@gehennawu/dsh-service 2.0.6 → 2.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gehennawu/dsh-service",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "DSH Web 运维面板：安全重启、健康监控、备份和 Linux 权限维护。",
   "type": "module",
   "scripts": {
@@ -25,6 +25,13 @@
     "quota-routes.js",
     "subagent-routes.js",
     "backup-routes.js",
+    "model-workbench.js",
+    "model-workbench-routes.js",
+    "model-workbench-settings.js",
+    "model-config-routes.js",
+    "provider-availability.js",
+    "model-config-schema.js",
+    "model-smart-fill.js",
     "plugin-health.js",
     "client.js",
     "cordis.patch.yml",
@@ -52,7 +59,7 @@
   "homepage": "https://github.com/gehennawu/dsh-service#readme",
   "engines": {
     "node": ">=22",
-    "dsh": ">=0.1.1-rc.2 <0.2.1-alpha.2"
+    "dsh": ">=0.1.1-rc.2 <0.2.1-alpha.3"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.3"
@@ -64,7 +71,8 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-connection",
-        "@deepseek-ai/dsh-api-remotes"
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-ui-primitives"
       ],
       "platform": "web"
     }

package/provider-availability.js

@@ -0,0 +1,84 @@
+// Profile-owned policy: configuration and credentials never move or disappear.
+export function createProviderAvailability(store) {
+  let disabled = new Set()
+  let disabledModels = new Set()
+  const modelKey = (provider, model) => JSON.stringify([provider, model])
+  let ready = false
+  const loading = store.load().then((state) => {
+    disabled = new Set(Object.entries(state.disabledProviders ?? {}).filter(([, value]) => value === true).map(([id]) => id))
+    disabledModels = new Set(Object.entries(state.disabledModels ?? {}).filter(([, value]) => value === true).map(([key]) => key))
+    ready = true
+  })
+  const enabled = (provider) => !disabled.has(provider)
+  const modelEnabled = (provider, model) => !disabledModels.has(modelKey(provider, model))
+  const assertEnabled = (provider, model) => {
+    if (!ready || !enabled(provider) || model !== undefined && !modelEnabled(provider, model)) {
+      const code = !ready ? 'provider-availability-loading' : !enabled(provider) ? 'provider-disabled' : 'model-disabled'
+      const error = new Error(code)
+      error.code = code.toUpperCase().replaceAll('-', '_')
+      throw error
+    }
+  }
+  let changes = Promise.resolve()
+  const set = (provider, value, expected) => {
+    const result = changes.then(async () => {
+      await loading
+      if (enabled(provider) !== expected) throw new Error('conflict')
+      await store.mutate((state) => {
+        state.disabledProviders ??= {}
+        if (value) delete state.disabledProviders[provider]
+        else Object.defineProperty(state.disabledProviders, provider, { value: true, enumerable: true, configurable: true, writable: true })
+      })
+      if (value) disabled.delete(provider); else disabled.add(provider)
+      return { route: provider, enabled: value }
+    })
+    changes = result.catch(() => {})
+    return result
+  }
+  const setModel = (provider, model, value, expected) => {
+    const result = changes.then(async () => {
+      await loading
+      if (modelEnabled(provider, model) !== expected) throw new Error('conflict')
+      const key = modelKey(provider, model)
+      await store.mutate((state) => {
+        state.disabledModels ??= {}
+        if (value) delete state.disabledModels[key]
+        else Object.defineProperty(state.disabledModels, key, { value: true, enumerable: true, configurable: true, writable: true })
+      })
+      if (value) disabledModels.delete(key); else disabledModels.add(key)
+      return { route: provider, modelId: model, enabled: value }
+    })
+    changes = result.catch(() => {})
+    return result
+  }
+  return { loading, enabled, modelEnabled, assertEnabled, set, setModel }
+}
+
+// Filter the shared catalog and guard exact routing, including inherited routes.
+// Keep every original method and restore it when the owning Fiber is disposed.
+export function installProviderAvailability(llm, policy, notify = () => {}) {
+  const originals = new Map()
+  const wrappers = new Map()
+  const wrap = (key, factory) => {
+    if (typeof llm[key] !== 'function') return
+    const original = llm[key]
+    const wrapper = factory(original.bind(llm))
+    originals.set(key, original); wrappers.set(key, wrapper); llm[key] = wrapper
+  }
+  wrap('listProviders', (original) => () => original().filter((row) => policy.enabled(row.id)))
+  wrap('listModels', (original) => async (provider, ...args) => { await policy.loading; return policy.enabled(provider) ? (await original(provider, ...args)).filter((row) => policy.modelEnabled(provider, row.id)) : [] })
+  wrap('resolveModelInfo', (original) => async (provider, ...args) => { await policy.loading; policy.assertEnabled(provider, args[0]); return original(provider, ...args) })
+  wrap('resolveCallConfig', (original) => async (config, ...args) => { await policy.loading; policy.assertEnabled(config.provider, config.model); return original(config, ...args) })
+  wrap('prepareCall', (original) => async (config, ...args) => {
+    await policy.loading; policy.assertEnabled(config.provider, config.model)
+    const prepared = await original(config, ...args)
+    return { ...prepared, stream: async function* (options) {
+      policy.assertEnabled(config.provider, config.model)
+      yield* prepared.stream(options)
+    } }
+  })
+  wrap('stream', (original) => async function* (options) { await policy.loading; policy.assertEnabled(options.provider, options.model); yield* original(options) })
+  let disposed = false
+  policy.loading.then(() => { if (!disposed) notify() }, () => {})
+  return () => { disposed = true; for (const [key, original] of originals) if (llm[key] === wrappers.get(key)) llm[key] = original; notify() }
+}

