@nvae/llmswitch 1.2.0 → 1.3.0

package/README.md

@@ -92,6 +92,21 @@ llms codex model --profile my-provider
 
 有 API Key 时会自动获取上游模型列表，也可手动输入模型 ID。
 
+Claude Code 与 OpenCode 支持在默认模型之外再配一个轻量小模型，用于标题生成、总结这类低成本任务。选完默认模型后会多问一步「选择轻量小模型」，选「不设置」则沿用默认模型：
+
+```bash
+# 交互选择（默认模型 → 启用模型 → 轻量小模型）
+llms opencode model
+
+# 直接指定，跳过小模型的交互
+llms opencode model --small glm-4.5-air
+
+# 清除已配置的小模型
+llms opencode model --small ""
+```
+
+小模型会写入各工具自己的配置项：OpenCode 写顶层 `small_model`，Claude Code 写 `ANTHROPIC_SMALL_FAST_MODEL` / `ANTHROPIC_DEFAULT_HAIKU_MODEL`。Codex 没有对应开关，因此不提供该选项。
+
 ### 4. 启用配置
 
 ```bash
@@ -119,6 +134,12 @@ llms launch claude --profile my-provider --model claude-sonnet-4
 
 未指定 `--profile` 时，会自动选择包含目标模型的配置。
 
+命令行上给出的模型只作用于本次启动，不会改动已保存的供应商配置（避免打错一个模型名就把它变成默认模型）。要让它成为该供应商的新默认模型，显式加 `--save`：
+
+```bash
+llms launch codex gpt-4.1 --save
+```
+
 ### 6. 预览执行计划
 
 ```bash
@@ -129,9 +150,26 @@ llms launch codex gpt-4.1 --dry-run
 llms launch codex gpt-4.1 --dry-run --json
 ```
 
-### 7. 管理本地 Bridge
+### 7. 非交互使用（脚本 / CI）
 
-Claude Code 或 Codex 使用非原生协议时，会自动启动本地 Bridge。
+供应商管理除交互菜单外，也提供可脚本化的子命令。参数齐全时不会出现任何提示：
+
+```bash
+# 添加并启用（--no-enable 则只保存不启用）
+llms opencode provider add \
+  --base-url https://api.example.com/v1 --api-key sk-xxx \
+  --name myprov --model glm-4.6 --small glm-4.5-air --json
+
+# 列出与删除
+llms opencode provider list --json
+llms opencode provider rm myprov --yes
+```
+
+所有交互式命令在 stdin 不是 TTY 时会立即报错并提示对应参数，而不是静默等待输入。
+
+### 8. 管理本地 Bridge
+
+Claude Code、Codex 或 OpenCode 使用非原生协议时，会自动启动本地 Bridge。
 
 ```bash
 # 查看 Bridge 状态
@@ -141,12 +179,13 @@ llms bridge status
 llms bridge start
 llms bridge stop
 
-# 重载配置
+# 重载配置（三个工具都支持）
 llms bridge reload claude
 llms bridge reload codex --profile my-provider
+llms bridge reload opencode
 ```
 
-### 8. 对外提供 AI 网关
+### 9. 对外提供 AI 网关
 
 Bridge 服务的是本机的 Claude Code / Codex / OpenCode。如果要让**第三方客户端**通过一个端口访问你配置的模型，用 gateway：
 
@@ -255,7 +294,7 @@ llms gateway key create --name partner \
   --daily-requests 5000
 
 llms gateway key list
-llms gateway key edit <id> --rate-limit 120          # 改限额/作用域/续期
+llms gateway key edit <id> --rate-limit 120 --daily-requests 8000   # 改限额/作用域/续期
 llms gateway key rotate <id>                          # 换发明文，旧 Key 立即失效
 llms gateway key revoke <id>
 ```
@@ -333,14 +372,14 @@ llms gateway logs --follow     # 持续跟踪
 
 | 环境变量 | 默认 | 说明 |
 | --- | --- | --- |
-| `LLM_SWITCH_MAX_CONCURRENCY` | 16 | 最大并发请求数 |
+| `LLM_SWITCH_MAX_CONCURRENCY` | 0（不限） | 最大并发请求数，超出返回 503；0 表示不限 |
 | `LLM_SWITCH_MAX_BODY_BYTES` | 16MB | 请求体上限 |
 | `LLM_SWITCH_MAX_RESPONSE_BYTES` | 32MB | 上游响应上限 |
 | `LLM_SWITCH_CONNECT_TIMEOUT_MS` | 30000 | 上游连接超时 |
 | `LLM_SWITCH_IDLE_TIMEOUT_MS` | 90000 | 流式空闲超时 |
 | `LLM_SWITCH_TOTAL_TIMEOUT_MS` | 600000 | 单请求总超时 |
 
-`llms gateway config show` 会一并显示当前生效值。
