dsh-model 0.0.1 → 0.15.0

package/dist/service/launchd.js

@@ -0,0 +1,89 @@
+// service/launchd.ts — macOS 用户级 LaunchAgent（RunAtLoad + KeepAlive）
+import { rm } from 'node:fs/promises';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { run } from '../util/exec.js';
+import { atomicWrite, exists } from '../util/fs.js';
+const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+export function renderPlist(spec) {
+    const args = spec.program.map((a) => `    <string>${esc(a)}</string>`).join('\n');
+    const envEntries = Object.entries(spec.env ?? {});
+    const envBlock = envEntries.length
+        ? `  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries.map(([k, v]) => `    <key>${esc(k)}</key>\n    <string>${esc(v)}</string>`).join('\n')}\n  </dict>\n`
+        : '';
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Generated by dsh-model. 由 dsh-model 生成，卸载请执行 dsh-model uninstall -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${esc(spec.label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+${envBlock}  <key>WorkingDirectory</key>
+  <string>${esc(spec.workingDirectory)}</string>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>StandardOutPath</key>
+  <string>${esc(spec.stdoutPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${esc(spec.stdoutPath)}</string>
+</dict>
+</plist>
+`;
+}
+export function launchd(spec) {
+    const domain = `gui/${process.getuid?.() ?? 501}`;
+    const target = `${domain}/${spec.label}`;
+    const bootstrap = async () => {
+        const r = await run('launchctl', ['bootstrap', domain, spec.file]);
+        // 已加载时返回 5 / 37（"service already loaded"），当成功
+        if (r.code !== 0 && !/already|in progress|5:|37:/i.test(r.stderr)) {
+            throw new DshModelError('service_failed', L(`launchctl bootstrap 失败：${r.stderr.trim()}`, `launchctl bootstrap failed: ${r.stderr.trim()}`));
+        }
+    };
+    const bootout = async () => {
+        await run('launchctl', ['bootout', target]);
+    };
+    return {
+        kind: 'launchd',
+        spec,
+        render: () => renderPlist(spec),
+        async install() {
+            await atomicWrite(spec.file, renderPlist(spec), { mode: 0o644 });
+            await bootout();
+            await bootstrap();
+        },
+        async start() {
+            await bootstrap();
+            await run('launchctl', ['kickstart', target]);
+        },
+        async stop() {
+            await bootout();
+        },
+        async restart() {
+            const r = await run('launchctl', ['kickstart', '-k', target]);
+            if (r.code !== 0)
+                await bootstrap();
+        },
+        async status() {
+            const installed = await exists(spec.file);
+            const r = await run('launchctl', ['print', target]);
+            if (r.code !== 0)
+                return { installed, running: false, detail: installed ? 'not loaded' : 'not installed' };
+            const pid = Number(r.stdout.match(/\bpid = (\d+)/)?.[1]) || undefined;
+            const state = r.stdout.match(/\bstate = (\w+)/)?.[1];
+            return { installed, running: state === 'running', pid, detail: state };
+        },
+        async uninstall() {
+            await bootout();
+            await rm(spec.file, { force: true });
+        },
+    };
+}

