feat(provider): 原生接入 Windsurf provider

crates/aether-provider-transport/src/lib.rs

@@ -24,6 +24,7 @@ mod standard;
 pub mod url;
 pub mod vertex;
 mod video;
+pub mod windsurf;
 
 pub use aether_oauth as oauth;
 pub use auth::{build_passthrough_headers, ensure_upstream_auth_header};
@@ -131,3 +132,9 @@ pub use video::{
     resolve_video_create_auth, video_create_transport_unsupported_reason,
     ProviderVideoCreateFamily, ProviderVideoCreateHeadersInput, VideoTaskTransportSnapshotLookup,
 };
+pub use windsurf::{
+    build_windsurf_cascade_headers, build_windsurf_cascade_request_body,
+    build_windsurf_cascade_upstream_url, is_windsurf_provider_transport,
+    local_windsurf_request_transport_unsupported_reason_with_network, GET_CHAT_MESSAGE_PATH,
+    WINDSURF_ENVELOPE_NAME,
+};

crates/aether-provider-transport/src/provider_types.rs

@@ -253,6 +253,17 @@ const GROK_RUNTIME_POLICY: ProviderRuntimePolicy = ProviderRuntimePolicy {
     ..STANDARD_RUNTIME_POLICY
 };
 
+const WINDSURF_RUNTIME_POLICY: ProviderRuntimePolicy = ProviderRuntimePolicy {
+    fixed_provider: true,
+    api_format_inheritance: ProviderApiFormatInheritance::OAuthOrBearer,
+    enable_format_conversion_by_default: true,
+    oauth_is_bearer_like: true,
+    supports_model_fetch: false,
+    supports_local_openai_chat_transport: false,
+    supports_local_same_format_transport: false,
+    ..STANDARD_RUNTIME_POLICY
+};
+
 const CLAUDE_CODE_FIXED_PROVIDER_TEMPLATE: FixedProviderTemplate = FixedProviderTemplate {
     provider_type: "claude_code",
     version: 1,
@@ -405,6 +416,19 @@ const GROK_FIXED_PROVIDER_TEMPLATE: FixedProviderTemplate = FixedProviderTemplat
     runtime_policy: GROK_RUNTIME_POLICY,
 };
 
+const WINDSURF_FIXED_PROVIDER_TEMPLATE: FixedProviderTemplate = FixedProviderTemplate {
+    provider_type: "windsurf",
+    version: 1,
+    base_url: "https://server.codeium.com",
+    endpoints: &[FixedProviderEndpointTemplate {
+        item_key: "openai:chat",
+        api_format: "openai:chat",
+        custom_path: None,
+        config_defaults: EMPTY_ENDPOINT_CONFIG_DEFAULTS,
+    }],
+    runtime_policy: WINDSURF_RUNTIME_POLICY,
+};
+
 pub fn provider_type_is_fixed(provider_type: &str) -> bool {
     provider_runtime_policy(provider_type).fixed_provider
 }
@@ -455,6 +479,7 @@ pub fn fixed_provider_template(provider_type: &str) -> Option<&'static FixedProv
         "gemini_cli" => Some(&GEMINI_CLI_FIXED_PROVIDER_TEMPLATE),
         "vertex_ai" => Some(&VERTEX_AI_FIXED_PROVIDER_TEMPLATE),
         "antigravity" => Some(&ANTIGRAVITY_FIXED_PROVIDER_TEMPLATE),
+        "windsurf" => Some(&WINDSURF_FIXED_PROVIDER_TEMPLATE),
         _ => None,
     }
 }
@@ -565,6 +590,17 @@ pub fn provider_type_admin_oauth_template(provider_type: &str) -> Option<Provide
             redirect_uri: "http://localhost:51121/oauth2callback",
             use_pkce: true,
         }),
+        "windsurf" => Some(ProviderOAuthTemplate {
+            provider_type: "windsurf",
+            display_name: "Windsurf",
+            authorize_url: "https://windsurf.com/windsurf/signin",
+            token_url: "https://register.windsurf.com/exa.seat_management_pb.SeatManagementService/RegisterUser",
+            client_id: "3GUryQ7ldAeKEuD2obYnppsnmj58eP5u",
+            client_secret: "",
+            scopes: &[],
+            redirect_uri: "show-auth-token",
+            use_pkce: false,
+        }),
         _ => None,
     }
 }
@@ -575,16 +611,18 @@ pub const ADMIN_PROVIDER_OAUTH_TEMPLATE_TYPES: &[&str] = &[
     "chatgpt_web",
     "gemini_cli",
     "antigravity",
+    "windsurf",
 ];
 
