coding-tool-x 3.3.7 → 3.3.9

package/src/server/api/agents.js

@@ -105,7 +105,7 @@ function getAllowedProjectRoots() {
 
   // 从工作区配置中扩展允许目录，避免误拦截外部磁盘/自定义根目录项目
   try {
-    const workspaceConfigPath = path.join(PATHS.base, 'workspaces.json');
+    const workspaceConfigPath = PATHS.workspaces;
     if (fs.existsSync(workspaceConfigPath)) {
       const raw = fs.readFileSync(workspaceConfigPath, 'utf-8');
       const parsed = JSON.parse(raw || '{}');

package/src/server/api/channels.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const router = express.Router();
+const fs = require('fs');
 const {
   getAllChannels,
   applyChannelToSettings,
@@ -18,6 +19,8 @@ const {
   sanitizeBatchConcurrency,
   runWithConcurrencyLimit
 } = require('../services/speed-test');
+const { PATHS } = require('../../config/paths');
+const { deleteBackup } = require('../services/settings-manager');
 const { getDefaultSpeedTestModelByToolType } = require('../../config/model-metadata');
 const { broadcastLog, broadcastProxyState, broadcastSchedulerState } = require('../websocket-server');
 const { clearRedirectCache } = require('../proxy-server');
@@ -185,6 +188,12 @@ router.post('/:id/apply-to-settings', async (req, res) => {
       // Stop proxy and restore backup
       const { stopProxyServer } = require('../proxy-server');
       await stopProxyServer({ clearStartTime: false });
+      deleteBackup();
+      try {
+        fs.unlinkSync(PATHS.activeChannel.claude);
+      } catch {
+        // ignore missing active channel marker
+      }
 
       // Re-apply channel settings after proxy stop to prevent race condition
       // (stopProxyServer restores backup, then we overwrite it with current channel)

package/src/server/api/claude-hooks.js

@@ -5,21 +5,26 @@ const path = require('path');
 const os = require('os');
 const https = require('https');
 const http = require('http');
+const { PATHS, NATIVE_PATHS } = require('../../config/paths');
 const { resolvePreferredHomeDir, normalizeWindowsHomePath } = require('../../utils/home-dir');
+const { createSameOriginGuard } = require('../services/network-access');
 
 // 检测操作系统
 const platform = os.platform(); // 'darwin' | 'win32' | 'linux'
+router.use(createSameOriginGuard({
+  message: '禁止跨站访问 Claude Hooks 配置接口'
+}));
 
 const HOME_DIR = resolvePreferredHomeDir(platform, process.env, os.homedir());
 
 // Claude settings.json 路径
-const CLAUDE_SETTINGS_PATH = path.join(HOME_DIR, '.claude', 'settings.json');
+const CLAUDE_SETTINGS_PATH = NATIVE_PATHS.claude.settings;
 
 // UI 配置路径（记录用户是否主动关闭过、飞书配置等）
-const UI_CONFIG_PATH = path.join(HOME_DIR, '.cc-tool', 'ui-config.json');
+const UI_CONFIG_PATH = PATHS.uiConfig;
 
 // 通知脚本路径（用于飞书通知）
-const NOTIFY_SCRIPT_PATH = path.join(HOME_DIR, '.cc-tool', 'notify-hook.js');
+const NOTIFY_SCRIPT_PATH = PATHS.notifyHook;
 
 // 读取 Claude settings.json
 function readClaudeSettings() {
@@ -222,17 +227,17 @@ function shouldRepairStopHook(settings, expectedScriptPath = NOTIFY_SCRIPT_PATH,
     return false;
   }
 
-  const markerType = parseNotifyTypeMarker(command);
-  if (!markerType) {
-    return false;
-  }
-
   const normalizedCommand = normalizePathForCompare(command);
   const normalizedExpected = normalizePathForCompare(expectedScriptPath);
   if (!normalizedCommand.includes(normalizedExpected)) {
     return true;
   }
 
