@co0ontty/wand 4.24.0 → 4.25.0

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "090ceecd30c3ef681295a17b38285bb22d37ce54",
-  "builtAt": "2026-07-25T01:03:54.326Z",
-  "version": "4.24.0",
+  "commit": "c37c92c6eb275aa3575fc63ff7ec93f650ddf71e",
+  "builtAt": "2026-07-25T10:01:47.790Z",
+  "version": "4.25.0",
   "channel": "stable"
 }

package/dist/config.js

@@ -4,7 +4,7 @@ import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promi
 import path from "node:path";
 import process from "node:process";
 import { isRunningAsRoot } from "./env-utils.js";
-import { normalizeSystemAiConfig } from "./system-ai.js";
+import { normalizeSystemAiConfig, systemAiProfiles } from "./system-ai.js";
 function isThinkingEffort(value) {
     return value === "off"
         || value === "standard"
@@ -79,6 +79,7 @@ export const defaultConfig = () => ({
     commitModel: "",
     commitAiSource: "cli",
     systemAi: {
+        id: crypto.randomUUID(),
         enabled: false,
         protocol: "openai",
         baseUrl: "",
@@ -461,8 +462,8 @@ export function writePreferenceToStorage(config, storage, key, value, options =
                 throw new Error("systemAi 必须是对象。");
             }
             const normalized = normalizeSystemAiConfig(value, config.systemAi ?? defaultConfig().systemAi);
-            if (normalized.enabled && (!normalized.baseUrl || !normalized.apiKey || !normalized.model)) {
-                throw new Error("启用系统 AI API 时，地址、API Key 和模型不能为空。");
+            if (normalized.enabled && !systemAiProfiles(normalized, true).length) {
+                throw new Error("启用系统 AI API 时，至少需要一条地址、API Key 和模型完整的路由。");
             }
             if (!options.deferCommitAiValidation) {
                 validateCommitAiConfig({ ...config, systemAi: normalized });

