dsh-model 0.0.1 → 0.14.0

package/dist/integrations/opencode.js

@@ -0,0 +1,101 @@
+// integrations/opencode.ts — OpenCode Zen 作为引擎的 openai-compatibility 上游（统一端点，设计 §1.3）
+//
+// key 存在 dsh-model 自己的 secrets.json（0600），由引擎持有；模型目录取自公开的 /zen/v1/models。
+// OpenCode 的免费档不能免 key 从第三方调用（官方 403 FreeTierError），所以必须有 key。
+// v0.2.0 曾把 key 写进 dsh 的凭据库并启用 dsh 内置 opencode 路由：migrateDshOpencode 负责迁走。
+import { applyDsh } from '../dsh/connect.js';
+import { readRef } from '../dsh/credentials.js';
+import { DshModelError } from '../errors.js';
+import { opencodeModelsPath } from '../engine/compat.js';
+import { L } from '../i18n.js';
+import { loadSecrets, saveSecrets } from '../secrets.js';
+import { run } from '../util/exec.js';
+import { readText, writeJson } from '../util/fs.js';
+export const OPENCODE_PROVIDER = 'opencode';
+export const OPENCODE_REF = 'OPENCODE_API_KEY';
+export const OPENCODE_MODELS_URL = 'https://opencode.ai/zen/v1/models';
+export const OPENCODE_KEY_PAGE = 'https://opencode.ai/auth';
+/**
+ * 校验 key。/zen/v1/models 是公开的，验不了 key；而且无效 key 和不带 key 一样返回
+ * 403 FreeTierError（实测 2026-10-08）。所以用这把 key 向一个免费模型发 1 token 请求：200 才算可用。
+ * 用 curl：它认 -x 代理（Node 的 fetch 不走代理）；key 经 stdin 的 curl 配置传入，不出现在进程参数里。
+ */
+export async function verifyOpencodeKey(key, proxy) {
+    const proxyArgs = proxy ? ['-x', proxy] : [];
+    const list = await run('curl', ['-s', '-m', '20', ...proxyArgs, OPENCODE_MODELS_URL], { timeoutMs: 30_000 });
+    let model = 'big-pickle';
+    try {
+        const ids = (JSON.parse(list.stdout).data ?? []).map((m) => m.id);
+        model = ids.includes('big-pickle') ? 'big-pickle' : (ids.find((id) => id.endsWith('-free')) ?? model);
+    }
+    catch {
+        if (list.code !== 0)
+            return { ok: false, status: null, detail: L(`连不上 opencode.ai${proxy ? '' : '（需要代理？dsh-model setup --proxy <地址>）'}`, `cannot reach opencode.ai${proxy ? '' : ' (proxy needed? dsh-model setup --proxy <url>)'}`) };
+    }
+    const body = JSON.stringify({ model, max_tokens: 1, messages: [{ role: 'user', content: 'hi' }] });
+    const r = await run('curl', ['-s', '-m', '40', '-w', '\n%{http_code}', '-K', '-', ...proxyArgs, '-H', 'Content-Type: application/json', '-d', body, OPENCODE_MODELS_URL.replace(/models$/, 'chat/completions')], { input: `header = "Authorization: Bearer ${key.replace(/"/g, '')}"\n`, timeoutMs: 60_000 });
+    const lines = r.stdout.trimEnd().split('\n');
+    const status = Number(lines.pop()) || null;
+    const text = lines.join('\n');
+    if (status === 200)
+        return { ok: true, status, detail: 'ok', model };
+    if (status === 403 && /FreeTierError/.test(text)) {
+        return {
+            ok: false,
+            status,
+            model,
+            detail: L('OpenCode 返回 FreeTierError：这把 key 没被识别（无效 key 会被当成匿名请求），或者 OpenCode 不允许在其客户端之外用免费档', 'OpenCode returned FreeTierError: the key was not recognized (an invalid key is treated as anonymous), or OpenCode does not allow its free tier outside its own client'),
+        };
+    }
+    if (status === 401)
+        return { ok: false, status, model, detail: L('key 无效', 'invalid key') };
+    if (status === 402 || /insufficient|balance|credit/i.test(text))
+        return { ok: true, status, model, detail: L('key 有效，但余额不足（免费模型应可用）', 'key valid but out of balance (free models should still work)') };
+    return { ok: false, status, model, detail: status ? `HTTP ${status}: ${text.slice(0, 160)}` : L('请求失败（网络 / 代理？）', 'request failed (network / proxy?)') };
+}
+export function validateKeyShape(key) {
+    if (!key || /\s/.test(key) || key.length < 16) {
+        throw new DshModelError('invalid_opencode_key', L('这看起来不是一个 OpenCode Zen key', 'That does not look like an OpenCode Zen key'), L(`在 ${OPENCODE_KEY_PAGE} 登录后创建 API key`, `Create an API key at ${OPENCODE_KEY_PAGE}`));
