coding-tool-x 3.3.7 → 3.3.9

package/src/server/api/proxy.js

@@ -4,6 +4,7 @@ const { startProxyServer, stopProxyServer, getProxyStatus } = require('../proxy-
 const {
   setProxyConfig,
   restoreSettings,
+  deleteBackup,
   isProxyConfig,
   getCurrentProxyPort,
   settingsExists,
@@ -11,6 +12,7 @@ const {
   readSettings
 } = require('../services/settings-manager');
 const { getAllChannels } = require('../services/channels');
+const { clearNativeOAuth } = require('../services/native-oauth-adapters');
 const { clearAllLogs } = require('../websocket-server');
 const { PATHS, NATIVE_PATHS, ensureStorageDirMigrated } = require('../../config/paths');
 const fs = require('fs');
@@ -37,6 +39,24 @@ function selectLatestEnabledChannel(channels) {
   }, enabledChannels[0]);
 }
 
+function resolveActiveChannel(channels, activeChannelId = null) {
+  if (!Array.isArray(channels) || channels.length === 0) {
+    return null;
+  }
+
+  if (activeChannelId) {
+    const matched = channels.find(channel => channel.id === activeChannelId);
+    if (matched) {
+      return matched;
+    }
+  }
+
+  return selectLatestEnabledChannel(channels)
+    || channels.find(channel => channel.enabled !== false)
+    || channels[0]
+    || null;
+}
+
 // 保存激活渠道ID
 function saveActiveChannelId(channelId) {
   ensureStorageDirMigrated();
@@ -70,11 +90,14 @@ function findActiveChannelFromSettings() {
   try {
     const settings = readSettings();
     const baseUrl = settings?.env?.ANTHROPIC_BASE_URL || '';
+    const { readNativeOAuth } = require('../services/native-oauth-adapters');
+    const nativeOAuth = readNativeOAuth('claude');
 
     // 兼容多种 API Key 格式（与 channels.js 保持一致）
-    let apiKey = settings?.env?.ANTHROPIC_API_KEY ||        // 标准格式
-                 settings?.env?.ANTHROPIC_AUTH_TOKEN ||     // 88code等平台格式
-                 '';
+    let apiKey = settings?.env?.ANTHROPIC_API_KEY || '';
+    if (!apiKey && !nativeOAuth) {
+      apiKey = settings?.env?.ANTHROPIC_AUTH_TOKEN || '';
+    }
 
     // 如果 apiKey 仍为空，尝试从 apiKeyHelper 提取
     if (!apiKey && settings?.apiKeyHelper) {
@@ -195,6 +218,7 @@ router.post('/start', async (req, res) => {
     }
 
     // 5. 设置代理配置（备份并修改 settings.json）
+    clearNativeOAuth('claude');
     setProxyConfig(proxyResult.port);
 
     const updatedStatus = getProxyStatus();
@@ -221,57 +245,28 @@ router.post('/start', async (req, res) => {
 router.post('/stop', async (req, res) => {
   try {
     const channelsBeforeStop = getAllChannels();
-    const latestEnabledChannel = selectLatestEnabledChannel(channelsBeforeStop);
+    const activeChannelId = loadActiveChannelId();
+    let restoredChannel = resolveActiveChannel(channelsBeforeStop, activeChannelId);
 
     // 1. 停止代理服务器
     const proxyResult = await stopProxyServer();
-    const activeChannelId = loadActiveChannelId();
-
-    // 2. 恢复配置（优先从备份，否则选择权重最高的启用渠道）
-    let restoredChannel = null;
+    const hadBackup = hasBackup();
 