 #[cfg(test)]
 mod tests {
     use super::{
         fixed_provider_endpoint_template_by_api_format, fixed_provider_key_inherits_api_formats,
-        fixed_provider_template, provider_runtime_policy,
+        fixed_provider_template, provider_runtime_policy, provider_type_admin_oauth_template,
         provider_type_allows_auth_channel_mismatch_by_default, provider_type_oauth_is_bearer_like,
         provider_type_supports_local_embedding_transport,
         provider_type_supports_local_same_format_transport, FixedProviderEndpointConfigValue,
+        ADMIN_PROVIDER_OAUTH_TEMPLATE_TYPES,
     };
 
     #[test]
@@ -675,6 +713,47 @@ mod tests {
         assert!(!template.runtime_policy.supports_local_same_format_transport);
     }
 
+    #[test]
+    fn windsurf_fixed_provider_template_exposes_openai_chat() {
+        let template = fixed_provider_template("windsurf").expect("windsurf template should exist");
+        assert_eq!(template.provider_type, "windsurf");
+        assert_eq!(template.base_url, "https://server.codeium.com");
+        assert_eq!(template.version, 1);
+        assert_eq!(
+            template
+                .endpoints
+                .iter()
+                .map(|item| item.api_format)
+                .collect::<Vec<_>>(),
+            vec!["openai:chat"]
+        );
+        assert!(
+            fixed_provider_endpoint_template_by_api_format("windsurf", "openai:chat").is_some()
+        );
+
+        let policy = provider_runtime_policy("windsurf");
+        assert!(policy.fixed_provider);
+        assert!(policy.enable_format_conversion_by_default);
+        assert!(policy.oauth_is_bearer_like);
+        assert!(!policy.supports_model_fetch);
+        assert!(!policy.supports_local_same_format_transport);
+    }
+
+    #[test]
+    fn windsurf_admin_oauth_template_is_advertised() {
+        let template =
+            provider_type_admin_oauth_template("windsurf").expect("windsurf oauth template");
+
+        assert_eq!(template.provider_type, "windsurf");
+        assert_eq!(template.display_name, "Windsurf");
+        assert_eq!(
+            template.authorize_url,
+            "https://windsurf.com/windsurf/signin"
+        );
+        assert_eq!(template.redirect_uri, "show-auth-token");
+        assert!(ADMIN_PROVIDER_OAUTH_TEMPLATE_TYPES.contains(&"windsurf"));
+    }
+
     #[test]
     fn fixed_provider_key_inheritance_keeps_oauth_and_kiro_configured_bearer_keys_open() {
         assert!(fixed_provider_key_inherits_api_formats(

