specific-ai-cli 0.0.0-stage → 0.1.1

package/static/xhs/xhs_core/js/sign.js

@@ -0,0 +1,225 @@
+/**
+ * XHS Web 共用签名算法入口：mns.js + xs_common.js。
+ * Creator 0101 可显式传入服务端 DS 程序，在隔离 VM 中调用其 _dsf；
+ * 其余签名路径不依赖浏览器宿主。
+ * seccore_signv2 兼容版：内部对 (url + JSON.stringify(data)) 求 md5 作为 u 与 md5(url) 作为 p，
+ * 与浏览器 window.mnsv2 完全一致（逐字节对齐）。
+ *
+ * CLI: node sign.js @input.json    ({api,data,cookie,version?,now?,seq?,tier?})
+ */
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const vm = require('vm');
+const { signTier, hexToBytes } = require('./mns.js');
+const { xsCommon } = require('./xs_common.js');
+
+const ALPHABET_XS = 'ZmserbBoHQtNP+wOcza/LpngG8yJq42KWYj0DSfdikx3VT16IlUAFM97hECvuRX5';
+function encodeUtf8(e) {
+  const r = encodeURIComponent(e), a = [];
+  for (let i = 0; i < r.length; i++) { const c = r.charAt(i); if (c === '%') { a.push(parseInt(r.charAt(i + 1) + r.charAt(i + 2), 16)); i += 2; } else a.push(c.charCodeAt(0)); }
+  return a;
+}
+function b64XS(e) {
+  const a = e.length, c = a % 3, d = []; let u = 0; const l = a - c, s = 16383;
+  for (u = 0; u < l; u += s) { const end = u + s > l ? l : u + s; for (let k = u; k < end; k += 3) { const t = (e[k] << 16) + ((k + 1 < end ? e[k + 1] : 0) << 8) + (k + 2 < end ? e[k + 2] : 0); d.push(ALPHABET_XS[(t >> 18) & 63], ALPHABET_XS[(t >> 12) & 63], ALPHABET_XS[(t >> 6) & 63], ALPHABET_XS[t & 63]); } }
+  if (c === 1) { const t = e[a - 1]; d.push(ALPHABET_XS[t >> 2] + ALPHABET_XS[(t << 4) & 63] + '=='); }
+  else if (c === 2) { const t = (e[a - 2] << 8) + e[a - 1]; d.push(ALPHABET_XS[t >> 10] + ALPHABET_XS[(t >> 4) & 63] + ALPHABET_XS[(t << 2) & 63] + '='); }
+  return d.join('');
+}
+
+function parseWebSsk(value, appId) {
+  let storage = value;
+  if (typeof storage === 'string') {
+    if (!storage) return null;
+    try { storage = JSON.parse(storage); } catch (_) { return null; }
+  }
+  if (!storage || typeof storage !== 'object') return null;
+  const encoded = storage[appId];
+  if (typeof encoded !== 'string' || !encoded) return null;
+  const raw = Buffer.from(encoded, 'base64');
+  return raw.length >= 32 ? raw : null;
+}
+
+function buildEncSskSign(md5FullBytes, webSsk, appId, options = {}) {
+  const secret = parseWebSsk(webSsk, appId);
+  if (!secret) return null;
+  const nonce = Buffer.allocUnsafe(4);
+  const randomValue = options.sskRandom != null
+    ? (Number(options.sskRandom) >>> 0)
+    : crypto.randomBytes(4).readUInt32LE(0);
+  const timestamp = options.sskTimestamp != null
+    ? (Number(options.sskTimestamp) >>> 0)
+    : (Date.now() >>> 0);
+  nonce.writeUInt32LE((timestamp + randomValue) >>> 0, 0);
+  const digest = crypto.createHash('sha1').update(Buffer.concat([secret, nonce])).digest();
+  const encSsk = Buffer.concat([nonce, digest, secret.subarray(32)]);
+  const encSskSign = crypto.createHash('sha1')
+    .update(Buffer.concat([Buffer.from(md5FullBytes), encSsk]))
+    .digest('base64');
+  return {
+    encSskSign: { [appId]: encSskSign },
+    encSsk: { [appId]: encSsk.toString('base64') },
+  };
+}
+
+function encodeXs(x3, x4Value, options = {}) {
+  // Browser's seccore_signv2 always sets x4 = (data ? typeof data : '')
+  // For empty data (GET), x4 = ''; for object data, x4 = 'object'; for string data, x4 = 'string'
+  const signObj = {
+    x0: String(options.signVersion || '4.4.3'),
+    x1: String(options.appId || 'xhs-pc-web'),
+    x2: String(options.platform || 'Windows'),
+    x3,
+    x4: x4Value,
+  };
+  // Current PC envelopes append x5 and, after webSsk activation, x6/x7.
