opencode-claude-code-ua 0.0.0-stage → 0.3.9

package/src/ua-runtime.mjs

@@ -0,0 +1,229 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { transformRequest } from './ua-transform.mjs'
+import { resolveTemplate } from './ua-store.mjs'
+
+import { SDK_BY_PROTOCOL, PATHS, protocolForModel, siteRoot, apiBase, operationURL } from '../lib/ua-protocol.mjs'
+export { SDK_BY_PROTOCOL, protocolForModel, siteRoot, apiBase, operationURL } from '../lib/ua-protocol.mjs'
+const authHeaders = ['authorization', 'x-api-key', 'x-goog-api-key', 'api-key', 'cookie', 'proxy-authorization']
+const err = (message, status = 400) => Object.assign(new Error(message), { status })
+
+export function operationForURL(input) {
+  const path = new URL(input instanceof Request ? input.url : input).pathname
+  if (/\/messages\/count_tokens$/.test(path)) return { protocol: 'anthropic', operation: 'count_tokens' }
+  if (/\/messages$/.test(path)) return { protocol: 'anthropic', operation: 'messages' }
+  if (/\/responses$/.test(path)) return { protocol: 'responses', operation: 'responses' }
+  if (/\/chat\/completions$/.test(path)) return { protocol: 'chat-completions', operation: 'chat/completions' }
+  const gemini = /\/models\/(.+):(generateContent|streamGenerateContent|countTokens)$/.exec(path)
+  if (gemini) return { protocol: 'gemini', operation: gemini[2], model: decodeURIComponent(gemini[1]) }
+  throw err('请求路径不是支持的模型操作')
+}
+
+export async function credential(connection, readAuth) {
+  let auth = connection.auth ?? {}
+  if (auth.source === 'host') {
+    const current = await readAuth?.(auth.provider, auth.account)
+    if (current?.type !== 'api' || typeof current.key !== 'string' || !current.key.trim()) throw err('当前宿主账号缺少 API key，请重新登录', 401)
+    const endpoint = current.metadata?.baseURL ?? current.metadata?.endpoint
+    if (!endpoint || new URL(endpoint).href.replace(/\/+$/, '') !== new URL(connection.baseURL).href.replace(/\/+$/, '')) throw err('宿主账号地址已改变，此旧连接不能使用当前凭据', 409)
+    auth = { ...auth, key: current.key }
+  }
+  if (['api-key', 'bearer'].includes(auth.mode) && !auth.key?.trim()) throw err('此连接缺少 API key', 400)
+  if (auth.mode === 'custom' && !auth.value?.trim()) throw err('此连接缺少自定义 Authorization', 400)
+  return auth
+}
+
+export function addAuthentication(headers, auth, protocol) {
+  const output = new Headers(headers)
+  for (const name of authHeaders) output.delete(name)
+  for (const name of [...output.keys()]) if (name.startsWith('x-magpie-')) output.delete(name)
+  if (auth.mode === 'bearer') output.set('authorization', `Bearer ${auth.key}`)
+  else if (auth.mode === 'custom') output.set('authorization', auth.value)
+  else if (auth.mode === 'api-key') output.set(protocol === 'anthropic' ? 'x-api-key' : protocol === 'gemini' ? 'x-goog-api-key' : 'authorization', ['responses', 'chat-completions'].includes(protocol) ? `Bearer ${auth.key}` : auth.key)
+  return output
+}
+
+function bodyModel(init) {
+  try {
+    const value = typeof init.body === 'string' ? JSON.parse(init.body) : ArrayBuffer.isView(init.body) && init.body.byteLength <= 2 * 1024 * 1024 ? JSON.parse(new TextDecoder().decode(init.body)) : undefined
+    return typeof value?.model === 'string' ? value.model : ''
+  } catch { return '' }
+}
+
+export async function prepareUpstream({ snapshot, connection, input, init = {}, context = {}, readAuth, template, templateRef, protocol: forcedProtocol, operation: forcedOperation, model: chosenModel }) {
+  if (!connection || connection.enabled === false) throw err('连接不存在或已停用', 404)
+  const incoming = new URL(input instanceof Request ? input.url : input)
+  const root = new URL(siteRoot(connection.baseURL))
+  const prefixes = [...new Set(Object.values(PATHS).concat(Object.values(connection.apiPaths ?? {})))].map(path => new URL(root.href.replace(/\/$/, '') + path.replace(/\/$/, '') + '/'))
+  if (incoming.origin !== root.origin || incoming.username || incoming.password || incoming.hash || !prefixes.some(prefix => incoming.pathname.startsWith(prefix.pathname))) throw err('拒绝发送凭据到此连接以外的路径')
+  const detected = operationForURL(input)
