@wengine-ai/llms 2.3.2414 → 2.3.2415

package/README.md

@@ -93,6 +93,7 @@ npm install -g @wengine-ai/claude-code-router-next@latest && ccr restart
 
 | 版本 | 发布内容 |
 | --- | --- |
+| **v2.3.2415** | <ul><li>**新增 Qoder 订阅 provider（qoder.com + qoder.cn）**: 同一插件同引擎支持国际站与国内站 PAT 订阅，双 managed provider + 卡片双区块（中英双语）；含整配置写串行化、401 单次刷新重放、每帧 1MiB 上限等健壮性修复。</li><li>**修复 WorkBuddy 6004 重置时间戳时区**: 测试改用 Asia/Shanghai 渲染，UTC CI 不再挂。</li><li>**修复 tool_result 图片按 base64 文本发送**: 图片改为视觉块发送，避免 200 万+ token 膨胀与上游拒绝。</li></ul> |
 | **v2.3.2414** | <ul><li>**CCR Desktop（可选 Tauri 客户端）与 Pi 配置生命周期修复**: 新增可选 Tauri 桌面壳（托盘快速切换全局默认模型、quota 摘要、单实例；生命周期伴侣化、退出不杀 gateway）；修复 `ccr restart` 的 disable→enable 与 legacy 项目 provider 改名迁移丢失 Pi 自定义模型字段（thinkingLevelMap/modelOverrides）。</li></ul> |
 | **v2.3.2413** | <ul><li>**修复 TTFT 永久为空**: #65（pi 会话粘连）与 #67（temp-file 重写）合并冲突解决时丢失了 #65 的 \`statsKey\` 文件名优先逻辑，handler 用会话 UUID 命名临时文件而 reader 用 requestId 查找 → 永久不匹配 → 所有流式请求的 TTFT 都是 null、tokens_per_second 退化为按完整时长重算。修复后 handler 优先用 \`metadata.statsKey\` 命名文件（对齐 reader），TTFT 与真实速度恢复。</li></ul> |
 | **v2.3.2412** | <ul><li>**修复用量/套餐接口在 node 版本不匹配时全部失效**: 当运行时 Node 的 ABI 与安装 better-sqlite3 时不同（如桌面应用注入自带 node），`ERR_DLOPEN_FAILED` 导致 `/api/usage*`、`/api/providers/quota` 全部 500，UI 用量页与套餐限额条消失。现在优先加载 better-sqlite3，加载失败自动回退 Node 内置 `node:sqlite`（Node ≥ 22.5），任意 node 版本下均可工作；CLI statusline 同步受益；回退时输出一次性显眼日志。</li><li>**修复 pi 模型条目自定义字段被刷新抹除**: `ensurePiCcrProvider` 此前整组替换 `models[]`，pi 的 `thinkingLevelMap` 等条目级自定义字段每次 CCR 启动/项目接管都被静默清掉（#69）。现在模型集合仍由 CCR 管理，但每个生成条目按同 id 与旧条目合并——受管字段以 CCR 为准，条目级自定义字段跨刷新保留。</li></ul> |

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,3 @@
+# Third-Party Notices
+
+Provider-specific protocol notices ship with their external provider plugins.

package/dist/api/plugin-request-state.d.ts

@@ -0,0 +1,22 @@
+import type { ManagedRuntime } from "../provider-plugins/types";
+interface PluginAttemptBudget {
+    refreshUsed: boolean;
+    terminalError?: Error;
+}
+interface PluginRequestState {
+    budgets: Map<string, PluginAttemptBudget>;
+}
+/** Install BEFORE any fallback {...req} copy: every copy shares this object. */
+export declare function ensurePluginRequestState(req: any): PluginRequestState;
+export declare function pluginAttemptBudget(req: any, runtime: ManagedRuntime, provider?: {
+    name?: string;
+} | null): PluginAttemptBudget;
+/**
+ * A classified nonretryable error stops this managed provider's models for the
+ * rest of the request — never an unrelated provider that happens to share the
+ * runtime (different subscription/credential pool).
+ */
+export declare function rememberPluginFailure(req: any, runtime: ManagedRuntime | undefined, error: any, provider?: {
+    name?: string;
+} | null): boolean;
+export {};

package/dist/api/plugin-response-error.d.ts

@@ -0,0 +1,5 @@
+import type { ManagedRuntime } from "../provider-plugins/types";
+/** No unclassified plugin response or read exception may reach rawBody/logging. */
+export declare function pluginResponseError(runtime: ManagedRuntime, status: number, body: unknown, systemText: string, transport?: {
+    errorName?: string;
+}): Promise<Error & Record<string, any>>;

