dsh-llm-codebuddy 1.3.4 → 1.3.5

package/README.md

@@ -1,7 +1,8 @@
 # DSH CodeBuddy Provider
 
-为 DeepSeek Harness（DSH）增加 `CodeBuddy 中国区` Provider。安装后可直接在
-DSH WebUI 中填写 API Key、获取模型、调整模型参数并使用 CodeBuddy 模型。
+为 DeepSeek Harness（DSH）增加 `CodeBuddy 中国区` Provider。支持 WorkBuddy
+API Key 和 CodeBuddy 中国站账号令牌两种认证方式，并可在 DSH WebUI 中获取、
+选择和调整模型。
 
 > [!IMPORTANT]
 > API Key 由 **WorkBuddy** 提供，本插件使用该 Key 调用供 CodeBuddy 使用的模型服务。
@@ -10,8 +11,10 @@ DSH WebUI 中填写 API Key、获取模型、调整模型参数并使用 CodeBud
 
 ## 功能
 
-- WebUI 中直接添加 `CodeBuddy 中国区`；
-- 只需填写从 WorkBuddy 获取的 API Key；
+- WebUI 中直接添加 `CodeBuddy 中国区`；
+- 支持从 WorkBuddy 获取的 API Key；
+- API Key 输入框旁可显式切换 `API Key` / `令牌登录`；
+- 支持从 WebUI 拉起浏览器登录 CodeBuddy 中国站，并自动复用、刷新登录令牌；
 - 自动获取 CodeBuddy 当前可用模型；
 - 支持编辑模型 ID、名称、上下文窗口和最大输出 Token；
 - 支持添加、删除模型以及重新同步模型目录；
@@ -24,10 +27,10 @@ DSH WebUI 中填写 API Key、获取模型、调整模型参数并使用 CodeBud
 
 - Windows、Linux 或 macOS；
 - Node.js `>= 22.19.0`；
-- 已安装 DSH；
-- 已验证 DSH `0.1.0-rc.6`。
-
-安装器已自带 DSH 所需的 `pnpm`，无需全局安装。
+- 已安装 DSH；
+- 已验证 DSH `0.1.0-rc.6`。
+
+安装器已自带 DSH 所需的 `pnpm`，无需全局安装；令牌登录也不需要安装 CodeBuddy CLI。
 
 > DSH 仍处于预发布阶段。未来版本如果调整插件接口，本插件可能需要同步升级；
 > DSH 普通更新不会覆盖本插件。
@@ -51,9 +54,35 @@ dsh plugin --profile headless add dsh-llm-codebuddy@latest
 
 只使用 WebUI 时，仅执行第一条即可。
 
-## WebUI 配置
-
-1. 打开“设置 → 模型”。
+## WebUI 配置
+
+### CodeBuddy 账号令牌登录（新用户推荐）
+
+1. 打开“设置 → 模型”。
+2. 添加或编辑 `CodeBuddy 中国区`。
+3. 点击 API Key 输入框右侧的“令牌登录”。
+4. 在自动打开的浏览器中完成 CodeBuddy 中国站登录。
+5. WebUI 显示“令牌已登录”后即可获取模型并保存自定义目录。
+
+如果 WebUI 无法打开浏览器，也可以使用命令行入口：
+
+```powershell
+npx --yes dsh-llm-codebuddy@latest login
+```
+
+插件会调用 CodeBuddy 官方认证流程。完成登录后，插件会自动把
+`CodeBuddy 中国区` Provider 切换为令牌模式，无需 API Key。点击同一行的
+“API Key”可以切回 API Key 模式；已经保存的 API Key 不会被删除。
+两种凭据彼此独立保留，之后再次点击“令牌登录”会优先复用已保存令牌；仅在没有
+令牌或主动重新登录时才需要再次打开浏览器。
+
+插件直接调用 CodeBuddy 中国站官方网页登录和令牌刷新接口，不依赖本机
+`codebuddy` 命令。访问令牌和刷新令牌保存在 DSH 凭据服务中，不会写入
+`settings.yaml` 或模型目录。
+
+### WorkBuddy API Key
+
+1. 打开“设置 → 模型”。
 2. 点击“添加提供方”。
 3. 选择 `CodeBuddy 中国区`。
 4. 输入从 WorkBuddy 获取的 API Key 并保存。
@@ -116,7 +145,7 @@ npx --yes dsh-llm-codebuddy@latest uninstall
 2. 只删除 `llm-pi-ai.providers.codebuddy-cn` 配置；
 3. 保留其他 Provider 和 DSH 设置；
 4. 从 `web`、`headless` Profile 移除插件；
-5. 保留 API Key 凭据，方便以后重新安装。
+5. 保留 API Key 和登录令牌凭据，方便以后重新安装。
 
 完成后重启 DSH。备份文件名类似：
 
@@ -141,28 +170,43 @@ dsh plugin --profile web list --depth 0
 确认 API Key 来自 WorkBuddy 且仍然有效，然后重新输入 Key 并点击“获取可用模型”。
 接口临时不可用时，插件仍会提供内置模型目录。
 