+  const protocol = forcedProtocol ?? detected.protocol
+  const operation = forcedOperation ?? detected.operation
+  if (detected.protocol !== protocol || detected.operation !== operation) throw err('请求协议与选定测试协议不匹配')
+  const model = chosenModel || context.model || bodyModel(init) || detected.model || ''
+  const target = new URL(operationURL(connection, protocol, operation, model || detected.model || ''))
+  target.search = incoming.search
+  if (protocol === 'gemini') target.searchParams.delete('key')
+  const selected = template !== undefined ? template : templateRef ? snapshot.templates.find(item => item.id === templateRef.id && item.revision === templateRef.revision) : resolveTemplate(snapshot, connection, protocol, model)
+  if (templateRef && !selected) throw err('指定模板版本不存在', 404)
+  const auth = await credential(connection, readAuth)
+  const scope = createHash('sha256').update(JSON.stringify([connection.baseURL, auth.mode, auth.key ?? '', auth.value ?? ''])).digest('hex')
+  const destination = target.href === incoming.href ? input : input instanceof Request ? new Request(target.href, input) : target.href
+  const transformed = await transformRequest({ template: selected, protocol, operation, input: destination, init,
+    context: { ...context, baseURL: connection.baseURL, credentialScope: scope, model: model || detected.model || '', requestId: context.requestId ?? randomUUID() } })
+  transformed.init = { ...transformed.init, headers: addAuthentication(transformed.init.headers, auth, protocol), redirect: 'manual' }
+  const result = { ...transformed, protocol, operation, model, generation: snapshot.generation, connectionId: connection.id }
+  Object.defineProperty(result, 'credentialValues', { value: [auth.key, auth.value].filter(Boolean), enumerable: false })
+  return result
+}
+
+export function createUATransport({ getSnapshot, getConnection, readAuth, fetchImpl = globalThis.fetch, getContext = () => ({}), observe = () => {} }) {
+  return async (input, init = {}) => {
+    const snapshot = await getSnapshot()
+    const connection = await getConnection(snapshot)
+    const prepared = await prepareUpstream({ snapshot, connection, input, init, context: await getContext(input, init), readAuth })
+    observe({ connectionId: connection.id, generation: snapshot.generation, templateId: prepared.summary?.templateId, revision: prepared.summary?.revision })
+    return fetchImpl(prepared.input, prepared.init)
+  }
+}
+
+export async function boundedResponse(response, { limit = 1024 * 1024, signal } = {}) {
+  if (Number(response.headers.get('content-length')) > limit) { await response.body?.cancel(); throw err('响应超过允许大小') }
+  const reader = response.body?.getReader()
+  if (!reader) return ''
+  let size = 0
+  const chunks = []
+  const stop = () => { void reader.cancel().catch(() => {}) }
+  signal?.addEventListener('abort', stop, { once: true })
+  try {
+    for (;;) {
+      signal?.throwIfAborted()
+      const { done, value } = await reader.read()
+      signal?.throwIfAborted()
+      if (done) break
+      size += value.byteLength
+      if (size > limit) throw err('响应超过允许大小')
+      chunks.push(Buffer.from(value))
+    }
+    return Buffer.concat(chunks).toString('utf8')
+  } finally {
+    signal?.removeEventListener('abort', stop)
+    stop()
+    reader.releaseLock()
+  }
+}
+
+export async function discoverUA(connection, options = {}) {
+  if (connection.models?.length) return connection.models.map(id => ({ id, name: id }))
+  return queryUAModels(connection, options)
+}
+
+export async function modelQueryScope(connection, readAuth) {
+  return (await prepareModelQuery(connection, readAuth)).scope
+}
+
+async function prepareModelQuery(connection, readAuth) {
+  const auth = await credential(connection, readAuth)
+  const protocol = protocolForModel(connection)
+  const headers = addAuthentication({ accept: 'application/json', 'anthropic-version': '2023-06-01' }, auth, protocol)
+  const url = apiBase(connection, protocol) + '/models'
+  // Scope the discovery record to the actual request, including the credential.