+  const markerType = parseNotifyTypeMarker(command);
+  if (!markerType) {
+    return true;
+  }
+
   return !fileExists(expectedScriptPath);
 }
 

package/src/server/api/codex-channels.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const router = express.Router();
+const fs = require('fs');
 const {
   getChannels,
   createChannel,
@@ -20,6 +21,8 @@ const {
   runWithConcurrencyLimit
 } = require('../services/speed-test');
 const { clearCodexRedirectCache } = require('../codex-proxy-server');
+const { deleteBackup } = require('../services/codex-settings-manager');
+const { PATHS } = require('../../config/paths');
 const { getDefaultSpeedTestModelByToolType } = require('../../config/model-metadata');
 const CODEX_GATEWAY_SOURCE_TYPE = 'codex';
 
@@ -349,6 +352,12 @@ module.exports = (config) => {
       if (proxyStatus && proxyStatus.running) {
         console.log(`Codex proxy is running, stopping to apply channel settings: ${channel.name}`);
         await stopCodexProxyServer({ clearStartTime: false });
+        deleteBackup();
+        try {
+          fs.unlinkSync(PATHS.activeChannel.codex);
+        } catch {
+          // ignore missing active channel marker
+        }
 
         broadcastLog({
           type: 'action',

package/src/server/api/codex-proxy.js

@@ -15,6 +15,7 @@ const {
   readConfig
 } = require('../services/codex-settings-manager');
 const { getChannels, getEnabledChannels } = require('../services/codex-channels');
+const { clearNativeOAuth } = require('../services/native-oauth-adapters');
 const { clearAllLogs } = require('../websocket-server');
 const { PATHS, ensureStorageDirMigrated } = require('../../config/paths');
 const fs = require('fs');
@@ -42,6 +43,24 @@ function selectLatestEnabledChannel(channels) {
   }, enabledChannels[0]);
 }
 
+function resolveActiveChannel(channels, activeChannelId = null) {
+  if (!Array.isArray(channels) || channels.length === 0) {
+    return null;
+  }
+
+  if (activeChannelId) {
+    const matched = channels.find(channel => channel.id === activeChannelId);
+    if (matched) {
+      return matched;
+    }
+  }
+
+  return selectLatestEnabledChannel(channels)
+    || channels.find(channel => channel.enabled !== false)
+    || channels[0]
+    || null;
+}
+
 // 保存激活渠道ID
 function saveActiveChannelId(channelId) {
   ensureStorageDirMigrated();
@@ -82,8 +101,7 @@ router.get('/status', (req, res) => {
   try {
     const proxyStatus = getCodexProxyStatus();
     const { channels } = getChannels();
-    const enabledChannels = channels.filter(ch => ch.enabled !== false);
-    const activeChannel = enabledChannels[0]; // 多渠道模式：第一个启用的渠道
+    const activeChannel = resolveActiveChannel(channels, loadActiveChannelId());
     const configStatus = {
       isProxyConfig: isProxyConfig(),
       configExists: configExists(),
@@ -143,6 +161,7 @@ router.post('/start', async (req, res) => {
     }
 
     // 5. 设置代理配置（备份并修改 config.toml 和 auth.json）
+    clearNativeOAuth('codex');
     const configResult = setProxyConfig(proxyResult.port);
 
     const updatedStatus = getCodexProxyStatus();
@@ -155,11 +174,12 @@ router.post('/start', async (req, res) => {
     let message = `Codex proxy started on port ${proxyResult.port}, active channel: ${currentChannel.name}`;
     let envHint = null;
 
-    // 只有首次注入环境变量时才提示用户执行 source 命令
-    if (configResult.envInjected && configResult.isFirstTime) {
+    if (configResult.envInjected && configResult.reloadRequired) {
       envHint = {
-        command: configResult.sourceCommand,
-        message: `首次启用需在 Codex 终端执行: ${configResult.sourceCommand}`
+        command: configResult.sourceCommand || null,
+        message: configResult.sourceCommand
+          ? `请在 Codex 终端执行: ${configResult.sourceCommand}`
+          : '请重新打开 Codex 终端以加载新的用户环境变量'
       };
     }
 
