opencode-go-usage-tui 1.1.0 → 1.2.0

package/README.md

@@ -1,5 +1,11 @@
 # opencode-go-usage-tui
 
+<div align="center">
+
+🌏 **语言 / Language:** [简体中文](/README.md) | [English](/README_EN.md)
+
+</div>
+
 在 OpenCode 侧边栏实时显示 OpenCode Go 额度用量（5小时/每周/每月）。
 
 支持中英双语界面（`/go-lang` 切换，首次启动自动引导选择语言）。
@@ -47,7 +53,15 @@ npm install -g opencode-go-usage-tui
 1. **workspace_id**：`wrk_` 开头，在 opencode.ai 控制台 URL 中获取
 2. **auth cookie**：浏览器 F12 → Application → Cookies → opencode.ai → 复制 `auth` 的值（`Fe26.2*` 开头）
 
-配置保存在 `~/.config/opencode/go-usage-config.json`。
+配置保存在 `~/.config/opencode/`：
+
+- `go-usage-config.json` — workspace_id（明文，非敏感）
+- `go-auth-cookie.enc` — auth cookie（**AES-256-GCM 加密**）
+- `.encryption-key` — 加密密钥（32 字节随机生成）
+
+> 🔒 **安全说明**：cookie 以 AES-256-GCM 加密存储，密钥随机生成且独立保存，文件被备份/同步/日志收集不会泄露 cookie。旧版明文文件（`go-auth-cookie.txt` / config.json 内嵌 cookie）首次读取时**自动迁移**为加密存储并清理明文。
+>
+> ⚠️ 局限：密钥与密文同目录，能防御"被动泄露"（备份/同步），无法防御能读取该目录的本地恶意程序。如需更强保护可改用系统级凭据存储。
 
 ### 方式二：环境变量
 

package/README_EN.md

@@ -1,5 +1,11 @@
 # opencode-go-usage-tui
 
+<div align="center">
+
+🌏 **Language / 语言:** [English](/README_EN.md) | [简体中文](/README.md)
+
+</div>
+
 Display your OpenCode Go quota usage (5h / weekly / monthly) in the OpenCode sidebar in real time.
 
 Bilingual UI (Chinese / English) — switch with `/go-lang`, or pick a language during the first-run onboarding.
@@ -47,7 +53,15 @@ Enter two values (unique per user — get them by logging into opencode.ai):
 1. **workspace_id**: starts with `wrk_`, found in the opencode.ai console URL
 2. **auth cookie**: in your browser, F12 → Application → Cookies → opencode.ai → copy the `auth` value (starts with `Fe26.2*`)
 
-Config is saved to `~/.config/opencode/go-usage-config.json`.
+Config is saved to `~/.config/opencode/`:
+
+- `go-usage-config.json` — workspace_id (plain text, not sensitive)
+- `go-auth-cookie.enc` — auth cookie (**AES-256-GCM encrypted**)
+- `.encryption-key` — encryption key (random 32 bytes)
+
+> 🔒 **Security**: The cookie is stored encrypted with AES-256-GCM, with a randomly generated key stored separately — backups, syncs, and logs cannot leak the cookie. Legacy plaintext files (`go-auth-cookie.txt` / cookie embedded in config.json) are **auto-migrated** to encrypted storage on first read, and the plaintext is cleaned up.
+>
+> ⚠️ Limitation: The key lives in the same directory as the ciphertext. This defends against passive leaks (backups/sync) but not against local malware that can read your user directory. Use system credential storage (Windows DPAPI / macOS Keychain) for stronger protection.
 
 ### Option 2: Environment variables
 

package/build.tui.mjs

@@ -10,7 +10,7 @@ await esbuild.build({
   format: "esm",
   platform: "node",
   bundle: true,
-  external: ["@opencode-ai/*", "@opentui/*", "solid-js", "node:fs", "node:path"],
+  external: ["@opencode-ai/*", "@opentui/*", "solid-js", "node:fs", "node:path", "node:crypto"],
   plugins: [solidPlugin({ solid: { moduleName: "@opentui/solid", generate: "universal" } })],
   define: { __PLUGIN_VERSION__: JSON.stringify(pkg.version) },
   logLevel: "info",

package/dist/tui.js

@@ -9,8 +9,9 @@ import { insertNode as _$insertNode } from "@opentui/solid";
 import { insert as _$insert } from "@opentui/solid";
 import { createElement as _$createElement } from "@opentui/solid";
 import { createSignal, createEffect, onMount, onCleanup, Show } from "solid-js";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, renameSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 
 // src/i18n.ts
 var ZH_T = {
@@ -113,44 +114,140 @@ function detectLang() {
 }
 
 // src/index.tsx
-var VERSION = "1.1.0";
+var VERSION = "1.2.0";
 var CHECK_INTERVAL = Number(process?.env?.OPENCODE_GO_CHECK_INTERVAL ?? 6e4);
 var WARN_THRESHOLD = Number(process?.env?.OPENCODE_GO_WARN_THRESHOLD ?? 0.8);
 var CONFIG_DIR = process?.env?.OPENCODE_CONFIG_DIR || (process?.env?.USERPROFILE ? `${process.env.USERPROFILE}\\.config\\opencode` : "") || process?.env?.HOME + "/.config/opencode";
 var CONFIG_FILE = join(CONFIG_DIR, "go-usage-config.json");
+var COOKIE_ENC_FILE = join(CONFIG_DIR, "go-auth-cookie.enc");
+var KEY_FILE = join(CONFIG_DIR, ".encryption-key");
+var COOKIE_PLAIN_FILE = `${CONFIG_DIR}\\go-auth-cookie.txt`;
 var KV_PREFIX = "go-usage";
-function loadConfig() {
-  const env = process?.env ?? {};
-  let fileCfg = {};
+function loadEncryptionKey() {
+  try {
+    const hex2 = readFileSync(KEY_FILE, "utf8").trim();
+    if (hex2) return Buffer.from(hex2, "hex");
+  } catch {
+  }
+  const key = randomBytes(32);
+  mkdirSync(dirname(KEY_FILE), {
+    recursive: true
+  });
+  writeFileSync(KEY_FILE, key.toString("hex"), {
+    encoding: "utf8",
+    mode: 384
+  });
+  return key;
+}
+function encryptText(text) {
+  const key = loadEncryptionKey();
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const data = cipher.update(text, "utf8", "hex") + cipher.final("hex");
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("hex"),
+    data,
+    tag: cipher.getAuthTag().toString("hex")
+  });
+}
+function decryptText(encJson) {
+  const {
+    iv,
+    data,
+    tag
+  } = JSON.parse(encJson);
+  const key = loadEncryptionKey();
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+  decipher.setAuthTag(Buffer.from(tag, "hex"));
+  return decipher.update(data, "hex", "utf8") + decipher.final("utf8");
+}
+function readJsonFile(file) {
   try {
-    fileCfg = JSON.parse(readFileSync(CONFIG_FILE, "utf8"));
+    return JSON.parse(readFileSync(file, "utf8"));
   } catch {
-    fileCfg = {};
+    return null;
+  }
+}
+function loadConfig() {
+  const env = process?.env ?? {};
+  const fileCfg = readJsonFile(CONFIG_FILE) ?? {};
+  if (env.OPENCODE_GO_AUTH_COOKIE) {
+    return {
+      workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "",
+      authCookie: env.OPENCODE_GO_AUTH_COOKIE
+    };
   }
-  const cookieFile = env.OPENCODE_GO_COOKIE_FILE || fileCfg.cookie_file || `${CONFIG_DIR}\\go-auth-cookie.txt`;
-  let fileCookie = "";
   try {
-    let p = cookieFile;
-    if (p === "~") p = (env.HOME || env.USERPROFILE) + "";
-    else if (p.startsWith("~/")) p = (env.HOME || env.USERPROFILE || "") + p.slice(1);
-    fileCookie = readFileSync(p, "utf8").trim();
+    if (existsSync(COOKIE_ENC_FILE)) {
+      const cookie = decryptText(readFileSync(COOKIE_ENC_FILE, "utf8"));
+      if (cookie) {
+        return {
+          workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "",
+          authCookie: cookie
+        };
+      }
+    }
   } catch {
-    fileCookie = "";
+  }
+  const legacyCookie = fileCfg.auth_cookie || fileCfg.cookie || (() => {
+    try {
+      return readFileSync(COOKIE_PLAIN_FILE, "utf8").trim();
+    } catch {
+      return "";
+    }
+  })();
+  if (legacyCookie) {
+    const enc = encryptText(legacyCookie);
+    mkdirSync(CONFIG_DIR, {
+      recursive: true
+    });
+    writeFileSync(COOKIE_ENC_FILE, enc, "utf8");
+    const cleanCfg = {
+      ...fileCfg
+    };
+    delete cleanCfg.cookie;
+    delete cleanCfg.auth_cookie;
+    try {
+      writeFileSync(CONFIG_FILE, JSON.stringify(cleanCfg, null, 2), "utf8");
+    } catch {
+    }
+    try {
+      if (existsSync(COOKIE_PLAIN_FILE)) renameSync(COOKIE_PLAIN_FILE, COOKIE_PLAIN_FILE + ".bak");
+    } catch {
+    }
+    return {
+      workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "",
+      authCookie: legacyCookie
+    };
   }
   return {
     workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "",
-    authCookie: env.OPENCODE_GO_AUTH_COOKIE || fileCfg.auth_cookie || fileCfg.cookie || fileCookie
+    authCookie: ""
   };
 }
 function saveConfig(patch) {
-  let fileCfg = {};
-  try {
-    fileCfg = JSON.parse(readFileSync(CONFIG_FILE, "utf8"));
-  } catch {
-    fileCfg = {};
-  }
+  const fileCfg = readJsonFile(CONFIG_FILE) ?? {};
   if (patch.workspace_id !== void 0) fileCfg.workspace_id = patch.workspace_id;
-  if (patch.cookie !== void 0) fileCfg.cookie = patch.cookie;
+  if (patch.cookie !== void 0) {
+    if (patch.cookie) {
+      mkdirSync(CONFIG_DIR, {
+        recursive: true
+      });
+      writeFileSync(COOKIE_ENC_FILE, encryptText(patch.cookie), "utf8");
+      delete fileCfg.cookie;
+      delete fileCfg.auth_cookie;
+      try {
+        if (existsSync(COOKIE_PLAIN_FILE)) renameSync(COOKIE_PLAIN_FILE, COOKIE_PLAIN_FILE + ".bak");
+      } catch {
+      }
+    } else {
+      try {
+        if (existsSync(COOKIE_ENC_FILE)) renameSync(COOKIE_ENC_FILE, COOKIE_ENC_FILE + ".bak");
+      } catch {
+      }
+    }
+  }
   try {
     mkdirSync(dirname(CONFIG_FILE), {
       recursive: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-go-usage-tui",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "OpenCode TUI plugin displaying OpenCode Go usage in the sidebar",
   "type": "module",
   "exports": {

package/src/index.tsx

@@ -10,8 +10,9 @@ import type {
 } from "@opencode-ai/plugin/tui"
 import { createSignal, createEffect, onMount, onCleanup, Show } from "solid-js"
 import type { JSX } from "@opentui/solid"
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs"
+import { readFileSync, writeFileSync, mkdirSync, renameSync, existsSync } from "node:fs"
 import { join, dirname } from "node:path"
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
 import { createT, detectLang, LANG_META } from "./i18n"
 import type { LangCode } from "./i18n"
 
@@ -24,35 +25,104 @@ const CONFIG_DIR = process?.env?.OPENCODE_CONFIG_DIR
   || (process?.env?.USERPROFILE ? `${process.env.USERPROFILE}\\.config\\opencode` : "")
   || process?.env?.HOME + "/.config/opencode"
 const CONFIG_FILE = join(CONFIG_DIR, "go-usage-config.json")
+const COOKIE_ENC_FILE = join(CONFIG_DIR, "go-auth-cookie.enc")
+const KEY_FILE = join(CONFIG_DIR, ".encryption-key")
+const COOKIE_PLAIN_FILE = `${CONFIG_DIR}\\go-auth-cookie.txt`
 const KV_PREFIX = "go-usage"
 
+// ── AES-256-GCM 加密存储 ────────────────────────────────
+// cookie 以密文存 go-auth-cookie.enc，密钥存 .encryption-key。
+// 注意：Windows 无 Unix 权限位，mode 0o600 仅对 macOS/Linux 生效；
+// Windows 上密钥与密文同目录，防护重点是"被动泄露"（备份/云同步/日志），
+// 无法抵御能读取该目录的本地恶意程序。
+function loadEncryptionKey(): Buffer {
+  try {
+    const hex = readFileSync(KEY_FILE, "utf8").trim()
+    if (hex) return Buffer.from(hex, "hex")
+  } catch { /* 无密钥则新建 */ }
+  const key = randomBytes(32)
+  mkdirSync(dirname(KEY_FILE), { recursive: true })
+  writeFileSync(KEY_FILE, key.toString("hex"), { encoding: "utf8", mode: 0o600 })
+  return key
+}
+
+function encryptText(text: string): string {
+  const key = loadEncryptionKey()
+  const iv = randomBytes(16)
+  const cipher = createCipheriv("aes-256-gcm", key, iv)
+  const data = cipher.update(text, "utf8", "hex") + cipher.final("hex")
+  return JSON.stringify({ v: 1, iv: iv.toString("hex"), data, tag: cipher.getAuthTag().toString("hex") })
+}
+
+function decryptText(encJson: string): string {
+  const { iv, data, tag } = JSON.parse(encJson)
+  const key = loadEncryptionKey()
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"))
+  decipher.setAuthTag(Buffer.from(tag, "hex"))
+  return decipher.update(data, "hex", "utf8") + decipher.final("utf8")
+}
+
+function readJsonFile<T>(file: string): T | null {
+  try { return JSON.parse(readFileSync(file, "utf8")) as T } catch { return null }
+}
+
+interface ConfigFile { workspace_id?: string; cookie?: string; auth_cookie?: string; cookie_file?: string }
+
 function loadConfig(): { workspaceId: string; authCookie: string } {
   const env = process?.env ?? {}
-  let fileCfg: Record<string, string> = {}
-  try {
-    fileCfg = JSON.parse(readFileSync(CONFIG_FILE, "utf8"))
-  } catch { fileCfg = {} }
-  const cookieFile = env.OPENCODE_GO_COOKIE_FILE || fileCfg.cookie_file || `${CONFIG_DIR}\\go-auth-cookie.txt`
-  let fileCookie = ""
+  const fileCfg = readJsonFile<ConfigFile>(CONFIG_FILE) ?? {}
+
+  // 1. 环境变量优先
+  if (env.OPENCODE_GO_AUTH_COOKIE) {
+    return { workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "", authCookie: env.OPENCODE_GO_AUTH_COOKIE }
+  }
+
+  // 2. 加密存储
   try {
-    let p = cookieFile
-    if (p === "~") p = (env.HOME || env.USERPROFILE) + ""
-    else if (p.startsWith("~/")) p = (env.HOME || env.USERPROFILE || "") + p.slice(1)
-    fileCookie = readFileSync(p, "utf8").trim()
-  } catch { fileCookie = "" }
-  return {
-    workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "",
-    authCookie: env.OPENCODE_GO_AUTH_COOKIE || fileCfg.auth_cookie || fileCfg.cookie || fileCookie,
+    if (existsSync(COOKIE_ENC_FILE)) {
+      const cookie = decryptText(readFileSync(COOKIE_ENC_FILE, "utf8"))
+      if (cookie) {
+        return { workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "", authCookie: cookie }
+      }
+    }
+  } catch { /* 密文损坏时回退到明文迁移 */ }
+
+  // 3. 兼容旧明文（config.json 内嵌 cookie / auth_cookie / 独立 txt 文件）——自动迁移
+  const legacyCookie = fileCfg.auth_cookie || fileCfg.cookie || (() => {
+    try { return readFileSync(COOKIE_PLAIN_FILE, "utf8").trim() } catch { return "" }
+  })()
+  if (legacyCookie) {
+    const enc = encryptText(legacyCookie)
+    mkdirSync(CONFIG_DIR, { recursive: true })
+    writeFileSync(COOKIE_ENC_FILE, enc, "utf8")
+    // 清理旧明文
+    const cleanCfg: ConfigFile = { ...fileCfg }
+    delete cleanCfg.cookie
+    delete cleanCfg.auth_cookie
+    try { writeFileSync(CONFIG_FILE, JSON.stringify(cleanCfg, null, 2), "utf8") } catch { /* 忽略 */ }
+    try { if (existsSync(COOKIE_PLAIN_FILE)) renameSync(COOKIE_PLAIN_FILE, COOKIE_PLAIN_FILE + ".bak") } catch { /* 忽略 */ }
+    return { workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "", authCookie: legacyCookie }
   }
+
+  return { workspaceId: env.OPENCODE_GO_WORKSPACE_ID || fileCfg.workspace_id || "", authCookie: "" }
 }
 
 function saveConfig(patch: { workspace_id?: string; cookie?: string }): void {
-  let fileCfg: Record<string, string> = {}
-  try {
-    fileCfg = JSON.parse(readFileSync(CONFIG_FILE, "utf8"))
-  } catch { fileCfg = {} }
+  const fileCfg = readJsonFile<ConfigFile>(CONFIG_FILE) ?? {}
   if (patch.workspace_id !== undefined) fileCfg.workspace_id = patch.workspace_id
-  if (patch.cookie !== undefined) fileCfg.cookie = patch.cookie
+  if (patch.cookie !== undefined) {
+    // cookie 改为加密存储，不再写明文到 config.json
+    if (patch.cookie) {
+      mkdirSync(CONFIG_DIR, { recursive: true })
+      writeFileSync(COOKIE_ENC_FILE, encryptText(patch.cookie), "utf8")
+      delete fileCfg.cookie
+      delete fileCfg.auth_cookie
+      // 清理可能存在的旧明文 txt
+      try { if (existsSync(COOKIE_PLAIN_FILE)) renameSync(COOKIE_PLAIN_FILE, COOKIE_PLAIN_FILE + ".bak") } catch { /* 忽略 */ }
+    } else {
+      try { if (existsSync(COOKIE_ENC_FILE)) renameSync(COOKIE_ENC_FILE, COOKIE_ENC_FILE + ".bak") } catch { /* 忽略 */ }
+    }
+  }
   try {
     mkdirSync(dirname(CONFIG_FILE), { recursive: true })
     writeFileSync(CONFIG_FILE, JSON.stringify(fileCfg, null, 2), "utf8")