+    }
+}
+/** 拉公开模型目录写到 opencode-models.json（走 curl：它认代理） */
+export async function refreshOpencodeModels(ctx, proxy) {
+    const r = await run('curl', ['-s', '-m', '20', ...(proxy ? ['-x', proxy] : []), OPENCODE_MODELS_URL], { timeoutMs: 30_000 });
+    let ids = [];
+    try {
+        ids = (JSON.parse(r.stdout).data ?? []).map((m) => m.id).filter((id) => typeof id === 'string' && id);
+    }
+    catch {
+        throw new DshModelError('opencode_models_failed', L(`取不到 OpenCode 模型目录${proxy ? '' : '（需要代理？）'}`, `Could not fetch the OpenCode model list${proxy ? '' : ' (proxy needed?)'}`));
+    }
+    const file = { updatedAt: new Date().toISOString(), models: ids.map((id) => ({ id })) };
+    await writeJson(opencodeModelsPath(ctx), file, { owner: ctx.owner });
+    return ids.length;
+}
+export async function opencodeConfigured(ctx) {
+    return Boolean((await loadSecrets(ctx)).opencode?.key);
+}
+export async function saveOpencodeKey(ctx, key, verifiedModel) {
+    const secrets = await loadSecrets(ctx);
+    secrets.opencode = { key, verifiedAt: new Date().toISOString(), ...(verifiedModel ? { verifiedModel } : {}) };
+    await saveSecrets(ctx, secrets);
+}
+export async function removeOpencodeKey(ctx) {
+    const secrets = await loadSecrets(ctx);
+    if (!secrets.opencode)
+        return false;
+    delete secrets.opencode;
+    await saveSecrets(ctx, secrets);
+    return true;
+}
+/** v0.2.0 → 统一端点：把 dsh-model 写进 dsh 的 OPENCODE_API_KEY 收回 secrets.json，并移除 dsh 里的 opencode 路由 */
+export async function migrateDshOpencode(ctx, all) {
+    const dsh = all.state.dsh;
+    if (!dsh?.ownedProviders?.includes(OPENCODE_PROVIDER) && !dsh?.ownedRefs?.includes(OPENCODE_REF))
+        return false;
+    const key = readRef(await readText(dsh.credFile), OPENCODE_REF);
+    if (key && !(await opencodeConfigured(ctx)))
+        await saveOpencodeKey(ctx, key);
+    await applyDsh(ctx, all.state, { refs: { [OPENCODE_REF]: null }, providers: { [OPENCODE_PROVIDER]: null } }, { profile: all.config.dsh.profile });
+    return true;
+}

package/dist/integrations/workbuddy.js

@@ -0,0 +1,114 @@
+// integrations/workbuddy.ts — WorkBuddy 经 dsh-model 自己的 bridge 接入统一端点（设计 §1.3.1）
+//
+// bridge 是常驻服务（com.dsh-model.bridge），读 WorkBuddy App 的登录态，对引擎提供 OpenAI 兼容接口。
+// v0.2.0 曾经通过 dsh 的插件管理装 dsh-workbuddy-connect：removeWorkbuddyPlugin 负责把 dsh-model 装的那份移除。
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { availableVariants, loadBridgeConfig, loadCatalogs } from '../bridge/runtime.js';
+import { ensureDaemon } from '../daemon/service.js';
+import { dshPlugin, profileHasDependency } from '../dsh/cli.js';
+import { resolveProfile } from '../dsh/locate.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { serviceFor } from '../service/index.js';
+import { info, ok, skip, warn } from '../util/output.js';
+export const WORKBUDDY_PLUGIN = 'dsh-workbuddy-connect';
+export function riskNotice() {
+    return L('WorkBuddy 接入说明：dsh-model 的 bridge 会读取并解密 WorkBuddy App 本机保存的登录凭据（需运行 App 自带的程序取密钥），并以 WorkBuddy 客户端的身份调用其接口。这绕开了 WorkBuddy 自己的凭据保护，可能不符合其服务条款，账号存在风险；WorkBuddy 升级加密方式时可能失效。刷新后的令牌只存 dsh-model 自己的副本，不改写 App 的文件。仅限你本人自用。', "WorkBuddy notice: dsh-model's bridge reads and decrypts the WorkBuddy app's locally stored sign-in (running the app's own binary to obtain the key) and calls its API as the WorkBuddy client. This bypasses WorkBuddy's own credential protection, may conflict with its terms, and puts the account at risk; it may break when WorkBuddy changes its encryption. Refreshed tokens are kept only in dsh-model's own copy; the app's files are never rewritten. Personal use only.");
+}
+export async function bridgeHealthy(port, secret) {
+    try {