-    // 优先尝试从备份恢复
-    if (hasBackup()) {
+    // 2. 恢复配置（优先恢复当前活动渠道，避免覆盖动态切换期间的设置变更）
+    if (restoredChannel) {
+      if (hadBackup) {
+        deleteBackup();
+        console.log('✅ Discarded backup snapshot');
+      }
+    } else if (hadBackup) {
       restoreSettings();
       console.log('✅ Restored settings from backup');
-
-      // 尝试找到匹配的渠道
       const channels = getAllChannels();
       const currentSettings = require('../services/channels').getCurrentSettings();
       if (currentSettings) {
         restoredChannel = channels.find(ch =>
           ch.baseUrl === currentSettings.baseUrl && ch.apiKey === currentSettings.apiKey
-        );
-      }
-      // Fallback: keep latest enabled channel when leaving dynamic switching mode
-      if (!restoredChannel && latestEnabledChannel) {
-        restoredChannel = channels.find(ch => ch.id === latestEnabledChannel.id) || latestEnabledChannel;
-      }
-      // Fallback: use previously active channel id
-      if (!restoredChannel && activeChannelId) {
-        restoredChannel = channels.find(ch => ch.id === activeChannelId);
-      }
-      // Fallback: use first enabled channel
-      if (!restoredChannel) {
-        restoredChannel = channels.find(ch => ch.enabled !== false) || channels[0];
-      }
-    } else {
-      // 没有备份，选择权重最高的启用渠道
-      const { getBestChannelForRestore, updateClaudeSettings } = require('../services/channels');
-      const channels = getAllChannels();
-      restoredChannel = latestEnabledChannel
-        ? channels.find(ch => ch.id === latestEnabledChannel.id)
-        : null;
-      if (!restoredChannel && activeChannelId) {
-        restoredChannel = channels.find(ch => ch.id === activeChannelId);
-      }
-      if (!restoredChannel) {
-        restoredChannel = getBestChannelForRestore();
-      }
-
-      if (restoredChannel) {
-        updateClaudeSettings(restoredChannel.baseUrl, restoredChannel.apiKey);
-        console.log(`✅ Restored settings to best channel: ${restoredChannel.name}`);
+        ) || null;
       }
     }
 
@@ -283,7 +278,7 @@ router.post('/stop', async (req, res) => {
     }
 
     // 3. 删除备份文件和active-channel.json
-    if (hasBackup()) {
+    if (hadBackup && !restoredChannel) {
       const backupPath = NATIVE_PATHS.claude.settingsBackup;
       if (fs.existsSync(backupPath)) {
         fs.unlinkSync(backupPath);

package/src/server/api/skills.js

@@ -25,6 +25,22 @@ function getSkillService(req) {
   return { platform, service: skillServices.get(platform) };
 }
 
+function extractRepoPayload(source = {}) {
+  const repo = source.repo && typeof source.repo === 'object' ? source.repo : source;
+  return {
+    id: repo.id || source.repoId || '',
+    provider: repo.provider || source.provider || '',
+    host: repo.host || source.host || '',
+    owner: repo.owner || source.owner || '',
+    name: repo.name || source.name || '',
+    branch: repo.branch || source.branch || 'main',
+    directory: repo.directory || source.directory || '',
+    projectPath: repo.projectPath || source.projectPath || '',
+    localPath: repo.localPath || source.localPath || '',
+    repoUrl: repo.repoUrl || source.repoUrl || ''
+  };
+}
+
 /**
  * 获取技能列表
  * GET /api/skills
@@ -66,7 +82,9 @@ router.get('/detail/*', async (req, res) => {
       });
     }
 
-    const result = await service.getSkillDetail(directory);
+    const repoHint = extractRepoPayload(req.query || {});
+    const hasRepoHint = Object.values(repoHint).some(Boolean);
+    const result = await service.getSkillDetail(directory, hasRepoHint ? repoHint : null, req.query.fullDirectory || '');
     res.json({
       success: true,
       platform,
@@ -106,7 +124,7 @@ router.get('/installed', (req, res) => {
 /**
  * 安装技能
  * POST /api/skills/install
- * Body: { directory, fullDirectory, repo: { owner, name, branch } }
+ * Body: { directory, fullDirectory, repo }
  * - directory: 本地安装目录（相对路径）
  * - fullDirectory: 仓库中的完整路径（当指定了仓库子目录时使用）
  */
@@ -122,7 +140,7 @@ router.post('/install', async (req, res) => {
       });
     }
 