package/dist/service/systemd.js

@@ -0,0 +1,83 @@
+// service/systemd.ts — systemd 用户级（local/Linux）与系统级（vps，User=dsh）
+import { rm } from 'node:fs/promises';
+import { userInfo } from 'node:os';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { run } from '../util/exec.js';
+import { atomicWrite, exists } from '../util/fs.js';
+import { warn } from '../util/output.js';
+const quote = (a) => (/[\s"\\]/.test(a) ? `"${a.replace(/(["\\])/g, '\\$1')}"` : a);
+export function renderUnit(spec, system) {
+    const lines = [
+        '# Generated by dsh-model. 由 dsh-model 生成，卸载请执行 dsh-model uninstall',
+        '[Unit]',
+        'Description=dsh-model engine (CLIProxyAPI)',
+        'After=network-online.target',
+        'Wants=network-online.target',
+        '',
+        '[Service]',
+        'Type=simple',
+        `ExecStart=${spec.program.map(quote).join(' ')}`,
+        `WorkingDirectory=${spec.workingDirectory}`,
+        'Restart=on-failure',
+        'RestartSec=5',
+        `StandardOutput=append:${spec.stdoutPath}`,
+        `StandardError=append:${spec.stdoutPath}`,
+        ...Object.entries(spec.env ?? {}).map(([k, v]) => `Environment=${quote(`${k}=${v}`)}`),
+    ];
+    if (system) {
+        lines.push(`User=${spec.user}`, `Group=${spec.user}`, 'NoNewPrivileges=yes', 'PrivateTmp=yes', 'ProtectSystem=strict', `ReadWritePaths=${spec.home}`);
+    }
+    lines.push('', '[Install]', `WantedBy=${system ? 'multi-user.target' : 'default.target'}`, '');
+    return lines.join('\n');
+}
+export function systemd(kind, spec) {
+    const system = kind === 'systemd-system';
+    const sc = (...args) => run('systemctl', system ? args : ['--user', ...args]);
+    const must = async (...args) => {
+        const r = await sc(...args);
+        if (r.code !== 0)
+            throw new DshModelError('service_failed', L(`systemctl ${args.join(' ')} 失败：${r.stderr.trim()}`, `systemctl ${args.join(' ')} failed: ${r.stderr.trim()}`));
+    };
+    return {
+        kind,
+        spec,
+        render: () => renderUnit(spec, system),
+        async install() {
+            await atomicWrite(spec.file, renderUnit(spec, system), { mode: 0o644 });
+            await must('daemon-reload');
+            await must('enable', '--now', spec.label);
+            if (!system)
+                await checkLinger();
+        },
+        async start() {
+            await must('start', spec.label);
+        },
+        async stop() {
+            await sc('stop', spec.label);
+        },
+        async restart() {
+            await must('restart', spec.label);
+        },
+        async status() {
+            const installed = await exists(spec.file);
+            const r = await sc('show', spec.label, '-p', 'ActiveState', '-p', 'MainPID');
+            const state = r.stdout.match(/ActiveState=(\w+)/)?.[1];
+            const pid = Number(r.stdout.match(/MainPID=(\d+)/)?.[1]) || undefined;
+            return { installed, running: state === 'active', pid, detail: state };
+        },
+        async uninstall() {
+            await sc('disable', '--now', spec.label);
+            await rm(spec.file, { force: true });
+            await sc('daemon-reload');
+        },
+    };
+}
+/** 用户级服务要开 linger 才能在退出登录后继续跑 */
+async function checkLinger() {
+    const user = userInfo().username;
+    const r = await run('loginctl', ['show-user', user, '-p', 'Linger']);
+    if (r.code === 0 && /Linger=no/.test(r.stdout)) {
+        warn(L(`用户 ${user} 没开 linger：退出登录后引擎会停止。需要的话请执行 sudo loginctl enable-linger ${user}`, `Linger is off for ${user}: the engine stops when you log out. If needed run: sudo loginctl enable-linger ${user}`));
+    }
+}