+  // Responses and auto may share a list only when URL and authentication agree.
+  const scope = createHash('sha256').update(JSON.stringify([url, [...headers], auth.source, auth.provider ?? '', auth.account ?? ''])).digest('hex')
+  return { url, headers, protocol, scope, secrets: [auth.key, auth.value].filter(Boolean) }
+}
+
+function catalogResult(entry) {
+  return { models: entry.models, count: entry.models.length, checkedAt: entry.checkedAt, source: `${entry.source}-cache`, cached: true, stale: true }
+}
+
+export async function readModelCatalog(connection, { catalog, readAuth } = {}) {
+  if (!catalog) return null
+  try {
+    const query = await prepareModelQuery(connection, readAuth)
+    const entry = await catalog.read(query.scope)
+    return entry ? catalogResult(entry) : null
+  } catch { return null }
+}
+
+function modelNetworkError(cause) {
+  const codes = []
+  for (let current = cause, depth = 0; current && depth < 4; current = current.cause, depth++) {
+    if (typeof current.code === 'string') codes.push(current.code)
+  }
+  const known = [
+    ['dns', ['ENOTFOUND', 'EAI_AGAIN', 'DNSLookupError'], '无法解析上游域名，请检查地址、DNS 或代理设置'],
+    ['connection-refused', ['ECONNREFUSED', 'ConnectionRefused'], '上游或代理拒绝连接，请检查服务地址和代理设置'],
+    ['connection-reset', ['ECONNRESET', 'EPIPE', 'ConnectionClosed', 'UND_ERR_SOCKET'], '上游或代理中断了连接，请检查网络和代理设置'],
+    ['timeout', ['ETIMEDOUT', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT'], '连接上游超时，请检查网络和代理设置'],
+    ['tls', ['CERT_HAS_EXPIRED', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'ERR_TLS_CERT_ALTNAME_INVALID', 'CERT_SIGNATURE_FAILURE'], '上游 TLS 证书验证失败，请检查证书或代理配置'],
+  ]
+  const [code, , message] = known.find(([, matches]) => codes.some(value => matches.includes(value))) ?? ['network', [], '无法连接上游，请检查网络或代理设置']
+  return Object.assign(err(message), { code, catalogFallback: true })
+}
+
+async function fetchModelList(query, fetchImpl, signal) {
+  let response
+  try { response = await fetchImpl(query.url, { method: 'GET', headers: query.headers, signal, redirect: 'manual' }) }
+  catch (error) { signal.throwIfAborted(); throw modelNetworkError(error) }
+  if (!response.ok) {
+    void response.body?.cancel().catch(() => {})
+    const error = Object.assign(err(`模型列表返回 HTTP ${response.status}`, response.status), { code: 'upstream-http', catalogFallback: response.status >= 500 })
+    if (response.status === 401) error.signIn = 'expired'
+    throw error
+  }
+  let text
+  try { text = await boundedResponse(response, { signal }) }
+  catch (error) { signal.throwIfAborted(); if (error.status) throw error; throw modelNetworkError(error) }
+  let data
+  try { data = JSON.parse(text) } catch { throw Object.assign(err('模型列表不是有效的 JSON'), { code: 'invalid-model-response' }) }
+  const list = query.protocol === 'gemini' && Array.isArray(data?.models)
+    ? data.models.map(item => ({ id: typeof item?.name === 'string' ? item.name.replace(/^models\//, '') : '', display_name: item?.displayName, limit: { context: item?.inputTokenLimit, output: item?.outputTokenLimit } }))
+    : data?.data
+  if (!Array.isArray(list)) throw Object.assign(err('模型列表格式无效'), { code: 'invalid-model-response' })
+  const models = new Map()
+  const safeText = (value, limit = 512) => typeof value === 'string' && value.trim() && value.trim().length <= limit && !/[\x00-\x1f\x7f-\x9f]/.test(value) && !query.secrets.some(secret => value.includes(secret))
+  for (const item of list) {
+    if (!safeText(item?.id, 256)) continue
+    const id = item.id.trim()
+    if (models.has(id)) continue
+    const name = item.display_name ?? item.name
+    models.set(id, { id, name: safeText(name) ? name.trim() : id, ...(item.limit && typeof item.limit === 'object' ? { limit: item.limit } : {}) })