package/quota-adapters.js

@@ -1110,6 +1110,37 @@ function parseCliproxyUpstream(provider, payload) {
   return normalizeGeminiBuckets(payload?.buckets)
 }
 
+// 管理面 403 的三种语义（上游 `internal/api/handlers/management/handler.go` 原文）：
+//   · `IP banned due to too many failed attempts. Try again in 29m10s` —— fail2ban 封禁（实测 2026-10-10）
+//   · `remote management disabled` / `remote management key not set` —— 管理面没开或没配密钥
+// 三者与「密钥填错」（401 `invalid management key`）完全不同，必须分开归类，否则用户对着一句
+// 状态码猜：填错要给重填入口，封禁/未开启给重填入口是误导。
+const CLIPROXY_BANNED_DETAIL_RE = /IP banned due to too many failed attempts/i
+const CLIPROXY_MGMT_OFF_DETAIL_RE = /remote management (?:disabled|key not set)/i
+
+/** CPA 管理面失败归类：401/403 = 管理密钥被拒（与其余 11 个 kind 同款，行回 unconfigured 就地重填）；
+ *  封禁 → mgmt-banned（专属码，给等待/换出口 IP 的指引）；远程管理未开启 → mgmt-disabled。 */
+function cliproxyManagementFailure(error) {
+  const detail = sanitizeQuotaErrorDetail(error?.detail)
+  if (detail !== undefined && CLIPROXY_BANNED_DETAIL_RE.test(detail)) {
+    const banned = new Error('mgmt-banned')
+    banned.detail = detail
+    return banned
+  }
+  if (detail !== undefined && CLIPROXY_MGMT_OFF_DETAIL_RE.test(detail)) {
+    const disabled = new Error('mgmt-disabled')
+    disabled.detail = detail
+    return disabled
+  }
+  const message = typeof error?.message === 'string' ? error.message : ''
+  if (message === 'http-status:401' || message === 'http-status:403') {
+    const rejected = new Error('credential-rejected')
+    if (detail !== undefined) rejected.detail = detail
+    return rejected
+  }
+  return error
+}
+
 async function fetchCliproxyUsage({ profile, config, credential, signal, requestJson }) {
   if (typeof requestJson !== 'function') throw new Error('transport-unavailable')
   const pinned = Array.isArray(config?.allowedHosts?.[profile.name]) ? config.allowedHosts[profile.name] : []
@@ -1119,8 +1150,9 @@ async function fetchCliproxyUsage({ profile, config, credential, signal, request
   try {
     filesPayload = await requestJson(`${origin}/v0/management/auth-files`, { authorization: credential, signal })
   } catch (error) {
+    // secret-key 为空时管理路由整体不注册 → 404（既有口径，先于其余归类）。
     if (error?.message === 'http-status:404') throw new Error('mgmt-disabled')
-    throw error
+    throw cliproxyManagementFailure(error)
   }
   const files = Array.isArray(filesPayload?.files) ? filesPayload.files : []
   const accounts = []
@@ -1162,8 +1194,12 @@ async function fetchCliproxyUsage({ profile, config, credential, signal, request
           body: JSON.stringify({ auth_index: account.authIndex, method: call.method, url: call.url, header: call.header, data: call.data }),
         })
       } catch (error) {
-        const detail = sanitizeQuotaErrorDetail(error?.detail)
-        pushFailure(accountIndex, quotaErrorCode(error), detail !== undefined ? { detail } : {})
+        // 管理面自身失败（密钥被拒 / 封禁 / 管理面未开）：与账号级上游失败（HTTP 200 信封里的
+        // status_code）严格分开。密钥在 api-call 途中失效或撞上封禁时，整行必须给出可行动指引，
+        // 而不是一个 upstream-status 家族码。
+        const failure = cliproxyManagementFailure(error)
+        const detail = sanitizeQuotaErrorDetail(failure?.detail)
+        pushFailure(accountIndex, quotaErrorCode(failure), detail !== undefined ? { detail } : {})
         const fallback = cliproxFallbackWindows(account)
         if (fallback.length > 0) {
           accountResults.set(accountIndex, fallback)