-### 为什么别人能看到某个模型，我这里看不到
+### 为什么别人能看到某个模型，我这里看不到
 
 模型权限与 API Key 绑定。插件只导入 `/v3/config` 中 `agents[name=cli].models` 为
 当前 Key 返回的模型；更换 Key 后请重新点击“获取可用模型”。插件不会强行显示
-当前 Key 未授权的模型。
-
-## 开发文档
-
-需要开发其他 Agent 或 Provider 时，请阅读
-[CodeBuddy 调用 WorkBuddy API 开发文档](./docs/CodeBuddy调用WorkBuddy-API开发文档.md)。
-
-### 卸载后仍显示旧页面
-
-关闭正在运行的 DSH，再重新启动。已经运行的进程不会自动卸载内存中的插件。
-
-## 工作原理
+当前 Key 未授权的模型。
+
+### 调用时报 `500 status code (no body)`
+
+先更新到最新版并重启 DSH：
+
+```powershell
+npx --yes dsh-llm-codebuddy@latest install
+```
+
+旧版本可能被 DSH 覆盖 CodeBuddy 请求标识，导致服务端拒绝请求；最新版已在插件请求层
+恢复 CodeBuddy 官方标识，同时适用于 API Key 和令牌模式。
+
+### 卸载后仍显示旧页面
+
+关闭正在运行的 DSH，再重新启动。已经运行的进程不会自动卸载内存中的插件。
+
+## 开发文档
+
+需要开发其他 Agent 或 Provider 时，请阅读
+[反向代理调用 WorkBuddy API 开发文档](./docs/反向代理调用WorkBuddy-API开发文档.md)。
+
+## 工作原理
 
 ```text
-WorkBuddy 提供 API Key
-          ↓
-DSH Agent → 本插件 → CodeBuddy /v2/chat/completions
-                    ↘ CodeBuddy /v3/config（获取模型）
+WorkBuddy 提供 API Key
+          ↓
+DSH Agent → 本插件 → CodeBuddy /v2/chat/completions
+                    ↘ CodeBuddy /v3/config（获取模型）
+
+CodeBuddy 中国站网页登录 → 本插件保存并刷新 DSH 登录凭据
+                              ↓ 当前 access token
+DSH Agent → 本插件 → CodeBuddy API（Authorization: Bearer）
 ```
 
 - DSH：负责 Agent 循环、上下文、工具调用和权限；

package/cli.js

@@ -6,6 +6,7 @@ import { createRequire } from "node:module";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { parseDocument } from "yaml";
+import { CODEBUDDY_SESSION_REF, loginCodeBuddy, parseCodeBuddySession, serializeCodeBuddySession } from "./codebuddy-auth.js";
 
 const PACKAGE = "dsh-llm-codebuddy";
 const PACKAGE_VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;
@@ -110,6 +111,43 @@ function cleanSettings(file) {
   return backup;
 }
 
+function enableTokenLogin(home = dshHome()) {
+  const file = join(home, "settings.yaml");
+  const source = existsSync(file) ? readFileSync(file, "utf8") : "{}\n";
+  const document = parseDocument(source);
+  if (document.errors.length) throw new Error(`无法解析 ${file}：${document.errors[0].message}`);
+  if (document.hasIn(PROVIDER_PATH)) document.deleteIn([...PROVIDER_PATH, "apiKeyEnv"]);
+  else document.setIn(PROVIDER_PATH, {});
+  if (existsSync(file)) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    copyFileSync(file, `${file}.codebuddy-backup-${stamp}`);
+  }
+  writeYamlDocument(file, document);
+}
+
+function storeLoginSession(session, home = dshHome()) {
+  const file = join(home, ".credentials.yaml");
+  const document = parseDocument(existsSync(file) ? readFileSync(file, "utf8") : "{}\n");
+  if (document.errors.length) throw new Error(`无法解析 ${file}：${document.errors[0].message}`);
+  document.set(CODEBUDDY_SESSION_REF, serializeCodeBuddySession(session));
+  if (existsSync(file)) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    copyFileSync(file, `${file}.codebuddy-backup-${stamp}`);
+  }
+  writeYamlDocument(file, document);
+}
+
+async function login() {
+  console.log("正在打开 CodeBuddy 中国站网页登录（无需安装 CodeBuddy CLI）……");
+  const session = await loginCodeBuddy((url, opened) => {
+    if (opened) console.log("浏览器登录页已打开，请在浏览器中完成登录。");
+    else console.log(`无法自动打开浏览器，请手动访问：${url}`);
+  });
+  storeLoginSession(session);
+  enableTokenLogin();
+  console.log("CodeBuddy 令牌登录成功，Provider 已切换为令牌模式。请重启 DSH。");
+}
+
 function install() {
   for (const profile of ["web", "headless"]) {
     runDsh(["plugin", "--profile", profile, "list", "--depth", "0"]);
@@ -129,7 +167,7 @@ function uninstall(home = dshHome()) {
     cleanPnpmWorkspace(workspace);
   }
   console.log(backup ? `CodeBuddy 配置已清理，备份：${backup}` : "未发现 CodeBuddy Provider 配置。");
-  console.log("插件已卸载，API Key 凭据保持不变。请重启 DSH。");
+  console.log("插件已卸载，API Key 和登录令牌凭据保持不变。请重启 DSH。");
 }
 
