dsh-model 0.0.1 → 0.14.0

package/dist/commands/login.js

@@ -0,0 +1,113 @@
+// commands/login.ts — 引导登录上游（交互交给引擎），之后同步模型到 dsh；以及 logout
+import { mkdir, rename, rm } from 'node:fs/promises';
+import { hostname, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { requireRootInVps } from '../context.js';
+import { filesFor, listAuthFiles, tightenAuthPerms } from '../engine/auth.js';
+import { listModels } from '../engine/client.js';
+import { currentBinary } from '../engine/install.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { dshKey, loadAll, saveAll, syncModels } from '../ops.js';
+import { withLock } from '../state.js';
+import { ensureEngine } from './setup.js';
+import { getUpstream, riskNotice } from '../upstreams.js';
+import { runInherit } from '../util/exec.js';
+import { exists } from '../util/fs.js';
+import { bold, info, ok } from '../util/output.js';
+function isHeadless(ctx) {
+    if (ctx.mode === 'vps' || ctx.env.SSH_CONNECTION || ctx.env.SSH_TTY)
+        return true;
+    if (ctx.platform === 'linux')
+        return !ctx.env.DISPLAY && !ctx.env.WAYLAND_DISPLAY;
+    return false;
+}
+/** 远端主机名：优先 SSH_CONNECTION 里的服务器地址 */
+function sshTarget(ctx) {
+    const serverIp = ctx.env.SSH_CONNECTION?.split(' ')[2];
+    const user = ctx.env.SUDO_USER || userInfo().username;
+    return `${user}@${serverIp || hostname()}`;
+}
+export async function login(ctx, upstream, opts) {
+    requireRootInVps(ctx);
+    const def = getUpstream(upstream);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        const bin = currentBinary(ctx);
+        if (!(await exists(bin)) || !(await exists(ctx.paths.engineYaml))) {
+            info(L('首次使用订阅上游，先安装引擎…', 'First subscription login: installing the engine…'));
+            await ensureEngine(ctx, all);
+        }
+        if (def.requiresRiskAck) {
+            if (!opts.acceptRisk) {
+                info(riskNotice(def));
+                return 2;
+            }
+            all.config.upstreams[def.id] = { ...all.config.upstreams[def.id], riskAcceptedAt: new Date().toISOString() };
+        }
+        // 单账号：已有凭据要 --replace；先挪走，成功后删，失败挪回
+        const existing = filesFor(await listAuthFiles(ctx), def);
+        if (existing.length && !opts.replace) {
+            throw new DshModelError('already_logged_in', L(`${def.label} 已经登录（${existing.join(', ')}）`, `${def.label} is already logged in (${existing.join(', ')})`), L(`换账号：dsh-model login ${def.id} --replace`, `To switch accounts: dsh-model login ${def.id} --replace`));
+        }
+        if (existing.length) {
+            await mkdir(ctx.paths.replaced, { recursive: true, mode: 0o700 });
+            for (const f of existing)
+                await rename(join(ctx.paths.auth, f), join(ctx.paths.replaced, f));
+        }
+        const before = await listModels(all.config.port, dshKey(all.keys)).then((m) => m.map((x) => x.id)).catch(() => []);
+        const headless = isHeadless(ctx);
+        const flag = opts.device && def.deviceFlag ? def.deviceFlag : def.flag;
+        const args = ['-config', ctx.paths.engineYaml, flag, ...(headless ? ['-no-browser'] : [])];
+        if (headless && def.callbackPort && flag === def.flag) {
+            info(bold(L('这台机器没有浏览器。两种方式任选其一：', 'No browser on this machine. Pick either way:')));
+            info(L(`  1. 在你自己的电脑上另开终端执行：ssh -N -L ${def.callbackPort}:127.0.0.1:${def.callbackPort} ${sshTarget(ctx)}`, `  1. On your own computer, in another terminal: ssh -N -L ${def.callbackPort}:127.0.0.1:${def.callbackPort} ${sshTarget(ctx)}`));
+            info(L('     然后在本地浏览器打开下面打印的授权链接。', '     then open the authorization URL printed below in your local browser.'));
+            info(L('  2. 直接在本地浏览器打开授权链接，授权后把浏览器跳转到的地址（打不开也没关系）粘贴回这里。', '  2. Open the URL in your local browser; after approving, paste the address it redirects to (even if the page fails to load) back here.'));
+            if (def.deviceFlag)
+                info(L(`  也可以改用 device-code：dsh-model login ${def.id} --device`, `  Or use device code instead: dsh-model login ${def.id} --device`));
+            info('');
+        }
+        const cmd = ctx.runAs && ctx.isRoot ? 'sudo' : bin;
