@tzyc/dsh-model-visibility 1.10.2 → 1.12.1

package/lib/export-csv.js

@@ -8,33 +8,61 @@
  * @module lib/export-csv
  */
 
-/** Quote one CSV field, RFC 4180 style. */
+/** Quote one CSV field, RFC 4180 style, and defuse spreadsheet formulas. */
 function csvField(value) {
   if (value === null || value === undefined) return ''
   let text = String(value)
+  // A leading =, +, -, @ or tab makes Excel/Sheets evaluate the cell. Model
+  // ids come from a third-party relay, so they are not trusted input.
+  if (/^[=+\-@\t\r]/.test(text)) text = `'${text}`
   if (/[",\r\n]/.test(text)) text = `"${text.replace(/"/g, '""')}"`
   return text
 }
 
-/** Prefix the sheet with the window totals, then one (day, route) row each. */
+/** Render one bucket tuple as four CSV columns. */
+function bucketFields(buckets) {
+  return [0, 1, 2, 3].map((index) => csvField(buckets?.[index] ?? 0))
+}
+
+/**
+ * Prefix the sheet with the window totals, then one (day, route) row each.
+ *
+ * `summary.days` is `{ dayKey: [in, out, cacheRead, cacheWrite] }` — the ledger
+ * folds to a single tuple per day. Per-route detail lives in `summary.byModel`
+ * (`{ "provider/model": tuple }`) and has no day dimension, so it is exported
+ * as its own section rather than being mistaken for a day/route map.
+ */
 export function toUsageCsv(summary) {
-  const fmt = (buckets) => `${buckets?.[0] ?? 0},${buckets?.[1] ?? 0},${buckets?.[2] ?? 0},${buckets?.[3] ?? 0}`
   const rows = []
   rows.push('section,range,input,output,cacheRead,cacheWrite')
   const ranges = summary?.ranges ?? {}
   for (const name of ['today', 'week', 'month', 'total']) {
-    rows.push(`sum,${name},${fmt(ranges[name])}`)
+    // `range` is a single bucket tuple, so it expands to the four numeric
+    // columns rather than being joined as if it were a string.
+    rows.push(['sum', name, ...bucketFields(ranges[name])].join(','))
   }
+
   rows.push('')
-  rows.push('day,provider/model,input,output,cacheRead,cacheWrite')
+  rows.push('day,input,output,cacheRead,cacheWrite')
   const days = summary?.days ?? {}
-  const dayKeys = Object.keys(days).sort()
-  for (const dayKey of dayKeys) {
-    const byRoute = days[dayKey] ?? {}
-    for (const [route, values] of Object.entries(byRoute)) {
-      // `*` is the day's own total; the per-route rows already carry it.
-      if (route === '*' || values.every((n) => n === 0)) continue
-      rows.push(`${dayKey},${route},${fmt(values)}`)
+  for (const dayKey of Object.keys(days).sort()) {
+    const values = days[dayKey]
+    if (!Array.isArray(values)) continue
+    if (values.every((n) => n === 0)) continue
+    rows.push([csvField(dayKey), ...bucketFields(values)].join(','))
+  }
+
+  const byModel = summary?.byModel ?? {}
+  const modelKeys = Object.keys(byModel).sort()
+  if (modelKeys.length > 0) {
+    rows.push('')
+    rows.push('provider/model,input,output,cacheRead,cacheWrite')
+    for (const route of modelKeys) {
+      if (route === '*') continue
+      const values = byModel[route]
+      if (!Array.isArray(values)) continue
+      if (values.every((n) => n === 0)) continue
+      rows.push([csvField(route), ...bucketFields(values)].join(','))
     }
   }
   return `${rows.join('\r\n')}\r\n`
@@ -47,7 +75,13 @@ export function toModelListCsv(catalog, { hidden = [] } = {}) {
   for (const group of catalog?.groups ?? []) {
     for (const model of group?.models ?? []) {
       const sources = model.sources ?? {}
-      const reasoning = model.reasoning?.efforts?.map((effort) => effort.id).join('|') ?? []
+      // `efforts` is an array of `{ id, name }`; joining it needs the ids, not
+      // the array itself (the old code called `.join` on the array and threw).
+      const efforts = Array.isArray(model.reasoning?.efforts)
+        ? model.reasoning.efforts
+            .map((effort) => (typeof effort === 'string' ? effort : effort?.id))
+            .filter((id) => typeof id === 'string' && id !== '')
+        : []
       rows.push(
         [
           group.id,
@@ -56,7 +90,7 @@ export function toModelListCsv(catalog, { hidden = [] } = {}) {
           model.kind ?? '',
           (model.inputModalities ?? []).join('|'),
           model.contextWindow ?? '',
-          reasoning.length > 0 ? reasoning.join('|') : '',
+          efforts.join('|'),
           model.reasoningSupported === true ? 'yes' : model.reasoningSupported === false ? 'no' : '',
           `${sources.modalities ?? 'unknown'};${sources.context ?? 'unknown'};${sources.reasoning ?? 'unknown'}`,
         ]