package/dist/server-settings-routes.js

@@ -5,7 +5,15 @@ import { getErrorMessage } from "./error-utils.js";
 import { asyncRoute } from "./express-async.js";
 import { getProviderDefaultModels, PREFERENCE_KEYS, saveConfig, validateCommitAiConfig, writePreferenceToStorage, } from "./config.js";
 import { DEPLOYMENT_CONFIG_KEYS } from "./runtime-config.js";
-import { discoverCliSystemAiConfigs, normalizeSystemAiConfig } from "./system-ai.js";
+import { callSystemAiText, discoverCliSystemAiConfigs, mergeSystemAiConfigs, normalizeSystemAiConfig, } from "./system-ai.js";
+function systemAiRouteIdentity(profile) {
+    return [
+        profile.protocol,
+        profile.baseUrl,
+        profile.model,
+        profile.authHeader ?? "bearer",
+    ].join("\0");
+}
 function publicConfig(config) {
     const { password: _password, appSecret: _appSecret, ...safe } = config;
     const defaultModels = getProviderDefaultModels(config);
@@ -129,14 +137,92 @@ export function registerSettingsRoutes(app, deps) {
             return;
         }
         const candidate = runtimeConfig.createCandidate();
+        const remainingImported = [...imported];
+        const existingRoutes = candidate.systemAi
+            ? [candidate.systemAi, ...(candidate.systemAi.fallbacks ?? [])]
+                .map((profile) => ({ ...profile, fallbacks: undefined }))
+            : [];
+        const refreshedExisting = existingRoutes.map((profile) => {
+            const importedIndex = remainingImported.findIndex((item) => systemAiRouteIdentity(item) === systemAiRouteIdentity(profile));
+            if (importedIndex < 0)
+                return profile;
+            const [matchingImport] = remainingImported.splice(importedIndex, 1);
+            return {
+                ...profile,
+                apiKey: matchingImport.apiKey,
+                source: matchingImport.source,
+            };
+        });
+        const merged = mergeSystemAiConfigs(refreshedExisting, remainingImported);
+        if (!merged) {
+            res.status(404).json({ error: "没有找到可用的系统 AI API 配置。" });
+            return;
+        }
         writePreferenceToStorage(candidate, storage, "systemAi", {
-            ...imported[0],
+            ...merged,
             enabled: candidate.systemAi?.enabled === true,
-            fallbacks: imported.slice(1),
         });
         runtimeConfig.commit(candidate, new Set(["systemAi"]));
         res.json({ ok: true, count: imported.length, systemAi: (publicConfig(candidate).systemAi) });
     });
+    app.post("/api/settings/system-ai/test", requireAdmin, asyncRoute(async (req, res) => {
+        const raw = req.body?.route;
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+            res.status(400).json({ error: "请提供要测试的系统 AI 线路。" });
+            return;
+        }
+        const submitted = raw;
+        const desired = runtimeConfig.desiredSnapshot().systemAi;
+        const storedRoutes = desired
+            ? [desired, ...(desired.fallbacks ?? [])].map((profile) => ({ ...profile, fallbacks: undefined }))
+            : [];
+        const submittedId = typeof submitted.id === "string" ? submitted.id.trim() : "";
+        const stored = submittedId
+            ? storedRoutes.find((profile) => profile.id === submittedId)
+            : undefined;
+        const apiKey = submitted.clearApiKey === true
+            ? ""
+            : typeof submitted.apiKey === "string" && submitted.apiKey.trim()
+                ? submitted.apiKey.trim()
+                : stored?.apiKey ?? "";
+        let route;
+        try {
+            route = normalizeSystemAiConfig({
+                ...stored,
+                ...submitted,
+                enabled: true,
+                apiKey,
+                fallbacks: undefined,
+            }, stored);
+            if (!route.baseUrl || !route.apiKey || !route.model) {
+                throw new Error("测试线路需要完整的 API 地址、API Key 和模型。");
+            }
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "测试线路配置无效。") });
+            return;
+        }
+        const startedAt = Date.now();
+        try {
+            const text = await callSystemAiText("这是 Wand 系统 API 线路验收。请只回复 WAND_API_OK。", route, 30_000);
+            if (!text.trim())
+                throw new Error("系统 AI API 返回了空结果。");
+            res.json({
+                ok: true,
+                source: route.source ?? "custom",
+                requestedModel: route.model,
+                reasoningEffort: route.protocol === "openai" ? "low" : "disabled",
+                latencyMs: Date.now() - startedAt,
+            });
+        }
+        catch (error) {
+            res.status(502).json({
+                error: getErrorMessage(error, "系统 AI API 测试失败。"),
+                requestedModel: route.model,
+                latencyMs: Date.now() - startedAt,
+            });
+        }
+    }));
     app.get("/api/app-connect-code", requireAdmin, (req, res) => {
         res.json(deps.resolveAppConnectCode(req));
     });
@@ -203,18 +289,51 @@ export function registerSettingsRoutes(app, deps) {
                     throw new Error("systemAi 必须是对象。");
                 }
                 const previous = candidateConfig.systemAi;
-                const apiKey = typeof body.systemAi.apiKey === "string" && body.systemAi.apiKey.trim()
-                    ? body.systemAi.apiKey.trim()
-                    : previous?.apiKey ?? "";
-                const submittedFallbacks = Array.isArray(body.systemAi.fallbacks)
-                    ? body.systemAi.fallbacks.map((item, index) => {
-                        const raw = item && typeof item === "object" && !Array.isArray(item) ? item : {};
-                        const prior = previous?.fallbacks?.[index];
-                        const fallbackApiKey = typeof raw.apiKey === "string" && raw.apiKey.trim() ? raw.apiKey.trim() : prior?.apiKey ?? "";
-                        return { ...prior, ...raw, apiKey: fallbackApiKey, fallbacks: undefined };
-                    })
-                    : previous?.fallbacks;
-                stagePreference("systemAi", normalizeSystemAiConfig({ ...previous, ...body.systemAi, apiKey, fallbacks: submittedFallbacks }, previous));
+                const systemAiEnabled = body.systemAi.enabled === true;
+                const previousRoutes = previous ? [previous, ...(previous.fallbacks ?? [])] : [];
+                const previousById = new Map(previousRoutes.flatMap((profile) => profile.id ? [[profile.id, profile]] : []));
+                const rawFallbacks = Array.isArray(body.systemAi.fallbacks) ? body.systemAi.fallbacks : [];
+                const rawRoutes = [body.systemAi, ...rawFallbacks].map((item) => item && typeof item === "object" && !Array.isArray(item)
+                    ? item
+                    : {});
+                const submittedIds = new Set();
+                const normalizedRoutes = rawRoutes.map((raw, index) => {
+                    const submittedId = typeof raw.id === "string" ? raw.id.trim() : "";
+                    if (submittedId) {
+                        if (submittedIds.has(submittedId))
+                            throw new Error("系统 AI 路由 ID 不能重复。");
+                        submittedIds.add(submittedId);
+                    }
+                    // Older web clients did not submit route IDs. For those clients only,
+                    // match a unique route by its non-secret identity; never fall back to
+                    // the array index because routes may have been reordered.
+                    const identityMatches = submittedId ? [] : previousRoutes.filter((profile) => profile.protocol === (raw.protocol === "anthropic" ? "anthropic" : "openai")
+                        && profile.baseUrl === (typeof raw.baseUrl === "string" ? raw.baseUrl.trim().replace(/\/+$/, "") : "")
+                        && profile.model === (typeof raw.model === "string" ? raw.model.trim() : "")
+                        && (profile.authHeader ?? "bearer") === (raw.authHeader === "x-api-key" ? "x-api-key" : "bearer"));
+                    const prior = (submittedId ? previousById.get(submittedId) : undefined)
+                        ?? (identityMatches.length === 1 ? identityMatches[0] : undefined);
+                    const apiKey = raw.clearApiKey === true
+                        ? ""
+                        : typeof raw.apiKey === "string" && raw.apiKey.trim()
+                            ? raw.apiKey.trim()
+                            : prior?.apiKey ?? "";
+                    return normalizeSystemAiConfig({
+                        ...prior,
+                        ...raw,
+                        enabled: index === 0 ? systemAiEnabled : true,
+                        apiKey,
+                        fallbacks: undefined,
+                    }, prior);
+                });
+                const [primary, ...fallbacks] = normalizedRoutes;
+                if (!primary)
+                    throw new Error("系统 AI 至少需要一个路由占位。");
+                stagePreference("systemAi", {
+                    ...primary,
+                    enabled: systemAiEnabled,
+                    ...(fallbacks.length ? { fallbacks } : { fallbacks: [] }),
+                });
             }
             for (const field of PREFERENCE_KEYS) {
                 if (field === "systemAi")