+        const cmdArgs = ctx.runAs && ctx.isRoot ? ['-u', ctx.runAs, '-H', bin, ...args] : args;
+        const env = { ...ctx.env, ...(all.config.proxy ? { HTTPS_PROXY: all.config.proxy, HTTP_PROXY: all.config.proxy } : {}) };
+        const code = await runInherit(cmd, all.config.proxy && cmd === 'sudo' ? ['--preserve-env=HTTPS_PROXY,HTTP_PROXY', ...cmdArgs] : cmdArgs, { cwd: ctx.paths.home, env });
+        const after = filesFor(await listAuthFiles(ctx), def);
+        if (code !== 0 || after.length === 0) {
+            for (const f of existing)
+                await rename(join(ctx.paths.replaced, f), join(ctx.paths.auth, f)).catch(() => { });
+            // 引擎等授权回调超时（5 分钟）或被取消时也返回 0，所以按"没拿到凭据"来提示
+            const hint = def.deviceFlag && flag !== def.deviceFlag
+                ? L(`没收到授权回调。网页报错或超时多半是网络 / 代理节点问题：换个节点重试，或改用 device-code：dsh-model login ${def.id} --device`, `No authorization callback received. A web error or timeout is usually a network / proxy-node issue: retry on another node, or use device code: dsh-model login ${def.id} --device`)
+                : L('没收到授权结果，请重试；引擎日志：dsh-model logs', 'No authorization result; please retry. Engine log: dsh-model logs');
+            const message = code === 0
+                ? L(`${def.label} 登录没有完成（超时或已取消）`, `${def.label} login did not complete (timed out or cancelled)`)
+                : L(`${def.label} 登录失败（退出码 ${code}）`, `${def.label} login failed (exit code ${code})`);
+            throw new DshModelError('login_failed', message, hint);
+        }
+        await rm(ctx.paths.replaced, { recursive: true, force: true });
+        await tightenAuthPerms(ctx);
+        ok(L(`${def.label} 已登录`, `${def.label} logged in`));
+        await saveAll(ctx, all);
+        await syncModels(ctx, all, { before });
+        return 0;
+    });
+}
+export async function logout(ctx, upstream) {
+    requireRootInVps(ctx);
+    const def = getUpstream(upstream);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        const files = filesFor(await listAuthFiles(ctx), def);
+        if (!files.length) {
+            info(L(`${def.label} 没有登录`, `${def.label} is not logged in`));
+            return 0;
+        }
+        const before = await listModels(all.config.port, dshKey(all.keys)).then((m) => m.map((x) => x.id)).catch(() => []);
+        for (const f of files)
+            await rm(join(ctx.paths.auth, f), { force: true });
+        ok(L(`${def.label} 已退出登录`, `${def.label} logged out`));
+        await syncModels(ctx, all, { before });
+        return 0;
+    });
+}

package/dist/commands/logs.js

@@ -0,0 +1,19 @@
+// commands/logs.ts — 打印引擎日志末尾
+import { join } from 'node:path';
+import { L } from '../i18n.js';
+import { readText } from '../util/fs.js';
+import { info, warn } from '../util/output.js';
+export async function logs(ctx, lines = 80, which = 'engine') {
+    const files = which === 'bridge' ? [join(ctx.paths.home, 'bridge.stdout.log')] : [join(ctx.paths.logs, 'main.log'), join(ctx.paths.home, 'engine.stdout.log')];
+    for (const file of files) {
+        const text = await readText(file);
+        if (text == null)
+            continue;
+        info(`==> ${file}`);
+        info(text.trimEnd().split('\n').slice(-lines).join('\n'));
+        info('');
+        return 0;
+    }
+    warn(L('还没有日志', 'No logs yet'));
+    return 0;
+}

package/dist/commands/opencode.js

@@ -0,0 +1,77 @@
+// commands/opencode.ts — dsh-model opencode [status|key|remove]，以及 setup 里的 OpenCode 步骤
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { OPENCODE_KEY_PAGE, opencodeConfigured, refreshOpencodeModels, removeOpencodeKey, saveOpencodeKey, validateKeyShape, verifyOpencodeKey, } from '../integrations/opencode.js';
+import { loadAll, syncAll } from '../ops.js';
+import { withLock } from '../state.js';
+import { info, isJsonMode, ok, printJson, skip } from '../util/output.js';
+import { canPrompt, promptSecret, readStdin } from '../util/prompt.js';
+/** 拿 key → 实测 → 存进 secrets.json → 拉模型目录。返回是否有变化（调用方随后 syncAll） */
+export async function configureOpencode(ctx, all, opts = {}) {
+    if ((await opencodeConfigured(ctx)) && !opts.replace) {
