qwenproxy-cli 1.0.0

package/src/core/database.ts

@@ -0,0 +1,276 @@
+import Database from "better-sqlite3";
+import path from "path";
+import fs from "fs";
+import { encrypt, isEncrypted } from "./crypto-utils.ts";
+
+/**
+ * Several suites exercise account rotation by deleting every row and restoring
+ * it in a `finally`. Pointed at the real database that is one crashed test away
+ * from wiping the operator's configured accounts — which is exactly how a whole
+ * account set was lost once. Tests get their own file so the blast radius of a
+ * failed restore is a throwaway directory.
+ */
+import {
+  getDataDir,
+  getDbDir,
+  getDbPath,
+  isRunningUnderNodeTest,
+} from "./paths.ts";
+
+const DATA_DIR = getDataDir();
+const DB_DIR = getDbDir();
+const DB_PATH = getDbPath();
+const LEGACY_DB_PATH = path.join(DATA_DIR, "qwenproxy.db");
+const LEGACY_DB_IN_DIR_PATH = path.join(DB_DIR, "qwenproxy.db");
+const LEGACY_DB_WAL_PATH = `${LEGACY_DB_PATH}-wal`;
+const LEGACY_DB_SHM_PATH = `${LEGACY_DB_PATH}-shm`;
+const LEGACY_DB_IN_DIR_WAL_PATH = `${LEGACY_DB_IN_DIR_PATH}-wal`;
+const LEGACY_DB_IN_DIR_SHM_PATH = `${LEGACY_DB_IN_DIR_PATH}-shm`;
+const DB_WAL_PATH = `${DB_PATH}-wal`;
+const DB_SHM_PATH = `${DB_PATH}-shm`;
+const LEGACY_JSON_PATH = path.resolve("accounts.json");
+const LEGACY_JSON_BAK_PATH = path.resolve("accounts.json.bak");
+const DB_JSON_BAK_PATH = path.join(DB_DIR, "accounts.json.bak");
+
+let db: Database.Database | null = null;
+
+export function getDatabase(): Database.Database {
+  if (db) return db;
+
+  // Ensure data directory exists with proper permissions
+  try {
+    if (!fs.existsSync(DB_DIR)) {
+      fs.mkdirSync(DB_DIR, { recursive: true, mode: 0o755 });
+    }
+    const migrateLegacyDatabase = (
+      legacyPath: string,
+      legacyWalPath: string,
+      legacyShmPath: string,
+    ) => {
+      if (fs.existsSync(legacyPath) && !fs.existsSync(DB_PATH)) {
+        fs.renameSync(legacyPath, DB_PATH);
+        if (fs.existsSync(legacyWalPath) && !fs.existsSync(DB_WAL_PATH)) {
+          fs.renameSync(legacyWalPath, DB_WAL_PATH);
+        }
+        if (fs.existsSync(legacyShmPath) && !fs.existsSync(DB_SHM_PATH)) {
+          fs.renameSync(legacyShmPath, DB_SHM_PATH);
+        }
+        console.log(`📦 [Database] Migrated legacy database to ${DB_PATH}`);
+      }
+    };
+
+    migrateLegacyDatabase(
+      LEGACY_DB_PATH,
+      LEGACY_DB_WAL_PATH,
+      LEGACY_DB_SHM_PATH,
+    );
+    migrateLegacyDatabase(
+      LEGACY_DB_IN_DIR_PATH,
+      LEGACY_DB_IN_DIR_WAL_PATH,
+      LEGACY_DB_IN_DIR_SHM_PATH,
+    );
+    if (
+      fs.existsSync(LEGACY_JSON_BAK_PATH) &&
+      !fs.existsSync(DB_JSON_BAK_PATH)
+    ) {
+      fs.renameSync(LEGACY_JSON_BAK_PATH, DB_JSON_BAK_PATH);
+    }
+    // Test write access
+    const testFile = path.join(DB_DIR, ".write-test");
+    fs.writeFileSync(testFile, "");
+    fs.unlinkSync(testFile);
+  } catch (err: any) {
+    console.error(
+      `❌ [Database] Cannot access database directory '${DB_DIR}':`,
+      err.message,
+    );
+    console.error(
+      "❌ [Database] Ensure the directory exists and has proper permissions",
+    );
+    console.error(
+      "❌ [Database] In Docker, mount a volume: -v ./data:/app/data",
+    );
+    throw new Error(`Database directory not accessible: ${DB_DIR}`);
+  }
+
+  try {
+    db = new Database(DB_PATH);
+  } catch (err: any) {
+    console.error(
+      `❌ [Database] Failed to open database at '${DB_PATH}':`,
+      err.message,
+    );
+    console.error("❌ [Database] Check file permissions and disk space");
+    throw err;
+  }
+
+  // Enable WAL mode for better concurrent read performance (ideal for VPS)
+  db.pragma("journal_mode = WAL");
+  db.pragma("busy_timeout = 5000");
+  db.pragma("synchronous = NORMAL");
+  db.pragma("cache_size = -64000"); // 64MB cache
+  db.pragma("foreign_keys = ON");
+
+  runMigrations(db);
+  migrateFromJson(db);
+  encryptPlaintextPasswords(db);
+
+  return db;
+}
+
+function runMigrations(db: Database.Database): void {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS accounts (
+      id TEXT PRIMARY KEY,
+      email TEXT UNIQUE NOT NULL,
+      password TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
+
+    -- Cooldown persistence columns (ignore if already exist)
+    -- Note: SQLite doesn't support IF NOT EXISTS for ALTER TABLE ADD COLUMN,
+    -- so these are wrapped in try-catch at the application level.