-    if (!repo || !repo.owner || !repo.name) {
+    if (!repo) {
       return res.status(400).json({
         success: false,
         message: 'Missing repo info'
@@ -131,11 +149,7 @@ router.post('/install', async (req, res) => {
 
     const result = await service.installSkill(
       directory,
-      {
-        owner: repo.owner,
-        name: repo.name,
-        branch: repo.branch || 'main'
-      },
+      extractRepoPayload({ repo }),
       fullDirectory || null  // 传递 fullDirectory 用于从仓库子目录下载
     );
 
@@ -153,6 +167,28 @@ router.post('/install', async (req, res) => {
   }
 });
 
+/**
+ * 安装本地 cc-tool 托管的技能
+ * POST /api/skills/install-local
+ * Body: { directory }
+ */
+router.post('/install-local', (req, res) => {
+  try {
+    const { platform, service } = getSkillService(req);
+    const { directory } = req.body;
+
+    if (!directory) {
+      return res.status(400).json({ success: false, message: 'Missing directory' });
+    }
+
+    const result = service.installLocalSkill(directory);
+    res.json({ success: true, platform, ...result });
+  } catch (err) {
+    console.error('[Skills API] Install local skill error:', err);
+    res.status(500).json({ success: false, message: err.message });
+  }
+});
+
 /**
  * 创建自定义技能
  * POST /api/skills/create
@@ -264,22 +300,23 @@ router.get('/repos', (req, res) => {
 /**
  * 添加仓库
  * POST /api/skills/repos
- * Body: { owner, name, branch, directory, enabled }
+ * Body: { provider, owner, name, host, projectPath, localPath, branch, directory, enabled }
  * - directory: 可选，指定扫描的子目录路径
  */
 router.post('/repos', (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
-    const { owner, name, branch = 'main', directory = '', enabled = true } = req.body;
+    const repo = extractRepoPayload(req.body);
+    repo.enabled = req.body.enabled !== false;
 
-    if (!owner || !name) {
+    if (!repo.localPath && !repo.projectPath && (!repo.owner || !repo.name)) {
       return res.status(400).json({
         success: false,
-        message: 'Missing owner or name'
+        message: 'Missing repo info'
       });
     }
 
-    const repos = service.addRepo({ owner, name, branch, directory, enabled });
+    const repos = service.addRepo(repo);
 
     res.json({
       success: true,
@@ -295,6 +332,47 @@ router.post('/repos', (req, res) => {
   }
 });
 
+router.delete('/repos', (req, res) => {
+  try {
+    const { platform, service } = getSkillService(req);
+    const { id = '', owner = '', name = '', directory = '' } = req.query;
+    const repos = service.removeRepo(owner, name, directory, id);
+
+    res.json({
+      success: true,
+      platform,
+      repos
+    });
+  } catch (err) {
+    console.error('[Skills API] Remove repo error:', err);
+    res.status(500).json({
+      success: false,
+      message: err.message
+    });
+  }
+});
+
+router.put('/repos/toggle', (req, res) => {
+  try {
+    const { platform, service } = getSkillService(req);
+    const { id = '', owner = '', name = '', enabled, directory = '' } = req.body;
+
+    const repos = service.toggleRepo(owner, name, directory, enabled, id);
+
+    res.json({
+      success: true,
+      platform,
+      repos
+    });
+  } catch (err) {
+    console.error('[Skills API] Toggle repo error:', err);
+    res.status(500).json({
+      success: false,
+      message: err.message
+    });
+  }
+});
+
 /**
  * 删除仓库
  * DELETE /api/skills/repos/:owner/:name

package/src/server/api/ui-config.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const router = express.Router();
+const { createSameOriginGuard } = require('../services/network-access');
 const {
   loadUIConfig,
   saveUIConfig,
@@ -7,6 +8,10 @@ const {
   updateNestedUIConfig
 } = require('../services/ui-config');
 