@@ -179,17 +199,9 @@ router.post('/start', async (req, res) => {
 // 停止代理
 router.post('/stop', async (req, res) => {
   try {
-    // 1. 获取当前激活渠道（优先使用启动动态切换时记录的渠道ID）
     const { channels } = getChannels();
     const activeChannelId = loadActiveChannelId();
-    let activeChannel = selectLatestEnabledChannel(channels);
-    if (!activeChannel && activeChannelId) {
-      activeChannel = channels.find(ch => ch.id === activeChannelId);
-    }
-    if (!activeChannel) {
-      const enabledChannels = channels.filter(ch => ch.enabled !== false);
-      activeChannel = enabledChannels[0] || channels[0] || null;
-    }
+    const activeChannel = resolveActiveChannel(channels, activeChannelId);
 
     // 2. 停止代理服务器
     const proxyResult = await stopCodexProxyServer();

package/src/server/api/gemini-proxy.js

@@ -16,6 +16,7 @@ const {
   readEnv
 } = require('../services/gemini-settings-manager');
 const { getChannels, getEnabledChannels } = require('../services/gemini-channels');
+const { clearNativeOAuth } = require('../services/native-oauth-adapters');
 const { PATHS, ensureStorageDirMigrated } = require('../../config/paths');
 const fs = require('fs');
 const path = require('path');
@@ -37,6 +38,24 @@ function selectLatestEnabledChannel(channels) {
   }, enabledChannels[0]);
 }
 
+function resolveActiveChannel(channels, activeChannelId = null) {
+  if (!Array.isArray(channels) || channels.length === 0) {
+    return null;
+  }
+
+  if (activeChannelId) {
+    const matched = channels.find(channel => channel.id === activeChannelId);
+    if (matched) {
+      return matched;
+    }
+  }
+
+  return selectLatestEnabledChannel(channels)
+    || channels.find(channel => channel.enabled !== false)
+    || channels[0]
+    || null;
+}
+
 // 保存激活渠道ID
 function saveActiveChannelId(channelId) {
   ensureStorageDirMigrated();
@@ -83,8 +102,7 @@ router.get('/status', (req, res) => {
       currentProxyPort: getCurrentProxyPort()
     };
     const { channels } = getChannels();
-    const enabledChannels = channels.filter(ch => ch.enabled !== false);
-    const activeChannel = enabledChannels[0]; // 多渠道模式：第一个启用的渠道
+    const activeChannel = resolveActiveChannel(channels, loadActiveChannelId());
 
     res.json({
       proxy: proxyStatus,
@@ -141,6 +159,7 @@ router.post('/start', async (req, res) => {
     }
 
     // 5. 设置代理配置（备份并修改 .env 和 settings.json）
+    clearNativeOAuth('gemini');
     setProxyConfig(proxyResult.port);
 
     const { broadcastProxyState } = require('../websocket-server');
@@ -164,17 +183,9 @@ router.post('/start', async (req, res) => {
 // 停止代理
 router.post('/stop', async (req, res) => {
   try {
-    // 1. 获取当前激活渠道（优先使用启动动态切换时记录的渠道ID）
     const { channels } = getChannels();
     const activeChannelId = loadActiveChannelId();
-    let activeChannel = selectLatestEnabledChannel(channels);
-    if (!activeChannel && activeChannelId) {
-      activeChannel = channels.find(ch => ch.id === activeChannelId);
-    }
-    if (!activeChannel) {
-      const enabledChannels = channels.filter(ch => ch.enabled !== false);
-      activeChannel = enabledChannels[0] || channels[0] || null;
-    }
+    const activeChannel = resolveActiveChannel(channels, activeChannelId);
 
     // 2. 停止代理服务器
     const proxyResult = await stopGeminiProxyServer();

package/src/server/api/hooks.js

@@ -0,0 +1,45 @@
+const express = require('express');
+const router = express.Router();
+const notificationHooks = require('../services/notification-hooks');
+const { createSameOriginGuard } = require('../services/network-access');
+
+router.use(createSameOriginGuard({
+  message: '禁止跨站访问通知配置接口'
+}));
+
+router.get('/', (req, res) => {
+  try {
+    res.json(notificationHooks.getNotificationSettings());
+  } catch (error) {
+    console.error('Error getting notification hook settings:', error);
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/', (req, res) => {
+  try {
+    const result = notificationHooks.saveNotificationSettings(req.body || {});
+    res.json({
+      ...result,
+      message: '通知设置已保存'
+    });
+  } catch (error) {
+    console.error('Error saving notification hook settings:', error);
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/test', async (req, res) => {
+  try {
+    await notificationHooks.testNotification(req.body || {});
+    res.json({
+      success: true,
+      message: req.body?.testFeishu ? '飞书测试通知已发送' : '系统测试通知已发送'
+    });
+  } catch (error) {
+    console.error('Error testing notification hook settings:', error);
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

