@mokuyoaxis/dsh-iris 0.1.0 → 0.1.1

package/lib/adapters.js

@@ -7,8 +7,10 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-
-const DASHSCOPE = 'https://dashscope.aliyuncs.com/api/v1';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { dashscopeApiBase } from './provider-protocol.js';
+import { chmodPrivateFile, ensurePrivateDir, privateSibling } from './private-storage.js';
 
 /**
  * 网络调用超时档位（2026-09-03 健康检查）：挂死的连接绝不能冻住盯守 tick——
@@ -111,8 +113,9 @@ export function dashscopeImageMode(model) {
 }
 
 /** 新版多模态同步协议：响应中直接返回图片 URL。 */
-export async function generateImageMultimodal({ key, model, prompt, size, n = 1, timeoutMs = T_SYNC_GEN, signal }) {
-  const res = await fetch(`${DASHSCOPE}/services/aigc/multimodal-generation/generation`, {
+export async function generateImageMultimodal({ key, baseUrl, model, prompt, size, n = 1, timeoutMs = T_SYNC_GEN, signal }) {
+  const apiBase = dashscopeApiBase(baseUrl);
+  const res = await fetch(`${apiBase}/services/aigc/multimodal-generation/generation`, {
     method: 'POST',
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal),
@@ -142,8 +145,9 @@ export async function startImageGeneration(opts) {
   }
   return { remoteTaskId: await submitImage(opts), urls: [] };
 }
-export async function submitImage({ key, model, prompt, size, n = 1, timeoutMs = T_SUBMIT, signal }) {
-  const res = await fetch(`${DASHSCOPE}/services/aigc/text2image/image-synthesis`, {
+export async function submitImage({ key, baseUrl, model, prompt, size, n = 1, timeoutMs = T_SUBMIT, signal }) {
+  const apiBase = dashscopeApiBase(baseUrl);
+  const res = await fetch(`${apiBase}/services/aigc/text2image/image-synthesis`, {
     method: 'POST',
     headers: { ...authHeaders(key), 'X-DashScope-Async': 'enable' },
     signal: timeoutSignal(timeoutMs, signal),
@@ -165,12 +169,13 @@ export async function submitImage({ key, model, prompt, size, n = 1, timeoutMs =
  * - 其他（t2v/i2v）：POST /services/aigc/video-generation/video-synthesis，
  *   imgDataUrl 支持公网 URL 或 data:image base64。
  */
-export async function submitVideo({ key, model, prompt, imgDataUrl, size = '1280*720', duration, audioUrl, resolution, timeoutMs = T_SUBMIT, signal }) {
+export async function submitVideo({ key, baseUrl, model, prompt, imgDataUrl, size = '1280*720', duration, audioUrl, resolution, timeoutMs = T_SUBMIT, signal }) {
+  const apiBase = dashscopeApiBase(baseUrl);
   const isS2V = /s2v/i.test(model || '');
   let url, input, parameters;
   const headers = { ...authHeaders(key), 'X-DashScope-Async': 'enable' };
   if (isS2V) {
-    url = `${DASHSCOPE}/services/aigc/image2video/video-synthesis`;
+    url = `${apiBase}/services/aigc/image2video/video-synthesis`;
     input = { image_url: imgDataUrl, audio_url: audioUrl };
     parameters = {};
     if (resolution) parameters.resolution = String(resolution);
@@ -178,7 +183,7 @@ export async function submitVideo({ key, model, prompt, imgDataUrl, size = '1280
       headers['X-DashScope-OssResourceResolve'] = 'enable';
     }
   } else {
-    url = `${DASHSCOPE}/services/aigc/video-generation/video-synthesis`;
+    url = `${apiBase}/services/aigc/video-generation/video-synthesis`;
     input = { prompt };
     if (imgDataUrl) input.img_url = imgDataUrl;
     parameters = { size };
@@ -203,8 +208,9 @@ export async function submitVideo({ key, model, prompt, imgDataUrl, size = '1280
  * 返回 oss:// 形式 URL；调用模型时请求头须带 X-DashScope-OssResourceResolve: enable
  * （submitVideo 的 s2v 分支已自动处理）。
  */
-export async function uploadTempFile({ key, model, filePath, timeoutMs = T_UPLOAD, signal }) {
-  const u = new URL(`${DASHSCOPE}/uploads`);
+export async function uploadTempFile({ key, baseUrl, model, filePath, timeoutMs = T_UPLOAD, signal }) {
+  const apiBase = dashscopeApiBase(baseUrl);
+  const u = new URL(`${apiBase}/uploads`);
   u.searchParams.set('action', 'getPolicy');
   u.searchParams.set('model', model);
   const pres = await fetch(u, { headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal) });
@@ -230,8 +236,9 @@ export async function uploadTempFile({ key, model, filePath, timeoutMs = T_UPLOA
 const TERMINAL = new Set(['SUCCEEDED', 'FAILED', 'CANCELED', 'UNKNOWN']);
 
