dsh-llm-codebuddy 1.3.3 → 1.3.5

package/codebuddy-auth.js

@@ -0,0 +1,186 @@
+import { spawn } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
+
+export const CODEBUDDY_SESSION_REF = "CODEBUDDY_LOGIN_SESSION";
+
+const BASE_URL = "https://copilot.tencent.com/v2/plugin";
+const USER_AGENT = "CLI/unknown CodeBuddy/2.137.1";
+const REQUEST_HEADERS = {
+  accept: "application/json",
+  "content-type": "application/json",
+  "user-agent": USER_AGENT,
+  "x-product": "SaaS",
+};
+const NO_ACCOUNT_HEADERS = {
+  "X-No-Authorization": "true",
+  "X-No-User-Id": "true",
+  "X-No-Enterprise-Id": "true",
+  "X-No-Department-Info": "true",
+};
+const NO_ID_HEADERS = {
+  "X-No-User-Id": "true",
+  "X-No-Enterprise-Id": "true",
+  "X-No-Department-Info": "true",
+};
+
+function calculateExpiresAt(auth, now = Date.now()) {
+  const result = { ...auth };
+  if (!result.expiresAt && Number.isFinite(result.expiresIn)) result.expiresAt = now + result.expiresIn * 1000;
+  if (!result.refreshExpiresAt && Number.isFinite(result.refreshExpiresIn)) result.refreshExpiresAt = now + result.refreshExpiresIn * 1000;
+  return result;
+}
+
+async function responseBody(response, action) {
+  try {
+    return await response.json();
+  } catch (error) {
+    throw new Error(`${action}返回了无法解析的数据`, { cause: error });
+  }
+}
+
+async function request(path, options, action) {
+  let response;
+  try {
+    response = await fetch(`${BASE_URL}${path}`, options);
+  } catch (error) {
+    if (options.signal?.aborted) throw new Error(`${action}已取消`, { cause: error });
+    throw new Error(`${action}无法连接 CodeBuddy 中国站`, { cause: error });
+  }
+  const body = await responseBody(response, action);
+  if (!response.ok || body?.code !== 0) throw new Error(`${action}失败（${body?.message ?? body?.msg ?? response.status}）`);
+  return body.data;
+}
+
+function enterpriseHeaders(session) {
+  const enterpriseId = session.account?.enterpriseId;
+  return {
+    ...(enterpriseId ? { "X-Enterprise-Id": enterpriseId, "X-Tenant-Id": enterpriseId } : {}),
+    ...(session.auth?.domain ? { "X-Domain": session.auth.domain } : {}),
+  };
+}
+
+async function poll(path, headers, action, timeoutMs, signal) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await delay(1000, undefined, { signal });
+    let response;
+    try {
+      response = await fetch(`${BASE_URL}${path}`, { headers: { ...REQUEST_HEADERS, ...headers }, signal });
+    } catch (error) {
+      if (signal?.aborted) throw new Error(`${action}已取消`, { cause: error });
+      continue;
+    }
+    const body = await responseBody(response, action);
+    if (response.ok && body?.code === 0 && body.data) return body.data;
+    if (response.status === 401 || response.status === 403) throw new Error(`${action}失败（${body?.message ?? body?.msg ?? response.status}）`);
+  }
+  throw new Error(`${action}超时`);
+}
+
+function openBrowser(url) {
+  const [command, args] = process.platform === "win32"
+    ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]]
+    : process.platform === "darwin"
+      ? ["open", [url]]
+      : ["xdg-open", [url]];
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+    child.once("error", reject);
+  });
+}
+
+function normalizeAccount(account) {
+  return {
+    ...(account?.userId || account?.uid ? { userId: account.userId ?? account.uid } : {}),
+    ...(account?.enterpriseId || account?.tenantId ? { enterpriseId: account.enterpriseId ?? account.tenantId } : {}),
+  };
+}
+
+export async function loginCodeBuddy(onAuthUrl, signal) {
+  const state = await request("/auth/state?platform=CLI", {
+    method: "POST",
