dowafu 0.4.0 → 0.5.0

package/dist/output.js

@@ -1,106 +1,6 @@
-// plan_dispatch_v1.4.md §12/§16：落檔與 run.jsonl。寫入序列化——前一次 appendFile 未
-// resolve 前不發下一次；呼叫平行，寫入序列。所有落檔內容在寫入前經 maskDeep 遮蔽（§12）。
-import { appendFile, mkdir, readdir, writeFile } from "node:fs/promises";
-import path from "node:path";
+// D1：Spoke 結果只寫進 SQLite 的 results 欄位；所有落庫內容在寫入前經 maskDeep 遮蔽。
 import { maskDeep, maskString } from "./mask.js";
 import { m } from "./messages.js";
-export class RunLogWriter {
-    filePath;
-    lang;
-    queue = Promise.resolve();
-    constructor(filePath, lang) {
-        this.filePath = filePath;
-        this.lang = lang;
-    }
-    // plan_dispatch_v2.4.md §12（一）：ts 語意為「append 被呼叫的當下」，即事件發生時刻，
-    // 故在此（方法本體）取時間，不得延後到 queue 的 then callback 內——落盤時間會被檔案
-    // 系統阻塞與 queue 排隊污染，失去診斷「哪一輪慢」的價值。ts 於 maskDeep 之後加入，
-    // 避免遮蔽邏輯誤傷時間字串。
-    append(event) {
-        const ts = new Date().toISOString();
-        const masked = maskDeep(event);
-        const line = JSON.stringify({ ...masked, ts }) + "\n";
-        // §12（二）：單次 appendFile 失敗只影響該行，不得毒化 queue——否則其後每一次
-        // append 都不會執行，且 flush() 也會 rejected，等於一次瞬時寫入失敗讓該次派工
-        // 其餘所有事件全部遺失。失敗以 stderr 留痕，不靜默吞掉。
-        this.queue = this.queue.then(() => appendFile(this.filePath, line, "utf8")).catch((err) => {
-            console.error(m(this.lang, "runLogWriteFailed", maskString(String(err))));
-        });
-    }
-    async flush() {
-        await this.queue;
-    }
-}
-export async function ensureOutDir(outDir) {
-    await mkdir(path.join(outDir, "raw"), { recursive: true });
-    // §13：「同一工單重跑會覆蓋同名輸出目錄——刻意行為」。其餘產物（summary.md、
-    // <agent>.md、raw/*.json）走 writeFile 自然覆蓋，唯獨 run.jsonl 走 appendFile
-    // ——§12 的 append 是為**單次執行內**的中斷安全，不是跨次累積。不在此清空的話，
-    // 重跑會把上一次的事件留著，而 toolCalls[] 正是偵測「零讀取」的唯一依據
-    // （issue_log_v2.0.md 2026-08-07：hub 驗收時據此數錯 9／22 vs 實際 7／20）。
-    await writeFile(path.join(outDir, "run.jsonl"), "", "utf8");
-}
-// 上面 §13 那條「重跑會覆蓋同名輸出目錄」的前提是**重跑的人知道自己在覆蓋什麼**。
-// 四格 host 對測（2026-08-13）打掉了那個前提：hub 會在派工前自己 rm -rf 掉輸出目錄，
-// 沒有人被問過，而那底下是已經付過錢的產物。覆蓋本身不改（此處語意維持不變），改成
-// 由 cli.ts 在**還沒呼叫任何 API 的地方**擋下來——目錄非空就中止，並要求換 ticket-id。
-// 讀不到目錄（不存在、或權限不足）一律回 false：不存在本來就該放行，權限不足則交給
-// 後面的 ensureOutDir 報 outDirNotWritable，兩者的訊息各自比這裡準確。
-export async function outDirHasArtifacts(outDir) {
-    try {
-        return (await readdir(outDir)).length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-// §13：raw 一律無條件覆寫。v2.4 實作期間曾加過「空 raw 不覆蓋磁碟上的非空內容」守衛
-// （由 v2.4 §20 的一條測試要求逼出來），驗收時撤除：它破壞了 §13「同一工單重跑會覆蓋
-// 同名輸出目錄」——重跑時該 spoke 若零 raw，上一次的內容會留著冒充本次證據，與
-// 21bbd83 修掉的 run.jsonl 污染同型，而 raw/ 是「當時究竟送了什麼出去」的唯一證據。
-// 「防禦性空 result 覆寫已付費內容」那條路徑的保證，由 persistSpokeResult 的
-// 「例外不外傳」單獨承擔——例外不外傳之後，results[i] 永遠是 runSpoke 的真實回傳值。
-export async function writeRawFiles(outDir, agent, result) {
-    await writeFile(path.join(outDir, "raw", `${agent}.request.json`), JSON.stringify(maskDeep(result.rawRequests), null, 2), "utf8");
-    await writeFile(path.join(outDir, "raw", `${agent}.response.json`), JSON.stringify(maskDeep(result.rawResponses), null, 2), "utf8");
-    // plan_fixes_v1.0.md §6：先前失敗時 request/response 兩份都是 []（兩者只記成功輪次），
-    // 中斷或失敗時完全沒有線索。獨立於上面兩份之外——不動既有「僅成功輪次」的語意，
-    // 逐次錯誤（含重試中途、非終局那次）另開一份，空陣列＝未撞過任何錯誤。
-    await writeFile(path.join(outDir, "raw", `${agent}.errors.json`), JSON.stringify(maskDeep(result.rawErrors), null, 2), "utf8");