 function selfTest() {
@@ -137,11 +175,29 @@ function selfTest() {
   try {
     const file = join(root, "settings.yaml");
     writeFileSync(file, "llm-pi-ai:\n  providers:\n    opencode-go:\n      apiKeyEnv: OPENCODE_GO_API_KEY\n    codebuddy-cn:\n      apiKeyEnv: CODEBUDDY_CN_API_KEY\n", "utf8");
+    enableTokenLogin(root);
+    const tokenMode = parseDocument(readFileSync(file, "utf8"));
+    if (tokenMode.hasIn([...PROVIDER_PATH, "apiKeyEnv"]) || !tokenMode.hasIn(PROVIDER_PATH)) {
+      throw new Error("token login settings self-test failed");
+    }
     const backup = cleanSettings(file);
     const result = parseDocument(readFileSync(file, "utf8"));
     if (!backup || !existsSync(backup) || result.hasIn(PROVIDER_PATH) || !result.hasIn(["llm-pi-ai", "providers", "opencode-go"])) {
       throw new Error("uninstall settings cleanup self-test failed");
     }
+    enableTokenLogin(root);
+    if (!parseDocument(readFileSync(file, "utf8")).hasIn(PROVIDER_PATH)) {
+      throw new Error("token login provider creation self-test failed");
+    }
+    const sampleSession = {
+      auth: { accessToken: "test-access-token", refreshToken: "test-refresh-token", expiresAt: Date.now() + 60_000 },
+      account: { userId: "test-user" },
+    };
+    storeLoginSession(sampleSession, root);
+    const storedSession = parseDocument(readFileSync(join(root, ".credentials.yaml"), "utf8")).get(CODEBUDDY_SESSION_REF);
+    if (parseCodeBuddySession(storedSession).account.userId !== "test-user") {
+      throw new Error("token credential storage self-test failed");
+    }
     const workspace = join(root, "pnpm-workspace.yaml");
     writeFileSync(workspace, "packages:\n  - .\nallowBuilds:\n  '@google/genai': true\n  protobufjs: pending\n", "utf8");
     withPnpmBuildPolicy(workspace, () => {
@@ -172,8 +228,9 @@ function selfTest() {
 const command = process.argv[2];
 if (command === "install") install();
 else if (command === "uninstall") uninstall();
+else if (command === "login") await login();
 else if (command === "--self-test") selfTest();
 else {
-  console.log("用法：dsh-llm-codebuddy <install|uninstall>");
+  console.log("用法：dsh-llm-codebuddy <install|login|uninstall>");
   process.exitCode = 1;
 }

package/client.js

@@ -0,0 +1,152 @@
+window.__ModuleLoader__.load({
+  id: "dsh-llm-codebuddy",
+  factory: () => {
+    const ROUTE = "/dsh-llm-codebuddy/auth";
+    const MARKER = "data-codebuddy-auth-switch";
+
+    function button(text) {
+      const element = document.createElement("button");
+      element.type = "button";
+      element.textContent = text;
+      Object.assign(element.style, {
+        minHeight: "44px",
+        padding: "0 12px",
+        border: "1px solid var(--dsw-border-subtle, #d0d5dd)",
+        borderRadius: "8px",
+        background: "var(--dsw-surface-subtle, transparent)",
+        color: "inherit",
+        cursor: "pointer",
+        whiteSpace: "nowrap",
+      });
+      return element;
+    }
+
+    function isCodeBuddy(input) {
+      const editor = input.parentElement?.parentElement;
+      if (!editor) return false;
+      if (editor.textContent?.includes("codebuddy-cn")) return true;
+      return editor.parentElement?.querySelector('select[aria-label="提供方"]')?.value === "codebuddy-cn";
+    }
+
+    function applyMode(input, keyButton, tokenButton, message, status) {
+      const token = status.mode === "token";
+      input.disabled = token;
+      input.placeholder = token ? "当前使用 CodeBuddy 账号令牌" : input.dataset.codebuddyPlaceholder || "输入 API 密钥";
+      keyButton.setAttribute("aria-pressed", String(!token));
+      tokenButton.setAttribute("aria-pressed", String(token));
+      keyButton.style.background = !token ? "var(--dsw-accent-subtle, #eef4ff)" : "var(--dsw-surface-subtle, transparent)";
+      tokenButton.style.background = token ? "var(--dsw-accent-subtle, #eef4ff)" : "var(--dsw-surface-subtle, transparent)";
+      message.textContent = token ? status.authenticated ? "令牌已登录" : "令牌缺失，请重新登录" : "";
+      message.style.color = token && !status.authenticated ? "var(--dsw-text-danger, #c62828)" : "var(--dsw-text-success, #2e7d32)";
+    }
+
+    async function request(path) {
+      const response = await fetch(`${ROUTE}/${path}`, { method: "POST" });
+      const body = await response.json();
+      if (!response.ok || !body.ok) {
