@sanqianx/claude-ai-workbench 0.13.2 → 0.13.4

package/packages/server/lib/profile-store.js

@@ -1,283 +1,283 @@
-'use strict';
-
-const path = require('path');
-const fs = require('fs');
-const { normalizeProfile, cleanId } = require('../../contracts');
-const { readJson, writeJson } = require('./json-file');
-
-class ProfileStore {
-  constructor(options = {}) {
-    if (!options.dataDir) throw new Error('ProfileStore dataDir is required');
-    this.profileFile = options.profileFile || path.join(options.dataDir, 'profiles.v2.json');
-    this.credentialFile = options.credentialFile || path.join(options.dataDir, 'credentials.v1.json');
-  }
-
-  _profiles() { return readJson(this.profileFile, { schema: 'claude-workbench-profiles/v2', profiles: [] }); }
-  _credentials() { return readJson(this.credentialFile, { schema: 'claude-workbench-credentials/v1', credentials: {} }); }
-
-  _configured(profile) {
-    return Boolean(this._credentials().credentials[profile.credentialRef]);
-  }
-
-  publicProfile(profile) {
-    profile = normalizeProfile(profile);
-    const secret = this._credentials().credentials[profile.credentialRef] || '';
-    const clean = {
-      ...profile,
-      credentialConfigured: Boolean(secret),
-      credentialMasked: maskCredential(secret),
-    };
-    delete clean.apiKey;
-    delete clean.authToken;
-    delete clean.anthropicAuthToken;
-    delete clean.secret;
-    return clean;
-  }
-
-  list() { return this._profiles().profiles.map(profile => this.publicProfile(profile)); }
-
-  maintenanceDefault() {
-    const id = this._profiles().maintenanceDefaultProfileId || null;
-    return { profileId: id, profile: id ? this.get(id) : null };
-  }
-
-  setMaintenanceDefault(id) {
-    const profileId = id == null ? null : cleanId(id, 'profileId');
-    if (profileId) this.runtimeProfile(profileId);
-    const cfg = this._profiles();
-    cfg.maintenanceDefaultProfileId = profileId;
-    writeJson(this.profileFile, cfg);
-    return this.maintenanceDefault();
-  }
-
-  maintenanceRuntime() {
-    const { profileId } = this.maintenanceDefault();
-    if (!profileId) throw Object.assign(new Error('maintenance default profile is not configured'), { status: 409 });
-    // Always use the persisted provider default, never a session selection.
-    return this.runtimeProfile(profileId);
-  }
-
-  embeddingConfig() {
-    const saved = this._profiles().embedding;
-    if (!saved) return { configured: false, config: null };
-    const { credentialRef, ...config } = saved;
-    config.endpoint = normalizeEmbedding(saved).endpoint;
-    let configured = false;
-    try { configured = Boolean(this.embeddingRuntime()); } catch {}
-    return { configured, config };
-  }
-
-  setEmbeddingConfig(input = {}) {
-    const cfg = this._profiles();
-    if (input.enabled === false) {
-      const keys = this._credentials();
-      delete keys.credentials[cfg.embedding?.credentialRef];
-      writeJson(this.credentialFile, keys);
-      cfg.embedding = null;
-    } else {
-      const next = normalizeEmbedding(input);
-      if (next.profileId) this.runtimeProfile(next.profileId);
-      else {
-        next.credentialRef = 'knowledge-embedding';
-        const keys = this._credentials();
-        const secret = typeof input.secret === 'string' ? input.secret.trim() : '';
-        if (secret) keys.credentials[next.credentialRef] = secret;
-        if (!keys.credentials[next.credentialRef]) throw Object.assign(new Error('向量模型凭据未配置。'), { status: 400 });
-        writeJson(this.credentialFile, keys);
-      }
-      cfg.embedding = next;
-    }
-    writeJson(this.profileFile, cfg);
-    return this.embeddingConfig();
-  }
-
-  embeddingRuntime() {
-    const saved = this._profiles().embedding;
-    if (!saved) throw Object.assign(new Error('向量模型未配置。'), { status: 409 });
-    const secret = saved.profileId ? this.runtimeProfile(saved.profileId).apiKey : this._credentials().credentials[saved.credentialRef];
-    if (!secret) throw Object.assign(new Error('向量模型凭据未配置。'), { status: 409 });
-    return { provider: saved.provider, model: saved.model, endpoint: normalizeEmbedding(saved).endpoint, apiKey: secret };
-  }
-
-  importEmbedding({ migrationId, settings }) {
-    if (!/^embedding-[a-f0-9]{64}$/.test(migrationId || '')) throw Object.assign(new Error('无效的向量配置迁移。'), { status: 400 });
-    const cfg = this._profiles();
-    if (cfg.embeddingImports?.[migrationId]) return this.embeddingConfig();
-    const backup = path.join(path.dirname(this.profileFile), 'recovery', migrationId);
-    fs.mkdirSync(backup, { recursive: true, mode: 0o700 });
-    for (const file of [this.profileFile, this.credentialFile]) {
-      const target = path.join(backup, path.basename(file));
-      if (fs.existsSync(file) && !fs.existsSync(target)) { fs.copyFileSync(file, target, fs.constants.COPYFILE_EXCL); fs.chmodSync(target, 0o600); }
-    }
-    // An existing Workbench choice wins. The caller keeps its own rollback
-    // backup before removing the retired, module-local active credential.
