Cliproxy Newapi Stack

interface:
  display_name: "CLIProxyAPI + NewAPI Stack"
  short_description: "部署 CLIProxyAPI + NewAPI 计费层组合栈"
  default_prompt: "部署 CLIProxyAPI 和 NewAPI 到 VPS，把 OAuth 订阅账号包装成可计费的 OpenAI 兼容 API"

#!/usr/bin/env bash
# Add a new OAuth account (codex/claude/qwen/iflow/gemini) to an existing
# CLIProxyAPI deployment by running OAuth locally and syncing the credential
# JSON to the VPS auth-dir. CLIProxyAPI watcher hot-loads the new file —
# no restart needed.
#
# Usage:
#   PROVIDER=codex SSH_TARGET=root@host SSH_KEY=~/.ssh/id_ed25519 \
#     CLIPROXY_LOCAL=/path/to/CLIProxyAPI \
#     ./add_codex_account.sh

set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=skills/cliproxy-newapi-stack/scripts/lib/validation.sh
. "$SCRIPT_DIR/lib/validation.sh"

: "${PROVIDER:=codex}"   # one of: codex|claude|qwen|iflow|antigravity|gemini
: "${SSH_TARGET:?SSH_TARGET required}"
: "${SSH_KEY:=$HOME/.ssh/id_ed25519}"
: "${CLIPROXY_LOCAL:=$PWD}"
: "${LOCAL_AUTH_DIR:=$HOME/.cli-proxy-api}"
: "${REMOTE_AUTH_DIR:=/root/.cli-proxy-api}"

case "$PROVIDER" in
  codex)        FLAG=-codex-login        ;;
  claude)       FLAG=-claude-login       ;;
  qwen)         FLAG=-qwen-login         ;;
  iflow)        FLAG=-iflow-login        ;;
  antigravity)  FLAG=-antigravity-login  ;;
  gemini)       FLAG=-login              ;;
  *) echo "unknown PROVIDER=$PROVIDER" >&2; exit 2 ;;
esac

require_safe_ssh_target SSH_TARGET "$SSH_TARGET"
require_absolute_safe_path REMOTE_AUTH_DIR "$REMOTE_AUTH_DIR"

mkdir -p "$LOCAL_AUTH_DIR"
echo ">> Capturing existing credentials before login"
before=$(find "$LOCAL_AUTH_DIR" -maxdepth 1 -type f -name "${PROVIDER}-*.json" -print | sort)

echo ">> Run OAuth in browser for the NEW account (logout/incognito as needed)"
( cd "$CLIPROXY_LOCAL" && go run ./cmd/server "$FLAG" -config config.yaml )

after=$(find "$LOCAL_AUTH_DIR" -maxdepth 1 -type f -name "${PROVIDER}-*.json" -print | sort)
new=$(comm -13 <(printf '%s\n' "$before" | sed '/^$/d') <(printf '%s\n' "$after" | sed '/^$/d') || true)

if [ -z "$new" ]; then
  echo "no new credential file detected; aborting"
  exit 1
fi

echo ">> New credential(s):"
echo "$new"

echo ">> Syncing to $SSH_TARGET:$REMOTE_AUTH_DIR"
ssh -i "$SSH_KEY" -- "$SSH_TARGET" bash -s -- "$REMOTE_AUTH_DIR" <<'REMOTE'
  set -euo pipefail
  remote_auth_dir=$1
  mkdir -p -- "$remote_auth_dir"
REMOTE
while IFS= read -r f; do
  [ -n "$f" ] && scp -i "$SSH_KEY" -- "$f" "$SSH_TARGET:$REMOTE_AUTH_DIR/"
done <<< "$new"

echo ">> Watcher should auto-load. Tailing log for confirmation..."
ssh -i "$SSH_KEY" -- "$SSH_TARGET" \
  "tail -n 100 /root/CLIProxyAPI/cli-proxy-api.log | grep -iE 'auth file changed|added' | tail -n 5"

echo ">> Listing remote credentials"
ssh -i "$SSH_KEY" -- "$SSH_TARGET" bash -s -- "$REMOTE_AUTH_DIR" "$PROVIDER" <<'REMOTE'
  set -euo pipefail
  remote_auth_dir=$1
  provider=$2
  shopt -s nullglob
  files=("${remote_auth_dir}/${provider}-"*.json)
  if ((${#files[@]} == 0)); then
    echo "no remote credentials found for provider ${provider}" >&2
    exit 1
  fi
  ls -l -- "${files[@]}"
REMOTE