package/dist/sources.js

@@ -0,0 +1,36 @@
+// sources.ts — 可接入的来源（设计 §14.2）。界面上每个来源一个开关。
+//
+// kind：engine = 引擎原生 OAuth；workbuddy = 我们自己的 bridge；opencode = key。
+// login：device = 链接 + 码（自动轮询）；paste = 授权后把跳转地址贴回来；link = 链接（自动轮询）；key = 粘贴 key。
+// 登录方式对照引擎管理接口 v8.0.13 实测：codex / claude 在管理接口里是回调式（需要贴回地址），kimi / xai / meta 是 device。
+export const SOURCES = [
+    { id: 'workbuddy', label: 'WorkBuddy', kind: 'workbuddy', login: 'link', variant: 'workbuddy', pricing: { tier: 'free', zh: '账号自带免费积分（剩余见用量）', en: 'Free credits on the account (see usage)' } },
+    { id: 'workbuddy-ai', label: 'WorkBuddy AI', kind: 'workbuddy', login: 'link', variant: 'workbuddy-ai', pricing: { tier: 'free', zh: '账号自带免费积分（剩余见用量）', en: 'Free credits on the account (see usage)' } },
+    { id: 'codex', label: 'Codex (ChatGPT)', kind: 'engine', login: 'device', deviceCliFlag: '-codex-device-login', engineProvider: 'codex', filePrefix: 'codex-', subscribeUrl: 'https://chatgpt.com/pricing', pricing: { tier: 'paid', zh: '需要 ChatGPT Plus / Pro 订阅', en: 'Needs a ChatGPT Plus / Pro subscription' } },
+    { id: 'claude', label: 'Claude', kind: 'engine', login: 'paste', engineProvider: 'claude', filePrefix: 'claude-', riskAck: true, risky: true, subscribeUrl: 'https://claude.com/pricing', pricing: { tier: 'paid', zh: '需要 Claude Pro / Max 订阅', en: 'Needs a Claude Pro / Max subscription' } },
+    { id: 'kimi', label: 'Kimi', kind: 'engine', login: 'device', engineProvider: 'kimi', filePrefix: 'kimi-', subscribeUrl: 'https://www.kimi.com/code/#pricing', pricing: { tier: 'paid', zh: '需要 Kimi Code 套餐（普通 Kimi 账号调用会被拒）', en: 'Needs a Kimi Code plan (a regular Kimi account is refused)' } },
+    { id: 'xai', label: 'Grok (xAI)', kind: 'engine', login: 'device', engineProvider: 'xai', filePrefix: 'xai-', subscribeUrl: 'https://grok.com/plans', pricing: { tier: 'paid', zh: '需要 SuperGrok 或 X Premium+ 订阅', en: 'Needs SuperGrok or X Premium+' } },
+    { id: 'meta', label: 'Muse (Meta)', kind: 'engine', login: 'device', engineProvider: 'meta', filePrefix: 'meta-', pricing: { tier: 'paid', zh: '需要 Muse Code 套餐（$5 / 月起），meta.ai 的免费版接不进来', en: 'Needs a Muse Code plan (from $5/mo); the free meta.ai tier cannot be used here' } },
+    { id: 'antigravity', label: 'Antigravity', kind: 'engine', login: 'paste', engineProvider: 'antigravity', filePrefix: 'antigravity-', riskAck: true, risky: true, pricing: { tier: 'limited', zh: 'Google 账号有免费额度，额度有限', en: 'Free quota with a Google account, limited' } },
+    { id: 'devin', label: 'Devin', kind: 'engine', login: 'paste', engineProvider: 'devin', filePrefix: 'devin-', subscribeUrl: 'https://devin.ai/pricing', probeModel: 'devin/swe-1-7-lightning', pricing: { tier: 'paid', zh: '需要 Devin Pro（$20 / 月）；免费档实测调用被拒（insufficient_quota）', en: 'Needs Devin Pro ($20/mo); the free tier is refused in testing (insufficient_quota)' } },
+    { id: 'opencode', label: 'OpenCode Zen', kind: 'opencode', login: 'key', subscribeUrl: 'https://opencode.ai/zen', pricing: { tier: 'paid', zh: '要先充值拿 key 按量计费；它的免费模型只能在 OpenCode 软件里用', en: 'Top up for a pay-as-you-go key; its free models only work inside the OpenCode app' } },
+];
+const ALIASES = { grok: 'xai', muse: 'meta', chatgpt: 'codex', openai: 'codex', 'workbuddy-cn': 'workbuddy', wb: 'workbuddy', 'wb-ai': 'workbuddy-ai' };
+export function findSource(id) {
+    const k = ALIASES[id.toLowerCase()] ?? id.toLowerCase();
+    return SOURCES.find((s) => s.id === k);
+}
+/** 凭据属于哪个来源：优先看 provider / type 字段，否则看文件名前缀 */
+export function credsFor(creds, def) {
+    return creds.filter((c) => {
+        const p = String(c.provider ?? c.type ?? '').toLowerCase();
+        if (p)
+            return p === def.engineProvider;
+        return Boolean(def.filePrefix && c.name.startsWith(def.filePrefix));
+    });
+}
+/** 引擎因 403 payment_required 把这个凭据冷却了（实测：Kimi 没有 Kimi Code 订阅时如此）*/
+export function paymentRequired(cred) {
+    const cooldowns = cred.cooldowns;
+    return Array.isArray(cooldowns) && cooldowns.some((c) => c?.reason === 'payment_required');
+}

