feat: Codex OAuth 按需启动 + Custom Provider Claude 伪装配置 (#182)

Bowl42 · web-flow · commit f5b1b7c722f7 · 2026-02-03T13:29:32.000+08:00
diff --git a/cmd/maxx/main.go b/cmd/maxx/main.go
@@ -376,11 +376,9 @@ func main() {
 		Handler: loggedMux,
 	}
 
-	// Start Codex OAuth callback server (listens on localhost:1455)
+	// Initialize Codex OAuth callback server (start on-demand)
 	codexOAuthServer := core.NewCodexOAuthServer(codexHandler)
-	if err := codexOAuthServer.Start(context.Background()); err != nil {
-		log.Printf("Warning: Failed to start Codex OAuth server: %v", err)
-	}
+	codexHandler.SetOAuthServer(codexOAuthServer)
 
 	// Start server in goroutine
 	log.Printf("Starting Maxx server %s on %s", version.Info(), *addr)
diff --git a/internal/core/database.go b/internal/core/database.go
@@ -358,6 +358,7 @@ func InitializeServerComponents(
 	kiroHandler := handler.NewKiroHandler(adminService)
 	codexHandler := handler.NewCodexHandler(adminService, repos.CodexQuotaRepo, wailsBroadcaster)
 	codexOAuthServer := NewCodexOAuthServer(codexHandler)
+	codexHandler.SetOAuthServer(codexOAuthServer)
 	projectProxyHandler := handler.NewProjectProxyHandler(proxyHandler, modelsHandler, repos.CachedProjectRepo)
 
 	log.Printf("[Core] Creating request tracker for graceful shutdown")
diff --git a/internal/core/server.go b/internal/core/server.go
@@ -135,13 +135,6 @@ func (s *ManagedServer) Start(ctx context.Context) error {
 		}
 	}
 
-	// 启动 Codex OAuth 回调服务器
-	if s.config.Components != nil && s.config.Components.CodexOAuthServer != nil {
-		if err := s.config.Components.CodexOAuthServer.Start(s.ctx); err != nil {
-			log.Printf("[Server] Failed to start Codex OAuth server: %v", err)
-		}
-	}
-
 	s.isRunning = true
 	log.Printf("[Server] Server started successfully")
 	return nil
diff --git a/internal/handler/codex.go b/internal/handler/codex.go
@@ -22,6 +22,14 @@ type CodexHandler struct {
 	quotaRepo    repository.CodexQuotaRepository
 	oauthManager *codex.OAuthManager
 	taskSvc      *service.CodexTaskService
+	oauthServer  OAuthServer
+}
+
+// OAuthServer is a minimal interface for the local OAuth callback server.
+type OAuthServer interface {
+	Start(ctx context.Context) error
+	Stop(ctx context.Context) error
+	IsRunning() bool
 }
 
 // NewCodexHandler creates a new Codex handler
@@ -38,6 +46,11 @@ func (h *CodexHandler) SetTaskService(taskSvc *service.CodexTaskService) {
 	h.taskSvc = taskSvc
 }
 
+// SetOAuthServer injects the local OAuth callback server.
+func (h *CodexHandler) SetOAuthServer(server OAuthServer) {
+	h.oauthServer = server
+}
+
 // ServeHTTP routes Codex requests
 // Routes:
 //
@@ -183,6 +196,16 @@ func (h *CodexHandler) handleValidateToken(w http.ResponseWriter, r *http.Reques
 
 // handleOAuthStart starts the OAuth authorization flow
 func (h *CodexHandler) handleOAuthStart(w http.ResponseWriter, r *http.Request) {
+	if h.oauthServer != nil && !h.oauthServer.IsRunning() {
+		startCtx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+		if err := h.oauthServer.Start(startCtx); err != nil {
+			cancel()
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+			return
+		}
+		cancel()
+	}
+
 	result, err := h.StartOAuth()
 	if err != nil {
 		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
@@ -260,6 +283,8 @@ func (h *CodexHandler) handleOAuthCallback(w http.ResponseWriter, r *http.Reques
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusOK)
 	w.Write([]byte(codexOAuthSuccessHTML))
+
+	h.stopOAuthServerAsync()
 }
 
