coding-tool-x 3.2.0

package/src/server/services/network-access.js

@@ -0,0 +1,80 @@
+function normalizeAddress(address) {
+  if (!address) return '';
+  const trimmed = String(address).trim();
+  if (trimmed.startsWith('::ffff:')) {
+    return trimmed.slice(7);
+  }
+  return trimmed;
+}
+
+function isLoopbackAddress(address) {
+  const normalized = normalizeAddress(address).toLowerCase();
+  if (!normalized) return false;
+  if (normalized === '::1' || normalized === 'localhost') return true;
+  if (normalized === '127.0.0.1') return true;
+  if (normalized.startsWith('127.')) return true;
+  return false;
+}
+
+function isLoopbackRequest(req) {
+  if (!req) return false;
+  const socketAddress = req.socket && req.socket.remoteAddress;
+  if (!isLoopbackAddress(socketAddress)) {
+    return false;
+  }
+  const forwarded = req.headers && req.headers['x-forwarded-for'];
+  if (typeof forwarded === 'string' && forwarded.trim()) {
+    const first = forwarded.split(',')[0].trim();
+    return isLoopbackAddress(first);
+  }
+  return true;
+}
+
+function createRemoteMutationGuard(options = {}) {
+  const enabled = options.enabled === true;
+  const allowRemoteMutation = options.allowRemoteMutation === true;
+  const message = options.message || 'LAN 模式下禁止远程写操作';
+
+  return (req, res, next) => {
+    if (!enabled || allowRemoteMutation) {
+      return next();
+    }
+    if (isLoopbackRequest(req)) {
+      return next();
+    }
+    if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') {
+      return next();
+    }
+    return res.status(403).json({
+      error: message,
+      code: 'LAN_REMOTE_WRITE_BLOCKED'
+    });
+  };
+}
+
+function createRemoteRouteGuard(options = {}) {
+  const enabled = options.enabled === true;
+  const allowRemoteAccess = options.allowRemoteAccess === true;
+  const message = options.message || 'LAN 模式下禁止远程访问该接口';
+
+  return (req, res, next) => {
+    if (!enabled || allowRemoteAccess) {
+      return next();
+    }
+    if (isLoopbackRequest(req)) {
+      return next();
+    }
+    return res.status(403).json({
+      error: message,
+      code: 'LAN_REMOTE_ROUTE_BLOCKED'
+    });
+  };
+}
+
+module.exports = {
+  normalizeAddress,
+  isLoopbackAddress,
+  isLoopbackRequest,
+  createRemoteMutationGuard,
+  createRemoteRouteGuard
+};

package/src/server/services/opencode-channels.js

@@ -0,0 +1,366 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+
+/**
+ * OpenCode 渠道管理服务
+ * 存储位置: ~/.cc-tool/opencode-channels.json
+ */
+
+function normalizeGatewaySourceType(value) {
+  const normalized = String(value || '').trim().toLowerCase();
+  if (normalized === 'claude') return 'claude';
+  if (normalized === 'gemini') return 'gemini';
+  return 'codex';
+}
+
+function normalizeApiKey(value) {
+  if (typeof value !== 'string') return '';
+  const trimmed = value.trim();
+  return trimmed || '';
+}
+
+function normalizeHostFromBaseUrl(baseUrl) {
+  const value = typeof baseUrl === 'string' ? baseUrl.trim() : '';
+  if (!value) return '';
+  try {
+    const parsed = new URL(value);
+    return String(parsed.hostname || '').trim().toLowerCase().replace(/^www\./, '');
+  } catch {
+    return '';
+  }
+}
+
+function normalizeChannelName(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, ' ');
+}
+
+// 获取渠道存储文件路径
+function getChannelsFilePath() {
+  const ccToolDir = path.join(os.homedir(), '.cc-tool');
+  if (!fs.existsSync(ccToolDir)) {
+    fs.mkdirSync(ccToolDir, { recursive: true });
+  }
+  return path.join(ccToolDir, 'opencode-channels.json');
+}
+
+function getCodexChannelsFilePath() {
+  const ccToolDir = path.join(os.homedir(), '.cc-tool');
+  if (!fs.existsSync(ccToolDir)) {
+    fs.mkdirSync(ccToolDir, { recursive: true });
+  }
+  return path.join(ccToolDir, 'codex-channels.json');
+}
+
+// 读取所有渠道
+function loadChannels() {
+  const filePath = getChannelsFilePath();
+
+  if (!fs.existsSync(filePath)) {
+    return { channels: [] };
+  }
+
+  try {
+    const content = fs.readFileSync(filePath, 'utf8');
+    const data = JSON.parse(content);
+    // 确保渠道有必要字段（兼容旧数据）
+    if (data.channels) {
+      data.channels = data.channels.map(ch => {
+        const normalized = {
+          ...ch,
+          enabled: ch.enabled !== false,
+          weight: ch.weight || 1,
+          maxConcurrency: ch.maxConcurrency || null,