+        const n = await refreshOpencodeModels(ctx, all.config.proxy).catch(() => 0);
+        skip(L(`已配置${n ? `（${n} 个模型）` : ''}；换 key：dsh-model opencode key`, `Configured${n ? ` (${n} models)` : ''}; to change the key: dsh-model opencode key`));
+        return n > 0;
+    }
+    let key;
+    if (opts.stdin) {
+        key = await readStdin();
+    }
+    else if (canPrompt()) {
+        info(L(`需要你的 OpenCode Zen API key（免费注册：${OPENCODE_KEY_PAGE}）。输入不会显示，直接回车跳过。`, `Needs your OpenCode Zen API key (free sign-up: ${OPENCODE_KEY_PAGE}). Input is hidden; press Enter to skip.`));
+        key = await promptSecret('OpenCode Zen API key: ');
+        if (!key) {
+            skip(L('已跳过；之后可执行 dsh-model opencode key', 'Skipped; later run dsh-model opencode key'));
+            return false;
+        }
+    }
+    else {
+        skip(L('非交互环境，跳过；之后执行 dsh-model opencode key（或 echo <key> | dsh-model opencode key --stdin）', 'Non-interactive; skipped. Later run dsh-model opencode key (or echo <key> | dsh-model opencode key --stdin)'));
+        return false;
+    }
+    validateKeyShape(key);
+    let verifiedModel;
+    if (!opts.skipVerify) {
+        info(L('正在用一个免费模型实测这把 key…', 'Testing the key against a free model…'));
+        const v = await verifyOpencodeKey(key, all.config.proxy);
+        if (!v.ok) {
+            throw new DshModelError('opencode_key_rejected', L(`实测失败（${v.model ?? '-'}）：${v.detail}`, `Test failed (${v.model ?? '-'}): ${v.detail}`), L('确认 key 正确后重试；确定要先写入可加 --skip-verify', 'Check the key and retry; to write it anyway add --skip-verify'));
+        }
+        verifiedModel = v.model;
+        ok(L(`key 可用（${v.model} 实测通过${v.detail !== 'ok' ? `；${v.detail}` : ''}）`, `Key works (${v.model} test passed${v.detail !== 'ok' ? `; ${v.detail}` : ''})`));
+    }
+    await saveOpencodeKey(ctx, key, verifiedModel);
+    const n = await refreshOpencodeModels(ctx, all.config.proxy);
+    ok(L(`OpenCode Zen 已接入统一端点（${n} 个模型，名字前缀 opencode/）`, `OpenCode Zen connected to the unified endpoint (${n} models, prefixed opencode/)`));
+    return true;
+}
+export async function opencode(ctx, sub, opts) {
+    if (!sub || sub === 'status') {
+        const configured = await opencodeConfigured(ctx);
+        if (isJsonMode())
+            printJson({ configured });
+        else
+            info(configured ? L('已配置（key 在 dsh-model 的 secrets.json，由引擎持有）', 'Configured (key in dsh-model secrets.json, held by the engine)') : L('未配置（dsh-model opencode key）', 'Not configured (dsh-model opencode key)'));
+        return 0;
+    }
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (sub === 'key') {
+            if (await configureOpencode(ctx, all, { stdin: opts.stdin, skipVerify: opts.skipVerify, replace: true }))
+                await syncAll(ctx, all);
+            return 0;
+        }
+        if (sub === 'remove') {
+            if (!(await removeOpencodeKey(ctx))) {
+                skip(L('OpenCode 本来就没配置', 'OpenCode was not configured'));
+                return 0;
+            }
+            await syncAll(ctx, all, { quiet: true });
+            ok(L('已移除 OpenCode Zen（key 与模型）', 'Removed OpenCode Zen (key and models)'));
+            return 0;
+        }
+        throw new DshModelError('unknown_command', L(`未知子命令：opencode ${sub}`, `Unknown subcommand: opencode ${sub}`));
+    });
+}

package/dist/commands/remote.js

@@ -0,0 +1,129 @@
+// commands/remote.ts — 让本人其他设备访问引擎。引擎始终只绑 127.0.0.1，入口只有三种：
+// ssh（默认，服务端零改动）/ tailscale serve / caddy（仅 vps，复用 dsh-vps 的 Caddy）
+import { readFile, rm } from 'node:fs/promises';
+import { hostname, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { loadAll, saveAll } from '../ops.js';
+import { withLock } from '../state.js';
+import { run, which } from '../util/exec.js';
+import { atomicWrite, exists, timestamp } from '../util/fs.js';
+import { bold, info, next, ok, skip } from '../util/output.js';
+import { DEFAULT_PUBLIC_PORT, closeFirewall, openFirewall, publicHost, siteBlock } from '../remote/public.js';
+const CADDYFILE = '/etc/caddy/Caddyfile';
+const CADDY_SNIPPET = '/etc/caddy/dsh-model.conf';
+const IMPORT_LINE = `import ${CADDY_SNIPPET}`;