+  // Creator 4.3.6 envelopes stop at x4.
+  if (options.x5 != null) signObj.x5 = String(options.x5);
+  if (options.x6 != null) signObj.x6 = options.x6;
+  if (options.x7 != null) signObj.x7 = options.x7;
+  return 'XYS_' + b64XS(encodeUtf8(JSON.stringify(signObj)));
+}
+
+function runDsfProgram(program, inputBytes, timeoutMs = 10000) {
+  const source = String(program || '');
+  if (!source || (!source.includes('__$c') && !source.includes('_dsf'))) {
+    throw new Error('Creator DS program is missing or invalid');
+  }
+  const sandbox = {};
+  sandbox.global = sandbox;
+  vm.runInNewContext(source, sandbox, { timeout: Number(timeoutMs) });
+  if (typeof sandbox._dsf !== 'function') {
+    throw new Error('Creator DS program did not export _dsf');
+  }
+  const output = Array.from(sandbox._dsf(null, Array.from(inputBytes || [])) || []);
+  if (
+    output.length !== 16
+    || output.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)
+  ) {
+    throw new Error('Creator _dsf output must be 16 bytes');
+  }
+  return output;
+}
+
+function signFull(input) {
+  input = input || {};
+  // 生产模式：cookie 必须从 CLI 传入；不再读磁盘兜底
+  if (!input.cookie) throw new Error('cookie required (must be passed via CLI JSON)');
+  const cookie = input.cookie;
+  const cookieMap = Object.fromEntries(cookie.split(/;\s*/).map((part) => {
+    const offset = part.indexOf('=');
+    return offset < 0 ? [part, ''] : [part.slice(0, offset), part.slice(offset + 1)];
+  }));
+  const a1 = (cookie.match(/a1=([^;]*)/) || [])[1] || '';
+  if (!a1) throw new Error('cookie a1 required');
+  const now = input.now != null ? Number(input.now) : Date.now();
+  const version = input.version != null ? (input.version >>> 0) : (Math.floor(Math.random() * 0x100000000) >>> 0);
+  const loadts = input.loadts != null ? Number(input.loadts) : Number(cookieMap.loadts);
+  if (!Number.isFinite(loadts)) throw new Error('loadts required (input.loadts or cookie loadts)');
+  if (input.seq == null) throw new Error('seq required from PcDeviceProfile session state');
+  if (input.envConst == null) throw new Error('envConst required from PcDeviceProfile stage state');
+  if (!Array.isArray(input.envFpTail) || input.envFpTail.length !== 14) {
+    throw new Error('envFpTail required from PcDeviceProfile stage state (14 bytes)');
+  }
+  // seccore_signv2 receives `data` as JS object or string (not stringified for u calc)
+  // c = url + JSON.stringify(data) for objects, or url + data for strings
+  const dataIn = input.data;
+  const dataStr = dataIn == null ? '' : (typeof dataIn === 'object' ? JSON.stringify(dataIn) : String(dataIn));
+  const c = String(input.api) + dataStr;
+  // x4 label per browser: object data → 'object', string data (non-empty) → 'string', else ''
+  const x4Label = dataIn == null || dataIn === '' ? '' : (typeof dataIn === 'object' ? 'object' : 'string');
+  const md5Full = hexToBytes(crypto.createHash('md5').update(c).digest('hex'));
+  const md5Url = hexToBytes(crypto.createHash('md5').update(String(input.api)).digest('hex'));
+  const fullLen = Buffer.byteLength(c, 'utf8');
+  const tier = input.tier || '0301';
+  const deviceTag = String(input.deviceTag || input.dsn || 'a3');
+  let dsSigBytes = input.dsSigBytes;
+  // Creator's Python adapter historically called this context field
+  // ``dsProgram`` while the standalone signer used ``dsfProgram``.  Accept
+  // both spellings so the server-issued _dsf program is actually executed
+  // for mns0101/a1 requests instead of silently falling back to the static
+  // placeholder hash.