-}
-// §13：「原文產出」欄——failed 無產出；其餘（含 truncated:*）皆落檔，即使不完整，
-// 因為那是已經付過錢的內容。
-export async function writeSpokeText(outDir, agent, result, lang) {
-    if (result.status === "failed")
-        return;
-    // issue_log_v2.5.md 待修 #7：本函式一度是唯一沒有遮蔽的落檔路徑——`raw/` 與 `run.jsonl`
-    // 都經 maskDeep，只有這裡直寫 finalText。spoke 讀的是被審專案的原始碼，那裡若有硬編金鑰，
-    // 它可以照抄進「原文」欄（§16 模板要求逐字複製），於是秘密落到一個不經遮蔽的檔案裡。
-    const content = maskString(result.finalText ?? m(lang, "noFullReportAvailable", result.status));
-    await writeFile(path.join(outDir, `${agent}.md`), content, "utf8");
-}
-// plan_dispatch_v2.4.md §13（一）：每支 spoke 完成即落檔的落地點。落檔例外不得外傳——
-// 落檔失敗不得使呼叫端的 promise rejected、不得改變該 spoke 的 status（落檔是產物持久化，
-// 不是執行結果），但必須留下痕跡：寫入 result.errors[] 並經 onError 回報。
-// writeSpokeText、writeRawFiles 各自包住例外，其一失敗不影響另一個執行。
-export async function persistSpokeResult(outDir, result, onError, lang) {
-    try {
-        await writeSpokeText(outDir, result.agent, result, lang);
-    }
-    catch (err) {
-        const msg = m(lang, "persistTextFailed", result.agent, maskString(String(err)));
-        result.errors.push(msg);
-        onError(msg);
-    }
-    try {
-        await writeRawFiles(outDir, result.agent, result);
-    }
-    catch (err) {
-        const msg = m(lang, "persistRawFailed", result.agent, maskString(String(err)));
-        result.errors.push(msg);
-        onError(msg);
-    }
-}
 function formatStoreCell(store) {
     return store === "false" ? "false" : store;
 }
@@ -114,6 +14,15 @@ function formatStatusCell(r, lang) {
     const flag = r.budgetTrigger === "reasoning_round" ? m(lang, "anomalySpikeFlag") : "";
     return `${r.status}（${flag}${label}）`;
 }
+// 工單 status-stdin §A-2：只在 provider 自己明確回報了非正常結束（finishReasonRaw 非
+// null，且 normalizeFinishReason 沒把它正規化成 "stop"）時才印；正常結束不多印一欄。
+// finishReason／finishReasonRaw 在這個條件下必然相等（usage.ts 的 STOP_VALUES 之外一律
+// 原樣保留），印 finishReason 即可，不必額外帶 raw。
+function formatFinishReasonCell(r, lang) {
+    if (r.finishReasonRaw === null || r.finishReason === "stop")
+        return null;
+    return m(lang, "finishReasonWarningCell", r.finishReason ?? "unknown");
+}
 // 工單 X1 v1.1 §二：模板佔位符若被留在回報裡，列出是哪幾個、各幾次；沒有命中維持既有
 // 風格印「無」。
 function formatPlaceholdersCell(hits, lang) {
@@ -135,6 +44,10 @@ export function buildSummaryMarkdown(ticketId, results, audits, toolCallAudits,
         if (t?.zeroSourceRead) {
             cells.push(m(lang, "zeroSourceReadWarning", t.allowedReadsCount));
         }
+        const finishReasonCell = formatFinishReasonCell(r, lang);
+        if (finishReasonCell !== null) {
+            cells.push(finishReasonCell);
+        }
         if (t) {
             cells.push(m(lang, "toolCallStats", t.total, t.allowed, t.rejected));
         }
@@ -153,7 +66,81 @@ export function buildSummaryMarkdown(ticketId, results, audits, toolCallAudits,
 ${rows.join("\n")}
 `;
 }
-export async function writeSummary(outDir, ticketId, results, audits, toolCallAudits, lang) {
-    const md = buildSummaryMarkdown(ticketId, results, audits, toolCallAudits, lang);
-    await writeFile(path.join(outDir, "summary.md"), md, "utf8");
+// D1 DB persistence.  `results` deliberately has no opaque blob column: the three
+// existing artifact families map to output/request/response and remain inspectable.
