feat(core): embed proxy and model policy features

Author: ssfun

.github/dependabot.yml

@@ -12,11 +12,3 @@ updates:
     directory: /cliproxyapi-pro-core
     schedule:
       interval: weekly
-  - package-ecosystem: gomod
-    directory: /cliproxyapi-pro-plugins/proxy-pool
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /cliproxyapi-pro-plugins/oauth-model-policy
-    schedule:
-      interval: weekly

.github/workflows/release-core.yml

@@ -270,9 +270,7 @@ jobs:
           rm -rf "${context_dir}"
           mkdir -p \
             "${context_dir}/binaries/linux/amd64" \
-            "${context_dir}/binaries/linux/arm64" \
-            "${context_dir}/plugins/linux/amd64" \
-            "${context_dir}/plugins/linux/arm64"
+            "${context_dir}/binaries/linux/arm64"
 
           amd64_archive="docker-assets/linux-amd64/CLIProxyAPI_${RELEASE_TAG#v}_linux_amd64.tar.gz"
           arm64_archive="docker-assets/linux-arm64/CLIProxyAPI_${RELEASE_TAG#v}_linux_aarch64.tar.gz"
@@ -288,10 +286,6 @@ jobs:
 
           cp "${tmp_dir}/amd64/cli-proxy-api" "${context_dir}/binaries/linux/amd64/CLIProxyAPI"
           cp "${tmp_dir}/arm64/cli-proxy-api" "${context_dir}/binaries/linux/arm64/CLIProxyAPI"
-          cp "${tmp_dir}/amd64/plugins/linux/amd64/proxy-pool.so" "${context_dir}/plugins/linux/amd64/proxy-pool.so"
-          cp "${tmp_dir}/arm64/plugins/linux/arm64/proxy-pool.so" "${context_dir}/plugins/linux/arm64/proxy-pool.so"
-          cp "${tmp_dir}/amd64/plugins/linux/amd64/oauth-model-policy.so" "${context_dir}/plugins/linux/amd64/oauth-model-policy.so"
-          cp "${tmp_dir}/arm64/plugins/linux/arm64/oauth-model-policy.so" "${context_dir}/plugins/linux/arm64/oauth-model-policy.so"
           cp "${tmp_dir}/amd64/config.example.yaml" "${context_dir}/config.example.yaml"
           cp docker-assets/management/management.html "${context_dir}/management.html"
           cp customizations-repo/cliproxyapi-pro-core/entrypoint.sh "${context_dir}/entrypoint.sh"
@@ -303,10 +297,6 @@ jobs:
           ls -lh \
             "${context_dir}/binaries/linux/amd64/CLIProxyAPI" \
             "${context_dir}/binaries/linux/arm64/CLIProxyAPI" \
-            "${context_dir}/plugins/linux/amd64/proxy-pool.so" \
-            "${context_dir}/plugins/linux/arm64/proxy-pool.so" \
-            "${context_dir}/plugins/linux/amd64/oauth-model-policy.so" \
-            "${context_dir}/plugins/linux/arm64/oauth-model-policy.so" \
             "${context_dir}/management.html"
 
       - name: Set up QEMU
@@ -534,30 +524,13 @@ jobs:
             -ldflags="-s -w -X main.Version=${RELEASE_TAG} -X main.Commit=release-${CORE_TAG} -X main.BuildDate=${BUILD_DATE}" \
             -o "${archive_dir}/${binary_name}" ./cmd/server/
 