package/dist/state.js

@@ -0,0 +1,90 @@
+// state.ts — config.json（用户意图）、state.json（安装台账）、.lock（命令互斥）
+//
+// state.json 是卸载与 repair 的唯一依据：dsh-model 写到 home 之外的每个文件都登记在这里。
+import { open, readFile, rm } from 'node:fs/promises';
+import { DshModelError } from './errors.js';
+import { L } from './i18n.js';
+import { ensureDir, readJson, writeJson } from './util/fs.js';
+export const DEFAULT_PORT = 8317;
+export const PROVIDER_ID = 'dsh-model';
+export function defaultConfig() {
+    return {
+        port: DEFAULT_PORT,
+        engine: { version: null },
+        dsh: { profile: null, providerId: PROVIDER_ID },
+        upstreams: {},
+        remote: { mode: 'off' },
+    };
+}
+export async function loadConfig(ctx) {
+    const stored = await readJson(ctx.paths.config);
+    const base = defaultConfig();
+    return {
+        ...base,
+        ...stored,
+        engine: { ...base.engine, ...stored?.engine },
+        dsh: { ...base.dsh, ...stored?.dsh },
+        upstreams: { ...stored?.upstreams },
+        remote: { ...base.remote, ...stored?.remote },
+    };
+}
+export async function saveConfig(ctx, config) {
+    await ensureHome(ctx);
+    await writeJson(ctx.paths.config, config, { owner: ctx.owner });
+}
+export async function loadState(ctx) {
+    const stored = await readJson(ctx.paths.state);
+    const state = { ...stored, engine: { versions: [], ...stored?.engine } };
+    // 0.1.0 的台账没有所有权字段：那时只会写 dsh-model 端点与 DSH_MODEL_API_KEY
+    if (state.dsh && !state.dsh.ownedProviders)
+        state.dsh.ownedProviders = [PROVIDER_ID];
+    if (state.dsh && !state.dsh.ownedRefs)
+        state.dsh.ownedRefs = ['DSH_MODEL_API_KEY'];
+    return state;
+}
+export async function saveState(ctx, state) {
+    await ensureHome(ctx);
+    await writeJson(ctx.paths.state, state, { owner: ctx.owner });
+}
+export async function ensureHome(ctx) {
+    await ensureDir(ctx.paths.home, { owner: ctx.owner });
+}
+/**
+ * 命令互斥：两个 setup 同时跑会互相踩配置。锁文件记 pid，持锁进程已不在就当过期锁清掉。
+ */
+export async function withLock(ctx, fn) {
+    await ensureHome(ctx);
+    const acquire = async () => {
+        const handle = await open(ctx.paths.lock, 'wx', 0o600);
+        await handle.writeFile(String(process.pid));
+        await handle.close();
+    };
+    try {
+        await acquire();
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const pid = Number((await readFile(ctx.paths.lock, 'utf8').catch(() => '')).trim());
+        if (pid && pid !== process.pid && isAlive(pid)) {
+            throw new DshModelError('locked', L(`另一个 dsh-model 命令正在运行（pid ${pid}），等它结束再试`, `Another dsh-model command is running (pid ${pid}); try again when it finishes`), L('如果是终端里的命令停在等你输入，回到终端完成它', 'If a command in a terminal is waiting for your input, finish it there'));
+        }
+        await rm(ctx.paths.lock, { force: true });
+        await acquire();
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await rm(ctx.paths.lock, { force: true });
+    }
+}
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}