+const DOMAIN_RE = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+export async function remote(ctx, sub, opts) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (sub === 'disable') {
+            await disable(ctx, all);
+            await saveAll(ctx, all);
+            return 0;
+        }
+        if (sub !== 'enable')
+            throw new DshModelError('unknown_command', L('用法：dsh-model remote enable --via ssh|tailscale|caddy / remote disable', 'Usage: dsh-model remote enable --via ssh|tailscale|caddy / remote disable'));
+        const via = (opts.via ?? 'ssh');
+        if (all.state.remote && all.state.remote.mode !== 'off' && all.state.remote.mode !== via)
+            await disable(ctx, all);
+        const port = all.config.port;
+        if (via === 'ssh') {
+            all.state.remote = { mode: 'ssh', files: [] };
+            const target = `${ctx.env.SUDO_USER || userInfo().username}@${ctx.env.SSH_CONNECTION?.split(' ')[2] || hostname()}`;
+            info(bold(L('在你自己的设备上执行（保持运行）：', 'On your own device, run (keep it open):')));
+            info(`  ssh -N -L ${port}:127.0.0.1:${port} ${target}`);
+            info(L(`然后在那台设备的软件里填：Base URL http://127.0.0.1:${port}/v1`, `Then in software on that device use: Base URL http://127.0.0.1:${port}/v1`));
+        }
+        else if (via === 'tailscale') {
+            if (!(await which('tailscale')))
+                throw new DshModelError('tailscale_missing', L('没找到 tailscale 命令', 'tailscale command not found'), L('先安装并登录 Tailscale', 'Install and log in to Tailscale first'));
+            const r = await run('tailscale', ['serve', '--bg', `--https=${port}`, `http://127.0.0.1:${port}`]);
+            if (r.code !== 0)
+                throw new DshModelError('tailscale_failed', L(`tailscale serve 失败：${r.stderr.trim()}`, `tailscale serve failed: ${r.stderr.trim()}`));
+            all.state.remote = { mode: 'tailscale', files: [], tailscaleHttpsPort: port };
+            const dns = await run('tailscale', ['status', '--json']);
+            const name = (() => {
+                try {
+                    return String(JSON.parse(dns.stdout).Self?.DNSName ?? '').replace(/\.$/, '');
+                }
+                catch {
+                    return '';
+                }
+            })();
+            ok(L('已通过 tailscale serve 开放给你的 tailnet', 'Exposed to your tailnet via tailscale serve'));
+            info(L(`  Base URL：https://${name || '<本机 tailnet 域名>'}:${port}/v1`, `  Base URL: https://${name || '<this machine tailnet name>'}:${port}/v1`));
+        }
+        else if (via === 'caddy') {
+            if (ctx.mode !== 'vps')
+                throw new DshModelError('caddy_vps_only', L('caddy 方式只用于 dsh-vps 所在的服务器', 'The caddy method is only for the dsh-vps server'));
+            if (opts.domain && !DOMAIN_RE.test(opts.domain))
+                throw new DshModelError('invalid_domain', L(`域名不合法：${opts.domain}`, `Invalid domain: ${opts.domain}`));
+            // 默认用 dsh 自己的域名（只有 IP 时用 <ip>.sslip.io），另开一个端口
+            const host = await publicHost(opts.domain ?? all.config.remote.domain);
+            const publicPort = all.config.remote.publicPort ?? DEFAULT_PUBLIC_PORT;
+            await enableCaddy(ctx, all, host, publicPort);
+            all.config.remote.domain = host;
+            all.config.remote.publicPort = publicPort;
+            ok(L(`对外端点已开通：https://${host}:${publicPort}/v1（只认 dsh-model 的 key）`, `Public endpoint enabled: https://${host}:${publicPort}/v1 (dsh-model keys only)`));
+        }
+        else {
+            throw new DshModelError('unknown_remote', L(`不支持的方式：${via}`, `Unsupported method: ${via}`));
+        }
+        all.config.remote.mode = via;
+        await saveAll(ctx, all);
+        next(L('为每台设备单独发一把 key：dsh-model key add <设备名>（丢了就 key revoke）', 'Issue one key per device: dsh-model key add <device> (revoke it if lost)'));
+        return 0;
+    });
+}
+export async function enableCaddy(ctx, all, domain, publicPort = DEFAULT_PUBLIC_PORT) {
+    if (!(await exists(CADDYFILE)))
+        throw new DshModelError('caddy_missing', L(`没找到 ${CADDYFILE}`, `${CADDYFILE} not found`));