 /** @returns {{done:boolean, ok:boolean, urls:string[], message?:string}} */
-export async function pollTask({ key, remoteTaskId, timeoutMs = T_POLL }) {
-  const res = await fetch(`${DASHSCOPE}/tasks/${encodeURIComponent(remoteTaskId)}`, {
+export async function pollTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL }) {
+  const apiBase = dashscopeApiBase(baseUrl);
+  const res = await fetch(`${apiBase}/tasks/${encodeURIComponent(remoteTaskId)}`, {
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs)
   });
@@ -272,8 +279,9 @@ export async function pollTask({ key, remoteTaskId, timeoutMs = T_POLL }) {
 }
 
 /* ---------------- DashScope：qwen-tts（同步） ---------------- */
-export async function synthesizeTts({ key, model = 'qwen-tts-latest', text, voice = 'Cherry', timeoutMs = T_SYNC_GEN, signal }) {
-  const res = await fetch(`${DASHSCOPE}/services/aigc/multimodal-generation/generation`, {
+export async function synthesizeTts({ key, baseUrl, model = 'qwen-tts-latest', text, voice = 'Cherry', timeoutMs = T_SYNC_GEN, signal }) {
+  const apiBase = dashscopeApiBase(baseUrl);
+  const res = await fetch(`${apiBase}/services/aigc/multimodal-generation/generation`, {
     method: 'POST',
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal),
@@ -407,13 +415,19 @@ export function extFromUrl(url, fallback = 'bin') {
 export async function downloadTo(url, filePath, { timeoutMs = T_DOWNLOAD, signal } = {}) {
   const res = await fetch(url, { signal: timeoutSignal(timeoutMs, signal) });
   if (!res.ok) throw new Error(`下载结果失败：HTTP ${res.status}`);
-  const buf = Buffer.from(await res.arrayBuffer());
-  const { writeFileSync, renameSync } = await import('node:fs');
-  // 原子落盘：先写 .tmp 再 rename，失败/超时不留半截产物
-  const tmp = filePath + '.tmp';
-  writeFileSync(tmp, buf);
-  renameSync(tmp, filePath);
-  return buf.length;
+  if (!res.body) throw new Error('下载结果失败：响应没有内容');
+  ensurePrivateDir(path.dirname(filePath));
+  const tmp = privateSibling(filePath, 'download');
+  try {
+    const output = fs.createWriteStream(tmp, { flags: 'wx', mode: 0o600 });
+    await pipeline(Readable.fromWeb(res.body), output);
+    const bytes = fs.statSync(tmp).size;
+    fs.renameSync(tmp, filePath);
+    chmodPrivateFile(filePath);
+    return bytes;
+  } finally {
+    try { fs.rmSync(tmp, { force: true }); } catch (_) { /* rename 成功后已不存在 */ }
+  }
 }
 
 /* ---------------- DashScope：非实时语音识别（异步任务） ---------------- */
@@ -422,14 +436,15 @@ export async function downloadTo(url, filePath, { timeoutMs = T_DOWNLOAD, signal
  * @param {{key:string, model:string, audioUrl:string}} opts audioUrl 为 oss:// 或公网 URL
  * @returns {Promise<string>} remoteTaskId
  */
-export async function submitTranscription({ key, model = 'qwen-audio-3.0-asr-flash-filetrans', audioUrl, timeoutMs = T_SUBMIT, signal }) {
+export async function submitTranscription({ key, baseUrl, model = 'qwen-audio-3.0-asr-flash-filetrans', audioUrl, timeoutMs = T_SUBMIT, signal }) {
+  const apiBase = dashscopeApiBase(baseUrl);
   const headers = { ...authHeaders(key), 'X-DashScope-Async': 'enable' };
   if (/^oss:\/\//.test(audioUrl || '')) headers['X-DashScope-OssResourceResolve'] = 'enable';
   // Qwen3 Filetrans 使用单值 file_url；Qwen-Audio 3.0、Fun-ASR、Paraformer 使用 file_urls。
   const input = /^qwen3-asr-.*filetrans/i.test(model || '')
     ? { file_url: audioUrl }
     : { file_urls: [audioUrl] };
-  const res = await fetch(`${DASHSCOPE}/services/audio/asr/transcription`, {
+  const res = await fetch(`${apiBase}/services/audio/asr/transcription`, {
     method: 'POST',
     headers,
     signal: timeoutSignal(timeoutMs, signal),
@@ -461,8 +476,9 @@ export function transcriptionText(payload) {
 }
 