#!/usr/bin/env bash
# Deploy NewAPI (calciumion/new-api) Docker container on a Linux VPS.
#
# Usage:
#   SSH_TARGET=root@1.2.3.4 SSH_KEY=~/.ssh/id_ed25519 PORT=8200 ./deploy_newapi.sh
#
# Idempotent: safe to re-run. Pulls latest image, recreates container if exists.

set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=skills/cliproxy-newapi-stack/scripts/lib/validation.sh
. "$SCRIPT_DIR/lib/validation.sh"

: "${SSH_TARGET:?SSH_TARGET required (e.g. root@1.2.3.4)}"
: "${SSH_KEY:=$HOME/.ssh/id_ed25519}"
: "${PORT:=8200}"
: "${DATA_DIR:=/root/newapi/data}"
: "${LOGS_DIR:=/root/newapi/logs}"
: "${IMAGE:=calciumion/new-api:latest}"
: "${TZ_VAL:=Asia/Shanghai}"

require_safe_ssh_target SSH_TARGET "$SSH_TARGET"
require_port PORT "$PORT"
require_absolute_safe_path DATA_DIR "$DATA_DIR"
require_absolute_safe_path LOGS_DIR "$LOGS_DIR"
require_safe_docker_image IMAGE "$IMAGE"
require_safe_timezone TZ_VAL "$TZ_VAL"

ssh -i "$SSH_KEY" -- "$SSH_TARGET" bash -s -- "$PORT" "$DATA_DIR" "$LOGS_DIR" "$IMAGE" "$TZ_VAL" <<'REMOTE'
  set -euo pipefail
  port=$1
  data_dir=$2
  logs_dir=$3
  image=$4
  tz_val=$5

  command -v docker >/dev/null || { apt-get update && apt-get install -y docker.io; }
  systemctl enable --now docker
  mkdir -p -- "$data_dir" "$logs_dir"
  docker pull "$image"
  docker rm -f new-api 2>/dev/null || true
  docker run -d --name new-api --restart unless-stopped \
    -p "${port}:3000" \
    -e "TZ=${tz_val}" \
    -v "${data_dir}:/data" \
    -v "${logs_dir}:/app/logs" \
    "$image"
  for i in 1 2 3 4 5 6 7 8 9 10; do
    sleep 2
    if curl -fsS -o /dev/null "http://127.0.0.1:${port}/api/setup"; then
      echo "NewAPI ready on port ${port}"
      exit 0
    fi
  done
  echo NewAPI did not become ready, recent logs: >&2
  docker logs --tail 50 new-api >&2
  exit 1
REMOTE

#!/usr/bin/env bash

die() {
  printf 'error: %s\n' "$*" >&2
  exit 2
}

require_uint() {
  local name=$1
  local value=$2

  if [[ ! "$value" =~ ^[0-9]+$ ]]; then
    die "$name must be an unsigned integer"
  fi
}

require_positive_uint() {
  local name=$1
  local value=$2

  require_uint "$name" "$value"
  if (( 10#$value < 1 )); then
    die "$name must be greater than zero"
  fi
}

require_port() {
  local name=$1
  local value=$2

  require_uint "$name" "$value"
  if (( 10#$value < 1 || 10#$value > 65535 )); then
    die "$name must be between 1 and 65535"
  fi
}

require_absolute_safe_path() {
  local name=$1
  local value=$2

  if [[ -z "$value" || "$value" != /* ]]; then
    die "$name must be an absolute path"
  fi
  if [[ ! "$value" =~ ^/[A-Za-z0-9._/:+-]+$ ]]; then
    die "$name contains unsupported characters"
  fi
  if [[ "$value" == *"/../"* || "$value" == *"/.." || "$value" == *"//"* ]]; then
    die "$name must not contain path traversal or duplicate slashes"
  fi
}

require_safe_container_name() {
  local name=$1
  local value=$2

  if [[ "$value" == -* || ! "$value" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]*$ ]]; then
    die "$name must be a Docker container name"
  fi
}

require_safe_docker_image() {
  local name=$1
  local value=$2

  if [[ "$value" == -* || ! "$value" =~ ^[A-Za-z0-9][A-Za-z0-9._/:@-]*$ ]]; then
    die "$name must be a Docker image reference"
  fi
}

require_safe_host() {
  local name=$1
  local value=$2

  if [[ "$value" == -* || ! "$value" =~ ^[A-Za-z0-9._:-]+$ ]]; then
    die "$name must be a host name or IP address"
  fi
}

require_safe_model_name() {
  local name=$1
  local value=$2

  if [[ "$value" == -* || ! "$value" =~ ^[A-Za-z0-9][A-Za-z0-9._:+/@-]*$ ]]; then
    die "$name must be a model name"
  fi
}

require_safe_ssh_target() {
  local name=$1
  local value=$2

  if [[ "$value" == -* || ! "$value" =~ ^([A-Za-z0-9._~-]+@)?[A-Za-z0-9._:-]+$ ]]; then
    die "$name must be an SSH host or user@host target"
  fi
}

require_safe_timezone() {
  local name=$1
  local value=$2

  if [[ "$value" == -* || ! "$value" =~ ^[A-Za-z0-9_+./-]+$ ]]; then
    die "$name must be an IANA-style timezone"
  fi
}