-          plugin_extension="so"
-          if [ "${GOOS}" = "darwin" ]; then plugin_extension="dylib"; fi
-          if [ "${GOOS}" = "windows" ]; then plugin_extension="dll"; fi
-          mkdir -p "${archive_dir}/plugins/${GOOS}/${GOARCH}"
-          plugin_relatives=()
-          for plugin_name in proxy-pool oauth-model-policy; do
-            plugin_relative="plugins/${GOOS}/${GOARCH}/${plugin_name}.${plugin_extension}"
-            plugin_source=".${plugin_name}-build"
-            rm -rf "${plugin_source}"
-            cp -R "../customizations-repo/cliproxyapi-pro-plugins/${plugin_name}" "${plugin_source}"
-            go -C "${plugin_source}" mod edit -replace github.com/router-for-me/CLIProxyAPI/v7=..
-            CGO_ENABLED=1 GOOS="${GOOS}" GOARCH="${GOARCH}" go -C "${plugin_source}" build \
-              -buildvcs=false -trimpath -buildmode=c-shared \
-              -o "${PWD}/${archive_dir}/${plugin_relative}" .
-            plugin_relatives+=("${plugin_relative}")
-          done
-
           cp LICENSE README.md README_EN.md config.example.yaml "${archive_dir}/"
           python ../customizations-repo/scripts/build/create_reproducible_archive.py \
             --format "${ARCHIVE_FORMAT}" \
             --output "dist/${archive_name}" \
             --root "${archive_dir}" \
             --source-date-epoch "${SOURCE_DATE_EPOCH}" \
-            "${binary_name}" LICENSE README.md README_EN.md config.example.yaml "${plugin_relatives[@]}"
+            "${binary_name}" LICENSE README.md README_EN.md config.example.yaml
 
       - name: Build Linux glibc plugin-capable archive
         if: matrix.kind == 'linux-glibc-plugin'
@@ -577,10 +550,6 @@ jobs:
           archive_name="CLIProxyAPI_${RELEASE_TAG#v}_linux_${ASSET_ARCH}.tar.gz"
           rm -rf "dist/linux-${GOARCH}"
           mkdir -p "${archive_dir}"
-          for plugin_name in proxy-pool oauth-model-policy; do
-            rm -rf ".${plugin_name}-build"
-            cp -R "../customizations-repo/cliproxyapi-pro-plugins/${plugin_name}" ".${plugin_name}-build"
-          done
 
           go_archive="go${GO_VERSION}.linux-${GOARCH}.tar.gz"
           go_sha256="$(
@@ -614,14 +583,6 @@ jobs:
                 -ldflags="-s -w -X main.Version=${RELEASE_TAG} -X main.Commit=release-${CORE_TAG} -X main.BuildDate=${BUILD_DATE}" \
                 -o "'"${archive_dir}"'/cli-proxy-api" ./cmd/server/
 
-              mkdir -p "'"${archive_dir}"'/plugins/linux/${GOARCH}"
-              for plugin_name in proxy-pool oauth-model-policy; do
-                go -C ".${plugin_name}-build" mod edit -replace github.com/router-for-me/CLIProxyAPI/v7=/src
-                CGO_ENABLED=1 GOOS=linux GOARCH="${GOARCH}" go -C ".${plugin_name}-build" build \
-                  -buildvcs=false -trimpath -buildmode=c-shared \
-                  -o "/src/'"${archive_dir}"'/plugins/linux/${GOARCH}/${plugin_name}.so" .
-              done
-
               glibc_versions="$(readelf --version-info "'"${archive_dir}"'/cli-proxy-api" | sed -n "s/.*Name: GLIBC_\([0-9.]*\).*/\1/p" | sort -Vu)"
               if [ -n "${glibc_versions}" ]; then
                 printf "GLIBC versions:\n%s\n" "${glibc_versions}"
@@ -639,9 +600,7 @@ jobs:
             --output "dist/${archive_name}" \
             --root "${archive_dir}" \
             --source-date-epoch "${SOURCE_DATE_EPOCH}" \
-            cli-proxy-api LICENSE README.md README_EN.md config.example.yaml \
-            "plugins/linux/${GOARCH}/proxy-pool.so" \
-            "plugins/linux/${GOARCH}/oauth-model-policy.so"
+            cli-proxy-api LICENSE README.md README_EN.md config.example.yaml
 
       - name: Install FreeBSD plugin build dependencies
         if: matrix.kind == 'freebsd-plugin'