-    if (!cfg.embedding) this.setEmbeddingConfig({ ...settings, secret: settings?.apiKey });
-    const next = this._profiles();
-    next.embeddingImports = { ...next.embeddingImports, [migrationId]: true };
-    writeJson(this.profileFile, next);
-    return this.embeddingConfig();
-  }
-
-  importLegacy({ migrationId, profiles, defaultProfileId }) {
-    if (!/^cutover-[a-f0-9-]{36}$/.test(migrationId || '') || !Array.isArray(profiles)) throw Object.assign(new Error('invalid profile migration'), { status: 400 });
-    const current = this._profiles();
-    if (current.migrationImports?.[migrationId]) return current.migrationImports[migrationId];
-    const prepared = profiles.map(raw => {
-      const id = `legacy-${cleanId(raw.id, 'profileId')}`;
-      if (this.get(id)) throw Object.assign(new Error('legacy profile identity conflicts with existing configuration'), { status: 409 });
-      const profile = normalizeProfile({ id, name: raw.name || raw.id, provider: raw.provider || 'anthropic-compatible', baseUrl: raw.baseUrl || raw.anthropicBaseUrl, openaiBaseUrl: raw.openaiBaseUrl, enabled: raw.enabled !== false, models: raw.models || { default: raw.mainModel || raw.model, reasoning: raw.thinkingModel, fast: raw.haikuModel, coding: raw.sonnetModel, largeContext: raw.opusModel } });
-      validateProfile(profile);
-      return { sourceId: raw.id, profile, secret: raw.apiKey || raw.anthropicApiKey || raw.authToken || raw.anthropicAuthToken || '' };
-    });
-    const backup = path.join(path.dirname(this.profileFile), 'recovery', migrationId);
-    fs.mkdirSync(backup, { recursive: true, mode: 0o700 });
-    for (const file of [this.profileFile, this.credentialFile]) {
-      const target = path.join(backup, path.basename(file));
-      if (fs.existsSync(file) && !fs.existsSync(target)) { fs.copyFileSync(file, target, fs.constants.COPYFILE_EXCL); fs.chmodSync(target, 0o600); }
-    }
-    const mapping = {};
-    const nextProfiles = current;
-    const nextCredentials = this._credentials();
-    for (const item of prepared) {
-      mapping[item.sourceId] = item.profile.id;
-      nextProfiles.profiles.push(item.profile);
-      if (item.secret) nextCredentials.credentials[item.profile.credentialRef] = String(item.secret);
-    }
-    // Write keys first: a crash may leave an unused credential, never a profile
-    // silently bound to a missing/different secret. Retrying uses the same map.