+export function persistSpokeResultDb(db, ticket, result) {
+    const output = result.status === "failed" ? null : maskString(result.finalText ?? "");
+    const request = JSON.stringify(maskDeep({ requests: result.rawRequests, errors: result.rawErrors }));
+    const response = JSON.stringify(maskDeep({ responses: result.rawResponses, result }));
+    try {
+        db.prepare(`INSERT INTO results (job_id, agent, output, request, response, tokens_in, tokens_out, cost_usd)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(ticket, result.agent, output, request, response, result.usage.inputTokens, result.usage.outputTokens, result.costUsd);
+    }
+    catch (err) {
+        // cli.ts intentionally persists the exact same in-memory result twice: immediately
+        // after a spoke, then once more in its post-settlement retry loop.  Keep that
+        // idempotent case, but let every materially different duplicate surface as SQLite's
+        // constraint error instead of silently replacing paid output.
+        const existing = db.prepare(`SELECT output, request, response, tokens_in, tokens_out, cost_usd
+       FROM results WHERE job_id = ? AND agent = ?`).get(ticket, result.agent);
+        if (existing
+            && existing.output === output
+            && existing.request === request
+            && existing.response === response
+            && existing.tokens_in === result.usage.inputTokens
+            && existing.tokens_out === result.usage.outputTokens
+            && existing.cost_usd === result.costUsd)
+            return;
+        throw err;
+    }
+}
+export function writeSummaryDb(db, ticket, results, audits, toolCallAudits, lang) {
+    const summary = buildSummaryMarkdown(ticket, results, audits, toolCallAudits, lang);
+    db.prepare(`INSERT INTO results (job_id, agent, output, request, response, tokens_in, tokens_out, cost_usd)
+     VALUES (?, '__summary__', ?, NULL, NULL, NULL, NULL, NULL)`).run(ticket, maskString(summary));
+}
+// 票 skill-refresh：把「讀回一次派工的結果」抽成 CLI 與 MCP 共用的唯一實作。
+// D1 之後產物只在 DB，而在此之前**只有 MCP 的 dispatch_result 讀得回來**——走 CLI 直接
+// 派工的人沒有對應指令，實測中的 Claude Code 因此自己去開 sqlite3（v0_5_0/_archived/log.md §八，當時記成
+// 「client 又 shell out 了」的行為觀察，沒認出那是缺一個指令）。
+//
+// 兩個呼叫端共用同一支，是因為這批已經撞過三次「兩個呼叫端只改了一個」（票 B 的候選清單、
+// 票 C 的 DOWAFU_HTTP_PORT、cost-cap 的 report/ticket-store）。
+//
+// `job_id` 欄存的是 resultId：CLI 直接派工時等於 ticket 名稱，走 daemon 佇列時是 job 的
+// UUID。故先照原樣查一次，查不到再把它當成 ticket 名稱去找最近一筆完成的 job——兩條派工
+// 路徑的使用者都能用同一個指令拿回結果。
+// 工單 status-stdin §A-1：output IS NULL 是既有的失敗訊號（見 persistSpokeResultDb——
+// 只有 status === "failed" 才寫 NULL，見上方 output 變數的三元運算）。先前這裡直接印
+// `${agent}:\n`，付了錢卻拿到空段落的東西，跟「這支什麼都沒說」分不出來。lang 預設 en：
+// 目前兩個呼叫端（cli.ts 的 `result` 子指令、mcp/protocol.ts 的 dispatch_result）都不在
+// 本票的擁有清單內，改不了它們的呼叫點；預設值讓既有呼叫維持可編譯、行為只在「失敗且無
+// 產出」這個先前本來就講不清楚的邊界上變化，成功的輸出逐字不受影響（見下方 map）。
