dsh-llm-workbuddy 0.1.0 → 0.1.2

package/README.md

@@ -53,12 +53,15 @@
 
 ## 前置条件（重要）
 
-1. 代理必须跑在 **workbuddy2api 主分支源码**上，不能用 PyPI 的 2.0.3：
+1. **代理必须独立安装并运行**：本插件**不打包**第三方代理 workbuddy2api。
+   请在你的机器上单独安装并启动它（见下方「安装代理」），它把 WorkBuddy/CodeBuddy
+   的私有协议转成标准 OpenAI chat-completions 格式。
+2. 代理必须跑在 **workbuddy2api 主分支源码**上，不能用 PyPI 的 2.0.3：
    旧版缺少 `X-Product-Code` / Genie-IDE 等请求头，登录会在最后一步 401。
-2. 登录请使用仓库里的 `login_workbuddy.py`（`platform=CLI` + codebuddy.cn
-   请求头，与官方插件一致），**不要**用代理自带的 `--login`（VSCode platform
+3. 登录使用**插件内置的 `login_workbuddy.py`**（本包自带，依赖系统 `python3`，
+   纯标准库，Python 3.7+ 即可），**不需要**代理自带的 `--login`（VSCode platform
    会 401）。
-3. 插件装入 profile 后需要**重启 `dsh web`** 才能加载新的 bundle（包括本小部件）。
+4. 插件装入 profile 后需要**重启 `dsh web`** 才能加载新的 bundle（包括本小部件）。
 
 ---
 
@@ -70,24 +73,44 @@
 dsh plugin --profile web add ./dsh-llm-workbuddy
 ```
 
+从 npm 发布版安装（正式发布后，朋友或你自己在任何机器上）：
+
+```sh
+dsh plugin add dsh-llm-workbuddy
+```
+
 CLI 会把依赖写进 profile 并把 `dsh-llm-workbuddy` 追加到 `dsh.profile.bundles`，
 同时在 `package.json` 的 `dsh.client` 声明里登记浏览器入口（见下文「Web 小部件
 工作原理」）。然后**重启** `dsh web`。
 
-> 本插件**没有任何构建步骤、零运行时依赖**：`lib/client.js` 是浏览器原生 JS，
-> 直接被 DSH serve，不需要 vite / react / TypeScript 编译。
+> 本插件**没有构建步骤**：`lib/client.js` 是浏览器原生 JS 直接被 serve；登录脚本
+> `login_workbuddy.py` 已打进包内，用系统 `python3` 运行（纯标准库，无需 uv）。
+> 唯一需要自己装的是第三方代理 workbuddy2api。
 
 ---
 
-## 启动代理（日常，先决条件）
+## 安装代理（先决条件，第三方）
 
-小组件依赖本地代理才能判断「代理是否运行」。先启动它：
+插件只提供模型路由与登录；真正的协议转换由 **workbuddy2api** 完成。请单独安装并
+启动它（以 127.0.0.1:8787 为例）：
 
 ```sh
-./start-workbuddy.sh
+# 1. 安装 uv（本机 Python 工具）
+curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# 2. 拉取 workbuddy2api 主分支源码
+git clone https://github.com/hawklithm/workbuddy2api.git
+cd workbuddy2api
+
+# 3. 启动代理（先完成下方「登录」后再请求）
+uv run python -u -m codebuddy_proxy --desensitize \
+  --session-file ~/.codebuddy-session.json \
+  --log-file ~/.codebuddy-proxy.jsonl
 # 监听 http://127.0.0.1:8787
 ```
 
+> 仓库根目录也有 `start-workbuddy.sh` 脚本（面向仓库本地开发），发布版插件不依赖它。
+
 验证：
 
 ```sh
@@ -120,13 +143,18 @@ curl http://127.0.0.1:8787/v1/models # 模型列表（含 glm-5.2 / deepseek-v4-
 