+    const original = await readFile(CADDYFILE, 'utf8');
+    const backup = join(ctx.paths.backups, `Caddyfile.${timestamp()}`);
+    await atomicWrite(backup, original);
+    await atomicWrite(CADDY_SNIPPET, siteBlock(domain, publicPort, all.config.port), { mode: 0o644 });
+    const hasImport = original.split('\n').some((l) => l.trim() === IMPORT_LINE);
+    if (!hasImport)
+        await atomicWrite(CADDYFILE, original.replace(/\n*$/, '\n') + IMPORT_LINE + '\n', { mode: 0o644 });
+    const v = await run('caddy', ['validate', '--config', CADDYFILE, '--adapter', 'caddyfile']);
+    if (v.code !== 0) {
+        await atomicWrite(CADDYFILE, original, { mode: 0o644 });
+        await rm(CADDY_SNIPPET, { force: true });
+        throw new DshModelError('caddy_invalid', L(`Caddy 配置校验失败，已回滚：${v.stderr.trim().slice(-300)}`, `Caddy config validation failed; rolled back: ${v.stderr.trim().slice(-300)}`));
+    }
+    const r = await run('systemctl', ['reload', 'caddy']);
+    if (r.code !== 0)
+        throw new DshModelError('caddy_reload_failed', L(`Caddy 重载失败：${r.stderr.trim()}`, `Caddy reload failed: ${r.stderr.trim()}`));
+    await openFirewall(publicPort);
+    all.state.remote = { mode: 'caddy', files: [CADDY_SNIPPET], caddyImportLine: hasImport ? undefined : IMPORT_LINE, caddyfile: CADDYFILE, publicUrl: `https://${domain}:${publicPort}/v1`, firewallPort: publicPort };
+    all.config.remote.mode = 'caddy';
+}
+export async function disable(ctx, all) {
+    const r = all.state.remote;
+    if (!r || r.mode === 'off') {
+        skip(L('远程访问本来就是关闭的', 'Remote access is already off'));
+        return;
+    }
+    if (r.mode === 'tailscale' && r.tailscaleHttpsPort) {
+        await run('tailscale', ['serve', `--https=${r.tailscaleHttpsPort}`, 'off']);
+    }
+    if (r.mode === 'caddy') {
+        for (const f of r.files)
+            await rm(f, { force: true });
+        if (r.caddyImportLine && r.caddyfile && (await exists(r.caddyfile))) {
+            const text = await readFile(r.caddyfile, 'utf8');
+            const kept = text.split('\n').filter((l) => l.trim() !== r.caddyImportLine).join('\n');
+            await atomicWrite(r.caddyfile, kept, { mode: 0o644 });
+        }
+        await run('systemctl', ['reload', 'caddy']);
+        if (r.firewallPort)
+            await closeFirewall(r.firewallPort);
+    }
+    all.state.remote = { mode: 'off', files: [] };
+    all.config.remote.mode = 'off';
+    ok(L('已关闭远程访问', 'Remote access disabled'));
+}

package/dist/commands/service.js

@@ -0,0 +1,72 @@
+// commands/service.ts — service install|start|stop|restart|status|uninstall，以及 repair
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { applyEngineConfig, loadAll, saveAll, syncAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { withLock } from '../state.js';
+import { ensureDaemon } from '../daemon/service.js';
+import { waitHealthy } from '../engine/client.js';
+import { info, isJsonMode, ok, printJson } from '../util/output.js';
+export async function service(ctx, sub) {
+    const svc = serviceFor(ctx);
+    if (!sub || sub === 'status') {
+        const s = await svc.status();
+        if (isJsonMode())
+            printJson({ kind: svc.kind, file: svc.spec.file, ...s });
+        else
+            info(`${svc.kind}  ${svc.spec.file}\n${L('已安装', 'installed')}: ${s.installed}  ${L('运行中', 'running')}: ${s.running}${s.pid ? `  pid ${s.pid}` : ''}${s.detail ? `  (${s.detail})` : ''}`);
+        return 0;
+    }
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        switch (sub) {
+            case 'install':
+                await svc.install();
+                all.state.service = { kind: svc.kind, file: svc.spec.file, label: svc.spec.label };
+                await saveAll(ctx, all);
+                break;
+            case 'start':
+                await svc.start();
+                break;
+            case 'stop':
+                await svc.stop();
+                break;
+            case 'restart':
+                await svc.restart();
+                break;
+            case 'uninstall':
+                await svc.uninstall();
+                delete all.state.service;
+                await saveAll(ctx, all);