-    writeJson(this.credentialFile, nextCredentials);
-    const preferred = prepared.find(item => item.sourceId === defaultProfileId && item.secret && item.profile.enabled) || prepared.find(item => item.secret && item.profile.enabled);
-    if (!nextProfiles.maintenanceDefaultProfileId && preferred) nextProfiles.maintenanceDefaultProfileId = preferred.profile.id;
-    nextProfiles.migrationImports = { ...nextProfiles.migrationImports, [migrationId]: mapping };
-    writeJson(this.profileFile, nextProfiles);
-    return mapping;
-  }
-
-  get(id) {
-    const profileId = cleanId(id, 'profileId');
-    const profile = this._profiles().profiles.find(item => item.id === profileId);
-    return profile ? this.publicProfile(profile) : null;
-  }
-
-  save(input, idOverride) {
-    const profile = normalizeProfile(input, idOverride);
-    validateProfile(profile);
-    const cfg = this._profiles();
-    const index = cfg.profiles.findIndex(item => item.id === profile.id);
-    if (index >= 0) cfg.profiles[index] = profile;
-    else cfg.profiles.push(profile);
-    writeJson(this.profileFile, cfg);
-    return this.publicProfile(profile);
-  }
-
-  delete(id) {
-    const profileId = cleanId(id, 'profileId');
-    const cfg = this._profiles();
-    const profile = cfg.profiles.find(item => item.id === profileId);
-    if (!profile) return false;
-    cfg.profiles = cfg.profiles.filter(item => item.id !== profileId);
-    if (cfg.maintenanceDefaultProfileId === profileId) cfg.maintenanceDefaultProfileId = null;
-    writeJson(this.profileFile, cfg);
-    const secrets = this._credentials();
-    delete secrets.credentials[profile.credentialRef];
-    writeJson(this.credentialFile, secrets);
-    return true;
-  }
-
-  setCredential(id, credential) {
-    const profileId = cleanId(id, 'profileId');
-    const cfg = this._profiles();
-    const profile = cfg.profiles.find(item => item.id === profileId);
-    if (!profile) throw Object.assign(new Error('profile not found'), { status: 404 });
-    const secret = typeof credential === 'string' ? credential : credential && credential.secret;
-    if (!secret || typeof secret !== 'string') {
-      throw Object.assign(new Error('credential secret is required'), { status: 400 });
-    }
-    const secrets = this._credentials();
-    secrets.credentials[profile.credentialRef] = String(secret);
-    writeJson(this.credentialFile, secrets);
-  }
-
-  runtimeProfile(id) {
-    const profileId = cleanId(id, 'profileId');
-    const profile = this._profiles().profiles.find(item => item.id === profileId);
-    if (!profile) throw Object.assign(new Error('profile not found'), { status: 404 });
-    if (!profile.enabled) throw Object.assign(new Error('profile is disabled'), { status: 400 });
-    const secret = this._credentials().credentials[profile.credentialRef];
-    if (!secret) throw Object.assign(new Error('profile credential is not configured'), { status: 400 });
-    return runtimeShape(profile, secret);
-  }
-
-  runtimeDraft(input, credential, options = {}) {
-    const profile = normalizeProfile(input);
-    validateProfile(profile, options);
-    if (!profile.enabled) throw Object.assign(new Error('profile is disabled'), { status: 400 });
-    let secret = typeof credential === 'string' ? credential : credential && credential.secret;
-    if (!secret) {
-      const saved = this._profiles().profiles.find(item => item.id === profile.id);
-      if (saved) secret = this._credentials().credentials[saved.credentialRef];
-    }
-    if (!secret) throw Object.assign(new Error('profile credential is not configured'), { status: 400 });
-    return runtimeShape(profile, String(secret));
-  }
-}
-
-function runtimeShape(profile, secret) {
-  profile = normalizeProfile(profile);
-  return {
-    ...profile,
-    apiKey: secret,
-    mainModel: profile.models.default,
-    thinkingModel: profile.models.reasoning || profile.models.default,
-    haikuModel: profile.models.fast || profile.models.default,
-    sonnetModel: profile.models.coding || profile.models.default,
-    opusModel: profile.models.largeContext || profile.models.default,
-  };
-}
-
-function maskCredential(secret) {
-  const value = String(secret || '');
-  if (!value) return '';
-  if (value.length <= 12) return `${value.slice(0, 2)}****${value.slice(-2)}`;
-  return `${value.slice(0, 6)}****${value.slice(-6)}`;
-}
-
-function normalizeEmbedding(input) {
-  if (!['minimax', 'openai'].includes(input.provider)) throw Object.assign(new Error('请选择支持的向量协议。'), { status: 400 });
-  const model = String(input.model || (input.provider === 'minimax' ? 'embo-01' : 'text-embedding-3-small')).trim();
-  if (!model || model.length > 200 || /[\x00-\x1f]/.test(model)) throw Object.assign(new Error('无效的向量模型。'), { status: 400 });
-  let endpoint = String(input.endpoint || '').trim();
-  if (endpoint) {
-    let url; try { url = new URL(endpoint); } catch {}
-    if (!url || !['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw Object.assign(new Error('向量接口地址无效。'), { status: 400 });
-    // MiniMax appends /v1/embeddings itself. Only official, known route
-    // aliases are normalized; private gateways may require their path prefix.