README.md

@@ -15,8 +15,8 @@ CLIProxyAPI Pro 是对两个 upstream 项目的最小化定制层集合：
 - 账号巡检支持自动化启用、禁用、删除、主动刷新令牌
 - 账号巡检针对 Antigravity 软封禁和 xAI 可用性异常提供可选深度检测
 - 路由策略页面统一管理 upstream 路由行为与按 provider 配置的请求状态保护
-- 内置动态代理池插件，把多个 HTTP/SOCKS 节点汇聚为固定的本地 SOCKS5 地址，支持轮询、加权、健康隔离与故障转移
-- 内置 OAuth 模型策略插件，可按多个提供商的账号套餐分别排除不可用模型，并同步约束模型列表和账号调度
+- 二进制内建代理池，把多个 HTTP/SOCKS 节点汇聚为固定的本地 SOCKS5 地址，支持轮询、加权、健康隔离与故障转移
+- 二进制内建 OAuth 模型策略，可按多个提供商的账号套餐分别排除不可用模型，并同步约束模型列表和账号调度
 
 ## 项目结构
 
@@ -36,10 +36,6 @@ CLIProxyAPI Pro 是对两个 upstream 项目的最小化定制层集合：
 │   ├── monitoring-locales.json
 │   └── overlay/
 │
-├── cliproxyapi-pro-plugins/
-│   ├── proxy-pool/
-│   └── oauth-model-policy/
-│
 ├── scripts/validation/
 └── .github/workflows/
     ├── ci.yml
@@ -64,12 +60,12 @@ CLIProxyAPI Pro 是对两个 upstream 项目的最小化定制层集合：
 - 支持 SQLite-backed quota cache。
 - 支持模型价格持久化。
 - 支持 QuotaProvider 插件协议和 Gemini CLI legacy adapter。
-- 支持通用 `AuthModelFilter` 插件协议；预打包的 `oauth-model-policy` 可按 xAI、Codex、Claude、Gemini CLI、Antigravity 和 Kimi OAuth 套餐排除模型。
+- 内建 OAuth 模型策略，可按 xAI、Codex、Claude、Gemini CLI、Antigravity 和 Kimi OAuth 套餐排除模型。
 - 启动时在内存中强制必要 upstream 配置；仅修改 YAML 中已存在的键，禁止自动新增键。
 - 支持后端账号巡检调度器和执行器，巡检探测前可刷新 token。
 - 支持统一路由策略与请求状态保护 API。
 - 支持 Komari agent 可选启动。
-- 标准 macOS、Windows amd64、Linux Release 和 Docker 镜像预打包 `proxy-pool` 与 `oauth-model-policy` 动态插件；Windows ARM64、FreeBSD 与 `_no-plugin` 产物暂不内置动态插件。
+- 代理池与 OAuth 模型策略直接编译进所有 Pro 二进制，包括 `_no-plugin` 产物；其配置持久化在 usage SQLite，不写入 `config.yaml`。
 - 将 `/` 跳转到 `/management.html`。
 - 增强 `/healthz` 返回信息。
 

README_EN.md

@@ -15,8 +15,8 @@ This project does not maintain a full fork of either upstream project. Instead,
 - Optional automatic enable, disable, delete, and token-refresh actions.
 - Optional deep probes for Antigravity soft bans and xAI availability anomalies.
 - A routing-policy page for upstream routing behavior and provider-scoped request-state protection.
-- A bundled dynamic proxy-pool plugin that aggregates HTTP/SOCKS nodes behind one fixed loopback SOCKS5 endpoint with rotation, health isolation, and failover.
-- A bundled OAuth model-policy plugin that removes unavailable models per provider and account plan, constraining both model listing and auth scheduling.
+- A statically linked proxy pool that aggregates HTTP/SOCKS nodes behind one fixed loopback SOCKS5 endpoint with rotation, health isolation, and failover.
+- A statically linked OAuth model policy that removes unavailable models per provider and account plan, constraining both model listing and auth scheduling.
 