+        const r = await fetch(`http://127.0.0.1:${port}/healthz`, { headers: { Authorization: `Bearer ${secret}` }, signal: AbortSignal.timeout(2000) });
+        return r.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function waitCatalogs(ctx, since, expected, timeoutMs = 45_000) {
+    const deadline = Date.now() + timeoutMs;
+    let cats = [];
+    while (Date.now() < deadline) {
+        cats = (await loadCatalogs(ctx.paths.home)).filter((c) => Date.parse(c.updatedAt) >= since);
+        if (cats.length >= expected)
+            return cats;
+        await new Promise((r) => setTimeout(r, 500));
+    }
+    return cats;
+}
+/** 检测 App → 首次打印说明 → bridge 配置与服务 → 等目录。返回目录（调用方随后 syncAll） */
+export async function enableWorkbuddy(ctx, all) {
+    const variants = await availableVariants(ctx.paths.home);
+    if (!variants.length) {
+        skip(ctx.platform === 'darwin'
+            ? L('没检测到 WorkBuddy 桌面 App，也没有用 dsh-model 登录过；可执行 dsh-model workbuddy login', 'No WorkBuddy desktop app and no dsh-model sign-in; run dsh-model workbuddy login')
+            : L('服务器上没有 WorkBuddy 桌面 App：执行 dsh-model workbuddy login，在任意浏览器里授权即可', 'No WorkBuddy desktop app on this server: run dsh-model workbuddy login and approve in any browser'));
+        return [];
+    }
+    if (!all.config.bridge?.riskNoticeAt) {
+        warn(riskNotice());
+        all.config.bridge = { port: all.config.bridge?.port ?? 0, riskNoticeAt: new Date().toISOString() };
+    }
+    const since = Date.now();
+    // 守护进程（bridge）重启后会按当前登录的产品重建，并读一遍目录
+    await ensureDaemon(ctx, all);
+    if (ctx.serviceDisabled)
+        return loadCatalogs(ctx.paths.home);
+    info(L('正在读取 WorkBuddy 登录态与模型目录（首次会运行 App 自带的程序取密钥）…', 'Reading WorkBuddy sign-in and model catalog (first run executes the app binary to obtain the key)…'));
+    const cats = await waitCatalogs(ctx, since, variants.length);
+    for (const c of cats) {
+        if (c.signedIn)
+            ok(L(`${c.label}：已登录${c.nickname ? `（${c.nickname}）` : ''}，${c.models.length} 个模型（前缀 ${c.prefix}/）`, `${c.label}: signed in${c.nickname ? ` (${c.nickname})` : ''}, ${c.models.length} models (prefix ${c.prefix}/)`));
+        else
+            warn(L(`${c.label}：未登录${c.error ? `（${c.error}）` : ''}。在 App 里登录后，bridge 会在 30 分钟内自动接入，或执行 dsh-model workbuddy refresh`, `${c.label}: not signed in${c.error ? ` (${c.error})` : ''}. After signing in to the app, the bridge picks it up within 30 minutes, or run dsh-model workbuddy refresh`));
+    }
+    if (cats.length < variants.length)
+        warn(L('部分 WorkBuddy 目录还没读到，稍后执行 dsh-model workbuddy refresh', 'Some WorkBuddy catalogs are not ready yet; run dsh-model workbuddy refresh later'));
+    return cats;
+}
+export async function disableWorkbuddy(ctx, all) {
+    if (!all.state.bridgeService && !all.config.bridge)
+        return false;
+    if (!ctx.serviceDisabled)
+        await serviceFor(ctx, 'bridge', all.config.proxy).uninstall();
+    delete all.state.bridgeService;
+    return true;
+}
+/** 请正在运行的 bridge 立刻重读登录态与目录（它会自己同步引擎和 dsh） */
+export async function refreshBridge(ctx) {
+    const cfg = await loadBridgeConfig(ctx.paths.home);
+    if (!cfg)
+        return false;
+    try {
+        const r = await fetch(`http://127.0.0.1:${cfg.port}/refresh`, { method: 'POST', headers: { Authorization: `Bearer ${cfg.secret}` }, signal: AbortSignal.timeout(60_000) });
+        return r.ok;
+    }
+    catch {
+        return false;
+    }
+}
+// —— v0.2.0 迁移：移除 dsh-model 通过 dsh 插件管理装的 dsh-workbuddy-connect ——
+export async function removeWorkbuddyPlugin(ctx, all) {
+    const rec = all.state.plugins?.find((p) => p.name === WORKBUDDY_PLUGIN);
+    if (!rec?.installedByUs)
+        return false;
+    const profile = await resolveProfile(ctx, all.config.dsh.profile);
