dsh-model-health 0.2.8 → 0.2.9

package/README.md

@@ -53,11 +53,11 @@ dsh --profile web --dump-config | grep dsh-model-health   # 配置层含本行
 **特性一览：**
 
 - 支持 `llm-pi-ai`（多协议自定义提供商）与 `llm-deepseek`（官方）两类配置来源
-- 可用性测试支持 `openai-completions` 与 `deepseek` 协议，其余协议自动标记「跳过」
+- 可用性测试支持 `openai-completions` 与 `deepseek` 协议，其余协议自动标记「跳过」；对 200 响应校验 body 确实是成功应答（部分网关 200 但 body 是错误对象）
 - API Key 通过 DSH credential service（`ctx.credentials.resolve`）解析，密钥不会输出到浏览器
 - 测试结果（状态/延迟/错误）持久化到 localStorage，刷新页面后仍可见
 - 状态列的 可用 / 不可用 / 跳过 徽章随时可点击，对单个模型重新测试，原地刷新状态与延迟
-- 设置导航使用脉搏线（Activity）图标——宿主图标表没有「健康」类目，参考 dsh-better-sidebar 的方案，JS 精准打 marker，CSS 用 `::before` + `mask` 把齿轮 svg 原地替换；颜色随主题走
+- 设置导航使用脉搏线（Activity）图标——宿主图标表没有「健康」类目，参考 dsh-better-sidebar 的方案，JS 精准打 marker（rAF 合帧防抖），CSS 用 `::before` + `mask` 把齿轮 svg 原地替换；颜色随主题走
 
 ## 实现方式 / How it works
 
@@ -69,6 +69,7 @@ dsh --profile web --dump-config | grep dsh-model-health   # 配置层含本行
 │  - ctx.webServer.register：                                        │
 │      GET  /api/model-health/json  读取并解析 settings.yaml → JSON  │
 │      POST /api/model-health/test  对单模型发最小请求测可用性/延迟  │
+│      （Origin 限本机；200 响应校验 body 为成功应答）               │
 │  - 解析 DSH credential service 获取 API Key                        │
 └──────────────────────────────────────────────────────────────────┘
                           │ fetch

package/dist/client.js

@@ -394,18 +394,39 @@
 //#endregion
 //#region src/client/storage.ts
 	const STORAGE_KEY = "dsh-model-health:test-results";
+	const VALID_STATUSES = /* @__PURE__ */ new Set([
+		"idle",
+		"testing",
+		"ok",
+		"fail",
+		"skip"
+	]);
+	/**
+	* 清洗任意来源（localStorage / 旧版本数据）的结果对象：
+	* - 残留的 testing（测试中刷新页面）归一为 idle
+	* - 旧版按数组下标存的纯数字 key 直接丢弃
+	* 纯函数，可单测。
+	*/
+	function sanitizeStoredResults(parsed) {
+		const cleaned = {};
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return cleaned;
+		for (const [k, v] of Object.entries(parsed)) {
+			if (/^\d+$/.test(k)) continue;
+			if (!v || typeof v !== "object") continue;
+			const raw = v;
+			const status = raw.status;
+			if (!VALID_STATUSES.has(status)) continue;
+			const result = { status: status === "testing" ? "idle" : status };
+			if (typeof raw.latency === "number" && raw.latency >= 0) result.latency = raw.latency;
+			if (typeof raw.error === "string") result.error = raw.error;
+			cleaned[k] = result;
+		}
+		return cleaned;
+	}
 	function loadStoredResults() {
 		try {
 			const raw = localStorage.getItem(STORAGE_KEY);
-			const parsed = raw ? JSON.parse(raw) : {};
-			const cleaned = {};
-			for (const k in parsed) {
-				if (/^\d+$/.test(k)) continue;
-				const v = parsed[k];
-				if (!v || typeof v !== "object") continue;
-				cleaned[k] = v.status === "testing" ? { status: "idle" } : v;
-			}
-			return cleaned;
+			return raw ? sanitizeStoredResults(JSON.parse(raw)) : {};
 		} catch {
 			return {};
 		}
@@ -441,12 +462,15 @@
 			});
 		}, []);
 		const testOne = useCallback(async (key) => {
+			setResults((s) => {
+				if (s[key]?.status === "testing") return s;
+				return {
+					...s,
+					[key]: { status: "testing" }
+				};
+			});
 			const seq = (seqRef.current[key] || 0) + 1;
 			seqRef.current[key] = seq;
-			setResults((s) => ({
-				...s,
-				[key]: { status: "testing" }
-			}));
 			const result = await requestModelTest(key);
 			writeResult(key, seq, result);
 		}, [writeResult]);
@@ -465,7 +489,7 @@
 				});
 				let done = 0;
 				const queue = models.map((m) => m.key);
-				async function worker() {
+				const worker = async () => {
 					while (queue.length > 0) {
 						const key = queue.shift();
 						if (key === void 0) break;
@@ -477,9 +501,20 @@
 						});
 						if (done >= total) setTesting(false);
 					}
-				}
+				};
 				await Promise.all(Array.from({ length: Math.min(CONCURRENCY, total) }, () => worker()));
-			}, [testOne])
+			}, [testOne]),
+			prune: useCallback((validKeys) => {
+				setResults((s) => {
+					const next = {};
+					let changed = false;
+					for (const k in s) if (validKeys.has(k)) next[k] = s[k];
+					else changed = true;
+					if (!changed) return s;
+					saveStoredResults(next);
+					return next;
+				});
+			}, [])
 		};
 	}
 