 ## Repository layout
 
@@ -36,10 +36,6 @@ This project does not maintain a full fork of either upstream project. Instead,
 │   ├── monitoring-locales.json
 │   └── overlay/
 │
-├── cliproxyapi-pro-plugins/
-│   ├── proxy-pool/
-│   └── oauth-model-policy/
-│
 ├── scripts/validation/
 └── .github/workflows/
     ├── ci.yml
@@ -64,12 +60,12 @@ Main capabilities:
 - Supports SQLite-backed quota cache.
 - Supports model price persistence.
 - Supports the QuotaProvider plugin protocol and a Gemini CLI legacy adapter.
-- Supports a generic `AuthModelFilter` plugin protocol; the bundled `oauth-model-policy` filters OAuth models by account plan for xAI, Codex, Claude, Gemini CLI, Antigravity, and Kimi.
+- Includes an OAuth model policy for xAI, Codex, Claude, Gemini CLI, Antigravity, and Kimi account plans.
 - Forces required upstream startup config: `usage-statistics-enabled=true` and the Pro management panel repository.
 - Adds a backend account-inspection scheduler and executor with token refresh before probing.
 - Adds unified routing-policy and request-state-protection APIs.
 - Optionally starts the Komari agent.
-- Prebundles the `proxy-pool` and `oauth-model-policy` dynamic libraries in standard macOS, Windows amd64, and Linux releases plus Docker images; Windows ARM64, FreeBSD, and `_no-plugin` assets do not currently bundle dynamic plugins.
+- Links the proxy pool and OAuth model policy into every Pro binary, including `_no-plugin` assets; their settings live in the usage SQLite database and are never written to `config.yaml`.
 - Redirects `/` to `/management.html`.
 - Enhances the `/healthz` response.
 

cliproxyapi-pro-core/Dockerfile

@@ -45,25 +45,9 @@ RUN set -eux; \
 
 COPY cliproxyapi-pro-core/embeddedusage /tmp/embeddedusage
 COPY cliproxyapi-pro-core/patches /tmp/patches
-COPY cliproxyapi-pro-plugins/proxy-pool /tmp/proxy-pool
-COPY cliproxyapi-pro-plugins/oauth-model-policy /tmp/oauth-model-policy
 
 RUN python3 /tmp/patches/apply_upstream_patches.py
 
-RUN set -eux; \
-    cd /tmp/proxy-pool; \
-    go mod edit -replace github.com/router-for-me/CLIProxyAPI/v7=/src/CLIProxyAPI; \
-    go mod tidy; \
-    CGO_ENABLED=1 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
-      go build -buildvcs=false -trimpath -buildmode=c-shared -o /out/proxy-pool.so .
-
-RUN set -eux; \
-    cd /tmp/oauth-model-policy; \
-    go mod edit -replace github.com/router-for-me/CLIProxyAPI/v7=/src/CLIProxyAPI; \
-    go mod tidy; \
-    CGO_ENABLED=1 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
-      go build -buildvcs=false -trimpath -buildmode=c-shared -o /out/oauth-model-policy.so .
-
 RUN set -eux; \
     go mod tidy; \
     CLIPROXY_SOURCE_VERSION="$(cat /tmp/cliproxy-version)"; \
@@ -93,8 +77,6 @@ RUN set -eux; \
 WORKDIR /CLIProxyAPI
 
 COPY --from=builder /out/CLIProxyAPI /CLIProxyAPI/CLIProxyAPI
-COPY --from=builder /out/proxy-pool.so /CLIProxyAPI/plugins/linux/${TARGETARCH}/proxy-pool.so
-COPY --from=builder /out/oauth-model-policy.so /CLIProxyAPI/plugins/linux/${TARGETARCH}/oauth-model-policy.so
 COPY --from=builder /src/CLIProxyAPI/config.example.yaml /CLIProxyAPI/config.example.yaml
 COPY --from=builder /tmp/pro-management.html /CLIProxyAPI/static/management.html
 COPY cliproxyapi-pro-core/entrypoint.sh /CLIProxyAPI/entrypoint.sh

cliproxyapi-pro-core/README.md

@@ -4,7 +4,7 @@
 
 本目录不维护 upstream 的完整 fork。Docker 构建时会下载指定 upstream release，复制本地 `embeddedusage/` 包，执行 `patches/` 中的补丁脚本，然后构建 Pro 部署使用的多架构镜像。
 
-标准 macOS、Windows amd64、Linux Pro Release 与 Docker 镜像会预打包 `proxy-pool` 和 `oauth-model-policy` 动态插件。前者在回环地址提供固定 SOCKS5 入口；后者按多个提供商的 OAuth 套餐排除账号不可用的模型。Windows ARM64、FreeBSD 与 `_no-plugin` 资产暂不内置动态插件。
+代理池和 OAuth 模型策略直接编译到 Core 二进制中，所有 Pro 构建（包括 `_no-plugin`）都具备这两项能力。配置保存在 usage SQLite 的 `pro_settings`，不会写入 `config.yaml`。
 
