dsh-model 0.0.1 → 0.14.0

package/dist/commands/sources.js

@@ -0,0 +1,196 @@
+// commands/sources.ts — 来源开关与登录（CLI 版；dsh 插件页调同一套守护进程接口）
+//   dsh-model sources
+//   dsh-model source enable|disable|logout <来源> [--accept-risk]
+//   dsh-model stats
+import { createInterface } from 'node:readline';
+import { control } from '../daemon/client.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { bold, dim, green, info, isJsonMode, ok, printJson, red, table, warn, yellow } from '../util/output.js';
+import { canPrompt } from '../util/prompt.js';
+/** "2 小时 13 分后重置" */
+function untilText(iso) {
+    if (!iso)
+        return '';
+    const ms = Date.parse(iso) - Date.now();
+    if (!(ms > 0))
+        return L('即将重置', 'resetting');
+    const m = Math.round(ms / 60000);
+    const d = Math.floor(m / 1440);
+    const h = Math.floor((m % 1440) / 60);
+    const mm = m % 60;
+    const t = d ? L(`${d} 天 ${h} 小时`, `${d}d ${h}h`) : h ? L(`${h} 小时 ${mm} 分`, `${h}h ${mm}m`) : L(`${mm} 分`, `${mm}m`);
+    return L(`${t}后重置`, `resets in ${t}`);
+}
+function bar(pct) {
+    const n = Math.max(0, Math.min(10, Math.round(pct / 10)));
+    const s = '█'.repeat(n) + '░'.repeat(10 - n);
+    return pct >= 90 ? red(s) : pct >= 70 ? yellow(s) : green(s);
+}
+/** 每个来源的用量行（设计 §14.6） */
+export function usageLines(s) {
+    const u = s.usage;
+    if (!u)
+        return [];
+    if (u.noAccess)
+        return [yellow(L(`    当前账号没有可用订阅（调用会被拒绝、不扣费），模型已在 dsh 中隐藏${s.subscribeUrl ? `；开通：${s.subscribeUrl}` : ''}`, `    No usable subscription on this account (calls refused, no charge); its models are hidden in dsh${s.subscribeUrl ? `; subscribe: ${s.subscribeUrl}` : ''}`))];
+    if (u.unsupported)
+        return [dim(L('    已实测可以调用；用量暂不支持查询', '    tested OK; usage not available yet'))];
+    const out = [];
+    for (const w of u.windows) {
+        const pct = w.usedPercent;
+        const amount = w.used !== undefined && w.limit !== undefined ? `  ${w.used}/${w.limit}` : '';
+        out.push(`    ${w.label.padEnd(8)} ${pct !== undefined ? `${bar(pct)} ${Math.round(pct)}%` : ''}${amount}  ${dim(untilText(w.resetAt))}`);
+    }
+    if (u.credits) {
+        const c = u.credits;
+        out.push(`    ${L('积分', 'credits')}     ${c.unlimited ? L('不限量', 'unlimited') : L(`剩余 ${c.remaining.toLocaleString()}${c.total ? ` / ${c.total.toLocaleString()}` : ''}`, `${c.remaining.toLocaleString()} left${c.total ? ` of ${c.total.toLocaleString()}` : ''}`)}`);
+    }
+    if (u.plan)
+        out.unshift(dim(`    ${L('套餐', 'plan')}：${u.plan}`));
+    if (u.error)
+        out.push(yellow(L(`    用量暂不可用：${u.error}`, `    usage unavailable: ${u.error}`)));
+    return out;
+}
+export function pricingTag(s) {
+    const t = s.pricing?.tier;
+    return t === 'free' ? green(L('免费', 'free')) : t === 'limited' ? yellow(L('免费·额度少', 'free·limited')) : t === 'paid' ? red(L('需付费', 'paid')) : '-';
+}
+export async function sources(ctx, opts = {}) {
+    // 高风险来源（Claude、Antigravity）默认不列出；已登录的照常显示，方便退出登录
+    const list = (await control(ctx, 'GET', '/sources?refresh=1')).filter((s) => opts.all || !s.risky || s.loggedIn);
+    if (isJsonMode()) {
+        printJson(list);
+        return 0;
+    }
+    info(table([
+        [L('开关', 'On'), L('来源', 'Source'), L('费用', 'Cost'), L('状态', 'State'), L('账号', 'Account'), L('模型', 'Models')],
+        ...list.map((s) => [
+            s.enabled ? green('●') : dim('○'),
+            s.id,
+            pricingTag(s),
+            s.loggedIn ? (s.usage?.noAccess ? yellow(L('已登录·无订阅', 'signed in · no plan')) : s.enabled ? green(L('已接入', 'connected')) : yellow(L('已登录·关闭', 'signed in · off'))) : dim(L('未登录', 'signed out')),
+            s.account ?? (s.detail ? dim(s.detail.slice(0, 40)) : '-'),
+            s.models ? String(s.models) : '-',
+        ]),
+    ]));
+    const unpaid = list.filter((s) => !s.loggedIn && s.pricing);
+    if (unpaid.length) {
+        info(bold(L('\n费用说明', '\nCost')));
+        for (const s of unpaid)
+            info(`  ${s.id.padEnd(13)}${L(s.pricing.zh, s.pricing.en)}${s.subscribeUrl ? dim(`  ${s.subscribeUrl}`) : ''}`);
+    }
+    const withUsage = list.filter((s) => s.usage);
+    if (withUsage.length) {
+        info(bold(L('\n订阅用量', '\nSubscription usage')));
+        for (const s of withUsage) {
+            info(`  ${s.label}${s.account ? dim(`  ${s.account}`) : ''}`);