 /** 轮询 ASR 任务；正式结果位于 results[].transcription_url 指向的 JSON。 */
-export async function pollTranscriptionTask({ key, remoteTaskId, timeoutMs = T_POLL }) {
-  const res = await fetch(`${DASHSCOPE}/tasks/${encodeURIComponent(remoteTaskId)}`, {
+export async function pollTranscriptionTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL }) {
+  const apiBase = dashscopeApiBase(baseUrl);
+  const res = await fetch(`${apiBase}/tasks/${encodeURIComponent(remoteTaskId)}`, {
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs)
   });

package/lib/api.js

@@ -16,6 +16,8 @@ import { irisHome, capabilitiesOf, onChange as onConfigChange } from './config.j
 import { mimeOf, mediaUrl } from './media.js';
 import * as tasks from './tasks.js';
 import { runAction } from './actions.js';
+import { chmodPrivateFile, ensurePrivateDir } from './private-storage.js';
+import { inferMediaProtocol } from './provider-protocol.js';
 
 function readJsonSafe(file) {
   try {
@@ -42,7 +44,7 @@ function providerPublic(p) {
     type: p.type || 'openai',
     baseUrl: p.baseUrl,
     enabled: p.enabled !== false,
-    mediaProtocol: p.mediaProtocol || 'dashscope',
+    mediaProtocol: p.mediaProtocol || inferMediaProtocol(p.baseUrl),
     apiKeyHint: keyHint(p.apiKey),
     capabilities: capabilitiesOf(p),
     // 迁移/推断结果是否与原始声明不同（UI 提示旧配置已推断）
@@ -370,18 +372,28 @@ function safeName(name) {
 function handleUpload(req, res) {
   const q = new URL(req.url || '', 'http://x').searchParams;
   const name = safeName(q.get('name') || 'upload');
-  fs.mkdirSync(uploadsDir(), { recursive: true });
+  ensurePrivateDir(uploadsDir());
   purgeStaleUploads();
 
   const stem = Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 8);
   const abs = path.join(uploadsDir(), stem + '-' + name);
   const tmp = abs + '.part';
-  const out = fs.createWriteStream(tmp, { mode: 0o600, flags: 'wx' });
+  // 惰性建流：空上传全程不落盘。createWriteStream 的 open 是异步的，
+  // 若在 open 完成前 destroy，文件仍会被创建，同步 rmSync 删不到，留下孤儿 .part。
+  let out = null;
   let totalBytes = 0;
   let settled = false;
 
   const discard = () => {
-    try { out.destroy(); } catch (_) { /* ignore */ }
+    const stream = out;
+    out = null;
+    if (stream) {
+      // 兜底：等 fd 真正关闭（close 事件）后再删一次，覆盖 open 晚于 destroy 的竞态。
+      stream.once('close', () => {
+        try { fs.rmSync(tmp, { force: true }); } catch (_) { /* ignore */ }
+      });
+      try { stream.destroy(); } catch (_) { /* ignore */ }
+    }
     try { fs.rmSync(tmp, { force: true }); } catch (_) { /* ignore */ }
   };
   const finish = (status, body) => {
@@ -391,7 +403,14 @@ function handleUpload(req, res) {
     sendJson(res, status, body);
   };
 
