src/index.js
Rama master · réplica de lectura del repositorio original.
/*
* WindsurfAPI · DevinAPI — 把 Windsurf / Devin 的云端模型变成 OpenAI / Anthropic / Gemini 标准 API。
* 零 npm 运行时依赖。
*
* 项目完整历史（提交/版本/PR/issue/自伤账本）可视化：
* https://dwgx.github.io/WindsurfAPI/HISTORY-LEDGER-VIZ.html
* 总账: docs/HISTORY-LEDGER.md · 逐条账: docs/HISTORY-LEDGER-2026-*.md
*/
// Logger must be imported first to patch log functions before other modules use them
import './dashboard/logger.js';
import { initAuth, isAuthenticated } from './auth.js';
import { configureLanguageServer, startLanguageServer, waitForReady, isLanguageServerRunning, stopLanguageServer, stopLanguageServerAndWait, cleanupOrphanLanguageServers, shouldPrewarmDefaultLs } from './langserver.js';
import { startServer } from './server.js';
import { config, log } from './config.js';
import { existsSync, mkdirSync, readdirSync, rmSync } from 'fs';
import { tmpdir } from 'os';
import { execSync } from 'child_process';
import { dirname, join } from 'path';
import { fileURLToPath } from 'url';
import { VERSION, BRAND } from './version.js';
import { abortActiveSse } from './sse-registry.js';
import { registerServer } from './server-registry.js';
import { buildSubprocessEnv } from './log-safety.js';
export { VERSION, BRAND };
// v2.0.146 (audit F-1): last-resort process safety nets. This service must
// not crash — it has fire-and-forget async paths (LS warmup, restart driver,
// self-update timers) where a stray rejection or a throw inside an async
// callback would otherwise terminate the process on Node >=15. A rejection is
// logged and the process keeps serving; an uncaught exception is logged and we
// exit non-zero so the supervisor (systemd) restarts from a clean state rather
// than continuing in an unknown one. Registered here (after the logger import,
// before main()) so the nets are live before any other module does async work.
let _crashNetsInstalled = false;
function installProcessCrashNets() {
if (_crashNetsInstalled) return;
_crashNetsInstalled = true;
process.on('unhandledRejection', (reason) => {
try { log.error('unhandledRejection:', reason instanceof Error ? (reason.stack || reason.message) : reason); }
catch { console.error('unhandledRejection:', reason); }
});
process.on('uncaughtException', (err) => {
try { log.error('uncaughtException — exiting for clean restart:', err?.stack || err); }
catch { console.error('uncaughtException:', err); }
process.exit(1);
});
}
installProcessCrashNets();
function workspaceBase() {
const tmpDir = process.env.TEMP || process.env.TMP || tmpdir();
const suffix = process.env.HOSTNAME ? `-${process.env.HOSTNAME}` : '';
return join(tmpDir, `windsurf-workspace${suffix}`);
}
function resetWorkspace() {
// Wipe the workspace on every startup. If we don't, files created by
// previous chat sessions (e.g. Claude "editing" config.yaml/lru_cache.py
// via the baked-in Cascade tool prompts) persist and pollute the next
// request — the model sees them at session init and starts narrating
// edits to files the caller never mentioned.
//
// Using Node fs APIs instead of an `execSync('mkdir -p ... && rm -rf')`
// shell pipeline so this is correct on Windows, macOS, and Linux without
// depending on a POSIX shell.
const wsBase = workspaceBase();
try {
mkdirSync(wsBase, { recursive: true });
for (const name of readdirSync(wsBase)) {
try { rmSync(join(wsBase, name), { recursive: true, force: true }); } catch {}
}
} catch {}
}
async function main() {
const banner = `
_ _ _ _ __ _ ____ ___
| | | (_) | | / _| / \\ | _ \\_ _|
| | | |_ _ __ __| |___ _ _ _ __ _| |_ / _ \\ | |_) | |
| |/\\| | | '_ \\ / _\` / __| | | | '__|_ _|/ ___ \\| __/| |
\\ /\\ / | | | | (_| \\__ \\ |_| | | |_| /_/ \\_\\_| |___|
\\/ \\/|_|_| |_|\\__,_|___/\\__,_|_|
${BRAND} v${VERSION}
`;
console.log(banner);
console.log(` OpenAI-compatible proxy for Windsurf — by dwgx1337\n`);
// Start language server binary.
// Auto-install if missing — users repeatedly miss the manual install step
// and open "request crashes" issues (see #18), so we just do it ourselves.
// Skipped on Windows (LS is Linux-only) and when install-ls.sh isn't present.