+    if (await profileHasDependency(ctx, profile, WORKBUDDY_PLUGIN)) {
+        const code = await dshPlugin(ctx, profile, ['remove', WORKBUDDY_PLUGIN], all.config.proxy);
+        if (code !== 0)
+            throw new DshModelError('plugin_remove_failed', L(`移除 ${WORKBUDDY_PLUGIN} 失败（退出码 ${code}）`, `Failed to remove ${WORKBUDDY_PLUGIN} (exit code ${code})`));
+    }
+    all.state.plugins = (all.state.plugins ?? []).filter((p) => p.name !== WORKBUDDY_PLUGIN);
+    return true;
+}
+/** 用户自己装了 dsh-workbuddy-connect：dsh 里会出现两组 WorkBuddy 模型，提示一下 */
+export async function userPluginInstalled(ctx, all) {
+    try {
+        const profile = await resolveProfile(ctx, all.config.dsh.profile);
+        const pkg = JSON.parse(await readFile(join(ctx.dshHome, 'profiles', profile, 'package.json'), 'utf8'));
+        return Boolean(pkg.dependencies?.[WORKBUDDY_PLUGIN]) && !all.state.plugins?.some((p) => p.name === WORKBUDDY_PLUGIN && p.installedByUs);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/keys.js

@@ -0,0 +1,54 @@
+// keys.ts — 客户端 key（每台设备 / 每个工具一把，可单独吊销）
+//
+// keys.json 0600。'dsh' 这把由 setup 生成，写进 dsh 的凭据文件；其余由 key add 生成。
+import { randomBytes } from 'node:crypto';
+import { DshModelError } from './errors.js';
+import { L } from './i18n.js';
+import { readJson, writeJson } from './util/fs.js';
+export const DSH_KEY_NAME = 'dsh';
+const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,39}$/;
+export function generateKey() {
+    return `dshm_${randomBytes(32).toString('base64url')}`;
+}
+export async function loadKeys(ctx) {
+    return (await readJson(ctx.paths.keys)) ?? { keys: [] };
+}
+export async function saveKeys(ctx, store) {
+    await writeJson(ctx.paths.keys, store, { owner: ctx.owner });
+}
+export function activeKeys(store) {
+    return store.keys.filter((k) => !k.revokedAt);
+}
+export function findActive(store, name) {
+    return activeKeys(store).find((k) => k.name === name);
+}
+export function addKey(store, name) {
+    if (!NAME_RE.test(name)) {
+        throw new DshModelError('invalid_key_name', L(`key 名称不合法：${name}（字母数字开头，可含 . _ -，最长 40）`, `Invalid key name: ${name} (alphanumeric start, may contain . _ -, max 40)`));
+    }
+    if (findActive(store, name)) {
+        throw new DshModelError('key_exists', L(`已经有一把叫 ${name} 的 key`, `A key named ${name} already exists`), L(`要换新的用：dsh-model key rotate ${name}`, `To replace it: dsh-model key rotate ${name}`));
+    }
+    const entry = { name, key: generateKey(), createdAt: new Date().toISOString() };
+    store.keys.push(entry);
+    return entry;
+}
+export function revokeKey(store, name) {
+    const entry = findActive(store, name);
+    if (!entry)
+        throw new DshModelError('key_not_found', L(`没有叫 ${name} 的 key`, `No key named ${name}`));
+    entry.revokedAt = new Date().toISOString();
+}
+export function rotateKey(store, name) {
+    revokeKey(store, name);
+    const entry = { name, key: generateKey(), createdAt: new Date().toISOString() };
+    store.keys.push(entry);
+    return entry;
+}
+/** setup 用：没有 dsh 这把就生成 */
+export function ensureDshKey(store) {
+    const existing = findActive(store, DSH_KEY_NAME);
+    if (existing)
+        return { entry: existing, created: false };
+    return { entry: addKey(store, DSH_KEY_NAME), created: true };
+}

package/dist/ops.js

@@ -0,0 +1,178 @@
+// ops.ts — 各命令共用的流程：读全部状态、应用引擎配置、同步模型到 dsh
+import { connectDshGroups } from './dsh/connect.js';
+import { listModels, waitHealthy, waitModelsChange } from './engine/client.js';
+import { compatModelIndex, loadCompatUpstreams } from './engine/compat.js';
+import { subscriptionMap } from './engine/sourcemap.js';
+import { pickedFor } from './dsh/pick.js';
+import { writeEngineConfig } from './engine/config.js';