-    if (input.provider === 'minimax' && ['api.minimaxi.com', 'api.minimax.io', 'api.minimax.cn', 'api.minimax.chat'].includes(url.hostname) && /^\/(?:anthropic|v1(?:\/embeddings)?)?\/?$/.test(url.pathname)) endpoint = url.origin;
-  }
-  return { provider: input.provider, model, endpoint, profileId: input.profileId ? cleanId(input.profileId, 'profileId') : null };
-}
-
-function validateProfile(profile, options = {}) {
-  if (profile.runtime !== 'claude-code') throw Object.assign(new Error('runtime must be claude-code'), { status: 400 });
-  if (!profile.provider) throw Object.assign(new Error('provider is required'), { status: 400 });
-  // One protocol endpoint is enough: single-protocol providers are valid;
-  // the agents that speak the missing protocol simply can't use it.
-  if (!profile.baseUrl && !profile.openaiBaseUrl) {
-    throw Object.assign(new Error('baseUrl is required'), { status: 400 });
-  }
-  for (const field of ['baseUrl', 'openaiBaseUrl']) {
-    if (!profile[field]) continue;
-    let url;
-    try { url = new URL(profile[field]); } catch {}
-    if (!url || !['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
-      throw Object.assign(new Error(`${field} must be an HTTP(S) endpoint without credentials, query, or fragment`), { status: 400 });
-    }
-  }
-  // Detection runs before any model is configured; every other path needs one.
-  if (!profile.models.default && options.requireModel !== false) {
-    throw Object.assign(new Error('models.default is required'), { status: 400 });
-  }
-  return profile;
-}
-
-module.exports = { ProfileStore, validateProfile, maskCredential };
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const { normalizeProfile, cleanId } = require('../../contracts');
+const { readJson, writeJson } = require('./json-file');
+
+class ProfileStore {
+  constructor(options = {}) {
+    if (!options.dataDir) throw new Error('ProfileStore dataDir is required');
+    this.profileFile = options.profileFile || path.join(options.dataDir, 'profiles.v2.json');
+    this.credentialFile = options.credentialFile || path.join(options.dataDir, 'credentials.v1.json');
+  }
+
+  _profiles() { return readJson(this.profileFile, { schema: 'claude-workbench-profiles/v2', profiles: [] }); }
+  _credentials() { return readJson(this.credentialFile, { schema: 'claude-workbench-credentials/v1', credentials: {} }); }
+
+  _configured(profile) {
+    return Boolean(this._credentials().credentials[profile.credentialRef]);
+  }
+
+  publicProfile(profile) {
+    profile = normalizeProfile(profile);
+    const secret = this._credentials().credentials[profile.credentialRef] || '';
+    const clean = {
+      ...profile,
+      credentialConfigured: Boolean(secret),
+      credentialMasked: maskCredential(secret),
+    };
+    delete clean.apiKey;
+    delete clean.authToken;
+    delete clean.anthropicAuthToken;
+    delete clean.secret;
+    return clean;
+  }
+
+  list() { return this._profiles().profiles.map(profile => this.publicProfile(profile)); }
+
+  maintenanceDefault() {
+    const id = this._profiles().maintenanceDefaultProfileId || null;
+    return { profileId: id, profile: id ? this.get(id) : null };
+  }
+
+  setMaintenanceDefault(id) {
+    const profileId = id == null ? null : cleanId(id, 'profileId');
+    if (profileId) this.runtimeProfile(profileId);
+    const cfg = this._profiles();
+    cfg.maintenanceDefaultProfileId = profileId;
+    writeJson(this.profileFile, cfg);
+    return this.maintenanceDefault();
+  }
+
+  maintenanceRuntime() {
+    const { profileId } = this.maintenanceDefault();
+    if (!profileId) throw Object.assign(new Error('maintenance default profile is not configured'), { status: 409 });
+    // Always use the persisted provider default, never a session selection.