package/dist/session-ai-context.js

@@ -85,7 +85,7 @@ export function resolveCommitAiContext(snapshot, config, discoverApis = discover
     };
     if (config.commitAiSource !== "api")
         return commitContext;
-    const directApi = mergeSystemAiConfigs(discoverApis(commitContext.provider), config.systemAi);
+    const directApi = mergeSystemAiConfigs(config.systemAi, discoverApis(commitContext.provider));
     return {
         ...commitContext,
         ...(directApi ? { systemAi: directApi } : {}),

package/dist/system-ai.d.ts

@@ -11,8 +11,8 @@ export declare function discoverCliSystemAiConfig(preferred?: SessionProvider, h
 /** Return the configured API chain in call order, excluding incomplete entries. */
 export declare function systemAiProfiles(config: SystemAiConfig | undefined, forceEnabled?: boolean): SystemAiConfig[];
 /**
- * Flatten and combine direct-API groups in priority order. Dynamically discovered
- * profiles can be passed first, followed by stored/legacy settings.
+ * Flatten and combine direct-API groups in caller-defined priority order.
+ * Later groups are appended after earlier groups and duplicate routes are skipped.
  */
 export declare function mergeSystemAiConfigs(...groups: Array<SystemAiConfig | SystemAiConfig[] | undefined>): SystemAiConfig | undefined;
 export declare function callSystemAiText(prompt: string, config: SystemAiConfig, timeoutMs?: number): Promise<string>;