+                break;
+            default:
+                throw new DshModelError('unknown_command', L(`未知子命令：service ${sub}`, `Unknown subcommand: service ${sub}`));
+        }
+        ok(`service ${sub}`);
+        return 0;
+    });
+}
+/** 按台账把一切拉回应有状态：engine.yaml、服务文件、dsh 接线 */
+export async function repair(ctx) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        await applyEngineConfig(ctx, all);
+        ok(L('engine.yaml 已重新生成', 'engine.yaml regenerated'));
+        if (!ctx.serviceDisabled) {
+            const svc = serviceFor(ctx);
+            await svc.install();
+            all.state.service = { kind: svc.kind, file: svc.spec.file, label: svc.spec.label };
+            await saveAll(ctx, all);
+            await svc.restart();
+            if (!(await waitHealthy(all.config.port, 15_000)))
+                throw new DshModelError('engine_unhealthy', L('引擎没有启动，查看 dsh-model logs', 'Engine did not start; see dsh-model logs'));
+            ok(L('服务已重装并重启', 'Service reinstalled and restarted'));
+            await ensureDaemon(ctx, all);
+        }
+        await syncAll(ctx, all);
+        return 0;
+    });
+}

package/dist/commands/setup.js

@@ -0,0 +1,216 @@
+// commands/setup.ts — 一条命令：引擎（统一端点）+ OpenCode Zen + WorkBuddy bridge → 全部接进 dsh。可重复执行
+//
+// 设计 §1.3：所有模型都从引擎 127.0.0.1:8317/v1 出去，dsh 只认 dsh-model 一个 provider。
+import { requireRootInVps } from '../context.js';
+import { locateDsh } from '../dsh/locate.js';
+import { listModels, unauthStatus, waitHealthy } from '../engine/client.js';
+import { activateVersion, currentVersion, fetchUpstreamAsset, installVersion, loadManifest, platformTarget } from '../engine/install.js';
+import { DshModelError, isDshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { migrateDshOpencode } from '../integrations/opencode.js';
+import { enableWorkbuddy, removeWorkbuddyPlugin, userPluginInstalled } from '../integrations/workbuddy.js';
+import { ensureDshKey, saveKeys } from '../keys.js';
+import { applyEngineConfig, loadAll, saveAll, syncAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { withLock } from '../state.js';
+import { ensureDir } from '../util/fs.js';
+import { bold, info, next, ok, skip, warn } from '../util/output.js';
+import { findFreePort, isPortFree } from '../util/port.js';
+import { detectProxy, normalizeProxyUrl, redactProxy } from '../util/proxy.js';
+import { configureOpencode } from './opencode.js';
+import { ensureDaemon } from '../daemon/service.js';
+import { installDshPlugin } from '../integrations/dshplugin.js';
+import { enableCaddy } from './remote.js';
+import { DEFAULT_PUBLIC_PORT, publicHost } from '../remote/public.js';
+export async function setup(ctx, opts) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        await ensureDir(ctx.paths.home, { owner: ctx.owner });
+        resolveProxy(all, opts, await detectProxy(ctx.env, ctx.platform));
+        if (opts.profile)
+            all.config.dsh.profile = opts.profile;
+        const loc = await locateDsh(ctx, all.config.dsh.profile);
+        all.config.dsh.profile = loc.profile;
+        ok(L(`dsh ${loc.version ?? ''}（profile：${loc.profile}）`, `dsh ${loc.version ?? ''} (profile: ${loc.profile})`));
+        await saveAll(ctx, all);
+        const failures = [];
+        const step = async (name, fn) => {
+            try {
+                await fn();
+            }
+            catch (error) {
+                if (!isDshModelError(error))
+                    throw error;
+                failures.push(name);
+                warn(`${error.message}${error.hint ? `\n  ${error.hint}` : ''}`);
+            }
+            await saveAll(ctx, all);
+        };
+        // v0.2.0 的做法（dsh 内置 opencode 路由、dsh-workbuddy-connect 插件）迁到统一端点
+        await step('migrate', async () => {
+            if (await migrateDshOpencode(ctx, all))
+                ok(L('已把 OpenCode 从 dsh 内置路由迁到统一端点', 'Moved OpenCode from the dsh built-in route to the unified endpoint'));
+            if (await removeWorkbuddyPlugin(ctx, all))
+                ok(L('已移除上一版安装的 dsh-workbuddy-connect 插件，改用 dsh-model 自己的 bridge', 'Removed the dsh-workbuddy-connect plugin installed by the previous version; using dsh-model\'s own bridge'));
