coding-tool-x 3.3.8 → 3.4.0

package/src/server/services/gemini-statistics-service.js

@@ -4,34 +4,12 @@ const {
   getDailyStatistics: getSharedDailyStatistics,
   getTodayStatistics: getSharedTodayStatistics
 } = require('./statistics-service');
+const { normalizeUsageTokens, toNumber } = require('./proxy-log-helper');
 
 const TOOL_TYPE = 'gemini';
 
-function toNumber(value) {
-  const num = Number(value);
-  return Number.isFinite(num) ? num : 0;
-}
-
-function normalizeToolTokens(tokens = {}) {
-  const input = toNumber(tokens.input);
-  const output = toNumber(tokens.output);
-  const cached = toNumber(tokens.cached);
-  const cacheCreation = toNumber(tokens.cacheCreation);
-  const cacheRead = toNumber(tokens.cacheRead || cached);
-  const total = toNumber(tokens.total) || (input + output);
-
-  return {
-    input,
-    output,
-    cached,
-    cacheCreation,
-    cacheRead,
-    total
-  };
-}
-
 function toLegacyEntryShape(entry = {}, includeName = false) {
-  const normalized = normalizeToolTokens(entry.tokens || {});
+  const normalized = normalizeUsageTokens(TOOL_TYPE, entry.tokens || {});
   const result = {
     requests: toNumber(entry.requests),
     tokens: {
@@ -123,7 +101,7 @@ function buildDailyStatistics(sharedDaily = {}, fallbackDate) {
 }
 
 function recordRequest(requestData = {}) {
-  const normalizedTokens = normalizeToolTokens(requestData.tokens || {});
+  const normalizedTokens = normalizeUsageTokens(TOOL_TYPE, requestData.tokens || {});
   return recordSharedRequest({
     ...requestData,
     toolType: TOOL_TYPE,

package/src/server/services/mcp-service.js

@@ -12,14 +12,13 @@ const { spawn } = require('child_process');
 const http = require('http');
 const https = require('https');
 const { McpClient, buildMissingCommandMessage, createMissingCommandHint } = require('./mcp-client');
-const { NATIVE_PATHS } = require('../../config/paths');
+const { NATIVE_PATHS, PATHS } = require('../../config/paths');
 const { resolvePreferredHomeDir } = require('../../utils/home-dir');
 
 const HOME_DIR = resolvePreferredHomeDir(process.platform, process.env, os.homedir());
 
 // MCP 配置文件路径
-const CC_TOOL_DIR = path.join(HOME_DIR, '.cc-tool');
-const MCP_SERVERS_FILE = path.join(CC_TOOL_DIR, 'mcp-servers.json');
+const MCP_SERVERS_FILE = PATHS.mcpServers;
 
 // 各平台配置文件路径
 const CLAUDE_CONFIG_PATH = path.join(HOME_DIR, '.claude.json');

package/src/server/services/model-detector.js

@@ -11,7 +11,7 @@ const { URL } = require('url');
 const crypto = require('crypto');
 const zlib = require('zlib');
 const { loadConfig } = require('../../config/loader');
-const { HOME_DIR } = require('../../config/paths');
+const { PATHS } = require('../../config/paths');
 
 // 内置模型优先级（当配置缺失时兜底）
 const MODEL_PRIORITY = {
@@ -669,11 +669,12 @@ function collectResponseBody(res) {
  * Get cache file path
  */
 function getCacheFilePath() {
-  const dir = path.join(HOME_DIR, '.cc-tool');
+  const filePath = PATHS.channelModels;
+  const dir = path.dirname(filePath);
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true });
   }
-  return path.join(dir, 'channel-models.json');
+  return filePath;
 }
 
 /**

package/src/server/services/native-oauth-adapters.js

@@ -9,6 +9,7 @@ const claudeSettingsManager = require('./settings-manager');
 const codexSettingsManager = require('./codex-settings-manager');
 const geminiSettingsManager = require('./gemini-settings-manager');
 const opencodeSettingsManager = require('./opencode-settings-manager');
+const { syncCodexUserEnvironment } = require('./codex-env-manager');
 const nativeKeychain = require('./native-keychain');
 const { maskToken, decodeJwtPayload, removeFileIfExists, sha256 } = require('./oauth-utils');
 
@@ -312,7 +313,7 @@ function clearCodexOAuth() {
 }
 
 function removeCodexChannelEnvVars() {
-  // auth.json 由 clearCodexChannelConfig 负责清理，Codex 优先读取 auth.json，无需操作 shell 配置文件
+  syncCodexUserEnvironment({}, { replace: true });
 }
 
 function clearCodexChannelConfig() {

package/src/server/services/network-access.js

@@ -30,6 +30,26 @@ function isLoopbackRequest(req) {
   return true;
 }
 
+function isSameOriginRequest(req) {
+  if (!req) return false;
+  const origin = req.headers && req.headers.origin;
+  if (!origin) {
+    return true;
+  }
+
+  const host = req.headers && req.headers.host;
+  if (!host) {
+    return false;
+  }
+
+  try {
+    const originUrl = new URL(origin);
+    return originUrl.host === host;
+  } catch (error) {
+    return false;
+  }
+}
+
 function createRemoteMutationGuard(options = {}) {
   const enabled = options.enabled === true;
   const allowRemoteMutation = options.allowRemoteMutation === true;
@@ -71,10 +91,28 @@ function createRemoteRouteGuard(options = {}) {
   };
 }
 
+function createSameOriginGuard(options = {}) {
+  const enabled = options.enabled !== false;
+  const message = options.message || '禁止跨站访问该接口';
+
+  return (req, res, next) => {
+    if (!enabled || isSameOriginRequest(req)) {
+      return next();
+    }
+
+    return res.status(403).json({
+      error: message,
+      code: 'CROSS_ORIGIN_REQUEST_BLOCKED'
+    });
+  };
+}
+
 module.exports = {
   normalizeAddress,
   isLoopbackAddress,
   isLoopbackRequest,
+  isSameOriginRequest,
   createRemoteMutationGuard,
-  createRemoteRouteGuard
+  createRemoteRouteGuard,
+  createSameOriginGuard
 };