-  out.on('error', (err) => finish(500, { error: 'upload failed: ' + String(err && err.message) }));
+  const ensureStream = () => {
+    if (!out) {
+      out = fs.createWriteStream(tmp, { mode: 0o600, flags: 'wx' });
+      out.on('error', (err) => finish(500, { error: 'upload failed: ' + String(err && err.message) }));
+    }
+    return out;
+  };
+
   req.on('data', (chunk) => {
     if (settled) return;
     totalBytes += chunk.length;
@@ -400,18 +419,21 @@ function handleUpload(req, res) {
       if (typeof req.resume === 'function') req.resume();
       return;
     }
-    if (!out.write(chunk) && typeof req.pause === 'function') {
+    const stream = ensureStream();
+    if (!stream.write(chunk) && typeof req.pause === 'function') {
       req.pause();
-      out.once('drain', () => { if (!settled && typeof req.resume === 'function') req.resume(); });
+      stream.once('drain', () => { if (!settled && typeof req.resume === 'function') req.resume(); });
     }
   });
   req.on('end', () => {
     if (settled) return;
     if (!totalBytes) return finish(400, { error: 'empty upload' });
-    out.end(() => {
+    const stream = out;
+    stream.end(() => {
       if (settled) return;
       try {
         fs.renameSync(tmp, abs);
+        chmodPrivateFile(abs);
         finish(200, { ok: true, path: abs, name, expiresInMs: UPLOAD_TTL_MS });
       } catch (err) {
         finish(500, { error: 'upload failed: ' + String(err && err.message) });
@@ -464,4 +486,4 @@ function serveTaskDetail(taskId, method, res) {
     'X-Content-Type-Options': 'nosniff'
   });
   res.end(method === 'HEAD' ? undefined : body);
-}
+}

package/lib/capability.js

@@ -2,7 +2,7 @@
 /**
  * Iris Provider 能力系统（阶段 1）。
  *
- * 目标（对齐 PLAN 阶段 1 与 RESEARCH 的 "test it, don't guess it"）：
+ * 目标（“实际验证，不只猜测”）：
  * - 能力常量：image-gen / video-gen / tts / transcribe / vision
  * - 严格选择：不具备某能力的 Provider 不得被兜底选中
  * - 有序 failover：同一能力按 providers.json 声明顺序返回，调用方按序尝试

package/lib/client.js

@@ -16,7 +16,7 @@
  * webServer 前缀模式），client 侧 fetch 轮询。全走标量，
  * apiKey 永不明文，产物给授权播放链接。
  */
-window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
+window.__ModuleLoader__.load({ id: '@mokuyoaxis/dsh-iris', factory: (require) => {
   var module = { exports: {} };
   var exports = module.exports;
 
