortSignal.timeout(isImageRoute(req.url)?630000:1800000)])});
+      license.acceptLease(response.headers.get('x-cu-lease'));
+      pool?.observe({token:authorization.slice(7),accountId:headers.get('chatgpt-account-id')??undefined},response);
+      if(response.status>=400&&!(response.headers.get('content-type')??'').toLowerCase().startsWith('application/json')){
+        response.body?.cancel().catch(()=>{});status=response.status===429?429:503;const wait=Number(response.headers.get('retry-after'));res.setHeader('retry-after',String(Number.isFinite(wait)&&wait>0?Math.min(60,Math.ceil(wait)):3));
+        return json(status,{error:{code:'service_unavailable',message:'Máy chủ tạm thời chưa phản hồi hợp lệ. Không tự gửi lại tác vụ đang chạy; kiểm tra kết nối rồi thử lại.'}});
+      }
+      status=response.status;const outgoing={'cache-control':'no-store'};
+      for(const [key,value]of response.headers)if(['content-type','retry-after','x-cu-request-id'].includes(key)||key.startsWith('x-codex-')||isImageRoute(req.url)&&key==='x-relay-policy-mode')outgoing[key]=value;
+      res.writeHead(status,outgoing);if(response.body)await pipeline(Readable.fromWeb(response.body),res,{signal:controller.signal});else res.end();
+    }catch(error){status=controller.signal.aborted?499:error.status??502;if(res.headersSent)res.destroy();else{if([429,503].includes(status))res.setHeader('retry-after',String(error.retryAfter??3));json(status,{error:{code:error.status?error.code??error.message:'connection_failed'}});}}
+    finally{clearTimeout(bodyTimer);controller.abort();if(counted){active--;buffered-=reserved;state.record({status,duration:Date.now()-started});}}
+  });
+  server.headersTimeout=15000;server.requestTimeout=60000;return server;
+}

package/state.mjs

@@ -0,0 +1,23 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import {DatabaseSync} from 'node:sqlite';
+import {DEFAULT_PORT,VERSION} from './product.mjs';
+export class ClientState{
+  constructor(home){
+    this.home=path.resolve(home);fs.mkdirSync(path.join(this.home,'data'),{recursive:true,mode:0o700});
+    this.db=new DatabaseSync(path.join(this.home,'data','connector.sqlite'));
+    this.db.exec('PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000; CREATE TABLE IF NOT EXISTS settings(key TEXT PRIMARY KEY,value TEXT NOT NULL); CREATE TABLE IF NOT EXISTS desktop_usage(id INTEGER PRIMARY KEY,ts INTEGER NOT NULL,status INTEGER NOT NULL,duration_ms INTEGER NOT NULL);');
+    this.settings={get:key=>this.get(key),set:(key,value)=>this.set(key,value)};
+  }
+  get(key){const row=this.db.prepare('SELECT value FROM settings WHERE key=?').get(key);return row?JSON.parse(row.value):null;}
+  set(key,value){this.db.prepare('INSERT INTO settings VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value').run(key,JSON.stringify(value));}
+  transaction(action){this.db.exec('BEGIN IMMEDIATE');try{const value=action();this.db.exec('COMMIT');return value;}catch(error){this.db.exec('ROLLBACK');throw error;}}
+  initialize({port=DEFAULT_PORT,codexHome}={}){
+    if(!this.get('initialized')){this.set('relay.port',port);this.set('control_token',crypto.randomBytes(32).toString('base64url'));this.set('initialized',true);}
+    this.set('relay.max_body_bytes',64*1024*1024);this.set('relay.max_concurrency',4);this.set('version',VERSION);
+    if(codexHome)this.set('codex_home',path.resolve(codexHome));
+  }
+  record(row){this.db.prepare('INSERT INTO desktop_usage(ts,status,duration_ms) VALUES(?,?,?)').run(Date.now(),row.status,row.duration);this.db.prepare('DELETE FROM desktop_usage WHERE id<(SELECT MAX(id)-2000 FROM desktop_usage)').run();}
+  close(){this.db.close();}
+}