 ### 方式 B（传统）：在终端手动跑
 
+使用本包内置的登录脚本（纯标准库，依赖系统 `python3`）：
+
 ```sh
-./login-workbuddy.sh
+python3 node_modules/dsh-llm-workbuddy/login_workbuddy.py --session-file ~/.codebuddy-session.json
 # 浏览器打开打印的链接，用 WorkBuddy/CodeBuddy 账号登录
-# 完成后自动保存会话到 .workbuddy/session.json（也提示已写入 ~/.codebuddy-session.json）
+# 完成后自动保存会话到 ~/.codebuddy-session.json
 ```
 
-两种方式的产物是同一个 `session.json`，可混用：终端登录后 Web 胶囊会自动变绿，
+> 仓库根目录也有 `./login-workbuddy.sh` 包装脚本（面向本地开发，走 `.tools/uv`）；
+> 发布版插件直接用系统 `python3` 运行同款脚本即可。
+
+两种方式写的是同一个会话文件，可混用：终端登录后 Web 胶囊会自动变绿，
 Web 登录后终端脚本也读得到同一份会话。
 
 ---
@@ -140,12 +168,13 @@ Web 登录后终端脚本也读得到同一份会话。
 
 | 方法 + 路径 | 行为 |
 |---|---|
-| `GET /api/workbuddy/status` | 读取 `.workbuddy/session.json` 的 `auth.expiresAt` 判断会话是否有效，并 `fetch` 代理 `/health` 判断 `proxyUp`；返回 JSON：`{ sessionFile, authenticated, expiresAt, account, proxyUp, tokenValid, loginScriptAvailable }` |
-| `POST /api/workbuddy/login` | 若已有有效会话则直接返回 `alreadyLoggedIn`；否则 `spawn` `.tools/uv run login_workbuddy.py --session-file .workbuddy/session.json`，从子进程 stdout 解析出 `authUrl` 立即返回 `{ authUrl, pending:true }`（设备流在后台继续，前端轮询 status 感知完成） |
+| `GET /api/workbuddy/status` | 读取会话文件（默认 `~/.codebuddy-session.json`，或配置的 `sessionFile`）的 `auth.expiresAt` 判断会话是否有效，并 `fetch` 代理 `/health` 判断 `proxyUp`；返回 JSON：`{ sessionFile, authenticated, expiresAt, account, proxyUp, tokenValid, loginScriptAvailable }` |
+| `POST /api/workbuddy/login` | 若已有有效会话则直接返回 `alreadyLoggedIn`；否则用系统 `python3` `spawn` 包内 `login_workbuddy.py --session-file <sessionFile>`，从子进程 stdout 解析出 `authUrl` 立即返回 `{ authUrl, pending:true }`（设备流在后台继续，前端轮询 status 感知完成） |
 
-> 会话文件与登录脚本路径按插件包位置自动推导：
-> `dsh-llm-workbuddy/lib/index.js` 向上两级即仓库根 `dsh-workbuddy/`，其下的
-> `.workbuddy/session.json` 与 `login_workbuddy.py` 即为目标。
+> 会话文件与登录脚本路径的解析顺序：
+> 1. 配置里显式指定的 `sessionFile` / `loginScript`；
+> 2. 包内 `login_workbuddy.py` + `~/.codebuddy-session.json`；
+> 3. 旧仓库布局（向上两级 `dsh-workbuddy/` 的 `.workbuddy/session.json`）自动兼容。
 