package/lib/learned-catalog.js

@@ -232,8 +232,15 @@ export function createLearnedCatalog(options = {}) {
    * from the checker), so records merge instead of replacing: newer facts
    * overwrite older ones field by field and the freshest `verifiedAt` stays.
    * @param inputs - check results, each `{ id | provider+model, …facts }`.
+   * @param extra - provenance for the whole call: `verifiedAt`, `origins`,
+   *   `checker`. `origins` is merged into each record so a later public-only
+   *   pass appends `public` next to an earlier `checker` instead of replacing
+   *   it (which is what made "publicOnly: 0" look like a missing source).
    */
   const upsertEntries = (inputs, extra = {}) => {
+    // A verify sweep now flushes one array of facts per batch instead of one
+    // call per model. Reloading by force for every call forced a full file read
+    // and a full rewrite per model (199 reads + 199 writes for 200 models).
     load(true)
     const source = Array.isArray(inputs) ? inputs : [inputs]
     let changed = false
@@ -241,10 +248,11 @@ export function createLearnedCatalog(options = {}) {
       const sanitized = sanitizeLearned(raw)
       if (sanitized === undefined) continue
       // Call-side provenance beats the entry's own stamps: the orchestrator
-      // knows the run that produced the fact.
+      // knows the run that produced the fact. An entry that carries its own
+      // `origins` keeps them, so a public-only row stays `['public']`.
       const provenance = {}
       if (extra?.verifiedAt !== undefined) provenance.verifiedAt = extra.verifiedAt
-      if (extra?.origins !== undefined) provenance.origins = extra.origins
+      if (extra?.origins !== undefined && raw?.origins === undefined) provenance.origins = extra.origins
       if (extra?.checker !== undefined) provenance.checker = extra.checker
       const record = { provider: raw?.provider, ...sanitized.entry, ...provenance, id: sanitized.id }
       const key = modelIdVariants(record.id)[0] ?? sanitized.id

package/lib/model-info.js

@@ -700,8 +700,10 @@ function catalogMeta() {
     // `reload` means the route understands `?reload=1` and drops every cache;
     // `overrides` means the Host persists and serves manual capability edits;
     // `verify` means the Host can sweep every model online; `usage` means the
-    // Host serves the token-usage ledger.
-    features: ['applyInput', 'reload', 'overrides', 'verify', 'usage'],
+    // Host serves the token-usage ledger; `checkerBudget` means the verify
+    // sweep sizes its output budget and pins a reasoning effort (a Host
+    // without it truncates every batch on a thinking checker).
+    features: ['applyInput', 'reload', 'overrides', 'verify', 'usage', 'checkerBudget'],
   }
 }
 

package/lib/model-overrides.js

@@ -30,10 +30,15 @@ import { MODEL_KINDS } from './capability-catalog.js'
 export const OVERRIDE_MODALITIES = ['text', 'image', 'audio', 'video', 'file']
 
 /**
- * Effort ids offered by the editor. The list is intentionally wider than the
- * `off/low/medium/high` ladder most adapters publish: relays and vendors also
- * use `minimal`, `max` and `xhigh`, and the whole point of a manual override is
- * to describe the upstream the adapter cannot describe.
+ * Effort ids the editor offers and the provider schema can key.
+ *
+ * The list is intentionally wider than the `off/low/medium/high` ladder most
+ * adapters publish: relays and vendors also use `minimal`, `max` and `xhigh`,
+ * and the whole point of a manual override is to describe the upstream the
+ * adapter cannot describe. It happens to be the same set `llm-pi-ai` accepts
+ * as `reasoningEfforts` keys, so `lib/provider-write.js` keeps its own frozen
+ * copy for the write path (a schema change there must not silently widen the
+ * editor, or vice versa).
  */
 export const OVERRIDE_EFFORT_IDS = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']
 

package/lib/provider-probe.js

@@ -231,6 +231,27 @@ export function parseModelListing(body) {
   return out
 }
 
+/**
+ * Build the model-id set from a New API `/api/pricing` response.
+ *
+ * A relay that refuses or times out on `/models` usually still answers the
+ * public pricing endpoint, and a bare id list is enough for the page to show
+ * the right total and to classify every model it serves.
+ * @param body - parsed `/api/pricing` payload.
+ * @returns a Map of model id to `{ id }` (kind filled in by the caller).
+ */
+export function parsePricingIds(body) {
+  const out = new Map()
+  const data = body !== null && typeof body === 'object' && Array.isArray(body.data) ? body.data : []
+  for (const raw of data) {
+    if (raw === null || typeof raw !== 'object') continue
+    const id = str(raw.model_name) ?? str(raw.model) ?? str(raw.modelName) ?? str(raw.id)
+    if (id === undefined) continue
+    out.set(id, { id })
+  }
+  return out
+}
+
 /**
  * Parse New API's `/api/pricing` response (model kind only).
  * @param body - parsed JSON.
@@ -321,11 +342,46 @@ export function profileSignature(profiles) {
 export function listingUrls(baseURL) {
   const base = String(baseURL).replace(/\/+$/, '')
   if (!/^https?:\/\//i.test(base)) return []
+  // A plaintext base URL would put the resolved API key on the wire in clear
+  // text. Loopback stays allowed for a local gateway.
+  if (!isSecureBase(base) && !isLoopback(base)) return []
   const urls = [`${base}/models`]
   if (!/\/v\d+$/i.test(base)) urls.push(`${base}/v1/models`)
   return urls
 }
 
+/** True when the base URL speaks TLS. */
+function isSecureBase(value) {
+  return /^https:\/\//i.test(String(value))
+}
+
+/** True for a loopback host, where plaintext never leaves the machine. */
+function isLoopback(value) {
+  try {
+    const host = new URL(value).hostname.toLowerCase()
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'
+  } catch (_error) {
+    return false
+  }
+}
+
+/** Turn a transport/DNS failure into something the page can show. */
+function transportMessage(error) {
+  const code = error?.code ?? error?.cause?.code
+  if (typeof code === 'string') {
+    if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') return '域名解析失败（DNS 查不到该主机）'
+    if (code === 'ECONNREFUSED') return '连接被拒绝'
+    if (code === 'ECONNRESET') return '连接被重置'
+    if (code === 'ETIMEDOUT' || code === 'UND_ERR_CONNECT_TIMEOUT') return '连接超时'
+    if (code === 'CERT_HAS_EXPIRED') return 'TLS 证书已过期'
+    if (code.startsWith('ERR_TLS') || code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE') return 'TLS 校验失败'
+    if (code === 'ENOTFOUND') return '域名解析失败'
+  }
+  const message = error?.message ?? String(error)
+  if (/aborted|timeout/i.test(message)) return '请求超时'
+  return message
+}
+
 /** One JSON GET with a timeout, redirect refusal and a body cap. */
 async function getJson(fetchImpl, url, headers, timeoutMs) {
   const response = await fetchImpl(url, {
@@ -453,13 +509,17 @@ export function createProviderProbe(options = {}) {
 
