@lynn123411/dsh-a6api 1.0.0 → 1.1.0

package/lib/index.js

@@ -892,6 +892,66 @@ async function fetchChannelDetails(channelId, userId, sessionCookie, targetModel
   }
   return null;
 }
+async function fetchPriceFluctuation(userId, sessionCookie, accessToken) {
+  const token = (accessToken || sessionCookie || "").trim();
+  const uid = (userId || "").trim();
+  if (!uid && !token) {
+    return { pendingCount: 0, unseenCount: 0, totalCount: 0, authError: false };
+  }
+  const headers = buildWebHeaders(uid || void 0, token || void 0);
+  const url = "https://a6api.com/api/marketplace/price-notices";
+  try {
+    const res = await fetch(url, { headers, signal: AbortSignal.timeout(8e3) });
+    if (res.status === 401 || res.status === 403) {
+      console.warn("[dsh-a6api] fetchPriceFluctuation auth failed", res.status);
+      return { pendingCount: 0, unseenCount: 0, totalCount: 0, authError: true };
+    }
+    if (!res.ok) {
+      console.warn("[dsh-a6api] fetchPriceFluctuation HTTP", res.status);
+      return { pendingCount: 0, unseenCount: 0, totalCount: 0 };
+    }
+    const json = await res.json().catch(() => null);
+    if (!json) return { pendingCount: 0, unseenCount: 0, totalCount: 0 };
+    if (json.success === false) return { pendingCount: 0, unseenCount: 0, totalCount: 0 };
+    let arr = [];
+    if (Array.isArray(json)) arr = json;
+    else if (Array.isArray(json.data)) arr = json.data;
+    else if (Array.isArray(json.data?.notices)) arr = json.data.notices;
+    else if (Array.isArray(json.data?.items)) arr = json.data.items;
+    else if (Array.isArray(json.notices)) arr = json.notices;
+    else if (Array.isArray(json.items)) arr = json.items;
+    const pickWithPresent = (keys) => {
+      for (const k of keys) {
+        const v = json?.data?.[k] ?? json?.[k];
+        if (v !== void 0 && v !== null) {
+          const n = Number(v);
+          if (!Number.isNaN(n)) return { value: n, present: true };
+        }
+      }
+      return { value: 0, present: false };
+    };
+    const pendingPick = pickWithPresent(["pendingCount", "pending_count", "pending", "openCount"]);
+    const unseenPick = pickWithPresent(["unseenCount", "unseen_count", "unseen", "has_unseen_count"]);
+    let pending = pendingPick.value;
+    let unseen = unseenPick.value;
+    const total = arr.length;
+    if (!pendingPick.present && arr.length > 0) {
+      const counted = arr.filter((n) => {
+        const s = String(n.state || n.status || "").toLowerCase();
+        return s === "open" || s === "pending" || n.pending === true;
+      }).length;
+      const hasState = arr.some((n) => n.state !== void 0 || n.status !== void 0);
+      if (hasState) pending = counted;
+    }
+    if (!unseenPick.present && arr.length > 0) {
+      unseen = arr.filter((n) => n.has_unseen === true || n.hasUnseen === true || n.unseen === true || n.is_unread === true).length;
+    }
+    return { pendingCount: pending, unseenCount: unseen, totalCount: total, notices: arr };
+  } catch (err) {
+    console.warn("[dsh-a6api] fetchPriceFluctuation error", err);
+    return { pendingCount: 0, unseenCount: 0, totalCount: 0 };
+  }
+}
 
 // src/server/probe.ts
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -916,7 +976,8 @@ async function probeSingleModel(baseURL, apiKey, userId, accessToken, modelName)
         messages: [{ role: "user", content: "1" }],
         max_tokens: 1
       }),
-      signal: AbortSignal.timeout(15e3)
+      // 推理模型(如 grok-4.6)实测单次响应可达 40-90s+,阈值过短会被频繁掐断导致探测失败
+      signal: AbortSignal.timeout(18e4)
     });
     if (res.ok) {
       requestOk = true;
@@ -925,11 +986,16 @@ async function probeSingleModel(baseURL, apiKey, userId, accessToken, modelName)
       requestError = `HTTP ${res.status}: ${errText.slice(0, 150)}`;
     }
   } catch (err) {
-    requestError = err?.message || String(err);
+    const raw = err?.message || String(err);
+    if (raw.includes("aborted due to timeout") || err?.name === "TimeoutError") {
+      requestError = "\u63A2\u6D4B\u8D85\u65F6(\u9608\u503C180\u79D2) \u2014 \u63A8\u7406\u6A21\u578B\u54CD\u5E94\u8F83\u6162,\u5DF2\u4FDD\u7559\u4E0A\u6B21\u5546\u6237\u6570\u636E,\u8BF7\u7A0D\u540E\u91CD\u8BD5";
+    } else {
+      requestError = raw;
+    }
   }
   const durationMs = Date.now() - startTime;
   if (requestOk && (userId || accessToken)) {
-    await sleep(700);
+    await sleep(1200);
     try {
       const logs = await fetchRecentLogs(userId, accessToken, 15);
       const minTimestamp = Math.floor(startTime / 1e3) - 10;
@@ -1019,6 +1085,13 @@ import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
 var A6API_CRED_REF = "A6API_API_KEY";