@@ -438,15 +438,15 @@ window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
       var models = p.models || [];
       function verBadge(m, c) {
         var v = m.verified && m.verified[c];
-        if (!v) return React.createElement('span', { className: 'iris-pm-ver', title: '未实测' }, c + '?');
-        return React.createElement('span', { className: 'iris-pm-ver ' + (v.ok ? 'ok' : 'bad'), title: (v.ok ? '实测通过 ' : '实测未通过 ') + (v.note || '') }, c + (v.ok ? '✓' : '✗'));
+        var cls = 'iris-pm-ver' + (v ? (' ' + (v.ok ? 'ok' : 'bad')) : '');
+        var title = v ? ((v.ok ? '实测通过：' : '实测未通过：') + (v.note || '')) : '点击单独验证此能力';
+        return React.createElement('button', { key: c, className: cls, title: title, onClick: function () { props.testModel(p, m, c); } }, c + (v ? (v.ok ? '✓' : '✗') : '?'));
       }
       var rows = models.map(function (m) {
         var caps = m.capabilities || [];
         return React.createElement('div', { key: m.id, className: 'iris-pm-mrow' },
           React.createElement('span', { className: 'iris-pm-mname' }, m.id, m.source === 'manual' ? React.createElement('span', { className: 'iris-pm-mtag' }, '手动') : null),
           React.createElement('span', { className: 'iris-pm-mcaps' }, caps.map(function (c) { return verBadge(m, c); })),
-          React.createElement('button', { className: 'iris-pm-btn', title: '逐能力实测（image/tts 产生真实调用）', onClick: function () { props.testModel(p, m); } }, '测'),
           React.createElement('button', { className: 'iris-pm-btn danger', title: '从池移除', onClick: function () { props.removeModel(p, m); } }, '✕'));
       });
       return React.createElement('div', { className: 'iris-pm-pool' },
@@ -466,7 +466,7 @@ window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
       var addingPair = React.useState(false);
       var adding = addingPair[0];
       var setAdding = addingPair[1];
-      var newForm = React.useState({ name: '', baseUrl: '', apiKey: '', type: 'openai' });
+      var newForm = React.useState({ name: '', baseUrl: '', apiKey: '', type: 'openai', mediaProtocol: 'auto' });
       var notePair = React.useState('');
       var note = notePair[0];
       var setNote = notePair[1];
@@ -493,23 +493,25 @@ window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
         postAction('providers_remove', { id: p.id }).then(function (r) { if (r.ok) refresh(); else setNote(r.d.error || '删除失败'); });
       }
       function testVision(p) {
+        if (!window.confirm('视觉实测会向供应商发送一张内置测试图，可能产生费用。继续吗？')) return;
         setNote('测试「' + (p.name || p.id) + '」的视觉能力…');
-        postAction('providers_test_vision', { id: p.id }).then(function (r) { setNote(r.d.text || r.d.error || '测试完成'); refresh(); });
+        postAction('providers_test_vision', { id: p.id, confirm_paid: true }).then(function (r) { setNote(r.d.text || r.d.error || '测试完成'); refresh(); });
       }
       function discover(p) {
         setNote('正在发现「' + (p.name || p.id) + '」的模型…');
         postAction('providers_discover', { id: p.id }).then(function (r) { setNote(r.d.text || r.d.error || '发现完成'); refresh(); });
       }
-      function testModel(p, m) {
-        var caps = (m.capabilities || []).length ? m.capabilities : ['vision'];
-        setNote('实测 ' + m.id + '（' + caps.join('/') + '，image/tts 会产生真实调用）…');
-        // 逐个能力测，串行；每个存 verified
-        caps.reduce(function (chain, c) {
-          return chain.then(function () {
-            return postAction('providers_test_model', { id: p.id, model_id: m.id, capability: c })
-              .then(function (r) { setNote(r.d.text || r.d.error || ''); });
-          });
-        }, Promise.resolve()).then(function () { refresh(); });
+      function testModel(p, m, capability) {
+        var noProbe = capability === 'video-gen' || capability === 'transcribe';
+        if (!noProbe && !window.confirm('将用模型「' + m.id + '」发起一次真实的 ' + capability + ' 请求，可能产生费用。继续吗？')) return;
+        setNote('验证 ' + m.id + ' · ' + capability + '…');
+        postAction('providers_test_model', { id: p.id, model_id: m.id, capability: capability, confirm_paid: !noProbe })
+          .then(function (r) { setNote(r.d.text || r.d.error || ''); refresh(); });
+      }
+      function setProtocol(p, value) {
+        postAction('providers_upsert', { id: p.id, mediaProtocol: value }).then(function (r) {
+          setNote(r.ok ? '媒体协议已更新' : (r.d.error || '更新失败')); refresh();
+        });
       }
       function removeModel(p, m) {
         if (!window.confirm('从池中移除模型「' + m.id + '」？')) return;
@@ -525,6 +527,9 @@ window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
         if (open) {
           body = React.createElement('div', { className: 'iris-pm-body' },
             React.createElement('div', { className: 'iris-pm-note' }, 'Key ' + (p.apiKeyHint || '未配置') + ' · ' + (p.type || '') + ' · ' + (p.mediaProtocol || '')),
+            React.createElement('div', { className: 'iris-pm-field' }, React.createElement('label', {}, '媒体协议'), React.createElement('select', { value: p.mediaProtocol || 'openai-images', onChange: function (e) { setProtocol(p, e.target.value); } },
+              React.createElement('option', { value: 'dashscope' }, 'DashScope（仅阿里云官方 HTTPS）'),
+              React.createElement('option', { value: 'openai-images' }, 'OpenAI Images 兼容'))),
             React.createElement('div', { className: 'iris-pm-note' }, '能力: ' + ((p.capabilities || []).join(' / ') || '无')),
             React.createElement(ModelPool, { provider: p, onNote: setNote, onDone: refresh, testModel: testModel, removeModel: removeModel, addModel: addModel }),
             React.createElement('div', { className: 'iris-wb-row' },
@@ -544,6 +549,10 @@ window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
           React.createElement('div', { className: 'iris-pm-field' }, React.createElement('label', {}, '名称'), React.createElement('input', { value: newForm[0].name, placeholder: '如 阿里云百炼', onChange: function (e) { newForm[1]({ ...newForm[0], name: e.target.value }); } })),
           React.createElement('div', { className: 'iris-pm-field' }, React.createElement('label', {}, 'Base URL *'), React.createElement('input', { value: newForm[0].baseUrl, placeholder: 'https://dashscope.aliyuncs.com/compatible-mode/v1', onChange: function (e) { newForm[1]({ ...newForm[0], baseUrl: e.target.value }); } })),
           React.createElement('div', { className: 'iris-pm-field' }, React.createElement('label', {}, 'API Key *'), React.createElement('input', { type: 'password', value: newForm[0].apiKey, placeholder: 'sk-...', onChange: function (e) { newForm[1]({ ...newForm[0], apiKey: e.target.value }); } })),
+          React.createElement('div', { className: 'iris-pm-field' }, React.createElement('label', {}, '媒体协议'), React.createElement('select', { value: newForm[0].mediaProtocol, onChange: function (e) { newForm[1]({ ...newForm[0], mediaProtocol: e.target.value }); } },
+            React.createElement('option', { value: 'auto' }, '自动（按 Base URL 安全判断）'),
+            React.createElement('option', { value: 'dashscope' }, 'DashScope（阿里云官方）'),
+            React.createElement('option', { value: 'openai-images' }, 'OpenAI Images 兼容'))),
           React.createElement('div', { className: 'iris-wb-row' },
             React.createElement('button', { className: 'iris-act-run', onClick: addProvider }, '保存'),
             React.createElement('button', { className: 'iris-pm-btn', onClick: function () { setAdding(false); } }, '取消')));
@@ -1184,4 +1193,4 @@ window.__ModuleLoader__.load({ id: 'dsh-iris', factory: (require) => {
 
