@alilis/k-hat 0.2.0 → 0.2.2

package/README.md

@@ -86,8 +86,8 @@ khat stop
 
 | 命令 | 说明 |
 |---|---|
-| `khat init` | 首次初始化：创建密钥库 + 访问令牌 + 默认配置 |
-| `khat start` | 后台启动代理与 supervisor；使用 `--foreground` 以前台模式诊断 |
+| `khat init` | 首次初始化：创建密钥库 + 访问令牌 + 默认配置；可用 `--port <n>` 指定监听端口 |
+| `khat start` | 后台启动代理与 supervisor；使用 `--foreground` 以前台模式诊断，使用 `--port <n>` 修改并持久化监听端口 |
 | `khat stop` | 请求后台代理优雅停止 |
 | `khat status` | 查看 Provider、key、路由及 key 健康状态 |
 | `khat doctor` | 检测本机 Agent Tool 配置并输出接入提示 |

package/dist/admin.js

@@ -1,4 +1,4 @@
-import { addProvider, updateProvider, removeProvider, addKey, updateKey, removeKey, enableKey, addRoute, updateRoute, removeRoute, maskSecret } from './store.js';
+import { addProvider, updateProvider, removeProvider, addKey, updateKey, removeKey, enableKey, setKeyEnabled, addRoute, updateRoute, setRouteEnabled, removeRoute, maskSecret } from './store.js';
 import { LogWriter } from './logger.js';
 import { join } from 'node:path';
 import { UiSessions, serveUi } from './web-ui.js';
@@ -8,6 +8,15 @@ import { ACCESS_TOKEN_REF, generateAccessToken } from './vault.js';
 // client or a process without the token cannot mutate config/state/vault.
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
 const uiSessions = new UiSessions();
+const ANTHROPIC_VERSION = '2023-06-01';
+function upstreamHeaders(protocol, secret, contentType = false) {
+    const headers = protocol === 'anthropic'
+        ? { 'x-api-key': secret, 'anthropic-version': ANTHROPIC_VERSION }
+        : { authorization: `Bearer ${secret}` };
+    if (contentType)
+        headers['content-type'] = 'application/json';
+    return headers;
+}
 function json(res, status, value) {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(value));
@@ -23,6 +32,25 @@ async function readJsonBody(req) {
         throw new Error('Invalid JSON body');
     }
 }
+async function listProviderModels(store, providerId) {
+    const provider = store.config.providers.find((item) => item.id === providerId);
+    if (!provider)
+        throw new Error(`unknown provider: ${providerId}`);
+    const key = provider.keys.find((item) => item.enabled !== false && store.states[`${provider.id}/${item.id}`]?.status !== 'unavailable');
+    if (!key)
+        throw new Error('provider has no available key');
+    const secret = store.vault.get(key.vaultRef);
+    if (!secret)
+        throw new Error('provider key secret is missing');
+    const headers = upstreamHeaders(provider.protocol, secret);
+    const response = await fetch(new URL('/v1/models', provider.baseUrl), { headers, signal: AbortSignal.timeout(10_000) });
+    if (!response.ok)
+        throw new Error(`model query failed with HTTP ${response.status}`);
+    const body = await response.json();
+    const values = Array.isArray(body?.data) ? body.data : Array.isArray(body?.models) ? body.models : [];
+    const ids = values.map((item) => typeof item === 'string' ? item : item?.id).filter((id) => typeof id === 'string' && id.length > 0);
+    return Array.from(new Set(ids)).sort();
+}
 function buildStatus(store) {
     const token = store.vault.get(ACCESS_TOKEN_REF);
     return {
@@ -39,6 +67,7 @@ function buildStatus(store) {
                 return {
                     id: key.id,
                     weight: key.weight,
+                    ...(key.enabled === false ? { enabled: false } : {}),
                     status: state?.status === 'unavailable' ? 'unavailable' : 'available',
                     lastError: state?.lastError,
                     secret: secret ? maskSecret(secret) : null,
@@ -46,7 +75,7 @@ function buildStatus(store) {
                 };
             })
         })),
-        routes: store.config.routes
+        routes: store.config.routes.map((route) => route.enabled === false ? { ...route, enabled: false } : { model: route.model, provider: route.provider })
     };
 }
 async function route(req, res, store, sessionAuthorized = false) {
@@ -91,6 +120,8 @@ async function route(req, res, store, sessionAuthorized = false) {
         return json(res, 200, { logs: logs.filter((entry) => (!model || entry.model === model) && (!key || entry.key === key) && (!status || String(entry.status) === status)) });
     }
     if (sub[0] === 'providers') {
+        if (sub.length === 3 && sub[2] === 'models' && method === 'GET')
+            return json(res, 200, { models: await listProviderModels(store, sub[1]) });
         if (sub.length === 1 && method === 'POST') {
             const body = await readJsonBody(req);
             if (!body.id || !body.protocol || !body.baseUrl)
@@ -136,7 +167,11 @@ async function route(req, res, store, sessionAuthorized = false) {
             return json(res, 200, { ok: true });
         }
         if (sub.length === 5 && sub[2] === 'keys' && sub[4] === 'enable' && method === 'POST') {
-            await store.mutate(() => enableKey(store, sub[1], sub[3]));
+            await store.mutate(async () => { await setKeyEnabled(store, sub[1], sub[3], true); await enableKey(store, sub[1], sub[3]); });
+            return json(res, 200, { ok: true });
+        }
+        if (sub.length === 5 && sub[2] === 'keys' && sub[4] === 'disable' && method === 'POST') {
+            await store.mutate(() => setKeyEnabled(store, sub[1], sub[3], false));
             return json(res, 200, { ok: true });
         }
         if (sub.length === 5 && sub[2] === 'keys' && sub[4] === 'probe' && method === 'POST') {
@@ -149,7 +184,7 @@ async function route(req, res, store, sessionAuthorized = false) {
             if (!secret || !model)
                 throw new Error('a key and route model are required for probing');
             const path = provider.protocol === 'anthropic' ? '/v1/messages' : '/v1/chat/completions';
-            const headers = provider.protocol === 'anthropic' ? { 'content-type': 'application/json', 'x-api-key': secret, 'anthropic-version': '2023-06-01' } : { 'content-type': 'application/json', authorization: `Bearer ${secret}` };
+            const headers = upstreamHeaders(provider.protocol, secret, true);
             const body = provider.protocol === 'anthropic' ? { model, max_tokens: 1, messages: [{ role: 'user', content: 'ping' }] } : { model, max_tokens: 1, messages: [{ role: 'user', content: 'ping' }], stream: false };
             const response = await fetch(new URL(path, provider.baseUrl), { method: 'POST', headers: headers, body: JSON.stringify(body), signal: AbortSignal.timeout(30_000) });
             if (response.ok)
@@ -167,14 +202,20 @@ async function route(req, res, store, sessionAuthorized = false) {
         }
         if (sub.length === 2 && method === 'PUT') {
             const body = await readJsonBody(req);
-            if (!body.provider || typeof body.provider !== 'string')
-                throw new Error('provider is required');
-            await store.mutate(() => updateRoute(store, decodeURIComponent(sub[1]), body.provider));
+            if (body.provider !== undefined)
+                await store.mutate(() => updateRoute(store, decodeURIComponent(sub[1]), body.provider));
+            if (body.enabled !== undefined)
+                await store.mutate(() => setRouteEnabled(store, decodeURIComponent(sub[1]), body.enabled));
+            return json(res, 200, { ok: true });
+        }
+        if (sub.length === 2 && (sub[1] === 'enable' || sub[1] === 'disable') && method === 'POST') {
+            const model = url.searchParams.get('model');
+            if (!model)
+                throw new Error('model query parameter is required');
+            await store.mutate(() => setRouteEnabled(store, model, sub[1] === 'enable'));
             return json(res, 200, { ok: true });
         }
         if (sub.length === 1 && method === 'DELETE') {
-            // The model goes in the query string: model names are not restricted to
-            // the provider/key id alphabet and may contain characters unsafe in a path segment.
             const model = url.searchParams.get('model');
             if (!model)
                 throw new Error('model query parameter is required');

package/dist/cli.js

@@ -27,14 +27,15 @@ Usage: khat <command> [arguments]
 
 Setup
   init                                  first-time setup: create vault + access token + default config
-  start [--foreground]                  start the proxy as a background daemon (or foreground with --foreground)
+  start [--foreground] [--port <n>]     start the proxy as a background daemon (or foreground with --foreground);
+                                        --port <n> changes the persisted listen port
   stop                                  stop the background daemon
   status                                show providers, keys, routes and key health
   doctor                                detect local Agent Tools and show connection guidance
   log [--tail <n>]                      show recent masked proxy request logs
   ui                                    issue a one-time browser ticket for the management page
   tui                                   open the interactive terminal management UI
-  export <file>                         export encrypted portable vault
+  export <file>                         export encrypted portable vault (use a .khat suffix)
   import <file> [--force]               import encrypted portable vault
 
