mslxdff 0.1.199 → 0.1.203

package/src/providers/cline/allowlist-sync.js

@@ -1,93 +1,93 @@
-/**
- * Cline 白名单自动同步（上游列表 = 真相）。
- *
- * 背景：`providerConfigs.cline.allowedModels` 是一份**静态快照**（历史由 `-provider cline free sync --yes` 一次性写入）。
- * 上游 `recommended-models` 会漂移——新模型上架免费通道、同一模型从 `cline-pass/` 挪到 `cline-free/`——
- * 而静态快照不跟着变，于是 `isModelAllowed()` 精确匹配失败，把上游明明免费可用的模型当成"未授权"拦掉
- * （实测 2026-09-24：`cline-free/gemini-3.8-flash`、`stealth/space-bunny-alpha`、`cline-free/mimo-v2.6-flash` 被拦，
- *  而 allowlist 里只有 `cline-pass/mimo-v2.6-flash`，通道不同即视为不同 id）。
- *
- * 本模块把语义改成「每次成功读取上游列表后，立即把上游 id 并进白名单」：
- *   - **只增不减**：上游下架的 id 保留在表内（与 modelPicks 孤儿"仅标记不自动删"的既有口径一致，回收走 prune），
- *     避免同步动作变成删配置。
- *   - **仅在上游成功路径调用**：内置兜底常量不是上游真相，写盘只会污染（由调用方保证，见 models.js）。
- *   - **无新增不写盘**：上游 10 分钟缓存内反复命中同一列表时零写放大。
- * 关掉：`MSLXDFF_CLINE_AUTOSYNC=0`（退回纯静态白名单行为）。
- * Note: 只增不减 + 仅上游成功路径同步的取舍见 .agents/notes/implemented/feature/2026-09-24-cline-auto-sync-free-catalog.md
- *
- * 纯逻辑（planMerge）无 IO，可单测；IO 全走注入。
- */
-
-/** 与 state/provider-config.js 的 normalizeAllowedModel 对齐：只剥首段等于 providerId 的前缀。调用方可注入同名函数保证单一真相。 */
-export function defaultNormalize(model, providerId) {
-  let s = String(model || "").trim();
-  if (!s) return "";
-  const idx = s.indexOf("/");
-  if (idx > 0 && s.slice(0, idx).toLowerCase() === String(providerId || "").toLowerCase()) s = s.slice(idx + 1);
-  return s;
-}
-
-/**
- * 求并集：保留 current 原顺序与全部既有条目，把 upstreamIds 中缺失的追加到尾部。
- * @param {string[]} current 当前白名单（裸 id）
- * @param {string[]} upstreamIds 上游模型 id（可带 provider 前缀，内部归一）
- * @param {(m:string, pid:string)=>string} [normalize]
- * @param {string} [providerId]
- * @returns {{next:string[], added:string[]}}
- */
-export function planMerge(current, upstreamIds, normalize = defaultNormalize, providerId = "") {
-  const cur = Array.isArray(current) ? current : [];
-  const next = [...new Set(cur.map((m) => normalize(m, providerId)).filter(Boolean))];
-  const seen = new Set(next);
-  const added = [];
-  for (const raw of Array.isArray(upstreamIds) ? upstreamIds : []) {
-    const norm = normalize(raw, providerId);
-    if (!norm || seen.has(norm)) continue;
-    seen.add(norm);
-    next.push(norm);
-    added.push(norm);
-  }
-  return { next, added };
-}
-
-/**
- * @param {object} opts
- * @param {string} opts.providerId
- * @param {() => string[]} opts.loadCurrent 读当前白名单（裸 id 数组）
- * @param {(id:string, list:string[]) => unknown} opts.persist 写回白名单
- * @param {(msg:string) => void} [opts.onLog]
- * @param {(m:string, pid:string)=>string} [opts.normalize]
- * @param {boolean} [opts.enabled] 显式覆盖 env 开关
- */
-export function createAllowlistSync({ providerId, loadCurrent, persist, onLog, normalize = defaultNormalize, enabled } = {}) {
-  const isEnabled = () => {
-    if (typeof enabled === "boolean") return enabled;
-    return String(process.env.MSLXDFF_CLINE_AUTOSYNC ?? "") !== "0";
-  };
-  const log = (msg) => { try { onLog?.(msg); } catch {} };
-
-  /**
-   * 把一批上游模型并进白名单。
-   * @param {{id?:string}[]|string[]} models 上游模型对象数组或 id 数组
-   * @returns {{skipped:string, added:string[], total:number}}
-   */
-  function syncIds(models) {
-    if (!isEnabled()) return { skipped: "disabled", added: [], total: 0 };
-    if (!Array.isArray(models) || !models.length) return { skipped: "empty", added: [], total: 0 };
-    try {
-      const ids = models.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