@@ -552,7 +587,7 @@
 //#region src/client/components/ModelListSection.tsx
 	function ModelListSection({ t, locale }) {
 		const React = getReact();
-		const { useState, useEffect, useCallback } = React;
+		const { useState, useEffect, useCallback, useRef } = React;
 		const run = useTestResults();
 		const [state, setState] = useState({
 			loading: true,
@@ -562,6 +597,8 @@
 		const [optionalCols, setOptionalCols] = useState({});
 		const [tooltip, setTooltip] = useState(null);
 		const [localeTick, setLocaleTick] = useState(0);
+		const tRef = useRef(t);
+		tRef.current = t;
 		useEffect(() => {
 			if (!locale || typeof locale.subscribe !== "function") return;
 			return locale.subscribe(() => setLocaleTick((n) => n + 1));
@@ -574,7 +611,7 @@
 			}));
 			try {
 				const json = await fetchModelList();
-				if (!json.ok) throw new Error(json.error || t("unknownError"));
+				if (!json.ok) throw new Error(json.error || tRef.current("unknownError"));
 				setState({
 					loading: false,
 					error: null,
@@ -587,10 +624,23 @@
 					data: null
 				});
 			}
-		}, [t]);
+		}, []);
 		useEffect(() => {
 			loadData();
 		}, [loadData]);
+		useEffect(() => {
+			if (state.data?.ok && state.data.models) run.prune(new Set(state.data.models.map((m) => m.key)));
+		}, [state.data, run.prune]);
+		useEffect(() => {
+			if (!tooltip) return;
+			const close = () => setTooltip(null);
+			window.addEventListener("scroll", close, true);
+			window.addEventListener("resize", close);
+			return () => {
+				window.removeEventListener("scroll", close, true);
+				window.removeEventListener("resize", close);
+			};
+		}, [tooltip]);
 		const toggleCol = (key) => {
 			setOptionalCols((s) => ({
 				...s,
@@ -613,15 +663,13 @@
 		const models = data.models || [];
 		const activeLang = locale && typeof locale.getLocale === "function" ? locale.getLocale().active : "zh";
 		const updatedAt = new Date(data.updatedAt || Date.now()).toLocaleString(activeLang === "en" ? "en-US" : "zh-CN");
-		const validKeys = new Set(models.map((m) => m.key));
 		const stats = {
 			ok: 0,
 			fail: 0,
 			skip: 0
 		};
-		for (const k in run.results) {
-			if (!validKeys.has(k)) continue;
-			const s = run.results[k].status;
+		for (const m of models) {
+			const s = run.results[m.key]?.status;
 			if (s === "ok") stats.ok++;
 			else if (s === "fail") stats.fail++;
 			else if (s === "skip") stats.skip++;
@@ -665,7 +713,7 @@
 			style: STYLES.th
 		}, t(col.label))))), /* @__PURE__ */ React.createElement("tbody", null, models.map((row, i) => {
 			const tr = run.results[row.key] || { status: "idle" };
-			return /* @__PURE__ */ React.createElement("tr", { key: (row.modelId || "") + i }, visibleCols.map((col) => {
+			return /* @__PURE__ */ React.createElement("tr", { key: row.key }, visibleCols.map((col) => {
 				if (col.key === "provider") {
 					const span = providerSpan[i];
 					if (span === void 0) return null;
@@ -714,7 +762,8 @@
 	*/
 	function registerSettingsNavIcon(label) {
 		let disposed = false;
-		const sync = () => {
+		let scheduled = false;
+		const run = () => {
 			if (disposed) return;
 			const currentLabel = label().trim();
 			const buttons = document.querySelectorAll("[role=\"dialog\"] nav button");
@@ -724,7 +773,15 @@
 				else button.removeAttribute(SETTINGS_NAV_MARKER);
 			}
 		};
-		sync();
+		const sync = () => {
+			if (scheduled || disposed) return;
+			scheduled = true;
+			requestAnimationFrame(() => {
+				scheduled = false;
+				run();
+			});
+		};
+		run();
 		const observer = new MutationObserver(sync);
 		observer.observe(document.body, {
 			childList: true,