+export function readResults(db, ticketOrJobId, lang = "en") {
+    const select = db.prepare("SELECT agent, output FROM results WHERE job_id = ? ORDER BY agent");
+    let rows = select.all(ticketOrJobId);
+    if (rows.length === 0) {
+        const latest = db
+            // 驗收熱修補（票 skill-docs）：先前只找 `completed`，於是**失敗的佇列 job 用 ticket-id
+            // 查不到**——而那正是最想看結果的時候（實測回「No results found」）。
+            // failed 與 interrupted 一樣有已付費的 results 可讀：interrupted 是「跑到一半行程死了」，
+            // 先完成的那幾支已經花過錢也已經落檔，把它們擋在外面與「落檔失敗不得銷毀已付費結果」
+            // （D1-hot3）那條的立場相反。running 不列入：那是還在跑，回半截會被讀成最終答案。
+            .prepare("SELECT id FROM jobs WHERE ticket = ? AND status IN ('completed', 'failed', 'interrupted') ORDER BY finished_at DESC LIMIT 1")
+            .get(ticketOrJobId);
+        if (latest)
+            rows = select.all(latest.id);
+    }
+    return rows.map((row) => `${row.agent}:\n${row.output ?? m(lang, "noFullReportAvailable", "failed")}`);
+}
+// 工單 status-stdin §A-3：dispatch_status 對 completed／failed 的 job 要能講出成敗分佈
+// ——「三支死一支」先前完全看不出來。沿用 §A-1 同一個 NULL 訊號（agent != '__summary__'：
+// 稽核表本身的那一列不是 spoke，不計入分佈），不重算、不新增欄位。與 readResults 不同，
+// 這裡的呼叫端（protocol.ts 的 dispatch_status）已經用 resolveJob 解出確切的 job.id，
+// 不需要 readResults 那套「查無結果就回頭找 ticket 名稱」的雙路查詢。
+export function readResultOutcomes(db, jobId) {
+    const rows = db
+        .prepare("SELECT agent, output FROM results WHERE job_id = ? AND agent != '__summary__' ORDER BY agent")
+        .all(jobId);
+    return rows.map((row) => ({ agent: row.agent, failed: row.output === null }));
 }

package/dist/progress.js

@@ -0,0 +1,36 @@
+// **絕不讓進度寫入弄死一次已付費的派工。** 這張表是可丟棄的診斷資料，而呼叫端正在跑的是
+// 花了錢的東西——任何 SQLite 例外都在這裡吞掉，不往上拋。同一個 (result_id, agent, round)
+// 重寫直接覆蓋：進度不是已付費產出，沒有 `results` 那條「實質不同的重寫要炸出來」的顧慮
+// （那條守的是 D1-hot3 的「落檔失敗不得銷毀已付費結果」，見 output.ts）。
+export function recordRound(db, resultId, agent, round, usage, hasToolCalls, now = () => new Date().toISOString()) {
+    try {
+        db.prepare(`INSERT INTO progress (result_id, agent, round, at, tokens_in, tokens_out, has_tool_calls)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(result_id, agent, round) DO UPDATE SET
+         at = excluded.at, tokens_in = excluded.tokens_in,
+         tokens_out = excluded.tokens_out, has_tool_calls = excluded.has_tool_calls`).run(resultId, agent, round, now(), usage.inputTokens, usage.outputTokens, hasToolCalls ? 1 : 0);
+    }
+    catch {
+        // 吞掉：見上方。進度查不到比派工中斷好。
+    }
+}
+// 每支 spoke 一列摘要，依 agent 排序（不是插入序——不同機器上的列序不該讓輸出長得不一樣）。
+export function readProgress(db, resultId) {
+    return db
+        .prepare(`SELECT agent,
+                count(*)        AS rounds,
+                max(round)      AS last_round,
+                max(at)         AS last_at,
+                sum(tokens_in)  AS tokens_in,
+                sum(tokens_out) AS tokens_out
+           FROM progress WHERE result_id = ?