+            for (const line of usageLines(s))
+                info(line);
+        }
+    }
+    info(dim(L('\n打开：dsh-model source enable <来源>   关闭：dsh-model source disable <来源>   高风险来源（Claude、Antigravity）：dsh-model sources --all', '\nTurn on: dsh-model source enable <source>   off: dsh-model source disable <source>   High-risk sources (Claude, Antigravity): dsh-model sources --all')));
+    return 0;
+}
+export async function source(ctx, sub, id, opts) {
+    if (!sub || !id || !['enable', 'disable', 'logout', 'on', 'off'].includes(sub)) {
+        throw new DshModelError('usage', L('用法：dsh-model source enable|disable|logout <来源>', 'Usage: dsh-model source enable|disable|logout <source>'));
+    }
+    if (sub === 'disable' || sub === 'off') {
+        await control(ctx, 'POST', `/sources/${id}/disable`);
+        ok(L(`${id} 已关闭（登录保留）`, `${id} turned off (sign-in kept)`));
+        return 0;
+    }
+    if (sub === 'logout') {
+        await control(ctx, 'POST', `/sources/${id}/logout`);
+        ok(L(`${id} 已退出登录`, `${id} signed out`));
+        return 0;
+    }
+    return enableInteractive(ctx, id, opts);
+}
+/** 打开一个来源；需要登录就在终端里完成（打印链接 / 码，回调式等你贴回地址） */
+export async function enableInteractive(ctx, id, opts = {}) {
+    const r = await control(ctx, 'POST', `/sources/${id}/enable`, { acceptRisk: Boolean(opts.acceptRisk) });
+    if (r.riskNotice) {
+        info(r.riskNotice);
+        return 2;
+    }
+    if (r.enabled) {
+        ok(L(`${id} 已接入`, `${id} connected`));
+        return 0;
+    }
+    if (!r.login)
+        throw new DshModelError('enable_failed', L(`${id} 没能打开`, `Could not turn on ${id}`));
+    return runLogin(ctx, id, r.login);
+}
+async function runLogin(ctx, id, s) {
+    info('');
+    info(bold(L('在任意设备的浏览器里打开下面的链接并授权：', 'Open this link in a browser on any device and approve:')));
+    info(`\n  ${s.url}\n`);
+    if (s.userCode)
+        info(L(`  授权页要求输入的码：${bold(s.userCode)}\n`, `  Code to enter on that page: ${bold(s.userCode)}\n`));
+    let rl;
+    if (s.needsPaste) {
+        info(L('授权后浏览器会跳到一个打不开的 localhost 地址——把地址栏里的完整地址粘贴到这里，回车。', 'After approving, the browser lands on a localhost address that will not load — paste that full address here and press Enter.'));
+        if (canPrompt()) {
+            rl = createInterface({ input: process.stdin, output: process.stdout });
+            rl.question(L('跳转地址：', 'Redirected address: '), (answer) => {
+                const url = answer.trim();
+                if (url) {
+                    void control(ctx, 'POST', `/login/${s.id}/callback`, { redirectUrl: url }).catch((e) => warn(String(e.message)));
+                }
+            });
+        }
+    }
+    else {
+        info(L('等待授权中（Ctrl+C 取消）…', 'Waiting for approval (Ctrl+C to cancel)…'));
+    }
+    try {
+        for (;;) {
+            await new Promise((r) => setTimeout(r, 2000));
+            const st = await control(ctx, 'GET', `/login/${s.id}`);
+            if (st.status === 'ok') {
+                ok(L(`${id} 已登录并接入`, `${id} signed in and connected`));
+                return 0;
+            }
+            if (st.status === 'error' || st.status === 'cancelled') {
+                warn(L(`登录没有完成：${st.error ?? st.status}`, `Login did not complete: ${st.error ?? st.status}`));
+                return 1;
+            }
+        }
+    }
+    finally {
+        rl?.close();
+    }
+}
+const pct = (w) => (w.successRate == null ? '-' : `${Math.round(w.successRate * 100)}%`);
+const ms = (w) => (w.avgLatencyMs == null ? '-' : w.avgLatencyMs >= 1000 ? `${(w.avgLatencyMs / 1000).toFixed(1)}s` : `${w.avgLatencyMs}ms`);
+const tps = (w) => (w.tokensPerSec == null ? '-' : `${w.tokensPerSec}`);
+const rate = (w) => {
+    const p = w.successRate;
+    const s = pct(w);
+    return p == null ? s : p >= 0.98 ? green(s) : p >= 0.9 ? yellow(s) : red(s);
+};
+export async function stats(ctx) {
+    const snap = await control(ctx, 'GET', '/stats');
+    if (isJsonMode()) {
+        printJson(snap);
+        return 0;
+    }
+    const rows = (title, m) => {
+        const entries = Object.entries(m).sort((a, b) => b[1].d1.requests - a[1].d1.requests);
+        if (!entries.length)
+            return;
+        info(bold(`\n${title}`));
+        info(table([