package/dist/api/routes.d.ts

@@ -1,4 +1,5 @@
 import { FastifyInstance } from "fastify";
+import { type PluginRegistry } from "../provider-plugins/registry";
 import { ConfigService } from "../services/config";
 import { ProviderService } from "../services/provider";
 import { TransformerService } from "../services/transformer";
@@ -12,6 +13,7 @@ export declare const CCR_FAMILY_ALIAS: RegExp;
 export declare function normalizeResponsesBody(body: any): void;
 declare module "fastify" {
     interface FastifyInstance {
+        pluginRegistry: PluginRegistry;
         configService: ConfigService;
         providerService: ProviderService;
         transformerService: TransformerService;

package/dist/ccr/plugin-install-routes.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Provider-plugin marketplace host routes (docs/design/provider-plugins.md §2.2).
+ *
+ * POST /api/plugins/install — one-click install from the npm registry using
+ * the SAME validated install core as the CLI (`ccr plugin add`): strict
+ * npm-name allowlist → npm pack (--ignore-scripts, bounded, throwaway
+ * credential env) → archive caps → payload validation → staged atomic swap →
+ * upsert plugins.json. Nothing hot-loads; callers restart via the existing
+ * POST /api/restart flow.
+ *
+ * GET /api/plugins/catalog — npm registry search for installable provider
+ * plugins (marker keyword), merged/deduped, with installed state. Registry
+ * failures degrade to an empty list + warning, never a 500.
+ *
+ * Both routes are LOCAL-ONLY (socket-address identity + loopback Origin/Host
+ * pinning, mirroring the workbuddy admin-route guard) on top of the normal
+ * CCR auth pipeline. Responses never include npm stderr, registry URLs or any
+ * credential material.
+ */
+import type { FastifyInstance } from "fastify";
+import { type PluginInstallErrorCode } from "@wengine-ai/claude-code-router-shared";
+/** npm search marker keywords: a package is only OFFERED when its
+ *  package.json declares one of these (the search endpoint indexes exactly
+ *  those package.json keywords). */
+export declare const PLUGIN_MARKER_KEYWORDS: readonly ["ccr-provider-plugin", "claude-code-router-plugin"];
+/** Default registry searched by GET /api/plugins/catalog. */
+export declare const PLUGIN_CATALOG_REGISTRY = "https://registry.npmjs.org";
+export interface CatalogEntry {
+    name: string;
+    description: string;
+    version: string;
+    installed: boolean;
+    installedVersion: string | null;
+}
+export interface CatalogResult {
+    ok: true;
+    plugins: CatalogEntry[];
+    /** Stable code when the registry could not be reached at all. */
+    warning?: "registry_unavailable";
+}
+/** Build the marketplace catalog: npm registry search by marker keyword,
+ *  merged/deduped by package name, annotated with installed state. A total
+ *  registry outage degrades to an empty list + warning — never a 500 and
+ *  never raw upstream error text. */
+export declare function buildPluginCatalog(configDir: string, options?: {
+    registryBase?: string;
+    timeoutMs?: number;
+}): Promise<CatalogResult>;
+export interface PluginMarketRouteDeps {
+    /** $CCR_CONFIG_DIR (the plugins/ root the loader reads). */
+    configDir: string;
+    /** Configured PORT fallback when the server is not listening (tests that
+     *  inject() without a socket). */
+    configuredPort?: number;
+    /** Test seams. */
+    /** npm registry used by the install lane (defaults to npm's own registry).
+     *  Also serves as the catalog base unless catalogRegistryBase is given. */
+    registry?: string;
+    npmTimeoutMs?: number;
+    /** Registry base for catalog search (tests stub this). */
+    catalogRegistryBase?: string;
+    /** Bounded catalog network wait (tests use small values). */
+    catalogTimeoutMs?: number;
+}
+/** HTTP status for a stable install error code. Only the contract-pinned
+ *  mappings are load-bearing (corrupted → 409, bad name → 400); everything
+ *  else follows "client fixable" vs "registry broke" vs "we broke". */
+export declare function installErrorStatus(code: PluginInstallErrorCode | "install_failed"): number;
+/**
+ * Local-only guard for the marketplace routes. The SOCKET address is the only
+ * trustworthy identity: a non-loopback caller is rejected regardless of any
+ * header it can spoof. For loopback callers an Origin header, when present,
+ * must match this server's own loopback authority, and a Host header must do
+ * the same — that is what stops a malicious local page (DNS rebinding / CSRF)
+ * from driving installs through the victim's own loopback socket.
+ * Originless loopback requests (local CLI/tooling) are allowed.
+ */
+export declare function assertLocalMarketplaceRequest(req: any, app: FastifyInstance, configuredPort: number): boolean;
+export declare function registerPluginMarketRoutes(app: FastifyInstance, deps: PluginMarketRouteDeps): void;