+          GROUP BY agent ORDER BY agent`)
+        .all(resultId).map((row) => ({
+        agent: row.agent,
+        rounds: Number(row.rounds),
+        lastRound: Number(row.last_round),
+        lastAt: row.last_at,
+        tokensIn: Number(row.tokens_in),
+        tokensOut: Number(row.tokens_out),
+    }));
+}

package/dist/provider-key.js

@@ -0,0 +1,84 @@
+// 工單 key-db（E12）：provider 金鑰的 DB 存取。**DB 是唯一來源。**
+//
+// `provider_keys` 表由 T1（hub）建好（db.ts migration version 2），本檔不碰 schema。
+// 與 src/api-token.ts 刻意不共用任何機制：那張表只存 hash（入站憑證，只比對不重放），
+// 這裡存明文（出站，得原樣交給廠商）。方向相反，見票 §零之「⚠️ 命名」一節。
+//
+// **0.5.0 起不再從環境變數或 `$DISPATCH_HOME/.env` 讀 API key**（使用者裁示，2026-09-06）。
+// 初版做過「ambient env > .env > DB」三層優先序，連帶要在 dotenv 載入當下記錄「哪些鍵是
+// 我填的」才分辨得出來源，`--doctor` 也得逐層顯示。那整串複雜度是多來源自己養出來的
+// ——**收緊成單一來源之後，優先序、來源分辨、各種組合的測試全部不存在**。
+// 舊版把 key 放在 .env 的人，升級後請改用 `dowafu key` 重設一次；缺 key 的錯誤訊息會講。
+import { now } from "./db.js";
+function toProviderKeyRecord(row) {
+    return {
+        provider: row.provider,
+        apiKey: row.api_key,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        lastTestedAt: row.last_tested_at,
+        lastTestModel: row.last_test_model,
+        lastTestSucceeded: row.last_test_succeeded === null ? null : row.last_test_succeeded === 1,
+    };
+}
+export function getProviderKey(db, provider) {
+    const row = db
+        .prepare("SELECT provider, api_key, created_at, updated_at, last_tested_at, last_test_model, last_test_succeeded FROM provider_keys WHERE provider = ?")
+        .get(provider);
+    return row ? toProviderKeyRecord(row) : undefined;
+}
+export function listProviderKeys(db) {
+    return db
+        .prepare("SELECT provider, api_key, created_at, updated_at, last_tested_at, last_test_model, last_test_succeeded FROM provider_keys ORDER BY provider")
+        .all().map(toProviderKeyRecord);
+}
+// A-2 #1：重複 set 同一個 provider 是更新不是新增一列，updated_at 要跟著動；created_at
+// 只在第一次寫入時落地。呼叫端負責 trim；本檔不對內容做任何格式判斷（A-1：明文存、不驗證）。
+export function setProviderKey(db, provider, apiKey) {
+    const timestamp = now();
+    db.prepare(`INSERT INTO provider_keys (provider, api_key, created_at, updated_at) VALUES (?, ?, ?, ?)
+     ON CONFLICT(provider) DO UPDATE SET
+       api_key = excluded.api_key,
+       updated_at = excluded.updated_at,
+       -- A test belongs to the key value, not merely its provider.  Re-pasting the same
+       -- value keeps the result useful; a different value must return to the untested state.
+       last_tested_at = CASE WHEN provider_keys.api_key <> excluded.api_key THEN NULL ELSE provider_keys.last_tested_at END,
+       last_test_model = CASE WHEN provider_keys.api_key <> excluded.api_key THEN NULL ELSE provider_keys.last_test_model END,
+       last_test_succeeded = CASE WHEN provider_keys.api_key <> excluded.api_key THEN NULL ELSE provider_keys.last_test_succeeded END`).run(provider, apiKey, timestamp, timestamp);
+    return getProviderKey(db, provider);
+}
+// A-2 #3：真的刪掉那一列（不是標記刪除），回傳是否真的刪到東西。
+export function removeProviderKey(db, provider) {
+    const result = db.prepare("DELETE FROM provider_keys WHERE provider = ?").run(provider);
+    return Number(result.changes) > 0;
+}
+// key-visibility §B：不論 API 驗證成功或失敗都留下結果。這裡刻意不更新 updated_at：那欄
+// 是 key 值最後被設定的時間，不能混進一個只讀驗證的時間。
+export function recordProviderKeyTest(db, provider, model, succeeded) {
+    db.prepare("UPDATE provider_keys SET last_tested_at = ?, last_test_model = ?, last_test_succeeded = ? WHERE provider = ?").run(now(), model, succeeded ? 1 : 0, provider);
+}
+// §C-1 之2：provider 清單從 DB 的 `providers` 表來（票 A 已把 provider 進 DB），不是硬編
+// 一份四家的清單——新增 provider 時選單自動跟上。
+export function listKnownProviderNames(db) {
+    return db.prepare("SELECT name FROM providers ORDER BY name").all().map((row) => row.name);
+}
+// 票 §E 點 3：遮罩尾碼會洩漏最後 4 碼——刻意的取捨（讓人認得出貼對沒），文件必須寫出來，
+// 不是安全機制。
+export function maskTail(apiKey) {
+    return `…${apiKey.slice(-4)}`;
+}
+// `dowafu key`（互動選單）、`key list`、`--doctor` 三個輸出面共用同一份判定，避免各自
+// 判斷一次而漂移。單一來源之後「有沒有設定」就等於 maskedTail 是不是 null，不需要來源欄位。
+export function buildKeyStatusRows(db) {