+            ['', L('请求(1h/24h)', 'Req (1h/24h)'), L('成功率', 'Success'), L('平均延迟', 'Avg latency'), 'tokens/s', L('最近失败', 'Last failure')],
+            ...entries.map(([k, v]) => [k, `${v.h1.requests}/${v.d1.requests}`, rate(v.d1), ms(v.d1), tps(v.d1), v.d1.lastFailureAt ? v.d1.lastFailureAt.slice(5, 16).replace('T', ' ') : '-']),
+        ]));
+    };
+    rows(L('按 key', 'By key'), snap.byKey);
+    rows(L('按来源', 'By source'), snap.bySource);
+    rows(L('按模型', 'By model'), snap.byModel);
+    if (!Object.keys(snap.byKey).length)
+        info(dim(L('还没有请求记录', 'No requests recorded yet')));
+    return 0;
+}

package/dist/commands/status.js

@@ -0,0 +1,216 @@
+// commands/status.ts — status（一屏总览）与 doctor（逐项检查，--e2e 实测每个模型）
+import { join } from 'node:path';
+import { availableVariants, bridgeConfigPath, loadBridgeConfig, loadCatalogs } from '../bridge/runtime.js';
+import { anyProviderPresent } from '../dsh/connect.js';
+import { KEY_REF, readRef } from '../dsh/credentials.js';
+import { listAuthFiles, summarize } from '../engine/auth.js';
+import { healthy, listModels, probeStream, probeToolCall, unauthStatus } from '../engine/client.js';
+import { currentBinary, currentVersion } from '../engine/install.js';
+import { L } from '../i18n.js';
+import { opencodeConfigured } from '../integrations/opencode.js';
+import { bridgeHealthy, userPluginInstalled } from '../integrations/workbuddy.js';
+import { findActive, DSH_KEY_NAME } from '../keys.js';
+import { loadAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { UPSTREAMS } from '../upstreams.js';
+import { exists, fileMode, readText, sha256 } from '../util/fs.js';
+import { dim, green, info, isJsonMode, printJson, red, table, yellow } from '../util/output.js';
+import { proxyReachable, redactProxy } from '../util/proxy.js';
+/** 模型 id 的分组：opencode/… workbuddy/… 其余算订阅 */
+function groupCounts(models) {
+    const g = new Map();
+    for (const m of models) {
+        const k = m.id.includes('/') ? m.id.split('/')[0] : 'subscription';
+        g.set(k, (g.get(k) ?? 0) + 1);
+    }
+    return g;
+}
+export async function status(ctx) {
+    const all = await loadAll(ctx);
+    const key = findActive(all.keys, DSH_KEY_NAME)?.key;
+    const engineInstalled = await exists(currentBinary(ctx));
+    const version = engineInstalled ? await currentVersion(ctx) : null;
+    const svc = engineInstalled && !ctx.serviceDisabled ? await serviceFor(ctx).status() : null;
+    const up = engineInstalled ? await healthy(all.config.port) : false;
+    const models = up && key ? await listModels(all.config.port, key).catch(() => []) : [];
+    const groups = groupCounts(models);
+    const { byUpstream } = summarize(await listAuthFiles(ctx));
+    const dshOk = await anyProviderPresent(all.state).catch(() => false);
+    const oc = await opencodeConfigured(ctx);
+    const bridgeCfg = await loadBridgeConfig(ctx.paths.home);
+    const bridgeUp = bridgeCfg ? await bridgeHealthy(bridgeCfg.port, bridgeCfg.secret) : false;
+    const cats = await loadCatalogs(ctx.paths.home);
+    const apps = await availableVariants(ctx.paths.home);
+    const logged = UPSTREAMS.filter((u) => byUpstream[u.id]?.length).map((u) => u.id);
+    const data = {
+        mode: ctx.mode,
+        home: ctx.paths.home,
+        endpoint: { version, running: up, port: all.config.port, service: svc, models: Object.fromEntries(groups) },
+        opencode: { configured: oc, models: groups.get('opencode') ?? 0 },
+        workbuddy: { apps: apps.map((v) => v.displayName), bridge: bridgeCfg ? { port: bridgeCfg.port, running: bridgeUp } : null, catalogs: cats.map((c) => ({ label: c.label, signedIn: c.signedIn, models: c.models.length, error: c.error })) },
+        subscriptions: logged,
+        dsh: all.state.dsh ? { profile: all.state.dsh.profile, providerPresent: dshOk } : null,
+        remote: all.config.remote.mode,
+        proxy: all.config.proxy ? redactProxy(all.config.proxy) : null,
+        keys: all.keys.keys.filter((k) => !k.revokedAt).map((k) => k.name),
+    };
+    if (isJsonMode()) {
+        printJson(data);
+        return 0;
+    }
+    const yes = (b, t, f) => (b ? green(t) : red(f));
+    const wbLine = !apps.length
+        ? dim(L('未登录（dsh-model workbuddy login）', 'not signed in (dsh-model workbuddy login)'))
+        : !bridgeCfg