+async function atomicWriteFile(filePath, content, mode = 384) {
+  const dir = path.dirname(filePath);
+  await fsp.mkdir(dir, { recursive: true });
+  const tmpPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
+  await fsp.writeFile(tmpPath, content, { mode });
+  await fsp.rename(tmpPath, filePath);
+}
 function dshHome() {
   return process.env.DSH_HOME || path.join(os.homedir(), ".dsh");
 }
@@ -1070,8 +1143,8 @@ async function readPluginConfig() {
 }
 async function savePluginConfig(config) {
   const filePath = configFile();
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, JSON.stringify(config, null, 2), "utf8");
+  const { apiKey: _apiKey, ...safeConfig } = config;
+  await atomicWriteFile(filePath, JSON.stringify(safeConfig, null, 2));
   if (config.apiKey && config.apiKey.trim()) {
     await writeCredentialKey(A6API_CRED_REF, config.apiKey.trim());
   }
@@ -1144,8 +1217,7 @@ async function writeCredentialKey(refKey, value) {
       lines.push("refs:", `  ${refKey}: ${JSON.stringify(value)}`);
     }
   }
-  await fsp.mkdir(path.dirname(cFile), { recursive: true });
-  await fsp.writeFile(cFile, lines.join("\n"), "utf8");
+  await atomicWriteFile(cFile, lines.join("\n"), 384);
 }
 async function syncToDshSettings(baseURL, modelIds) {
   const sFile = settingsFile();
@@ -1238,8 +1310,7 @@ async function syncToDshSettings(baseURL, modelIds) {
   } else {
     lines.push(`llm-pi-ai:`, `  providers:`, ...a6apiBlockLines);
   }
-  await fsp.mkdir(path.dirname(sFile), { recursive: true });
-  await fsp.writeFile(sFile, lines.join("\n"), "utf8");
+  await atomicWriteFile(sFile, lines.join("\n"), 420);
 }
 async function getDshConfiguredModels() {
   try {
@@ -1279,13 +1350,23 @@ async function getDshConfiguredModels() {
 var name = "@lynn123411/dsh-a6api";
 var inject = ["webServer"];
 var PREFIX = "/api/dsh-a6api";
+var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+function maskConfig(c) {
+  return {
+    ...c,
+    apiKey: c.apiKey ? MASK : "",
+    accessToken: c.accessToken || c.sessionCookie ? MASK : "",
+    sessionCookie: "",
+    userId: c.userId ? MASK : "",
+    hasApiKey: Boolean(c.apiKey),
+    hasToken: Boolean(c.accessToken || c.sessionCookie)
+  };
+}
 function sendJson(res, status, body) {
   res.writeHead(status, {
     "content-type": "application/json; charset=utf-8",
-    "cache-control": "no-cache",
-    "access-control-allow-origin": "*",
-    "access-control-allow-headers": "*",
-    "access-control-allow-methods": "GET, POST, OPTIONS"
+    "cache-control": "no-cache"
+    // 不设 access-control-allow-origin：仅允许同源调用，阻断跨站读取与 CSRF 预检
   });
   res.end(JSON.stringify(body));
 }
@@ -1313,6 +1394,7 @@ async function parseJsonBody(req) {
   }
 }
 var merchantCardCache = /* @__PURE__ */ new Map();
+var MERCHANT_CARD_TTL_MS = 15 * 60 * 1e3;
 function apply(ctx) {
   const webServer = ctx.webServer || (ctx.get ? ctx.get("webServer") : null);
   if (webServer && typeof webServer.register === "function") {
@@ -1324,11 +1406,7 @@ function apply(ctx) {
           const url = new URL(req.url || "/", "http://localhost");
           const pathname = url.pathname.replace(PREFIX, "") || "/";
           if (req.method === "OPTIONS") {
-            res.writeHead(204, {
-              "access-control-allow-origin": "*",
-              "access-control-allow-headers": "*",
-              "access-control-allow-methods": "GET, POST, OPTIONS"
-            });
+            res.writeHead(204);
             return res.end();
           }
           try {
@@ -1360,18 +1438,22 @@ function apply(ctx) {
                 ];
               }
               if (config.userId || token) {
-                const missing = modelIds.filter((m) => !merchantCardCache.has(m.toLowerCase()));
+                const missing = modelIds.filter((m) => {
+                  const entry = merchantCardCache.get(m.toLowerCase());
+                  return !entry || Date.now() - entry.at >= MERCHANT_CARD_TTL_MS;
+                });
                 if (missing.length > 0) {
                   const found = await getKnownMerchantsFromLogs(config.userId, token, missing);
                   for (const [mName, card] of Object.entries(found)) {
-                    merchantCardCache.set(mName.toLowerCase(), card);
+                    merchantCardCache.set(mName.toLowerCase(), { card, at: Date.now() });
                   }
                 }
               }
               const dshSet = new Set(dshConfiguredModels);
               const models = modelIds.map((mId) => {
                 const meta = resolveModelMeta(mId);
-                const cachedCard = merchantCardCache.get(mId.toLowerCase());