+import { DshModelError, isDshModelError } from './errors.js';
+import { L } from './i18n.js';
+import { DSH_KEY_NAME, findActive, loadKeys } from './keys.js';
+import { serviceFor } from './service/index.js';
+import { loadConfig, loadState, saveConfig, saveState } from './state.js';
+import { ok, skip, warn } from './util/output.js';
+export async function loadAll(ctx) {
+    const [config, state, keys] = await Promise.all([loadConfig(ctx), loadState(ctx), loadKeys(ctx)]);
+    return { config, state, keys };
+}
+export async function saveAll(ctx, all) {
+    await saveConfig(ctx, all.config);
+    await saveState(ctx, all.state);
+}
+export function dshKey(keys) {
+    const k = findActive(keys, DSH_KEY_NAME);
+    if (!k)
+        throw new DshModelError('not_setup', L('还没有初始化', 'Not set up yet'), L('先执行 dsh-model setup', 'Run dsh-model setup first'));
+    return k.key;
+}
+/**
+ * 写 engine.yaml；内容变了且服务已注册，就重启引擎并等它起来。
+ * 不能指望引擎的热重载：我们原子写（临时文件 + rename）会换掉文件 inode，
+ * Linux 上引擎的 fsnotify 盯着旧 inode，收不到变化（VPS 实测：写入后引擎一直是 0 个 OpenAI-compat）。
+ */
+export async function applyEngineConfig(ctx, all) {
+    return writeEngineConfig(ctx, all.config, all.keys);
+}
+/**
+ * 兜底重启：热重载没生效时用。vps 模式下 bridge 以 dsh 用户运行，没有权限重启系统服务——
+ * 这时只记警告不失败（实测：bridge 写完配置后 systemctl restart 被拒）。
+ */
+async function restartEngineBestEffort(ctx, all) {
+    if (ctx.serviceDisabled || !all.state.service)
+        return false;
+    try {
+        await serviceFor(ctx).restart();
+        return waitHealthy(all.config.port, 15_000);
+    }
+    catch (error) {
+        warn(L(`没能重启引擎（${isDshModelError(error) ? error.code : String(error)}）；稍后执行 dsh-model repair`, `Could not restart the engine (${isDshModelError(error) ? error.code : String(error)}); run dsh-model repair later`));
+        return false;
+    }
+}
+/**
+ * 把引擎当前的模型列表写进 dsh。dsh 没装 / 没接过线时只提示，不算失败。
+ * before：login/logout 前的模型 id，用来等引擎热重载完成。
+ */
+export async function syncModels(ctx, all, opts = {}) {
+    const key = dshKey(all.keys);
+    const models = opts.before ? await waitModelsChange(all.config.port, key, opts.before) : await listModels(all.config.port, key);
+    const ids = models.map((m) => m.id);
+    const candidates = await dshCandidates(ctx, all, ids);
+    // 每个来源只把挑中的模型写进 dsh（管理页勾选，或默认挑选）；统一端点照常提供全部
+    const groups = [];
+    for (const c of candidates.values()) {
+        const picked = new Set(pickedFor(c.models.map((m) => ({ id: m.id, name: m.name, rate: m.rate })), all.config.dshModels?.[c.source]));
+        const models = c.models.filter((m) => picked.has(m.id)).map(({ rate: _r, ...m }) => m);
+        if (models.length)
+            groups.push({ providerId: c.providerId, displayName: c.label, models });
+    }
+    try {
+        const r = await connectDshGroups(ctx, all.state, all.keys, {
+            port: all.config.port,
+            key,
+            groups,
+            profile: opts.profile ?? all.config.dsh.profile,
+            force: opts.force,
+        });
+        all.config.dsh.profile = r.location.profile;
+        r.warnings.forEach((w) => warn(w));
+        if (!opts.quiet) {
+            if (r.providers.length) {
+                const summary = groups.map((g) => `${g.displayName} ${g.models.length}`).join(' · ');
+                const shown = groups.reduce((n, g) => n + g.models.length, 0);
+                const usable = [...candidates.values()].reduce((n, c) => n + c.models.length, 0);
+                (r.changed ? ok : skip)(L(`dsh（${r.location.profile}）显示 ${shown} 个模型（共 ${usable} 个可用）：${summary}`, `dsh (${r.location.profile}) shows ${shown} of ${usable} models: ${summary}`));
+            }
+            else {
+                skip(L('还没有登录任何上游，dsh 里暂时没有 dsh-model 的模型', 'No upstream logged in yet, so dsh has no dsh-model models for now'));