#!/usr/bin/env python3
"""Write/merge ModelRatio / CacheRatio / CompletionRatio overrides into NewAPI SQLite.

NewAPI v0.12.x merges the persisted `options` rows on top of the in-memory defaults.
This script reads the current values, deep-merges patches, writes them back,
then restarts the container so the new values are loaded.

Pricing semantics (CRITICAL — easy to get wrong):
  ModelRatio       = USD per 1M input tokens / 2  (NewAPI internal scale)
                     User-facing rule: if your target input price is X USD/1M,
                     write X / 2  e.g. input 2.5 -> ModelRatio 1.25.
                     BUT: many docs treat ModelRatio as the input price directly
                     for OpenAI-compatible providers. Verify with a test request
                     and check logs.quota matches expectation.
  CacheRatio       = cached_input / input  (relative multiplier)
                     If cached input is 0.1x of input, write 0.1.
  CompletionRatio  = output / input (relative multiplier)
                     If output is 6x of input, write 6.

Usage:
  SSH_TARGET=root@host  SSH_KEY=~/.ssh/id_ed25519  ./set_pricing.py \
      --model gpt-5.4         --input 2.5  --cached 0.25 --output 15 \
      --model gpt-5.3-codex   --input 1.75 --cached 0.175 --output 14

The script computes the three ratios from raw USD/1M prices.
"""
import argparse
import json
import os
import shlex
import subprocess
import sys


def run_ssh(target: str, key: str, command: str) -> str:
    cmd = ["ssh", "-i", key, target, command]
    result = subprocess.run(cmd, capture_output=True, text=True, check=False)
    if result.returncode != 0:
        sys.stderr.write(result.stderr)
        raise SystemExit(f"ssh failed: {' '.join(shlex.quote(c) for c in cmd)}")
    return result.stdout


def build_remote_python(updates: dict, db_path: str) -> str:
    """Return a heredoc Python program executed on the VPS."""
    payload = json.dumps(updates, ensure_ascii=False)
    program = f"""
import sqlite3, json, sys
DB = {json.dumps(db_path)}
patches = json.loads({json.dumps(payload)})
conn = sqlite3.connect(DB)
cur = conn.cursor()
for key, patch in patches.items():
    row = cur.execute("SELECT value FROM options WHERE key=?", (key,)).fetchone()
    data = json.loads(row[0]) if row and row[0] else {{}}
    data.update(patch)
    value = json.dumps(data, ensure_ascii=False, separators=(",", ":"))
    cur.execute(
        "INSERT INTO options(key, value) VALUES(?, ?) "
        "ON CONFLICT(key) DO UPDATE SET value=excluded.value",
        (key, value),
    )
conn.commit()
for key in ("ModelRatio", "CacheRatio", "CompletionRatio"):
    row = cur.execute("SELECT value FROM options WHERE key=?", (key,)).fetchone()
    if row:
        sample = {{m: json.loads(row[0]).get(m) for m in patches.get(key, {{}}).keys()}}
        print(key, sample)
conn.close()
"""
    return f"python3 - <<'PY'{program}\nPY"


def main() -> int:
    p = argparse.ArgumentParser(description="NewAPI pricing override writer")
    p.add_argument(
        "--model",
        action="append",
        required=True,
        dest="models",
        help="Model name (repeatable). Each --model must be followed by --input/--cached/--output.",
    )
    p.add_argument("--input", type=float, action="append", required=True, dest="inputs",
                   help="Input price USD per 1M tokens (repeatable, paired with --model)")
    p.add_argument("--cached", type=float, action="append", default=[], dest="cacheds",
                   help="Cached input price USD per 1M tokens")
    p.add_argument("--output", type=float, action="append", required=True, dest="outputs",
                   help="Output price USD per 1M tokens")
    p.add_argument("--ratio-divisor", type=float, default=2.0,
                   help="ModelRatio = input / divisor. Default 2 for NewAPI v0.12.x "
                        "(OneAPI internal-scale convention: ModelRatio*2 == USD/1M). "
                        "Set 1 if your fork uses raw USD/1M.")
    p.add_argument("--db", default="/root/newapi/data/one-api.db")
    p.add_argument("--restart", default="new-api",
                   help="docker container name to restart after write (set empty to skip)")
    args = p.parse_args()