+                const cacheEntry = merchantCardCache.get(mId.toLowerCase());
+                const cachedCard = cacheEntry && Date.now() - cacheEntry.at < MERCHANT_CARD_TTL_MS ? cacheEntry.card : void 0;
                 return {
                   model_name: mId,
                   brand: meta.brand,
@@ -1386,7 +1468,7 @@ function apply(ctx) {
               });
               const recentLogs = await fetchRecentLogs(config.userId, token, 20);
               const response = {
-                config,
+                config: maskConfig(config),
                 balance,
                 models,
                 dshConfiguredModels,
@@ -1397,10 +1479,11 @@ function apply(ctx) {
             if (pathname === "/config" && req.method === "POST") {
               const body = await parseJsonBody(req);
               const current = await readPluginConfig();
-              const rawToken = body.accessToken !== void 0 ? body.accessToken : body.sessionCookie !== void 0 ? body.sessionCookie : current.accessToken || current.sessionCookie || "";
+              const rawToken = body.accessToken !== void 0 && body.accessToken !== MASK ? body.accessToken : body.sessionCookie !== void 0 && body.sessionCookie !== MASK ? body.sessionCookie : current.accessToken || current.sessionCookie || "";
+              const newApiKey = body.apiKey !== void 0 && body.apiKey !== MASK ? body.apiKey : current.apiKey;
               const updated = {
                 baseURL: body.baseURL !== void 0 ? body.baseURL : current.baseURL,
-                apiKey: body.apiKey !== void 0 ? body.apiKey : current.apiKey,
+                apiKey: newApiKey,
                 accessToken: rawToken,
                 sessionCookie: rawToken,
                 userId: body.userId !== void 0 ? body.userId : current.userId,
@@ -1415,7 +1498,7 @@ function apply(ctx) {
               if (updated.activeModels.length > 0) {
                 await syncToDshSettings(updated.baseURL, updated.activeModels);
               }
-              return sendJson(res, 200, { ok: true, config: updated, balance });
+              return sendJson(res, 200, { ok: true, config: maskConfig(updated), balance });
             }
             if (pathname === "/balance" && (req.method === "GET" || req.method === "HEAD")) {
               const config = await readPluginConfig();
@@ -1438,7 +1521,7 @@ function apply(ctx) {
               if (modelName && modelName !== "all") {
                 const result = await probeSingleModel(config.baseURL, config.apiKey, config.userId, token, modelName);
                 if (result.merchant) {
-                  merchantCardCache.set(modelName.toLowerCase(), result.merchant);
+                  merchantCardCache.set(modelName.toLowerCase(), { card: result.merchant, at: Date.now() });
                 }
                 return sendJson(res, 200, { ok: true, result });
               }
@@ -1453,7 +1536,7 @@ function apply(ctx) {
               for (const m of modelIds) {
                 const r = await probeSingleModel(config.baseURL, config.apiKey, config.userId, token, m);
                 if (r.merchant) {
-                  merchantCardCache.set(m.toLowerCase(), r.merchant);
+                  merchantCardCache.set(m.toLowerCase(), { card: r.merchant, at: Date.now() });
                 }
                 results.push(r);
               }
@@ -1471,6 +1554,17 @@ function apply(ctx) {
               const dshConfiguredModels = await getDshConfiguredModels();
               return sendJson(res, 200, { ok: true, dshConfiguredModels });
             }
+            if (pathname === "/price-fluctuation" && (req.method === "GET" || req.method === "HEAD")) {
+              const config = await readPluginConfig();
+              const token = config.accessToken || config.sessionCookie || "";
+              if (!token || !config.userId) {
+                return sendJson(res, 200, { ok: true, data: { pendingCount: 0, unseenCount: 0, totalCount: 0, hasAuth: false, authError: false, updatedAt: Date.now() } });
+              }
+              const result = await fetchPriceFluctuation(config.userId, token, token);
+              const { notices, ...counts } = result;
+              const hasAuth = !counts.authError;
+              return sendJson(res, 200, { ok: true, data: { pendingCount: counts.pendingCount, unseenCount: counts.unseenCount, totalCount: counts.totalCount, hasAuth, authError: Boolean(counts.authError), updatedAt: Date.now() } });
+            }
             return sendJson(res, 404, { ok: false, error: "Not found" });
           } catch (err) {
             console.error("[dsh-a6api] API error:", err);