+            }
+        }
+    }
+    catch (error) {
+        if (isDshModelError(error) && error.code === 'dsh_not_found') {
+            warn(`${error.message}${error.hint ? ` — ${error.hint}` : ''}`);
+        }
+        else {
+            throw error;
+        }
+    }
+    await saveAll(ctx, all);
+    return ids;
+}
+/**
+ * 每个来源可以放进 dsh 的全部模型（勾选列表也用它）。
+ * 订阅模型名后缀"· 订阅"；已登录但没有可用订阅的来源（如 Kimi 没有 Kimi Code 套餐）不算，免得选了就报错。
+ */
+export async function dshCandidates(ctx, all, ids) {
+    const list = ids ?? (await listModels(all.config.port, dshKey(all.keys))).map((m) => m.id);
+    const meta = compatModelIndex(await loadCompatUpstreams(ctx));
+    const subs = await subscriptionMap(ctx, all.config.port);
+    const out = new Map();
+    const push = (source, providerId, label, model) => {
+        let g = out.get(source);
+        if (!g)
+            out.set(source, (g = { source, providerId, label, models: [] }));
+        g.models.push(model);
+    };
+    for (const id of list) {
+        const m = meta.get(id);
+        if (m?.group) {
+            push(m.group, `dsh-model-${m.group}`, m.groupLabel ?? m.group, {
+                id,
+                name: m.dshName ?? m.displayName ?? id,
+                ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
+                ...(m.maxTokens ? { maxTokens: m.maxTokens } : {}),
+                input: m.image ? ['text', 'image'] : ['text'],
+                ...(m.rate !== undefined ? { rate: m.rate } : {}),
+            });
+            continue;
+        }
+        const s = subs.models.get(id);
+        if (s && subs.noAccess.has(s.source))
+            continue;
+        if (s)
+            push(s.source, `dsh-model-${s.source}`, s.label, { id, name: `${s.displayName ?? id} · ${L('订阅', 'subscription')}` });
+        else
+            push('other', all.config.dsh.providerId, L('订阅（dsh-model）', 'Subscriptions (dsh-model)'), { id, name: id });
+    }
+    return out;
+}
+/** 引擎里带前缀（opencode/ workbuddy/ workbuddy-ai/）的模型是否正好等于期望：不能缺，也不能多（关掉的来源要消失） */
+function aliasesMatch(models, expected) {
+    const want = new Set(expected);
+    const prefixes = ['opencode/', 'workbuddy/', 'workbuddy-ai/'];
+    const have = models.map((m) => m.id).filter((id) => prefixes.some((p) => id.startsWith(p)));
+    return have.length === want.size && have.every((id) => want.has(id));
+}
+/** 等引擎热重载后模型列表与期望一致（openai-compatibility 上游改动之后），最多 timeoutMs */
+async function waitForAliases(port, key, expected, timeoutMs = 6000) {
+    const deadline = Date.now() + timeoutMs;
+    let last = [];
+    while (Date.now() < deadline) {
+        try {
+            last = await listModels(port, key);
+            if (aliasesMatch(last, expected))
+                return last;
+        }
+        catch {
+            // 重载中
+        }
+        await new Promise((r) => setTimeout(r, 300));
+    }
+    return last;
+}
+/**
+ * 全量同步：按当前的 OpenCode key / WorkBuddy 目录重写 engine.yaml → 等引擎加载 → 把模型清单写进 dsh。
+ * setup、opencode key、bridge 发现目录变化时都走这里。
+ */
+export async function syncAll(ctx, all, opts = {}) {
+    await applyEngineConfig(ctx, all);
+    const expected = [...compatModelIndex(await loadCompatUpstreams(ctx)).keys()];
+    const key = dshKey(all.keys);
+    // 不看"这次有没有写文件"，而看引擎实际加载的模型是否与期望一致：别的进程可能已经写过同样的内容（VPS 实测），
+    // 关掉一个来源时也要等它的模型真的消失，才把清单写进 dsh
+    if (!aliasesMatch(await waitForAliases(all.config.port, key, expected, 8000), expected) && (await restartEngineBestEffort(ctx, all))) {
+        await waitForAliases(all.config.port, key, expected, 8000);
+    }
+    return syncModels(ctx, all, { quiet: opts.quiet });
+}

package/dist/remote/public.js

@@ -0,0 +1,109 @@
+// remote/public.ts — 对外 HTTPS 端点（vps 模式，复用 dsh-vps 的 Caddy）
+//
