u1s1-cli 1.2.8 → 1.3.0

package/dist/api.d.ts

@@ -64,6 +64,8 @@ export interface ModelsResponse {
     models: ApiModel[];
     features: ApiFeatures;
     announcement?: ApiAnnouncement | null;
+    /** Opaque, device-bound canary echoed only by the official signing proxy. */
+    clientAttestation?: string;
 }
 /** 401:凭证失效(设备被移除/换过钥匙),调用方应引导重新登录而不是继续硬跑。 */
 export declare class AuthError extends Error {

package/dist/api.js

@@ -3,6 +3,11 @@ import { authorizedFetch } from "./device-auth.js";
 /** 401:凭证失效(设备被移除/换过钥匙),调用方应引导重新登录而不是继续硬跑。 */
 export class AuthError extends Error {
 }
+/** 网关错误壳统一是 { error: { message } };解析不出来时回退到状态码提示。 */
+async function errorMessageFromResponse(resp, fallback) {
+    const body = (await resp.json().catch(() => null));
+    return body?.error?.message ?? fallback;
+}
 export async function fetchModels(cfg) {
     let resp;
     try {
@@ -17,9 +22,15 @@ export async function fetchModels(cfg) {
     if (resp.status === 401)
         throw new AuthError("登录已失效,请重新运行 u1s1 login");
     if (!resp.ok)
-        throw new Error(`服务端返回 ${resp.status},稍后再试`);
+        throw new Error(await errorMessageFromResponse(resp, `服务端返回 ${resp.status},稍后再试`));
     const body = (await resp.json());
-    return { models: body.data, features: body.features ?? {}, announcement: body.announcement };
+    const token = body.client_attestation?.token;
+    return {
+        models: body.data,
+        features: body.features ?? {},
+        announcement: body.announcement,
+        clientAttestation: typeof token === "string" && token.length <= 1024 ? token : undefined,
+    };
 }
 /**
  * 拉取用户在云端配置的自定义模型端点(dashboard「自定义模型端点」卡片)。
@@ -37,7 +48,7 @@ export async function fetchUserEndpoints(cfg) {
         throw new Error(`连不上 ${cfg.baseUrl}`);
     }
     if (!resp.ok)
-        throw new Error(`服务端返回 ${resp.status}`);
+        throw new Error(await errorMessageFromResponse(resp, `服务端返回 ${resp.status}`));
     const body = (await resp.json());
     return Array.isArray(body.endpoints) ? body.endpoints : [];
 }
@@ -76,10 +87,8 @@ export async function searchWeb(cfg, input) {
     }
     if (resp.status === 401)
         throw new Error("登录已失效,请重新运行 u1s1 login");
-    if (!resp.ok) {
-        const body = (await resp.json().catch(() => null));
-        throw new Error(body?.error?.message ?? `搜索服务返回 ${resp.status},稍后再试`);
-    }
+    if (!resp.ok)
+        throw new Error(await errorMessageFromResponse(resp, `搜索服务返回 ${resp.status},稍后再试`));
     return (await resp.json());
 }
 /** web_fetch 直连失败时的回退:网关用 Cloudflare Browser Rendering 渲染后转 markdown。 */
@@ -103,10 +112,8 @@ export async function renderPage(cfg, url, signal) {
     }
     if (resp.status === 401)
         throw new Error("登录已失效,请重新运行 u1s1 login");
-    if (!resp.ok) {
-        const body = (await resp.json().catch(() => null));
-        throw new Error(body?.error?.message ?? `渲染服务返回 ${resp.status}`);
-    }
+    if (!resp.ok)
+        throw new Error(await errorMessageFromResponse(resp, `渲染服务返回 ${resp.status}`));
     return (await resp.json());
 }
 const IMAGE_URL_HEADER = "x-u1s1-image-url";
@@ -178,10 +185,8 @@ export async function generateImage(cfg, req, signal) {
     }
     if (resp.status === 401)
         throw new Error("登录已失效,请重新运行 u1s1 login");
-    if (!resp.ok) {
-        const body = (await resp.json().catch(() => null));
-        throw new Error(body?.error?.message ?? `图片生成服务返回 ${resp.status},稍后再试`);
-    }
+    if (!resp.ok)
+        throw new Error(await errorMessageFromResponse(resp, `图片生成服务返回 ${resp.status},稍后再试`));
     return readGeneratedImageResponse(resp);
 }
 export async function fetchMe(cfg) {
@@ -200,6 +205,6 @@ export async function fetchMe(cfg) {
     if (resp.status === 401)
         throw new Error("登录已失效,请重新运行 u1s1 login");
     if (!resp.ok)
-        throw new Error(`服务端返回 ${resp.status},稍后再试`);
+        throw new Error(await errorMessageFromResponse(resp, `服务端返回 ${resp.status},稍后再试`));
     return (await resp.json());
 }

package/dist/device-auth.d.ts

@@ -13,11 +13,12 @@ interface SigningProxy {
     localKey: string;
     token: string;
     client: ClientSurface;
+    clientAttestation?: string;
 }
 export type ClientSurface = "terminal" | "web" | "desktop" | "cloud";
 /**
  * pi accepts static provider headers only. Keep it behind a loopback proxy that
  * replaces the local bearer credential with a fresh DPoP proof per request.
  */
-export declare function ensureSigningProxy(cfg: CliConfig, fallbackClient?: ClientSurface): Promise<SigningProxy>;
+export declare function ensureSigningProxy(cfg: CliConfig, fallbackClient?: ClientSurface, clientAttestation?: string): Promise<SigningProxy>;
 export {};

package/dist/device-auth.js

@@ -98,12 +98,13 @@ function clientSurface(fallback) {
  * pi accepts static provider headers only. Keep it behind a loopback proxy that
  * replaces the local bearer credential with a fresh DPoP proof per request.
  */
-export async function ensureSigningProxy(cfg, fallbackClient = "terminal") {
+export async function ensureSigningProxy(cfg, fallbackClient = "terminal", clientAttestation) {
     if (!hasDeviceCredential(cfg))
         throw new Error("当前安装需要重新登录，以创建设备凭证");
     const client = clientSurface(fallbackClient);
     const current = signingProxy;
-    if (current && current.token === cfg.deviceToken && current.client === client)
+    if (current && current.token === cfg.deviceToken && current.client === client
+        && current.clientAttestation === clientAttestation)
         return current;
     const localKey = `local-${randomBytes(32).toString("hex")}`;
     const upstreamOrigin = new URL(cfg.baseUrl).origin;
@@ -133,6 +134,8 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal") {
             outboundHeaders.set("x-u1s1-client", client);
             outboundHeaders.set("x-u1s1-version", VERSION);
             outboundHeaders.set("x-u1s1-platform", `${process.platform}-${process.arch}`);
+            if (clientAttestation)
+                outboundHeaders.set("x-u1s1-attestation", clientAttestation);
             const upstream = await authorizedFetch(cfg, target, {
                 method: req.method ?? "GET",
                 headers: outboundHeaders,
@@ -166,6 +169,12 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal") {
     });
     server.unref();
     const port = server.address().port;
-    signingProxy = { baseUrl: `http://127.0.0.1:${port}/v1`, localKey, token: cfg.deviceToken, client };
+    signingProxy = {
+        baseUrl: `http://127.0.0.1:${port}/v1`,
+        localKey,
+        token: cfg.deviceToken,
+        client,
+        clientAttestation,
+    };
     return signingProxy;
 }

package/dist/index.js

@@ -193,7 +193,7 @@ async function runAgent(cfg, args) {
     // it after the live model list arrives; explicit user choices remain intact.
     ensureDefaultSettings(MODELS);
     // pi provider 只支持静态 header；指向本机 signing proxy，由它逐请求附 DPoP proof。
-    const signing = await ensureSigningProxy(cfg);
+    const signing = await ensureSigningProxy(cfg, "terminal", modelsResp?.clientAttestation);
     const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey };
     ensureBrandPrompt(await shellReady);
     ensureProviderModels(officialCfg);

package/dist/web.js

@@ -54,20 +54,22 @@ export async function prepareWebEnv(cfg) {
     let webFetchRenderEnabled = false;
     // 老网关没有 /v1/image,image_gen 缺失时按关闭处理,不注册生图工具
     let imageGenEnabled = false;
+    let clientAttestation;
     const endpointsReady = loadCustomEndpoints(cfg);
     try {
-        const { models, features } = await fetchModels(cfg);
+        const { models, features, clientAttestation: attestation } = await fetchModels(cfg);
         setModelsFromApi(models.map(apiModelToDef));
         webSearchEnabled = features.web_search !== false;
         webFetchRenderEnabled = features.web_fetch_render === true;
         imageGenEnabled = features.image_gen === true;
+        clientAttestation = attestation;
     }
     catch (e) {
         console.error("  获取模型列表失败,使用内置列表:", e.message);
     }
     await endpointsReady;
     ensureDefaultSettings(MODELS);
-    const signing = await ensureSigningProxy(cfg, "desktop");
+    const signing = await ensureSigningProxy(cfg, "desktop", clientAttestation);
     const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey };
     webOfficialCfg = officialCfg;
     const modelsPath = refreshWebModels();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u1s1-cli",
-  "version": "1.2.8",
+  "version": "1.3.0",
   "description": "u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。",
   "type": "module",
   "bin": {
@@ -42,8 +42,8 @@
   "license": "MIT",
   "homepage": "https://u1s1.io",
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.84.3",
-    "@earendil-works/pi-tui": "0.84.3",
+    "@earendil-works/pi-coding-agent": "0.84.4",
+    "@earendil-works/pi-tui": "0.84.4",
     "typebox": "1.3.7"
   },
   "devDependencies": {

package/scripts/patch-pi.js

@@ -133,13 +133,13 @@ const ENABLE_AUTOWRAP = "\\x1b[?7h";`,
           expected: 1,
         },
         {
-          from: 'let buffer = "\\x1b[?2026h";',
-          to: 'let buffer = "\\x1b[?2026h" + DISABLE_AUTOWRAP;',
+          from: 'output.append("\\x1b[?2026h");',
+          to: 'output.append("\\x1b[?2026h" + DISABLE_AUTOWRAP);',
           expected: 3,
         },
         {
-          from: 'buffer += "\\x1b[?2026l";',
-          to: 'buffer += ENABLE_AUTOWRAP + "\\x1b[?2026l";',
+          from: 'output.append("\\x1b[?2026l");',
+          to: 'output.append(ENABLE_AUTOWRAP + "\\x1b[?2026l");',
           expected: 3,
         },
       ];