 // handleOAuthExchange handles POST /codex/oauth/exchange
@@ -351,6 +376,19 @@ func (h *CodexHandler) sendOAuthErrorResult(w http.ResponseWriter, state, errorM
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusBadRequest)
 	w.Write([]byte(codexOAuthErrorHTML))
+
+	h.stopOAuthServerAsync()
+}
+
+func (h *CodexHandler) stopOAuthServerAsync() {
+	if h.oauthServer == nil || !h.oauthServer.IsRunning() {
+		return
+	}
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		_ = h.oauthServer.Stop(ctx)
+	}()
 }
 
 // RefreshProviderInfo refreshes the Codex provider info by re-validating the refresh token
diff --git a/web/src/components/language-toggle.tsx b/web/src/components/language-toggle.tsx
@@ -1,4 +1,3 @@
-import * as React from 'react';
 import { Languages, Check } from 'lucide-react';
 import { useTranslation } from 'react-i18next';
 import {
diff --git a/web/src/locales/en.json b/web/src/locales/en.json
@@ -891,6 +891,17 @@
     "editDescription": "Update your custom provider settings",
     "basicInfo": "1. Basic Information",
     "clientConfig": "2. Client Configuration",
+    "cloakTitle": "3. Claude Cloaking",
+    "cloakMode": "Cloak Mode",
+    "cloakModeDesc": "Controls whether the Claude Code system prompt and fake user_id are injected.",
+    "cloakModeAuto": "Auto (only non-claude-cli clients)",
+    "cloakModeAlways": "Always (force cloaking)",
+    "cloakModeNever": "Never (disable cloaking)",
+    "cloakStrictMode": "Strict Mode",
+    "cloakStrictModeDesc": "Replace all system messages with the Claude Code prompt.",
+    "cloakSensitiveWords": "Sensitive Words",
+    "cloakSensitiveWordsDesc": "Words will be obfuscated with zero-width characters (comma or newline separated).",
+    "cloakSensitiveWordsPlaceholder": "e.g. secret, internal-project",
     "displayName": "Display Name",
     "apiEndpoint": "API Endpoint",
     "apiKey": "API Key",
diff --git a/web/src/locales/zh.json b/web/src/locales/zh.json
@@ -891,6 +891,17 @@
     "editDescription": "更新您的自定义提供商设置",
     "basicInfo": "1. 基本信息",
     "clientConfig": "2. 客户端配置",
+    "cloakTitle": "3. Claude 伪装",
+    "cloakMode": "伪装模式",
+    "cloakModeDesc": "控制是否注入 Claude Code system 提示词与伪造 user_id。",
+    "cloakModeAuto": "自动（仅非 claude-cli 客户端）",
+    "cloakModeAlways": "始终（强制伪装）",
+    "cloakModeNever": "从不（禁用伪装）",
+    "cloakStrictMode": "严格模式",
+    "cloakStrictModeDesc": "用 Claude Code 提示词替换所有 system 消息。",
+    "cloakSensitiveWords": "敏感词",
+    "cloakSensitiveWordsDesc": "将以零宽字符混淆（逗号或换行分隔）。",
+    "cloakSensitiveWordsPlaceholder": "例如：secret, internal-project",
     "displayName": "显示名称",
     "apiEndpoint": "API 端点",
     "apiKey": "API 密钥",
diff --git a/web/src/pages/providers/components/clients-config-section.tsx b/web/src/pages/providers/components/clients-config-section.tsx
@@ -1,6 +1,14 @@
 import { useState, useEffect } from 'react';
 import { Switch } from '@/components/ui';
 import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
 import { ClientIcon } from '@/components/icons/client-icons';
 import type { ClientType } from '@/lib/transport';
 import type { ClientConfig } from '../types';
@@ -9,6 +17,12 @@ import { useTranslation } from 'react-i18next';
 interface ClientsConfigSectionProps {
   clients: ClientConfig[];
   onUpdateClient: (clientId: ClientType, updates: Partial<ClientConfig>) => void;
+  cloak?: {
+    mode: 'auto' | 'always' | 'never';
+    strictMode: boolean;
+    sensitiveWords: string;
+  };
+  onUpdateCloak?: (updates: Partial<ClientsConfigSectionProps['cloak']>) => void;
 }
 
 // Separate component for multiplier input to manage local state
@@ -57,21 +71,24 @@ function MultiplierInput({
   );
 }
 