 ## 定制内容
 
@@ -81,7 +81,7 @@ detail 还会保留 upstream `ClientRequestMetadata` 提供的 `client_ip`、`x_
 - `model_prices` — 基础价格兼容数据和完整的全局 model 价格规则。
 - `quota_cache` — 配额卡片和账号级刷新使用的 SQLite-backed quota snapshots。
 - `monitoring_settings` — 监控日志保留时间、WebDAV 备份配置和 models.dev 定期同步配置。
-- `pro_settings` — Pro 私有设置；当前包含请求状态保护策略。
+- `pro_settings` — Pro 私有设置；当前包含请求状态保护、代理池和 OAuth 模型策略。
 - `routing_cursor_state` — 账号路由轮转游标。
 - `auth_runtime_stats` — 账号选择、成功/失败和近期请求桶统计。
 - `account_inspection_schedule` — 后端账号巡检调度设置。
@@ -137,11 +137,11 @@ detail 还会保留 upstream `ClientRequestMetadata` 提供的 `client_ip`、`x_
 `Executor.HttpRequest` 提供兼容适配；插件未来原生实现协议后会自动优先使用原生能力。
 协议字段与兼容策略见 [QUOTA_PROVIDER.md](QUOTA_PROVIDER.md)。
 
-### OAuth 套餐模型策略插件
+### 内建代理池与 OAuth 套餐模型策略
 
-补丁层为 upstream 插件 SDK/ABI 增加通用 `AuthModelFilter` 能力。Core 只提供当前 auth、原始模型集合和受控 HTTP callback，并强制插件只能减去已有模型；套餐识别与规则均位于预打包的 `oauth-model-policy` 插件中。
+Core 内建回环 SOCKS5 代理池以及 xAI、Codex、Claude、Gemini CLI、Antigravity、Kimi 的 OAuth 套餐模型策略。代理接管只在运行时替换全局传输路径，不改写 `config.yaml`，凭证级代理和显式 `direct` 不受影响。模型处理顺序为 upstream `excluded_models`、内建套餐过滤、OAuth alias/prefix、模型注册，最终结果同时约束 `/v1/models` 聚合和请求调度候选账号。
 
-插件支持 xAI、Codex、Claude、Gemini CLI、Antigravity 和 Kimi OAuth，并为所有提供商提供 `_unknown`、`_default` 与自定义套餐规则。处理顺序为 upstream `excluded_models`、插件套餐过滤、OAuth alias/prefix、模型注册。最终注册结果同时约束 `/v1/models` 聚合和请求调度候选账号。配置与探测细节见 `cliproxyapi-pro-plugins/oauth-model-policy/README.md`。
+首次启动会读取旧 `plugins.configs.proxy-pool` 和 `plugins.configs.oauth-model-policy`，校验并写入 SQLite，回读确认成功后再原子清除旧 YAML。旧代理接管若处于启用状态，会先把根 `proxy-url` 恢复为旧 `restore-proxy-url`；其他第三方插件配置保持不变。
 
 ### 后端账号巡检调度器
 
@@ -237,7 +237,7 @@ https://github.com/ssfun/CLIProxyAPI-Pro
 - `Dockerfile` — 下载 upstream CLIProxyAPI，应用定制层，并构建最终镜像。
 - `Dockerfile.runtime` — GitHub Actions 使用预构建 Linux 二进制组装运行时镜像。
 - `QUOTA_PROVIDER.md` — QuotaProvider 插件协议和兼容策略。
-- `../cliproxyapi-pro-plugins/oauth-model-policy/` — 按 OAuth 套餐过滤账号模型的动态插件。
+- `patches/sources/internal/profeatures/` — 内建代理池、模型策略的 SQLite 迁移与运行时编排。
 - `entrypoint.sh` — 启动 Komari、主 API 和 WebDAV usage 恢复逻辑。
 - `embeddedusage/` — 内嵌 SQLite usage service 和 management routes。
 - `patches/apply_upstream_patches.py` — Docker build 阶段 patch upstream 源码。