crates/aether-provider-transport/src/windsurf.rs

@@ -0,0 +1,466 @@
+use std::collections::BTreeMap;
+
+use serde_json::{json, Value};
+use uuid::Uuid;
+
+use crate::rules::{
+    apply_local_body_rules_with_request_headers, apply_local_header_rules_with_request_headers,
+    body_rules_are_locally_supported, header_rules_are_locally_supported,
+};
+use crate::snapshot::GatewayProviderTransportSnapshot;
+use crate::url::build_passthrough_path_url;
+use crate::{
+    resolve_transport_profile, should_skip_upstream_passthrough_header,
+    supports_local_oauth_request_auth_resolution, transport_profile_is_configured,
+    transport_proxy_is_locally_supported,
+};
+
+pub const PROVIDER_TYPE: &str = "windsurf";
+pub const WINDSURF_ENVELOPE_NAME: &str = "windsurf:GetChatMessage";
+pub const GET_CHAT_MESSAGE_PATH: &str = "/exa.api_server_pb.ApiServerService/GetChatMessage";
+const DEFAULT_IDE_VERSION: &str = "1.9600.41";
+const PLACEHOLDER_API_KEY: &str = "__placeholder__";
+
+pub fn is_windsurf_provider_transport(transport: &GatewayProviderTransportSnapshot) -> bool {
+    transport
+        .provider
+        .provider_type
+        .trim()
+        .eq_ignore_ascii_case(PROVIDER_TYPE)
+}
+
+pub fn local_windsurf_request_transport_unsupported_reason_with_network(
+    transport: &GatewayProviderTransportSnapshot,
+) -> Option<&'static str> {
+    if !transport.provider.is_active {
+        return Some("provider_inactive");
+    }
+    if !transport.endpoint.is_active {
+        return Some("endpoint_inactive");
+    }
+    if !transport.key.is_active {
+        return Some("key_inactive");
+    }
+    if !is_windsurf_provider_transport(transport) {
+        return Some("transport_provider_type_unsupported");
+    }
+    if !transport
+        .endpoint
+        .api_format
+        .trim()
+        .eq_ignore_ascii_case("openai:chat")
+    {
+        return Some("transport_api_format_mismatch");
+    }
+    if !header_rules_are_locally_supported(transport.endpoint.header_rules.as_ref()) {
+        return Some("transport_header_rules_unsupported");
+    }
+    if !body_rules_are_locally_supported(transport.endpoint.body_rules.as_ref()) {
+        return Some("transport_body_rules_unsupported");
+    }
+    if transport.key.decrypted_auth_config.is_some()
+        && !supports_local_oauth_request_auth_resolution(transport)
+        && !supports_local_windsurf_request_auth_resolution(transport)
+    {
+        return Some("transport_oauth_resolution_unsupported");
+    }
+    if !transport_proxy_is_locally_supported(transport) {
+        return Some("transport_proxy_unsupported");
+    }
+    if transport_profile_is_configured(transport) && resolve_transport_profile(transport).is_none()
+    {
+        return Some("transport_profile_unsupported");
+    }
+    None
+}
+
+pub fn supports_local_windsurf_request_auth_resolution(
+    transport: &GatewayProviderTransportSnapshot,
+) -> bool {
+    resolve_windsurf_cascade_auth(transport).is_some()
+}
+
+pub fn resolve_windsurf_cascade_auth(
+    transport: &GatewayProviderTransportSnapshot,
+) -> Option<(String, String)> {
+    if !is_windsurf_provider_transport(transport) {
+        return None;
+    }
+    let auth_type = transport.key.auth_type.trim().to_ascii_lowercase();
+    if !matches!(auth_type.as_str(), "oauth" | "api_key" | "bearer") {
+        return None;
+    }
+    let secret = transport.key.decrypted_api_key.trim();
+    if secret.is_empty() || secret == PLACEHOLDER_API_KEY {
+        return None;
+    }
+    Some(("authorization".to_string(), format!("Bearer {secret}")))
+}
+
+pub fn build_windsurf_cascade_upstream_url(
+    upstream_base_url: &str,
+    query: Option<&str>,
+) -> Option<String> {
+    build_passthrough_path_url(upstream_base_url, GET_CHAT_MESSAGE_PATH, query, &[])
+}
+
+pub fn build_windsurf_cascade_request_body(
+    body_json: &Value,
+    mapped_model: &str,
+    auth_value: &str,
+    body_rules: Option<&Value>,
+    request_headers: Option<&http::HeaderMap>,