+        const error = new Error(body.message || `请求失败（${response.status}）`);
+        error.status = response.status;
+        throw error;
+      }
+      return body;
+    }
+
+    function mount(input) {
+      const field = input.parentElement;
+      if (!field || field.querySelector(`[${MARKER}]`)) return;
+      field.setAttribute("data-codebuddy-auth-field", "");
+      input.dataset.codebuddyPlaceholder = input.placeholder;
+      const controls = document.createElement("div");
+      controls.setAttribute(MARKER, "");
+      controls.setAttribute("role", "group");
+      controls.setAttribute("aria-label", "CodeBuddy 认证方式");
+      Object.assign(controls.style, { display: "flex", alignItems: "center", gap: "8px", flexWrap: "wrap" });
+      const keyButton = button("API Key");
+      const tokenButton = button("令牌登录");
+      const message = document.createElement("span");
+      message.setAttribute("role", "status");
+      message.setAttribute("aria-live", "polite");
+      Object.assign(message.style, { fontSize: "12px", minHeight: "18px" });
+      controls.append(keyButton, tokenButton, message);
+      field.append(controls);
+      let current = { mode: "api-key", authenticated: false };
+      const render = (status) => {
+        current = { ...current, ...status };
+        applyMode(input, keyButton, tokenButton, message, current);
+      };
+
+      const setBusy = (busy) => {
+        keyButton.disabled = busy;
+        tokenButton.disabled = busy;
+        keyButton.style.cursor = busy ? "progress" : "pointer";
+        tokenButton.style.cursor = busy ? "progress" : "pointer";
+      };
+      keyButton.addEventListener("click", async () => {
+        setBusy(true);
+        message.textContent = "正在切换…";
+        try {
+          render(await request("api-key"));
+          input.focus();
+        } catch (error) {
+          message.textContent = error instanceof Error ? error.message : "切换失败";
+          message.style.color = "var(--dsw-text-danger, #c62828)";
+        } finally {
+          setBusy(false);
+        }
+      });
+      tokenButton.addEventListener("click", async () => {
+        setBusy(true);
+        tokenButton.textContent = "等待浏览器登录…";
+        message.textContent = "请在浏览器中完成 CodeBuddy 中国站登录";
+        try {
+          const path = current.mode === "api-key" && current.authenticated ? "token" : "login";
+          render(await request(path));
+        } catch (error) {
+          message.textContent = error instanceof Error ? error.message : "登录失败";
+          message.style.color = "var(--dsw-text-danger, #c62828)";
+        } finally {
+          tokenButton.textContent = "令牌登录";
+          setBusy(false);
+        }
+      });
+      fetch(`${ROUTE}/status`, { cache: "no-store" })
+        .then((response) => response.json())
+        .then(render)
+        .catch(() => {
+          message.textContent = "认证状态读取失败";
+          message.style.color = "var(--dsw-text-danger, #c62828)";
+        });
+    }
+
+    function enhance() {
+      for (const input of document.querySelectorAll('input[aria-label="API 密钥"]')) {
+        if (isCodeBuddy(input)) mount(input);
+      }
+    }
+
+    function apply(ctx) {
+      ctx.effect(() => {
+        const style = document.createElement("style");
+        style.textContent = `
+          [data-codebuddy-auth-field] { display: grid !important; grid-template-columns: minmax(0, 1fr) auto; gap: 8px; }
+          [data-codebuddy-auth-field] > span:first-child { grid-column: 1 / -1; }
+          [data-codebuddy-auth-field] > input[aria-label="API 密钥"] { grid-column: 1; min-width: 0; }
+          [data-codebuddy-auth-field] > [data-codebuddy-auth-switch] { grid-column: 2; }
+          @media (max-width: 640px) { [data-codebuddy-auth-field] > [data-codebuddy-auth-switch] { grid-column: 1 / -1; } }
+        `;
+        document.head.append(style);
+        const observer = new MutationObserver(enhance);
+        observer.observe(document.body, { childList: true, subtree: true });
+        document.addEventListener("change", enhance, true);
+        enhance();
+        return () => {
+          style.remove();
+          observer.disconnect();
+          document.removeEventListener("change", enhance, true);
+        };
+      }, "llm-codebuddy: auth switch");
+    }
+
+    return { name: "dsh-llm-codebuddy-client", inject: [], apply };
+  },
+});