+          modelRedirects: ch.modelRedirects || [],
+          speedTestModel: ch.speedTestModel || null,
+          wireApi: ch.wireApi || 'openai',  // OpenCode 默认使用 OpenAI 兼容格式
+          gatewaySourceType: normalizeGatewaySourceType(ch.gatewaySourceType),
+          allowedModels: ch.allowedModels || []
+        };
+        normalized.providerKey = deriveProviderKey(normalized);
+        return normalized;
+      });
+    }
+    return data;
+  } catch (err) {
+    console.error('[OpenCode Channels] Failed to parse channels file:', err);
+    return { channels: [] };
+  }
+}
+
+function deriveProviderKey(channel) {
+  const base = channel.wireApi || channel.providerKey || 'opencode';
+  if (typeof base === 'string' && base.startsWith('opencode_')) {
+    return base;
+  }
+  return `opencode_${base}`;
+}
+
+// 保存渠道数据
+function saveChannels(data) {
+  const filePath = getChannelsFilePath();
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf8');
+}
+
+// 获取所有渠道
+function getChannels() {
+  const data = loadChannels();
+  return {
+    channels: data.channels || []
+  };
+}
+
+// 添加渠道
+function createChannel(name, baseUrl, apiKey, extraConfig = {}) {
+  const data = loadChannels();
+
+  const newChannel = {
+    id: crypto.randomUUID(),
+    name,
+    baseUrl,
+    apiKey,
+    wireApi: extraConfig.wireApi || 'openai',
+    enabled: extraConfig.enabled !== false,
+    weight: extraConfig.weight || 1,
+    maxConcurrency: extraConfig.maxConcurrency || null,
+    modelRedirects: extraConfig.modelRedirects || [],
+    speedTestModel: extraConfig.speedTestModel || null,
+    model: extraConfig.model || null,
+    gatewaySourceType: normalizeGatewaySourceType(extraConfig.gatewaySourceType),
+    providerKey: extraConfig.providerKey || null,
+    presetId: extraConfig.presetId || null,
+    websiteUrl: extraConfig.websiteUrl || '',
+    allowedModels: extraConfig.allowedModels || [],
+    createdAt: Date.now(),
+    updatedAt: Date.now()
+  };
+  newChannel.providerKey = extraConfig.providerKey || deriveProviderKey(newChannel);
+
+  data.channels.push(newChannel);
+  saveChannels(data);
+
+  return newChannel;
+}
+
+// 更新渠道
+function updateChannel(channelId, updates) {
+  const data = loadChannels();
+  const index = data.channels.findIndex(c => c.id === channelId);
+
+  if (index === -1) {
+    throw new Error('Channel not found');
+  }
+
+  const oldChannel = data.channels[index];
+
+  const merged = {
+    ...oldChannel,
+    ...updates,
+    id: channelId,
+    createdAt: oldChannel.createdAt,
+    modelRedirects: updates.modelRedirects !== undefined ? updates.modelRedirects : (oldChannel.modelRedirects || []),
+    speedTestModel: updates.speedTestModel !== undefined ? updates.speedTestModel : (oldChannel.speedTestModel || null),
+    gatewaySourceType: normalizeGatewaySourceType(
+      updates.gatewaySourceType !== undefined
+        ? updates.gatewaySourceType
+        : oldChannel.gatewaySourceType
+    ),
+    updatedAt: Date.now()
+  };
+  merged.providerKey = updates.providerKey || deriveProviderKey(merged);
+  data.channels[index] = merged;
+
+  // Get proxy status
+  const { getOpenCodeProxyStatus } = require('../opencode-proxy-server');
+  const proxyStatus = getOpenCodeProxyStatus();
+  const isProxyRunning = proxyStatus.running;
+
+  // Single-channel enforcement when proxy is OFF: enabling a channel disables all others
+  if (!isProxyRunning && merged.enabled && !oldChannel.enabled) {
+    data.channels.forEach((ch, i) => {
+      if (i !== index && ch.enabled) {
+        ch.enabled = false;
+      }
+    });
+    console.log(`[OpenCode Single-channel mode] Enabled "${merged.name}", disabled all others`);
+  }
+
+  // Prevent disabling last enabled channel when proxy is OFF
+  if (!isProxyRunning && !merged.enabled && oldChannel.enabled) {
+    const enabledCount = data.channels.filter(ch => ch.enabled).length;
+    if (enabledCount === 0) {
+      throw new Error('无法禁用最后一个启用的渠道。请先启用其他渠道或启动动态切换。');
+    }
+  }
+
+  saveChannels(data);
+  return data.channels[index];
+}
+
+// 删除渠道
+async function deleteChannel(channelId) {
+  const data = loadChannels();
+  const index = data.channels.findIndex(c => c.id === channelId);
+
+  if (index === -1) {
+    throw new Error('Channel not found');
+  }
+
+  data.channels.splice(index, 1);
+  saveChannels(data);
+