package/quota-routes.js

@@ -66,10 +66,12 @@ export function createQuotaRoutes({
           // 漏掉它会把卡片锁死在错误态，用户找不到任何入口（GUI 反馈「失效后无法再次填入」）。
           const credentialClass = view.lastError === 'credential-missing' || view.lastError === 'no-base-url' || view.lastError === 'credentials-unavailable' || view.lastError === 'credential-rejected'
           const providerResetCards = resetCardsByProvider.get(profile.name) ?? []
-          // 凭据填写窗口的数据源：仅对「缺凭据」的未配置行附带候选线索名的配置状态（describe 只回
-          // 配置与否/来源/可写，绝不带值）；凭据服务缺席时省略字段——客户端隐藏窗口退回文案指引。
+          // 凭据窗口的数据源：**已适配行一律附带**候选线索名的配置状态，不再以「未配置」为门槛——
+          // 已保存的凭据（密钥轮换、换账号、填错想改）此前没有任何 GUI 修改入口（用户点名）。
+          // describe 只回配置与否/来源/可写，绝不带值，且是内存查询；凭据服务缺席时省略字段，
+          // 客户端随之隐藏入口、退回文案指引。
           let credentialHints
-          if (credentialClass && !view.refreshing && view.lastError !== 'no-base-url') {
+          {
             const credentials = ctx.get('credentials')
             if (credentials !== undefined && typeof credentials.describe === 'function') {
               const described = []
@@ -103,6 +105,8 @@ export function createQuotaRoutes({
             ...(view.lastErrorEndpoint !== undefined ? { errorEndpoint: view.lastErrorEndpoint } : {}),
             ...(view.lastErrorAccount !== undefined ? { errorAccount: view.lastErrorAccount } : {}),
             nextAllowedAt: view.nextAllowedAt,
+            // 确定性失败后的手动模式：客户端据此把「{time} 后可重试」换成「自动重试已暂停」。
+            ...(view.manualOnly === true ? { manualOnly: true } : {}),
             ...(providerResetCards.length > 0 ? { resetCards: providerResetCards } : {}),
             ...(credentialHints !== undefined ? { credentialHints } : {}),
             // 凭据入口语义由 Adapter policy 下发稳定键，客户端只负责本地化，不再对 kind 重复分支。
@@ -119,8 +123,10 @@ export function createQuotaRoutes({
     } },
     'quota-refresh': { feature: 'quotaLookup', audit: true, handle: async (payload, rpcEndpoint) => {
       try {
-        // 手动刷新入口：provider 过白名单且 kind 已适配；清掉节流闸后立即 kick。
-        // 单飞仍生效（在途时本次点击为 no-op）；上游结果经后续 quota 快照带出，不在此等待。
+        // 手动重试/连接入口：provider 过白名单且 kind 已适配；这是「确定性失败转手动模式」之后
+        // 唯一还能打上游的路径（kick 带 manual 标记，跳过手动模式与退避/TTL/间隔三道闸）。
+        // 单飞仍生效（在途时本次点击为 no-op）；只受不可绕过的手动冷却约束；上游结果经后续
+        // quota 快照带出，不在此等待。
         const providerName = typeof payload?.provider === 'string' ? payload.provider : ''
         const profile = readQuotaProfiles(ctx.get('settings'), ctx.get('llm')).find((candidate) => candidate.name === providerName)
         if (profile === undefined) return { ok: false, error: 'unknown-provider' }
@@ -130,9 +136,9 @@ export function createQuotaRoutes({
         const forced = quotaThrottle.force(providerName)
         if (!forced.ok) {
           if (forced.reason === 'inflight') return { ok: true }
-          return { ok: false, error: forced.reason === 'cooldown' ? 'refresh-cooldown' : 'refresh-backoff', nextAllowedAt: forced.nextAllowedAt }
+          return { ok: false, error: 'refresh-cooldown', nextAllowedAt: forced.nextAllowedAt }
         }
-        kickQuotaRefresh(profile, adapter, config)
+        kickQuotaRefresh(profile, adapter, config, { manual: true })
         return { ok: true }
       } catch (error) {
         return rpcTechnicalFailure(error)

package/subagent-routes.js

@@ -17,11 +17,13 @@ export function createSubagentRoutes({
   listSubagentDispatches,
   listSubagentModels,
   rpcTechnicalFailure,
+  providerAvailability,
 }) {
   return {
     'subagent-route': { feature: 'subagentRoute', handle: async (payload, rpcEndpoint) => {
       try {
         await subagentRouteLoadPromise
+        if (providerAvailability) await providerAvailability.loading
         const llm = ctx.get('llm')
         // 模型清单沿用 skills-models 的白名单口径（llm.listProviders × listModels，单渠道失败跳过），
         // 并对每个精确模型附加 adapter 的 reasoning metadata（resolveModelInfo 缺席时保留原目录项）；
@@ -128,6 +130,11 @@ export function createSubagentRoutes({
           }
         }
         return await serializeSubagentRouteWrite(async (config) => {
+          if (providerAvailability) {
+            await providerAvailability.loading
+            if (primary.provider) providerAvailability.assertEnabled(primary.provider, primary.model)
+            for (const fallback of fallbacks) providerAvailability.assertEnabled(fallback.provider, fallback.model)
+          }
           config.mode = mode
           if (mode === 'custom') {
             config.provider = primary.provider