-      const cur = loadCurrent() || [];
-      const { next, added } = planMerge(cur, ids, normalize, providerId);
-      if (!added.length) return { skipped: "", added: [], total: next.length };
-      persist(providerId, next);
-      log(`[${providerId}] allowlist auto-sync: +${added.length} → ${next.length} total (${added.join(", ")})`);
-      return { skipped: "", added, total: next.length };
-    } catch (err) {
-      // 同步是增益动作，失败绝不打断模型列表读取与请求链路
-      log(`[${providerId}] allowlist auto-sync failed: ${String(err?.message || err)}`);
-      return { skipped: "error", added: [], total: 0 };
-    }
-  }
-
-  return { syncIds };
-}
+/**
+ * Cline 白名单自动同步（上游列表 = 真相）。
+ *
+ * 背景：`providerConfigs.cline.allowedModels` 是一份**静态快照**（历史由 `-provider cline free sync --yes` 一次性写入）。
+ * 上游 `recommended-models` 会漂移——新模型上架免费通道、同一模型从 `cline-pass/` 挪到 `cline-free/`——
+ * 而静态快照不跟着变，于是 `isModelAllowed()` 精确匹配失败，把上游明明免费可用的模型当成"未授权"拦掉
+ * （实测 2026-09-24：`cline-free/gemini-3.8-flash`、`stealth/space-bunny-alpha`、`cline-free/mimo-v2.6-flash` 被拦，
+ *  而 allowlist 里只有 `cline-pass/mimo-v2.6-flash`，通道不同即视为不同 id）。
+ *
+ * 本模块把语义改成「每次成功读取上游列表后，立即把上游 id 并进白名单」：
+ *   - **只增不减**：上游下架的 id 保留在表内（与 modelPicks 孤儿"仅标记不自动删"的既有口径一致，回收走 prune），
+ *     避免同步动作变成删配置。
+ *   - **仅在上游成功路径调用**：内置兜底常量不是上游真相，写盘只会污染（由调用方保证，见 models.js）。
+ *   - **无新增不写盘**：上游 10 分钟缓存内反复命中同一列表时零写放大。
+ * 关掉：`MSLXDFF_CLINE_AUTOSYNC=0`（退回纯静态白名单行为）。
+ * Note: 只增不减 + 仅上游成功路径同步的取舍见 .agents/notes/implemented/feature/2026-09-24-cline-auto-sync-free-catalog.md
+ *
+ * 纯逻辑（planMerge）无 IO，可单测；IO 全走注入。
+ */
+
+/** 与 state/provider-config.js 的 normalizeAllowedModel 对齐：只剥首段等于 providerId 的前缀。调用方可注入同名函数保证单一真相。 */
+export function defaultNormalize(model, providerId) {
+  let s = String(model || "").trim();
+  if (!s) return "";
+  const idx = s.indexOf("/");
+  if (idx > 0 && s.slice(0, idx).toLowerCase() === String(providerId || "").toLowerCase()) s = s.slice(idx + 1);
+  return s;
+}
+
+/**
+ * 求并集：保留 current 原顺序与全部既有条目，把 upstreamIds 中缺失的追加到尾部。
+ * @param {string[]} current 当前白名单（裸 id）
+ * @param {string[]} upstreamIds 上游模型 id（可带 provider 前缀，内部归一）
+ * @param {(m:string, pid:string)=>string} [normalize]
+ * @param {string} [providerId]
+ * @returns {{next:string[], added:string[]}}
+ */
+export function planMerge(current, upstreamIds, normalize = defaultNormalize, providerId = "") {
+  const cur = Array.isArray(current) ? current : [];
+  const next = [...new Set(cur.map((m) => normalize(m, providerId)).filter(Boolean))];
+  const seen = new Set(next);
+  const added = [];
+  for (const raw of Array.isArray(upstreamIds) ? upstreamIds : []) {
+    const norm = normalize(raw, providerId);
+    if (!norm || seen.has(norm)) continue;
+    seen.add(norm);
+    next.push(norm);
+    added.push(norm);
+  }
+  return { next, added };
+}
+
+/**
+ * @param {object} opts
+ * @param {string} opts.providerId
+ * @param {() => string[]} opts.loadCurrent 读当前白名单（裸 id 数组）
+ * @param {(id:string, list:string[]) => unknown} opts.persist 写回白名单
+ * @param {(msg:string) => void} [opts.onLog]
+ * @param {(m:string, pid:string)=>string} [opts.normalize]
+ * @param {boolean} [opts.enabled] 显式覆盖 env 开关
+ */
+export function createAllowlistSync({ providerId, loadCurrent, persist, onLog, normalize = defaultNormalize, enabled } = {}) {
+  const isEnabled = () => {
+    if (typeof enabled === "boolean") return enabled;