 Access token
@@ -62,6 +63,9 @@ Routes
   route list
   route remove <model>
 
+Version
+  version | --version | -v              print the khat version
+
 Environment
   KHAT_HOME            data directory (default ~/.khat)
   KHAT_ACCESS_TOKEN    override the vault access token (mainly for tests)`;
@@ -103,6 +107,15 @@ function flagInt(flags, name, fallback) {
         throw new Error(`--${name} must be a positive integer`);
     return parsed;
 }
+function flagPort(flags, name) {
+    const value = flagString(flags, name);
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535)
+        throw new Error(`--${name} must be an integer between 1 and 65535`);
+    return parsed;
+}
 async function promptSecret(label) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try {
@@ -122,16 +135,26 @@ async function promptPassword(label) {
     return new Promise((resolve, reject) => {
         const stdin = process.stdin;
         let value = '';
-        const onData = (chunk) => { const text = chunk.toString(); if (text.includes('\\n') || text.includes('\\r')) {
-            stdin.setRawMode?.(false);
-            stdin.pause();
-            stdin.off('data', onData);
-            process.stdout.write('\\n');
-            value = value.trim();
-            value ? resolve(value) : reject(new Error('empty password'));
-        }
-        else
-            value += text; };
+        const onData = (chunk) => { for (const ch of chunk.toString()) {
+            if (ch === '\n' || ch === '\r') {
+                stdin.setRawMode?.(false);
+                stdin.pause();
+                stdin.off('data', onData);
+                process.stdout.write('\n');
+                value = value.trim();
+                return value ? resolve(value) : reject(new Error('empty password'));
+            }
+            if (ch === '\u007f' || ch === '\b') {
+                if (value) {
+                    value = value.slice(0, -1);
+                    process.stdout.write('\b \b');
+                }
+            }
+            else {
+                value += ch;
+                process.stdout.write('*');
+            }
+        } };
         stdin.setRawMode?.(true);
         stdin.resume();
         stdin.on('data', onData);
@@ -244,10 +267,16 @@ async function runForeground() {
     process.once('SIGINT', shutdown);
     process.once('SIGTERM', shutdown);
 }
-async function runStart(foreground) {
+async function runStart(foreground, port) {
+    const store = await openInitializedStore();
+    if (port !== undefined && port !== store.config.port) {
+        if (await daemonRunning())
+            throw new Error(`khat is already running on port ${store.config.port}; run 'khat stop' first, then start with --port ${port}`);
+        store.config.port = port;
+        await store.saveConfig();
+    }
     if (foreground)
         return runForeground();
-    const store = await openInitializedStore();
     if (await daemonRunning())
         throw new Error('khat is already running; use khat stop first');
     const occupiedPid = await findListeningPid(store.config.port);
@@ -412,18 +441,23 @@ async function runImport(path, force) {
     await importPortable(path, dataDir, createKeyProtector(), password, force);
     console.log(`imported encrypted vault into ${dataDir}`);
 }
-async function runInit() {
+async function runVersion() {
+    const pkg = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+    console.log(pkg.version);
+}
+async function runInit(port) {
     await mkdir(dataDir, { recursive: true, mode: 0o700 });
     if (await fileExists(configPath)) {
         console.error(`already initialized at ${configPath} (delete the directory to start over)`);
         process.exitCode = 1;
         return;
     }
+    const config = port === undefined || port === defaultConfig.port ? defaultConfig : { ...defaultConfig, port };
     const vault = await Vault.create(vaultPath, createKeyProtector());
     const token = generateAccessToken();
     vault.set(ACCESS_TOKEN_REF, token);
     await vault.save();
-    await saveJsonAtomic(configPath, defaultConfig);
+    await saveJsonAtomic(configPath, config);
     await saveJsonAtomic(statePath, { keys: {} });
     console.log(`Initialized ${dataDir}`);
     console.log();
@@ -431,7 +465,7 @@ async function runInit() {
     console.log(`  ${token}`);
     console.log();
     console.log('Point your tools at the proxy, e.g.:');
-    console.log(`  base URL:      http://${defaultConfig.bind}:${defaultConfig.port}/v1`);
+    console.log(`  base URL:      http://${config.bind}:${config.port}/v1`);
     console.log(`  Authorization: Bearer ${token}`);
 }
 const [command, ...rest] = process.argv.slice(2);
@@ -443,8 +477,13 @@ try {
         case '-h':
             console.log(USAGE);
             break;
+        case 'version':
+        case '--version':
+        case '-v':
+            await runVersion();
+            break;
         case 'init':
-            await runInit();
+            await runInit(flagPort(flags, 'port'));
             break;
         case 'export':
             await runExport(positionals[0]);
@@ -453,7 +492,7 @@ try {
             await runImport(positionals[0], flags.force === true);
             break;
         case 'start':
-            await runStart(flags.foreground === true);
+            await runStart(flags.foreground === true, flagPort(flags, 'port'));
             break;
         case 'stop':
             await runStop();

package/dist/config.js

@@ -42,6 +42,9 @@ export function validateConfig(config) {
                 throw new Error(`Invalid timeouts.${field}: expected a positive integer`);
         }
     }
+    if (!Number.isInteger(config.port) || config.port < 1 || config.port > 65535) {
+        throw new Error('Invalid config: port must be an integer between 1 and 65535');
+    }
     for (const provider of config.providers) {
         if (!provider.id || !provider.baseUrl || (provider.protocol !== 'openai' && provider.protocol !== 'anthropic') || !Array.isArray(provider.keys))
             throw new Error(`Invalid provider: ${provider.id}`);
@@ -59,6 +62,8 @@ export function validateConfig(config) {
         for (const key of provider.keys) {
             if (!key.id || !Number.isInteger(key.weight) || key.weight < 1)
                 throw new Error(`Invalid key in provider ${provider.id}`);
+            if (key.enabled !== undefined && typeof key.enabled !== 'boolean')
+                throw new Error(`Invalid key ${provider.id}/${key.id}: enabled must be boolean`);
             if (key.vaultRef !== `${provider.id}/${key.id}`)
                 throw new Error(`Invalid key ${provider.id}/${key.id}: vaultRef must match provider and key id`);
         }
@@ -66,6 +71,8 @@ export function validateConfig(config) {
     for (const route of config.routes) {
         if (!route.model || !route.provider)
             throw new Error('Invalid route: model and provider are required');
+        if (route.enabled !== undefined && typeof route.enabled !== 'boolean')
+            throw new Error(`Invalid route ${route.model}: enabled must be boolean`);
         if (!config.providers.some((item) => item.id === route.provider))
             throw new Error(`Invalid route ${route.model}: unknown provider ${route.provider}`);
     }

package/dist/router.js

@@ -1,10 +1,18 @@
-export function resolveProvider(config, model) {
+export function findRoute(config, model) {
     const slash = model.indexOf('/');
     if (slash > 0) {
         const providerId = model.slice(0, slash);
-        const provider = config.providers.find((item) => item.id === providerId);
-        return provider && config.routes.some((route) => route.provider === providerId && route.model === model.slice(slash + 1)) ? provider : undefined;
+        const routeModel = model.slice(slash + 1);
+        return config.routes.find((route) => route.provider === providerId && route.model === routeModel);
     }
-    const route = config.routes.find((item) => item.model === model);
-    return route ? config.providers.find((item) => item.id === route.provider) : undefined;
+    return config.routes.find((route) => route.model === model);
+}
+export function resolveProvider(config, model) {
+    const route = findRoute(config, model);
+    if (!route || route.enabled === false)
+        return undefined;
+    return config.providers.find((item) => item.id === route.provider);
+}
+export function isRouteDisabled(config, model) {
+    return findRoute(config, model)?.enabled === false;
 }

package/dist/selector.js

@@ -1,7 +1,7 @@
 export class WeightedSelector {
     current = new Map();
     select(providerId, keys, states) {
-        const available = keys.filter((key) => states[`${providerId}/${key.id}`]?.status !== 'unavailable');
+        const available = keys.filter((key) => key.enabled !== false && states[`${providerId}/${key.id}`]?.status !== 'unavailable');
         if (!available.length)
             return undefined;
         let total = 0;