package/dist/upstreams.js

@@ -0,0 +1,23 @@
+// upstreams.ts — 上游与引擎登录参数的映射（对照 CLIProxyAPI v8.0.13 -h 实测）
+import { DshModelError } from './errors.js';
+import { L } from './i18n.js';
+export const UPSTREAMS = [
+    { id: 'codex', label: 'Codex (ChatGPT)', flag: '-codex-login', deviceFlag: '-codex-device-login', callbackPort: 1455, filePrefix: 'codex-' },
+    { id: 'kimi', label: 'Kimi', flag: '-kimi-login', filePrefix: 'kimi-' },
+    { id: 'xai', label: 'Grok (xAI)', flag: '-xai-login', filePrefix: 'xai-' },
+    { id: 'meta', label: 'Muse (Meta)', flag: '-meta-login', filePrefix: 'meta-' },
+    { id: 'claude', label: 'Claude (Pro/Max)', flag: '-claude-login', callbackPort: 54545, filePrefix: 'claude-', requiresRiskAck: true },
+    { id: 'antigravity', label: 'Antigravity', flag: '-antigravity-login', callbackPort: 51121, filePrefix: 'antigravity-', requiresRiskAck: true },
+];
+const ALIASES = { grok: 'xai', muse: 'meta', chatgpt: 'codex', openai: 'codex' };
+export function getUpstream(id) {
+    const key = ALIASES[id.toLowerCase()] ?? id.toLowerCase();
+    const def = UPSTREAMS.find((u) => u.id === key);
+    if (!def) {
+        throw new DshModelError('unknown_upstream', L(`不认识的上游：${id}`, `Unknown upstream: ${id}`), L(`可用：${UPSTREAMS.map((u) => u.id).join('、')}`, `Available: ${UPSTREAMS.map((u) => u.id).join(', ')}`));
+    }
+    return def;
+}
+export function riskNotice(def) {
+    return L(`${def.label} 的服务条款限定订阅凭据只能在其官方客户端中使用。通过第三方工具调用可能违反条款，账号存在被限制或封禁的风险。dsh-model 仅供个人自用，风险由你自行承担。\n确认后请加 --accept-risk 重新执行：dsh-model login ${def.id} --accept-risk`, `${def.label}'s terms limit subscription credentials to its official clients. Using them through a third-party tool may violate those terms and risks account restriction or suspension. dsh-model is for personal use only; you accept this risk yourself.\nTo proceed, re-run with --accept-risk: dsh-model login ${def.id} --accept-risk`);
+}

package/dist/util/diff.js

@@ -0,0 +1,30 @@
+// util/diff.ts — 给 --dry-run 用的简单行 diff（LCS）
+export function lineDiff(before, after, label) {
+    const a = before.split('\n');
+    const b = after.split('\n');
+    const n = a.length;
+    const m = b.length;
+    const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+    for (let i = n - 1; i >= 0; i--)
+        for (let j = m - 1; j >= 0; j--)
+            dp[i][j] = a[i] === b[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+    const out = [`--- ${label}`, `+++ ${label}`];
+    let i = 0;
+    let j = 0;
+    while (i < n || j < m) {
+        if (i < n && j < m && a[i] === b[j]) {
+            out.push(`  ${a[i]}`);
+            i++;
+            j++;
+        }
+        else if (j < m && (i >= n || dp[i][j + 1] >= dp[i + 1][j])) {
+            out.push(`+ ${b[j]}`);
+            j++;
+        }
+        else {
+            out.push(`- ${a[i]}`);
+            i++;
+        }
+    }
+    return out.join('\n');
+}