     let body
     let lastError
+    let refused = false
     for (const url of listingUrls(profile.baseURL)) {
       try {
         const response = await getJson(fetchImpl, url, headers, timeoutMs)
         if (response.status === 401 || response.status === 403) {
+          // Keep going: a relay that rejects the listing still often serves the
+          // public pricing endpoint, and its id list is better than nothing.
           diagnostics.status = 'unauthorized'
           diagnostics.message = `HTTP ${response.status}`
-          return { entries: new Map(), diagnostics }
+          refused = true
+          break
         }
         if (response.status < 200 || response.status >= 300) {
           lastError = new Error(`HTTP ${response.status}`)
@@ -471,9 +531,34 @@ export function createProviderProbe(options = {}) {
         lastError = error
       }
     }
+
+    // New API exposes model ids and kinds through its public pricing endpoint.
+    // When `/models` is unreachable (DNS, timeout, 401, 5xx) that listing is
+    // still worth having: it is what lets the page show "served N models"
+    // instead of a bare failure. It is also frequently 403/404, which is not an
+    // error.
+    const pricing = await probePricing(profile, headers)
     if (body === undefined) {
-      diagnostics.status = 'failed'
-      diagnostics.message = lastError instanceof Error ? lastError.message : String(lastError)
+      if (pricing.entries.size > 0) {
+        // The listing failed but the pricing endpoint enumerated the route.
+        diagnostics.status = 'partial'
+        diagnostics.models = pricing.entries.size
+        diagnostics.capabilities = 0
+        diagnostics.pricing = pricing.state
+        const status = refused ? String(diagnostics.message ?? '') : undefined
+        diagnostics.message = refused
+          ? `${status === '' ? 'HTTP 401/403' : status}（鉴权被拒），已用价格接口列出模型`
+          : `模型列表不可用（${
+              lastError === undefined ? '未知原因' : transportMessage(lastError)
+            }），已用价格接口列出模型`
+        return { entries: withKinds(pricing.entries, pricing.kinds), diagnostics }
+      }
+      diagnostics.status = refused ? 'unauthorized' : 'failed'
+      diagnostics.pricing = pricing.state
+      if (!refused) {
+        diagnostics.message =
+          lastError === undefined ? 'no listing endpoint answered' : transportMessage(lastError)
+      }
       return { entries: new Map(), diagnostics }
     }
 
@@ -485,29 +570,60 @@ export function createProviderProbe(options = {}) {
       capabilityKeys.some((field) => entry[field] !== undefined),
     ).length
 
-    // New API exposes model kind through its public pricing endpoint. It is
-    // frequently disabled (403); that is a normal outcome, not a failure.
+    diagnostics.pricing = pricing.state
+    return { entries: withKinds(entries, pricing.kinds), diagnostics }
+  }
+
+  /**
+   * Fill in the kind of every entry from the pricing endpoint, keeping the
+   * richer `/models` facts when both sources describe the same model.
+   */
+  /**
+   * Return a copy of `entries` with each model's kind filled in from the
+   * pricing endpoint, keeping the richer `/models` facts when both sources
+   * describe the same model.
+   *
+   * A copy, not an edit: the partial branch passes the pricing map itself, and
+   * mutating it while iterating it would make the result depend on map order.
+   */
+  const withKinds = (entries, kinds) => {
+    const out = new Map()
+    for (const [id, entry] of entries) out.set(id, { ...entry })
+    for (const [id, info] of kinds) {
+      const entry = out.get(id) ?? { id }
+      if (entry.kind === undefined) entry.kind = info.kind
+      out.set(id, entry)
+    }
+    return out
+  }
+
+  /**
+   * Read New API's public pricing endpoint for model ids and kinds.
+   * @returns `{ entries, kinds, state }`; `state` is ok / disabled / failed.
+   */
+  const probePricing = async (profile, headers) => {
+    const empty = { entries: new Map(), kinds: new Map(), state: 'failed' }
+    let origin
     try {
-      const url = new URL(profile.baseURL)
-      const response = await getJson(fetchImpl, `${url.origin}/api/pricing`, headers, timeoutMs)
-      if (response.status === 403 || response.status === 404) {
-        diagnostics.pricing = 'disabled'
-      } else if (response.status >= 200 && response.status < 300) {
-        const pricing = parsePricing(response.body)
-        for (const [id, info] of pricing) {
-          const entry = entries.get(id) ?? { id }
-          if (entry.kind === undefined) entry.kind = info.kind
-          entries.set(id, entry)
-        }
-        diagnostics.pricing = 'ok'
-      } else {
-        diagnostics.pricing = 'failed'
+      origin = new URL(profile.baseURL).origin
+    } catch (_error) {
+      return { ...empty, state: 'skipped' }
+    }
+    // The pricing request carries the same Authorization header, so it obeys the
+    // same rule as the listing: TLS only, unless the target is loopback.
+    if (!isSecureBase(origin) && !isLoopback(origin)) return { ...empty, state: 'skipped' }
+    try {
+      const response = await getJson(fetchImpl, `${origin}/api/pricing`, headers, timeoutMs)
+      if (response.status === 403 || response.status === 404) return { ...empty, state: 'disabled' }
+      if (response.status < 200 || response.status >= 300) return empty
+      return {
+        entries: parsePricingIds(response.body),
+        kinds: parsePricing(response.body),
+        state: 'ok',
       }
     } catch (_error) {
-      diagnostics.pricing = 'failed'
+      return empty
     }
-
-    return { entries, diagnostics }
   }
 