+    return listKnownProviderNames(db).map((provider) => {
+        const stored = getProviderKey(db, provider);
+        return {
+            provider,
+            maskedTail: stored ? maskTail(stored.apiKey) : null,
+            updatedAt: stored ? stored.updatedAt : null,
+            lastTestedAt: stored ? stored.lastTestedAt : null,
+            lastTestModel: stored ? stored.lastTestModel : null,
+            lastTestSucceeded: stored ? stored.lastTestSucceeded : null,
+        };
+    });
+}

package/dist/providers-store.js

@@ -0,0 +1,165 @@
+import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { now } from "./db.js";
+import { DispatchError } from "./types.js";
+import { m } from "./messages.js";
+import { parseProvidersFile } from "./providers.js";
+import { bundledProvidersPath } from "./pkg-info.js";
+const DEFAULT_ENABLED = new Set([
+    "gpt-5.6-luna",
+    "deepseek-v4-flash",
+    "gemini-3.1-flash-lite",
+    "gemini-3.5-flash-lite",
+    "claude-haiku-4-5-20251001",
+]);
+// 解析與讀檔分開：播種必須是同步的（protocol.ts／stdio.ts 都是同步，
+// 讓它們變 async 會一路波及到還沒寫的 HTTP binding），而 import 走 async 讀檔。
+// 兩條路共用同一份解析，避免「兩種入口兩種嚴格度」。
+function parseSourceText(text, lang) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        throw new DispatchError(m(lang, "providersFileInvalidJson", err.message), 2);
+    }
+    const providers = parseProvidersFile(raw, lang);
+    const entries = raw;
+    const pricingSources = {};
+    for (const name of Object.keys(providers)) {
+        const source = entries[name];
+        pricingSources[name] = source.pricingSource ?? null;
+    }
+    return { providers, pricingSources };
+}
+export async function readProvidersFile(filePath, lang) {
+    let text;
+    try {
+        text = await readFile(filePath, "utf8");
+    }
+    catch {
+        throw new DispatchError(m(lang, "missingProviders", filePath), 2);
+    }
+    return parseSourceText(text, lang);
+}
+// 熱修補（票 A 驗收缺口二）：空表要自動播種出貨檔。
+//
+// 驗收發現全新安裝完全跑不動——models 表是空的，addSpoke 回「白名單為空」，
+// 而使用者得自己找出 bundled providers.json 的路徑（在全域安裝裡帶版本號與相依雜湊，
+// report.ts 的註解就寫著「猜不到」）。更糟的是 bundled 旗標用路徑完全相等判定，
+// 所以複製一份自己的副本再 import 會得到「12 個型號全關」，而且沒有任何提示。
+//
+// hub 原本的裁示是「只由 providers import 明確觸發，不做啟動時自動偵測」——那句話
+// 講的是**合流**（升級後蓋掉價目，會在使用者不知情時改掉計費基準），不是**首次播種**
+// （空表放進出貨資料，沒有覆蓋任何東西）。措辭沒分開，故此處修正：只在**完全空表**時播種。
+//
+// 回傳是否真的播了種——呼叫端要據此印出通知。**播種不得靜默**。
+export function seedIfEmpty(db, lang) {
+    const count = db.prepare("SELECT count(*) AS c FROM models").get().c;
+    if (Number(count) > 0)
+        return false;
+    const filePath = bundledProvidersPath();
+    let text;
+    try {
+        text = readFileSync(filePath, "utf8");
+    }
+    catch {
+        throw new DispatchError(m(lang, "missingProviders", filePath), 2);
+    }
+    // bundled = true：出貨檔才套用 DEFAULT_ENABLED 那五個。
+    mergeProviders(db, parseSourceText(text, lang), true);
+    return true;
+}
+function json(value) {
+    return JSON.stringify(value);
+}
+export function mergeProviders(db, source, bundled) {
+    const timestamp = now();
+    db.exec("BEGIN");
+    try {
+        for (const [name, config] of Object.entries(source.providers)) {
+            db.prepare(`INSERT INTO providers (name, base_url, api, store, tool_calling, reasoning, chars_per_token, tpm_limit, max_spoke_tokens, pricing_source, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(name) DO UPDATE SET base_url=excluded.base_url, api=excluded.api, store=excluded.store,
+          tool_calling=excluded.tool_calling, reasoning=excluded.reasoning, chars_per_token=excluded.chars_per_token,
+          tpm_limit=excluded.tpm_limit, max_spoke_tokens=excluded.max_spoke_tokens, pricing_source=excluded.pricing_source,
+          updated_at=excluded.updated_at`)
+                .run(name, config.baseURL, config.api, config.store === null ? null : 0, config.toolCalling ? 1 : 0, json(config.reasoning), config.charsPerToken, config.tpmLimit, config.maxSpokeTokens, json(source.pricingSources[name]), timestamp);
+            for (const model of config.models) {
+                const price = config.pricing?.[model];