+    upstream_is_stream: bool,
+) -> Option<Value> {
+    let mapped_model = mapped_model.trim();
+    if mapped_model.is_empty() {
+        return None;
+    }
+    let messages = body_json.get("messages")?.as_array()?.clone();
+    if messages.is_empty() {
+        return None;
+    }
+    let conversation_id =
+        extract_conversation_id(body_json).unwrap_or_else(|| Uuid::new_v4().to_string());
+    let message_text = last_user_message_text(&messages).unwrap_or_else(|| "Continue.".to_string());
+    let mut provider_request_body = json!({
+        "metadata": windsurf_metadata_from_auth(auth_value),
+        "model": mapped_model,
+        "modelName": mapped_model,
+        "stream": upstream_is_stream,
+        "conversationId": conversation_id,
+        "message": message_text,
+        "messages": messages,
+    });
+
+    if let Some(max_tokens) = body_json
+        .get("max_tokens")
+        .or_else(|| body_json.get("maxTokens"))
+    {
+        provider_request_body
+            .as_object_mut()?
+            .insert("maxTokens".to_string(), max_tokens.clone());
+    }
+    if let Some(temperature) = body_json.get("temperature") {
+        provider_request_body
+            .as_object_mut()?
+            .insert("temperature".to_string(), temperature.clone());
+    }
+    if let Some(top_p) = body_json.get("top_p").or_else(|| body_json.get("topP")) {
+        provider_request_body
+            .as_object_mut()?
+            .insert("topP".to_string(), top_p.clone());
+    }
+
+    if !apply_local_body_rules_with_request_headers(
+        &mut provider_request_body,
+        body_rules,
+        Some(body_json),
+        request_headers,
+    ) {
+        return None;
+    }
+    Some(provider_request_body)
+}
+
+pub fn build_windsurf_cascade_headers(
+    headers: &http::HeaderMap,
+    provider_request_body: &Value,
+    original_request_body: &Value,
+    header_rules: Option<&Value>,
+    auth_header: &str,
+    auth_value: &str,
+    upstream_is_stream: bool,
+) -> Option<BTreeMap<String, String>> {
+    let mut out = BTreeMap::new();
+    for (name, value) in headers {
+        let Ok(value) = value.to_str() else {
+            continue;
+        };
+        let key = name.as_str().to_ascii_lowercase();
+        if should_skip_upstream_passthrough_header(&key) {
+            continue;
+        }
+        let value = value.trim();
+        if !value.is_empty() {
+            out.insert(key, value.to_string());
+        }
+    }
+
+    let auth_header = auth_header.trim().to_ascii_lowercase();
+    if !apply_local_header_rules_with_request_headers(
+        &mut out,
+        header_rules,
+        &[
+            auth_header.as_str(),
+            "content-type",
+            "connect-protocol-version",
+        ],
+        provider_request_body,
+        Some(original_request_body),
+        Some(headers),
+    ) {
+        return None;
+    }
+
+    out.insert("content-type".to_string(), "application/json".to_string());
+    out.insert("connect-protocol-version".to_string(), "1".to_string());
+    out.insert(
+        "user-agent".to_string(),
+        format!("windsurf/{DEFAULT_IDE_VERSION}"),
+    );
+    out.insert(
+        "accept".to_string(),
+        if upstream_is_stream {
+            "text/event-stream".to_string()
+        } else {
+            "application/json".to_string()
+        },
+    );
+    if !auth_header.is_empty() {
+        out.insert(auth_header, auth_value.trim().to_string());
+    }
+    out.remove("content-length");
+    Some(out)
+}
+
+fn windsurf_metadata_from_auth(auth_value: &str) -> Value {
+    json!({
+        "apiKey": auth_secret_from_header_value(auth_value),
+        "ideName": "windsurf",
+        "ideVersion": DEFAULT_IDE_VERSION,
+        "extensionName": "windsurf",
+        "extensionVersion": DEFAULT_IDE_VERSION,
+        "locale": "en",
+    })
+}
+
+fn auth_secret_from_header_value(auth_value: &str) -> String {
+    let value = auth_value.trim();
+    value