+  const dsfProgram = input.dsfProgram || input.dsProgram;
+  if (deviceTag !== 'nop' && !dsSigBytes && dsfProgram) {
+    const dsfInput = [];
+    let timestamp = BigInt(now);
+    for (let index = 0; index < 8; index++) {
+      dsfInput.push(Number(timestamp & 255n));
+      timestamp >>= 8n;
+    }
+    dsfInput.push(...md5Url);
+    dsSigBytes = runDsfProgram(dsfProgram, dsfInput, input.dsfTimeoutMs);
+  }
+  const x3 = signTier({
+    api: input.api,
+    data: dataStr,
+    a1,
+    appId: String(input.appId || 'xhs-pc-web'),
+    deviceTag,
+    dsSigBytes,
+    version,
+    ts: now,
+    loadts,
+    seq: input.seq,
+    envConst: input.envConst,
+    envFpTail: input.envFpTail,
+    md5FullBytes: md5Full,
+    md5UrlBytes: md5Url,
+    fullLen,
+  }, tier);
+  const xsOptions = { ...input };
+  const appId = String(input.appId || 'xhs-pc-web');
+  if (appId === 'xhs-pc-web') {
+    xsOptions.x5 = Buffer.from(md5Full).toString('hex');
+    const ssk = buildEncSskSign(md5Full, input.webSsk, appId, input);
+    if (ssk) {
+      xsOptions.x6 = ssk.encSskSign;
+      xsOptions.x7 = ssk.encSsk;
+    } else {
+      delete xsOptions.x6;
+      delete xsOptions.x7;
+    }
+  } else {
+    delete xsOptions.x5;
+    delete xsOptions.x6;
+    delete xsOptions.x7;
+  }
+  const xs = encodeXs(x3, x4Label, xsOptions);
+  // Browser builds MNS first, then samples Date.now() again for X-t.
+  const xt = input.xt != null ? String(input.xt) : String(Date.now());
+  const out = { x3, xs, xt, len: x3.length, prefix: x3.slice(0, 12), tier, pure: true };
+  // X-S-Common 纯算（需 b1 + dslPair）
+  const b1 = input.b1 == null ? '' : String(input.b1);
+  const dslPairRaw = input.dslPair == null ? input.dsl_pair : input.dslPair;
+  const dslPair = dslPairRaw == null ? '' : String(dslPairRaw);
+  if (dslPair) {
+    const webBuild = String(input.webBuild || cookieMap.webBuild || '');
+    if (!webBuild) throw new Error('webBuild required (input.webBuild or cookie webBuild)');
+    out.xs_common = xsCommon(a1, xt, xs, dslPair, b1, {
+      b1b1: input.b1b1,
+      signVersion: input.signVersion,
+      platform: input.platform,
+      appId: input.appId,
+      webBuild,
+      signCount: input.signCount,
+    });
+  }
+  return out;
+}
+
+function main() {
+  const arg = process.argv[2];
+  const raw = arg && arg.startsWith('@') ? fs.readFileSync(arg.slice(1), 'utf8') : arg;
+  const input = JSON.parse(raw);
+  process.stdout.write(JSON.stringify(signFull(input)) + '\n');
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  signFull, encodeXs, encodeUtf8, b64XS, runDsfProgram,
+  parseWebSsk, buildEncSskSign, main,
+};
+

package/static/xhs/xhs_core/js/websectiga_cli.js

@@ -0,0 +1,220 @@
+'use strict';
+
+const env = require('./websectiga_env');
+const _process = process;
+const _Buffer = Buffer;
+const crypto = require('crypto');
+const fs = require('fs');
+const vm = require('vm');
+
+const inputText = fs.readFileSync(0, 'utf8');
+const input = JSON.parse(inputText || '{}');
+const sourceCode = String(input.code || '');
+if (sourceCode.length < 1000 || !/\w+\(\)\(window,\{/.test(sourceCode)) {
+  throw new Error('invalid scripting JSVMP code');
+}
+const UA = String(input.userAgent || 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36');
+const PLATFORM = String(input.platform || 'Win32');
+const PAGE_URL = String(input.pageUrl || 'https://www.xiaohongshu.com/explore?channel_id=homefeed_recommend');
+
+function nativeInstance(name) {
+  const [Ctor, instance] = env.getNativeProto(name, {});
+  // Browser host objects expose their brand through the prototype, while
+  // Object.getOwnPropertyNames(instance) is empty for Navigator/Document.