    target = os.environ.get("SSH_TARGET")
    key = os.environ.get("SSH_KEY", os.path.expanduser("~/.ssh/id_ed25519"))
    if not target:
        sys.stderr.write("SSH_TARGET env required\n")
        return 2

    n = len(args.models)
    if not (len(args.inputs) == len(args.outputs) == n):
        sys.stderr.write("--model / --input / --output must appear the same number of times\n")
        return 2
    if args.cacheds and len(args.cacheds) != n:
        sys.stderr.write("--cached must appear 0 times or once per --model\n")
        return 2

    model_ratio: dict = {}
    cache_ratio: dict = {}
    completion_ratio: dict = {}
    for i, model in enumerate(args.models):
        inp = args.inputs[i]
        out = args.outputs[i]
        cached = args.cacheds[i] if args.cacheds else None
        model_ratio[model] = inp / args.ratio_divisor
        completion_ratio[model] = out / inp if inp else 0
        if cached is not None and inp:
            cache_ratio[model] = cached / inp

    updates = {"ModelRatio": model_ratio, "CompletionRatio": completion_ratio}
    if cache_ratio:
        updates["CacheRatio"] = cache_ratio

    print("Computed ratios:")
    print(json.dumps(updates, ensure_ascii=False, indent=2))

    print(f"Applying to {target}:{args.db}")
    out = run_ssh(target, key, build_remote_python(updates, args.db))
    print(out)

    if args.restart:
        print(f"Restarting container {args.restart}")
        run_ssh(target, key, f"docker restart {shlex.quote(args.restart)} >/dev/null")
    print("Done. Verify with verify_stack.sh.")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=skills/cliproxy-newapi-stack/scripts/lib/validation.sh
. "$SCRIPT_DIR/lib/validation.sh"

failures=0

assert_pass() {
  local name=$1
  shift
  if ! ("$@"); then
    printf 'FAIL expected pass: %s\n' "$name" >&2
    failures=$((failures + 1))
  fi
}

assert_fail() {
  local name=$1
  shift
  if ("$@") >/dev/null 2>&1; then
    printf 'FAIL expected rejection: %s\n' "$name" >&2
    failures=$((failures + 1))
  fi
}

assert_pass port_valid require_port PORT 8200
assert_fail port_shell_meta require_port PORT '8200;id'
assert_fail port_out_of_range require_port PORT 70000

assert_pass path_valid require_absolute_safe_path DB /root/newapi/data/one-api.db
assert_fail path_quote require_absolute_safe_path DB "/root/newapi/data/one-api.db';id'"
assert_fail path_space require_absolute_safe_path DB '/root/newapi/data/one api.db'
assert_fail path_traversal require_absolute_safe_path DB /root/newapi/../etc/passwd

assert_pass ssh_target_valid require_safe_ssh_target SSH_TARGET root@1.2.3.4
assert_fail ssh_target_option require_safe_ssh_target SSH_TARGET '-oProxyCommand=id'
assert_fail ssh_target_shell_meta require_safe_ssh_target SSH_TARGET 'root@host;id'

assert_pass docker_image_valid require_safe_docker_image IMAGE calciumion/new-api:latest
assert_fail docker_image_option require_safe_docker_image IMAGE '-bad'
assert_fail docker_image_shell_meta require_safe_docker_image IMAGE 'calciumion/new-api:latest;id'

assert_pass container_valid require_safe_container_name CONTAINER new-api
assert_fail container_shell_meta require_safe_container_name CONTAINER 'new-api;id'

assert_pass model_valid require_safe_model_name MODEL gpt-5.4
assert_fail model_json_breakout require_safe_model_name MODEL 'gpt";id'

if ((failures > 0)); then
  exit 1
fi

echo "security validation tests passed"

#!/usr/bin/env bash
# Top up a NewAPI user's quota directly in SQLite (admin API does not always persist).
#
# Usage:
#   SSH_TARGET=root@host SSH_KEY=~/.ssh/id_ed25519 ./topup.sh <user_id> <quota>
# Example: ./topup.sh 1 1000000000   # 1B quota = USD 2000 at QuotaPerUnit=500000

set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=skills/cliproxy-newapi-stack/scripts/lib/validation.sh
. "$SCRIPT_DIR/lib/validation.sh"