+router.use(createSameOriginGuard({
+  message: '禁止跨站访问 UI 配置接口'
+}));
+
 // Get all UI config
 router.get('/', (req, res) => {
   try {

package/src/server/codex-proxy-server.js

@@ -11,8 +11,9 @@ const { resolveModelPricing } = require('./utils/pricing');
 const { recordRequest: recordCodexRequest } = require('./services/codex-statistics-service');
 const { saveProxyStartTime, clearProxyStartTime, getProxyStartTime, getProxyRuntime } = require('./services/proxy-runtime');
 const { createDecodedStream } = require('./services/response-decoder');
-const { getEnabledChannels, writeCodexConfigForMultiChannel, getEffectiveApiKey } = require('./services/codex-channels');
+const { getEffectiveApiKey } = require('./services/codex-channels');
 const { persistProxyRequestSnapshot } = require('./services/request-logger');
+const { publishUsageLog, publishFailureLog } = require('./services/proxy-log-helper');
 
 let proxyServer = null;
 let proxyApp = null;
@@ -270,6 +271,14 @@ async function startCodexProxyServer(options = {}) {
         const effectiveKey = getEffectiveApiKey(channel);
         if (!effectiveKey) {
           release();
+          publishFailureLog({
+            source: 'codex',
+            channel: channel.name,
+            message: 'API key not configured or expired. Please update your channel key.',
+            statusCode: 401,
+            stage: 'preflight',
+            broadcastLog
+          });
           return res.status(401).json({
             error: {
               message: 'API key not configured or expired. Please update your channel key.',
@@ -324,6 +333,20 @@ async function startCodexProxyServer(options = {}) {
           release();
           if (err) {
             recordFailure(channel.id, 'codex', err);
+            const metadata = requestMetadata.get(req) || {
+              channel: channel.name,
+              channelId: channel.id,
+              startTime: Date.now()
+            };
+            publishFailureLog({
+              source: 'codex',
+              metadata,
+              message: err.message,
+              error: err,
+              statusCode: 502,
+              stage: 'proxy_web',
+              broadcastLog
+            });
             console.error('Codex proxy error:', err);
             if (res && !res.headersSent) {
               res.status(502).json({
@@ -337,6 +360,13 @@ async function startCodexProxyServer(options = {}) {
         });
       } catch (error) {
         console.error('Codex channel allocation error:', error);
+        publishFailureLog({
+          source: 'codex',
+          message: error.message || 'No Codex channel available',
+          statusCode: 503,
+          stage: 'allocate_channel',
+          broadcastLog
+        });
         if (!res.headersSent) {
           res.status(503).json({
             error: {
@@ -389,8 +419,40 @@ async function startCodexProxyServer(options = {}) {
         totalTokens: 0,
         model: ''
       };
+      let usageRecorded = false;
       const parsedStream = createDecodedStream(proxyRes);
 
+      function recordUsageIfReady() {
+        if (usageRecorded) {
+          return false;
+        }
+
+        const result = publishUsageLog({
+          source: 'codex',
+          metadata,
+          model: tokenData.model,
+          tokens: {
+            input: tokenData.inputTokens,
+            output: tokenData.outputTokens,
+            cached: tokenData.cachedTokens,
+            reasoning: tokenData.reasoningTokens,
+            total: tokenData.totalTokens
+          },
+          calculateCost,
+          broadcastLog,
+          recordRequest: recordCodexRequest,
+          recordSuccess,
+          allowBroadcast: !isResponseClosed
+        });
+
+        if (!result) {
+          return false;
+        }
+
+        usageRecorded = true;
+        return true;
+      }
+
       parsedStream.on('data', (chunk) => {
         // 如果响应已关闭，停止处理
         if (isResponseClosed) {
@@ -455,7 +517,10 @@ async function startCodexProxyServer(options = {}) {
                 // 兼容 Responses API 和 Chat Completions API
                 tokenData.inputTokens = parsed.usage.input_tokens || parsed.usage.prompt_tokens || 0;
                 tokenData.outputTokens = parsed.usage.output_tokens || parsed.usage.completion_tokens || 0;
+                tokenData.totalTokens = parsed.usage.total_tokens || (tokenData.inputTokens + tokenData.outputTokens);
               }
+
+              recordUsageIfReady();
             } catch (err) {
               // 忽略解析错误
             }
@@ -475,71 +540,14 @@ async function startCodexProxyServer(options = {}) {
               // 兼容两种格式
               tokenData.inputTokens = parsed.usage.input_tokens || parsed.usage.prompt_tokens || 0;
               tokenData.outputTokens = parsed.usage.output_tokens || parsed.usage.completion_tokens || 0;
+              tokenData.totalTokens = parsed.usage.total_tokens || (tokenData.inputTokens + tokenData.outputTokens);
             }
           } catch (err) {
             // 忽略解析错误
           }
         }
 