+
+    CREATE TABLE IF NOT EXISTS qwen_auth_sessions (
+      account_id TEXT PRIMARY KEY,
+      cookie TEXT NOT NULL,
+      user_agent TEXT NOT NULL,
+      bx_v TEXT,
+      bx_ua TEXT,
+      bx_umidtoken TEXT,
+      user_id TEXT,
+      token_expires_at INTEGER,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_qwen_auth_sessions_expires
+      ON qwen_auth_sessions(token_expires_at);
+
+    CREATE TABLE IF NOT EXISTS logical_thread_states (
+      session_id TEXT PRIMARY KEY,
+      account_id TEXT NOT NULL,
+      chat_session_id TEXT NOT NULL,
+      parent_id TEXT,
+      instructions_sent INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_thread_updated ON logical_thread_states(updated_at);
+
+    CREATE TABLE IF NOT EXISTS personalization_cache (
+      account_id TEXT PRIMARY KEY,
+      instruction_hash TEXT NOT NULL,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+
+  // Cooldown persistence columns — wrapped in try-catch because
+  // SQLite doesn't support IF NOT EXISTS for ALTER TABLE ADD COLUMN.
+  try {
+    db.exec(
+      `ALTER TABLE accounts ADD COLUMN cooldown_until INTEGER DEFAULT 0;`,
+    );
+  } catch (err) {
+    if (!isDuplicateColumnError(err)) throw err;
+  }
+  try {
+    db.exec(`ALTER TABLE accounts ADD COLUMN cooldown_reason TEXT;`);
+  } catch (err) {
+    if (!isDuplicateColumnError(err)) throw err;
+  }
+}
+
+function isDuplicateColumnError(err: unknown): boolean {
+  return err instanceof Error && err.message.includes("duplicate column name");
+}
+
+function encryptPlaintextPasswords(db: Database.Database): void {
+  const rows = db.prepare("SELECT id, password FROM accounts").all() as Array<{
+    id: string;
+    password: string;
+  }>;
+  const update = db.prepare(
+    "UPDATE accounts SET password = ?, updated_at = datetime('now') WHERE id = ?",
+  );
+  let migrated = 0;
+
+  const migrate = db.transaction(() => {
+    for (const row of rows) {
+      if (row.password && !isEncrypted(row.password)) {
+        update.run(encrypt(row.password), row.id);
+        migrated++;
+      }
+    }
+  });
+
+  migrate();
+
+  if (migrated > 0) {
+    console.log(
+      `[Database] Encrypted ${migrated} plaintext password(s) in database`,
+    );
+  }
+}
+
+/**
+ * Auto-migrate existing accounts.json into SQLite on first run.
+ * The legacy JSON file is moved to data/db/accounts.json.bak after successful migration.
+ */
+function migrateFromJson(db: Database.Database): void {
+  const jsonPath = LEGACY_JSON_PATH;
+  if (!fs.existsSync(jsonPath)) return;
+
+  try {
+    const raw = fs.readFileSync(jsonPath, "utf-8");
+    const accounts = JSON.parse(raw) as Array<{
+      id: string;
+      email: string;
+      password: string;
+    }>;
+
+    if (!Array.isArray(accounts) || accounts.length === 0) {
+      // Empty or invalid file — just rename it
+      fs.renameSync(jsonPath, DB_JSON_BAK_PATH);
+      return;
+    }
+
+    const insert = db.prepare(`
+      INSERT OR IGNORE INTO accounts (id, email, password) VALUES (?, ?, ?)