+                const old = db.prepare("SELECT enabled FROM models WHERE provider = ? AND model = ?").get(name, model);
+                const enabled = old ? old.enabled : bundled && DEFAULT_ENABLED.has(model) ? 1 : 0;
+                db.prepare(`INSERT INTO models (provider, model, input_per_m, cached_input_per_m, cache_write_per_m, output_per_m, enabled, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(provider, model) DO UPDATE SET input_per_m=excluded.input_per_m, cached_input_per_m=excluded.cached_input_per_m,
+            cache_write_per_m=excluded.cache_write_per_m, output_per_m=excluded.output_per_m, enabled=models.enabled, updated_at=excluded.updated_at`)
+                    .run(name, model, price?.inputPerM ?? null, price?.cachedInputPerM ?? null, price?.cacheWritePerM ?? null, price?.outputPerM ?? null, enabled, timestamp);
+            }
+        }
+        db.exec("COMMIT");
+    }
+    catch (err) {
+        db.exec("ROLLBACK");
+        throw err;
+    }
+}
+export function loadProviders(db, lang) {
+    const providers = {};
+    const rows = db.prepare("SELECT name, base_url, api, store, tool_calling, reasoning, chars_per_token, tpm_limit, max_spoke_tokens, pricing_source FROM providers ORDER BY name").all();
+    const models = listModels(db);
+    for (const row of rows) {
+        const name = String(row.name);
+        let reasoning;
+        let source;
+        try {
+            reasoning = JSON.parse(String(row.reasoning));
+            source = row.pricing_source === null ? null : JSON.parse(String(row.pricing_source));
+        }
+        catch {
+            throw new DispatchError(m(lang, "providersDbCorrupt", name), 2);
+        }
+        const own = models.filter((model) => model.provider === name);
+        if (own.length === 0)
+            throw new DispatchError(m(lang, "providersDbCorrupt", name), 2);
+        const pricing = {};
+        for (const model of own) {
+            if (model.inputPerM !== undefined && model.outputPerM !== undefined) {
+                pricing[model.model] = {
+                    inputPerM: model.inputPerM,
+                    outputPerM: model.outputPerM,
+                    ...(model.cachedInputPerM !== undefined ? { cachedInputPerM: model.cachedInputPerM } : {}),
+                    ...(model.cacheWritePerM !== undefined ? { cacheWritePerM: model.cacheWritePerM } : {}),
+                };
+            }
+        }
+        const asOf = source && typeof source === "object" && typeof source.asOf === "string"
+            ? source.asOf : undefined;
+        providers[name] = {
+            baseURL: String(row.base_url), api: row.api, store: row.store === null ? null : false,
+            toolCalling: Number(row.tool_calling) === 1, reasoning, models: own.map((model) => model.model),
+            charsPerToken: row.chars_per_token === null ? null : Number(row.chars_per_token),
+            tpmLimit: row.tpm_limit === null ? null : Number(row.tpm_limit),
+            maxSpokeTokens: row.max_spoke_tokens === null ? null : Number(row.max_spoke_tokens),
+            ...(Object.keys(pricing).length > 0 ? { pricing } : {}), ...(asOf ? { pricingAsOf: asOf } : {}),
+        };
+    }
+    return providers;
+}
+export function listModels(db) {
+    return db.prepare("SELECT provider, model, input_per_m, cached_input_per_m, cache_write_per_m, output_per_m, enabled FROM models ORDER BY provider, model").all()
+        .map((row) => ({ provider: String(row.provider), model: String(row.model), inputPerM: row.input_per_m === null ? undefined : Number(row.input_per_m), cachedInputPerM: row.cached_input_per_m === null ? undefined : Number(row.cached_input_per_m), cacheWritePerM: row.cache_write_per_m === null ? undefined : Number(row.cache_write_per_m), outputPerM: row.output_per_m === null ? undefined : Number(row.output_per_m), enabled: Number(row.enabled) === 1 }));
+}
+export function isModelEnabled(db, provider, model) {
+    return db.prepare("SELECT enabled FROM models WHERE provider = ? AND model = ?").get(provider, model)?.enabled === 1;
+}
+export function setModelEnabled(db, providerOrModel, maybeModel, enabled, lang) {