+            ? yellow(L('未启用（dsh-model workbuddy enable）', 'not enabled (dsh-model workbuddy enable)'))
+            : !bridgeUp
+                ? red(L(`bridge 没在运行（127.0.0.1:${bridgeCfg.port}，dsh-model repair）`, `bridge not running (127.0.0.1:${bridgeCfg.port}, dsh-model repair)`))
+                : cats.map((c) => (c.signedIn ? green(`${c.label} ${c.models.length}`) : yellow(L(`${c.label} 未登录`, `${c.label} signed out`)))).join(' · ') || yellow(L('目录还没读到', 'catalog not read yet'));
+    info(table([
+        [L('统一端点', 'Endpoint'), engineInstalled ? yes(up, `127.0.0.1:${all.config.port}`, L('未运行（dsh-model repair）', 'not running (dsh-model repair)')) + dim(`  v${version ?? '-'}${svc ? ` · ${svc.detail ?? '-'}` : ''}`) : red(L('未安装（dsh-model setup）', 'not installed (dsh-model setup)'))],
+        [L('模型', 'Models'), models.length ? [...groups].map(([g, n]) => `${g === 'subscription' ? L('订阅', 'subscription') : g} ${n}`).join(' · ') : yellow('0')],
+        ['OpenCode Zen', oc ? green(L(`已配置 · ${groups.get('opencode') ?? 0} 个模型`, `configured · ${groups.get('opencode') ?? 0} models`)) : yellow(L('未配置（dsh-model opencode key）', 'not configured (dsh-model opencode key)'))],
+        ['WorkBuddy', wbLine],
+        [L('订阅', 'Subscriptions'), logged.length ? logged.join(', ') : dim(L('无（dsh-model login <上游>）', 'none (dsh-model login <upstream>)'))],
+        ['dsh', data.dsh ? yes(dshOk, `${data.dsh.profile} ✓`, L(`${data.dsh.profile}：provider 不在了（dsh-model repair）`, `${data.dsh.profile}: provider missing (dsh-model repair)`)) : yellow(L('未接入', 'not connected'))],
+        [L('远程访问', 'Remote'), all.config.remote.mode],
+        [L('出站代理', 'Proxy'), data.proxy ?? L('不使用', 'none')],
+        ['Keys', data.keys.join(', ') || '-'],
+    ]));
+    return 0;
+}
+export async function doctor(ctx, opts) {
+    const all = await loadAll(ctx);
+    const checks = [];
+    const add = (id, level, message) => checks.push({ id, level, message });
+    const key = findActive(all.keys, DSH_KEY_NAME)?.key;
+    const homeMode = await fileMode(ctx.paths.home);
+    if (homeMode == null)
+        add('home', 'fail', L(`${ctx.paths.home} 不存在（先 setup）`, `${ctx.paths.home} missing (run setup)`));
+    else
+        add('home', homeMode & 0o077 ? 'warn' : 'ok', L(`home 权限 ${homeMode.toString(8)}`, `home mode ${homeMode.toString(8)}`));
+    for (const [id, file] of [['keys', ctx.paths.keys], ['engine-yaml', ctx.paths.engineYaml], ['secrets', join(ctx.paths.home, 'secrets.json')], ['bridge-config', bridgeConfigPath(ctx.paths.home)]]) {
+        const m = await fileMode(file);
+        if (m != null)
+            add(id, m & 0o077 ? 'warn' : 'ok', `${file.split('/').pop()} ${m.toString(8)}`);
+    }
+    const authFiles = await listAuthFiles(ctx);
+    const loose = [];
+    for (const f of authFiles)
+        if (((await fileMode(join(ctx.paths.auth, f))) ?? 0) & 0o077)
+            loose.push(f);
+    if (authFiles.length)
+        add('auth-perms', loose.length ? 'warn' : 'ok', loose.length ? L(`凭据文件权限过宽：${loose.join(', ')}`, `Credential files too permissive: ${loose.join(', ')}`) : L(`订阅凭据 ${authFiles.length} 个，权限正常`, `${authFiles.length} subscription credentials, permissions OK`));
+    const { byUpstream, other } = summarize(authFiles);
+    const multi = Object.entries(byUpstream).filter(([, f]) => f.length > 1);
+    if (multi.length)
+        add('single-account', 'warn', L(`同一上游有多个账号：${multi.map(([u]) => u).join(', ')}`, `Multiple accounts for: ${multi.map(([u]) => u).join(', ')}`));
+    if (other.length)
+        add('unknown-auth', 'warn', L(`不认识的凭据文件：${other.join(', ')}`, `Unrecognized credential files: ${other.join(', ')}`));
+    // —— 统一端点 ——
+    const engineInstalled = await exists(currentBinary(ctx));
+    const version = engineInstalled ? await currentVersion(ctx) : null;
+    add('engine', engineInstalled ? (version === all.config.engine.version ? 'ok' : 'warn') : 'fail', engineInstalled ? `v${version}` : L('未安装（dsh-model setup）', 'not installed (dsh-model setup)'));
+    if (engineInstalled && !ctx.serviceDisabled) {
+        const s = await serviceFor(ctx).status();
+        add('engine-service', s.running ? 'ok' : 'fail', `${serviceFor(ctx).kind}: ${s.detail ?? '-'}`);
+    }
+    if (all.config.proxy) {
+        const reach = await proxyReachable(all.config.proxy);