   module.exports = { inject: inject, apply: apply };
   return module.exports;
-}});
+}});

package/lib/config.js

@@ -1,7 +1,7 @@
 'use strict';
 /**
  * Iris 配置存储：$DSH_HOME/iris/v1/providers.json
- * 结构与 ai-paint 工作台兼容（providers 数组同形），支持一键导入。
+ * Iris 独立持有配置；旧工作台仅作为用户显式指定的一次性导入来源。
  * Key 明文落盘（0600）；接口层永远不回明文。
  */
 import fs from 'node:fs';
@@ -9,6 +9,37 @@ import path from 'node:path';
 import os from 'node:os';
 import * as cap from './capability.js';
 import * as models from './models.js';
+import { atomicWritePrivate, chmodPrivateFile, privateSibling } from './private-storage.js';
+import { inferMediaProtocol } from './provider-protocol.js';
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function validateStoredConfig(value) {
+  if (!isPlainObject(value)) throw new Error('配置根节点必须是对象');
+  if (!Array.isArray(value.providers)) throw new Error('providers 必须是数组');
+  if (!isPlainObject(value.assignments)) throw new Error('assignments 必须是对象');
+  for (const provider of value.providers) {
+    if (!isPlainObject(provider)) throw new Error('provider 条目必须是对象');
+    if (provider.id !== undefined && typeof provider.id !== 'string') throw new Error('provider.id 必须是字符串');
+    if (provider.baseUrl !== undefined && typeof provider.baseUrl !== 'string') throw new Error('provider.baseUrl 必须是字符串');
+    if (provider.apiKey !== undefined && typeof provider.apiKey !== 'string') throw new Error('provider.apiKey 必须是字符串');
+    if (provider.models !== undefined && !Array.isArray(provider.models)) throw new Error('provider.models 必须是数组');
+    for (const model of provider.models || []) {
+      if (typeof model === 'string') continue;
+      if (!isPlainObject(model) || typeof model.id !== 'string' || !model.id.trim()) {
+        throw new Error('provider.models 条目必须是模型名或带 id 的对象');
+      }
+    }
+  }
+}
+
+function normalizeStoredProvider(provider) {
+  if (provider.mediaProtocol === 'dashscope' || provider.mediaProtocol === 'openai-images') return false;
+  provider.mediaProtocol = inferMediaProtocol(provider.baseUrl);
+  return true;
+}
 
 export function irisHome() {
   const home = process.env.DSH_HOME || path.join(os.homedir(), '.dsh');
@@ -35,16 +66,7 @@ function emitChange() {
 }
 
 function persist() {
-  fs.mkdirSync(path.dirname(storeFile()), { recursive: true });
-  const tmp = storeFile() + '.tmp';
-  // 0600 从创建时生效（含临时文件）；rename 保留 mode，chmod 兜底不依赖 umask
-  fs.writeFileSync(tmp, JSON.stringify(cache, null, 2), { mode: 0o600 });
-  fs.renameSync(tmp, storeFile());
-  try {
-    fs.chmodSync(storeFile(), 0o600);
-  } catch (_) {
-    /* ignore */
-  }
+  atomicWritePrivate(storeFile(), JSON.stringify(cache, null, 2));
   emitChange(); // 任何配置落盘 = 状态变了 → SSE 推送
 }
 