package/dist/server.js

@@ -3,7 +3,7 @@ import { watch } from 'node:fs';
 import { readJsonFile, saveJsonAtomic, validateConfig, defaultTimeouts } from './config.js';
 import { LogWriter } from './logger.js';
 import { join, basename } from 'node:path';
-import { resolveProvider } from './router.js';
+import { resolveProvider, isRouteDisabled } from './router.js';
 import { WeightedSelector } from './selector.js';
 import { handleAdmin } from './admin.js';
 import { ACCESS_TOKEN_REF } from './vault.js';
@@ -102,8 +102,11 @@ export function createKhatServer(options) {
             if (!parsed.model || typeof parsed.model !== 'string')
                 return json(res, 400, { error: { message: 'model is required' } });
             const provider = resolveProvider(options.config, parsed.model);
-            if (!provider)
+            if (!provider) {
+                if (isRouteDisabled(options.config, parsed.model))
+                    return json(res, 403, { error: { message: `Route disabled for model: ${parsed.model}` } });
                 return json(res, 404, { error: { message: `No route for model: ${parsed.model}` } });
+            }
             if (provider.protocol !== protocol)
                 return json(res, 400, { error: { message: `Model ${parsed.model} resolves to a ${provider.protocol} provider, but ${req.url} speaks ${protocol}` } });
             const tried = new Set();
@@ -182,13 +185,18 @@ export function createKhatServer(options) {
                         clearTimeout(idleTimer);
                     }
                 }
-                res.end();
-                res.off('close', clientGone);
                 const durationMs = Date.now() - startedAt;
                 const ttfbMs = (firstByteAt ?? Date.now()) - startedAt;
                 const keyRef = `${provider.id}/${key.id}`;
                 options.store?.recordCounter(keyRef, { requests: 1, failed: upstream.ok ? 0 : 1, bytesOut: bytes, tokensIn, tokensOut });
-                void logger?.append({ ts: new Date().toISOString(), event: 'forward', model: parsed.model, provider: provider.id, key: keyRef, status: upstream.status, ttfbMs, durationMs, bytes, tokensIn, tokensOut });
+                try {
+                    await logger?.append({ ts: new Date().toISOString(), event: 'forward', model: parsed.model, provider: provider.id, key: keyRef, status: upstream.status, ttfbMs, durationMs, bytes, tokensIn, tokensOut });
+                }
+                catch (error) {
+                    console.error(`[khat] failed to write request log: ${error?.message ?? error}`);
+                }
+                res.end();
+                res.off('close', clientGone);
                 return;
             }
         }

package/dist/store.js

@@ -195,6 +195,27 @@ export async function removeKey(store, providerId, keyId) {
     await store.vault.save();
     await store.saveState();
 }
+export async function setKeyEnabled(store, providerId, keyId, enabled) {
+    const provider = findProvider(store, providerId);
+    const key = provider.keys.find((item) => item.id === keyId);
+    if (!key)
+        throw new Error(`unknown key: ${providerId}/${keyId}`);
+    const previous = key.enabled;
+    if (enabled)
+        delete key.enabled;
+    else
+        key.enabled = false;
+    try {
+        await persistConfig(store);
+    }
+    catch (error) {
+        if (previous === undefined)
+            delete key.enabled;
+        else
+            key.enabled = previous;
+        throw error;
+    }
+}
 export async function enableKey(store, providerId, keyId) {
     const provider = findProvider(store, providerId);
     if (!provider.keys.some((item) => item.id === keyId))
@@ -231,6 +252,26 @@ export async function updateRoute(store, model, providerId) {
         throw error;
     }
 }
+export async function setRouteEnabled(store, model, enabled) {
+    const route = store.config.routes.find((item) => item.model === model);
+    if (!route)
+        throw new Error(`unknown route: ${model}`);
+    const previous = route.enabled;
+    if (enabled)
+        delete route.enabled;
+    else
+        route.enabled = false;
+    try {
+        await persistConfig(store);
+    }
+    catch (error) {
+        if (previous === undefined)
+            delete route.enabled;
+        else
+            route.enabled = previous;
+        throw error;
+    }
+}
 export async function removeRoute(store, model) {
     const before = store.config.routes.length;
     store.config.routes = store.config.routes.filter((route) => route.model !== model);

package/dist/tui-client.js

@@ -51,6 +51,9 @@ export class AdminClient {
     async deleteKey(providerId, keyId) {
         await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}`, { method: 'DELETE' });
     }
+    async disableKey(providerId, keyId) {
+        await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}/disable`, { method: 'POST' });
+    }
     async enableKey(providerId, keyId) {
         await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}/enable`, { method: 'POST' });
     }
@@ -63,6 +66,8 @@ export class AdminClient {
     async updateRoute(model, provider) {
         await this.request(`/_keys/routes/${encodeURIComponent(model)}`, { method: 'PUT', body: { provider } });
     }
+    async enableRoute(model) { await this.request(`/_keys/routes/enable?model=${encodeURIComponent(model)}`, { method: 'POST' }); }
+    async disableRoute(model) { await this.request(`/_keys/routes/disable?model=${encodeURIComponent(model)}`, { method: 'POST' }); }
     async deleteRoute(model) {
         await this.request(`/_keys/routes?model=${encodeURIComponent(model)}`, { method: 'DELETE' });
     }