+`llms gateway config show` 会一并显示当前生效值（加 `--json` 可拿结构化输出）。这些限额对 gateway 与 Bridge 同时生效。
 
 **对外暴露的安全要求**：默认只绑回环地址。绑到非回环地址必须显式传 `--allow-remote`，且至少存在一个有效 API Key，否则拒绝启动。
 
@@ -365,11 +404,12 @@ llms gateway config set --cors-origins https://app.example.com
 | `llms` | 选择工具并启动（未配置时自动引导） |
 | `llms <tool>` | 直接启动工具（未配置时自动引导完整链路） |
 | `llms setup [--tool <tool>]` | 显式引导配置（添加供应商 → 模型 → 启用 → 启动） |
-| `llms <tool> provider` | 管理供应商配置（添加、查看、编辑、删除） |
+| `llms <tool> provider` | 交互管理供应商（添加、查看、编辑、删除） |
+| `llms <tool> provider list/add/rm` | 非交互增删查（脚本 / CI 用） |
 | `llms <tool> use [name]` | 启用指定配置 |
 | `llms <tool> current` | 查看当前配置 |
 | `llms <tool> model` | 选择模型 |
-| `llms launch/run <tool> [model]` | 启动工具 |
+| `llms launch/run <tool> [model]` | 启动工具（加 `--save` 才改默认模型） |
 | `llms bridge status` | 查看 Bridge 状态 |
 | `llms gateway start` | 启动对外 AI 网关 |
 | `llms gateway provider import` | 从工具配置导入网关供应商 |
@@ -399,10 +439,13 @@ llms launch --help
 | --- | --- |
 | llmswitch 配置 | `~/.config/llm-switch/` |
 | 网关供应商 / Key / 日志 | `~/.config/llm-switch/gateway/` |
+| 写入前的自动备份 | `~/.config/llm-switch/<tool>/backups/`（每类保留最近 10 份） |
 | Claude Code | `~/.claude/settings.json` |
 | Codex | `~/.codex/config.toml` |
 | OpenCode | `~/.config/opencode/opencode.json` |
 
+修改这些工具的配置前会先备份原文件；备份含明文 API Key，因此按类别只保留最近 10 份。若目标配置文件语法损坏，命令会报出具体文件路径而不是崩溃。
+
 查看实际路径：
 
 ```bash

package/dist/adapters/claude.js

@@ -1,8 +1,7 @@
-import { existsSync, readFileSync } from "node:fs";
 import { emptyProxy } from "../types.js";
 import { assertCompatible } from "../formats/compatibility.js";
 import { clearBridgeUpstream, ensureBridgeForProfile, profileNeedsBridge, } from "../bridge/manager.js";
-import { backupFile, atomicWriteFile } from "../utils/fs.js";
+import { backupFile, atomicWriteFile, readStructuredFile, stringRecordAt, } from "../utils/fs.js";
 import { applyProxyToEnvRecord, clearProxyEnvKeys, } from "../utils/proxy.js";
 import { getBackupsDir, getClaudeSettingsPath, } from "../utils/paths.js";
 import { setActiveProfile } from "../store/profiles.js";
@@ -24,9 +23,10 @@ export const CLAUDE_MANAGED_ENV_KEYS = [
     "all_proxy",
 ];
 export function readClaudeSettings(path = getClaudeSettingsPath()) {
-    if (!existsSync(path))
-        return {};
-    return JSON.parse(readFileSync(path, "utf8"));
+    return readStructuredFile(path, (text) => JSON.parse(text), {
+        label: "Claude Code 配置",
+        fallback: () => ({}),
+    });
 }
 function stripManagedEnv(env) {
     const next = { ...env };
@@ -37,7 +37,7 @@ function stripManagedEnv(env) {
 }
 export function buildClaudeSettings(existing, profile, effectiveBaseUrl, effectiveApiKey = profile.apiKey) {
     assertCompatible("claude", profile.apiFormat);
-    const env = stripManagedEnv({ ...(existing.env || {}) });