 ### 前端胶囊（`lib/client.js`）
 
@@ -189,6 +218,8 @@ DSH 的 `dsh.client` 机制只要求 `package.json` 里：
     # defaultContextWindow: 200000      # 未在目录中标明容量的模型使用
     # discovery: true                   # 实时拉取代理的 /v1/models（30s 缓存）
     # models: [...]                     # 静态目录（代理不可达时的兜底）
+    # loginScript: ''                   # 登录脚本绝对/相对路径；默认用包内 login_workbuddy.py
+    # sessionFile: ~/.codebuddy-session.json  # 会话文件路径；默认同上
 ```
 
 模型列表默认取插件内置目录；代理可达时改为实时拉取 `/v1/models`（支持
@@ -203,9 +234,9 @@ DSH 的 `dsh.client` 机制只要求 `package.json` 里：
 |---|---|
 | 右下角没有胶囊 | `dsh web` 没重启加载新 bundle → 重启 `dsh web`；或 `curl /plugins/dsh-llm-workbuddy/client.js` 应返回 200 |
 | 胶囊一直 `…`（加载中） | `GET /api/workbuddy/status` 失败 → 确认 `dsh web` 在跑、端口正确 |
-| 胶囊红 + `代理未运行` | `start-workbuddy.sh` 没起或挂了 → 启动代理后再看 |
-| 点「登录」没反应 / 按钮灰 | `loginScriptAvailable:false` → `login_workbuddy.py` 或 `.tools/uv` 不在仓库根；检查路径 |
-| 新标签页打开后登录完成，胶囊仍是红 | 会话文件 `.workbuddy/session.json` 未刷新或 `expiresAt` 已过期 → 刷新页面或重跑登录 |
+| 胶囊红 + `代理未运行` | workbuddy2api 代理没起或挂了 → 按「安装代理」章节启动 |
+| 点「登录」没反应 / 按钮灰 | `loginScriptAvailable:false` → 包内 `login_workbuddy.py` 缺失或系统无 `python3`；检查安装 |
+| 新标签页打开后登录完成，胶囊仍是红 | 会话文件（默认 `~/.codebuddy-session.json`）未刷新或 `expiresAt` 已过期 → 刷新页面或重跑登录 |
 | 启动 `dsh web` 报 `EPERM ... cordis.yml` | `.dsh` 所在系统卷受保护（`/System/Volumes/Data` 带 `protect`）。解决：`sudo chown -R $(whoami) /Users/jiyunyang/.dsh`，或 `export DSH_HOME=$HOME/dsh-home` 后重新 `dsh plugin --profile web add` 并把插件链接进新 home |
 | 模型请求 `TRANSPORT` 错误 | 代理未运行或端口不对（连接被拒绝） |
 
@@ -228,8 +259,10 @@ DSH 的 `dsh.client` 机制只要求 `package.json` 里：
 |---|---|
 | `lib/index.js` | Cordis 插件主体：LLM 适配器 `WorkBuddyAdapter` + `/api/workbuddy/*` 路由注册 |
 | `lib/client.js` | 零依赖浏览器小部件（状态胶囊 + 登录流程），被 `dsh.client` 注入 |
+| `login_workbuddy.py` | 设备流登录脚本（随包发布，被后端路由用系统 `python3` spawn） |
 | `cordis.patch.yml` | 本包的 Cordis bundle 挂载声明（`id: llm-workbuddy`） |
 | `package.json` | 包元数据、`dsh.client` 浏览器入口声明、`llm-workbuddy` peer 依赖 |
-| `../login_workbuddy.py` | 设备流登录脚本（被后端路由 spawn） |
-| `../start-workbuddy.sh` | 启动 workbuddy2api 代理 |
-| `../.workbuddy/session.json` | 登录会话文件（胶囊与适配器共读） |
+
+> 第三方 workbuddy2api 代理**不在包内**，需单独安装（见「安装代理」章节）。
+> 仓库根目录的 `start-workbuddy.sh` / `login-workbuddy.sh` / `.workbuddy/` 是本地
+> 开发用的配套文件，不随 npm 包发布。

package/lib/index.js

@@ -592,6 +592,11 @@ export const Config = z.object({
   models: z.array(catalogModel).default(DEFAULT_MODELS),
   streamIdleTimeoutMs: z.number().min(Number.MIN_VALUE).max(MAX_TIMER_DELAY_MS).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
   discovery: z.boolean().default(true),
+  // Optional path overrides for the login helper. When unset, the plugin uses
+  // the login_workbuddy.py bundled with this package and the default session
+  // file location (~/.codebuddy-session.json).
+  loginScript: z.string(),
+  sessionFile: z.string(),
 });
 
 /** Resolve, validate, and detach the advisory model catalog. */
@@ -652,6 +657,8 @@ export function resolveAdapterOptions(config) {
     models: resolveModels(config.models),
     streamIdleTimeoutMs,
     discovery: config.discovery ?? true,
+    loginScript: config.loginScript,
+    sessionFile: config.sessionFile,
   };
 }
 
@@ -659,25 +666,61 @@ export function resolveAdapterOptions(config) {
 
 // #region login status web API
 
-/** Resolve the repo root that holds `login_workbuddy.py` and `.workbuddy/`. */
+/**
+ * Resolve the runtime paths for the login helper and session file.
+ *
+ * Precedence:
+ *   1. explicit `loginScript` / `sessionFile` config (paths may be absolute
+ *      or relative to the process CWD);