+  delete instance.toString;
+  delete instance[Symbol.toStringTag];
+  Object.defineProperty(Ctor.prototype, Symbol.toStringTag, {
+    value: name,
+    configurable: true,
+  });
+  return [Ctor, instance];
+}
+
+function defineReadonly(proto, values) {
+  for (const [key, value] of Object.entries(values)) {
+    Object.defineProperty(proto, key, {
+      get: env.setFuncNative(function get() { return value; }, `get ${key}`, 0),
+      enumerable: true,
+      configurable: true,
+    });
+  }
+}
+
+const [Window, fakeWindow] = nativeInstance('Window');
+const [Navigator, fakeNavigator] = nativeInstance('Navigator');
+defineReadonly(Navigator.prototype, {
+  appCodeName: 'Mozilla',
+  appName: 'Netscape',
+  appVersion: UA.slice(8),
+  cookieEnabled: true,
+  hardwareConcurrency: 8,
+  language: 'zh-CN',
+  languages: Object.freeze(['zh-CN', 'zh', 'en']),
+  maxTouchPoints: 0,
+  platform: PLATFORM,
+  product: 'Gecko',
+  productSub: '20030107',
+  userAgent: UA,
+  vendor: 'Google Inc.',
+  webdriver: false,
+});
+
+const [Location, fakeLocation] = nativeInstance('Location');
+const parsedUrl = new URL(PAGE_URL);
+defineReadonly(Location.prototype, {
+  href: PAGE_URL,
+  protocol: parsedUrl.protocol,
+  host: parsedUrl.host,
+  hostname: parsedUrl.hostname,
+  port: parsedUrl.port,
+  pathname: parsedUrl.pathname,
+  search: parsedUrl.search,
+  hash: parsedUrl.hash,
+  origin: parsedUrl.origin,
+});
+Location.prototype.toString = env.setFuncNative(function toString() { return PAGE_URL; }, 'toString', 0);
+
+const [HTMLDivElement] = nativeInstance('HTMLDivElement');
+let appendCalls = 0;
+let appendSelfCalls = 0;
+HTMLDivElement.prototype.getAttribute = env.setFuncNative(function getAttribute() { return null; }, 'getAttribute', 1);
+HTMLDivElement.prototype.setAttribute = env.setFuncNative(function setAttribute() {}, 'setAttribute', 2);
+HTMLDivElement.prototype.appendChild = env.setFuncNative(function appendChild(child) {
+  appendCalls += 1;
+  if (child === this) appendSelfCalls += 1;
+  throw new TypeError('Illegal invocation');
+}, 'appendChild', 1);
+Object.defineProperty(HTMLDivElement.prototype, 'style', {
+  get: env.setFuncNative(function get() { return {}; }, 'get style', 0),
+  configurable: true,
+});
+
+const [HTMLHtmlElement, fakeDocumentElement] = nativeInstance('HTMLHtmlElement');
+HTMLHtmlElement.prototype.getAttribute = env.setFuncNative(function getAttribute() { return null; }, 'getAttribute', 1);
+
+const [HTMLBodyElement, fakeBody] = nativeInstance('HTMLBodyElement');
+HTMLBodyElement.prototype.appendChild = env.setFuncNative(function appendChild(child) { return child; }, 'appendChild', 1);
+
+const [HTMLDocument, fakeDocument] = nativeInstance('HTMLDocument');
+HTMLDocument.prototype.createElement = env.setFuncNative(function createElement(tag) {
+  if (String(tag).toLowerCase() === 'div') return Object.create(HTMLDivElement.prototype);
+  return Object.create(HTMLDivElement.prototype);
+}, 'createElement', 1);
+HTMLDocument.prototype.addEventListener = env.setFuncNative(function addEventListener() {}, 'addEventListener', 2);
+HTMLDocument.prototype.removeEventListener = env.setFuncNative(function removeEventListener() {}, 'removeEventListener', 2);