+        add('proxy', reach ? 'ok' : 'fail', reach ? L(`代理 ${redactProxy(all.config.proxy)} 可连接`, `Proxy ${redactProxy(all.config.proxy)} reachable`) : L(`代理 ${redactProxy(all.config.proxy)} 连不上（代理软件没开？dsh-model setup --proxy <地址>|none）`, `Proxy ${redactProxy(all.config.proxy)} unreachable (proxy app not running? dsh-model setup --proxy <url>|none)`));
+    }
+    const up = engineInstalled ? await healthy(all.config.port) : false;
+    if (engineInstalled)
+        add('healthz', up ? 'ok' : 'fail', `127.0.0.1:${all.config.port}`);
+    if (up) {
+        const code = await unauthStatus(all.config.port);
+        add('auth-enforced', code === 401 ? 'ok' : 'fail', L(`不带 key 请求返回 ${code}`, `unauthenticated request → ${code}`));
+    }
+    let models = [];
+    if (up && key) {
+        try {
+            models = await listModels(all.config.port, key);
+            const g = groupCounts(models);
+            add('models', models.length ? 'ok' : 'warn', models.length ? [...g].map(([k, n]) => `${k} ${n}`).join(' · ') : L('0 个模型', '0 models'));
+        }
+        catch (error) {
+            add('models', 'fail', String(error.message));
+        }
+    }
+    // —— OpenCode / WorkBuddy ——
+    const oc = await opencodeConfigured(ctx);
+    const ocModels = models.filter((m) => m.id.startsWith('opencode/')).length;
+    add('opencode', !oc ? 'warn' : up && !ocModels ? 'fail' : 'ok', !oc ? L('OpenCode Zen 未配置（dsh-model opencode key）', 'OpenCode Zen not configured (dsh-model opencode key)') : up && !ocModels ? L('已配置但引擎里没有 opencode/ 模型（dsh-model repair）', 'configured but no opencode/ models in the engine (dsh-model repair)') : L(`OpenCode Zen：${ocModels} 个模型`, `OpenCode Zen: ${ocModels} models`));
+    const apps = await availableVariants(ctx.paths.home);
+    const bridgeCfg = await loadBridgeConfig(ctx.paths.home);
+    // 守护进程（来源开关、登录、统计、WorkBuddy 转发）总要在跑；只有刻意跳过系统服务时不查
+    if (!ctx.serviceDisabled) {
+        if (!bridgeCfg)
+            add('daemon', 'fail', L('守护进程没配置（dsh-model setup）', 'Daemon not configured (dsh-model setup)'));
+        else {
+            const bUp = await bridgeHealthy(bridgeCfg.port, bridgeCfg.secret);
+            add('daemon', bUp ? 'ok' : 'fail', bUp ? L(`守护进程 127.0.0.1:${bridgeCfg.port} 运行中`, `daemon 127.0.0.1:${bridgeCfg.port} running`) : L('守护进程没在运行（dsh-model logs --bridge；dsh-model repair）', 'daemon not running (dsh-model logs --bridge; dsh-model repair)'));
+        }
+    }
+    if (apps.length && bridgeCfg) {
+        {
+            for (const c of await loadCatalogs(ctx.paths.home)) {
+                const inEngine = models.filter((m) => m.id.startsWith(`${c.prefix}/`)).length;
+                if (!c.signedIn)
+                    add(`workbuddy-${c.key}`, 'warn', L(`${c.label}：未登录${c.error ? `（${c.error}）` : ''}——在 App 里登录后执行 dsh-model workbuddy refresh`, `${c.label}: signed out${c.error ? ` (${c.error})` : ''} — sign in to the app, then dsh-model workbuddy refresh`));
+                else
+                    add(`workbuddy-${c.key}`, up && !inEngine ? 'fail' : 'ok', L(`${c.label}：已登录，${c.models.length} 个模型${up ? `（引擎里 ${inEngine} 个）` : ''}${c.error ? `；${c.error}` : ''}`, `${c.label}: signed in, ${c.models.length} models${up ? ` (${inEngine} in engine)` : ''}${c.error ? `; ${c.error}` : ''}`));
+            }
+        }
+        if (await userPluginInstalled(ctx, all))
+            add('workbuddy-plugin', 'warn', L('同时装了 dsh-workbuddy-connect 插件：dsh 里会有两组 WorkBuddy 模型', 'dsh-workbuddy-connect is also installed: dsh shows two WorkBuddy groups'));
+    }
+    // —— dsh 接线 ——
+    if (all.state.dsh) {
+        const d = all.state.dsh;
+        const present = await anyProviderPresent(all.state).catch(() => false);
+        add('dsh-provider', present ? 'ok' : models.length ? 'fail' : 'warn', present ? L(`dsh（${d.profile}）里有 dsh-model`, `dsh-model present in dsh (${d.profile})`) : models.length ? L('dsh 里没有 dsh-model（dsh-model repair）', 'dsh-model missing in dsh (dsh-model repair)') : L('dsh 里还没有 dsh-model：引擎里还没有模型', 'dsh-model not in dsh yet: the engine has no models'));
+        const credText = await readText(d.credFile);
+        add('dsh-key', readRef(credText) === key ? 'ok' : 'fail', readRef(credText) === key ? L(`${KEY_REF} 与 key 一致`, `${KEY_REF} matches`) : L(`${KEY_REF} 与 key 不一致（dsh-model repair）`, `${KEY_REF} does not match (dsh-model repair)`));