+ *   2. bundled `login_workbuddy.py` (this package ships a copy) and the
+ *      conventional `~/.codebuddy-session.json`;
+ *   3. legacy fallback: the monorepo layout `dsh-workbuddy/` (two levels up
+ *      from the plugin dir) that held `login_workbuddy.py` and
+ *      `.workbuddy/session.json`.
+ */
 const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url));
-// dsh-llm-workbuddy/lib/index.js -> dsh-workbuddy/ (two levels up).
-const REPO_ROOT = resolve(PLUGIN_DIR, "..", "..");
-const SESSION_FILE = resolve(REPO_ROOT, ".workbuddy", "session.json");
-const LOGIN_SCRIPT = resolve(REPO_ROOT, "login_workbuddy.py");
-const WORKBUDDY_UV = resolve(REPO_ROOT, ".tools", "uv");
+
+function defaultSessionFile() {
+  const home = process.env.HOME ?? process.env.USERPROFILE;
+  return home ? resolve(home, ".codebuddy-session.json") : resolve(PLUGIN_DIR, ".codebuddy-session.json");
+}
+
+function resolveLoginPaths(config) {
+  const configSession = config?.sessionFile;
+  const configScript = config?.loginScript;
+
+  let sessionFile;
+  if (typeof configSession === "string" && configSession.length > 0) {
+    sessionFile = resolve(configSession);
+  } else {
+    // Legacy monorepo layout: dsh-workbuddy/.workbuddy/session.json
+    const legacyRoot = resolve(PLUGIN_DIR, "..", "..");
+    const legacySession = resolve(legacyRoot, ".workbuddy", "session.json");
+    sessionFile = existsSync(legacySession) ? legacySession : defaultSessionFile();
+  }
+
+  let loginScript;
+  if (typeof configScript === "string" && configScript.length > 0) {
+    loginScript = resolve(configScript);
+  } else {
+    // Bundled copy ships at the package root (dsh-llm-workbuddy/login_workbuddy.py).
+    loginScript = resolve(PLUGIN_DIR, "..", "login_workbuddy.py");
+  }
+
+  return { sessionFile, loginScript };
+}
 
 /**
  * Read the local WorkBuddy session file and derive its validity. Returns a
  * normalized status object the Web widget polls. Never throws — missing or
  * malformed state is reported as `authenticated: false` so the UI can prompt.
  */
-function readSessionStatus() {
-  if (!existsSync(SESSION_FILE)) {
+function readSessionStatus(sessionFile) {
+  if (!existsSync(sessionFile)) {
     return { sessionFile: false, authenticated: false, expiresAt: null, account: null };
   }
   try {
-    const raw = JSON.parse(readFileSync(SESSION_FILE, "utf-8"));
+    const raw = JSON.parse(readFileSync(sessionFile, "utf-8"));
     const expiresAt = raw?.auth?.expiresAt ?? null;
     const now = Date.now();
     const expired = expiresAt !== null && expiresAt <= now;
@@ -721,21 +764,22 @@ async function probeProxy(baseURL) {
  * can open it in a new tab. The widget then polls `/status` until the session
  * file appears and reports `authenticated: true`.
  */
-function registerWorkbuddyRoutes(ctx) {
+function registerWorkbuddyRoutes(ctx, config) {
   if (ctx.webServer === undefined) return; // headless profile: no HTTP surface
   const baseURL = config_baseURL();
+  const { sessionFile, loginScript } = resolveLoginPaths(config);
   ctx.webServer.register({
     path: "/api/workbuddy/status",
     exact: true,
     methods: ["GET"],
     async handler(_req, res) {
-      const session = readSessionStatus();
+      const session = readSessionStatus(sessionFile);
       const proxy = await probeProxy(baseURL);
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({
         ...session,
         ...proxy,
-        loginScriptAvailable: existsSync(LOGIN_SCRIPT),