package/src/server/api/oauth-credentials.js

@@ -0,0 +1,163 @@
+const express = require('express');
+const router = express.Router();
+const {
+  SUPPORTED_TOOLS,
+  getAllToolSummaries,
+  getToolSummary,
+  importCredential,
+  syncLocalCredential,
+  setDefaultCredential,
+  deleteCredential,
+  applyStoredCredential,
+  clearNativeOAuthState,
+  fetchCredentialUsage
+} = require('../services/oauth-credentials-service');
+
+function assertTool(tool) {
+  if (!SUPPORTED_TOOLS.includes(tool)) {
+    const error = new Error(`Unsupported OAuth tool: ${tool}`);
+    error.statusCode = 404;
+    throw error;
+  }
+}
+
+function broadcastToolProxyState(tool) {
+  const { broadcastProxyState } = require('../websocket-server');
+
+  if (tool === 'claude') {
+    const { getProxyStatus } = require('../proxy-server');
+    const { getAllChannels } = require('../services/channels');
+    const channels = getAllChannels();
+    const activeChannel = channels.find(ch => ch.enabled !== false) || null;
+    broadcastProxyState('claude', getProxyStatus(), activeChannel, channels);
+    return;
+  }
+
+  if (tool === 'codex') {
+    const { getCodexProxyStatus } = require('../codex-proxy-server');
+    const { getChannels } = require('../services/codex-channels');
+    const channels = getChannels().channels || [];
+    const activeChannel = channels.find(ch => ch.enabled !== false) || null;
+    broadcastProxyState('codex', getCodexProxyStatus(), activeChannel, channels);
+    return;
+  }
+
+  if (tool === 'gemini') {
+    const { getGeminiProxyStatus } = require('../gemini-proxy-server');
+    const { getChannels } = require('../services/gemini-channels');
+    const channels = getChannels().channels || [];
+    const activeChannel = channels.find(ch => ch.enabled !== false) || null;
+    broadcastProxyState('gemini', getGeminiProxyStatus(), activeChannel, channels);
+    return;
+  }
+
+  if (tool === 'opencode') {
+    const { getOpenCodeProxyStatus } = require('../opencode-proxy-server');
+    const { getChannels } = require('../services/opencode-channels');
+    const channels = getChannels().channels || [];
+    const activeChannel = channels.find(ch => ch.enabled !== false) || null;
+    broadcastProxyState('opencode', getOpenCodeProxyStatus(), activeChannel, channels);
+  }
+}
+
+router.get('/', (req, res) => {
+  try {
+    res.json({ tools: getAllToolSummaries() });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+router.get('/:tool', (req, res) => {
+  try {
+    const { tool } = req.params;
+    assertTool(tool);
+    res.json({ tool, summary: getToolSummary(tool) });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/:tool/import', (req, res) => {
+  try {
+    const { tool } = req.params;
+    assertTool(tool);
+    const credential = importCredential(tool, req.body || {});
+    res.json({ tool, credential, summary: getToolSummary(tool) });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/:tool/sync-local', (req, res) => {
+  try {
+    const { tool } = req.params;
+    assertTool(tool);
+    const result = syncLocalCredential(tool);
+    res.json({ tool, ...result });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/:tool/:credentialId/default', (req, res) => {
+  try {
+    const { tool, credentialId } = req.params;
+    assertTool(tool);
+    const summary = setDefaultCredential(tool, credentialId);
+    res.json({ tool, summary });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/:tool/:credentialId/apply', async (req, res) => {
+  try {
+    const { tool, credentialId } = req.params;
+    assertTool(tool);
+    const result = await applyStoredCredential(tool, credentialId);
+    broadcastToolProxyState(tool);
+    res.json({
+      tool,
+      ...result,
+      message: `${tool} 已切换到 OAuth 凭证控制`
+    });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/:tool/clear-native', (req, res) => {
+  try {
+    const { tool } = req.params;
+    assertTool(tool);
+    const nativeState = clearNativeOAuthState(tool);
+    res.json({ tool, nativeState });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.get('/:tool/:credentialId/usage', async (req, res) => {
+  try {
+    const { tool, credentialId } = req.params;
+    assertTool(tool);
+    const result = await fetchCredentialUsage(tool, credentialId);
+    res.json({ tool, credentialId, usage: result });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.delete('/:tool/:credentialId', (req, res) => {
+  try {
+    const { tool, credentialId } = req.params;
+    assertTool(tool);
+    const summary = deleteCredential(tool, credentialId);
+    res.json({ tool, summary });
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