+    return this.runtimeProfile(profileId);
+  }
+
+  embeddingConfig() {
+    const saved = this._profiles().embedding;
+    if (!saved) return { configured: false, config: null };
+    const { credentialRef, ...config } = saved;
+    config.endpoint = normalizeEmbedding(saved).endpoint;
+    let configured = false;
+    try { configured = Boolean(this.embeddingRuntime()); } catch {}
+    return { configured, config };
+  }
+
+  setEmbeddingConfig(input = {}) {
+    const cfg = this._profiles();
+    if (input.enabled === false) {
+      const keys = this._credentials();
+      delete keys.credentials[cfg.embedding?.credentialRef];
+      writeJson(this.credentialFile, keys);
+      cfg.embedding = null;
+    } else {
+      const next = normalizeEmbedding(input);
+      if (next.profileId) this.runtimeProfile(next.profileId);
+      else {
+        next.credentialRef = 'knowledge-embedding';
+        const keys = this._credentials();
+        const secret = typeof input.secret === 'string' ? input.secret.trim() : '';
+        if (secret) keys.credentials[next.credentialRef] = secret;
+        if (!keys.credentials[next.credentialRef]) throw Object.assign(new Error('向量模型凭据未配置。'), { status: 400 });
+        writeJson(this.credentialFile, keys);
+      }
+      cfg.embedding = next;
+    }
+    writeJson(this.profileFile, cfg);
+    return this.embeddingConfig();
+  }
+
+  embeddingRuntime() {
+    const saved = this._profiles().embedding;
+    if (!saved) throw Object.assign(new Error('向量模型未配置。'), { status: 409 });
+    const secret = saved.profileId ? this.runtimeProfile(saved.profileId).apiKey : this._credentials().credentials[saved.credentialRef];
+    if (!secret) throw Object.assign(new Error('向量模型凭据未配置。'), { status: 409 });
+    return { provider: saved.provider, model: saved.model, endpoint: normalizeEmbedding(saved).endpoint, apiKey: secret };
+  }
+
+  importEmbedding({ migrationId, settings }) {
+    if (!/^embedding-[a-f0-9]{64}$/.test(migrationId || '')) throw Object.assign(new Error('无效的向量配置迁移。'), { status: 400 });
+    const cfg = this._profiles();
+    if (cfg.embeddingImports?.[migrationId]) return this.embeddingConfig();
+    const backup = path.join(path.dirname(this.profileFile), 'recovery', migrationId);
+    fs.mkdirSync(backup, { recursive: true, mode: 0o700 });
+    for (const file of [this.profileFile, this.credentialFile]) {
+      const target = path.join(backup, path.basename(file));
+      if (fs.existsSync(file) && !fs.existsSync(target)) { fs.copyFileSync(file, target, fs.constants.COPYFILE_EXCL); fs.chmodSync(target, 0o600); }
+    }
+    // An existing Workbench choice wins. The caller keeps its own rollback
+    // backup before removing the retired, module-local active credential.