package/dist/web-ui.js

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-const PAGE = `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>khat 密钥管理</title><script>(function(){try{var t=localStorage.getItem('khatTheme');if(t!=='dark'&&t!=='light')t=(window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches)?'dark':'light';document.documentElement.setAttribute('data-theme',t)}catch(e){document.documentElement.setAttribute('data-theme','light')}})();</script><style>
+const PAGE = `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title data-i18n="title">khat 密钥管理</title><script>(function(){try{var t=localStorage.getItem('khatTheme');if(t!=='dark'&&t!=='light')t=(window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches)?'dark':'light';document.documentElement.setAttribute('data-theme',t)}catch(e){document.documentElement.setAttribute('data-theme','light')}try{var l=localStorage.getItem('khatLang');document.documentElement.lang=(l==='en')?'en':'zh-CN'}catch(e){document.documentElement.lang='zh-CN'}})();</script><style>
 *{box-sizing:border-box}
 :root{color-scheme:light;--bg:#f4f6fa;--surface:#ffffff;--surface-2:var(--surface-2);--border:#e5eaf1;--border-strong:#d5dee9;--text:#1c2540;--muted:#5d6a85;--faint:#93a0b5;--accent:#4f46e5;--accent-hover:#4338ca;--accent-soft:#eef2ff;--ok:#15803d;--ok-bg:#ecfdf5;--ok-border:#bcf0d2;--bad:#b91c1c;--bad-bg:#fef2f2;--bad-border:#fdd8d8;--warn:#92400e;--warn-bg:#fffbeb;--warn-border:#fbe38a;--topbar-bg:rgba(255,255,255,.88);--ring:rgba(79,70,229,.16);--shadow:0 1px 2px rgba(23,32,51,.04);--mono:ui-monospace,SFMono-Regular,Menlo,Consolas,'Courier New',monospace}
 [data-theme=dark]{color-scheme:dark;--bg:#0f1523;--surface:#161d2f;--surface-2:#1d2538;--border:#28324a;--border-strong:#3a4767;--text:#e4eaf5;--muted:#9aa6bd;--faint:#68748f;--accent:#818cf8;--accent-hover:#a5b4fc;--accent-soft:#232c52;--ok:#4ade80;--ok-bg:#122b20;--ok-border:#215239;--bad:#f87171;--bad-bg:#33181a;--bad-border:#5c2a2e;--warn:#fbbf24;--warn-bg:#30260f;--warn-border:#5e4a17;--topbar-bg:rgba(15,21,35,.88);--ring:rgba(129,140,248,.32);--shadow:0 1px 3px rgba(0,0,0,.35)}
@@ -19,6 +19,13 @@ main.container{padding-top:22px;padding-bottom:48px}
 .alert:not(:empty){display:block}
 .alert-error{background:var(--bad-bg);color:var(--bad);border:1px solid var(--bad-border)}
 .alert-warn{background:var(--warn-bg);color:var(--warn);border:1px solid var(--warn-border)}
+.toasts{position:fixed;top:16px;right:16px;z-index:100;display:flex;flex-direction:column;gap:8px;max-width:min(360px,92vw);pointer-events:none}
+.toast{pointer-events:auto;background:var(--surface);border:1px solid var(--border-strong);border-left-width:4px;border-radius:10px;padding:10px 14px;font-size:13px;line-height:1.45;box-shadow:0 8px 24px rgba(15,23,42,.18);animation:slideIn .22s ease;word-break:break-word}
+.toast-error{border-left-color:var(--bad);color:var(--bad)}
+.toast-ok{border-left-color:var(--ok);color:var(--ok)}
+.toast-warn{border-left-color:var(--warn);color:var(--warn)}
+.toast.fade{opacity:0;transform:translateX(12px);transition:opacity .3s,transform .3s}
+@keyframes slideIn{from{opacity:0;transform:translateX(16px)}to{opacity:1;transform:translateX(0)}}
 .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(190px,1fr));gap:12px;margin-bottom:18px}
 .stat{background:var(--surface);border:1px solid var(--border);border-radius:12px;padding:14px 16px;box-shadow:var(--shadow)}
 .stat-label{font-size:12px;font-weight:600;color:var(--muted)}
@@ -89,81 +96,73 @@ tbody tr:hover td{background:var(--surface-2)}
 #providerForm [name=baseUrl]{flex:1 1 220px;min-width:200px}
 #keyForm [name=id]{width:170px}
 #keyForm [name=value]{flex:1 1 220px;min-width:210px}
-#routeForm [name=model]{width:230px;font-family:var(--mono)}
 #providerForm>button,#keyForm>button,#routeForm>button{margin-left:auto}
-dialog{border:none;border-radius:14px;padding:0;width:min(460px,92vw);box-shadow:0 20px 60px rgba(15,23,42,.28)}
-dialog::backdrop{background:rgba(15,23,42,.45)}
-.dialog-body{padding:22px 24px}
-.dialog-title{margin:0 0 16px;font-size:15.5px;font-weight:700}
-.field{display:flex;flex-direction:column;gap:5px;margin-bottom:12px;font-size:12.5px;font-weight:600;color:var(--muted)}
-.field input{height:36px}
-.field-row{display:flex;gap:12px}
-.field-row .field{flex:1;min-width:0}
-.field-row input{width:100%}
-.dialog-actions{display:flex;justify-content:flex-end;gap:8px;margin-top:4px}
 @media(max-width:640px){.auto-note{display:none}.conn-badge{max-width:180px}}
 </style></head><body>
+<div id="toasts" class="toasts"></div>
 <header class="topbar"><div class="container topbar-inner">
 <div class="brand"><span class="logo" aria-hidden="true"></span><span>khat</span><span id="connection" class="conn-badge"></span></div>
-<div class="topbar-actions"><button id="themeToggle" class="btn btn-secondary btn-icon" type="button" title="切换深色 / 浅色模式">🌙</button><span class="auto-note">每 30 秒自动刷新</span><button id="refresh" class="btn btn-secondary" type="button">刷新</button></div>
+<div class="topbar-actions"><span class="auto-note" data-i18n="autoRefresh">每 30 秒自动刷新</span><button id="langToggle" class="btn btn-secondary btn-icon" type="button" data-i18n-aria="toggleLang" title="中文 / English">EN</button><button id="themeToggle" class="btn btn-secondary btn-icon" type="button" data-i18n-aria="toggleTheme" title="切换深色 / 浅色模式">🌙</button><button id="refresh" class="btn btn-secondary" type="button" data-i18n="refresh">刷新</button></div>
 </div></header>
 <main class="container">
 <p id="error" class="alert alert-error"></p>
 <p id="poolWarn" class="alert alert-warn"></p>
 <div class="stats">
-<div class="stat"><div class="stat-label">Provider 数量</div><div class="stat-value" id="statProviders">—</div><div class="stat-sub">已配置的服务商</div></div>
-<div class="stat"><div class="stat-label">Key 可用率</div><div class="stat-value" id="statKeys">—</div><div class="stat-sub" id="statKeysSub">—</div></div>
-<div class="stat"><div class="stat-label">近期请求成功率</div><div class="stat-value" id="statReq">—</div><div class="stat-sub" id="statReqSub">按最近一次拉取的日志统计</div></div>
-<div class="stat"><div class="stat-label">近期 Tokens 用量</div><div class="stat-value" id="statTokens">—</div><div class="stat-sub">输入 / 输出 合计</div></div>
+<div class="stat"><div class="stat-label" data-i18n="statProviders">Provider 数量</div><div class="stat-value" id="statProviders">—</div><div class="stat-sub" data-i18n="statProvidersSub">已配置的服务商</div></div>
+<div class="stat"><div class="stat-label" data-i18n="statKeys">Key 可用率</div><div class="stat-value" id="statKeys">—</div><div class="stat-sub" id="statKeysSub">—</div></div>
+<div class="stat"><div class="stat-label" data-i18n="statReq">近期请求成功率</div><div class="stat-value" id="statReq">—</div><div class="stat-sub" id="statReqSub" data-i18n="statReqSub">按最近一次拉取的日志统计</div></div>
+<div class="stat"><div class="stat-label" data-i18n="statTokens">近期 Tokens 用量</div><div class="stat-value" id="statTokens">—</div><div class="stat-sub" data-i18n="statTokensSub">输入 / 输出 合计</div></div>
 </div>
 <section class="card">
-<div class="card-head"><div><h2 class="card-title">Provider / Key 管理</h2><p class="card-sub">维护服务商、密钥池与轮询权重；下方筛选均在本地完成，不会请求服务端。</p></div></div>
-<form id="providerForm" class="toolbar" autocomplete="off"><input name="id" placeholder="provider id" required><input name="name" placeholder="名称"><input name="baseUrl" placeholder="https://api.example.com" required><select name="protocol"><option>openai</option><option>anthropic</option></select><button class="btn btn-primary">添加 Provider</button></form>
-<form id="keyForm" class="toolbar" autocomplete="off"><select name="provider" required></select><input name="id" placeholder="key id" required><input name="weight" type="number" min="1" step="1" value="1" title="轮询权重：该 key 在 Provider 内多个 key 间被选中的相对占比，默认 1"><input name="value" type="password" placeholder="API key 明文（加密存入密钥库）" required autocomplete="new-password"><button class="btn btn-primary">添加 Key</button></form>
-<div class="filter-bar"><input id="keySearch" type="search" placeholder="搜索 provider 名称 / baseUrl / key id / 错误原因…" aria-label="筛选 Key"><select id="keyStatus" aria-label="状态筛选"><option value="all">全部状态</option><option value="available">仅可用</option><option value="unavailable">仅不可用</option></select><span class="match-info" id="keyMatchInfo"></span></div>
+<div class="card-head"><div><h2 class="card-title" data-i18n="cardProviders">Provider / Key 管理</h2><p class="card-sub" data-i18n="cardProvidersSub">维护服务商、密钥池与轮询权重；下方筛选均在本地完成，不会请求服务端。</p></div></div>