+        .strip_prefix("Bearer ")
+        .or_else(|| value.strip_prefix("bearer "))
+        .unwrap_or(value)
+        .trim()
+        .to_string()
+}
+
+fn extract_conversation_id(body_json: &Value) -> Option<String> {
+    let object = body_json.as_object()?;
+    string_value(object.get("conversation_id"))
+        .or_else(|| string_value(object.get("conversationId")))
+        .or_else(|| string_value(object.get("session_id")))
+        .or_else(|| string_value(object.get("sessionId")))
+        .or_else(|| {
+            object
+                .get("metadata")
+                .and_then(Value::as_object)
+                .and_then(|metadata| {
+                    string_value(metadata.get("conversation_id"))
+                        .or_else(|| string_value(metadata.get("conversationId")))
+                        .or_else(|| string_value(metadata.get("session_id")))
+                        .or_else(|| string_value(metadata.get("sessionId")))
+                })
+        })
+}
+
+fn string_value(value: Option<&Value>) -> Option<String> {
+    value
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToOwned::to_owned)
+}
+
+fn last_user_message_text(messages: &[Value]) -> Option<String> {
+    messages
+        .iter()
+        .rev()
+        .filter_map(Value::as_object)
+        .find(|message| {
+            message
+                .get("role")
+                .and_then(Value::as_str)
+                .is_some_and(|role| role == "user")
+        })
+        .and_then(|message| openai_content_to_text(message.get("content")))
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+}
+
+fn openai_content_to_text(value: Option<&Value>) -> Option<String> {
+    match value? {
+        Value::String(text) => Some(text.clone()),
+        Value::Array(items) => {
+            let parts = items
+                .iter()
+                .filter_map(|item| {
+                    item.as_object()
+                        .and_then(|object| object.get("text"))
+                        .and_then(Value::as_str)
+                })
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .collect::<Vec<_>>();
+            (!parts.is_empty()).then(|| parts.join("\n"))
+        }
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use http::HeaderMap;
+    use serde_json::json;
+
+    use crate::snapshot::{
+        GatewayProviderTransportEndpoint, GatewayProviderTransportKey,
+        GatewayProviderTransportProvider, GatewayProviderTransportSnapshot,
+    };
+
+    use super::{
+        build_windsurf_cascade_headers, build_windsurf_cascade_request_body,
+        build_windsurf_cascade_upstream_url,
+        local_windsurf_request_transport_unsupported_reason_with_network,
+        resolve_windsurf_cascade_auth, GET_CHAT_MESSAGE_PATH,
+    };
+
+    fn sample_windsurf_transport(auth_type: &str) -> GatewayProviderTransportSnapshot {
+        GatewayProviderTransportSnapshot {
+            provider: GatewayProviderTransportProvider {
+                id: "provider-windsurf".to_string(),
+                name: "Windsurf".to_string(),
+                provider_type: "windsurf".to_string(),
+                website: None,
+                is_active: true,
+                keep_priority_on_conversion: false,
+                enable_format_conversion: true,
+                concurrent_limit: None,
+                max_retries: None,
+                proxy: None,
+                request_timeout_secs: None,
+                stream_first_byte_timeout_secs: None,
+                config: None,
+            },
+            endpoint: GatewayProviderTransportEndpoint {
+                id: "endpoint-windsurf-chat".to_string(),
+                provider_id: "provider-windsurf".to_string(),
+                api_format: "openai:chat".to_string(),
+                api_family: Some("openai".to_string()),
+                endpoint_kind: Some("chat".to_string()),
+                is_active: true,
+                base_url: "https://server.codeium.com".to_string(),
+                header_rules: None,
+                body_rules: None,
+                max_retries: None,
+                custom_path: None,
+                config: None,
+                format_acceptance_config: None,
+                proxy: None,
+            },
+            key: GatewayProviderTransportKey {
+                id: "key-windsurf".to_string(),
+                provider_id: "provider-windsurf".to_string(),
+                name: "windsurf@example.com".to_string(),
+                auth_type: auth_type.to_string(),
+                is_active: true,
+                api_formats: None,
+                auth_type_by_format: None,
+                allow_auth_channel_mismatch_formats: None,
+                allowed_models: None,
+                capabilities: None,
+                rate_multipliers: None,
+                global_priority_by_format: None,
+                expires_at_unix_secs: None,
+                proxy: None,
+                fingerprint: None,
+                decrypted_api_key: "devin-session-token$abc".to_string(),
+                decrypted_auth_config: Some(r#"{"provider_type":"windsurf"}"#.to_string()),
+            },
+        }
+    }
+
+    #[test]
+    fn builds_windsurf_cascade_url() {
+        assert_eq!(
+            build_windsurf_cascade_upstream_url("https://server.codeium.com", Some("debug=1"))
+                .as_deref(),
+            Some(
+                "https://server.codeium.com/exa.api_server_pb.ApiServerService/GetChatMessage?debug=1"
+            )
+        );
+        assert!(GET_CHAT_MESSAGE_PATH.ends_with("/GetChatMessage"));
+    }
+
+    #[test]
+    fn builds_cascade_request_body_with_metadata_and_messages() {
+        let body = build_windsurf_cascade_request_body(
+            &json!({
+                "model": "gpt-5",
+                "conversation_id": "conv-1",
+                "messages": [
+                    {"role": "system", "content": "brief"},
+                    {"role": "user", "content": [{"type": "text", "text": "hello"}]}
+                ],
+                "max_tokens": 128
+            }),
+            "windsurf-model",
+            "Bearer devin-session-token$abc",
+            None,
+            None,
+            true,
+        )
+        .expect("body should build");
+
+        assert_eq!(body["metadata"]["apiKey"], json!("devin-session-token$abc"));
+        assert_eq!(body["modelName"], json!("windsurf-model"));
+        assert_eq!(body["stream"], json!(true));
+        assert_eq!(body["conversationId"], json!("conv-1"));
+        assert_eq!(body["message"], json!("hello"));
+        assert_eq!(body["maxTokens"], json!(128));
+    }
+
+    #[test]
+    fn builds_cascade_headers_with_connect_protocol_and_auth() {
+        let headers = build_windsurf_cascade_headers(
+            &HeaderMap::new(),
+            &json!({"metadata": {"apiKey": "secret"}}),
+            &json!({"messages": []}),
+            None,
+            "authorization",
+            "Bearer secret",
+            false,
+        )
+        .expect("headers should build");
+
+        assert_eq!(
+            headers.get("connect-protocol-version").map(String::as_str),
+            Some("1")
+        );
+        assert_eq!(
+            headers.get("authorization").map(String::as_str),
+            Some("Bearer secret")
+        );
+        assert_eq!(
+            headers.get("accept").map(String::as_str),
+            Some("application/json")
+        );
+    }
+
+    #[test]
+    fn oauth_windsurf_transport_resolves_direct_bearer_auth() {
+        let transport = sample_windsurf_transport("oauth");
+
+        assert_eq!(
+            local_windsurf_request_transport_unsupported_reason_with_network(&transport),
+            None
+        );
+        assert_eq!(
+            resolve_windsurf_cascade_auth(&transport),
+            Some((
+                "authorization".to_string(),
+                "Bearer devin-session-token$abc".to_string()
+            ))
+        );
+    }
+}