@@ -58,14 +80,22 @@ export function load() {
     return cache;
   }
   try {
-    cache = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (!Array.isArray(cache.providers)) cache.providers = [];
-    if (!cache.assignments || typeof cache.assignments !== 'object') cache.assignments = {};
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    let normalized = false;
+    if (isPlainObject(parsed) && parsed.assignments === undefined) {
+      parsed.assignments = {};
+      normalized = true;
+    }
+    validateStoredConfig(parsed);
+    cache = parsed;
+    for (const provider of cache.providers) normalized = normalizeStoredProvider(provider) || normalized;
+    if (normalized) persist();
   } catch (err) {
     // 文件存在但损坏：隔离，绝不静默覆盖证据
-    const backup = file + '.corrupted-' + Date.now();
+    const backup = privateSibling(file, 'corrupted');
     try {
       fs.renameSync(file, backup);
+      chmodPrivateFile(backup);
     } catch (_) {
       /* 隔离失败也继续 */
     }
@@ -81,7 +111,7 @@ export function resetCache() {
   cache = null;
 }
 
-/** 首次运行且 Iris 为空时，从工作台配置导入（迁移动作，非耦合） */
+/** 用户显式指定来源且 Iris 为空时，从工作台配置导入。 */
 export function importFromWorkbench(workbenchConfigPath) {
   const c = load();
   if (c.providers.length) return { imported: 0, reason: '已有配置，跳过导入' };
@@ -89,12 +119,13 @@ export function importFromWorkbench(workbenchConfigPath) {
   try {
     raw = JSON.parse(fs.readFileSync(workbenchConfigPath, 'utf8'));
   } catch (_) {
-    return { imported: 0, reason: '未找到工作台配置' };
+    return { imported: 0, reason: '来源文件不可读或 JSON 无效' };
   }
-  const list = Array.isArray(raw.providers) ? raw.providers : [];
+  const list = Array.isArray(raw?.providers) ? raw.providers : [];
   let n = 0;
   for (const p of list) {
-    if (!p || !p.apiKey || !p.baseUrl) continue;
+    if (!p || typeof p.apiKey !== 'string' || !p.apiKey.trim() ||
+        typeof p.baseUrl !== 'string' || !p.baseUrl.trim()) continue;
     c.providers.push({
       id: 'iris_' + Math.random().toString(36).slice(2, 8),
       name: p.name || p.id,
@@ -102,13 +133,12 @@ export function importFromWorkbench(workbenchConfigPath) {
       baseUrl: p.baseUrl,
       apiKey: p.apiKey,
       enabled: p.enabled !== false,
-      // 媒体生成默认走百炼协议；OpenAI Images 兼容后端由用户按需切换
-      mediaProtocol: /dashscope/i.test(p.baseUrl) ? 'dashscope' : 'openai-images'
+      mediaProtocol: inferMediaProtocol(p.baseUrl)
     });
     n++;
   }
   if (n) persist();
-  return { imported: n };
+  return n ? { imported: n } : { imported: 0, reason: '来源没有可导入的供应商' };
 }
 
 export function providers() {
@@ -271,12 +301,16 @@ export function upsert(provider) {
   if (id) {
     const i = c.providers.findIndex((p) => p.id === id);
     if (i >= 0) {
+      if (rest.mediaProtocol === 'auto') rest.mediaProtocol = inferMediaProtocol(rest.baseUrl ?? c.providers[i].baseUrl);
       c.providers[i] = { ...c.providers[i], ...rest };
+      normalizeStoredProvider(c.providers[i]);
       persist();
       return c.providers[i];
     }
   }
   const fresh = { id: 'iris_' + Math.random().toString(36).slice(2, 8), ...rest };
+  if (fresh.mediaProtocol === 'auto') delete fresh.mediaProtocol;
+  normalizeStoredProvider(fresh);
   c.providers.push(fresh);
   persist();
   return fresh;

