@lynn123411/dsh-a6api 1.0.0 → 1.0.1

package/lib/index.js

@@ -916,7 +916,8 @@ async function probeSingleModel(baseURL, apiKey, userId, accessToken, modelName)
         messages: [{ role: "user", content: "1" }],
         max_tokens: 1
       }),
-      signal: AbortSignal.timeout(15e3)
+      // 推理模型(如 grok-4.6)实测单次响应可达 40-90s+,阈值过短会被频繁掐断导致探测失败
+      signal: AbortSignal.timeout(18e4)
     });
     if (res.ok) {
       requestOk = true;
@@ -925,11 +926,16 @@ async function probeSingleModel(baseURL, apiKey, userId, accessToken, modelName)
       requestError = `HTTP ${res.status}: ${errText.slice(0, 150)}`;
     }
   } catch (err) {
-    requestError = err?.message || String(err);
+    const raw = err?.message || String(err);
+    if (raw.includes("aborted due to timeout") || err?.name === "TimeoutError") {
+      requestError = "\u63A2\u6D4B\u8D85\u65F6(\u9608\u503C180\u79D2) \u2014 \u63A8\u7406\u6A21\u578B\u54CD\u5E94\u8F83\u6162,\u5DF2\u4FDD\u7559\u4E0A\u6B21\u5546\u6237\u6570\u636E,\u8BF7\u7A0D\u540E\u91CD\u8BD5";
+    } else {
+      requestError = raw;
+    }
   }
   const durationMs = Date.now() - startTime;
   if (requestOk && (userId || accessToken)) {
-    await sleep(700);
+    await sleep(1200);
     try {
       const logs = await fetchRecentLogs(userId, accessToken, 15);
       const minTimestamp = Math.floor(startTime / 1e3) - 10;
@@ -1019,6 +1025,13 @@ import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
 var A6API_CRED_REF = "A6API_API_KEY";
+async function atomicWriteFile(filePath, content, mode = 384) {
+  const dir = path.dirname(filePath);
+  await fsp.mkdir(dir, { recursive: true });
+  const tmpPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
+  await fsp.writeFile(tmpPath, content, { mode });
+  await fsp.rename(tmpPath, filePath);
+}
 function dshHome() {
   return process.env.DSH_HOME || path.join(os.homedir(), ".dsh");
 }
@@ -1070,8 +1083,8 @@ async function readPluginConfig() {
 }
 async function savePluginConfig(config) {
   const filePath = configFile();
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, JSON.stringify(config, null, 2), "utf8");
+  const { apiKey: _apiKey, ...safeConfig } = config;
+  await atomicWriteFile(filePath, JSON.stringify(safeConfig, null, 2));
   if (config.apiKey && config.apiKey.trim()) {
     await writeCredentialKey(A6API_CRED_REF, config.apiKey.trim());
   }
@@ -1144,8 +1157,7 @@ async function writeCredentialKey(refKey, value) {
       lines.push("refs:", `  ${refKey}: ${JSON.stringify(value)}`);
     }
   }
-  await fsp.mkdir(path.dirname(cFile), { recursive: true });
-  await fsp.writeFile(cFile, lines.join("\n"), "utf8");
+  await atomicWriteFile(cFile, lines.join("\n"), 384);
 }
 async function syncToDshSettings(baseURL, modelIds) {
   const sFile = settingsFile();
@@ -1238,8 +1250,7 @@ async function syncToDshSettings(baseURL, modelIds) {
   } else {
     lines.push(`llm-pi-ai:`, `  providers:`, ...a6apiBlockLines);
   }
-  await fsp.mkdir(path.dirname(sFile), { recursive: true });
-  await fsp.writeFile(sFile, lines.join("\n"), "utf8");
+  await atomicWriteFile(sFile, lines.join("\n"), 420);
 }
 async function getDshConfiguredModels() {
   try {
@@ -1279,13 +1290,23 @@ async function getDshConfiguredModels() {
 var name = "@lynn123411/dsh-a6api";
 var inject = ["webServer"];
 var PREFIX = "/api/dsh-a6api";
+var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+function maskConfig(c) {
+  return {
+    ...c,
+    apiKey: c.apiKey ? MASK : "",
+    accessToken: c.accessToken || c.sessionCookie ? MASK : "",
+    sessionCookie: "",
+    userId: c.userId ? MASK : "",
+    hasApiKey: Boolean(c.apiKey),
+    hasToken: Boolean(c.accessToken || c.sessionCookie)
+  };
+}
 function sendJson(res, status, body) {
   res.writeHead(status, {
     "content-type": "application/json; charset=utf-8",
-    "cache-control": "no-cache",
-    "access-control-allow-origin": "*",
-    "access-control-allow-headers": "*",
-    "access-control-allow-methods": "GET, POST, OPTIONS"
+    "cache-control": "no-cache"
+    // 不设 access-control-allow-origin：仅允许同源调用，阻断跨站读取与 CSRF 预检
   });
   res.end(JSON.stringify(body));
 }
@@ -1313,6 +1334,7 @@ async function parseJsonBody(req) {
   }
 }
 var merchantCardCache = /* @__PURE__ */ new Map();
+var MERCHANT_CARD_TTL_MS = 15 * 60 * 1e3;
 function apply(ctx) {
   const webServer = ctx.webServer || (ctx.get ? ctx.get("webServer") : null);
   if (webServer && typeof webServer.register === "function") {
@@ -1324,11 +1346,7 @@ function apply(ctx) {
           const url = new URL(req.url || "/", "http://localhost");
           const pathname = url.pathname.replace(PREFIX, "") || "/";
           if (req.method === "OPTIONS") {
-            res.writeHead(204, {