-export function ClientsConfigSection({ clients, onUpdateClient }: ClientsConfigSectionProps) {
+export function ClientsConfigSection({
+  clients,
+  onUpdateClient,
+  cloak,
+  onUpdateCloak,
+}: ClientsConfigSectionProps) {
   const { t } = useTranslation();
   return (
     <div>
-      <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-        {clients.map((client) => (
+      <div className="rounded-xl border border-border overflow-hidden bg-card">
+        {clients.map((client, index) => (
           <div
             key={client.id}
-            className={`rounded-xl border transition-all duration-200 flex flex-col ${
-              client.enabled
-                ? 'bg-card border-border shadow-sm'
-                : 'bg-muted/30 border-transparent opacity-80 hover:opacity-100 hover:bg-muted/50'
-            }`}
+            className={`px-4 py-4 transition-colors duration-200 ${
+              client.enabled ? 'bg-card' : 'bg-muted/30'
+            } ${index > 0 ? 'border-t border-border' : ''}`}
           >
-            <div className="flex items-center justify-between p-4 border-b border-transparent">
+            <div className="flex items-center justify-between">
               <div className="flex items-center gap-3">
                 <ClientIcon type={client.id} size={32} />
                 <span
@@ -90,10 +107,12 @@ export function ClientsConfigSection({ clients, onUpdateClient }: ClientsConfigS
 
             {/* Expandable/Visible Content */}
             <div
-              className={`px-4 pb-4 transition-all duration-200 ${client.enabled ? 'opacity-100' : 'opacity-50 grayscale pointer-events-none'}`}
+              className={`pt-4 transition-all duration-200 ${
+                client.enabled ? 'opacity-100' : 'opacity-50 grayscale pointer-events-none'
+              }`}
             >
-              <div className="space-y-3">
-                <div className="bg-muted/50 rounded-lg p-3 border border-border/50">
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <div>
                   <label className="text-xs font-medium text-muted-foreground block mb-1.5 uppercase tracking-wide">
                     {t('provider.endpointOverride')}
                   </label>
@@ -106,7 +125,7 @@ export function ClientsConfigSection({ clients, onUpdateClient }: ClientsConfigS
                     className="text-sm w-full bg-card h-9"
                   />
                 </div>
-                <div className="bg-muted/50 rounded-lg p-3 border border-border/50">
+                <div>
                   <label className="text-xs font-medium text-muted-foreground block mb-1.5 uppercase tracking-wide">
                     {t('provider.multiplier', 'Price Multiplier')}
                   </label>
@@ -123,6 +142,65 @@ export function ClientsConfigSection({ clients, onUpdateClient }: ClientsConfigS
                   </div>
                 </div>
               </div>
+
+              {client.id === 'claude' && cloak && onUpdateCloak && (
+                <div className="mt-5 space-y-4">
+                  <div className="border-t border-border/60" />
+                  <div>
+                    <label className="text-xs font-medium text-muted-foreground block mb-1.5 uppercase tracking-wide">
+                      {t('provider.cloakMode')}
+                    </label>
+                    <Select
+                      value={cloak.mode}
+                      onValueChange={(value) =>
+                        onUpdateCloak({ mode: value as 'auto' | 'always' | 'never' })
+                      }
+                    >
+                      <SelectTrigger className="w-full">
+                        <SelectValue placeholder={t('provider.cloakModeAuto')} />
+                      </SelectTrigger>
+                      <SelectContent>
+                        <SelectItem value="auto">{t('provider.cloakModeAuto')}</SelectItem>
+                        <SelectItem value="always">{t('provider.cloakModeAlways')}</SelectItem>
+                        <SelectItem value="never">{t('provider.cloakModeNever')}</SelectItem>
+                      </SelectContent>
+                    </Select>
+                    <p className="text-xs text-muted-foreground mt-1">
+                      {t('provider.cloakModeDesc')}
+                    </p>
+                  </div>
+
+                  <div className="flex items-center justify-between gap-3">
+                    <div className="space-y-1">
+                      <p className="text-sm font-medium text-foreground">
+                        {t('provider.cloakStrictMode')}
+                      </p>
+                      <p className="text-xs text-muted-foreground">
+                        {t('provider.cloakStrictModeDesc')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={cloak.strictMode}
+                      onCheckedChange={(checked) => onUpdateCloak({ strictMode: checked })}
+                    />
+                  </div>
+
+                  <div>
+                    <label className="text-xs font-medium text-muted-foreground block mb-1.5 uppercase tracking-wide">
+                      {t('provider.cloakSensitiveWords')}
+                    </label>
+                    <Textarea
+                      value={cloak.sensitiveWords}
+                      onChange={(e) => onUpdateCloak({ sensitiveWords: e.target.value })}
+                      placeholder={t('provider.cloakSensitiveWordsPlaceholder')}
+                      className="min-h-[88px]"
+                    />
+                    <p className="text-xs text-muted-foreground mt-1">
+                      {t('provider.cloakSensitiveWordsDesc')}
+                    </p>
+                  </div>
+                </div>
+              )}
             </div>
           </div>
         ))}
diff --git a/web/src/pages/providers/components/custom-config-step.tsx b/web/src/pages/providers/components/custom-config-step.tsx
@@ -26,6 +26,13 @@ export function CustomConfigStep() {
   const createProvider = useCreateProvider();
   const createModelMapping = useCreateModelMapping();
 