package/lib/guard.js

@@ -1,41 +1,54 @@
 'use strict';
 /**
- * Iris 请求守卫（O2 授权边界，2026-09-03 修订为"发布安全优先"）。
+ * Iris 请求守卫。
  *
- * 调研宿主结论：DSH 在 `dsh-client-connection` 里有一套权威信任栅栏
- * `isTrustedApiRequest`（回环∪trustedHosts + Sec-Fetch-Site + Origin==Host），
- * 但它**只挂在 `/api` 前缀**。iris 注册的是 `/iris/*` 裸 prefix 路由，在栅栏之外，
- * 所以 iris 需自备一道——但必须**对齐宿主里"永不锁死合法用户"的那半，
- * 舍弃"会锁死 LAN/反代用户"的那半**。
- *
- * 威胁与处置（按发布安全排序）：
- * ① 驱动式 CSRF（真实、高价值）：恶意网页对 `/iris/api/actions/*` 发跨站 POST，
- *    触发付费生成/写盘。→ **挡**：POST 时 `Sec-Fetch-Site === cross-site` 拒绝；
- *    有 `Origin` 且 `Origin.host !== 请求 Host` 拒绝。合法同源用户（不管在回环/LAN/
- *    反代域名上访问，浏览器 Origin 总与 Host 同源）永不误伤；无 Origin 的 CLI/curl 放行。
- * ② DNS 重绑定读 state / 驱动 POST（低价值）：需要 Host 白名单才能挡，但白名单正是
- *    锁死 LAN/反代用户的元凶。用户裁定：iris 开源、反代场景无所谓 → **不挡**，
- *    读接口（GET/HEAD/SSE）完全放开（跨源读本就受 CORS 阻挡，媒体另有 token 能力凭证）。
- *
- * 净效果：**任何部署拓扑都不拦合法用户**，只挡跨站 CSRF 驱动付费动作。
+ * `/iris/*` 不经过 DSH 的 `/api` 信任栅栏，因此默认只接受回环 Host。
+ * LAN/反代场景需用 IRIS_TRUSTED_HOSTS 显式列出 host 或 host:port；这只是
+ * Host 边界，不是身份认证。POST 另外校验 Sec-Fetch-Site 与 Origin==Host。
  */
 
 /** 请求 Host 头 → host:port 规范化（小写，去 IPv6 方括号保留） */
 function authority(header) {
-  const h = String(header || '').trim().toLowerCase();
-  if (!h) return '';
-  return h;
+  return String(header || '').trim().toLowerCase();
+}
+
+function hostnameOf(value) {
+  try { return new URL('http://' + authority(value)).hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase(); }
+  catch (_) { return ''; }
+}
+
+function isLoopbackHost(hostname) {
+  if (hostname === 'localhost' || hostname === '::1') return true;
+  const match = hostname.match(/^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  return !!match && match.slice(1).every((part) => Number(part) <= 255);
+}
+
+/** Host 是否属于默认回环或显式信任列表。列表格式：逗号分隔 host / host:port。 */
+export function isTrustedHost(hostHeader, configured = process.env.IRIS_TRUSTED_HOSTS || '') {
+  const host = authority(hostHeader);
+  const hostname = hostnameOf(host);
+  if (!host || !hostname) return false;
+  if (isLoopbackHost(hostname)) return true;
+  for (const raw of String(configured || '').split(',')) {
+    const entry = authority(raw);
+    if (!entry) continue;
+    if (entry === host) return true;
+    if (!entry.includes(':') && entry.replace(/\.$/, '') === hostname) return true;
+  }
+  return false;
 }
 
 /**
  * 纯函数裁决：{ok:true} 放行；否则 {ok:false, status, error}。
- * 非 POST 一律放行；POST 仅挡跨站/跨源（同源浏览器与无 Origin 的 CLI 放行）。
  * @param {{method?:string, headers?:object}} req node:http IncomingMessage 的最小面
  */
-export function checkRequest(req) {
+export function checkRequest(req, options = {}) {
   const headers = req.headers || {};
   const method = String(req.method || 'GET').toUpperCase();
-  if (method !== 'POST') return { ok: true }; // 读接口放开：跨源读受 CORS 挡，媒体有 token
+  if (!isTrustedHost(headers.host, options.trustedHosts)) {
+    return { ok: false, status: 403, error: 'untrusted host' };
+  }
+  if (method !== 'POST') return { ok: true };
 
   const sfs = String(headers['sec-fetch-site'] || '').toLowerCase();
   if (sfs === 'cross-site') return { ok: false, status: 403, error: 'cross-site request denied' };
@@ -50,7 +63,7 @@ export function checkRequest(req) {
     }
     if (oh !== authority(headers.host)) return { ok: false, status: 403, error: 'cross-origin request denied' };
   }
-  return { ok: true }; // 同源浏览器，或无 Origin 的本机 CLI/curl
+  return { ok: true };
 }
 
 /** 包裹路由 handler：未授权请求统一 403 人话 JSON，不进业务 handler */