+    if (models.size > 2048) throw Object.assign(err('模型列表超过 2048 个，请使用手填模型缩小范围'), { code: 'invalid-model-response' })
+  }
+  return [...models.values()]
+}
+
+export async function lookupUAModels(connection, { readAuth, fetchImpl = globalThis.fetch, modelFetchFor, signal = AbortSignal.timeout(15000), catalog, source = 'management', allowCached = false } = {}) {
+  signal.throwIfAborted()
+  const query = await prepareModelQuery(connection, readAuth)
+  let models
+  try {
+    const send = await modelFetchFor?.(query.scope) ?? fetchImpl
+    signal.throwIfAborted()
+    models = await fetchModelList(query, send, signal)
+    signal.throwIfAborted()
+  }
+  catch (error) {
+    const timedOut = signal.aborted && signal.reason?.name === 'TimeoutError'
+    if (signal.aborted && !timedOut) signal.throwIfAborted()
+    if (timedOut) error = Object.assign(err('模型列表读取超时，请检查网络和代理设置', 408), { code: 'timeout', catalogFallback: true })
+    if (allowCached && error.catalogFallback && catalog) {
+      const entry = await catalog.read(query.scope).catch(() => null)
+      if (signal.aborted && !timedOut) signal.throwIfAborted()
+      if (entry) return { ...catalogResult(entry), refreshError: { code: error.code, message: error.message } }
+    }
+    throw error
+  }
+  const checkedAt = new Date().toISOString()
+  let catalogWarning
+  if (catalog) {
+    try { await catalog.write(query.scope, { models: models.map(({ id, name }) => ({ id, name })), checkedAt, source }) }
+    catch { catalogWarning = '模型目录未能保存，其他管理会话暂时无法共享本次结果；请检查目录权限或缓存文件' }
+  }
+  return { models, count: models.length, checkedAt, source: 'upstream', cached: false, stale: false, ...(catalogWarning ? { catalogWarning } : {}) }
+}
+
+export async function queryUAModels(connection, options = {}) {
+  const result = await lookupUAModels(connection, { ...options, allowCached: false })
+  return result.models
+}

package/src/ua-service.mjs

@@ -0,0 +1,129 @@
+import { createHash } from 'node:crypto'
+import { createUATestRunner } from './ua-tests.mjs'
+import { validateTemplate } from './ua-transform.mjs'
+import { lookupUAModels, readModelCatalog, modelQueryScope } from './ua-runtime.mjs'
+import { createUAModelCatalog } from './ua-model-catalog.mjs'
+import { matchesAccountSite } from '../lib/ua-protocol.mjs'
+import { createKeyUsage } from './key-usage.mjs'
+
+const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex')
+const failure = (message, status = 400) => Object.assign(new Error(message), { status })
+
+export function createUAService({ store, legacyStore, accountManager, readAuth, fetchImpl, modelFetchFor, modelCatalog = createUAModelCatalog(store.path), onConnectionSaved, syncConnections, runtime = () => ({ mode: 'standalone', observed: [] }) }) {
+  const test = createUATestRunner({ store, readAuth, fetchImpl, modelFetchFor })
+  const initialized = () => store.initialize()
+  return {
+    async state() {
+      await initialized()
+      const snapshot = await store.snapshot({ secrets: true })
+      const modelCatalogs = {}
+      for (const connection of snapshot.connections) {
+        const entry = await readModelCatalog(connection, { catalog: modelCatalog, readAuth })
+        if (entry) modelCatalogs[connection.id] = entry
+        connection.auth.key = ''
+        connection.auth.value = ''
+      }
+      const siteAccounts = accountManager ? (await accountManager.list()).accounts.map(account => ({ id: account.id, name: account.name,
+        siteUrl: account.siteUrl, siteType: account.siteType ?? 'newapi', userId: account.userId, enabled: account.enabled,
+        checkinEnabled: account.checkinEnabled, schedule: account.schedule })) : []
+      return { ...snapshot, modelCatalogs, siteAccounts, runtime: await runtime(snapshot) }
+    },
+    async accountConnections() {
+      await initialized()