package/src/server/api/opencode-proxy.js

@@ -16,6 +16,7 @@ const {
   getCurrentProxyPort
 } = require('../services/opencode-settings-manager');
 const { getChannels, getEnabledChannels, applyChannelToSettings } = require('../services/opencode-channels');
+const { clearNativeOAuth } = require('../services/native-oauth-adapters');
 const { getSchedulerState } = require('../services/channel-scheduler');
 const { PATHS, ensureStorageDirMigrated } = require('../../config/paths');
 const fs = require('fs');
@@ -42,6 +43,24 @@ function selectLatestEnabledChannel(channels) {
   }, enabledChannels[0]);
 }
 
+function resolveActiveChannel(channels, activeChannelId = null) {
+  if (!Array.isArray(channels) || channels.length === 0) {
+    return null;
+  }
+
+  if (activeChannelId) {
+    const matched = channels.find(channel => channel.id === activeChannelId);
+    if (matched) {
+      return matched;
+    }
+  }
+
+  return selectLatestEnabledChannel(channels)
+    || channels.find(channel => channel.enabled !== false)
+    || channels[0]
+    || null;
+}
+
 // 保存激活渠道ID
 function saveActiveChannelId(channelId) {
   ensureStorageDirMigrated();
@@ -84,7 +103,7 @@ router.get('/status', (req, res) => {
     const proxyStatus = getOpenCodeProxyStatus();
     const { channels } = getChannels();
     const enabledChannels = channels.filter(ch => ch.enabled !== false);
-    const activeChannel = enabledChannels[0];
+    const activeChannel = resolveActiveChannel(channels, loadActiveChannelId());
     const configStatus = {
       isProxyConfig: isProxyConfig(),
       configExists: configExists(),
@@ -176,6 +195,7 @@ router.post('/start', async (req, res) => {
     });
 
     const activeModel = currentChannel.model || currentChannel.speedTestModel || null;
+    clearNativeOAuth('opencode');
     setProxyConfig(proxyResult.port, { channels: channelPayloads, model: activeModel });
 
     // 5. 广播状态更新
@@ -199,17 +219,9 @@ router.post('/start', async (req, res) => {
 // 停止代理
 router.post('/stop', async (req, res) => {
   try {
-    // 1. 获取当前激活渠道（优先使用启动动态切换时记录的渠道ID）
     const { channels } = getChannels();
     const activeChannelId = loadActiveChannelId();
-    let activeChannel = selectLatestEnabledChannel(channels);
-    if (!activeChannel && activeChannelId) {
-      activeChannel = channels.find(ch => ch.id === activeChannelId);
-    }
-    if (!activeChannel) {
-      const enabledChannels = channels.filter(ch => ch.enabled !== false);
-      activeChannel = enabledChannels[0] || channels[0] || null;
-    }
+    const activeChannel = resolveActiveChannel(channels, activeChannelId);
 
     // 2. 停止代理服务器
     const proxyResult = await stopOpenCodeProxyServer();

package/src/server/api/plugins.js

@@ -57,7 +57,8 @@ router.get('/', (req, res) => {
 router.get('/market', async (req, res) => {
   try {
     const { platform, service } = getPluginsService(req);
-    const plugins = await service.getMarketPlugins();
+    const forceRefresh = req.query.refresh === '1';
+    const plugins = await service.getMarketPlugins(forceRefresh);
 
     res.json({
       success: true,