+        const cm = await fileMode(d.credFile);
+        if (cm != null)
+            add('dsh-cred-perms', cm === 0o600 ? 'ok' : 'fail', L(`.credentials.yaml 权限 ${cm.toString(8)}（dsh 要求 600）`, `.credentials.yaml mode ${cm.toString(8)} (dsh requires 600)`));
+        const patchText = await readText(d.patchFile);
+        if (patchText != null && d.writtenPatchSha && sha256(patchText) !== d.writtenPatchSha) {
+            add('dsh-patch-edited', 'ok', L('cordis.patch.yml 在接线后被修改过（卸载时只会移除 dsh-model 的部分）', 'cordis.patch.yml edited since connect (uninstall will remove only dsh-model parts)'));
+        }
+    }
+    else {
+        add('dsh-provider', 'warn', L('还没接入 dsh（dsh-model setup）', 'Not connected to dsh (dsh-model setup)'));
+    }
+    if (ctx.env[KEY_REF])
+        add('env-override', 'warn', L(`环境变量 ${KEY_REF} 会覆盖 dsh 凭据里的值`, `Env var ${KEY_REF} overrides the value in dsh credentials`));
+    if ((await exists('/etc/caddy/dsh-model.conf')) && all.config.remote.mode !== 'caddy')
+        add('caddy-orphan', 'warn', L('发现残留的 /etc/caddy/dsh-model.conf', 'Found leftover /etc/caddy/dsh-model.conf'));
+    // —— e2e：默认每组（订阅按 owned_by，opencode/workbuddy 按前缀）取一个模型 ——
+    const e2e = [];
+    if (opts.e2e && key && models.length) {
+        const groupOf = (m) => (m.id.includes('/') ? m.id.split('/')[0] : (m.owned_by ?? m.id));
+        const pick = opts.model ? models.filter((m) => m.id === opts.model) : opts.all ? models : [...new Map(models.map((m) => [groupOf(m), m])).values()];
+        for (const m of pick) {
+            const s = await probeStream(all.config.port, key, m.id);
+            const t = await probeToolCall(all.config.port, key, m.id);
+            e2e.push({ model: m.id, stream: s.detail, tool: t.detail, ok: s.ok && t.ok });
+        }
+    }
+    const failed = checks.some((c) => c.level === 'fail') || e2e.some((r) => !r.ok);
+    if (isJsonMode()) {
+        printJson({ ok: !failed, checks, e2e });
+        return failed ? 1 : 0;
+    }
+    const mark = (l) => (l === 'ok' ? green('✓') : l === 'warn' ? yellow('!') : red('✗'));
+    info(table(checks.map((c) => [mark(c.level), c.id, c.message])));
+    if (e2e.length) {
+        info('');
+        info(table([[L('模型', 'Model'), L('流式', 'Stream'), L('工具调用', 'Tool call')], ...e2e.map((r) => [`${r.ok ? green('✓') : red('✗')} ${r.model}`, r.stream, r.tool])]));
+    }
+    else if (opts.e2e) {
+        info(yellow(L('没有可测的模型', 'No models to test')));
+    }
+    return failed ? 1 : 0;
+}

package/dist/commands/uninstall.js

@@ -0,0 +1,97 @@
+// commands/uninstall.ts — 按台账逆序拆除：remote → dsh 接线 → 服务 → home。每步失败不中断，最后汇总
+import { cp, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { requireRootInVps } from '../context.js';
+import { disconnectDsh } from '../dsh/connect.js';
+import { listAuthFiles } from '../engine/auth.js';
+import { L } from '../i18n.js';
+import { loadAll, saveAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { exists, timestamp } from '../util/fs.js';
+import { fail, info, ok, warn } from '../util/output.js';
+import { disable as disableRemote } from './remote.js';
+import { disableWorkbuddy, removeWorkbuddyPlugin } from '../integrations/workbuddy.js';
+import { removeDshPlugin } from '../integrations/dshplugin.js';
+async function confirm(question) {
+    if (!process.stdin.isTTY)
+        return false;
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return /^(y|yes|是)$/i.test((await rl.question(`${question} [y/N] `)).trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function uninstall(ctx, opts) {
+    requireRootInVps(ctx);
+    if (!(await exists(ctx.paths.home))) {
+        info(L('没有安装过 dsh-model（或已卸载）', 'dsh-model is not installed (or already removed)'));
+        return 0;
+    }
+    const all = await loadAll(ctx);
+    const authCount = (await listAuthFiles(ctx)).length;
+    if (!opts.yes) {
+        info(L('将要：关闭远程访问 → 移除 WorkBuddy bridge → 还原 dsh 配置 → 移除引擎服务 → 删除 ' + ctx.paths.home + '（含 OpenCode key 与 WorkBuddy 令牌副本）', 'This will: disable remote access → remove the WorkBuddy bridge → restore dsh config → remove the engine service → delete ' + ctx.paths.home + ' (incl. the OpenCode key and WorkBuddy token copies)'));
+        if (authCount && !opts.keepAuth)