: "${SSH_TARGET:?SSH_TARGET required}"
: "${SSH_KEY:=$HOME/.ssh/id_ed25519}"
: "${DB:=/root/newapi/data/one-api.db}"
: "${CONTAINER:=new-api}"

USER_ID="${1:?user_id required}"
QUOTA="${2:?quota integer required}"

require_safe_ssh_target SSH_TARGET "$SSH_TARGET"
require_positive_uint USER_ID "$USER_ID"
require_uint QUOTA "$QUOTA"
require_absolute_safe_path DB "$DB"
require_safe_container_name CONTAINER "$CONTAINER"

ssh -i "$SSH_KEY" -- "$SSH_TARGET" bash -s -- "$USER_ID" "$QUOTA" "$DB" "$CONTAINER" <<'REMOTE'
  set -euo pipefail
  user_id=$1
  quota=$2
  db=$3
  container=$4

  sqlite3 "$db" "UPDATE users SET quota=$quota WHERE id=$user_id;"
  sqlite3 -header -column "$db" "SELECT id, username, quota, used_quota FROM users WHERE id=$user_id;"
  docker restart "$container" >/dev/null
  echo "restarted ${container}"
REMOTE

#!/usr/bin/env bash
# Two-path verification: direct CLIProxyAPI (cpa_ key) and via NewAPI (sk- token).
# Both must return HTTP 200 AND NewAPI must record a non-zero quota log entry.
# Provides W-16 fresh-session evidence for "stack is healthy".
#
# Usage:
#   HOST=1.2.3.4 \
#   SSH_TARGET=root@1.2.3.4 \
#   SSH_KEY=~/.ssh/id_ed25519 \
#   CLIPROXY_PORT=8317 NEWAPI_PORT=8200 \
#   CLIPROXY_KEY=cpa_xxx NEWAPI_TOKEN=sk-xxx \
#   MODEL=gpt-5.4 \
#   ./verify_stack.sh

set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=skills/cliproxy-newapi-stack/scripts/lib/validation.sh
. "$SCRIPT_DIR/lib/validation.sh"

: "${HOST:?HOST required}"
: "${SSH_TARGET:?SSH_TARGET required}"
: "${SSH_KEY:=$HOME/.ssh/id_ed25519}"
: "${CLIPROXY_PORT:=8317}"
: "${NEWAPI_PORT:=8200}"
: "${CLIPROXY_KEY:?CLIPROXY_KEY required}"
: "${NEWAPI_TOKEN:?NEWAPI_TOKEN required}"
: "${MODEL:?MODEL required}"
: "${DB:=/root/newapi/data/one-api.db}"

require_safe_host HOST "$HOST"
require_safe_ssh_target SSH_TARGET "$SSH_TARGET"
require_port CLIPROXY_PORT "$CLIPROXY_PORT"
require_port NEWAPI_PORT "$NEWAPI_PORT"
require_safe_model_name MODEL "$MODEL"
require_absolute_safe_path DB "$DB"

payload='{"model":"'"$MODEL"'","messages":[{"role":"user","content":"reply OK"}],"stream":false,"max_tokens":4}'

echo "[1/3] Direct CLIProxyAPI :$CLIPROXY_PORT"
http_a=$(curl -s -o /tmp/_cpa.json -w "%{http_code}" \
  -H "Authorization: Bearer $CLIPROXY_KEY" -H "Content-Type: application/json" \
  --data "$payload" \
  "http://$HOST:$CLIPROXY_PORT/v1/chat/completions")
echo "  HTTP $http_a"
[ "$http_a" = "200" ] || { echo "FAIL direct CLIProxyAPI"; cat /tmp/_cpa.json; exit 1; }

echo "[2/3] Via NewAPI :$NEWAPI_PORT"
http_b=$(curl -s -o /tmp/_newapi.json -w "%{http_code}" \
  -H "Authorization: Bearer $NEWAPI_TOKEN" -H "Content-Type: application/json" \
  --data "$payload" \
  "http://$HOST:$NEWAPI_PORT/v1/chat/completions")
echo "  HTTP $http_b"
[ "$http_b" = "200" ] || { echo "FAIL via NewAPI"; cat /tmp/_newapi.json; exit 1; }

echo "[3/3] NewAPI billing log (latest 3)"
ssh -i "$SSH_KEY" -- "$SSH_TARGET" bash -s -- "$DB" <<'REMOTE'
  set -euo pipefail
  db=$1
  sqlite3 -header -column "$db" <<'SQL'
SELECT id, model_name, prompt_tokens, completion_tokens, quota, request_id
  FROM logs
 ORDER BY id DESC
 LIMIT 3;
SQL
REMOTE

echo OK both paths returned 200, latest billing log printed above