package/codebuddy-auth.js

@@ -0,0 +1,186 @@
+import { spawn } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
+
+export const CODEBUDDY_SESSION_REF = "CODEBUDDY_LOGIN_SESSION";
+
+const BASE_URL = "https://copilot.tencent.com/v2/plugin";
+const USER_AGENT = "CLI/unknown CodeBuddy/2.137.1";
+const REQUEST_HEADERS = {
+  accept: "application/json",
+  "content-type": "application/json",
+  "user-agent": USER_AGENT,
+  "x-product": "SaaS",
+};
+const NO_ACCOUNT_HEADERS = {
+  "X-No-Authorization": "true",
+  "X-No-User-Id": "true",
+  "X-No-Enterprise-Id": "true",
+  "X-No-Department-Info": "true",
+};
+const NO_ID_HEADERS = {
+  "X-No-User-Id": "true",
+  "X-No-Enterprise-Id": "true",
+  "X-No-Department-Info": "true",
+};
+
+function calculateExpiresAt(auth, now = Date.now()) {
+  const result = { ...auth };
+  if (!result.expiresAt && Number.isFinite(result.expiresIn)) result.expiresAt = now + result.expiresIn * 1000;
+  if (!result.refreshExpiresAt && Number.isFinite(result.refreshExpiresIn)) result.refreshExpiresAt = now + result.refreshExpiresIn * 1000;
+  return result;
+}
+
+async function responseBody(response, action) {
+  try {
+    return await response.json();
+  } catch (error) {
+    throw new Error(`${action}返回了无法解析的数据`, { cause: error });
+  }
+}
+
+async function request(path, options, action) {
+  let response;
+  try {
+    response = await fetch(`${BASE_URL}${path}`, options);
+  } catch (error) {
+    if (options.signal?.aborted) throw new Error(`${action}已取消`, { cause: error });
+    throw new Error(`${action}无法连接 CodeBuddy 中国站`, { cause: error });
+  }
+  const body = await responseBody(response, action);
+  if (!response.ok || body?.code !== 0) throw new Error(`${action}失败（${body?.message ?? body?.msg ?? response.status}）`);
+  return body.data;
+}
+
+function enterpriseHeaders(session) {
+  const enterpriseId = session.account?.enterpriseId;
+  return {
+    ...(enterpriseId ? { "X-Enterprise-Id": enterpriseId, "X-Tenant-Id": enterpriseId } : {}),
+    ...(session.auth?.domain ? { "X-Domain": session.auth.domain } : {}),
+  };
+}
+
+async function poll(path, headers, action, timeoutMs, signal) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await delay(1000, undefined, { signal });
+    let response;
+    try {
+      response = await fetch(`${BASE_URL}${path}`, { headers: { ...REQUEST_HEADERS, ...headers }, signal });
+    } catch (error) {
+      if (signal?.aborted) throw new Error(`${action}已取消`, { cause: error });
+      continue;
+    }
+    const body = await responseBody(response, action);
+    if (response.ok && body?.code === 0 && body.data) return body.data;
+    if (response.status === 401 || response.status === 403) throw new Error(`${action}失败（${body?.message ?? body?.msg ?? response.status}）`);
+  }
+  throw new Error(`${action}超时`);
+}
+
+function openBrowser(url) {
+  const [command, args] = process.platform === "win32"
+    ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]]
+    : process.platform === "darwin"
+      ? ["open", [url]]
+      : ["xdg-open", [url]];
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+    child.once("error", reject);
+  });
+}
+
+function normalizeAccount(account) {
+  return {
+    ...(account?.userId || account?.uid ? { userId: account.userId ?? account.uid } : {}),
+    ...(account?.enterpriseId || account?.tenantId ? { enterpriseId: account.enterpriseId ?? account.tenantId } : {}),
+  };
+}
+
+export async function loginCodeBuddy(onAuthUrl, signal) {
+  const state = await request("/auth/state?platform=CLI", {
+    method: "POST",
+    headers: { ...REQUEST_HEADERS, ...NO_ACCOUNT_HEADERS },
+    body: "{}",
+    signal,
+  }, "创建 CodeBuddy 登录会话");
+  if (!state?.state || !state?.authUrl) throw new Error("CodeBuddy 登录接口没有返回登录地址");
+  try {
+    await openBrowser(state.authUrl);
+    onAuthUrl?.(state.authUrl, true);
+  } catch {
+    onAuthUrl?.(state.authUrl, false);
+  }
+  const auth = calculateExpiresAt(await poll(
+    `/auth/token?state=${encodeURIComponent(state.state)}`,
+    NO_ACCOUNT_HEADERS,
+    "等待 CodeBuddy 登录",
+    10 * 60_000,
+    signal,
+  ));
+  if (!auth.accessToken || !auth.refreshToken) throw new Error("CodeBuddy 登录接口没有返回完整令牌");
+  const account = await poll(
+    `/login/account?state=${encodeURIComponent(state.state)}`,
+    { ...enterpriseHeaders({ auth }), authorization: `Bearer ${auth.accessToken}`, ...NO_ID_HEADERS },
+    "获取 CodeBuddy 账号",
+    60_000,
+    signal,
+  );
+  return { auth, account: normalizeAccount(account) };
+}
+
+export async function refreshCodeBuddySession(session, signal) {
+  if (!session?.auth?.refreshToken) throw new Error("CodeBuddy 登录会话缺少刷新令牌，请重新登录");
+  const auth = await request("/auth/token/refresh", {
+    method: "POST",
+    headers: {
+      ...REQUEST_HEADERS,
+      ...enterpriseHeaders(session),
+      "X-Refresh-Token": session.auth.refreshToken,
+      "X-Auth-Refresh-Source": "plugin",
+    },
+    body: "{}",
+    signal,
+  }, "刷新 CodeBuddy 登录令牌");
+  const fresh = calculateExpiresAt(auth);
+  const merged = { ...session.auth, ...fresh, refreshToken: fresh?.refreshToken ?? session.auth.refreshToken };
+  if (!merged.accessToken) throw new Error("CodeBuddy 刷新接口没有返回访问令牌");
+  return { auth: merged, account: normalizeAccount(session.account) };
+}
+
+export function serializeCodeBuddySession(session) {
+  if (!session?.auth?.accessToken || !session?.auth?.refreshToken) throw new Error("CodeBuddy 登录会话无效");
+  return JSON.stringify({ auth: calculateExpiresAt(session.auth), account: normalizeAccount(session.account) });
+}
+
+export function parseCodeBuddySession(value) {
+  let session;
+  try {
+    session = JSON.parse(value);
+  } catch (error) {
+    throw new Error("CodeBuddy 登录凭据已损坏，请重新登录", { cause: error });
+  }
+  if (!session?.auth?.accessToken || !session?.auth?.refreshToken) throw new Error("CodeBuddy 登录凭据不完整，请重新登录");
+  return { auth: calculateExpiresAt(session.auth), account: normalizeAccount(session.account) };
+}
+
+export function sessionNeedsRefresh(session, now = Date.now()) {
+  const expiresAt = Number(session?.auth?.expiresAt);
+  if (Number.isFinite(expiresAt)) return expiresAt <= now + 2 * 60_000;
+  try {
+    const payload = JSON.parse(Buffer.from(session.auth.accessToken.split(".")[1], "base64url").toString("utf8"));
+    return Number.isFinite(payload.exp) ? payload.exp * 1000 <= now + 2 * 60_000 : true;
+  } catch {
+    return true;
+  }
+}
+
+export function sessionCacheDeadline(session, now = Date.now()) {
+  const expiresAt = Number(session?.auth?.expiresAt);
+  return Number.isFinite(expiresAt)
+    ? Math.max(now, Math.min(expiresAt - 2 * 60_000, now + 30 * 60_000))
+    : now + 5 * 60_000;
+}