package/dist/util/exec.js

@@ -0,0 +1,42 @@
+// util/exec.ts — 子进程
+import { spawn } from 'node:child_process';
+/** 跑一个命令并收集输出；不抛错，调用方看 code */
+export function run(cmd, args, options = {}) {
+    return new Promise((resolve) => {
+        // 不需要输入时 stdin 直接 ignore；需要时子进程可能不读就退出（或命令不存在），写入会 EPIPE，必须吞掉（服务器上实测会崩）
+        const hasInput = options.input !== undefined;
+        const child = spawn(cmd, args, { cwd: options.cwd, env: options.env ?? process.env, stdio: [hasInput ? 'pipe' : 'ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        const timer = options.timeoutMs ? setTimeout(() => child.kill('SIGKILL'), options.timeoutMs) : null;
+        child.stdout?.on('data', (d) => (stdout += d));
+        child.stderr?.on('data', (d) => (stderr += d));
+        child.on('error', (error) => {
+            if (timer)
+                clearTimeout(timer);
+            resolve({ code: 127, stdout, stderr: stderr + String(error.message) });
+        });
+        child.on('close', (code) => {
+            if (timer)
+                clearTimeout(timer);
+            resolve({ code: code ?? 1, stdout, stderr });
+        });
+        if (hasInput && child.stdin) {
+            child.stdin.on('error', () => { });
+            child.stdin.end(options.input);
+        }
+    });
+}
+/** 交互式运行：stdio 直接交给用户（登录流程要用户看 URL、粘贴回调） */
+export function runInherit(cmd, args, options = {}) {
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, { cwd: options.cwd, env: options.env ?? process.env, stdio: 'inherit' });
+        child.on('error', () => resolve(127));
+        child.on('close', (code) => resolve(code ?? 1));
+    });
+}
+/** 在 PATH 里找命令 */
+export async function which(cmd) {
+    const r = await run('sh', ['-c', `command -v ${cmd}`]);
+    return r.code === 0 ? r.stdout.trim() || null : null;
+}

package/dist/util/fs.js

@@ -0,0 +1,107 @@
+// util/fs.ts — 原子写、哈希、属主
+//
+// 所有落盘都走 atomicWrite：先写同目录临时文件再 rename，中途断电也不会留下半个文件。
+// vps 模式下 dsh-model 以 root 运行，但文件要归 dsh 用户，所以写入时可带 owner。
+import { createHash, randomBytes } from 'node:crypto';
+import { chown, chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export async function atomicWrite(file, data, options = {}) {
+    const mode = options.mode ?? 0o600;
+    await mkdir(dirname(file), { recursive: true });
+    const tmp = join(dirname(file), `.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        await writeFile(tmp, data, { mode });
+        await chmod(tmp, mode); // umask 可能削掉 writeFile 的 mode
+        if (options.owner)
+            await chown(tmp, options.owner.uid, options.owner.gid);
+        await rename(tmp, file);
+    }
+    catch (error) {
+        await rm(tmp, { force: true });
+        throw error;
+    }
+}
+/**
+ * 原地覆盖写（保留 inode）：给"被别的进程用 fsnotify 盯着的文件"用。
+ * atomicWrite 的 rename 会换掉 inode，Linux 上盯着旧 inode 的监听就再也收不到变化（引擎热重载实测失效）。
+ * 文件不存在时退回 atomicWrite。代价是极短时间内可能读到半个文件——引擎会按 SHA 去抖并在解析失败时保留旧配置。
+ */
+export async function writeInPlace(file, data, options = {}) {
+    const mode = options.mode ?? 0o600;
+    try {
+        await stat(file);
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return atomicWrite(file, data, options);
+        throw error;
+    }
+    await writeFile(file, data);
+    await chmod(file, mode);
+    if (options.owner)
+        await chown(file, options.owner.uid, options.owner.gid);
+}
+export async function ensureDir(dir, options = {}) {
+    await mkdir(dir, { recursive: true, mode: options.mode ?? 0o700 });
+    await chmod(dir, options.mode ?? 0o700);
+    if (options.owner)
+        await chown(dir, options.owner.uid, options.owner.gid);
+}
+export function sha256(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+export async function sha256File(file) {
+    try {
+        return sha256(await readFile(file));
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    }
+}
+export async function readText(file) {
+    try {
+        return await readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    }
+}
+export async function readJson(file) {
+    const text = await readText(file);
+    return text == null ? null : JSON.parse(text);
+}
+export async function writeJson(file, value, options = {}) {
+    await atomicWrite(file, JSON.stringify(value, null, 2) + '\n', options);
+}
+export async function exists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return false;
+        throw error;
+    }
+}
+/** 文件权限位（如 0o600）；不存在返回 null */
+export async function fileMode(path) {
+    try {
+        return (await stat(path)).mode & 0o777;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    }
+}
+export function isNotFound(error) {
+    return error?.code === 'ENOENT';
+}
+export function timestamp(date = new Date()) {
+    return date.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+}