+<form id="providerForm" class="toolbar" autocomplete="off"><input name="id" placeholder="provider id" data-i18n-ph="phProviderId" required><input name="name" placeholder="名称" data-i18n-ph="phName"><input name="baseUrl" placeholder="https://api.example.com" data-i18n-ph="phBaseUrl" required><select name="protocol"><option>openai</option><option>anthropic</option></select><button class="btn btn-primary" data-i18n="btnAddProvider">添加 Provider</button></form>
+<form id="keyForm" class="toolbar" autocomplete="off"><select name="provider" required></select><input name="id" placeholder="key id" data-i18n-ph="phKeyId" required><input name="weight" type="number" min="1" step="1" value="1" data-i18n-title="weightTitle"><input name="value" type="password" placeholder="API key 明文（加密存入密钥库）" data-i18n-ph="phKeyValue" required autocomplete="new-password"><button class="btn btn-primary" data-i18n="btnAddKey">添加 Key</button></form>
+<div class="filter-bar"><input id="keySearch" type="search" placeholder="搜索 provider 名称 / baseUrl / key id / 错误原因…" data-i18n-ph="phSearchKey" data-i18n-aria="keyFilterAria" aria-label="筛选 Key"><select id="keyStatus" data-i18n-aria="statusFilterAria" aria-label="状态筛选"><option value="all" data-i18n="allStatus">全部状态</option><option value="available" data-i18n="onlyAvail">仅可用</option><option value="unavailable" data-i18n="onlyUnavail">仅不可用</option></select><span class="match-info" id="keyMatchInfo"></span></div>
 <div id="providers"></div>
 </section>
 <section class="card">
-<div class="card-head"><div><h2 class="card-title">Routes</h2><p class="card-sub">模型到 Provider 的转发映射规则。</p></div></div>
-<form id="routeForm" class="toolbar" autocomplete="off"><input name="model" placeholder="model" required><select name="provider" required></select><button class="btn btn-primary">添加 Route</button></form>
-<div class="table-wrap"><table><thead><tr><th>Model</th><th>Provider</th><th></th></tr></thead><tbody id="routes"></tbody></table></div>
+<div class="card-head"><div><h2 class="card-title" data-i18n="cardRoutes">Routes</h2><p class="card-sub" data-i18n="cardRoutesSub">模型到 Provider 的转发映射规则。</p></div></div>
+<form id="routeForm" class="toolbar" autocomplete="off"><select name="provider" required></select><select name="models" multiple size="5" required aria-label="models"></select><button type="button" id="routeModels" class="btn btn-secondary" data-i18n="btnLoadModels">获取模型</button><button class="btn btn-primary" data-i18n="btnAddRoute">批量添加 Route</button></form>
+<div class="table-wrap"><table><thead><tr><th data-i18n="thModel">Model</th><th data-i18n="thProvider">Provider</th><th data-i18n="thStatus">Status</th><th></th></tr></thead><tbody id="routes"></tbody></table></div>
 </section>
 <section class="card">
-<div class="card-head"><div><h2 class="card-title">请求成功 / 失败趋势</h2><p class="card-sub">将最近拉取的日志按时间分桶聚合（最多 30 桶），悬停柱体可查看详情。</p></div><span class="legend"><span><i class="swatch ok"></i>成功</span><span><i class="swatch bad"></i>失败</span></span></div>
-<div class="chart-box"><svg id="traffic" role="img" aria-label="request success/failure trend"></svg><div id="chartEmpty" class="chart-empty" hidden>暂无请求记录</div></div>
+<div class="card-head"><div><h2 class="card-title" data-i18n="cardTraffic">请求成功 / 失败趋势</h2><p class="card-sub" data-i18n="cardTrafficSub">将最近拉取的日志按时间分桶聚合（最多 30 桶），悬停柱体可查看详情。</p></div><span class="legend"><span><i class="swatch ok"></i><span data-i18n="legendOk">成功</span></span><span><i class="swatch bad"></i><span data-i18n="legendFail">失败</span></span></span></div>
+<div class="chart-box"><svg id="traffic" role="img" data-i18n-aria="trafficAria" aria-label="request success/failure trend"></svg><div id="chartEmpty" class="chart-empty" hidden data-i18n="chartEmpty">暂无请求记录</div></div>
 </section>
 <section class="card">
-<div class="card-head"><div><h2 class="card-title">Logs</h2><p class="card-sub">最近的转发日志；关键字与结果类型为本地即时筛选，修改“条数”才会重新拉取。</p></div></div>
-<div class="filter-bar"><input id="logFilter" type="search" placeholder="按 model / key / provider / status 筛选…"><select id="logStatus" aria-label="结果筛选"><option value="all">全部结果</option><option value="ok">仅成功</option><option value="fail">仅失败</option></select><select id="logTail" aria-label="日志条数"><option value="100" selected>最近 100 条</option><option value="300">最近 300 条</option><option value="1000">最近 1000 条</option></select><span class="match-info" id="logMatchInfo"></span></div>
-<div class="table-wrap"><table><thead><tr><th>Time</th><th>Status</th><th>Provider</th><th>Key</th><th>Model</th><th class="num">Duration</th><th class="num">Tokens in/out</th></tr></thead><tbody id="logs"></tbody></table></div>
+<div class="card-head"><div><h2 class="card-title" data-i18n="cardLogs">Logs</h2><p class="card-sub" data-i18n="cardLogsSub">最近的转发日志；关键字与结果类型为本地即时筛选，修改“条数”才会重新拉取。</p></div></div>
+<div class="filter-bar"><input id="logFilter" type="search" placeholder="按 model / key / provider / status 筛选…" data-i18n-ph="phFilterLog"><select id="logStatus" data-i18n-aria="resultFilterAria" aria-label="结果筛选"><option value="all" data-i18n="allResult">全部结果</option><option value="ok" data-i18n="onlyOk">仅成功</option><option value="fail" data-i18n="onlyFail">仅失败</option></select><select id="logTail" data-i18n-aria="logCountAria" aria-label="日志条数"><option value="100" selected data-i18n="logTail100">最近 100 条</option><option value="300" data-i18n="logTail300">最近 300 条</option><option value="1000" data-i18n="logTail1000">最近 1000 条</option></select><span class="match-info" id="logMatchInfo"></span></div>
+<div class="table-wrap"><table><thead><tr><th data-i18n="thTime">Time</th><th data-i18n="thStatus">Status</th><th data-i18n="thProvider">Provider</th><th data-i18n="thKey">Key</th><th data-i18n="thModel">Model</th><th class="num" data-i18n="thDuration">Duration</th><th class="num" data-i18n="thTokensInOut">Tokens in/out</th></tr></thead><tbody id="logs"></tbody></table></div>
 </section>
 </main>
-<dialog id="keyEdit"><div class="dialog-body"><h3 class="dialog-title">编辑 Key</h3><form id="keyEditForm" autocomplete="off">
-<label class="field">Provider<input name="provider" readonly></label>
-<label class="field">Key id<input name="id" readonly></label>
-<div class="field-row"><label class="field">权重<input name="weight" type="number" min="1" step="1" value="1" title="轮询权重：该 key 在 Provider 内多个 key 间被选中的相对占比"></label><label class="field">新 API key（留空保持不变）<input name="value" type="password" autocomplete="new-password" placeholder="sk-…"></label></div>
-<footer class="dialog-actions"><button type="button" id="keyEditCancel" class="btn btn-secondary">取消</button><button class="btn btn-primary">保存</button></footer>
-</form></div></dialog>
 <script type="module">
 const $=s=>document.querySelector(s), error=$('#error');
 const NS='http://www.w3.org/2000/svg';
 const pad2=n=>String(n).padStart(2,'0');
 const state={status:null,logs:[],logTail:'100',keyKeyword:'',keyStatus:'all',logKeyword:'',logStatus:'all'};
-async function api(path,init={}){const r=await fetch(path,{...init,headers:{authorization:'Bearer '+sessionStorage.khatSession,'content-type':'application/json',...(init.headers||{})}});const body=await r.json().catch(()=>({}));if(!r.ok)throw Error(body.error?.message||r.statusText);return body}
-async function exchange(){const ticket=new URLSearchParams(location.search).get('ticket');if(sessionStorage.khatSession){if(ticket)window.history.replaceState({},'', '/_keys/ui');return}if(ticket){const r=await fetch('/_keys/ticket/session',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})});if(!r.ok)throw Error('票据无效或已过期');sessionStorage.khatSession=(await r.json()).session;window.history.replaceState({},'', '/_keys/ui')}if(!sessionStorage.khatSession)throw Error('请通过 khat ui 打开此页面')}
+const I18N={
+ zh:{title:'khat 密钥管理',toggleTheme:'切换深色 / 浅色模式',toggleLang:'切换语言',keyFilterAria:'筛选 Key',statusFilterAria:'状态筛选',resultFilterAria:'结果筛选',logCountAria:'日志条数',autoRefresh:'每 30 秒自动刷新',refresh:'刷新',statProviders:'Provider 数量',statProvidersSub:'已配置的服务商',statKeys:'Key 可用率',statReq:'近期请求成功率',statReqSub:'按最近一次拉取的日志统计',statTokens:'近期 Tokens 用量',statTokensSub:'输入 / 输出 合计',cardProviders:'Provider / Key 管理',cardProvidersSub:'维护服务商、密钥池与轮询权重；下方筛选均在本地完成，不会请求服务端。',phProviderId:'provider id',phName:'名称',phBaseUrl:'https://api.example.com',btnAddProvider:'添加 Provider',phKeyId:'key id',weightTitle:'轮询权重：该 key 在 Provider 内多个 key 间被选中的相对占比，默认 1',phKeyValue:'API key 明文（加密存入密钥库）',btnAddKey:'添加 Key',phSearchKey:'搜索 provider 名称 / baseUrl / key id / 错误原因…',allStatus:'全部状态',onlyAvail:'仅可用',onlyUnavail:'仅不可用',cardRoutes:'Routes',cardRoutesSub:'模型到 Provider 的转发映射规则。',phModel:'model',btnAddRoute:'批量添加 Route',btnLoadModels:'获取模型',thModel:'Model',thProvider:'Provider',cardTraffic:'请求成功 / 失败趋势',cardTrafficSub:'将最近拉取的日志按时间分桶聚合（最多 30 桶），悬停柱体可查看详情。',legendOk:'成功',legendFail:'失败',chartEmpty:'暂无请求记录',cardLogs:'Logs',cardLogsSub:'最近的转发日志；关键字与结果类型为本地即时筛选，修改“条数”才会重新拉取。',phFilterLog:'按 model / key / provider / status 筛选…',allResult:'全部结果',onlyOk:'仅成功',onlyFail:'仅失败',logTail100:'最近 100 条',logTail300:'最近 300 条',logTail1000:'最近 1000 条',thTime:'Time',thStatus:'Status',thDuration:'Duration',thTokensInOut:'Tokens in/out',thKey:'Key',thWeight:'Weight',thRequests:'Requests',thFailed:'Failed',thErrReason:'错误原因',thActions:'操作',avail:'可用',unavail:'不可用',disabled:'已停用',noKeysMatch:'没有符合筛选条件的 key',noKeysYet:'该 Provider 尚未添加 key，可在上方表单中添加',keyMatchInfo:'匹配 {k} / {t} 个 key · 显示 {p} 个 Provider',noProviderMatch:'没有匹配的 Provider 或 Key，试试调整关键字或状态筛选。',noRoutes:'暂无路由配置',noLogs:'暂无请求日志',noLogMatch:'没有匹配的日志，试试调整筛选条件。',poolWarn:'Provider {p} 没有可用的 Key，请恢复或探活后再重试。',btnDisable:'停用',btnRecover:'恢复',btnProbe:'探活',btnDelete:'删除',confirmDelKey:'删除 key {p}/{k}？',saved:'已保存',errOpenViaUi:'请通过 khat ui 打开此页面',errTicket:'票据无效或已过期',err401:'401 未授权（key 无效或被撤销）',err402:'402 余额不足',err429:'429 限速',errHttp:'HTTP {h} 错误',errOccurredAt:'发生于',trafficTip:'{t}：成功 {ok} 次 · 失败 {bad} 次',showLogs:'显示 {n} / {t} 条',statKeysSubTpl:'可用 {a} 个 · 共 {t} 个',statReqSubTpl:'成功 {ok} 次 · 失败 {fail} 次',keyCountTpl:'{n} 个 key',trafficAria:'请求成功 / 失败趋势'},
+ en:{title:'khat Key Manager',toggleTheme:'Toggle dark / light theme',toggleLang:'Switch language',keyFilterAria:'Filter keys',statusFilterAria:'Filter by status',resultFilterAria:'Filter by result',logCountAria:'Log count',autoRefresh:'Auto-refresh every 30s',refresh:'Refresh',statProviders:'Providers',statProvidersSub:'Configured services',statKeys:'Key availability',statReq:'Recent success rate',statReqSub:'From last fetched logs',statTokens:'Recent tokens',statTokensSub:'Input / Output total',cardProviders:'Provider / Key Management',cardProvidersSub:'Manage providers, key pools and weights; filtering is local only.',phProviderId:'provider id',phName:'Name',phBaseUrl:'https://api.example.com',btnAddProvider:'Add Provider',phKeyId:'key id',weightTitle:'Polling weight: relative share among keys in this provider, default 1',phKeyValue:'API key plaintext (stored encrypted)',btnAddKey:'Add Key',phSearchKey:'Search provider / baseUrl / key id / error…',allStatus:'All status',onlyAvail:'Available only',onlyUnavail:'Unavailable only',cardRoutes:'Routes',cardRoutesSub:'Model-to-Provider forwarding rules.',phModel:'model',btnAddRoute:'Batch add Routes',btnLoadModels:'Load models',thModel:'Model',thProvider:'Provider',cardTraffic:'Request success / failure trend',cardTrafficSub:'Aggregates recent logs into time buckets (max 30). Hover bars for detail.',legendOk:'Success',legendFail:'Failure',chartEmpty:'No request records',cardLogs:'Logs',cardLogsSub:'Recent forwarding logs; keyword & result filtering is local; changing count re-fetches.',phFilterLog:'Filter by model / key / provider / status…',allResult:'All results',onlyOk:'Success only',onlyFail:'Failure only',logTail100:'Last 100',logTail300:'Last 300',logTail1000:'Last 1000',thTime:'Time',thStatus:'Status',thDuration:'Duration',thTokensInOut:'Tokens in/out',thKey:'Key',thWeight:'Weight',thRequests:'Requests',thFailed:'Failed',thErrReason:'Error reason',thActions:'Actions',avail:'Available',unavail:'Unavailable',disabled:'Disabled',noKeysMatch:'No keys match the filters',noKeysYet:'No keys yet for this provider; add via the form above',keyMatchInfo:'{k} / {t} keys matched · {p} providers shown',noProviderMatch:'No matching provider or key; adjust filters.',noRoutes:'No routes configured',noLogs:'No request logs',noLogMatch:'No matching logs; adjust filters.',poolWarn:'Provider {p} has no available keys. Recover or probe a key before retrying.',btnDisable:'Disable',btnRecover:'Enable',btnProbe:'Probe',btnDelete:'Delete',confirmDelKey:'Delete key {p}/{k}?',saved:'Saved',errOpenViaUi:'Please open this page via khat ui',errTicket:'Ticket invalid or expired',err401:'401 Unauthorized (key invalid or revoked)',err402:'402 Insufficient balance',err429:'429 Rate limited',errHttp:'HTTP {h} error',errOccurredAt:'at',trafficTip:'{t}: {ok} ok · {bad} failed',showLogs:'Showing {n} / {t}',statKeysSubTpl:'{a} available · {t} total',statReqSubTpl:'{ok} ok · {fail} failed',keyCountTpl:'{n} keys',trafficAria:'request success/failure trend'}
+};
+let lang=(()=>{try{return localStorage.getItem('khatLang')==='en'?'en':'zh'}catch(e){return 'zh'}})();
+function t(key){return (I18N[lang]&&I18N[lang][key])||I18N.zh[key]||key}
+function tf(key,vars){let s=t(key);if(vars)for(const k in vars)s=s.split('{'+k+'}').join(String(vars[k]));return s}
+function applyLang(l){lang=l;try{localStorage.setItem('khatLang',l)}catch(e){}document.documentElement.lang=l==='en'?'en':'zh-CN';document.querySelectorAll('[data-i18n]').forEach(el=>{el.textContent=t(el.dataset.i18n)});document.querySelectorAll('[data-i18n-ph]').forEach(el=>{el.placeholder=t(el.dataset.i18nPh)});document.querySelectorAll('[data-i18n-title]').forEach(el=>{el.title=t(el.dataset.i18nTitle)});document.querySelectorAll('[data-i18n-aria]').forEach(el=>{el.setAttribute('aria-label',t(el.dataset.i18nAria))});renderConnection();renderStats();renderProviders();renderRoutes();renderLogs();drawTraffic();const b=$('#langToggle');if(b)b.textContent=l==='zh'?'EN':'中'}
+function toast(msg,type,ms){type=type||'error';ms=ms||3500;const c=$('#toasts');if(!c)return;const el=document.createElement('div');el.className='toast toast-'+type;el.textContent=msg;c.append(el);setTimeout(()=>{el.classList.add('fade');setTimeout(()=>el.remove(),300)},ms)}
+async function api(path,init){init=init||{};const r=await fetch(path,{...init,headers:{authorization:'Bearer '+sessionStorage.khatSession,'content-type':'application/json',...(init.headers||{})}});const body=await r.json().catch(()=>({}));if(!r.ok)throw Error(body.error?.message||r.statusText);return body}
+async function exchange(){const ticket=new URLSearchParams(location.search).get('ticket');if(sessionStorage.khatSession){if(ticket)window.history.replaceState({},'', '/_keys/ui');return}if(ticket){const r=await fetch('/_keys/ticket/session',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})});if(!r.ok)throw Error(t('errTicket'));sessionStorage.khatSession=(await r.json()).session;window.history.replaceState({},'', '/_keys/ui')}if(!sessionStorage.khatSession)throw Error(t('errOpenViaUi'))}
 function cell(v,cls){const e=document.createElement('td');if(cls)e.className=cls;e.textContent=v==null?'—':String(v);return e}
 function fmtNum(n){return n>=100000?Math.round(n/1000)+'k':n>=10000?(n/1000).toFixed(1)+'k':String(n)}
 function fmtHM(m){const d=new Date(m*60000);return pad2(d.getHours())+':'+pad2(d.getMinutes())}
 function formatTs(ts){const d=new Date(ts);if(isNaN(d.getTime()))return String(ts);const day=d.toDateString()===new Date().toDateString()?'':(d.getMonth()+1)+'-'+d.getDate()+' ';return day+pad2(d.getHours())+':'+pad2(d.getMinutes())+':'+pad2(d.getSeconds())}
-function errText(k){const http=k.lastError&&k.lastError.http;if(http===undefined)return '—';return ({401:'401 未授权（key 无效或被撤销）',402:'402 余额不足',429:'429 限速'})[http]||('HTTP '+http+' 错误')}
+function errText(k){const http=k.lastError&&k.lastError.http;if(http===undefined)return '—';if(http===401)return t('err401');if(http===402)return t('err402');if(http===429)return t('err429');return tf('errHttp',{h:http})}
 function btn(label,className,onclick){const b=document.createElement('button');b.type='button';b.className=className;b.textContent=label;b.onclick=onclick;return b}
-function run(fn){return async arg=>{try{await fn(arg)}catch(e){error.textContent=e.message}}}
+function run(fn){return async arg=>{try{await fn(arg)}catch(e){error.textContent=e.message;toast(e.message)}}}
 function statusCell(ok,text,title){const td=document.createElement('td');const sp=document.createElement('span');sp.className='pill pill-status '+(ok?'pill-ok':'pill-bad');sp.textContent=text;if(title)sp.title=title;td.append(sp);return td}
 function syncProviderSelect(sel,providers){const ids=providers.map(p=>p.id).join(',');if(sel.dataset.ids===ids)return;sel.dataset.ids=ids;const prev=sel.value;sel.replaceChildren(...providers.map(p=>{const o=document.createElement('option');o.value=p.id;o.textContent=p.id;return o}));if(ids.split(',').includes(prev))sel.value=prev}
-function openKeyEdit(providerId,keyId,weight){const d=$('#keyEdit');d.querySelector('[name=provider]').value=providerId;d.querySelector('[name=id]').value=keyId;d.querySelector('[name=weight]').value=weight;d.querySelector('[name=value]').value='';d.showModal();d.querySelector('[name=weight]').focus()}
-function renderConnection(){const c=$('#connection');c.replaceChildren(Object.assign(document.createElement('i'),{className:'dot'}),document.createTextNode(' '+state.status.listen))}
-function renderStats(){const st=state.status;if(!st)return;const keys=[];for(const p of st.providers)for(const k of p.keys)keys.push(k);const avail=keys.filter(k=>k.status==='available').length;$('#statProviders').textContent=String(st.providers.length);$('#statKeys').textContent=keys.length?Math.round(avail*100/keys.length)+'%':'—';$('#statKeysSub').textContent='可用 '+avail+' 个 · 共 '+keys.length+' 个';let ok=0,fail=0,tIn=0,tOut=0;for(const x of state.logs){if(Number(x.status)<400)ok++;else fail++;tIn+=x.tokensIn||0;tOut+=x.tokensOut||0}const total=ok+fail;$('#statReq').textContent=total?Math.round(ok*100/total)+'%':'—';$('#statReqSub').textContent='成功 '+ok+' 次 · 失败 '+fail+' 次';$('#statTokens').textContent=total?fmtNum(tIn)+' / '+fmtNum(tOut):'—'}
-function providerHead(p,keys){const head=document.createElement('div');head.className='provider-head';const nm=document.createElement('h3');nm.className='provider-name';nm.textContent=p.name||p.id;nm.title=p.id;head.append(nm);const pp=document.createElement('span');pp.className='pill protocol-pill';pp.textContent=p.protocol;head.append(pp);const url=document.createElement('span');url.className='provider-url';url.textContent=p.baseUrl||'';url.title=p.baseUrl||'';head.append(url);const cnt=document.createElement('span');cnt.className='provider-count';cnt.textContent=keys.length+(keys.length!==p.keys.length?' / '+p.keys.length:'')+' 个 key';head.append(cnt);return head}
+function renderConnection(){if(!state.status)return;const c=$('#connection');c.replaceChildren(Object.assign(document.createElement('i'),{className:'dot'}),document.createTextNode(' '+state.status.listen))}
+function renderStats(){const st=state.status;if(!st)return;const keys=[];for(const p of st.providers)for(const k of p.keys)keys.push(k);const avail=keys.filter(k=>k.enabled!==false&&k.status==='available').length;$('#statProviders').textContent=String(st.providers.length);$('#statKeys').textContent=keys.length?Math.round(avail*100/keys.length)+'%':'—';$('#statKeysSub').textContent=keys.length?tf('statKeysSubTpl',{a:avail,t:keys.length}):'—';let ok=0,fail=0,tIn=0,tOut=0;for(const x of state.logs){if(Number(x.status)<400)ok++;else fail++;tIn+=x.tokensIn||0;tOut+=x.tokensOut||0}const total=ok+fail;$('#statReq').textContent=total?Math.round(ok*100/total)+'%':'—';$('#statReqSub').textContent=tf('statReqSubTpl',{ok:ok,fail:fail});$('#statTokens').textContent=total?fmtNum(tIn)+' / '+fmtNum(tOut):'—'}
+function providerHead(p,keys){const head=document.createElement('div');head.className='provider-head';const nm=document.createElement('h3');nm.className='provider-name';nm.textContent=p.name||p.id;nm.title=p.id;head.append(nm);const pp=document.createElement('span');pp.className='pill protocol-pill';pp.textContent=p.protocol;head.append(pp);const url=document.createElement('span');url.className='provider-url';url.textContent=p.baseUrl||'';url.title=p.baseUrl||'';head.append(url);const cnt=document.createElement('span');cnt.className='provider-count';cnt.textContent=tf('keyCountTpl',{n:keys.length+(keys.length!==p.keys.length?(' / '+p.keys.length):'')});head.append(cnt);return head}
 function renderProviders(){
  const box=$('#providers');box.replaceChildren();
  const st=state.status;if(!st)return;
@@ -177,11 +176,13 @@ function renderProviders(){
   if(p.keys.length&&!keys.length)continue;
   if(!p.keys.length&&!hitMeta)continue;
   shownP++;shownK+=keys.length;
+  const hasAvailableKey=p.keys.some(k=>k.enabled!==false&&k.status==='available');
   const blk=document.createElement('div');blk.className='provider-block';
   blk.append(providerHead(p,keys));
+  if(p.keys.length&&!hasAvailableKey){const warn=document.createElement('p');warn.className='alert alert-warn';warn.textContent=tf('poolWarn',{p:p.name||p.id});blk.append(warn)}
   const tw=document.createElement('div');tw.className='table-wrap';
   const table=document.createElement('table');
-  table.innerHTML='<thead><tr><th>Key</th><th>Weight</th><th>Status</th><th class="num">Requests</th><th class="num">Failed</th><th class="num">Tokens in/out</th><th>错误原因</th><th>操作</th></tr></thead>';
+  table.innerHTML='<thead><tr><th>'+t('thKey')+'</th><th>'+t('thWeight')+'</th><th>'+t('thStatus')+'</th><th class="num">'+t('thRequests')+'</th><th class="num">'+t('thFailed')+'</th><th class="num">'+t('thTokensInOut')+'</th><th>'+t('thErrReason')+'</th><th>'+t('thActions')+'</th></tr></thead>';
   const tb=document.createElement('tbody');
   for(const k of keys){
    const tr=document.createElement('tr');
@@ -190,40 +191,39 @@ function renderProviders(){
    if(k.secret){const sk=document.createElement('span');sk.className='key-secret';sk.textContent=k.secret;kt.append(sk)}
    tr.append(kt);
    tr.append(cell(k.weight,'num'));
-   tr.append(statusCell(k.status==='available',k.status==='available'?'可用':'不可用',k.lastError?errText(k)+(k.lastError.at?' · 发生于 '+k.lastError.at:''):''));
+   tr.append(statusCell(k.enabled!==false&&k.status==='available',k.enabled===false?t('disabled'):(k.status==='available'?t('avail'):t('unavail')),k.lastError?errText(k)+(k.lastError.at?' · '+t('errOccurredAt')+' '+k.lastError.at:''):''));
    tr.append(cell(k.counters.requests||0,'num'),cell(k.counters.failed||0,'num'),cell((k.counters.tokensIn||0)+' / '+(k.counters.tokensOut||0),'num'));
-   const et=document.createElement('td');et.textContent=errText(k);et.className=k.lastError?'err-text':'err-text none';if(k.lastError)et.title='发生时间 '+k.lastError.at;
+   const et=document.createElement('td');et.textContent=errText(k);et.className=k.lastError?'err-text':'err-text none';if(k.lastError)et.title=t('errOccurredAt')+' '+k.lastError.at;
    tr.append(et);
    const ac=document.createElement('td');
    const rowA=document.createElement('div');rowA.className='row-actions';
-   const wInput=document.createElement('input');wInput.type='number';wInput.min='1';wInput.step='1';wInput.value=k.weight;wInput.title='权重：改完失焦即保存';
-   wInput.onchange=run(async()=>{await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id),{method:'PUT',body:JSON.stringify({weight:Number(wInput.value)})});load()});
+   const wInput=document.createElement('input');wInput.type='number';wInput.min='1';wInput.step='1';wInput.value=k.weight;wInput.title=t('weightTitle');
+   wInput.onchange=run(async()=>{await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id),{method:'PUT',body:JSON.stringify({weight:Number(wInput.value)})});toast(t('saved'),'ok');load()});
    rowA.append(wInput);
-   for(const pair of [['恢复','enable'],['探活','probe']]){
-    const b=btn(pair[0],'btn btn-secondary btn-sm',run(async()=>{await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id)+'/'+pair[1],{method:'POST'});load()}));
-    b.disabled=pair[0]==='恢复'&&k.status==='available';
-    rowA.append(b);
-   }
-   rowA.append(btn('编辑','btn btn-secondary btn-sm',()=>openKeyEdit(p.id,k.id,k.weight)));
-   rowA.append(btn('删除','btn btn-danger btn-sm',run(async()=>{if(confirm('删除 key '+p.id+'/'+k.id+'？')){await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id),{method:'DELETE'});load()}})));
+   rowA.append(btn(k.enabled!==false?t('btnDisable'):t('btnRecover'),'btn btn-secondary btn-sm',run(async()=>{await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id)+'/'+(k.enabled!==false?'disable':'enable'),{method:'POST'});toast(t('saved'),'ok');load()})));
+   rowA.append(btn(t('btnProbe'),'btn btn-secondary btn-sm',run(async()=>{await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id)+'/probe',{method:'POST'});toast(t('saved'),'ok');load()})));
+
+   rowA.append(btn(t('btnDelete'),'btn btn-danger btn-sm',run(async()=>{if(confirm(tf('confirmDelKey',{p:p.id,k:k.id}))){await api('/_keys/providers/'+encodeURIComponent(p.id)+'/keys/'+encodeURIComponent(k.id),{method:'DELETE'});toast(t('saved'),'ok');load()}})));
    ac.append(rowA);tr.append(ac);
    tb.append(tr);
   }
-  if(!keys.length){const er=document.createElement('tr');er.className='empty-row';const ed=document.createElement('td');ed.colSpan=8;ed.textContent=p.keys.length?'没有符合筛选条件的 key':'该 Provider 尚未添加 key，可在上方表单中添加';er.append(ed);tb.append(er)}
+  if(!keys.length){const er=document.createElement('tr');er.className='empty-row';const ed=document.createElement('td');ed.colSpan=8;ed.textContent=p.keys.length?t('noKeysMatch'):t('noKeysYet');er.append(ed);tb.append(er)}
   table.append(tb);tw.append(table);blk.append(tw);box.append(blk);
  }
- $('#keyMatchInfo').textContent='匹配 '+shownK+' / '+totalK+' 个 key · 显示 '+shownP+' 个 Provider';
- if(shownP===0){const em=document.createElement('div');em.className='empty-state';em.textContent='没有匹配的 Provider 或 Key，试试调整关键字或状态筛选。';box.append(em)}
+ $('#keyMatchInfo').textContent=tf('keyMatchInfo',{k:shownK,t:totalK,p:shownP});
+ if(shownP===0){const em=document.createElement('div');em.className='empty-state';em.textContent=t('noProviderMatch');box.append(em)}
 }
 function renderRoutes(){
  const tb=$('#routes');tb.replaceChildren();
  const rs=state.status?state.status.routes:[];
- if(!rs.length){const er=document.createElement('tr');er.className='empty-row';const ed=document.createElement('td');ed.colSpan=3;ed.textContent='暂无路由配置';er.append(ed);tb.append(er);return}
+ if(!rs.length){const er=document.createElement('tr');er.className='empty-row';const ed=document.createElement('td');ed.colSpan=4;ed.textContent=t('noRoutes');er.append(ed);tb.append(er);return}
  for(const rt of rs){
   const tr=document.createElement('tr');
-  tr.append(cell(rt.model,'mono-cell'),cell(rt.provider));
+  tr.append(cell(rt.model,'mono-cell'),cell(rt.provider),statusCell(rt.enabled!==false,rt.enabled!==false?t('avail'):t('unavail')));
   const d=document.createElement('td');
-  d.append(btn('删除','btn btn-danger btn-sm',run(async()=>{await api('/_keys/routes?model='+encodeURIComponent(rt.model),{method:'DELETE'});load()})));
+  const toggle=rt.enabled!==false?'disable':'enable';
+  d.append(btn(rt.enabled!==false?t('btnDisable'):t('btnRecover'),'btn btn-secondary btn-sm',run(async()=>{await api('/_keys/routes/'+toggle+'?model='+encodeURIComponent(rt.model),{method:'POST'});toast(t('saved'),'ok');load()})));
+  d.append(btn(t('btnDelete'),'btn btn-danger btn-sm',run(async()=>{await api('/_keys/routes?model='+encodeURIComponent(rt.model),{method:'DELETE'});toast(t('saved'),'ok');load()})));
   tr.append(d);tb.append(tr);
  }
 }
@@ -236,8 +236,8 @@ function renderLogs(){
   if(!kw)return true;
   return [x.model,x.key,x.provider,x.status].some(v=>String(v).toLowerCase().includes(kw));
  });
- $('#logMatchInfo').textContent='显示 '+rows.length+' / '+state.logs.length+' 条';
- if(!rows.length){const er=document.createElement('tr');er.className='empty-row';const ed=document.createElement('td');ed.colSpan=7;ed.textContent=state.logs.length?'没有匹配的日志，试试调整筛选条件。':'暂无请求日志';er.append(ed);tb.append(er);return}
+ $('#logMatchInfo').textContent=tf('showLogs',{n:rows.length,t:state.logs.length});
+ if(!rows.length){const er=document.createElement('tr');er.className='empty-row';const ed=document.createElement('td');ed.colSpan=7;ed.textContent=state.logs.length?t('noLogMatch'):t('noLogs');er.append(ed);tb.append(er);return}
  for(const e of rows){
   const r=document.createElement('tr');
   r.append(cell(formatTs(e.ts),'mono-cell'));
@@ -253,7 +253,7 @@ function drawTraffic(){
  const svg=$('#traffic');svg.replaceChildren();
  const emptyBox=$('#chartEmpty');
  const times=[];
- for(const x of state.logs){const t=new Date(x.ts).getTime();if(Number.isFinite(t))times.push({m:Math.floor(t/60000),ok:Number(x.status)<400})}
+ for(const x of state.logs){const t0=new Date(x.ts).getTime();if(Number.isFinite(t0))times.push({m:Math.floor(t0/60000),ok:Number(x.status)<400})}
  if(!times.length){emptyBox.hidden=false;return}
  emptyBox.hidden=true;
  let minM=Infinity,maxM=-Infinity;
@@ -272,12 +272,22 @@ function drawTraffic(){
   if(!b)continue;
   const total=b.ok+b.bad,h=total/peak*(axisY-topPad),badH=b.bad/total*h,rx=Math.min(3,bw/3);
   const g=document.createElementNS(NS,'g');
-  const ti=document.createElementNS(NS,'title');ti.textContent=fmtHM(startM)+'：成功 '+b.ok+' 次 · 失败 '+b.bad+' 次';g.append(ti);
+  const ti=document.createElementNS(NS,'title');ti.textContent=tf('trafficTip',{t:fmtHM(startM),ok:b.ok,bad:b.bad});g.append(ti);
   if(b.ok)g.append(mk('rect',{x:(cx-bw/2).toFixed(1),y:(axisY-h+badH).toFixed(1),width:bw.toFixed(1),height:(h-badH).toFixed(1),rx:rx,fill:'#10b981'}));
   if(b.bad)g.append(mk('rect',{x:(cx-bw/2).toFixed(1),y:(axisY-h).toFixed(1),width:bw.toFixed(1),height:badH.toFixed(1),rx:rx,fill:'#ef4444'}));
   svg.append(g);
  }
 }
+async function loadModels(){
+ const provider=$('#routeForm [name=provider]').value;
+ const select=$('#routeForm [name=models]');
+ select.replaceChildren();
+ if(!provider)return;
+ try{
+  const r=await api('/_keys/providers/'+encodeURIComponent(provider)+'/models');
+  for(const model of r.models||[]){const o=document.createElement('option');o.value=model;o.textContent=model;select.append(o)}
+ }catch(e){error.textContent=e.message;toast(e.message)}
+}
 async function load(){
  try{
   await exchange();
@@ -292,16 +302,17 @@ async function load(){
   renderRoutes();
   renderLogs();
   drawTraffic();
- }catch(e){error.textContent=e.message}
+ }catch(e){error.textContent=e.message;toast(e.message)}
 }
-function applyTheme(t){document.documentElement.setAttribute('data-theme',t);try{localStorage.setItem('khatTheme',t)}catch(e){}const b=$('#themeToggle');b.textContent=t==='dark'?'☀️':'🌙';b.setAttribute('aria-label',t==='dark'?'切换浅色模式':'切换深色模式')}
+function applyTheme(theme){document.documentElement.setAttribute('data-theme',theme);try{localStorage.setItem('khatTheme',theme)}catch(e){}const b=$('#themeToggle');b.textContent=theme==='dark'?'☀️':'🌙';b.setAttribute('aria-label',t('toggleTheme'))}
 $('#themeToggle').onclick=()=>applyTheme(document.documentElement.getAttribute('data-theme')==='dark'?'light':'dark');
+$('#langToggle').onclick=()=>applyLang(lang==='zh'?'en':'zh');
 applyTheme(document.documentElement.getAttribute('data-theme')||'light');
-$('#providerForm').onsubmit=run(async e=>{e.preventDefault();const x=Object.fromEntries(new FormData(e.target));await api('/_keys/providers',{method:'POST',body:JSON.stringify(x)});e.target.reset();load()});
-$('#keyForm').onsubmit=run(async e=>{e.preventDefault();const x=Object.fromEntries(new FormData(e.target));await api('/_keys/providers/'+encodeURIComponent(x.provider)+'/keys',{method:'POST',body:JSON.stringify({id:x.id,value:x.value,weight:Number(x.weight)||1})});e.target.reset();load()});
-$('#routeForm').onsubmit=run(async e=>{e.preventDefault();await api('/_keys/routes',{method:'POST',body:JSON.stringify(Object.fromEntries(new FormData(e.target)))});e.target.reset();load()});
-$('#keyEditForm').onsubmit=run(async e=>{e.preventDefault();const d=$('#keyEdit'),provider=d.querySelector('[name=provider]').value,id=d.querySelector('[name=id]').value,body={weight:Number(d.querySelector('[name=weight]').value)||1},v=d.querySelector('[name=value]').value.trim();if(v)body.value=v;await api('/_keys/providers/'+encodeURIComponent(provider)+'/keys/'+encodeURIComponent(id),{method:'PUT',body:JSON.stringify(body)});d.close();load()});
-$('#keyEditCancel').onclick=()=>$('#keyEdit').close();
+applyLang(lang);
+$('#routeModels').onclick=()=>loadModels();
+$('#providerForm').onsubmit=run(async e=>{e.preventDefault();const x=Object.fromEntries(new FormData(e.target));await api('/_keys/providers',{method:'POST',body:JSON.stringify(x)});e.target.reset();toast(t('saved'),'ok');load()});
+$('#keyForm').onsubmit=run(async e=>{e.preventDefault();const x=Object.fromEntries(new FormData(e.target));await api('/_keys/providers/'+encodeURIComponent(x.provider)+'/keys',{method:'POST',body:JSON.stringify({id:x.id,value:x.value,weight:Number(x.weight)||1})});e.target.reset();toast(t('saved'),'ok');load()});
+$('#routeForm').onsubmit=run(async e=>{e.preventDefault();const provider=e.target.provider.value;const models=[...e.target.models.selectedOptions].map(o=>o.value);for(const model of models)await api('/_keys/routes',{method:'POST',body:JSON.stringify({model,provider})});e.target.reset();toast(t('saved'),'ok');load()});
 $('#keySearch').oninput=e=>{state.keyKeyword=e.target.value;renderProviders()};
 $('#keyStatus').onchange=e=>{state.keyStatus=e.target.value;renderProviders()};
 $('#logFilter').oninput=e=>{state.logKeyword=e.target.value;renderLogs()};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alilis/k-hat",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "publishConfig": {
     "access": "public"
   },