+    return String(process.env.MSLXDFF_CLINE_AUTOSYNC ?? "") !== "0";
+  };
+  const log = (msg) => { try { onLog?.(msg); } catch {} };
+
+  /**
+   * 把一批上游模型并进白名单。
+   * @param {{id?:string}[]|string[]} models 上游模型对象数组或 id 数组
+   * @returns {{skipped:string, added:string[], total:number}}
+   */
+  function syncIds(models) {
+    if (!isEnabled()) return { skipped: "disabled", added: [], total: 0 };
+    if (!Array.isArray(models) || !models.length) return { skipped: "empty", added: [], total: 0 };
+    try {
+      const ids = models.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
+      const cur = loadCurrent() || [];
+      const { next, added } = planMerge(cur, ids, normalize, providerId);
+      if (!added.length) return { skipped: "", added: [], total: next.length };
+      persist(providerId, next);
+      log(`[${providerId}] allowlist auto-sync: +${added.length} → ${next.length} total (${added.join(", ")})`);
+      return { skipped: "", added, total: next.length };
+    } catch (err) {
+      // 同步是增益动作，失败绝不打断模型列表读取与请求链路
+      log(`[${providerId}] allowlist auto-sync failed: ${String(err?.message || err)}`);
+      return { skipped: "error", added: [], total: 0 };
+    }
+  }
+
+  return { syncIds };
+}

package/src/providers/cline/free-catalog.js

@@ -1,71 +1,71 @@
-/**
- * Cline 免费目录深模块：只认上游 `free` 数组（公开接口，无需鉴权、无凭据）。
- * GET {bareHost}/api/v1/ai/cline/recommended-models → { recommended, free, clinePass, clineCloud }
- * 供 cline/models.js（聚合目录 + 启动自检）与 `-provider cline free` CLI 共用；缓存由调用方持有。
- */
-import { compatFetch } from "../../compat.js";
-import { joinUrl } from "../base.js";
-
-export const FREE_CATALOG_PATH = "/api/v1/ai/cline/recommended-models";
-export const DEFAULT_CLINE_BASE = "https://api.cline.bot";
-
-// 上游不可达时的内置兜底（2026-09-20 实测 5 个；只有 id 与短名，无凭据）
-export const FALLBACK_FREE = Object.freeze([
-  { id: "cline-free/deepseek-v4.1-flash", name: "deepseek-v4.1-flash" },
-  { id: "cline-free/muse-spark-1.3-contributor", name: "muse-spark-1.3-contributor" },
-  { id: "z-ai/glm-5.3-flash", name: "glm-5.3-flash" },
-  { id: "cline-free/solar-pro4", name: "solar-pro4" },
-  { id: "poolside/laguna-s-2.1:free", name: "laguna-s-2.1:free" },
-]);
-export const FALLBACK_FREE_IDS = FALLBACK_FREE.map((m) => m.id);
-
-/** 目录 URL 归一：baseUrl 可能是裸 host 或带 /api/v1 的老 clinebot 形态；customPath 尊重用户自定义端点 */
-export function catalogUrl(baseUrl, customPath) {
-  const raw = String(baseUrl || "").trim() || DEFAULT_CLINE_BASE;
-  const bare = raw.replace(/\/+$/, "").replace(/\/api\/v1\/?$/, "") || DEFAULT_CLINE_BASE;
-  const p = String(customPath || "").trim();
-  if (p && p !== "/models" && p !== FREE_CATALOG_PATH) return joinUrl(bare, p);
-  return joinUrl(bare, FREE_CATALOG_PATH);
-}
-
-/** 只取 json.free（对象 {id,name,...} 或裸字符串两种形态都容忍） */
-function pickFree(json) {
-  const arr = Array.isArray(json?.free) ? json.free : [];
-  const out = [];
-  for (const m of arr) {
-    if (typeof m === "string" && m.trim()) out.push({ id: m.trim() });
-    else if (m && typeof m.id === "string" && m.id.trim()) out.push({ ...m, id: m.id.trim(), name: String(m.name || "") });
-  }
-  return out;
-}
-
-/**
- * 拉免费目录。
- * @returns {Promise<{ok:boolean, status:number, url:string, models:object[], ids:string[], error?:string}>}
- *   ok=false 时 models/ids 为空（兜底由调用方决定）；authorization 供私有/自定义目录可选透传。
- */
-export async function fetchFreeCatalog({ baseUrl, customPath, fetchImpl, dispatcher, authorization, timeoutMs = 15_000 } = {}) {