package/codebuddy-web.js

@@ -0,0 +1,98 @@
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { CODEBUDDY_SESSION_REF, loginCodeBuddy, serializeCodeBuddySession } from "./codebuddy-auth.js";
+
+const PROVIDER = "codebuddy-cn";
+const API_KEY_ENV = "CODEBUDDY_API_KEY";
+const ROUTE = "/dsh-llm-codebuddy/auth";
+
+export function authenticationMode(config) {
+  const profile = config?.providers?.[PROVIDER];
+  return profile && profile.apiKeyEnv === undefined ? "token" : "api-key";
+}
+
+function json(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+
+function localPost(req) {
+  const address = req.socket.remoteAddress;
+  const loopback = address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+  if (!loopback) return false;
+  const origin = req.headers.origin;
+  if (!origin) return req.headers["sec-fetch-site"] === "same-origin";
+  try {
+    return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+}
+
+async function setMode(settings, mode) {
+  const config = settings.get("llm-pi-ai");
+  const exists = Object.hasOwn(config?.providers ?? {}, PROVIDER);
+  const path = ["providers", PROVIDER];
+  if (!exists) {
+    await settings.mutate("llm-pi-ai", [{ op: "set", path, value: mode === "token" ? {} : { apiKeyEnv: API_KEY_ENV } }]);
+    return;
+  }
+  await settings.mutate("llm-pi-ai", [{
+    op: mode === "token" ? "unset" : "set",
+    path: [...path, "apiKeyEnv"],
+    ...(mode === "api-key" ? { value: API_KEY_ENV } : {}),
+  }]);
+}
+
+export function installCodeBuddyWeb(ctx) {
+  ctx.inject(["webServer", "settings", "credentials"], (webCtx) => {
+    let loginPromise;
+    const currentState = async () => ({
+      ok: true,
+      mode: authenticationMode(webCtx.settings.get("llm-pi-ai")),
+      authenticated: (await webCtx.credentials.describe(credentialRef(CODEBUDDY_SESSION_REF))).configured,
+    });
+    const status = async (_req, res) => {
+      json(res, 200, await currentState());
+    };
+    const apiKey = async (req, res) => {
+      if (req.method !== "POST") return json(res, 405, { ok: false, message: "Method not allowed" });
+      if (!localPost(req)) return json(res, 403, { ok: false, message: "只允许从本机 DSH 页面切换认证方式" });
+      await setMode(webCtx.settings, "api-key");
+      json(res, 200, await currentState());
+    };
+    const token = async (req, res) => {
+      if (req.method !== "POST") return json(res, 405, { ok: false, message: "Method not allowed" });
+      if (!localPost(req)) return json(res, 403, { ok: false, message: "只允许从本机 DSH 页面切换认证方式" });
+      const state = await currentState();
+      if (!state.authenticated) return json(res, 409, { ok: false, message: "尚未保存 CodeBuddy 登录令牌" });
+      await setMode(webCtx.settings, "token");
+      json(res, 200, await currentState());
+    };
+    const login = async (req, res) => {
+      if (req.method !== "POST") return json(res, 405, { ok: false, message: "Method not allowed" });
+      if (!localPost(req)) return json(res, 403, { ok: false, message: "只允许从本机 DSH 页面登录" });
+      try {
+        loginPromise ??= (async () => {
+          const session = await loginCodeBuddy();
+          await webCtx.credentials.set(credentialRef(CODEBUDDY_SESSION_REF), serializeCodeBuddySession(session));
+          await setMode(webCtx.settings, "token");
+        })().finally(() => {
+          loginPromise = undefined;
+        });
+        await loginPromise;
+        json(res, 200, { ok: true, mode: "token", authenticated: true });
+      } catch (error) {
+        json(res, 500, { ok: false, message: error instanceof Error ? error.message : "CodeBuddy 登录失败" });
+      }
+    };
+    webCtx.effect(() => {
+      const dispose = [
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/status`, handler: status }),
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/api-key`, handler: apiKey }),
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/token`, handler: token }),
+        webCtx.webServer.register({ kind: "exact", path: `${ROUTE}/login`, handler: login }),
+      ];
+      return () => dispose.forEach((fn) => fn());
+    }, "llm-codebuddy: web login routes");
+  });
+}

package/index.js

@@ -6,6 +6,15 @@ import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-sett
 import { createProvider } from "@earendil-works/pi-ai";
 import * as openAICompletionsApi from "@earendil-works/pi-ai/api/openai-completions";
 import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+import {
+  CODEBUDDY_SESSION_REF,
+  parseCodeBuddySession,
+  refreshCodeBuddySession,
+  serializeCodeBuddySession,
+  sessionCacheDeadline,
+  sessionNeedsRefresh,
+} from "./codebuddy-auth.js";
+import { installCodeBuddyWeb } from "./codebuddy-web.js";
 
 export { Config };
 