+  const parseSensitiveWords = (value: string): string[] => {
+    return value
+      .split(/[\n,]/)
+      .map((item) => item.trim())
+      .filter(Boolean);
+  };
+
   const handleSave = async () => {
     if (!isValid()) return;
 
@@ -55,6 +62,16 @@ export function CustomConfigStep() {
             apiKey: formData.apiKey,
             clientBaseURL: Object.keys(clientBaseURL).length > 0 ? clientBaseURL : undefined,
             clientMultiplier: Object.keys(clientMultiplier).length > 0 ? clientMultiplier : undefined,
+            cloak:
+              formData.cloakMode !== 'auto' ||
+              formData.cloakStrictMode ||
+              parseSensitiveWords(formData.cloakSensitiveWords || '').length > 0
+                ? {
+                    mode: formData.cloakMode,
+                    strictMode: formData.cloakStrictMode,
+                    sensitiveWords: parseSensitiveWords(formData.cloakSensitiveWords || ''),
+                  }
+                : undefined,
           },
         },
         supportedClientTypes,
@@ -170,7 +187,22 @@ export function CustomConfigStep() {
             <h3 className="text-lg font-semibold text-text-primary border-b border-border pb-2">
               {t('provider.clientConfig')}
             </h3>
-            <ClientsConfigSection clients={formData.clients} onUpdateClient={updateClient} />
+            <ClientsConfigSection
+              clients={formData.clients}
+              onUpdateClient={updateClient}
+              cloak={{
+                mode: formData.cloakMode || 'auto',
+                strictMode: !!formData.cloakStrictMode,
+                sensitiveWords: formData.cloakSensitiveWords || '',
+              }}
+              onUpdateCloak={(updates) =>
+                updateFormData({
+                  cloakMode: updates?.mode ?? formData.cloakMode,
+                  cloakStrictMode: updates?.strictMode ?? formData.cloakStrictMode,
+                  cloakSensitiveWords: updates?.sensitiveWords ?? formData.cloakSensitiveWords,
+                })
+              }
+            />
           </div>
 
           {/* Model Mapping Section */}
diff --git a/web/src/pages/providers/components/provider-edit-flow.tsx b/web/src/pages/providers/components/provider-edit-flow.tsx
diff --git a/web/src/pages/providers/context/provider-form-context.tsx b/web/src/pages/providers/context/provider-form-context.tsx
diff --git a/web/src/pages/providers/types.ts b/web/src/pages/providers/types.ts

Original file line number	Diff line number	Diff line change
`@@ -135,13 +135,6 @@ func (s *ManagedServer) Start(ctx context.Context) error {`
`135`	`135`	`}`
`136`	`136`	`}`
`137`	`137`
`138`		`- // 启动 Codex OAuth 回调服务器`
`139`		`- if s.config.Components != nil && s.config.Components.CodexOAuthServer != nil {`
`140`		`- if err := s.config.Components.CodexOAuthServer.Start(s.ctx); err != nil {`
`141`		`- log.Printf("[Server] Failed to start Codex OAuth server: %v", err)`
`142`		`- }`
`143`		`- }`
`144`		`-`
`145`	`138`	`s.isRunning = true`
`146`	`139`	`log.Printf("[Server] Server started successfully")`
`147`	`140`	`return nil`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,3 @@`
`1`		`-import * as React from 'react';`
`2`	`1`	`import { Languages, Check } from 'lucide-react';`
`3`	`2`	`import { useTranslation } from 'react-i18next';`
`4`	`3`	`import {`