+            info(L(`其中包括 ${authCount} 个上游登录凭据（加 --keep-auth 可先备份出来）`, `including ${authCount} upstream login credentials (add --keep-auth to back them up first)`));
+        if (!(await confirm(L('确认卸载？', 'Proceed with uninstall?')))) {
+            info(L('已取消', 'Cancelled'));
+            return 1;
+        }
+    }
+    const errors = [];
+    const step = async (name, fn) => {
+        try {
+            await fn();
+        }
+        catch (error) {
+            errors.push(`${name}: ${error.message}`);
+            fail(`${name}: ${error.message}`);
+        }
+    };
+    await step('remote', async () => {
+        if (all.state.remote && all.state.remote.mode !== 'off')
+            await disableRemote(ctx, all);
+    });
+    await step('dsh-plugin', async () => {
+        if (await removeDshPlugin(ctx, all))
+            ok(L('已从 dsh 移除 dsh-model 插件', 'Removed the dsh-model plugin from dsh'));
+    });
+    await step('workbuddy', async () => {
+        if (await removeWorkbuddyPlugin(ctx, all))
+            ok(L('已移除上一版安装的 WorkBuddy 插件', 'Removed the WorkBuddy plugin installed by a previous version'));
+        if (await disableWorkbuddy(ctx, all))
+            ok(L('WorkBuddy bridge 服务已移除', 'WorkBuddy bridge service removed'));
+    });
+    await step('dsh', async () => {
+        if (!all.state.dsh)
+            return;
+        const r = await disconnectDsh(ctx, all.state);
+        ok(L(`dsh 配置已还原（patch：${r.patch}，凭据：${r.cred}）`, `dsh config restored (patch: ${r.patch}, credentials: ${r.cred})`));
+    });
+    await saveAll(ctx, all).catch(() => { });
+    await step('service', async () => {
+        if (ctx.serviceDisabled)
+            return;
+        await serviceFor(ctx).uninstall();
+        ok(L('系统服务已移除', 'Service removed'));
+    });
+    await step('auth-backup', async () => {
+        if (!opts.keepAuth || !authCount)
+            return;
+        const dest = join(homedir(), `dsh-model-auth-backup-${timestamp()}`);
+        await cp(ctx.paths.auth, dest, { recursive: true, filter: (src) => !src.includes('/logs') });
+        ok(L(`登录凭据已备份到 ${dest}`, `Credentials backed up to ${dest}`));
+    });
+    if (errors.length) {
+        warn(L(`有 ${errors.length} 步失败，保留了 ${ctx.paths.home} 以便重试（再次执行 uninstall）`, `${errors.length} step(s) failed; kept ${ctx.paths.home} so you can retry (run uninstall again)`));
+        return 1;
+    }
+    await rm(ctx.paths.home, { recursive: true, force: true });
+    ok(L(`已删除 ${ctx.paths.home}，卸载完成`, `Deleted ${ctx.paths.home}; uninstall complete`));
+    info(L('最后可执行：npm uninstall -g dsh-model', 'Finally you can run: npm uninstall -g dsh-model'));
+    return 0;
+}

package/dist/commands/workbuddy.js

@@ -0,0 +1,117 @@
+// commands/workbuddy.ts — dsh-model workbuddy [status|login|logout|enable|refresh|disable]
+import { requireRootInVps } from '../context.js';
+import { availableVariants, loadCatalogs } from '../bridge/runtime.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { disableWorkbuddy, enableWorkbuddy, refreshBridge, riskNotice } from '../integrations/workbuddy.js';
+import { workbuddyLogin, workbuddyLogout } from '../bridge/login.js';
+import { WORKBUDDY_VARIANTS } from '../bridge/workbuddy/variants.js';
+import { bold } from '../util/output.js';
+import { loadAll, saveAll, syncAll } from '../ops.js';
+import { withLock } from '../state.js';
+import { info, isJsonMode, ok, printJson, skip, warn } from '../util/output.js';
+/** cn / ai（也认 workbuddy / workbuddy-ai），默认国内版 */
+function pickVariant(arg) {
+    const a = (arg ?? 'cn').toLowerCase();
+    const id = a === 'ai' || a === 'workbuddy-ai' || a === 'global' ? 'workbuddy-ai' : a === 'cn' || a === 'workbuddy' ? 'workbuddy' : '';
+    const v = WORKBUDDY_VARIANTS.find((x) => x.id === id);
+    if (!v)
+        throw new DshModelError('unknown_workbuddy_product', L(`不认识的产品：${arg}（cn 或 ai）`, `Unknown product: ${arg} (cn or ai)`));
+    return v;
+}
+export async function workbuddy(ctx, sub, arg) {
+    if (sub === 'login')
+        return login(ctx, pickVariant(arg));
+    if (sub === 'logout')
+        return logout(ctx, pickVariant(arg));
+    if (!sub || sub === 'status') {
+        const [apps, cats] = await Promise.all([availableVariants(ctx.paths.home), loadCatalogs(ctx.paths.home)]);
+        if (isJsonMode()) {
+            printJson({ apps: apps.map((v) => v.displayName), catalogs: cats.map(({ models, ...c }) => ({ ...c, models: models.length })) });