+        });
+        info('');
+        info(bold(L('统一端点（引擎）', 'Unified endpoint (engine)')));
+        let engineRunning = false;
+        await step('engine', async () => {
+            engineRunning = await ensureEngine(ctx, all, { port: opts.port });
+        });
+        if (failures.includes('engine')) {
+            warn(L('引擎没装好，后面的步骤都依赖它，先停在这里', 'The engine is not ready and everything else depends on it; stopping here'));
+            return 1;
+        }
+        info('');
+        info(bold(L('守护进程', 'Daemon')));
+        await step('daemon', () => ensureDaemon(ctx, all));
+        info('');
+        info(bold('OpenCode Zen'));
+        if (opts.skipOpencode)
+            skip(L('已跳过（--skip-opencode）', 'Skipped (--skip-opencode)'));
+        else
+            await step('opencode', () => configureOpencode(ctx, all));
+        info('');
+        info(bold('WorkBuddy'));
+        if (opts.skipWorkbuddy)
+            skip(L('已跳过（--skip-workbuddy）', 'Skipped (--skip-workbuddy)'));
+        else {
+            await step('workbuddy', () => enableWorkbuddy(ctx, all));
+            if (await userPluginInstalled(ctx, all))
+                warn(L('你自己装了 dsh-workbuddy-connect 插件：dsh 里会有两组 WorkBuddy 模型。不需要的话可在 dsh 的插件页移除它', 'You installed the dsh-workbuddy-connect plugin yourself: dsh will show two WorkBuddy groups. Remove it from the dsh Plugins page if you do not need it'));
+        }
+        info('');
+        info(bold(L('dsh 插件页', 'dsh plugin page')));
+        if (opts.skipDshPlugin)
+            skip(L('已跳过（--skip-dsh-plugin）', 'Skipped (--skip-dsh-plugin)'));
+        else
+            await step('dsh-plugin', () => installDshPlugin(ctx, all));
+        // vps：自动在 dsh 的域名上开对外端点（没有域名就用 IP），自己的其他设备直接能用
+        if (ctx.mode === 'vps') {
+            info('');
+            info(bold(L('对外端点', 'Public endpoint')));
+            if (all.state.remote?.mode && all.state.remote.mode !== 'off' && all.state.remote.mode !== 'caddy')
+                skip(L(`已用 ${all.state.remote.mode} 方式开放，保持不变`, `Already exposed via ${all.state.remote.mode}; unchanged`));
+            else
+                await step('public-endpoint', async () => {
+                    const host = await publicHost(all.config.remote.domain);
+                    const port = all.config.remote.publicPort ?? DEFAULT_PUBLIC_PORT;
+                    await enableCaddy(ctx, all, host, port);
+                    all.config.remote.domain = host;
+                    all.config.remote.publicPort = port;
+                    ok(`https://${host}:${port}/v1`);
+                });
+        }
+        info('');
+        info(bold(L('同步到 dsh', 'Sync to dsh')));
+        let ids = [];
+        if (engineRunning) {
+            await step('sync', async () => {
+                ids = await syncAll(ctx, all);
+            });
+        }
+        else {
+            await applyEngineConfig(ctx, all);
+            skip(L('引擎没在运行，跳过同步到 dsh（启动后执行 dsh-model models sync）', 'Engine not running; skipped syncing to dsh (run dsh-model models sync once it is up)'));
+        }
+        const groups = new Map();
+        for (const id of ids) {
+            const g = id.includes('/') ? id.split('/')[0] : L('订阅', 'subscription');
+            groups.set(g, (groups.get(g) ?? 0) + 1);
+        }
+        if (groups.size)
+            info(`  ${[...groups].map(([g, n]) => `${g} ${n}`).join(' · ')}`);
+        info('');
+        if (failures.length)
+            warn(L(`有 ${failures.length} 项没完成：${failures.join('、')}。修好后重新执行 dsh-model setup 即可`, `${failures.length} item(s) not done: ${failures.join(', ')}. Fix them and re-run dsh-model setup`));
+        const base = all.state.remote?.mode === 'caddy' && all.state.remote.publicUrl ? all.state.remote.publicUrl : `http://127.0.0.1:${all.config.port}/v1`;
+        next(L(`在 dsh 的模型列表里选 dsh-model 下的模型。其他软件：Base URL ${base}，key 用 dsh-model key add <名称> 领取`, `Pick a dsh-model model in dsh. Other software: Base URL ${base}, get a key with dsh-model key add <name>`));
+        info(L('  订阅上游（codex 等）：dsh-model login <上游>', '  Subscription upstreams (codex etc.): dsh-model login <upstream>'));