+    const env = stripManagedEnv(stringRecordAt(existing, "env"));
     clearProxyEnvKeys(env);
     const needsBridge = profileNeedsBridge(profile);
     env.ANTHROPIC_BASE_URL = effectiveBaseUrl || profile.baseUrl;
@@ -47,9 +47,9 @@ export function buildClaudeSettings(existing, profile, effectiveBaseUrl, effecti
     env.ANTHROPIC_MODEL = profile.models.default;
     env.ANTHROPIC_DEFAULT_SONNET_MODEL = profile.models.default;
     env.ANTHROPIC_DEFAULT_OPUS_MODEL = profile.models.default;
-    if (profile.models.fast) {
-        env.ANTHROPIC_SMALL_FAST_MODEL = profile.models.fast;
-        env.ANTHROPIC_DEFAULT_HAIKU_MODEL = profile.models.fast;
+    if (profile.models.smallModel) {
+        env.ANTHROPIC_SMALL_FAST_MODEL = profile.models.smallModel;
+        env.ANTHROPIC_DEFAULT_HAIKU_MODEL = profile.models.smallModel;
     }
     else {
         env.ANTHROPIC_SMALL_FAST_MODEL = profile.models.default;
@@ -103,7 +103,7 @@ export async function deactivateClaudeProfile() {
     const configPath = getClaudeSettingsPath();
     const existing = readClaudeSettings(configPath);
     const backupPath = backupFile(configPath, getBackupsDir("claude"), "settings");
-    const env = stripManagedEnv({ ...(existing.env || {}) });
+    const env = stripManagedEnv(stringRecordAt(existing, "env"));
     clearProxyEnvKeys(env);
     const next = { ...existing, env };
     if (Object.keys(env).length === 0)

package/dist/adapters/codex.js

@@ -1,19 +1,47 @@
 import { existsSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { parse, stringify } from "smol-toml";
 import { emptyProxy } from "../types.js";
 import { assertCompatible } from "../formats/compatibility.js";
 import { normalizeBaseUrlForFormat } from "../utils/base-url.js";
-import { atomicWriteFile, backupFile, ensureDir } from "../utils/fs.js";
+import { backupFile, ensureDir, plainObjectAt, readStructuredFile, writeFilesAtomically, } from "../utils/fs.js";
 import { buildProxyEnv } from "../utils/proxy.js";
 import { getBackupsDir, getCodexConfigPath, getCodexEnvPath, getCodexHome, } from "../utils/paths.js";
 import { setActiveProfile } from "../store/profiles.js";
 import { clearBridgeUpstream, ensureBridgeForProfile, profileNeedsBridge, } from "../bridge/manager.js";
+/**
+ * Codex identifiers derived from a profile name.
+ *
+ * Profile names may contain `-` (see NAME_RE) but Codex provider keys and env
+ * var names are safest restricted to `[A-Za-z0-9_]`. Naively replacing `-` with
+ * `_` is not injective: `a-b` and `a_b` both collapse to `a_b`, so one profile
+ * would silently overwrite the other's provider block and API key. Append a
+ * short hash of the original name whenever the name contains a character that
+ * gets rewritten, which keeps distinct profiles distinct.