+    headers: { ...REQUEST_HEADERS, ...NO_ACCOUNT_HEADERS },
+    body: "{}",
+    signal,
+  }, "创建 CodeBuddy 登录会话");
+  if (!state?.state || !state?.authUrl) throw new Error("CodeBuddy 登录接口没有返回登录地址");
+  try {
+    await openBrowser(state.authUrl);
+    onAuthUrl?.(state.authUrl, true);
+  } catch {
+    onAuthUrl?.(state.authUrl, false);
+  }
+  const auth = calculateExpiresAt(await poll(
+    `/auth/token?state=${encodeURIComponent(state.state)}`,
+    NO_ACCOUNT_HEADERS,
+    "等待 CodeBuddy 登录",
+    10 * 60_000,
+    signal,
+  ));
+  if (!auth.accessToken || !auth.refreshToken) throw new Error("CodeBuddy 登录接口没有返回完整令牌");
+  const account = await poll(
+    `/login/account?state=${encodeURIComponent(state.state)}`,
+    { ...enterpriseHeaders({ auth }), authorization: `Bearer ${auth.accessToken}`, ...NO_ID_HEADERS },
+    "获取 CodeBuddy 账号",
+    60_000,
+    signal,
+  );
+  return { auth, account: normalizeAccount(account) };
+}
+
+export async function refreshCodeBuddySession(session, signal) {
+  if (!session?.auth?.refreshToken) throw new Error("CodeBuddy 登录会话缺少刷新令牌，请重新登录");
+  const auth = await request("/auth/token/refresh", {
+    method: "POST",
+    headers: {
+      ...REQUEST_HEADERS,
+      ...enterpriseHeaders(session),
+      "X-Refresh-Token": session.auth.refreshToken,
+      "X-Auth-Refresh-Source": "plugin",
+    },
+    body: "{}",
+    signal,
+  }, "刷新 CodeBuddy 登录令牌");
+  const fresh = calculateExpiresAt(auth);
+  const merged = { ...session.auth, ...fresh, refreshToken: fresh?.refreshToken ?? session.auth.refreshToken };
+  if (!merged.accessToken) throw new Error("CodeBuddy 刷新接口没有返回访问令牌");
+  return { auth: merged, account: normalizeAccount(session.account) };
+}
+
+export function serializeCodeBuddySession(session) {
+  if (!session?.auth?.accessToken || !session?.auth?.refreshToken) throw new Error("CodeBuddy 登录会话无效");
+  return JSON.stringify({ auth: calculateExpiresAt(session.auth), account: normalizeAccount(session.account) });
+}
+
+export function parseCodeBuddySession(value) {
+  let session;
+  try {
+    session = JSON.parse(value);
+  } catch (error) {
+    throw new Error("CodeBuddy 登录凭据已损坏，请重新登录", { cause: error });
+  }
+  if (!session?.auth?.accessToken || !session?.auth?.refreshToken) throw new Error("CodeBuddy 登录凭据不完整，请重新登录");
+  return { auth: calculateExpiresAt(session.auth), account: normalizeAccount(session.account) };
+}
+
+export function sessionNeedsRefresh(session, now = Date.now()) {
+  const expiresAt = Number(session?.auth?.expiresAt);
+  if (Number.isFinite(expiresAt)) return expiresAt <= now + 2 * 60_000;
+  try {
+    const payload = JSON.parse(Buffer.from(session.auth.accessToken.split(".")[1], "base64url").toString("utf8"));
+    return Number.isFinite(payload.exp) ? payload.exp * 1000 <= now + 2 * 60_000 : true;
+  } catch {
+    return true;
+  }
+}
+
+export function sessionCacheDeadline(session, now = Date.now()) {
+  const expiresAt = Number(session?.auth?.expiresAt);
+  return Number.isFinite(expiresAt)
+    ? Math.max(now, Math.min(expiresAt - 2 * 60_000, now + 30 * 60_000))
+    : now + 5 * 60_000;
+}

package/codebuddy-web.js

@@ -0,0 +1,98 @@
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { CODEBUDDY_SESSION_REF, loginCodeBuddy, serializeCodeBuddySession } from "./codebuddy-auth.js";
+
+const PROVIDER = "codebuddy-cn";
+const API_KEY_ENV = "CODEBUDDY_API_KEY";
+const ROUTE = "/dsh-llm-codebuddy/auth";
+
+export function authenticationMode(config) {
+  const profile = config?.providers?.[PROVIDER];
+  return profile && profile.apiKeyEnv === undefined ? "token" : "api-key";
+}
+