+      return (await store.snapshot()).connections.map(connection => ({ id: connection.id, name: connection.name, baseURL: connection.baseURL,
+        revision: connection.revision, enabled: connection.enabled, newApiAccountId: connection.newApiAccountId ?? '' }))
+    },
+    async execute(action, data, { signal } = {}) {
+      await initialized()
+      if (action === 'templates/validate') return { template: validateTemplate(data.template) }
+      if (action === 'templates/save') return store.saveTemplate(data)
+      if (action === 'templates/archive') return store.archiveTemplate(data)
+      if (action === 'templates/remove') return store.removeTemplate(data)
+      if (action === 'connections/usage') {
+        if (data.confirmNetwork !== true) throw failure('读取连接余额需要明确确认')
+        const snapshot = await store.snapshot({ secrets: true })
+        const connection = snapshot.connections.find(item => item.id === data.connectionId)
+        if (!connection || !connection.enabled) throw failure('连接不存在或已停用', 404)
+        const usageFetch = modelFetchFor ? modelFetchFor(await modelQueryScope(connection, readAuth)) : fetchImpl
+        const usage = await createKeyUsage({ fetchImpl: usageFetch, readAuth })(connection)
+        return { connectionId: connection.id, revision: connection.revision, usage, at: new Date().toISOString() }
+      }
+      if (action === 'connections/models') {
+        if (data.confirmNetwork !== true) throw failure('获取模型需要明确确认')
+        const connection = await store.prepareConnection(data)
+        const timeout = AbortSignal.timeout(15000)
+        const combined = signal ? AbortSignal.any([signal, timeout]) : timeout
+        try {
+          const result = await lookupUAModels(connection, { readAuth, fetchImpl, modelFetchFor, signal: combined, catalog: modelCatalog, source: 'management', allowCached: true })
+          signal?.throwIfAborted()
+          if (!result.cached) combined.throwIfAborted()
+          return { ...result, models: result.models.map(({ id, name }) => ({ id, name })), message: result.cached ? '刷新失败，显示此前发现的模型；连接尚未保存' : '模型列表已读取，连接尚未保存；未发送生成请求' }
+        } catch (error) {
+          if (combined.aborted) throw Object.assign(failure('获取模型已取消或超时，手填内容保留', 408), { code: signal?.aborted ? 'cancelled' : 'timeout' })
+          if (error.code === 'upstream-http') throw Object.assign(failure(`${error.message}，请检查地址、协议和凭据`), { code: error.code })
+          if ([400, 409].includes(error.status)) {
+            if (['dns', 'connection-refused', 'connection-reset', 'timeout', 'tls', 'network'].includes(error.code)) {
+              const route = (await runtime()).mode === 'host' ? '当前管理会话的代理可能与宿主账号代理不同。' : '独立工具不继承 Magpie 的账号代理；可从 Magpie 打开 UA PRO 管理后核对。'
+              error.message += `。${route}`
+            }
+            throw error
+          }
+          throw failure('模型列表读取未完成，请重新打开管理页后重试', 400)
+        }
+      }
+      if (action === 'connections/sync') {
+        if (!syncConnections) throw failure('独立工具不能直接写入 Magpie；请从宿主打开 UA PRO 管理后同步', 409)
+        return syncConnections()
+      }
+      if (action === 'connections/save') {
+        if (data.connection?.newApiAccountId) {
+          if (!accountManager) throw failure('站点账号管理尚未初始化', 409)
+          const account = await accountManager.get(data.connection.newApiAccountId)
+          if (!matchesAccountSite(data.connection.baseURL, account)) throw Object.assign(failure('余额与签到只能绑定同一站点的账号'), { fields: { newApiAccountId: '所选账号属于其他站点' } })
+        }
+        const result = await store.saveConnection(data)
+        if (onConnectionSaved) {
+          try {
+            const host = await onConnectionSaved(result.connection)
+            if (host?.status === 'reload-required') return { ...result, registration: 'pending-reload', activation: 'pending-reload', host, message: host.message }