+    if (!cfg.embedding) this.setEmbeddingConfig({ ...settings, secret: settings?.apiKey });
+    const next = this._profiles();
+    next.embeddingImports = { ...next.embeddingImports, [migrationId]: true };
+    writeJson(this.profileFile, next);
+    return this.embeddingConfig();
+  }
+
+  importLegacy({ migrationId, profiles, defaultProfileId }) {
+    if (!/^cutover-[a-f0-9-]{36}$/.test(migrationId || '') || !Array.isArray(profiles)) throw Object.assign(new Error('invalid profile migration'), { status: 400 });
+    const current = this._profiles();
+    if (current.migrationImports?.[migrationId]) return current.migrationImports[migrationId];
+    const prepared = profiles.map(raw => {
+      const id = `legacy-${cleanId(raw.id, 'profileId')}`;
+      if (this.get(id)) throw Object.assign(new Error('legacy profile identity conflicts with existing configuration'), { status: 409 });
+      const profile = normalizeProfile({ id, name: raw.name || raw.id, provider: raw.provider || 'anthropic-compatible', baseUrl: raw.baseUrl || raw.anthropicBaseUrl, openaiBaseUrl: raw.openaiBaseUrl, enabled: raw.enabled !== false, models: raw.models || { default: raw.mainModel || raw.model, reasoning: raw.thinkingModel, fast: raw.haikuModel, coding: raw.sonnetModel, largeContext: raw.opusModel } });
+      validateProfile(profile);
+      return { sourceId: raw.id, profile, secret: raw.apiKey || raw.anthropicApiKey || raw.authToken || raw.anthropicAuthToken || '' };
+    });
+    const backup = path.join(path.dirname(this.profileFile), 'recovery', migrationId);
+    fs.mkdirSync(backup, { recursive: true, mode: 0o700 });
+    for (const file of [this.profileFile, this.credentialFile]) {
+      const target = path.join(backup, path.basename(file));
+      if (fs.existsSync(file) && !fs.existsSync(target)) { fs.copyFileSync(file, target, fs.constants.COPYFILE_EXCL); fs.chmodSync(target, 0o600); }
+    }
+    const mapping = {};
+    const nextProfiles = current;
+    const nextCredentials = this._credentials();
+    for (const item of prepared) {
+      mapping[item.sourceId] = item.profile.id;
+      nextProfiles.profiles.push(item.profile);
+      if (item.secret) nextCredentials.credentials[item.profile.credentialRef] = String(item.secret);
+    }
+    // Write keys first: a crash may leave an unused credential, never a profile
+    // silently bound to a missing/different secret. Retrying uses the same map.
+    writeJson(this.credentialFile, nextCredentials);
+    const preferred = prepared.find(item => item.sourceId === defaultProfileId && item.secret && item.profile.enabled) || prepared.find(item => item.secret && item.profile.enabled);
+    if (!nextProfiles.maintenanceDefaultProfileId && preferred) nextProfiles.maintenanceDefaultProfileId = preferred.profile.id;
+    nextProfiles.migrationImports = { ...nextProfiles.migrationImports, [migrationId]: mapping };
+    writeJson(this.profileFile, nextProfiles);
+    return mapping;
+  }
+
+  get(id) {
+    const profileId = cleanId(id, 'profileId');
+    const profile = this._profiles().profiles.find(item => item.id === profileId);
+    return profile ? this.publicProfile(profile) : null;
+  }
+
+  save(input, idOverride) {
+    const profile = normalizeProfile(input, idOverride);
+    validateProfile(profile);
+    const cfg = this._profiles();
+    const index = cfg.profiles.findIndex(item => item.id === profile.id);
+    if (index >= 0) cfg.profiles[index] = profile;
+    else cfg.profiles.push(profile);
+    writeJson(this.profileFile, cfg);
+    return this.publicProfile(profile);
+  }
+
+  delete(id) {
+    const profileId = cleanId(id, 'profileId');
+    const cfg = this._profiles();
+    const profile = cfg.profiles.find(item => item.id === profileId);
+    if (!profile) return false;
+    cfg.profiles = cfg.profiles.filter(item => item.id !== profileId);
+    if (cfg.maintenanceDefaultProfileId === profileId) cfg.maintenanceDefaultProfileId = null;
+    writeJson(this.profileFile, cfg);
+    const secrets = this._credentials();
+    delete secrets.credentials[profile.credentialRef];
+    writeJson(this.credentialFile, secrets);
+    return true;
+  }
+
+  setCredential(id, credential) {
+    const profileId = cleanId(id, 'profileId');
+    const cfg = this._profiles();
+    const profile = cfg.profiles.find(item => item.id === profileId);
+    if (!profile) throw Object.assign(new Error('profile not found'), { status: 404 });
+    const secret = typeof credential === 'string' ? credential : credential && credential.secret;
+    if (!secret || typeof secret !== 'string') {