package/dist/util/output.js

@@ -0,0 +1,50 @@
+// util/output.ts — 终端输出。--json 时人读的输出全部静默，最后由命令打印一个 JSON
+let jsonMode = false;
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+export function setJsonMode(on) {
+    jsonMode = on;
+}
+export function isJsonMode() {
+    return jsonMode;
+}
+const paint = (code, s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : s);
+export const green = (s) => paint('32', s);
+export const yellow = (s) => paint('33', s);
+export const red = (s) => paint('31', s);
+export const dim = (s) => paint('2', s);
+export const bold = (s) => paint('1', s);
+export function info(msg) {
+    if (!jsonMode)
+        console.log(msg);
+}
+export function ok(msg) {
+    if (!jsonMode)
+        console.log(`${green('✓')} ${msg}`);
+}
+export function skip(msg) {
+    if (!jsonMode)
+        console.log(`${dim('·')} ${dim(msg)}`);
+}
+export function warn(msg) {
+    if (!jsonMode)
+        console.error(`${yellow('!')} ${msg}`);
+}
+export function fail(msg) {
+    console.error(`${red('✗')} ${msg}`);
+}
+export function next(msg) {
+    if (!jsonMode)
+        console.log(`${bold('→')} ${msg}`);
+}
+export function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+// 东亚宽字符（CJK、全角符号）占两列；✓ ✗ 等符号在终端里是单列
+const WIDE = /[\u1100-\u115f\u2e80-\u303e\u3041-\ua4cf\uac00-\ud7a3\uf900-\ufaff\ufe30-\ufe4f\uff00-\uff60\uffe0-\uffe6]/;
+/** 简单对齐表格（按显示宽度处理 CJK） */
+export function table(rows) {
+    const width = (s) => [...s.replace(/\x1b\[[0-9;]*m/g, '')].reduce((n, ch) => n + (WIDE.test(ch) ? 2 : 1), 0);
+    const cols = Math.max(...rows.map((r) => r.length));
+    const w = Array.from({ length: cols }, (_, i) => Math.max(...rows.map((r) => width(r[i] ?? ''))));
+    return rows.map((r) => r.map((c, i) => (i === r.length - 1 ? c : c + ' '.repeat((w[i] ?? 0) - width(c)))).join('  ')).join('\n');
+}

package/dist/util/pkg.js

@@ -0,0 +1,13 @@
+// util/pkg.ts — 包根目录（dist/util/pkg.js 或 src/util/pkg.ts 往上两级）
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const PKG_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+export function pkgVersion() {
+    try {
+        return JSON.parse(readFileSync(join(PKG_ROOT, 'package.json'), 'utf8')).version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}

package/dist/util/port.js

@@ -0,0 +1,16 @@
+// util/port.ts — 端口占用检测
+import { createServer } from 'node:net';
+export function isPortFree(port, host = '127.0.0.1') {
+    return new Promise((resolve) => {
+        const server = createServer();
+        server.once('error', () => resolve(false));
+        server.listen(port, host, () => server.close(() => resolve(true)));
+    });
+}
+/** 从 start 起找第一个空闲端口（最多试 50 个） */
+export async function findFreePort(start, host = '127.0.0.1') {
+    for (let p = start; p < start + 50; p++)
+        if (await isPortFree(p, host))
+            return p;
+    throw new Error(`no free port in ${start}..${start + 49}`);
+}

package/dist/util/prompt.js

@@ -0,0 +1,40 @@
+// util/prompt.ts — 交互输入。secret 不回显（key 不进终端回滚、不进 shell 历史）
+import { createInterface } from 'node:readline';
+export function canPrompt() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+export function promptLine(question) {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+export function promptSecret(question) {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+        const out = rl;
+        let asked = false;
+        out._writeToOutput = (s) => {
+            // 只把提问本身写出去，之后的按键一律不回显
+            if (!asked) {
+                out.output.write(s);
+                asked = true;
+            }
+        };
+        rl.question(question, (answer) => {
+            rl.close();
+            process.stdout.write('\n');
+            resolve(answer.trim());
+        });
+    });
+}
+/** 非交互：从管道读完整 stdin（dsh-model opencode key --stdin） */
+export async function readStdin() {
+    let data = '';
+    for await (const chunk of process.stdin)
+        data += chunk;
+    return data.trim();
+}