package/dist/index.js

@@ -47,6 +47,7 @@ function toPublicRow(r) {
 }
 function collectModels(cfg) {
 	const rows = [];
+	if (!cfg || typeof cfg !== "object") return rows;
 	const piAi = cfg["llm-pi-ai"];
 	if (piAi && typeof piAi === "object") {
 		const providers = piAi.providers || {};
@@ -96,25 +97,27 @@ function collectModels(cfg) {
 //#endregion
 //#region src/host/markdown.ts
 function renderMarkdownTable(rows) {
+	const settingsPath = join(dshHome(), "settings.yaml");
 	if (rows.length === 0) return [
-		"当前 settings.yaml 中未配置任何模型。",
+		"当前 settings.yaml 中未配置任何模型。/ No models are configured in settings.yaml.",
 		"",
 		"请在 Web UI 的 设置 → 模型 中添加 DeepSeek API Key 或自定义提供商。",
-		`配置文件位置：${join(dshHome(), "settings.yaml")}`
+		"Please add a DeepSeek API key or a custom provider in Web UI → Settings → Models.",
+		`配置文件位置 / Config file: ${settingsPath}`
 	].join("\n");
-	const header = "| # | Provider | 模型 ID | 名称 | 上下文窗口 | 最大输出 | 输入模态 | API 协议 | BaseURL |";
-	const sep = "|---|----------|---------|------|-----------|---------|---------|---------|---------|";
+	const header = "| # | Provider | Model ID | Name | Context Window | Max Output | Input | API | BaseURL |";
+	const sep = "|---|----------|----------|------|----------------|------------|-------|-----|---------|";
 	const lines = rows.map((r, i) => {
 		return `| ${i + 1} | ${r.provider} | ${r.modelId} | ${r.modelName} | ${r.contextWindow} | ${r.maxTokens} | ${r.input} | ${r.api} | ${r.baseURL} |`;
 	});
 	return [
-		`已配置 **${rows.length}** 个模型：`,
+		`已配置 **${rows.length}** 个模型 / **${rows.length}** model(s) configured:`,
 		"",
 		header,
 		sep,
 		...lines,
 		"",
-		`_来源：${join(dshHome(), "settings.yaml")}_`
+		`_来源 / Source: ${settingsPath}_`
 	].join("\n");
 }
 //#endregion
@@ -125,6 +128,27 @@ function sendJson(res, code, obj) {
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
 	res.end(JSON.stringify(obj));
 }
+const LOCAL_HOSTNAMES = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1",
+	"0.0.0.0"
+]);
+/**
+* 浏览器跨站请求会携带 Origin 头：要求其指向本机（无 Origin 的请求——
+* curl / 服务间调用——放行）。与 readJsonBody 的 Content-Type 门卫叠加，
+* 构成写路由（POST /test）的双层 CSRF/SSRF 缓解。
+*/
+function isLocalOrigin(req) {
+	const origin = String(req.headers.origin ?? "");
+	if (!origin) return true;
+	try {
+		return LOCAL_HOSTNAMES.has(new URL(origin).hostname.toLowerCase());
+	} catch {
+		return false;
+	}
+}
 /** 读 JSON body（限 64KB），且必须是 application/json（兼作 CSRF 门卫）。 */
 async function readJsonBody(req) {
 	if (!String(req.headers["content-type"] ?? "").includes("application/json")) throw new Error("Content-Type 必须是 application/json");
@@ -140,11 +164,47 @@ async function readJsonBody(req) {
 }
 //#endregion
 //#region src/host/model-test.ts
+/** 错误体最多读这么多字节就提前取消（展示时也只取前 300 字符） */
+const MAX_ERROR_BODY_BYTES = 1024;
+/** 成功响应体较大（含 usage 等），最多读 4KB 用于成功校验 */
+const SUCCESS_BODY_MAX_CHARS = 4096;
+const PROBE_TIMEOUT_MS = 1e4;
+/** 读取响应体前若干字符：超大响应（如 HTML 错误页）不整体载入内存。 */
+async function readBodySnippet(resp, maxChars) {
+	if (Number(resp.headers.get("content-length") || 0) > MAX_ERROR_BODY_BYTES) return "";
+	const reader = resp.body?.getReader();
+	if (!reader) return "";