+    `);
+
+    const migrate = db.transaction(() => {
+      for (const account of accounts) {
+        if (
+          account.id &&
+          typeof account.email === "string" &&
+          account.email.trim().length > 0
+        ) {
+          insert.run(account.id, account.email.trim(), account.password || "");
+        }
+      }
+    });
+
+    migrate();
+
+    // Rename old file to .bak to avoid re-migration
+    fs.renameSync(jsonPath, DB_JSON_BAK_PATH);
+    console.log(
+      `[Database] Migrated ${accounts.length} account(s) from accounts.json to SQLite`,
+    );
+  } catch (err: any) {
+    console.error(
+      "❌ [Database] Failed to migrate accounts.json:",
+      err.message,
+    );
+  }
+}
+
+export function closeDatabase(): void {
+  if (db) {
+    db.close();
+    db = null;
+  }
+}

package/src/core/errors.ts

@@ -0,0 +1,118 @@
+/**
+ * Valid HTTP status codes for operational errors.
+ */
+export type QwenProxyStatusCode =
+  | 400
+  | 401
+  | 403
+  | 404
+  | 429
+  | 499
+  | 500
+  | 502
+  | 503
+  | 504;
+
+/**
+ * Base class for all QwenProxy operational errors.
+ * Provides OpenAI-compatible error formatting.
+ */
+export abstract class QwenProxyError extends Error {
+  abstract readonly statusCode: QwenProxyStatusCode;
+  abstract readonly type: string;
+  abstract readonly code: string;
+  param?: string;
+
+  constructor(message: string) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+
+  toOpenAI() {
+    return {
+      error: {
+        message: this.message,
+        type: this.type,
+        code: this.code,
+        param: this.param,
+      },
+    };
+  }
+}
+
+export class ValidationError extends QwenProxyError {
+  readonly statusCode = 400;
+  readonly type = "invalid_request_error";
+  readonly code: string = "bad_request";
+}
+
+/** Input exceeds the local safe budget before it reaches the Qwen web API. */
+export class ContextLengthExceededError extends ValidationError {
+  readonly code = "context_length_exceeded";
+
+  constructor(message: string, param = "messages") {
+    super(message);
+    this.param = param;
+  }
+}
+
+export class AuthError extends QwenProxyError {
+  readonly statusCode = 401;
+  readonly type = "authentication_error";
+  readonly code = "invalid_api_key";
+}
+
+export class ForbiddenError extends QwenProxyError {
+  readonly statusCode = 403;
+  readonly type = "permission_error";
+  readonly code = "insufficient_quota";
+}
+
+export class NotFoundError extends QwenProxyError {
+  readonly statusCode = 404;
+  readonly type = "not_found_error";
+  readonly code = "resource_not_found";
+}
+
+export class UpstreamRateLimit extends QwenProxyError {
+  readonly statusCode = 429;
+  readonly type = "rate_limit_error";
+  readonly code = "rate_limit_exceeded";
+}
+
+export class UpstreamError extends QwenProxyError {
+  readonly statusCode = 502;
+  readonly type = "upstream_error";
+  readonly code = "upstream_unavailable";
+}
+
+export class UpstreamTimeout extends QwenProxyError {
+  readonly statusCode = 504;
+  readonly type = "timeout_error";
+  readonly code = "upstream_timeout";
+}
+
+export class InternalError extends QwenProxyError {
+  readonly statusCode = 500;
+  readonly type = "internal_error";
+  readonly code = "internal_server_error";
+}
+
+/**
+ * The client disconnected (or a same-session retry superseded the request)
+ * before the upstream stream could be created. There is no listener left to
+ * receive an error body, so this must NOT be surfaced as a 500: it is neither
+ * a server fault nor an upstream failure. HTTP 499 (Client Closed Request)
+ * keeps the semantics without polluting error metrics.
+ */
+export class ClientAbortedError extends QwenProxyError {
+  readonly statusCode = 499 as QwenProxyStatusCode;
+  readonly type = "request_aborted";
+  readonly code = "client_aborted";
+}
+
+export class ServiceUnavailable extends QwenProxyError {
+  readonly statusCode = 503;
+  readonly type = "service_unavailable";
+  readonly code = "service_degraded";
+}

package/src/core/logger.ts

@@ -0,0 +1,269 @@
+import "dotenv/config";
+
+/**
+ * Mask an email address for safe logging.
+ * "user@example.com" → "user@***"
+ */
+export function maskEmail(email: string | undefined | null): string {
+  if (!email) return "<unknown>";
+  const atIndex = email.indexOf("@");
+  if (atIndex <= 0) return "<invalid>";
+  return email.substring(0, atIndex);
+}
+
+// ─── Log sanitization ───────────────────────────────────────────────────────────
+// Log entries carry raw upstream payloads (headers, cookies, JWT-backed
+// sessions, malformed tool-call dumps). Redact known credential keys and any
+// loose JWT/API-key shaped string before the entry hits the console, even when
+// the value appears nested inside a bigger object or a quoted JSON dump.
+
+const SENSITIVE_KEY_PATTERN =
+  /^(authorization|auth|cookie|cookies|set-cookie|api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|token|password|passwd|secret|x5sec|x5secdata|bx-ua|bx-v|bx-umidtoken)$/i;
+
+/** WAF cookie names come in many variants: x5sec, x5sec_v3, x5sec-cn, bx-temp... */
+const WAF_KEY_PREFIX_PATTERN = /^(x5sec|bx[-_])/i;
+
+/** JWT (3 base64url segments) or OpenAI-style `sk-` API key. */
+const LOOSE_SECRET_PATTERN =
+  /(eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{20,})/g;
+
+/** Credentials embedded in free-form strings: header lines, cookie jars, URLs. */
+const EMBEDDED_SECRET_PATTERN =
+  /((?:x5sec(?:data|_[a-z0-9]+|-[a-z0-9]+)?|bx[-_][a-z0-9_-]+)\s*=\s*[^;\s"']+)|(\bBearer\s+[A-Za-z0-9._~+\/=-]+)/gi;
+
+function isPassthroughObject(value: object): boolean {
+  return (
+    value instanceof Date ||
+    value instanceof RegExp ||
+    value instanceof Error ||
+    value instanceof Map ||
+    value instanceof Set ||
+    value instanceof ArrayBuffer ||
+    ArrayBuffer.isView(value)
+  );
+}
+
+function redactLogValue(value: unknown): unknown {
+  if (typeof value === "string") {
+    return value
+      .replace(LOOSE_SECRET_PATTERN, "[REDACTED]")
+      .replace(EMBEDDED_SECRET_PATTERN, "[REDACTED]");
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactLogValue(item));
+  }
+  if (value !== null && typeof value === "object" && !isPassthroughObject(value)) {
+    // Recurse into own enumerable props of BOTH plain objects and class
+    // instances (sessions, response wrappers) — JSON.stringify serializes
+    // those the same way, so redacting them loses nothing.
+    const out: Record<string, unknown> = {};
+    for (const [key, val] of Object.entries(value)) {
+      out[key] =
+        SENSITIVE_KEY_PATTERN.test(key) || WAF_KEY_PREFIX_PATTERN.test(key)
+          ? "[REDACTED]"
+          : redactLogValue(val);
+    }
+    return out;
+  }
+  return value;
+}
+
+function redactLogMessage(message: string): string {
+  return message
+    .replace(LOOSE_SECRET_PATTERN, "[REDACTED]")
+    .replace(EMBEDDED_SECRET_PATTERN, "[REDACTED]");
+}
+
+export type LogLevel = "debug" | "info" | "warn" | "error";
+
+const LEVEL_RANK: Record<LogLevel, number> = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+};
+
+/**
+ * Data/hora BR local (sem ms) usado APENAS no campo `until=` das linhas de
+ * cooldown/quota — informação de negócio, não um carimbo de log.
+ */
+export function formatCooldownUntil(date: Date): string {
+  const pad = (n: number): string => String(n).padStart(2, "0");
+  return `${pad(date.getDate())}/${pad(date.getMonth() + 1)}/${date.getFullYear()} ${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
+}
+
+/**
+ * TOOLCALL_DEBUG levels:
+ *   "0" or undefined = disabled
+ *   "1" = full debug (all toolcall logs)
+ *   "errors" = only on errors (log toolcall details when parser/execution fails)
+ *
+ * UPSTREAM_DEBUG:
+ *   "true" = log raw SSE chunks received from Qwen
+ */
+export type ToolcallDebugLevel = "0" | "1" | "errors";
+
+export interface LogEntry {
+  timestamp: Date;
+  level: LogLevel;
+  message: string;
+  context?: string;
+  data?: Record<string, unknown>;
+}
+
+export class Logger {
+  private minLevel: LogLevel;
+  private context?: string;
+
+  constructor(level: LogLevel = "warn", context?: string) {
+    this.minLevel = level;
+    this.context = context;
+  }
+
+  private shouldLog(level: LogLevel): boolean {
+    return LEVEL_RANK[level] >= LEVEL_RANK[this.minLevel];
+  }
+
+  /** Cheap level check so callers can skip building expensive log payloads. */
+  isLevelEnabled(level: LogLevel): boolean {
+    return this.shouldLog(level);
+  }
+
+  private formatEntry(entry: LogEntry): string {
+    const pad = (str: string): string => str.padStart(5, " ");
+    const colorCode =
+      entry.level === "error"
+        ? "\x1b[31m"
+        : entry.level === "warn"
+          ? "\x1b[33m"
+          : entry.level === "debug"
+            ? "\x1b[36m"
+            : "";
+    const reset = "\x1b[0m";
+
+    const coloredLevel = colorCode + pad(entry.level.toUpperCase()) + reset;
+    const contextPart = entry.context ? ` [${entry.context}]` : "";
+
+    // Redact credentials from BOTH the message (payload previews often embed
+    // cookies/JWTs) and the structured data.