+ */
+function sanitizeCodexId(name) {
+    const sanitized = name.replace(/[^a-zA-Z0-9_]/g, "_");
+    if (sanitized === name)
+        return sanitized;
+    const suffix = createHash("sha256")
+        .update(name)
+        .digest("hex")
+        .slice(0, 6);
+    return `${sanitized}_${suffix}`;
+}
 function providerKey(name) {
+    return sanitizeCodexId(name);
+}
+/** Pre-fix form, kept only so stale entries can be cleaned up on apply. */
+function legacyProviderKey(name) {
     return name.replace(/[^a-zA-Z0-9_]/g, "_");
 }
 export function envKeyName(profileName) {
-    const key = providerKey(profileName).toUpperCase();
-    return `LLM_SWITCH_${key}_API_KEY`;
+    return `LLM_SWITCH_${providerKey(profileName).toUpperCase()}_API_KEY`;
+}
+/** Pre-fix env var name; removed alongside the current one so no key lingers. */
+export function legacyEnvKeyName(profileName) {
+    return `LLM_SWITCH_${legacyProviderKey(profileName).toUpperCase()}_API_KEY`;
 }
 /**
  * Model-level metadata Codex accepts in config.toml. Only `model_context_window`
@@ -30,19 +58,23 @@ function applyModelInfo(config, profile) {
     }
 }
 export function readCodexConfig(path = getCodexConfigPath()) {
-    if (!existsSync(path))
-        return {};
-    return parse(readFileSync(path, "utf8"));
+    return readStructuredFile(path, (text) => parse(text), {
+        label: "Codex 配置",
+        fallback: () => ({}),
+    });
 }
 export function buildCodexConfig(existing, profile, effectiveBaseUrl) {
     assertCompatible("codex", profile.apiFormat);
     const id = providerKey(profile.name);
     const providers = {
-        ...(existing.model_providers || {}),
+        ...plainObjectAt(existing, "model_providers"),
     };
     const providerBlock = {
         name: profile.displayName || profile.name,
         base_url: effectiveBaseUrl,
+        // 对 Codex 一律声明 responses：原生 openai-responses 上游直连，
+        // openai-chat 上游则由本地 bridge 转成 /v1/responses 后再交给 Codex，
+        // 两种情况下 Codex 看到的都是 Responses 协议。
         wire_api: "responses",
         env_key: envKeyName(profile.name),
         requires_openai_auth: false,
@@ -55,6 +87,10 @@ export function buildCodexConfig(existing, profile, effectiveBaseUrl) {
         }
     }
     providers[id] = providerBlock;
+    // 清掉旧命名方案留下的同名 provider 块（否则会与新键并存）。
+    const legacyId = legacyProviderKey(profile.name);
+    if (legacyId !== id)
+        delete providers[legacyId];
     const next = {
         ...existing,
         model: profile.models.default,
@@ -85,7 +121,11 @@ export function buildCodexEnvFile(existingContent, profile, effectiveApiKey = pr
             order.push(k);
         map.set(k, v);
     }
+    // 旧命名方案下的密钥行必须删掉，否则明文会一直留在 .env 里。
+    const legacyKeyName = legacyEnvKeyName(profile.name);
     const keyName = envKeyName(profile.name);
+    if (legacyKeyName !== keyName)
+        map.delete(legacyKeyName);
     if (!map.has(keyName))
         order.push(keyName);
     // When bridging, Codex talks to local bridge; key can be placeholder.
@@ -156,10 +196,13 @@ export async function applyCodexProfile(profile) {
     const existing = readCodexConfig(configPath);
     const backupPath = backupFile(configPath, getBackupsDir("codex"), "config");
     backupFile(envPath, getBackupsDir("codex"), "env");
+    // config.toml 与 .env 必须一起生效：先把两份内容都构造好，再作为一个单元写入。
     const next = buildCodexConfig(existing, profile, effectiveBaseUrl);
-    atomicWriteFile(configPath, stringify(next) + "\n");
     const prevEnv = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
-    atomicWriteFile(envPath, buildCodexEnvFile(prevEnv, profile, effectiveApiKey));
+    writeFilesAtomically([
+        { path: configPath, content: stringify(next) + "\n" },
+        { path: envPath, content: buildCodexEnvFile(prevEnv, profile, effectiveApiKey) },
+    ]);
     setActiveProfile("codex", profile.name);
     return {
         tool: "codex",
@@ -180,12 +223,15 @@ export async function deactivateCodexProfile(profileName) {
     backupFile(envPath, getBackupsDir("codex"), "env");
     const next = { ...existing };
     const providers = {
-        ...(existing.model_providers || {}),
+        ...plainObjectAt(existing, "model_providers"),
     };
     if (profileName) {
         const id = providerKey(profileName);
         delete providers[id];
-        if (next.model_provider === id) {
+        const legacyId = legacyProviderKey(profileName);
+        if (legacyId !== id)
+            delete providers[legacyId];
+        if (next.model_provider === id || next.model_provider === legacyId) {
             delete next.model_provider;