-  const url = catalogUrl(baseUrl, customPath);
-  const impl = fetchImpl || compatFetch;
-  const headers = { Accept: "application/json" };
-  if (authorization) headers.Authorization = authorization;
-  const opts = { headers };
-  if (dispatcher) opts.dispatcher = dispatcher;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(new Error("cline free catalog timed out")), timeoutMs);
-  timer.unref?.();
-  opts.signal = controller.signal;
-  try {
-    const res = await impl(url, opts);
-    const status = Number(res?.status) || 0;
-    if (!res?.ok) return { ok: false, status, url, models: [], ids: [], error: `HTTP ${status}` };
-    const json = await res.json().catch(() => null);
-    const models = pickFree(json);
-    if (!models.length) return { ok: false, status, url, models: [], ids: [], error: "empty free list" };
-    return { ok: true, status, url, models, ids: models.map((m) => m.id) };
-  } catch (err) {
-    return { ok: false, status: 0, url, models: [], ids: [], error: String(err?.message || err) };
-  } finally {
-    clearTimeout(timer);
-  }
-}
+/**
+ * Cline 免费目录深模块：只认上游 `free` 数组（公开接口，无需鉴权、无凭据）。
+ * GET {bareHost}/api/v1/ai/cline/recommended-models → { recommended, free, clinePass, clineCloud }
+ * 供 cline/models.js（聚合目录 + 启动自检）与 `-provider cline free` CLI 共用；缓存由调用方持有。
+ */
+import { compatFetch } from "../../compat.js";
+import { joinUrl } from "../base.js";
+
+export const FREE_CATALOG_PATH = "/api/v1/ai/cline/recommended-models";
+export const DEFAULT_CLINE_BASE = "https://api.cline.bot";
+
+// 上游不可达时的内置兜底（2026-09-20 实测 5 个；只有 id 与短名，无凭据）
+export const FALLBACK_FREE = Object.freeze([
+  { id: "cline-free/deepseek-v4.1-flash", name: "deepseek-v4.1-flash" },
+  { id: "cline-free/muse-spark-1.3-contributor", name: "muse-spark-1.3-contributor" },
+  { id: "z-ai/glm-5.3-flash", name: "glm-5.3-flash" },
+  { id: "cline-free/solar-pro4", name: "solar-pro4" },
+  { id: "poolside/laguna-s-2.1:free", name: "laguna-s-2.1:free" },
+]);
+export const FALLBACK_FREE_IDS = FALLBACK_FREE.map((m) => m.id);
+
+/** 目录 URL 归一：baseUrl 可能是裸 host 或带 /api/v1 的老 clinebot 形态；customPath 尊重用户自定义端点 */
+export function catalogUrl(baseUrl, customPath) {
+  const raw = String(baseUrl || "").trim() || DEFAULT_CLINE_BASE;
+  const bare = raw.replace(/\/+$/, "").replace(/\/api\/v1\/?$/, "") || DEFAULT_CLINE_BASE;
+  const p = String(customPath || "").trim();
+  if (p && p !== "/models" && p !== FREE_CATALOG_PATH) return joinUrl(bare, p);
+  return joinUrl(bare, FREE_CATALOG_PATH);
+}
+
+/** 只取 json.free（对象 {id,name,...} 或裸字符串两种形态都容忍） */
+function pickFree(json) {
+  const arr = Array.isArray(json?.free) ? json.free : [];
+  const out = [];
+  for (const m of arr) {
+    if (typeof m === "string" && m.trim()) out.push({ id: m.trim() });
+    else if (m && typeof m.id === "string" && m.id.trim()) out.push({ ...m, id: m.id.trim(), name: String(m.name || "") });
+  }
+  return out;
+}
+
+/**
+ * 拉免费目录。
+ * @returns {Promise<{ok:boolean, status:number, url:string, models:object[], ids:string[], error?:string}>}
+ *   ok=false 时 models/ids 为空（兜底由调用方决定）；authorization 供私有/自定义目录可选透传。
+ */
+export async function fetchFreeCatalog({ baseUrl, customPath, fetchImpl, dispatcher, authorization, timeoutMs = 15_000 } = {}) {
+  const url = catalogUrl(baseUrl, customPath);
+  const impl = fetchImpl || compatFetch;
