dsh-model 0.0.0-stage → 0.14.0

package/dist/bridge/server.js

@@ -0,0 +1,178 @@
+// bridge/server.ts — dsh-model 的 WorkBuddy bridge：把 WorkBuddy 私有接口变成本机 OpenAI 兼容接口
+//
+// 只绑 127.0.0.1，要求内部密钥（引擎的 openai-compatibility 上游带着它来）；Host / Origin 必须是回环，挡 DNS rebinding。
+// 路由按产品分前缀：/cn/v1/...（WorkBuddy 国内版）、/ai/v1/...（WorkBuddy AI 国际版）。
+// 协议细节（凭据解密、客户端身份、刷新、目录）来自移植的 ./workbuddy/*（MIT，见其 LICENSE）。
+import { timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { Readable } from 'node:stream';
+import { aggregateSse } from './aggregate.js';
+import { hostIsLoopback, originIsLoopback } from './workbuddy/loopback.js';
+import { extractDisplayErrorMessage, prepareChatBody } from './workbuddy/upstream.js';
+const BODY_LIMIT = 64 * 1024 * 1024;
+const KIND_STATUS = {
+    hard_credit: 402,
+    soft_rate: 429,
+    session_dead: 401,
+    not_found: 502,
+    server: 502,
+    client: 400,
+};
+function json(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+    res.end(payload);
+}
+function oaiError(res, status, code, message) {
+    json(res, status, { error: { message, type: code, code } });
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > BODY_LIMIT) {
+                reject(new Error('request body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+export function createBridge(options) {
+    const expected = Buffer.from(options.secret);
+    // variants 可能在运行中增加（新登录了一个产品），每次请求现查
+    const log = options.log ?? (() => { });
+    const authorized = (req) => {
+        const m = /^Bearer\s+(.+)$/i.exec(String(req.headers.authorization ?? '').trim());
+        if (!m)
+            return false;
+        const got = Buffer.from(m[1]);
+        return got.length === expected.length && timingSafeEqual(got, expected);
+    };
+    const server = createServer((req, res) => {
+        void handle(req, res).catch((error) => {
+            log(`bridge: unhandled ${String(error)}`);
+            if (!res.headersSent)
+                oaiError(res, 500, 'internal', 'bridge internal error');
+            else
+                res.end();
+        });
+    });
+    async function handle(req, res) {
+        if (!hostIsLoopback(req.headers.host))
+            return oaiError(res, 403, 'host_not_allowed', 'Host must be loopback');
+        if (!originIsLoopback(req.headers.origin))
+            return oaiError(res, 403, 'origin_not_allowed', 'Origin must be loopback');
+        if (!authorized(req))
+            return oaiError(res, 401, 'unauthorized', 'missing or invalid bearer');
+        const fullUrl = new URL(req.url ?? '/', 'http://127.0.0.1');
+        const url = fullUrl.pathname.replace(/\/+$/, '') || '/';
+        if (req.method === 'GET' && url === '/healthz')
+            return json(res, 200, { ok: true });
+        if (req.method === 'GET' && url === '/status') {
+            const out = {};
+            for (const v of options.variants) {
+                const st = await v.store.status().catch((e) => ({ signedIn: false, error: String(e) }));
+                out[v.key] = { label: v.label, models: v.catalog.current().length, auth: st };
+            }
+            return json(res, 200, out);
+        }
+        if (url.startsWith('/control/') && options.onControl) {
+            let body = undefined;
+            if (req.method !== 'GET' && req.method !== 'DELETE') {
+                const raw = (await readBody(req)).toString('utf8');
+                try {
+                    body = raw ? JSON.parse(raw) : undefined;
+                }
+                catch {
+                    return oaiError(res, 400, 'invalid_json', 'request body is not JSON');
+                }
+            }
+            const r = await options.onControl(req.method ?? 'GET', url.slice('/control'.length), body, fullUrl.searchParams);
+            return json(res, r.status, r.body);
+        }