@@ -18,7 +27,7 @@ const DISPLAY_NAME = "CodeBuddy 中国区";
 const API_KEY_ENV = "CODEBUDDY_API_KEY";
 const BASE_URL = "https://copilot.tencent.com/v2";
 const CONFIG_URL = "https://copilot.tencent.com/v3/config";
-const USER_AGENT = "CLI/unknown CodeBuddy/2.136.0";
+const USER_AGENT = "CLI/unknown CodeBuddy/2.137.1";
 const STREAM_IDLE_TIMEOUT_MS = 300_000;
 const NO_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
 const EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"];
@@ -31,6 +40,16 @@ const COMPAT = {
   thinkingFormat: "openai",
 };
 
+function codeBuddyRequestOptions(options) {
+  return { ...options, headers: { ...(options?.headers ?? {}), "user-agent": USER_AGENT } };
+}
+
+const codeBuddyApi = {
+  ...openAICompletionsApi,
+  stream: (model, context, options) => openAICompletionsApi.stream(model, context, codeBuddyRequestOptions(options)),
+  streamSimple: (model, context, options) => openAICompletionsApi.streamSimple(model, context, codeBuddyRequestOptions(options)),
+};
+
 const FALLBACK_MODELS = [
   ["hy3", "Hy3", 192000, 64000, true],
   ["glm-5.2", "GLM-5.2", 1000000, 48000, false],
@@ -133,13 +152,18 @@ function modelsFromConfig(data) {
   });
 }
 
-async function fetchCodeBuddyModels(apiKey, signal) {
+function authenticationHeaders(credential) {
+  const value = assertUsableApiKey(credential.value, name, credential.ref ?? API_KEY_ENV);
+  return credential.kind === "bearer" ? { authorization: `Bearer ${value}` } : { "x-api-key": value };
+}
+
+async function fetchCodeBuddyModels(credential, signal) {
   let response;
   try {
     response = await fetch(CONFIG_URL, {
       headers: {
         accept: "application/json",
-        "x-api-key": assertUsableApiKey(apiKey, name, API_KEY_ENV),
+        ...authenticationHeaders(credential),
         "user-agent": USER_AGENT,
         "x-product": "SaaS",
       },
@@ -164,7 +188,7 @@ function codeBuddyProvider(models, auth) {
     baseUrl: BASE_URL,
     auth,
     models,
-    api: openAICompletionsApi,
+    api: codeBuddyApi,
   });
 }
 
@@ -172,6 +196,7 @@ function resolvedProfile(provider, source, piProvider, configuredMaxTokens = new
   const apiKeyEnv = source.apiKeyEnv === undefined ? undefined : credentialRef(source.apiKeyEnv);
   return {
     ...source,
+    headers: runtimeHeaders(source.headers),
     provider,
     displayName: source.displayName ?? piProvider.name ?? provider,
     ...(apiKeyEnv === undefined ? {} : { apiKeyEnv }),
@@ -216,15 +241,30 @@ function selectCodeBuddyModels(base, entries) {
   });
 }
 
-export const __testing = Object.freeze({ modelsFromConfig, selectCodeBuddyModels });
+function ownsProvider(provider, builtins) {
+  return provider === PROVIDER || builtins.has(provider);
+}
+
+function runtimeHeaders(headers) {
+  return { ...(headers ?? {}) };
+}
+
+function codeBuddySource(config, source) {
+  return Object.hasOwn(config?.providers ?? {}, PROVIDER) ? source : { ...source, apiKeyEnv: source.apiKeyEnv ?? API_KEY_ENV };
+}
+
+export const __testing = Object.freeze({ authenticationHeaders, codeBuddyRequestOptions, codeBuddySource, modelsFromConfig, ownsProvider, runtimeHeaders, selectCodeBuddyModels });
 
 export function apply(ctx, config) {
+  installCodeBuddyWeb(ctx);
   let current = () => config;
   let remoteModels;
   let generation = 0;
   let memoRaw;
   let memoGeneration = -1;
   let memoized;
+  let loginSession;
+  let loginSessionPromise;
   const builtins = new Map(builtinProviders().map((provider) => [provider.id, provider]));
   const apiKeyAuth = builtins.get("deepseek")?.auth;
   if (!apiKeyAuth) throw new Error(`${name}: pi-ai DeepSeek auth helper is unavailable`);
@@ -245,20 +285,20 @@ export function apply(ctx, config) {
     if (memoRaw === current() && memoGeneration === generation && memoized) return memoized;
     const result = new Map();
     for (const [provider, source] of Object.entries(raw.providers)) {
+      if (!ownsProvider(provider, builtins)) continue;
       if (provider === PROVIDER) {
+        const sourceWithAuth = codeBuddySource(current(), source);
         const models = selectCodeBuddyModels(remoteModels ?? FALLBACK_MODELS, source.models);
         const configured = new Map((source.models ?? []).flatMap((model) =>
           Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0 ? [[model.id, model.maxTokens]] : [],
         ));
         result.set(provider, resolvedProfile(provider, {
-          ...source,
-          apiKeyEnv: source.apiKeyEnv ?? API_KEY_ENV,
+          ...sourceWithAuth,
           displayName: DISPLAY_NAME,
         }, codeBuddyProvider(models, apiKeyAuth), configured));
         continue;
       }
       const base = builtins.get(provider);
-      if (!base) throw new Error(`${name}: 不支持非内置 Provider "${provider}"`);
       const selected = selectBuiltinModels(base, source.models);
       const configured = new Map((source.models ?? []).flatMap((model) =>
         Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0 ? [[model.id, model.maxTokens]] : [],
@@ -271,15 +311,54 @@ export function apply(ctx, config) {
     return result;
   };
 