             delete next.model;
             delete next.model_context_window;
@@ -197,9 +243,11 @@ export async function deactivateCodexProfile(profileName) {
         delete next.model_context_window;
     }
     next.model_providers = providers;
-    atomicWriteFile(configPath, stringify(next) + "\n");
     const prevEnv = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
-    atomicWriteFile(envPath, stripCodexManagedEnv(prevEnv, profileName));
+    writeFilesAtomically([
+        { path: configPath, content: stringify(next) + "\n" },
+        { path: envPath, content: stripCodexManagedEnv(prevEnv, profileName) },
+    ]);
     await clearBridgeUpstream("codex");
     return {
         tool: "codex",
@@ -219,7 +267,9 @@ function stripCodexManagedEnv(existingContent, profileName) {
         "https_proxy",
         "all_proxy",
     ]);
-    const keyToRemove = profileName ? envKeyName(profileName) : null;
+    const keysToRemove = new Set(profileName
+        ? [envKeyName(profileName), legacyEnvKeyName(profileName)]
+        : []);
     const out = [];
     for (const line of lines) {
         const trimmed = line.trim();
@@ -238,9 +288,11 @@ function stripCodexManagedEnv(existingContent, profileName) {
         const k = trimmed.slice(0, eq).trim();
         if (proxyKeys.has(k))
             continue;
-        if (keyToRemove && k === keyToRemove)
+        if (keysToRemove.size > 0 && keysToRemove.has(k))
             continue;
-        if (!keyToRemove && k.startsWith("LLM_SWITCH_") && k.endsWith("_API_KEY")) {
+        if (keysToRemove.size === 0 &&
+            k.startsWith("LLM_SWITCH_") &&
+            k.endsWith("_API_KEY")) {
             continue;
         }
         out.push(line);

package/dist/adapters/opencode.js

@@ -1,8 +1,7 @@
-import { existsSync, readFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { assertCompatible } from "../formats/compatibility.js";
 import { normalizeBaseUrlForFormat } from "../utils/base-url.js";
-import { atomicWriteFile, backupFile, ensureDir } from "../utils/fs.js";
+import { backupFile, ensureDir, plainObjectAt, readStructuredFile, stringRecordAt, writeFilesAtomically, } from "../utils/fs.js";
 import { applyProxyToEnvRecord, clearProxyEnvKeys } from "../utils/proxy.js";
 import { getBackupsDir, getOpenCodeAuthPath, getOpenCodeConfigDir, getOpenCodeConfigPath, } from "../utils/paths.js";
 import { setActiveProfile } from "../store/profiles.js";
@@ -21,15 +20,16 @@ function npmForFormat(format) {
     }
 }
 export function readOpenCodeConfig(path = getOpenCodeConfigPath()) {
-    if (!existsSync(path)) {
-        return { $schema: "https://opencode.ai/config.json" };
-    }
-    return JSON.parse(readFileSync(path, "utf8"));
+    return readStructuredFile(path, (text) => JSON.parse(text), {
+        label: "OpenCode 配置",
+        fallback: () => ({ $schema: "https://opencode.ai/config.json" }),
+    });
 }
 export function readOpenCodeAuth(path = getOpenCodeAuthPath()) {
-    if (!existsSync(path))
-        return {};
-    return JSON.parse(readFileSync(path, "utf8"));
+    return readStructuredFile(path, (text) => JSON.parse(text), {
+        label: "OpenCode 凭据文件",
+        fallback: () => ({}),
+    });
 }
 /**
  * Build one model entry for the OpenCode provider block, filling in every
@@ -81,6 +81,9 @@ export function buildOpenCodeProviderBlock(profile, overrides) {
     if (!models[profile.models.default]) {
         models[profile.models.default] = buildOpenCodeModelEntry(profile.models.default, metaById[profile.models.default]);
     }
+    if (profile.models.smallModel && !models[profile.models.smallModel]) {
+        models[profile.models.smallModel] = buildOpenCodeModelEntry(profile.models.smallModel, metaById[profile.models.smallModel]);
+    }
     const options = {
         baseURL: overrides?.baseURL ||
             normalizeBaseUrlForFormat(profile.apiFormat, profile.baseUrl),
@@ -102,16 +105,12 @@ export function buildOpenCodeProviderBlock(profile, overrides) {
 export function buildOpenCodeConfig(existing, profile, overrides) {
     assertCompatible("opencode", profile.apiFormat);
     const id = providerId(profile.name);
-    const providers = {
-        ...(existing.provider || {}),
-    };
+    const providers = { ...plainObjectAt(existing, "provider") };
     providers[id] = buildOpenCodeProviderBlock(profile, overrides);
     // Optional top-level env for proxy (OpenCode may pass through). When the
     // profile routes through the bridge, the upstream proxy is applied inside the
     // bridge; skip env-var proxy injection so OpenCode doesn't apply its own.