+  const headers = { Accept: "application/json" };
+  if (authorization) headers.Authorization = authorization;
+  const opts = { headers };
+  if (dispatcher) opts.dispatcher = dispatcher;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error("cline free catalog timed out")), timeoutMs);
+  timer.unref?.();
+  opts.signal = controller.signal;
+  try {
+    const res = await impl(url, opts);
+    const status = Number(res?.status) || 0;
+    if (!res?.ok) return { ok: false, status, url, models: [], ids: [], error: `HTTP ${status}` };
+    const json = await res.json().catch(() => null);
+    const models = pickFree(json);
+    if (!models.length) return { ok: false, status, url, models: [], ids: [], error: "empty free list" };
+    return { ok: true, status, url, models, ids: models.map((m) => m.id) };
+  } catch (err) {
+    return { ok: false, status: 0, url, models: [], ids: [], error: String(err?.message || err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/providers/cline/headers.js

@@ -1,37 +1,37 @@
-/**
- * Cline 指纹头：官方靠这些头识别“是不是 Cline 客户端”
- * 缺少即 403: "only available via Cline product surfaces"
- * 逆向自 pingmike2/cline2api-workers worker.js clineHeaders
- */
-export function clineHeaders(sessionId, token) {
-  return {
-    Authorization: `Bearer workos:${token}`,
-    "Content-Type": "application/json",
-    "User-Agent": "Cline/3.0.47",
-    "HTTP-Referer": "https://cline.bot",
-    "X-Title": "Cline",
-    "X-IS-MULTIROOT": "false",
-    "X-CLIENT-TYPE": "cline-sdk",
-    "X-CLIENT-VERSION": "3.0.47",
-    "X-PLATFORM": "terminal",
-    "X-PLATFORM-VERSION": "3.0.47",
-    "X-CORE-VERSION": "0.0.66",
-    "X-Task-ID": sessionId,
-  };
-}
-
-export function isRefreshToken(key, providerId = "") {
-  const s = String(key || "").trim();
-  if (!s) return false;
-  // 仅 cline 系供应商才有 refreshToken 形态（WorkOS 设备授权）；其他一律走传统 Key
-  const pid = String(providerId || "").toLowerCase();
-  const baseHint = pid;
-  const isCline = baseHint.includes("cline");
-  if (!isCline) {
-    // 非 cline 供应商，即使长串也不视为 refreshToken，默认传统 Key（以后 xxx.bot 再扩展此处白名单）
-    return false;
-  }
-  if (s.startsWith("sk_") || s.startsWith("sk-")) return false;
-  if (s.length > 20) return true;
-  return false;
-}
+/**
+ * Cline 指纹头：官方靠这些头识别“是不是 Cline 客户端”
+ * 缺少即 403: "only available via Cline product surfaces"
+ * 逆向自 pingmike2/cline2api-workers worker.js clineHeaders
+ */
+export function clineHeaders(sessionId, token) {
+  return {
+    Authorization: `Bearer workos:${token}`,
+    "Content-Type": "application/json",
+    "User-Agent": "Cline/3.0.47",
+    "HTTP-Referer": "https://cline.bot",
+    "X-Title": "Cline",
+    "X-IS-MULTIROOT": "false",
+    "X-CLIENT-TYPE": "cline-sdk",
+    "X-CLIENT-VERSION": "3.0.47",
+    "X-PLATFORM": "terminal",
+    "X-PLATFORM-VERSION": "3.0.47",
+    "X-CORE-VERSION": "0.0.66",
+    "X-Task-ID": sessionId,
+  };
+}
+
+export function isRefreshToken(key, providerId = "") {
+  const s = String(key || "").trim();
+  if (!s) return false;
+  // 仅 cline 系供应商才有 refreshToken 形态（WorkOS 设备授权）；其他一律走传统 Key
+  const pid = String(providerId || "").toLowerCase();
+  const baseHint = pid;
+  const isCline = baseHint.includes("cline");
+  if (!isCline) {
+    // 非 cline 供应商，即使长串也不视为 refreshToken，默认传统 Key（以后 xxx.bot 再扩展此处白名单）
+    return false;
+  }
+  if (s.startsWith("sk_") || s.startsWith("sk-")) return false;
+  if (s.length > 20) return true;
+  return false;
+}