+      throw Object.assign(new Error('credential secret is required'), { status: 400 });
+    }
+    const secrets = this._credentials();
+    secrets.credentials[profile.credentialRef] = String(secret);
+    writeJson(this.credentialFile, secrets);
+  }
+
+  runtimeProfile(id) {
+    const profileId = cleanId(id, 'profileId');
+    const profile = this._profiles().profiles.find(item => item.id === profileId);
+    if (!profile) throw Object.assign(new Error('profile not found'), { status: 404 });
+    if (!profile.enabled) throw Object.assign(new Error('profile is disabled'), { status: 400 });
+    const secret = this._credentials().credentials[profile.credentialRef];
+    if (!secret) throw Object.assign(new Error('profile credential is not configured'), { status: 400 });
+    return runtimeShape(profile, secret);
+  }
+
+  runtimeDraft(input, credential, options = {}) {
+    const profile = normalizeProfile(input);
+    validateProfile(profile, options);
+    if (!profile.enabled) throw Object.assign(new Error('profile is disabled'), { status: 400 });
+    let secret = typeof credential === 'string' ? credential : credential && credential.secret;
+    if (!secret) {
+      const saved = this._profiles().profiles.find(item => item.id === profile.id);
+      if (saved) secret = this._credentials().credentials[saved.credentialRef];
+    }
+    if (!secret) throw Object.assign(new Error('profile credential is not configured'), { status: 400 });
+    return runtimeShape(profile, String(secret));
+  }
+}
+
+function runtimeShape(profile, secret) {
+  profile = normalizeProfile(profile);
+  return {
+    ...profile,
+    apiKey: secret,
+    mainModel: profile.models.default,
+    thinkingModel: profile.models.reasoning || profile.models.default,
+    haikuModel: profile.models.fast || profile.models.default,
+    sonnetModel: profile.models.coding || profile.models.default,
+    opusModel: profile.models.largeContext || profile.models.default,
+  };
+}
+
+function maskCredential(secret) {
+  const value = String(secret || '');
+  if (!value) return '';
+  if (value.length <= 12) return `${value.slice(0, 2)}****${value.slice(-2)}`;
+  return `${value.slice(0, 6)}****${value.slice(-6)}`;
+}
+
+function normalizeEmbedding(input) {
+  if (!['minimax', 'openai'].includes(input.provider)) throw Object.assign(new Error('请选择支持的向量协议。'), { status: 400 });
+  const model = String(input.model || (input.provider === 'minimax' ? 'embo-01' : 'text-embedding-3-small')).trim();
+  if (!model || model.length > 200 || /[\x00-\x1f]/.test(model)) throw Object.assign(new Error('无效的向量模型。'), { status: 400 });
+  let endpoint = String(input.endpoint || '').trim();
+  if (endpoint) {
+    let url; try { url = new URL(endpoint); } catch {}
+    if (!url || !['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw Object.assign(new Error('向量接口地址无效。'), { status: 400 });
+    // MiniMax appends /v1/embeddings itself. Only official, known route
+    // aliases are normalized; private gateways may require their path prefix.
+    if (input.provider === 'minimax' && ['api.minimaxi.com', 'api.minimax.io', 'api.minimax.cn', 'api.minimax.chat'].includes(url.hostname) && /^\/(?:anthropic|v1(?:\/embeddings)?)?\/?$/.test(url.pathname)) endpoint = url.origin;
+  }
+  return { provider: input.provider, model, endpoint, profileId: input.profileId ? cleanId(input.profileId, 'profileId') : null };
+}
+
+function validateProfile(profile, options = {}) {
+  if (profile.runtime !== 'claude-code') throw Object.assign(new Error('runtime must be claude-code'), { status: 400 });
+  if (!profile.provider) throw Object.assign(new Error('provider is required'), { status: 400 });
+  // One protocol endpoint is enough: single-protocol providers are valid;
+  // the agents that speak the missing protocol simply can't use it.
+  if (!profile.baseUrl && !profile.openaiBaseUrl) {
+    throw Object.assign(new Error('baseUrl is required'), { status: 400 });
+  }
+  for (const field of ['baseUrl', 'openaiBaseUrl']) {
+    if (!profile[field]) continue;
+    let url;
+    try { url = new URL(profile[field]); } catch {}
+    if (!url || !['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+      throw Object.assign(new Error(`${field} must be an HTTP(S) endpoint without credentials, query, or fragment`), { status: 400 });
+    }
+  }
+  // Detection runs before any model is configured; every other path needs one.
+  if (!profile.models.default && options.requireModel !== false) {
+    throw Object.assign(new Error('models.default is required'), { status: 400 });
+  }
+  return profile;
+}
+
+module.exports = { ProfileStore, validateProfile, maskCredential };