+    const safeMessage = redactLogMessage(entry.message);
+    const safeData = entry.data ? redactLogValue(entry.data) : undefined;
+
+    let output = `${coloredLevel}${contextPart} ${safeMessage}`;
+
+    if (safeData !== undefined) {
+      output += "\n" + JSON.stringify(safeData, null, 2);
+    }
+
+    return output;
+  }
+
+  debug(message: string, data?: Record<string, unknown>): void {
+    if (this.shouldLog("debug")) {
+      console.log(
+        this.formatEntry({
+          timestamp: new Date(),
+          level: "debug",
+          message: this.context ? `[${this.context}] ${message}` : message,
+          data,
+        }),
+      );
+    }
+  }
+
+  info(message: string, data?: Record<string, unknown>): void {
+    if (this.shouldLog("info")) {
+      console.log(
+        this.formatEntry({
+          timestamp: new Date(),
+          level: "info",
+          message: this.context ? `[${this.context}] ${message}` : message,
+          data,
+        }),
+      );
+    }
+  }
+
+  warn(message: string, data?: Record<string, unknown>): void {
+    if (this.shouldLog("warn")) {
+      console.warn(
+        this.formatEntry({
+          timestamp: new Date(),
+          level: "warn",
+          message: this.context ? `[${this.context}] ${message}` : message,
+          data,
+        }),
+      );
+    }
+  }
+
+  error(message: string, data?: Record<string, unknown>): void {
+    if (this.shouldLog("error")) {
+      console.error(
+        this.formatEntry({
+          timestamp: new Date(),
+          level: "error",
+          message: this.context ? `[${this.context}] ${message}` : message,
+          data,
+        }),
+      );
+    }
+  }
+}
+
+// Determine initial log level from environment
+const envLevel = process.env.LOG_LEVEL as LogLevel | undefined;
+const toolcallDebugEnv = process.env.TOOLCALL_DEBUG || "errors";
+
+export const toolcallDebugLevel: ToolcallDebugLevel =
+  toolcallDebugEnv === "1"
+    ? "1"
+    : toolcallDebugEnv === "errors"
+      ? "errors"
+      : "0";
+
+const initialLevel: LogLevel =
+  toolcallDebugLevel === "1"
+    ? "debug"
+    : envLevel && ["debug", "info", "warn", "error"].includes(envLevel)
+      ? envLevel
+      // Default for general users: quiet terminal with only warnings/errors
+      // (+ the always-on request/account console lines). Debugging opt-in via
+      // LOG_LEVEL=debug / TOOLCALL_DEBUG=1.
+      : "warn";
+
+export const logger = new Logger(initialLevel);
+
+export function isDebugEnabled(): boolean {
+  return logger.isLevelEnabled("debug");
+}
+
+// Helper to check if toolcall debug is enabled
+export function isToolcallDebugEnabled(): boolean {
+  return toolcallDebugLevel === "1";
+}
+
+export function isToolcallErrorDebugEnabled(): boolean {
+  return toolcallDebugLevel === "1" || toolcallDebugLevel === "errors";
+}
+
+export const upstreamDebugEnabled = process.env.UPSTREAM_DEBUG === "true";
+
+// Confirm debug mode on startup (only log if explicitly set)
+if (process.env.TOOLCALL_DEBUG) {
+  if (toolcallDebugLevel === "1") {
+    console.log("🔍 [Logger] TOOLCALL_DEBUG=1 - full debug logs active");
+  } else if (toolcallDebugLevel === "errors") {
+    console.log(
+      "[Logger] TOOLCALL_DEBUG=errors - toolcall logs on errors only",
+    );
+  } else {
+    console.log("🔇 [Logger] TOOLCALL_DEBUG=0 - toolcall logs disabled");
+  }
+}
+
+if (upstreamDebugEnabled) {
+  console.log(
+    "[Logger] UPSTREAM_DEBUG=true - raw upstream chunks logging active",
+  );
+}