+        return failures.length ? 1 : 0;
+    });
+}
+function resolveProxy(all, opts, found) {
+    if (opts.proxy !== undefined) {
+        all.config.proxy = opts.proxy === 'none' ? null : normalizeProxyUrl(opts.proxy);
+    }
+    else if (all.config.proxy === undefined) {
+        all.config.proxy = found?.url ?? null;
+        if (found)
+            ok(L(`检测到代理 ${redactProxy(found.url)}（来自 ${found.source}）`, `Detected proxy ${redactProxy(found.url)} (from ${found.source})`));
+    }
+    if (all.config.proxy)
+        skip(L(`出站代理：${redactProxy(all.config.proxy)}（改用 --proxy <地址> 或 --proxy none）`, `Outbound proxy: ${redactProxy(all.config.proxy)} (change with --proxy <url> or --proxy none)`));
+}
+/** 订阅引擎：下载校验 → key → 端口 → engine.yaml → 服务 → 鉴权自检 → 同步模型到 dsh。setup --engine 与首次 login 共用 */
+/** 返回引擎是否在运行（DSH_MODEL_SERVICE=none 时可能没跑） */
+export async function ensureEngine(ctx, all, opts = {}) {
+    const { config, state, keys } = all;
+    if (config.proxy === undefined) {
+        const found = await detectProxy(ctx.env, ctx.platform);
+        config.proxy = found?.url ?? null;
+    }
+    await ensureDir(ctx.paths.auth, { owner: ctx.owner });
+    const manifest = await loadManifest();
+    const target = platformTarget();
+    const version = config.engine.version ?? manifest.version;
+    const asset = version === manifest.version ? manifest.assets[target] : await fetchUpstreamAsset(manifest, version, target);
+    if (!asset)
+        throw new DshModelError('unsupported_platform', L(`引擎没有 ${target} 的发布包`, `No engine build for ${target}`));
+    const installed = await installVersion(ctx, version, asset);
+    if ((await currentVersion(ctx)) !== version)
+        await activateVersion(ctx, version);
+    config.engine.version = version;
+    if (!state.engine.versions.includes(version))
+        state.engine.versions.push(version);
+    (installed ? ok : skip)(L(`引擎 CLIProxyAPI v${version}${installed ? ' 已下载并校验' : ' 已安装'}`, `Engine CLIProxyAPI v${version} ${installed ? 'downloaded and verified' : 'already installed'}`));
+    const { created } = ensureDshKey(keys);
+    if (created)
+        await saveKeys(ctx, keys);
+    if (opts.port)
+        config.port = opts.port;
+    if (!(await isPortFree(config.port)) && !(await portIsOurs(config.port, keys))) {
+        const free = await findFreePort(config.port + 1);
+        warn(L(`端口 ${config.port} 被其他程序占用，改用 ${free}`, `Port ${config.port} is taken by another program; using ${free}`));
+        config.port = free;
+    }
+    await saveAll(ctx, all);
+    await applyEngineConfig(ctx, all);
+    if (ctx.serviceDisabled) {
+        skip(L('已跳过系统服务（DSH_MODEL_SERVICE=none）', 'Skipped system service (DSH_MODEL_SERVICE=none)'));
+    }
+    else {
+        const svc = serviceFor(ctx);
+        await svc.install();
+        state.service = { kind: svc.kind, file: svc.spec.file, label: svc.spec.label };
+        await saveAll(ctx, all);
+        if (installed)
+            await svc.restart();
+    }
+    if (!(await waitHealthy(config.port, ctx.serviceDisabled ? 1500 : 15_000))) {
+        if (ctx.serviceDisabled) {
+            warn(L('引擎未运行（服务已跳过）', 'Engine not running (service skipped)'));
+            return false;
+        }
+        throw new DshModelError('engine_unhealthy', L(`引擎没有在 127.0.0.1:${config.port} 上启动`, `Engine did not come up on 127.0.0.1:${config.port}`), L('查看日志：dsh-model logs', 'Check logs: dsh-model logs'));
+    }
+    const unauth = await unauthStatus(config.port);
+    if (unauth !== 401)
+        throw new DshModelError('auth_not_enforced', L(`不带 key 的请求返回了 ${unauth}（应为 401），已停止`, `Unauthenticated request returned ${unauth} (expected 401); stopping`));
+    ok(L(`引擎已在 127.0.0.1:${config.port} 运行，鉴权已生效`, `Engine running on 127.0.0.1:${config.port} with auth enforced`));
+    return true;
+}
+async function portIsOurs(port, keys) {
+    for (const k of keys.keys.filter((x) => !x.revokedAt)) {
+        try {
+            await listModels(port, k.key);
+            return true;
+        }
+        catch {
+            // 不是我们
+        }
+    }
+    return false;
+}