//
// DEVIN_CONNECT / DEVIN_ONLY are the binary-less pivot backends (pure HTTP to
// Devin cloud — no language_server needed). In those modes the whole LS block
// is pure friction: a fresh Docker boot would otherwise shell out to download
// a ~100MB+ binary the deploy never uses, delaying startup. Skip it entirely.
const lsBackendUnused = String(process.env.DEVIN_CONNECT || '').trim() === '1'
|| String(process.env.DEVIN_ONLY || '').trim() === '1';
const binaryPath = config.lsBinaryPath;
if (lsBackendUnused) {
log.info('DEVIN_CONNECT/DEVIN_ONLY enabled — skipping language server startup (binary-less backend).');
} else if (!existsSync(binaryPath) && process.platform === 'win32') {
log.warn('Windows detected: the Language Server binary is Linux/macOS only.');
log.warn('Options: (1) Use Docker (see docker-compose.yml), (2) Use WSL2, or');
log.warn('(3) Point LS_BINARY_PATH to a Windsurf desktop app language_server binary.');
}
if (!lsBackendUnused && !existsSync(binaryPath) && process.platform !== 'win32') {
const scriptPath = (() => {
try {
const here = dirname(fileURLToPath(import.meta.url));
return join(here, '..', 'install-ls.sh');
} catch { return null; }
})();
if (scriptPath && existsSync(scriptPath)) {
log.info(`Language server binary missing at ${binaryPath}`);
log.info(`Auto-installing via ${scriptPath} — this runs once.`);
try {
// Bounded so a slow/black-holed network can't hang boot forever. The
// upstream desktop archive is ~345 MB; install-ls.sh allows 60 s for
// the manifest plus 900 s for the archive, so leave headroom for
// extraction and hashing.
execSync(`bash "${scriptPath}"`, {
stdio: 'inherit',
// Denylist env (L3b env-leak fix): the installer needs the general
// env — PATH for curl/node/sha256sum, HOME, TMPDIR, proxy + CA-trust
// vars for the downloads, WINDSURFAPI_LS_* overrides — but not the
// proxy's credentials. Nothing install-ls.sh reads is secret-shaped.
env: { ...buildSubprocessEnv(), LS_INSTALL_PATH: binaryPath },
timeout: 1020000,
});
log.info('Language server binary installed.');
} catch (err) {
log.error(`Auto-install failed: ${err.message}`);
log.error('Run manually: bash install-ls.sh (or set LS_BINARY_PATH to point at an existing binary)');
}
}
}
if (!lsBackendUnused && existsSync(binaryPath)) {
resetWorkspace();
// v2.0.85 (#127 123cek): kill any leftover language_server_linux_x64
// processes from prior runs (PM2 SIGKILL / dashboard self-update via
// process.exit() / earlier crash) before we start ours. Otherwise
// they keep their LS pool ports occupied and accumulate over self-
// update cycles. Setting WINDSURFAPI_SKIP_LS_CLEANUP=1 disables
// (e.g. multi-WindsurfAPI on a shared host).
if (process.env.WINDSURFAPI_SKIP_LS_CLEANUP !== '1') {
try {
const r = cleanupOrphanLanguageServers();
if (r.killed > 0) log.info(`LS cleanup: scanned ${r.scanned} candidate(s), killed ${r.killed} orphan(s)`);
} catch (e) { log.warn(`LS cleanup error (non-fatal): ${e.message}`); }
}
const lsConfig = {
binaryPath,
port: config.lsPort,
apiServerUrl: config.codeiumApiUrl,
};
configureLanguageServer(lsConfig);
if (shouldPrewarmDefaultLs()) {
await startLanguageServer(lsConfig);
try {
await waitForReady(30000);
// v2.0.93: if default LS started but proxy-LS crashed, give the
// manage child (port 42101) a moment to restart before syncing models.
log.info('LS ready — fetching model catalog');
} catch (err) {
log.error(`Language server failed to start: ${err.message}`);
log.error('Chat completions will not work without the language server.');
log.error('Run: bash install-ls.sh (pinned upstream manifest; no fallback source)');
}
} else {
log.info('LS default prewarm disabled (LS_PREWARM_DEFAULT=0 or LS_MAX_INSTANCES=1); LS starts lazily on first request');
}
} else if (!lsBackendUnused) {
log.warn(`Language server binary not found at ${binaryPath}`);
log.warn('Install it with: download Windsurf Linux tarball and extract language_server_linux_x64');
}
// Init auth pool
await initAuth();
if (!isAuthenticated()) {
log.warn('No accounts configured. Add via:');
log.warn(' POST /auth/login {"token":"..."}');
log.warn(' POST /auth/login {"api_key":"..."}');
}
const server = startServer();
// Expose the live server so dashboard-triggered restart / self-update paths
// in api.js can drain in-flight requests before exiting (they otherwise have
// no reference to it). Mirrors the sse-registry pattern.