+defineReadonly(HTMLDocument.prototype, {
+  body: fakeBody,
+  documentElement: fakeDocumentElement,
+  domain: 'xiaohongshu.com',
+  hidden: false,
+  referrer: '',
+  title: '',
+  URL: PAGE_URL,
+  visibilityState: 'visible',
+});
+
+const [External, fakeExternal] = nativeInstance('External');
+External.prototype.toString = env.setFuncNative(function toString() { return '[object External]'; }, 'toString', 0);
+
+const [HTMLImageElement] = nativeInstance('HTMLImageElement');
+for (const key of [
+  'alt', 'src', 'srcset', 'sizes', 'crossOrigin', 'useMap', 'isMap',
+  'width', 'height', 'naturalWidth', 'naturalHeight', 'complete',
+  'currentSrc', 'referrerPolicy',
+]) {
+  Object.defineProperty(HTMLImageElement.prototype, key, {
+    get: env.setFuncNative(function get() { return ''; }, `get ${key}`, 0),
+    set: env.setFuncNative(function set() {}, `set ${key}`, 1),
+    configurable: true,
+    enumerable: true,
+  });
+}
+const Image = env.setFuncNative(function Image() {
+  return Object.create(HTMLImageElement.prototype);
+}, 'Image', 0);
+Image.prototype = HTMLImageElement.prototype;
+
+const [Screen, fakeScreen] = nativeInstance('Screen');
+defineReadonly(Screen.prototype, {
+  width: 1920,
+  height: 1080,
+  availWidth: 1920,
+  availHeight: 1040,
+  colorDepth: 24,
+  pixelDepth: 24,
+});
+
+const [History, fakeHistory] = nativeInstance('History');
+defineReadonly(History.prototype, { length: 1, state: null });
+
+const nativeAtob = env.setFuncNative(function atob(value) {
+  return _Buffer.from(String(value), 'base64').toString('binary');
+}, 'atob', 1);
+const nativeBtoa = env.setFuncNative(function btoa(value) {
+  return _Buffer.from(String(value), 'binary').toString('base64');
+}, 'btoa', 1);
+
+Object.assign(fakeWindow, {
+  Array,
+  Boolean,
+  Date,
+  Function,
+  Image,
+  JSON,
+  Location,
+  Math,
+  Navigator,
+  Number,
+  Object,
+  RegExp,
+  String,
+  Window,
+  atob: nativeAtob,
+  btoa: nativeBtoa,
+  console,
+  document: fakeDocument,
+  escape,
+  external: fakeExternal,
+  frames: null,
+  history: fakeHistory,
+  location: fakeLocation,
+  navigator: fakeNavigator,
+  screen: fakeScreen,
+  encodeURIComponent,
+  setTimeout,
+  clearTimeout,
+});
+fakeWindow.window = fakeWindow;
+fakeWindow.self = fakeWindow;
+fakeWindow.top = fakeWindow;
+fakeWindow.parent = fakeWindow;
+fakeWindow.frames = [fakeWindow];
+
+let result = '';
+fakeWindow.seccallback = env.setFuncNative(function seccallback(value) {
+  result = String(value || '');
+}, 'seccallback', 1);
+
+env.init({
+  window: fakeWindow,
+  document: fakeDocument,
+  navigator: fakeNavigator,
+  location: fakeLocation,
+});
+
+vm.runInThisContext(sourceCode, {
+  filename: 'xhs-scripting-response.js',
+  timeout: Number(input.timeoutMs || 10000),
+});
+
+const summary = {
+  websectiga: result,
+  length: result.length,
+  hex: /^[0-9a-f]{64}$/i.test(result),
+  sha256Prefix: crypto.createHash('sha256').update(result).digest('hex').slice(0, 16),
+};
+
+_process.stdout.write(JSON.stringify(summary) + '\n');
+// env_core keeps an exit-time diagnostic reporter for reverse work. The pure
+// CLI has already emitted its machine-readable result, so suppress that noise.
+console.log = function log() {};