-              "access-control-allow-origin": "*",
-              "access-control-allow-headers": "*",
-              "access-control-allow-methods": "GET, POST, OPTIONS"
-            });
+            res.writeHead(204);
             return res.end();
           }
           try {
@@ -1360,18 +1378,22 @@ function apply(ctx) {
                 ];
               }
               if (config.userId || token) {
-                const missing = modelIds.filter((m) => !merchantCardCache.has(m.toLowerCase()));
+                const missing = modelIds.filter((m) => {
+                  const entry = merchantCardCache.get(m.toLowerCase());
+                  return !entry || Date.now() - entry.at >= MERCHANT_CARD_TTL_MS;
+                });
                 if (missing.length > 0) {
                   const found = await getKnownMerchantsFromLogs(config.userId, token, missing);
                   for (const [mName, card] of Object.entries(found)) {
-                    merchantCardCache.set(mName.toLowerCase(), card);
+                    merchantCardCache.set(mName.toLowerCase(), { card, at: Date.now() });
                   }
                 }
               }
               const dshSet = new Set(dshConfiguredModels);
               const models = modelIds.map((mId) => {
                 const meta = resolveModelMeta(mId);
-                const cachedCard = merchantCardCache.get(mId.toLowerCase());
+                const cacheEntry = merchantCardCache.get(mId.toLowerCase());
+                const cachedCard = cacheEntry && Date.now() - cacheEntry.at < MERCHANT_CARD_TTL_MS ? cacheEntry.card : void 0;
                 return {
                   model_name: mId,
                   brand: meta.brand,
@@ -1386,7 +1408,7 @@ function apply(ctx) {
               });
               const recentLogs = await fetchRecentLogs(config.userId, token, 20);
               const response = {
-                config,
+                config: maskConfig(config),
                 balance,
                 models,
                 dshConfiguredModels,
@@ -1397,10 +1419,11 @@ function apply(ctx) {
             if (pathname === "/config" && req.method === "POST") {
               const body = await parseJsonBody(req);
               const current = await readPluginConfig();
-              const rawToken = body.accessToken !== void 0 ? body.accessToken : body.sessionCookie !== void 0 ? body.sessionCookie : current.accessToken || current.sessionCookie || "";
+              const rawToken = body.accessToken !== void 0 && body.accessToken !== MASK ? body.accessToken : body.sessionCookie !== void 0 && body.sessionCookie !== MASK ? body.sessionCookie : current.accessToken || current.sessionCookie || "";
+              const newApiKey = body.apiKey !== void 0 && body.apiKey !== MASK ? body.apiKey : current.apiKey;
               const updated = {
                 baseURL: body.baseURL !== void 0 ? body.baseURL : current.baseURL,
-                apiKey: body.apiKey !== void 0 ? body.apiKey : current.apiKey,
+                apiKey: newApiKey,
                 accessToken: rawToken,
                 sessionCookie: rawToken,
                 userId: body.userId !== void 0 ? body.userId : current.userId,
@@ -1415,7 +1438,7 @@ function apply(ctx) {
               if (updated.activeModels.length > 0) {
                 await syncToDshSettings(updated.baseURL, updated.activeModels);
               }
-              return sendJson(res, 200, { ok: true, config: updated, balance });
+              return sendJson(res, 200, { ok: true, config: maskConfig(updated), balance });
             }
             if (pathname === "/balance" && (req.method === "GET" || req.method === "HEAD")) {
               const config = await readPluginConfig();
@@ -1438,7 +1461,7 @@ function apply(ctx) {
               if (modelName && modelName !== "all") {
                 const result = await probeSingleModel(config.baseURL, config.apiKey, config.userId, token, modelName);
                 if (result.merchant) {
-                  merchantCardCache.set(modelName.toLowerCase(), result.merchant);
+                  merchantCardCache.set(modelName.toLowerCase(), { card: result.merchant, at: Date.now() });
                 }
                 return sendJson(res, 200, { ok: true, result });
               }
@@ -1453,7 +1476,7 @@ function apply(ctx) {
               for (const m of modelIds) {
                 const r = await probeSingleModel(config.baseURL, config.apiKey, config.userId, token, m);
                 if (r.merchant) {
-                  merchantCardCache.set(m.toLowerCase(), r.merchant);
+                  merchantCardCache.set(m.toLowerCase(), { card: r.merchant, at: Date.now() });
                 }
                 results.push(r);
               }