registerServer(server);
// Packaged first-run: print the auto-generated credentials prominently (like
// start.ps1 does for the source install) so the user can log in / call the
// API. They're already persisted to the .env beside the exe.
if (config.generatedCreds) {
const c = config.generatedCreds;
log.warn('################################################################');
log.warn('# 已为你自动生成密钥(请截图妥善保存) #');
log.warn('################################################################');
// D6-LOGS (audit 2026-09-22): only these two lines carry generated credentials,
// and `log.warn` is patched by dashboard/logger.js to copy every call into the
// dashboard ring buffer, the live SSE subscribers and logs/{app,error}-<date>.jsonl
// — sinks that outlive the session and travel into bug reports, container logs and
// backups. The first-run display exists for the operator in front of the console,
// so it goes straight to console.warn; the banner, the .env path and the failure
// explanation below stay on the logger, where operators expect to find them.
if (c.DASHBOARD_PASSWORD) console.warn(` 面板登录密码 (DASHBOARD_PASSWORD): ${c.DASHBOARD_PASSWORD}`);
if (c.API_KEY) console.warn(` 网关调用密钥 (API_KEY): ${c.API_KEY}`);
if (c.envPath) log.warn(` 已写入 ${c.envPath} — 下次启动沿用,无需重设。`);
else log.warn(` (写入 .env 失败${c.persistError ? ': ' + c.persistError : ''} — 本次有效,重启会重新生成)`);
log.warn('################################################################');
}
// Packaged single-exe desktop UX: on the FIRST deploy (no Windsurf_data folder
// existed yet), pop the dashboard in the default browser so the initial
// double-click lands on a usable setup page. Subsequent launches don't reopen
// it. Best effort — a headless/CI run (WINDSURFAPI_NO_OPEN=1) or a missing
// opener just skips it. Delayed slightly so the "Server on ..." line prints.
if (config.isFirstRun && process.env.WINDSURFAPI_NO_OPEN !== '1') {
const url = `http://127.0.0.1:${config.port}/dashboard`;
setTimeout(() => {
try {
// Windows: `cmd /c start "" <url>` opens the default browser without a
// shell window lingering. execFile avoids spawning a persistent shell.
import('child_process').then(({ execFile }) => {
if (process.platform === 'win32') {
execFile('cmd', ['/c', 'start', '', url], { windowsHide: true }, () => {});
} else if (process.platform === 'darwin') {
execFile('open', [url], () => {});
} else {
execFile('xdg-open', [url], () => {});
}
}).catch(() => {});
log.info(`First run — opening dashboard in your browser: ${url}`);
} catch { /* opener unavailable — user can open the URL manually */ }
}, 800);
}
let shuttingDown = false;
const shutdown = (signal) => {
if (shuttingDown) return;
shuttingDown = true;
const inflight = server.getActiveRequests?.() ?? '?';
log.info(`${signal} received — draining ${inflight} in-flight requests (up to 30s)...`);
const abortedSse = abortActiveSse('server shutting down');
if (abortedSse) log.warn(`Aborted ${abortedSse} active SSE stream(s): server shutting down`);
// Detach P1: entries are in-memory and hold no LS lease, but a drain must
// refuse new admissions and drop what exists so a dying process does not
// leave claims behind while the LS pool is being stopped.
import('./detached-registry.js').then(m => m.beginDetachDrain()).catch(() => {});
if (typeof server.closeIdleConnections === 'function') server.closeIdleConnections();
// v2.0.146 (audit F-2): await LS children actually exiting before
// process.exit, mirroring the self-update path. A synchronous
// stopLanguageServer() + immediate exit reparents still-living LS
// children to PID 1, leaving them holding pool ports (42100, 42101…)
// that the freshly-restarted replica then races (the H-4 orphan race).
const finalize = async (reason) => {
// K7: shutdown DRAINS, it does not write the pool back. The periodic
// dirty-flush keeps accounts.json current (≤30s stale) and status flips
// save immediately, so a shutdown rewrite buys nothing — and it used to
// clobber an operator's external accounts.json write, forcing the
// "stop → wait for the flush hook → write → start" deploy dance. Removing
// it lets an external write land safely once the process is stopped.
try { await stopLanguageServerAndWait({ perProcessTimeoutMs: 1500 }); }
catch { try { stopLanguageServer(); } catch {} }
log.info(`Shutdown complete (${reason})`);
process.exit(0);
};
server.close(() => {
log.info('HTTP server closed, stopping language server');
void finalize('drained');
});
setTimeout(() => {
log.warn('Drain timeout, forcing exit');
void finalize('drain-timeout');
}, 30_000);
};
process.on('SIGINT', () => shutdown('SIGINT'));
process.on('SIGTERM', () => shutdown('SIGTERM'));
}
main().catch(err => { console.error('Fatal:', err); process.exit(1); });