-  const resolveApiKey = async (provider, profile) => {
+  const resolveLoginSession = async () => {
+    if (loginSession?.expiresAt > Date.now()) return loginSession;
+    loginSessionPromise ??= (async () => {
+      const credentials = ctx.get("credentials");
+      const ref = credentialRef(CODEBUDDY_SESSION_REF);
+      const stored = await credentials?.resolve(ref);
+      const value = stored?.value ?? launchEnvironmentOf(ctx).get(ref)?.value;
+      if (!value) throw new Error("未找到 CodeBuddy 登录凭据");
+      let session = parseCodeBuddySession(value);
+      if (sessionNeedsRefresh(session)) {
+        session = await refreshCodeBuddySession(session);
+        await credentials?.set(ref, serializeCodeBuddySession(session));
+      }
+      return { ...session, expiresAt: sessionCacheDeadline(session) };
+    })().finally(() => {
+      loginSessionPromise = undefined;
+    });
+    loginSession = await loginSessionPromise;
+    return loginSession;
+  };
+
+  const resolveCredential = async (provider, profile) => {
     const ref = profile.apiKeyEnv;
-    if (!ref) return undefined;
+    if (!ref && provider === PROVIDER) {
+      let session;
+      try {
+        session = await resolveLoginSession();
+      } catch (error) {
+        throw new LlmError(`${name}: 未找到可用的 CodeBuddy 登录令牌，请运行 dsh-llm-codebuddy login`, "MISSING_CREDENTIAL", { cause: error });
+      }
+      profile.headers ??= {};
+      if (session.account.userId) profile.headers["X-User-Id"] = session.account.userId;
+      if (session.account.enterpriseId) {
+        profile.headers["X-Enterprise-Id"] = session.account.enterpriseId;
+        profile.headers["X-Tenant-Id"] = session.account.enterpriseId;
+      }
+      if (session.auth.domain) profile.headers["X-Domain"] = session.auth.domain;
+      return { value: assertUsableApiKey(session.auth.accessToken, name, "CodeBuddy login session"), kind: "bearer" };
+    }
+    if (!ref) return { value: undefined, kind: "none" };
     const stored = await ctx.get("credentials")?.resolve(ref);
     const value = stored?.value ?? launchEnvironmentOf(ctx).get(ref)?.value;
-    if (value) return assertUsableApiKey(value, name, ref);
+    if (value) return { value: assertUsableApiKey(value, name, ref), kind: "api-key", ref };
     throw new LlmError(`${name}: Provider "${provider}" 缺少 API Key，请在 WebUI 的模型设置中填写`, "MISSING_CREDENTIAL");
   };
 
+  const resolveApiKey = async (provider, profile) => (await resolveCredential(provider, profile)).value;
+
   const adapter = new PiAiAdapter({
     profiles,
     resolveApiKey,
@@ -301,8 +380,8 @@ export function apply(ctx, config) {
       refreshPromise ??= (async () => {
         try {
           const profile = profiles().get(PROVIDER);
-          const apiKey = await resolveApiKey(PROVIDER, profile);
-          remoteModels = await fetchCodeBuddyModels(apiKey);
+          const credential = await resolveCredential(PROVIDER, profile);
+          remoteModels = await fetchCodeBuddyModels(credential);
           generation += 1;
         } catch {
           // Keep the built-in catalog available while the key or network is absent.
@@ -333,8 +412,10 @@ export function apply(ctx, config) {
   ctx.llm.registerModelDiscovery(NS, async (request) => {
     if (request.provider === PROVIDER) {
       const profile = profiles().get(PROVIDER);
-      const apiKey = request.apiKey ?? await resolveApiKey(PROVIDER, profile);
-      remoteModels = await fetchCodeBuddyModels(apiKey, request.signal);
+      const credential = request.apiKey
+        ? { value: request.apiKey, kind: "api-key", ref: API_KEY_ENV }
+        : await resolveCredential(PROVIDER, profile);
+      remoteModels = await fetchCodeBuddyModels(credential, request.signal);
       generation += 1;
       return remoteModels.map((model) => ({
         id: model.id,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-llm-codebuddy",
-  "version": "1.3.4",
-  "description": "使用 WorkBuddy API Key 为 DeepSeek Harness 接入 CodeBuddy 模型",
+  "version": "1.3.5",
+  "description": "通过 WorkBuddy API Key 或 CodeBuddy 登录令牌为 DeepSeek Harness 接入 CodeBuddy 模型",
   "author": "Axiaohungry",
   "keywords": [
     "deepseek-harness",
@@ -14,7 +14,9 @@
   "type": "module",
   "main": "index.js",
   "exports": {
-    ".": "./index.js"
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json"
   },
   "bin": {
     "dsh-llm-codebuddy": "cli.js"
@@ -29,6 +31,9 @@
   },
   "files": [
     "index.js",
+    "codebuddy-auth.js",
+    "codebuddy-web.js",
+    "client.js",
     "cli.js",
     "cordis.patch.yml",
     "docs",
@@ -36,9 +41,13 @@
     "LICENSE"
   ],
   "scripts": {
-    "check": "node --check index.js && node --check cli.js && node --test test.js && node cli.js --self-test"
+    "check": "node --check index.js && node --check codebuddy-auth.js && node --check codebuddy-web.js && node --check client.js && node --check cli.js && node --test test.js && node cli.js --self-test"
   },
   "dsh": {
+    "client": {
+      "inject": [],
+      "platform": "web"
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     }