   const sweep = async () => {

package/lib/provider-write.js

@@ -23,8 +23,22 @@
  * @module lib/provider-write
  */
 
-/** Fields this module knows how to mirror into a provider profile. */
-export const PROVIDER_WRITE_FIELDS = ['input', 'contextWindow', 'reasoningEfforts']
+/**
+ * Effort keys the provider schema accepts.
+ *
+ * Must stay in lock-step with `llm-pi-ai`'s `reasoningEfforts` dict key schema.
+ * A single unknown key rejects the entire `settings.mutate` op list, which also
+ * silently discards the modalities and context window saved alongside it.
+ */
+export const PROVIDER_EFFORT_LEVELS = Object.freeze([
+  'off',
+  'minimal',
+  'low',
+  'medium',
+  'high',
+  'xhigh',
+  'max',
+])
 
 /** Plain-object guard. */
 function isRecord(value) {
@@ -43,9 +57,13 @@ function messageOf(error) {
  * Convert a manual ladder into the provider `reasoningEfforts` shape.
  *
  * `off` maps to `null` ("supported, send nothing"), every other level maps to
- * its own id as the wire value. Returns undefined when there is nothing worth
- * writing: an unset ladder, or one that only offers `off` (provider config
- * rejects that as "offers no level beyond off").
+ * its own id as the wire value. Levels the provider schema cannot key are
+ * dropped here rather than sent: one unknown key rejects the whole write, and
+ * the user would lose the modalities and context window saved with it.
+ *
+ * Returns undefined when there is nothing worth writing: an unset ladder, a
+ * ladder that only offers `off` (the schema rejects that as "offers no level
+ * beyond off"), or one whose every level is unusable.
  * @param override - sanitized override entry.
  * @returns a provider ladder, `false` for "no reasoning", or undefined.
  */
@@ -55,8 +73,10 @@ export function effortsForProvider(override) {
   const ladder = {}
   let beyondOff = false
   for (const effort of override.efforts) {
-    const id = typeof effort === 'string' ? effort : effort?.id
-    if (typeof id !== 'string' || id === '') continue
+    const raw = typeof effort === 'string' ? effort : effort?.id
+    if (typeof raw !== 'string' || raw === '') continue
+    const id = raw.toLowerCase()
+    if (!PROVIDER_EFFORT_LEVELS.includes(id)) continue
     if (id === 'off') ladder.off = null
     else {
       ladder[id] = id
@@ -68,6 +88,10 @@ export function effortsForProvider(override) {
 
 /**
  * The provider fields an override implies.
+ *
+ * These are the only fields this module mirrors; anything else an override
+ * carries (`kind`, `defaultEffort`, an off-only ladder) has no provider
+ * equivalent and stays in the local override file.
  * @param override - sanitized override entry.
  * @returns `{input?, contextWindow?, reasoningEfforts?}`; empty when nothing is writable.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tzyc/dsh-model-visibility",
-  "version": "1.10.2",
+  "version": "1.12.1",
   "publishConfig": {
     "access": "public"
   },
@@ -24,7 +24,7 @@
     "docs"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs",
+    "test": "node --import ./test/setup.mjs --test test/*.test.mjs",
     "build": "node scripts/build-client.mjs"
   },
   "dsh": {