+function json(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+
+function localPost(req) {
+  const address = req.socket.remoteAddress;
+  const loopback = address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+  if (!loopback) return false;
+  const origin = req.headers.origin;
+  if (!origin) return req.headers["sec-fetch-site"] === "same-origin";
+  try {
+    return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+}
+
+async function setMode(settings, mode) {
+  const config = settings.get("llm-pi-ai");
+  const exists = Object.hasOwn(config?.providers ?? {}, PROVIDER);
+  const path = ["providers", PROVIDER];
+  if (!exists) {
+    await settings.mutate("llm-pi-ai", [{ op: "set", path, value: mode === "token" ? {} : { apiKeyEnv: API_KEY_ENV } }]);
+    return;
+  }
+  await settings.mutate("llm-pi-ai", [{
+    op: mode === "token" ? "unset" : "set",
+    path: [...path, "apiKeyEnv"],
+    ...(mode === "api-key" ? { value: API_KEY_ENV } : {}),
+  }]);
+}
+
+export function installCodeBuddyWeb(ctx) {
+  ctx.inject(["webServer", "settings", "credentials"], (webCtx) => {
+    let loginPromise;
+    const currentState = async () => ({
+      ok: true,
+      mode: authenticationMode(webCtx.settings.get("llm-pi-ai")),
+      authenticated: (await webCtx.credentials.describe(credentialRef(CODEBUDDY_SESSION_REF))).configured,
+    });
+    const status = async (_req, res) => {
+      json(res, 200, await currentState());
+    };
+    const apiKey = async (req, res) => {
+      if (req.method !== "POST") return json(res, 405, { ok: false, message: "Method not allowed" });
+      if (!localPost(req)) return json(res, 403, { ok: false, message: "只允许从本机 DSH 页面切换认证方式" });
+      await setMode(webCtx.settings, "api-key");
+      json(res, 200, await currentState());
+    };
+    const token = async (req, res) => {
+      if (req.method !== "POST") return json(res, 405, { ok: false, message: "Method not allowed" });
+      if (!localPost(req)) return json(res, 403, { ok: false, message: "只允许从本机 DSH 页面切换认证方式" });
+      const state = await currentState();
+      if (!state.authenticated) return json(res, 409, { ok: false, message: "尚未保存 CodeBuddy 登录令牌" });
+      await setMode(webCtx.settings, "token");
+      json(res, 200, await currentState());
+    };
+    const login = async (req, res) => {
+      if (req.method !== "POST") return json(res, 405, { ok: false, message: "Method not allowed" });
+      if (!localPost(req)) return json(res, 403, { ok: false, message: "只允许从本机 DSH 页面登录" });
+      try {
+        loginPromise ??= (async () => {
+          const session = await loginCodeBuddy();
+          await webCtx.credentials.set(credentialRef(CODEBUDDY_SESSION_REF), serializeCodeBuddySession(session));
+          await setMode(webCtx.settings, "token");
+        })().finally(() => {
+          loginPromise = undefined;
+        });
+        await loginPromise;
+        json(res, 200, { ok: true, mode: "token", authenticated: true });
+      } catch (error) {
+        json(res, 500, { ok: false, message: error instanceof Error ? error.message : "CodeBuddy 登录失败" });
+      }
+    };
+    webCtx.effect(() => {
+      const dispose = [
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/status`, handler: status }),
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/api-key`, handler: apiKey }),
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/token`, handler: token }),
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/login`, handler: login }),
+      ];
+      return () => dispose.forEach((fn) => fn());
+    }, "llm-codebuddy: web login routes");
+  });
+}