+            if (host && host.status !== 'registered') return { ...result, registration: 'pending-reload', activation: 'pending-reload', host, message: host.message || '连接已保存，宿主账号尚未确认，请同步或重载后核对' }
+            return { ...result, registration: 'registered', activation: 'pending-runtime-observation', ...(host ? { host } : {}) }
+          } catch { return { ...result, registration: 'pending-reload', activation: 'pending-reload', message: '连接已保存，宿主注册未确认，请重载插件后核对' } }
+        }
+        return { ...result, registration: 'pending-host-load', activation: 'pending-runtime-observation' }
+      }
+      if (action === 'connections/remove') return store.removeConnection(data)
+      if (action === 'bindings/apply') return { ...await store.applyBinding(data), activation: 'pending-runtime-observation' }
+      if (action === 'routes/apply') return { ...await store.applyModelRoute(data), activation: 'pending-reload', message: '模型上游协议和模板已保存；请在 Magpie 重新获取模型或重载插件后使用' }
+      if (action === 'test') return { result: await test(data, { signal }) }
+      if (action === 'migration/preview') {
+        const profile = await legacyStore?.load()
+        if (!profile) return { available: false, message: '没有可迁移的独立 Claude 配置；原生账号继续使用兼容入口' }
+        return { available: true, fingerprint: digest(profile), connection: { name: '原 Claude 连接', baseURL: profile.upstream.baseUrl, models: profile.models, secrets: { key: Boolean(profile.upstream.apiKey), value: Boolean(profile.upstream.authorizationValue) } }, template: { name: '原 Claude 配置副本', basedOn: 'custom.claude-vscode-2316', parameters: profile.parameters }, message: '只复制为 UA PRO 新连接，不修改原配置或停用原供应商' }
+      }
+      if (action === 'migration/apply') {
+        if (typeof data.fingerprint !== 'string') throw failure('请先预览迁移')
+        const profile = await legacyStore?.load()
+        if (!profile || digest(profile) !== data.fingerprint) throw failure('旧配置已改变，请重新预览', 409)
+        const snapshot = await store.snapshot()
+        const id = `migration.${digest({ base: profile.upstream.baseUrl, key: profile.upstream.apiKey }).slice(0, 16)}`
+        if (snapshot.connections.some(connection => connection.id === id)) throw failure('此配置已经迁移，请在连接列表中核对', 409)
+        const baseline = structuredClone(snapshot.templates.find(item => item.id === 'custom.claude-vscode-2316' && item.revision === 1))
+        delete baseline.id
+        baseline.name = '原 Claude 配置副本'
+        baseline.kind = 'custom'
+        baseline.basedOn = { id: 'custom.claude-vscode-2316', revision: 1 }
+        baseline.body.parameters = structuredClone(profile.parameters)
+        const map = { userAgent: 'user-agent', anthropicVersion: 'anthropic-version', anthropicBeta: 'anthropic-beta', contentType: 'content-type' }
+        for (const [field, name] of Object.entries(map)) if (profile.headers[field]) baseline.headers.push({ name, action: 'set', value: profile.headers[field], enabled: true, when: 'always' })
+        for (const extra of profile.headers.extra) baseline.headers.push({ name: extra.name, action: extra.value === null ? 'delete' : 'set', ...(extra.value === null ? {} : { value: extra.value }), enabled: extra.enabled, when: 'always' })
+        const saved = await store.saveTemplate({ template: baseline })
+        return this.execute('connections/save', { connection: { id, name: '原 Claude 连接', enabled: true, baseURL: profile.upstream.baseUrl,
+          protocol: 'anthropic', models: profile.models, apiPaths: {}, modelProtocols: {}, siteId: '', independent: false,
+          auth: { source: 'stored', mode: profile.upstream.authorizationMode, key: profile.upstream.apiKey, value: profile.upstream.authorizationValue },
+          binding: { mode: 'template', id: saved.template.id, revision: saved.template.revision }, modelBindings: {} } })
+      }
+      throw failure('未知的 UA PRO 操作', 404)
+    },
+  }
+}