+    const matches = maybeModel === undefined
+        ? db.prepare("SELECT provider, model FROM models WHERE model = ? ORDER BY provider").all(providerOrModel)
+        : db.prepare("SELECT provider, model FROM models WHERE provider = ? AND model = ?").all(providerOrModel, maybeModel);
+    const model = maybeModel ?? providerOrModel;
+    if (matches.length === 0)
+        throw new DispatchError(m(lang, "providerModelNotFound", model), 2);
+    if (matches.length > 1)
+        throw new DispatchError(m(lang, "providerModelAmbiguous", model, matches.map((item) => item.provider).join(", ")), 2);
+    db.prepare("UPDATE models SET enabled = ?, updated_at = ? WHERE provider = ? AND model = ?").run(enabled ? 1 : 0, now(), matches[0].provider, matches[0].model);
+}

package/dist/providers.js

@@ -1,6 +1,7 @@
+import { readFile } from "node:fs/promises";
+import { loadProviders as loadProvidersFromDb } from "./providers-store.js";
 // plan_dispatch_v1.4.md §5：providers.json 載入與驗證。fail closed——api 欄缺失或
 // store:true 即中止（exit 2），不套用預設值繼續跑（§10 步驟 3）。
-import { readFile } from "node:fs/promises";
 import { DispatchError, } from "./types.js";
 import { m } from "./messages.js";
 function parseReasoning(raw, providerName, lang) {
@@ -44,7 +45,7 @@ function parsePositiveNumber(v, label, lang) {
     }
     return v;
 }
-function parsePricing(raw, providerName, lang) {
+function parsePricing(raw, providerName, models, lang) {
     if (raw === undefined)
         return undefined;
     if (!raw || typeof raw !== "object") {
@@ -52,6 +53,9 @@ function parsePricing(raw, providerName, lang) {
     }
     const out = {};
     for (const [model, entry] of Object.entries(raw)) {
+        if (!models.includes(model)) {
+            throw new DispatchError(m(lang, "pricingModelNotWhitelisted", providerName, model), 2);
+        }
         if (!entry || typeof entry !== "object") {
             throw new DispatchError(m(lang, "pricingModelNotObject", providerName, model), 2);
         }
@@ -96,8 +100,12 @@ function parseProviderConfig(name, raw, lang) {
     if (typeof r.baseURL !== "string" || r.baseURL.length === 0) {
         throw new DispatchError(m(lang, "providerBaseUrlMissing", name), 2);
     }
-    // §5：models 白名單。未填（或非陣列）視為空陣列 = 不做型號檢查。
-    const models = Array.isArray(r.models) ? r.models.filter((v) => typeof v === "string") : [];
+    // A-1 addendum: models is the fail-closed model boundary. Missing, empty, and
+    // non-string entries must not silently turn into an unrestricted provider.
+    if (!Array.isArray(r.models) || r.models.length === 0 || !r.models.every((v) => typeof v === "string" && v.length > 0)) {
+        throw new DispatchError(m(lang, "providerModelsRequired", name), 2);
+    }
+    const models = r.models;
     // §5：charsPerToken。未填時用 CLI 全域值——保留 null，不在此處套 1.0（CLI 端才知道
     // 使用者傳入的 --chars-per-token 是多少）。
     if (r.charsPerToken !== undefined && (typeof r.charsPerToken !== "number" || !(r.charsPerToken > 0))) {
@@ -114,7 +122,7 @@ function parseProviderConfig(name, raw, lang) {
         charsPerToken,
         tpmLimit: typeof r.tpmLimit === "number" ? r.tpmLimit : null,
         maxSpokeTokens: typeof r.maxSpokeTokens === "number" ? r.maxSpokeTokens : null,
-        pricing: parsePricing(r.pricing, name, lang),
+        pricing: parsePricing(r.pricing, name, models, lang),
         pricingAsOf: parsePricingAsOf(r.pricingSource),
     };
 }
@@ -137,7 +145,7 @@ export function parseProvidersFile(json, lang) {
     }
     return out;
 }
-export async function loadProviders(filePath, lang) {
+export async function loadProvidersFile(filePath, lang) {
     let text;
     try {
         text = await readFile(filePath, "utf8");
@@ -154,6 +162,10 @@ export async function loadProviders(filePath, lang) {
     }
     return parseProvidersFile(json, lang);
 }
+// Runtime authority is SQLite. The bundled file remains an explicit import source only.
+export function loadProviders(db, lang) {
+    return loadProvidersFromDb(db, lang);
+}
 export function getProviderConfig(providers, name, lang) {
     const config = providers[name];
     if (!config) {