+        loginScriptAvailable: existsSync(loginScript),
       }));
     },
   });
@@ -744,20 +788,22 @@ function registerWorkbuddyRoutes(ctx) {
     exact: true,
     methods: ["POST"],
     async handler(_req, res) {
-      if (!existsSync(LOGIN_SCRIPT)) {
+      if (!existsSync(loginScript)) {
         res.writeHead(503, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "login_workbuddy.py not found" }));
         return;
       }
       // Existing session is fine; no need to re-run the flow.
-      const existing = readSessionStatus();
+      const existing = readSessionStatus(sessionFile);
       if (existing.authenticated) {
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ alreadyLoggedIn: true, authUrl: null, ...existing }));
         return;
       }
-      const args = ["run", "--python", "3.12", "python", "-u", LOGIN_SCRIPT, "--session-file", SESSION_FILE];
-      const child = spawn(WORKBUDDY_UV, args, { cwd: REPO_ROOT, env: { ...process.env, UV_PYTHON_INSTALL_DIR: resolve(REPO_ROOT, ".tools", "uv-python"), UV_CACHE_DIR: resolve(REPO_ROOT, ".tools", "uv-cache"), PYTHONUNBUFFERED: "1" } });
+      // login_workbuddy.py is dependency-free (stdlib only), so we invoke it
+      // directly with the system Python — no uv runtime required.
+      const args = ["-u", loginScript, "--session-file", sessionFile];
+      const child = spawn("python3", args, { env: { ...process.env, PYTHONUNBUFFERED: "1" } });
       let stdout = "";
       let authUrl = null;
       child.stdout.on("data", (chunk) => {
@@ -821,7 +867,7 @@ export function apply(ctx, config) {
     settingsPath: [],
   }]);
   ctx.llm.registerAdapter([PROVIDER], adapter);
-  registerWorkbuddyRoutes(ctx);
+  registerWorkbuddyRoutes(ctx, config);
   installSettingsSection(ctx, NS, Config, config, {
     setSource: (source) => {
       current = source;

package/login_workbuddy.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Standalone WorkBuddy/CodeBuddy CN OAuth login.
+
+Implements the device flow exactly like the official CodeBuddy plugin
+(platform=CLI, Origin/Referer codebuddy.cn, CLI User-Agent), as verified by
+the Sliverkiss/workbuddy2api Go login tool. Writes a session file in the
+format the hawklithm/workbuddy2api Python proxy reads:
+{ "auth": {accessToken, refreshToken, expiresIn, domain}, "account": {...}, "machineId": "..." }
+
+Usage:
+  python3 login_workbuddy.py [--session-file PATH] [--timeout 300]
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import pathlib
+import sys
+import time
+import urllib.error
+import urllib.request
+import uuid
+
+BASE = "https://copilot.tencent.com"
+PLATFORM = "CLI"
+CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2"
+ORIGIN = "https://www.codebuddy.cn"
+
+
+def common_headers(req: urllib.request.Request) -> None:
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Accept", "application/json, text/plain, */*")
+    req.add_header("X-Requested-With", "XMLHttpRequest")
+    req.add_header("Origin", ORIGIN)
+    req.add_header("Referer", ORIGIN + "/")
+    req.add_header("User-Agent", CLIENT_UA)
+
+
+def do(method: str, path: str, *, auth: str | None = None, body: dict | None = None) -> tuple[dict, int]:
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    url = BASE + path
+    req = urllib.request.Request(url, data=data, method=method)
+    common_headers(req)
+    if auth:
+        req.add_header("Authorization", f"Bearer {auth}")
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            return json.loads(resp.read().decode("utf-8")), resp.status
+    except urllib.error.HTTPError as exc:
+        detail = exc.read().decode("utf-8", errors="replace")
+        raise RuntimeError(f"HTTP {exc.code} {path}: {detail[:400]}") from exc
+
+
+def unwrap(payload: dict) -> dict:
+    """{code, msg, data} envelope."""
+    if payload.get("code") not in (0, None):
+        raise RuntimeError(f"business code={payload.get('code')} msg={payload.get('msg')}")
+    data = payload.get("data")
+    return data if isinstance(data, dict) else {}
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--session-file", default=str(pathlib.Path.home() / ".codebuddy-session.json"))
+    ap.add_argument("--timeout", type=int, default=300)
+    args = ap.parse_args()
+
+    session_file = pathlib.Path(args.session_file)
+
+    state_payload, _ = do("POST", f"/v2/plugin/auth/state?platform={PLATFORM}", body={})
+    st = unwrap(state_payload)
+    state = st.get("state")
+    auth_url = st.get("authUrl")
+    if not state or not auth_url:
+        raise RuntimeError(f"auth/state missing state/authUrl: {st!r}")
+
+    print("请在浏览器中打开以下链接，用你的 WorkBuddy/CodeBuddy 账号完成登录：")
+    print(f"\n  {auth_url}\n")
+
+    deadline = time.monotonic() + args.timeout
+    token = None
+    while time.monotonic() < deadline:
+        time.sleep(2)
+        try:
+            tok, _ = do("GET", f"/v2/plugin/auth/token?state={state}")
+        except RuntimeError:
+            continue
+        if isinstance(tok.get("data"), dict) and tok["data"].get("accessToken"):
+            token = tok["data"]
+            break
+    if token is None:
+        print("登录超时，请重试。", file=sys.stderr)
+        return 1
+
+    access = token.get("accessToken", "")
+    account: dict = {}
+    try:
+        acct, _ = do("GET", f"/v2/plugin/login/account?state={state}", auth=access)
+        if isinstance(acct.get("data"), dict):
+            account = acct["data"]
+    except RuntimeError as exc:
+        print(f"(warn) login/account skipped: {exc}", file=sys.stderr)
+
+    session = {
+        "auth": {
+            "accessToken": access,
+            "refreshToken": token.get("refreshToken", ""),
+            "expiresIn": token.get("expiresIn"),
+            "expiresAt": int(time.time() * 1000) + int(token.get("expiresIn", 0) or 0) * 1000,
+            "domain": token.get("domain", ""),
+        },
+        "account": account,
+        "machineId": str(uuid.uuid4()),
+    }
+    session_file.parent.mkdir(parents=True, exist_ok=True)
+    session_file.write_text(json.dumps(session, ensure_ascii=False, indent=2))
+    print(f"\n登录成功，会话已保存: {session_file}")
+    print(f"用户: {account.get('nickname') or account.get('uid') or '<unknown>'}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-llm-workbuddy",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "WorkBuddy (via the local workbuddy2api proxy) LLM provider adapter for DeepSeek Harness, with a Web login-status widget",
   "type": "module",
   "main": "lib/index.js",
@@ -32,19 +32,21 @@
       "default": "./lib/index.js"
     },
     "./client": "./lib/client.js",
+    "./login_workbuddy.py": "./login_workbuddy.py",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
   "files": [
     "lib",
+    "login_workbuddy.py",
     "cordis.patch.yml",
     "README.md"
   ],
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-timeout": "^0.1.0-rc.8",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-settings": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-timeout": "^0.1.0-rc.7",
     "@deepseek-ai/schemastery": "^3.18.1"
   }
 }