+	const decoder = new TextDecoder();
+	let text = "";
+	try {
+		while (text.length < maxChars) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			text += decoder.decode(value, { stream: true });
+		}
+		text += decoder.decode();
+	} finally {
+		await reader.cancel().catch(() => {});
+	}
+	return text.slice(0, maxChars);
+}
+/** 校验 200 响应体确实是该协议的成功应答（部分网关 200 但 body 是错误对象）。 */
+function validateSuccessBody(_api, text) {
+	if (!text.trim()) return "响应体为空";
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		return "响应体不是合法 JSON";
+	}
+	if (json?.error) return `响应体含错误：${(typeof json.error === "string" ? json.error : JSON.stringify(json.error)).slice(0, 200)}`;
+	if (!Array.isArray(json?.choices)) return "响应缺少 choices 字段";
+}
 /** 发起最小测试请求（max_tokens=1，超时 10s），返回结果对象。 */
 async function probeModel(row, apiKey) {
 	const url = row.baseURL.replace(/\/$/, "") + "/chat/completions";
 	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(), 1e4);
+	const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
 	const start = Date.now();
 	try {
 		const resp = await fetch(url, {
@@ -165,31 +225,40 @@ async function probeModel(row, apiKey) {
 			signal: controller.signal
 		});
 		const latency = Date.now() - start;
-		if (resp.ok) {
-			clearTimeout(timer);
-			return {
-				status: "ok",
-				latency
-			};
-		}
-		const text = await resp.text().catch(() => "");
-		clearTimeout(timer);
-		return {
+		const snippet = await readBodySnippet(resp, resp.ok ? SUCCESS_BODY_MAX_CHARS : 300).catch(() => "");
+		if (!resp.ok) return {
+			status: "fail",
+			latency,
+			error: `HTTP ${resp.status}: ${snippet.slice(0, 300)}`
+		};
+		const problem = validateSuccessBody(row.api, snippet);
+		return problem ? {
 			status: "fail",
 			latency,
-			error: `HTTP ${resp.status}: ${text.slice(0, 300)}`
+			error: problem
+		} : {
+			status: "ok",
+			latency
 		};
 	} catch (e) {
-		clearTimeout(timer);
 		return {
 			status: "fail",
 			latency: Date.now() - start,
-			error: e?.name === "AbortError" ? "超时（10s）" : e?.message || String(e)
+			error: e?.name === "AbortError" ? `超时（${PROBE_TIMEOUT_MS / 1e3}s）` : e?.message || String(e)
 		};
+	} finally {
+		clearTimeout(timer);
 	}
 }
 function createTestRouteHandler(resolveApiKey) {
 	return async function handler(req, res) {
+		if (!isLocalOrigin(req)) {
+			sendJson(res, 403, {
+				ok: false,
+				error: "拒绝非本地来源的请求"
+			});
+			return;
+		}
 		let key;
 		try {
 			key = (await readJsonBody(req)).key;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-health",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "DSH plugin that lists all configured models with availability/latency testing, by reading $DSH_HOME/settings.yaml.",
   "license": "MIT",
   "repository": {
@@ -33,7 +33,8 @@
   "scripts": {
     "build": "tsdown",
     "prepare": "pnpm run build",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "js-yaml": "^4.1.0"
@@ -49,6 +50,12 @@
     "@types/node": "^22.10.0",
     "@types/react": "^19.2.18",
     "tsdown": "^0.22.14",
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "vitest": "^3.2.4"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }