u1s1-cli 1.2.9 → 1.3.0

package/dist/api.d.ts

@@ -64,6 +64,8 @@ export interface ModelsResponse {
     models: ApiModel[];
     features: ApiFeatures;
     announcement?: ApiAnnouncement | null;
+    /** Opaque, device-bound canary echoed only by the official signing proxy. */
+    clientAttestation?: string;
 }
 /** 401:凭证失效(设备被移除/换过钥匙),调用方应引导重新登录而不是继续硬跑。 */
 export declare class AuthError extends Error {

package/dist/api.js

@@ -24,7 +24,13 @@ export async function fetchModels(cfg) {
     if (!resp.ok)
         throw new Error(await errorMessageFromResponse(resp, `服务端返回 ${resp.status},稍后再试`));
     const body = (await resp.json());
-    return { models: body.data, features: body.features ?? {}, announcement: body.announcement };
+    const token = body.client_attestation?.token;
+    return {
+        models: body.data,
+        features: body.features ?? {},
+        announcement: body.announcement,
+        clientAttestation: typeof token === "string" && token.length <= 1024 ? token : undefined,
+    };
 }
 /**
  * 拉取用户在云端配置的自定义模型端点(dashboard「自定义模型端点」卡片)。

package/dist/device-auth.d.ts

@@ -13,11 +13,12 @@ interface SigningProxy {
     localKey: string;
     token: string;
     client: ClientSurface;
+    clientAttestation?: string;
 }
 export type ClientSurface = "terminal" | "web" | "desktop" | "cloud";
 /**
  * pi accepts static provider headers only. Keep it behind a loopback proxy that
  * replaces the local bearer credential with a fresh DPoP proof per request.
  */
-export declare function ensureSigningProxy(cfg: CliConfig, fallbackClient?: ClientSurface): Promise<SigningProxy>;
+export declare function ensureSigningProxy(cfg: CliConfig, fallbackClient?: ClientSurface, clientAttestation?: string): Promise<SigningProxy>;
 export {};

package/dist/device-auth.js

@@ -98,12 +98,13 @@ function clientSurface(fallback) {
  * pi accepts static provider headers only. Keep it behind a loopback proxy that
  * replaces the local bearer credential with a fresh DPoP proof per request.
  */
-export async function ensureSigningProxy(cfg, fallbackClient = "terminal") {
+export async function ensureSigningProxy(cfg, fallbackClient = "terminal", clientAttestation) {
     if (!hasDeviceCredential(cfg))
         throw new Error("当前安装需要重新登录，以创建设备凭证");
     const client = clientSurface(fallbackClient);
     const current = signingProxy;
-    if (current && current.token === cfg.deviceToken && current.client === client)
+    if (current && current.token === cfg.deviceToken && current.client === client
+        && current.clientAttestation === clientAttestation)
         return current;
     const localKey = `local-${randomBytes(32).toString("hex")}`;
     const upstreamOrigin = new URL(cfg.baseUrl).origin;
@@ -133,6 +134,8 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal") {
             outboundHeaders.set("x-u1s1-client", client);
             outboundHeaders.set("x-u1s1-version", VERSION);
             outboundHeaders.set("x-u1s1-platform", `${process.platform}-${process.arch}`);
+            if (clientAttestation)
+                outboundHeaders.set("x-u1s1-attestation", clientAttestation);
             const upstream = await authorizedFetch(cfg, target, {
                 method: req.method ?? "GET",
                 headers: outboundHeaders,
@@ -166,6 +169,12 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal") {
     });
     server.unref();
     const port = server.address().port;
-    signingProxy = { baseUrl: `http://127.0.0.1:${port}/v1`, localKey, token: cfg.deviceToken, client };
+    signingProxy = {
+        baseUrl: `http://127.0.0.1:${port}/v1`,
+        localKey,
+        token: cfg.deviceToken,
+        client,
+        clientAttestation,
+    };
     return signingProxy;
 }

package/dist/index.js

@@ -193,7 +193,7 @@ async function runAgent(cfg, args) {
     // it after the live model list arrives; explicit user choices remain intact.
     ensureDefaultSettings(MODELS);
     // pi provider 只支持静态 header；指向本机 signing proxy，由它逐请求附 DPoP proof。
-    const signing = await ensureSigningProxy(cfg);
+    const signing = await ensureSigningProxy(cfg, "terminal", modelsResp?.clientAttestation);
     const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey };
     ensureBrandPrompt(await shellReady);
     ensureProviderModels(officialCfg);

package/dist/web.js

@@ -54,20 +54,22 @@ export async function prepareWebEnv(cfg) {
     let webFetchRenderEnabled = false;
     // 老网关没有 /v1/image,image_gen 缺失时按关闭处理,不注册生图工具
     let imageGenEnabled = false;
+    let clientAttestation;
     const endpointsReady = loadCustomEndpoints(cfg);
     try {
-        const { models, features } = await fetchModels(cfg);
+        const { models, features, clientAttestation: attestation } = await fetchModels(cfg);
         setModelsFromApi(models.map(apiModelToDef));
         webSearchEnabled = features.web_search !== false;
         webFetchRenderEnabled = features.web_fetch_render === true;
         imageGenEnabled = features.image_gen === true;
+        clientAttestation = attestation;
     }
     catch (e) {
         console.error("  获取模型列表失败,使用内置列表:", e.message);
     }
     await endpointsReady;
     ensureDefaultSettings(MODELS);
-    const signing = await ensureSigningProxy(cfg, "desktop");
+    const signing = await ensureSigningProxy(cfg, "desktop", clientAttestation);
     const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey };
     webOfficialCfg = officialCfg;
     const modelsPath = refreshWebModels();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u1s1-cli",
-  "version": "1.2.9",
+  "version": "1.3.0",
   "description": "u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。",
   "type": "module",
   "bin": {