+  return { success: true };
+}
+
+// 获取所有启用的渠道
+function getEnabledChannels() {
+  const data = loadChannels();
+  return data.channels.filter(c => c.enabled !== false);
+}
+
+// 保存渠道顺序
+function saveChannelOrder(order) {
+  const data = loadChannels();
+
+  const orderedChannels = [];
+  for (const id of order) {
+    const channel = data.channels.find(c => c.id === id);
+    if (channel) {
+      orderedChannels.push(channel);
+    }
+  }
+
+  // 添加不在顺序中的渠道
+  for (const channel of data.channels) {
+    if (!orderedChannels.find(c => c.id === channel.id)) {
+      orderedChannels.push(channel);
+    }
+  }
+
+  data.channels = orderedChannels;
+  saveChannels(data);
+}
+
+function loadCodexChannels() {
+  const filePath = getCodexChannelsFilePath();
+  if (!fs.existsSync(filePath)) {
+    return [];
+  }
+  try {
+    const content = fs.readFileSync(filePath, 'utf8');
+    const data = JSON.parse(content);
+    return Array.isArray(data?.channels) ? data.channels : [];
+  } catch {
+    return [];
+  }
+}
+
+function collectCodexFallbackApiKeys(channel) {
+  if (String(process.env.OPENCODE_DISABLE_CODEX_KEY_FALLBACK || '').trim() === '1') {
+    return [];
+  }
+
+  const targetHost = normalizeHostFromBaseUrl(channel?.baseUrl);
+  const targetName = normalizeChannelName(channel?.name);
+  const targetId = String(channel?.id || '').trim();
+  const codexChannels = loadCodexChannels();
+  if (codexChannels.length === 0) {
+    return [];
+  }
+
+  const matches = [];
+  for (const codexChannel of codexChannels) {
+    const apiKey = normalizeApiKey(codexChannel?.apiKey || codexChannel?.key || '');
+    if (!apiKey) continue;
+
+    const codexName = normalizeChannelName(codexChannel?.name);
+    const codexHost = normalizeHostFromBaseUrl(codexChannel?.baseUrl);
+    const codexId = String(codexChannel?.id || '').trim();
+
+    let score = 0;
+    if (targetHost && codexHost && targetHost === codexHost) {
+      score += 100;
+    }
+    if (targetName && codexName && targetName === codexName) {
+      score += 90;
+    } else if (targetName && codexName && (targetName.includes(codexName) || codexName.includes(targetName))) {
+      score += 60;
+    }
+    if (targetId && codexId && targetId === codexId) {
+      score += 40;
+    }
+    if (codexChannel?.enabled !== false) {
+      score += 10;
+    }
+
+    if (score > 0) {
+      matches.push({ score, apiKey });
+    }
+  }
+
+  matches.sort((a, b) => b.score - a.score);
+
+  const unique = [];
+  const seen = new Set();
+  for (const item of matches) {
+    if (!item?.apiKey || seen.has(item.apiKey)) continue;
+    seen.add(item.apiKey);
+    unique.push(item.apiKey);
+  }
+  return unique;
+}
+
+function normalizeBooleanLike(value) {
+  if (typeof value === 'boolean') return value;
+  if (typeof value !== 'string') return null;
+  const lowered = value.trim().toLowerCase();
+  if (lowered === '1' || lowered === 'true' || lowered === 'yes' || lowered === 'on') return true;
+  if (lowered === '0' || lowered === 'false' || lowered === 'no' || lowered === 'off') return false;
+  return null;
+}
+
+function getEffectiveApiKeyCandidates(channel) {
+  const ownApiKey = normalizeApiKey(channel?.apiKey || channel?.key || '');
+  const codexFallbackKeys = collectCodexFallbackApiKeys(channel);
+  const explicitPreferCodex = normalizeBooleanLike(channel?.preferCodexApiKey);
+  const envPreferCodex = normalizeBooleanLike(process.env.OPENCODE_PREFER_CODEX_API_KEY);
+  const defaultPreferCodex = false;
+  const preferCodex = explicitPreferCodex ?? envPreferCodex ?? defaultPreferCodex;
+
+  const ordered = preferCodex
+    ? [...codexFallbackKeys, ownApiKey]
+    : [ownApiKey, ...codexFallbackKeys];
+
+  const seen = new Set();
+  const candidates = [];
+  for (const key of ordered) {
+    const normalized = normalizeApiKey(key);
+    if (!normalized || seen.has(normalized)) continue;
+    seen.add(normalized);
+    candidates.push(normalized);
+  }
+  return candidates;
+}
+
+/**
+ * 获取渠道的有效 API Key
+ */
+async function getEffectiveApiKey(channel) {
+  const candidates = getEffectiveApiKeyCandidates(channel);
+  return candidates[0] || null;
+}
+
+module.exports = {
+  getChannels,
+  createChannel,
+  updateChannel,
+  deleteChannel,
+  getEnabledChannels,
+  saveChannelOrder,
+  getEffectiveApiKey,
+  getEffectiveApiKeyCandidates
+};