-    const env = {
-        ...(existing.env || {}),
-    };
+    const env = stringRecordAt(existing, "env");
     clearProxyEnvKeys(env);
     if (!overrides) {
         applyProxyToEnvRecord(env, profile.proxy);
@@ -122,6 +121,15 @@ export function buildOpenCodeConfig(existing, profile, overrides) {
         provider: providers,
         model: `${id}/${profile.models.default}`,
     };
+    // `small_model` handles lightweight tasks (title generation, summaries).
+    // Only touch it when it is ours: a user-configured value pointing at another
+    // provider must survive.
+    if (profile.models.smallModel) {
+        next.small_model = `${id}/${profile.models.smallModel}`;
+    }
+    else if (ownsModelRef(existing.small_model, id)) {
+        delete next.small_model;
+    }
     if (Object.keys(env).length > 0) {
         next.env = env;
     }
@@ -130,6 +138,10 @@ export function buildOpenCodeConfig(existing, profile, overrides) {
     }
     return next;
 }
+/** Whether an OpenCode `provider/model` reference belongs to the given provider id. */
+function ownsModelRef(value, id) {
+    return typeof value === "string" && value.startsWith(`${id}/`);
+}
 export function buildOpenCodeAuth(existing, profile) {
     const id = providerId(profile.name);
     const next = { ...existing };
@@ -157,10 +169,13 @@ export async function applyOpenCodeProfile(profile) {
     const nextConfig = buildOpenCodeConfig(existing, profile, bridgeConnection
         ? { baseURL: bridgeConnection.baseUrl, apiKey: bridgeConnection.clientToken }
         : undefined);
-    atomicWriteFile(configPath, JSON.stringify(nextConfig, null, 2) + "\n");
+    // opencode.json 与 auth.json 必须一起生效，否则会出现“选了供应商但没有凭据”的半更新状态。
     const bridgeApiKey = bridgeConnection?.clientToken || profile.apiKey;
     const nextAuth = buildOpenCodeAuth(readOpenCodeAuth(authPath), { ...profile, apiKey: bridgeApiKey });
-    atomicWriteFile(authPath, JSON.stringify(nextAuth, null, 2) + "\n");
+    writeFilesAtomically([
+        { path: configPath, content: JSON.stringify(nextConfig, null, 2) + "\n" },
+        { path: authPath, content: JSON.stringify(nextAuth, null, 2) + "\n" },
+    ]);
     setActiveProfile("opencode", profile.name);
     return {
         tool: "opencode",
@@ -180,15 +195,11 @@ export function deactivateOpenCodeProfile(profileName) {
     const existing = readOpenCodeConfig(configPath);
     const backupPath = backupFile(configPath, getBackupsDir("opencode"), "opencode");
     backupFile(authPath, getBackupsDir("opencode"), "auth");
-    const providers = {
-        ...(existing.provider || {}),
-    };
+    const providers = { ...plainObjectAt(existing, "provider") };
     const id = profileName ? providerId(profileName) : null;
     if (id)
         delete providers[id];
-    const env = {
-        ...(existing.env || {}),
-    };
+    const env = stringRecordAt(existing, "env");
     clearProxyEnvKeys(env);
     const next = {
         ...existing,
@@ -197,19 +208,28 @@ export function deactivateOpenCodeProfile(profileName) {
     if (id && typeof existing.model === "string" && existing.model.startsWith(`${id}/`)) {
         delete next.model;
     }
+    if (id && ownsModelRef(existing.small_model, id)) {
+        delete next.small_model;
+    }
     if (Object.keys(env).length > 0)
         next.env = env;
     else
         delete next.env;
-    atomicWriteFile(configPath, JSON.stringify(next, null, 2) + "\n");
+    const writes = [
+        { path: configPath, content: JSON.stringify(next, null, 2) + "\n" },
+    ];
     if (id) {
         const auth = readOpenCodeAuth(authPath);
         if (auth[id]) {
             const nextAuth = { ...auth };
             delete nextAuth[id];
-            atomicWriteFile(authPath, JSON.stringify(nextAuth, null, 2) + "\n");
+            writes.push({
+                path: authPath,
+                content: JSON.stringify(nextAuth, null, 2) + "\n",
+            });
         }
     }
+    writeFilesAtomically(writes);
     return {
         tool: "opencode",
         profile: profileName || "",

package/dist/bridge/manager.js

@@ -225,8 +225,15 @@ export async function stopBridge() {
     if (!instance)
         return false;
     const probe = await probeBridge(state.listener.advertiseHost, state.listener.port);
+    // daemon 已经死了（端口不通且 pid 不在），但 state 里还留着实例记录。
+    // 之前这种情况会一直抛「无法验证身份」，导致 stop 永远失败、start 也走偏。
+    if (!probe.reachable && !isPidRunning(instance.pid)) {
+        updateBridgeState((current) => ({ ...current, instance: null, pid: null }));
+        return false;
+    }
     if (!probe.authenticated || probe.instanceId !== instance.id) {
-        throw new BridgeControlError("无法验证 bridge 实例身份；为避免误杀，未发送任何进程信号。");
+        throw new BridgeControlError("无法验证 bridge 实例身份；为避免误杀，未发送任何进程信号。" +
+            "若确认该端口上的进程与本工具无关，请改用其他端口（LLM_SWITCH_BRIDGE_PORT）。");
     }
     let response;
     try {

package/dist/bridge/responses-to-chat-response.js

@@ -336,7 +336,7 @@ export function responsesEventToChatChunks(event, state) {
         const itemId = String(item.id || "");
         const entry = toolEntryFor(state, itemId);
         // Non-streamed argument payloads only appear on the done event.
-        if (entry && entry.custom && entry.customInput) {
+        if (entry?.custom && entry.customInput) {
             out.push(chunk(state, {
                 tool_calls: [
                     {

package/dist/bridge/runtime.js

@@ -6,7 +6,9 @@ export const DEFAULT_BRIDGE_RUNTIME_LIMITS = Object.freeze({
     connectTimeoutMs: 30_000,
     idleTimeoutMs: 90_000,
     totalTimeoutMs: 600_000,
-    maxConcurrency: 16,
+    // 默认不限并发：这些进程只服务本机的 Claude Code / Codex / OpenCode 或
+    // 自己签发 Key 的客户端，真正的瓶颈在上游而不在这里。需要保护时显式设值。
+    maxConcurrency: 0,
     rateLimitPerMinute: 120,
 });
 const RUNTIME_LIMIT_SPECS = [
@@ -49,7 +51,8 @@ const RUNTIME_LIMIT_SPECS = [
     {
         env: "LLM_SWITCH_MAX_CONCURRENCY",
         key: "maxConcurrency",
-        min: 1,
+        // 0 = 不限并发（默认）。
+        min: 0,
         max: 128,
     },
     {
@@ -76,6 +79,41 @@ export function parseBridgeRuntimeLimits(env = process.env) {
     }
     return parsed;
 }
+/**
+ * Bounded in-flight request counter shared by the bridge and the gateway.
+ * `LLM_SWITCH_MAX_CONCURRENCY` is documented as applying to both, so both must
+ * actually enforce it.
+ *
+ * A max of 0 (the default) means unlimited: requests are still counted so
+ * `gateway status` can report live concurrency, but none are ever rejected.
+ */
+export class ConcurrencyGate {
+    max;
+    active = 0;
+    constructor(max) {
+        this.max = max;
+    }
+    get inFlight() {
+        return this.active;
+    }
+    /** Whether a ceiling is configured at all. */
+    get limited() {
+        return this.max > 0;
+    }
+    get limit() {
+        return this.max;
+    }
+    tryAcquire() {
+        if (this.limited && this.active >= this.max)
+            return false;
+        this.active += 1;
+        return true;
+    }
+    release() {
+        if (this.active > 0)
+            this.active -= 1;
+    }
+}
 export function parseBridgePort(value) {
     const raw = typeof value === "number" ? String(value) : value;
     if (!/^\d+$/.test(raw)) {