-        // 只有当有 token 数据时才记录
-        if (tokenData.inputTokens > 0 || tokenData.outputTokens > 0) {
-          const now = new Date();
-          const time = now.toLocaleTimeString('zh-CN', {
-            hour12: false,
-            hour: '2-digit',
-            minute: '2-digit',
-            second: '2-digit'
-          });
-
-          // 记录统计数据（先计算）
-          const tokens = {
-            input: tokenData.inputTokens,
-            output: tokenData.outputTokens,
-            total: tokenData.inputTokens + tokenData.outputTokens
-          };
-          const cost = calculateCost(tokenData.model, tokens);
-
-          // 广播日志（仅当响应仍然开放时）
-          if (!isResponseClosed) {
-            broadcastLog({
-              type: 'log',
-              id: metadata.id,
-              time: time,
-              channel: metadata.channel,
-              model: tokenData.model,
-              inputTokens: tokenData.inputTokens,
-              outputTokens: tokenData.outputTokens,
-              cachedTokens: tokenData.cachedTokens,
-              reasoningTokens: tokenData.reasoningTokens,
-              totalTokens: tokenData.totalTokens,
-              cost: cost,
-              source: 'codex'
-            });
-          }
-
-          const duration = Date.now() - metadata.startTime;
-
-          recordCodexRequest({
-            id: metadata.id,
-            timestamp: new Date(metadata.startTime).toISOString(),
-            toolType: 'codex',
-            channel: metadata.channel,
-            channelId: metadata.channelId,
-            model: tokenData.model,
-            tokens: {
-              input: tokenData.inputTokens,
-              output: tokenData.outputTokens,
-              reasoning: tokenData.reasoningTokens,
-              cached: tokenData.cachedTokens,
-              total: tokens.total
-            },
-            duration: duration,
-            success: true,
-            cost: cost
-          });
-
-          recordSuccess(metadata.channelId, 'codex');
-        }
+        recordUsageIfReady();
 
         if (!isResponseClosed) {
           requestMetadata.delete(req);
@@ -553,6 +561,15 @@ async function startCodexProxyServer(options = {}) {
         }
         isResponseClosed = true;
         recordFailure(metadata.channelId, 'codex', err);
+        publishFailureLog({
+          source: 'codex',
+          metadata,
+          message: err.message,
+          error: err,
+          statusCode: proxyRes.statusCode,
+          stage: 'response_stream',
+          broadcastLog
+        });
         requestMetadata.delete(req);
       });
     });
@@ -565,6 +582,19 @@ async function startCodexProxyServer(options = {}) {
         releaseChannel(req.selectedChannel.id, 'codex');
         broadcastSchedulerState('codex', getSchedulerState('codex'));
       }
+      publishFailureLog({
+        source: 'codex',
+        metadata: (req && requestMetadata.get(req)) || {
+          channel: req?.selectedChannel?.name,
+          channelId: req?.selectedChannel?.id,
+          model: req?.body?.model
+        },
+        message: err.message,
+        error: err,
+        statusCode: 502,
+        stage: 'proxy',
+        broadcastLog
+      });
       if (res && !res.headersSent) {
         res.status(502).json({
           error: {
@@ -585,16 +615,6 @@ async function startCodexProxyServer(options = {}) {
         // 保存代理启动时间（如果是切换渠道，保留原有启动时间）
         saveProxyStartTime('codex', preserveStartTime);
 
-        // 启动代理时同步配置到 Codex 的 config.toml
-        try {
-          const enabledChannels = getEnabledChannels();
-          if (enabledChannels.length > 0) {
-            writeCodexConfigForMultiChannel(enabledChannels);
-          }
-        } catch (err) {
-          // ignore sync error
-        }
-
         resolve({ success: true, port });
       });