+            return 0;
+        }
+        info(L(`App：${apps.length ? apps.map((v) => v.displayName).join('、') : '未检测到'}`, `App: ${apps.length ? apps.map((v) => v.displayName).join(', ') : 'not found'}`));
+        for (const c of cats) {
+            info(`  ${c.label}: ${c.signedIn ? L(`已登录${c.nickname ? `（${c.nickname}）` : ''}，${c.models.length} 个模型`, `signed in${c.nickname ? ` (${c.nickname})` : ''}, ${c.models.length} models`) : L('未登录', 'not signed in')}${c.error ? `  — ${c.error}` : ''}`);
+        }
+        return 0;
+    }
+    requireRootInVps(ctx);
+    if (sub === 'refresh') {
+        if (await refreshBridge(ctx))
+            ok(L('bridge 已重读 WorkBuddy 登录态与目录，并同步到引擎和 dsh', 'bridge re-read WorkBuddy sign-in and catalog and synced the engine and dsh'));
+        else
+            warn(L('bridge 没在运行（dsh-model workbuddy enable）', 'bridge is not running (dsh-model workbuddy enable)'));
+        return 0;
+    }
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (sub === 'enable') {
+            await enableWorkbuddy(ctx, all);
+            await saveAll(ctx, all);
+            await syncAll(ctx, all);
+            return 0;
+        }
+        if (sub === 'disable') {
+            if (!(await disableWorkbuddy(ctx, all))) {
+                skip(L('WorkBuddy 本来就没启用', 'WorkBuddy was not enabled'));
+                return 0;
+            }
+            delete all.config.bridge;
+            await saveAll(ctx, all);
+            // bridge 不在了，目录文件也作废：删掉后重新生成引擎配置
+            const { rm } = await import('node:fs/promises');
+            const { bridgeDir, bridgeConfigPath } = await import('../bridge/runtime.js');
+            await rm(bridgeDir(ctx.paths.home), { recursive: true, force: true });
+            await rm(bridgeConfigPath(ctx.paths.home), { force: true });
+            await syncAll(ctx, all, { quiet: true });
+            ok(L('已停用 WorkBuddy（bridge 服务、目录与登录副本已移除）', 'WorkBuddy disabled (bridge service, catalogs and token copies removed)'));
+            return 0;
+        }
+        throw new DshModelError('unknown_command', L(`未知子命令：workbuddy ${sub}`, `Unknown subcommand: workbuddy ${sub}`));
+    });
+}
+/**
+ * 登录：轮询期间不持锁（最长 10 分钟），拿到令牌后再持锁启用 / 重启 bridge 并同步。
+ */
+async function login(ctx, variant) {
+    requireRootInVps(ctx);
+    const all = await loadAll(ctx);
+    if (!all.config.bridge?.riskNoticeAt)
+        warn(riskNotice());
+    info(L(`正在向 ${variant.displayName} 申请授权链接…`, `Requesting an authorization link from ${variant.displayName}…`));
+    const credential = await workbuddyLogin(variant, ctx.paths.home, {
+        proxy: all.config.proxy,
+        owner: ctx.owner,
+        onUrl: (url) => {
+            info('');
+            info(bold(L('在任意设备的浏览器里打开下面的链接并授权（服务器上不需要浏览器）：', 'Open this link in a browser on any device and approve (no browser needed on the server):')));
+            info(`\n  ${url}\n`);
+            info(L('等待授权中（最长 10 分钟，Ctrl+C 取消）…', 'Waiting for approval (up to 10 minutes, Ctrl+C to cancel)…'));
+        },
+    });
+    ok(L(`${variant.displayName} 已登录${credential.nickname ? `（${credential.nickname}）` : ''}；令牌只存在 dsh-model 自己的目录（0600）`, `${variant.displayName} signed in${credential.nickname ? ` (${credential.nickname})` : ''}; the token is kept only in dsh-model's own directory (0600)`));
+    return withLock(ctx, async () => {
+        const fresh = await loadAll(ctx);
+        await enableWorkbuddy(ctx, fresh);
+        await saveAll(ctx, fresh);
+        await syncAll(ctx, fresh);
+        return 0;
+    });
+}
+async function logout(ctx, variant) {
+    requireRootInVps(ctx);
+    if (!(await workbuddyLogout(variant, ctx.paths.home))) {
+        skip(L(`${variant.displayName} 没有用 dsh-model 登录过（桌面 App 的登录请在 App 里退出）`, `${variant.displayName} was not signed in through dsh-model (sign out of the desktop app in the app itself)`));
+        return 0;
+    }
+    ok(L(`已删除 dsh-model 保存的 ${variant.displayName} 令牌`, `Deleted the ${variant.displayName} token saved by dsh-model`));
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (all.state.bridgeService)
+            await enableWorkbuddy(ctx, all); // 重启 bridge，让它不再服务这个产品
+        await saveAll(ctx, all);
+        await syncAll(ctx, all, { quiet: true });
+        return 0;
+    });
+}