+        if (req.method === 'POST' && url === '/refresh') {
+            if (!options.onRefresh)
+                return oaiError(res, 404, 'not_found', 'refresh not supported');
+            return json(res, 200, { ok: true, result: await options.onRefresh() });
+        }
+        const m = /^\/([a-z]+)\/v1\/(models|chat\/completions)$/.exec(url);
+        const variant = m ? options.variants.find((v) => v.key === m[1]) : undefined;
+        if (!m || !variant)
+            return oaiError(res, 404, 'not_found', `no such route: ${req.method} ${url}`);
+        if (m[2] === 'models' && req.method === 'GET') {
+            return json(res, 200, { object: 'list', data: variant.catalog.current().map((model) => ({ id: model.id, object: 'model', created: 0, owned_by: 'workbuddy' })) });
+        }
+        if (m[2] === 'chat/completions' && req.method === 'POST')
+            return chat(variant, req, res);
+        return oaiError(res, 405, 'method_not_allowed', `${req.method} ${url}`);
+    }
+    async function chat(variant, req, res) {
+        if (!String(req.headers['content-type'] ?? '').toLowerCase().startsWith('application/json'))
+            return oaiError(res, 415, 'unsupported_media_type', 'Content-Type must be application/json');
+        let credential;
+        try {
+            credential = await variant.store.resolve();
+        }
+        catch (error) {
+            return oaiError(res, 401, 'not_signed_in', `${variant.label}: ${String(error.message ?? error)} — sign in again in the ${variant.label} app`);
+        }
+        const raw = (await readBody(req)).toString('utf8');
+        // OpenAI 规范：不写 stream 就是非流式。曾按 "!== false" 判断，没写 stream 的请求被当成流式，
+        // 把上游的 ": heartbeat" 原样透传给引擎，引擎既解析不了 JSON，也拿不到 token 用量（VPS 实测）
+        let wantsStream = false;
+        try {
+            wantsStream = JSON.parse(raw).stream === true;
+        }
+        catch {
+            return oaiError(res, 400, 'invalid_json', 'request body is not JSON');
+        }
+        const controller = new AbortController();
+        res.on('close', () => controller.abort());
+        const result = await variant.client.chatStream(credential, prepareChatBody(raw), controller.signal);
+        if (!result.ok) {
+            const detail = extractDisplayErrorMessage(result.message) ?? result.message.slice(0, 400);
+            return oaiError(res, KIND_STATUS[result.kind], result.kind, `${variant.label} upstream ${result.kind} (http ${result.status}): ${detail}`);
+        }
+        const body = Readable.fromWeb(result.response.body);
+        if (!wantsStream) {
+            let text = '';
+            for await (const chunk of body)
+                text += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk);
+            return json(res, 200, aggregateSse(text));
+        }
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive', 'X-Accel-Buffering': 'no' });
+        let sawDone = false;
+        body.on('data', (c) => {
+            if (c.includes('[DONE]'))
+                sawDone = true;
+        });
+        body.on('error', (error) => {
+            log(`bridge: ${variant.label} stream failed mid-flight: ${String(error)}`);
+            // 上游中途断开：补发 [DONE]，让客户端正常收尾而不是挂住
+            if (!sawDone && res.writable)
+                res.end('data: [DONE]\n\n');
+        });
+        body.pipe(res);
+    }
+    const ready = new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.port, options.host ?? '127.0.0.1', () => {
+            const addr = server.address();
+            resolve(typeof addr === 'object' && addr ? addr.port : options.port);
+        });
+    });
+    return {
+        server,
+        ready,
+        close: () => new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections();
+        }),
+    };
+}

package/dist/bridge/workbuddy/_compat.js

@@ -0,0 +1,52 @@
+// _compat.ts — 移植代码原本依赖 dsh 的 @deepseek-ai/dsh-atomic-write 与 @deepseek-ai/dsh-home-paths，这里给出 dsh-model 的等价实现。
+// resolveDshHome() 在移植代码里只用来放自己的状态文件（凭据副本、版本缓存），所以指向 bridge 的状态目录，而不是 dsh 的 DSH_HOME。
+import { open, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { atomicWrite, ensureDir } from '../../util/fs.js';
+/** bridge 的状态目录：$DSH_MODEL_HOME/workbuddy（默认 ~/.dsh-model/workbuddy） */
+export function resolveDshHome() {
+    const home = process.env.DSH_MODEL_HOME ? resolve(process.env.DSH_MODEL_HOME) : join(homedir(), '.dsh-model');
+    return join(home, 'workbuddy');
+}
+export async function writeFileAtomic(file, data, options = {}) {
+    await ensureDir(dirname(file), { mode: options.dirMode ?? 0o700 });
+    await atomicWrite(file, data, { mode: options.mode ?? 0o600 });
+}
+/** 跨进程文件锁（bridge 与 CLI 可能同时刷新令牌）：<file>.lock 用 O_EXCL 抢占，过期 30s 视为遗留 */
+export async function withFileLock(file, fn) {
+    const lock = `${file}.lock`;
+    await ensureDir(dirname(lock), { mode: 0o700 });
+    const deadline = Date.now() + 15_000;
+    for (;;) {
+        try {
+            const handle = await open(lock, 'wx', 0o600);
+            await handle.writeFile(String(Date.now()));
+            await handle.close();
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const { stat } = await import('node:fs/promises');
+                if (Date.now() - (await stat(lock)).mtimeMs > 30_000) {
+                    await rm(lock, { force: true });
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
+            if (Date.now() > deadline)
+                throw new Error(`timed out waiting for lock ${lock}`);
+            await new Promise((r) => setTimeout(r, 100));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await rm(lock, { force: true });
+    }
+}

package/dist/bridge/workbuddy/app-version.js

@@ -0,0 +1,141 @@
+// Ported from dsh-workbuddy-connect v0.7.1 (commit 390582e04da4e8e8bf746d71997440e4b716ec47),
+// https://github.com/corrinehu/dsh-workbuddy-connect — MIT License, Copyright (c) 2026 Corrine Hu.
+// See LICENSE.dsh-workbuddy-connect in this directory. Changes: imports adapted to dsh-model (./_compat.js).
+/**
+ * The international desktop app's version, used as the `/v3/config` UA.
+ *
+ * The App-shaped catalog is served only to a User-Agent carrying the product
+ * name (see `docs/workbuddy-ai-international-research-2026-09-11.md` §2.7).
+ * That document's conclusion recommended the space form `WorkBuddy AI/<v>`;
+ * re-measured on 2026-09-11 the *space* form is rejected (HTTP 400, code
+ * 12403) while the terse `WorkBuddyAI/<v>` form — with or without the space
+ * removed — returns the 21-model App document. The UA is therefore built from
+ * the form verified in code, not from the earlier prose.
+ *
+ * The version feeds the international catalog UA and the chat identity's
+ * `X-IDE-Version`: a missing App, an unreadable plist, or a bad cached value
+ * degrades to the last saved value and finally to a compiled-in constant, and
+ * never blocks credential use or the provider.
+ *
+ * @module dsh-workbuddy-connect/app-version
+ */
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { writeFileAtomic } from './_compat.js';
+import { resolveDshHome } from './_compat.js';
+/**
+ * Last-resort UA version.
+ *
+ * The gateway ignores the version number when splitting the UA (research §2.7.2
+ * item 2: `CLI/1.0.0`, `CLI/99.0.0` and the real version all return the same
+ * document), so this constant is a shape requirement rather than a currency
+ * claim. It is *not* used to infer anything about model capabilities.
+ */
+export const FALLBACK_APP_VERSION = '5.5.2';
+/** Basename of the saved version under `$DSH_HOME`. */
+export const WORKBUDDY_APP_VERSION_FILENAME = '.workbuddy-ai-version.json';
+/**
+ * Whether a string is safe to interpolate into an HTTP header.
+ *
+ * Strict on purpose: the value reaches a header, so anything that could split
+ * the request (CR, LF, spaces beyond the separator) or inject a second UA
+ * token must never pass. The App's own version is always `N.N.N` or `N.N.N.N`.
+ */
+export function validAppVersion(value) {
+    return typeof value === 'string' && /^\d{1,6}(?:\.\d{1,6}){1,3}$/u.test(value);
+}
+/** macOS App-bundle roots: system-wide first, then the user's own install. */
+function macAppRoots() {
+    return ['/Applications', join(homedir(), 'Applications')];
+}
+/**
+ * Read `CFBundleShortVersionString` out of an `Info.plist`.
+ *
+ * Parsed as XML rather than grepped, because the plist contains several
+ * `<string>` values and a regex would be one unrelated key away from
+ * returning the wrong one. A binary plist has no `<dict>` in its bytes and is
+ * reported as unreadable (the saved value then applies) rather than guessed at.
+ */
+export async function readBundleVersion(plistPath) {
+    let text;
+    try {
+        text = await readFile(plistPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    // `<key>CFBundleShortVersionString</key>` followed by the next `<string>`.
+    const match = /<key>\s*CFBundleShortVersionString\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(text);
+    const version = match?.[1]?.trim();
+    return validAppVersion(version) ? version : undefined;
+}
+/**
+ * The installed international App's version, or `undefined` when it is not
+ * installed (or not readable).
+ *
+ * Windows and Linux have no verified bundle-metadata location yet, so this
+ * returns `undefined` there and the saved/fallback value is used instead of
+ * guessing a path — the same discipline the credential discovery follows.
+ */
+export async function installedAppVersion() {
+    if (process.platform !== 'darwin')
+        return undefined;
+    for (const root of macAppRoots()) {
+        const bundle = join(root, 'WorkBuddy AI.app');
+        const version = await readBundleVersion(join(bundle, 'Contents', 'Info.plist'));
+        if (version !== undefined)
+            return { version, bundle };
+    }
+    return undefined;
+}
+/** Saved-version file path under the Harness home. */
+export function appVersionPath() {
+    return join(resolveDshHome(), WORKBUDDY_APP_VERSION_FILENAME);
+}
+/**
+ * Resolve the UA version: installed App first, then the last saved value, then
+ * the compiled-in fallback.
+ *
+ * A value read from the App is written back immediately, so an uninstalled App
+ * or an unreadable plist later still has the last real version to fall back
+ * on. The write is best-effort: failing to cache a version must never fail the
+ * catalog request that asked for it.
+ */
+export async function resolveAppVersion(options = {}) {
+    const path = options.path ?? appVersionPath();
+    const installed = await (options.installed ?? installedAppVersion)();
+    if (installed !== undefined && validAppVersion(installed.version)) {
+        try {
+            await writeFileAtomic(path, `${JSON.stringify({ version: installed.version, bundle: installed.bundle, observedAt: Date.now() }, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+        }
+        catch {
+            // A read-only home is not a reason to serve no catalog.
+        }
+        return { version: installed.version, source: 'installed', bundle: installed.bundle };
+    }
+    try {
+        const saved = JSON.parse(await readFile(path, 'utf8'));
+        if (typeof saved === 'object' && saved !== null) {
+            const version = saved['version'];
+            if (validAppVersion(version))
+                return { version, source: 'saved' };
+        }
+    }
+    catch {
+        // Absent or malformed cache: fall through to the compiled-in default.
+    }
+    return { version: FALLBACK_APP_VERSION, source: 'fallback' };
+}
+/**
+ * Build the App-shaped User-Agent for catalog requests.
+ *
+ * `WorkBuddyAI/<version>` with no space is the form measured to reach the App
+ * document; the space form is rejected with 400/12403. Throws on an invalid
+ * version rather than sending a malformed header.
+ */
+export function appUserAgent(version) {
+    if (!validAppVersion(version))
+        throw new Error(`invalid WorkBuddy AI version for User-Agent: ${JSON.stringify(version)}`);
+    return `WorkBuddyAI/${version}`;
+}