+// 引擎始终只监听 127.0.0.1；对外由 Caddy 在 dsh 已有的域名上另开一个端口转发：
+//   https://<dsh 的域名>:9443/v1  → 127.0.0.1:8317
+// 不能复用 443：dsh-gate 对所有路径（含 /api）都要求网页登录，只带 key 的 API 客户端过不去（实测）。
+// 域名自动从 dsh-vps 的站点块读（/etc/caddy/dsh-site.conf 的第一个站点）；只有 IP 时用 <ip>.sslip.io，
+// 这样仍能拿到正规证书。防火墙（iptables INPUT 默认 DROP）放行这个端口，并用一个开机服务保持；
+// 关闭 / 卸载时全部撤销。
+import { readFile, rm } from 'node:fs/promises';
+import { isIP } from 'node:net';
+import { run } from '../util/exec.js';
+import { atomicWrite, exists } from '../util/fs.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+export const DSH_SITE_CONF = '/etc/caddy/dsh-site.conf';
+export const DEFAULT_PUBLIC_PORT = 9443;
+export const FIREWALL_UNIT = '/etc/systemd/system/dsh-model-firewall.service';
+const FW_COMMENT = 'dsh-model';
+/** dsh-vps 站点块的地址：域名，或 IP（没配域名时） */
+export async function detectDshHost() {
+    try {
+        return parseSiteHost(await readFile(DSH_SITE_CONF, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Caddyfile 片段里第一个站点块的地址 */
+export function parseSiteHost(text) {
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = /^([^{}]+)\{$/.exec(line);
+        if (!m)
+            continue;
+        // 站点地址可能是 "https://x"、"x:443"、"x, y"
+        const first = m[1].trim().split(/[\s,]+/)[0].replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+        if (!first || first.startsWith('(') || first === 'import')
+            continue;
+        return { host: first, kind: isIP(first) ? 'ip' : 'domain' };
+    }
+    return null;
+}
+/** 本机公网 IPv4（从默认路由的源地址取） */
+export async function publicIp() {
+    const r = await run('ip', ['-4', 'route', 'get', '1.1.1.1']);
+    const m = / src (\d+\.\d+\.\d+\.\d+)/.exec(r.stdout);
+    return m?.[1] ?? null;
+}
+/** 有域名用域名；只有 IP 时用 <ip>.sslip.io（公共 DNS，解析回这个 IP），这样仍能签正规证书 */
+export async function publicHost(override) {
+    if (override)
+        return override;
+    const site = await detectDshHost();
+    if (site?.kind === 'domain')
+        return site.host;
+    const ip = site?.kind === 'ip' ? site.host : await publicIp();
+    if (!ip)
+        throw new DshModelError('no_public_ip', L('查不到这台服务器的公网地址', 'Cannot determine the public address of this server'), L('用 --domain 指定：dsh-model remote enable --via caddy --domain 你的域名', 'Pass it explicitly: dsh-model remote enable --via caddy --domain your.domain'));
+    return `${ip.replace(/\./g, '-')}.sslip.io`;
+}
+export function siteBlock(host, publicPort, enginePort) {
+    return `# Generated by dsh-model. 由 dsh-model 生成：对外的 OpenAI 兼容端点（只认 dsh-model 的 key）\n${host}:${publicPort} {\n\treverse_proxy 127.0.0.1:${enginePort}\n}\n`;
+}
+async function ruleExists(bin, port) {
+    return (await run(bin, ['-C', 'INPUT', '-p', 'tcp', '--dport', String(port), '-m', 'comment', '--comment', FW_COMMENT, '-j', 'ACCEPT'])).code === 0;
+}
+/** 放行端口（IPv4 + IPv6），并装一个开机时补回规则的 oneshot 服务 */
+export async function openFirewall(port) {
+    for (const bin of ['iptables', 'ip6tables']) {
+        if (!(await ruleExists(bin, port)))
+            await run(bin, ['-I', 'INPUT', '-p', 'tcp', '--dport', String(port), '-m', 'comment', '--comment', FW_COMMENT, '-j', 'ACCEPT']);
+    }
+    const add = (bin) => `/bin/sh -c '${bin} -C INPUT -p tcp --dport ${port} -m comment --comment ${FW_COMMENT} -j ACCEPT 2>/dev/null || ${bin} -I INPUT -p tcp --dport ${port} -m comment --comment ${FW_COMMENT} -j ACCEPT'`;
+    const unit = [
+        '# Generated by dsh-model. 由 dsh-model 生成：开机后放行对外端点的端口',
+        '[Unit]',
+        'Description=dsh-model public endpoint firewall rule',
+        'After=network-online.target',
+        '',
+        '[Service]',
+        'Type=oneshot',
+        'RemainAfterExit=yes',
+        `ExecStart=${add('iptables')}`,
+        `ExecStart=${add('ip6tables')}`,
+        '',
+        '[Install]',