package/dist/system-ai.js

@@ -1,7 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 const SYSTEM_AI_TIMEOUT_MS = 60_000;
+const SYSTEM_AI_ROUTE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
 export class SystemAiError extends Error {
     code;
     constructor(message, code) {
@@ -29,6 +31,9 @@ export function normalizeSystemAiConfig(value, fallback) {
             throw new Error("系统 AI API 地址必须使用 http 或 https。");
     }
     const normalized = {
+        id: typeof raw.id === "string" && SYSTEM_AI_ROUTE_ID_PATTERN.test(raw.id.trim())
+            ? raw.id.trim()
+            : fallback?.id ?? randomUUID(),
         enabled: raw.enabled === true,
         protocol,
         baseUrl,
@@ -41,9 +46,15 @@ export function normalizeSystemAiConfig(value, fallback) {
     };
     if (Array.isArray(raw.fallbacks)) {
         normalized.fallbacks = raw.fallbacks
-            .map((item, index) => {
+            .map((item) => {
             try {
-                const itemFallback = fallback?.fallbacks?.[index];
+                const itemId = item && typeof item === "object" && !Array.isArray(item)
+                    && typeof item.id === "string"
+                    ? item.id.trim()
+                    : "";
+                const itemFallback = itemId
+                    ? fallback?.fallbacks?.find((profile) => profile.id === itemId)
+                    : undefined;
                 const profile = normalizeSystemAiConfig(item, itemFallback);
                 delete profile.fallbacks;
                 return profile;
@@ -70,6 +81,10 @@ function tryNormalizeSystemAiConfig(value) {
     }
 }
 function systemAiProfileKey(profile) {
+    // Credential is intentionally part of runtime dedupe: if a stored key is
+    // stale but a tool config has already rotated it, the discovered route must
+    // remain available later in the same fallback chain. Import handles that
+    // case separately by refreshing the stored route in place.
     return [
         profile.protocol,
         profile.baseUrl,
@@ -288,8 +303,8 @@ export function systemAiProfiles(config, forceEnabled = false) {
     });
 }
 /**
- * Flatten and combine direct-API groups in priority order. Dynamically discovered
- * profiles can be passed first, followed by stored/legacy settings.
+ * Flatten and combine direct-API groups in caller-defined priority order.
+ * Later groups are appended after earlier groups and duplicate routes are skipped.
  */
 export function mergeSystemAiConfigs(...groups) {
     const profiles = [];
@@ -343,11 +358,22 @@ export async function callSystemAiText(prompt, config, timeoutMs = SYSTEM_AI_TIM
             headers.authorization = `Bearer ${normalized.apiKey}`;
     }
     else {
-        headers.authorization = `Bearer ${normalized.apiKey}`;
+        if (normalized.authHeader === "x-api-key")
+            headers["x-api-key"] = normalized.apiKey;
+        else
+            headers.authorization = `Bearer ${normalized.apiKey}`;
     }
     const body = normalized.protocol === "anthropic"
         ? { model: normalized.model, max_tokens: 2048, messages: [{ role: "user", content: prompt }] }
-        : { model: normalized.model, messages: [{ role: "user", content: prompt }], stream: false };
+        : {
+            model: normalized.model,
+            // Quick system tasks should not silently inherit a model's expensive
+            // default reasoning level. Settings probes a route with this same
+            // payload, so an incompatible endpoint fails visibly before it is used.
+            reasoning_effort: "low",
+            messages: [{ role: "user", content: prompt }],
+            stream: false,
+        };
     let response;
     try {
         response = await fetch(endpoint(normalized.baseUrl, normalized.protocol), {

package/dist/types.d.ts

@@ -138,6 +138,8 @@ export interface WandConfig {
 export type SystemAiProtocol = "openai" | "anthropic";
 export type SystemAiAuthHeader = "bearer" | "x-api-key";
 export interface SystemAiConfig {
+    /** 设置页路由的稳定标识，用于重排后安全地关联已保存密钥。 */
+    id?: string;
     enabled: boolean;
     protocol: SystemAiProtocol;
     baseUrl: string;