+        'WantedBy=multi-user.target',
+        '',
+    ].join('\n');
+    await atomicWrite(FIREWALL_UNIT, unit, { mode: 0o644 });
+    await run('systemctl', ['daemon-reload']);
+    await run('systemctl', ['enable', 'dsh-model-firewall.service']);
+}
+export async function closeFirewall(port) {
+    for (const bin of ['iptables', 'ip6tables']) {
+        while (await ruleExists(bin, port)) {
+            const r = await run(bin, ['-D', 'INPUT', '-p', 'tcp', '--dport', String(port), '-m', 'comment', '--comment', FW_COMMENT, '-j', 'ACCEPT']);
+            if (r.code !== 0)
+                break;
+        }
+    }
+    if (await exists(FIREWALL_UNIT)) {
+        await run('systemctl', ['disable', 'dsh-model-firewall.service']);
+        await rm(FIREWALL_UNIT, { force: true });
+        await run('systemctl', ['daemon-reload']);
+    }
+}

package/dist/secrets.js

@@ -0,0 +1,13 @@
+// secrets.ts — dsh-model 自己保管的上游凭据（目前是 OpenCode Zen key）。secrets.json 0600，不进 dsh 的凭据库：
+// 统一端点下 dsh 只认 dsh-model 一个 provider，上游 key 由引擎持有。
+import { join } from 'node:path';
+import { readJson, writeJson } from './util/fs.js';
+export function secretsPath(ctx) {
+    return join(ctx.paths.home, 'secrets.json');
+}
+export async function loadSecrets(ctx) {
+    return (await readJson(secretsPath(ctx))) ?? {};
+}
+export async function saveSecrets(ctx, secrets) {
+    await writeJson(secretsPath(ctx), secrets, { owner: ctx.owner });
+}

package/dist/service/index.js

@@ -0,0 +1,46 @@
+// service/index.ts — 引擎的系统服务：按运行模式挑 launchd / systemd --user / systemd 系统级
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { currentBinary } from '../engine/install.js';
+import { PKG_ROOT } from '../util/pkg.js';
+import { launchd } from './launchd.js';
+import { systemd } from './systemd.js';
+export const SERVICE_LABEL = 'com.dsh-model.engine';
+export const UNIT_NAME = 'dsh-model-engine.service';
+export const BRIDGE_LABEL = 'com.dsh-model.bridge';
+export const BRIDGE_UNIT = 'dsh-model-bridge.service';
+export function serviceKind(ctx) {
+    if (ctx.mode === 'vps')
+        return 'systemd-system';
+    return ctx.platform === 'darwin' ? 'launchd' : 'systemd-user';
+}
+/** bridge 是 Node 进程：用当前 node 的绝对路径，加上本包的入口 */
+function bridgeProgram() {
+    return [process.execPath, join(PKG_ROOT, 'bin', 'dsh-model.js'), 'bridge', 'run'];
+}
+/**
+ * bridge 进程的环境：DSH_MODEL_HOME；有代理时让 Node 的 fetch 走代理（NODE_USE_ENV_PROXY，Node ≥ 22.21），
+ * 但国内版 WorkBuddy 的域名与本机回环直连。
+ */
+export function bridgeEnv(ctx, proxy) {
+    return {
+        DSH_MODEL_HOME: ctx.paths.home,
+        ...(proxy ? { NODE_USE_ENV_PROXY: '1', HTTPS_PROXY: proxy, HTTP_PROXY: proxy, NO_PROXY: '127.0.0.1,localhost,::1,.tencent.com,.codebuddy.cn,.workbuddy.cn,.qq.com' } : {}),
+    };
+}
+export function serviceFor(ctx, name = 'engine', proxy) {
+    const kind = serviceKind(ctx);
+    const label = name === 'engine' ? (kind === 'launchd' ? SERVICE_LABEL : UNIT_NAME) : kind === 'launchd' ? BRIDGE_LABEL : BRIDGE_UNIT;
+    const common = {
+        program: name === 'engine' ? [currentBinary(ctx), '-config', ctx.paths.engineYaml] : bridgeProgram(),
+        workingDirectory: ctx.paths.home,
+        stdoutPath: join(ctx.paths.home, `${name}.stdout.log`),
+        home: ctx.paths.home,
+        ...(name === 'bridge' ? { env: bridgeEnv(ctx, proxy) } : {}),
+    };
+    if (kind === 'launchd')
+        return launchd({ ...common, label, file: join(homedir(), 'Library/LaunchAgents', `${label}.plist`) });
+    if (kind === 'systemd-user')
+        return systemd('systemd-user', { ...common, label, file: join(homedir(), '.config/systemd/user', label) });
+    return systemd('systemd-system', { ...common, label, file: join('/etc/systemd/system', label), user: ctx.runAs });
+}