dsh-model 0.0.1 → 0.15.0

package/dist/commands/setup.js

@@ -0,0 +1,219 @@
+// commands/setup.ts — 一条命令：引擎（统一端点）+ OpenCode Zen + WorkBuddy bridge → 全部接进 dsh。可重复执行
+//
+// 设计 §1.3：所有模型都从引擎 127.0.0.1:8317/v1 出去，dsh 只认 dsh-model 一个 provider。
+import { requireRootInVps } from '../context.js';
+import { locateDsh } from '../dsh/locate.js';
+import { listModels, unauthStatus, waitHealthy } from '../engine/client.js';
+import { activateVersion, currentVersion, fetchUpstreamAsset, installVersion, loadManifest, platformTarget } from '../engine/install.js';
+import { DshModelError, isDshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { migrateDshOpencode } from '../integrations/opencode.js';
+import { enableWorkbuddy, removeWorkbuddyPlugin, userPluginInstalled } from '../integrations/workbuddy.js';
+import { ensureDshKey, saveKeys } from '../keys.js';
+import { applyEngineConfig, loadAll, saveAll, syncAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { withLock } from '../state.js';
+import { ensureDir } from '../util/fs.js';
+import { bold, info, next, ok, skip, warn } from '../util/output.js';
+import { findFreePort, isPortFree } from '../util/port.js';
+import { detectProxy, normalizeProxyUrl, redactProxy } from '../util/proxy.js';
+import { askOpencodeKey, configureOpencode } from './opencode.js';
+import { opencodeConfigured } from '../integrations/opencode.js';
+import { ensureDaemon } from '../daemon/service.js';
+import { installDshPlugin } from '../integrations/dshplugin.js';
+import { enableCaddy } from './remote.js';
+import { DEFAULT_PUBLIC_PORT, publicHost } from '../remote/public.js';
+export async function setup(ctx, opts) {
+    requireRootInVps(ctx);
+    // 要问的先问完再拿锁：等你输入时不占着锁，dsh 管理页照常能用（实测：卡在问 key 时页面新增 key 报"另一个命令正在运行"）
+    const opencodeKey = opts.skipOpencode || (await opencodeConfigured(ctx)) ? undefined : await askOpencodeKey();
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        await ensureDir(ctx.paths.home, { owner: ctx.owner });
+        resolveProxy(all, opts, await detectProxy(ctx.env, ctx.platform));
+        if (opts.profile)
+            all.config.dsh.profile = opts.profile;
+        const loc = await locateDsh(ctx, all.config.dsh.profile);
+        all.config.dsh.profile = loc.profile;
+        ok(L(`dsh ${loc.version ?? ''}（profile：${loc.profile}）`, `dsh ${loc.version ?? ''} (profile: ${loc.profile})`));
+        await saveAll(ctx, all);
+        const failures = [];
+        const step = async (name, fn) => {
+            try {
+                await fn();
+            }
+            catch (error) {
+                if (!isDshModelError(error))
+                    throw error;
+                failures.push(name);
+                warn(`${error.message}${error.hint ? `\n  ${error.hint}` : ''}`);
+            }
+            await saveAll(ctx, all);
+        };
+        // v0.2.0 的做法（dsh 内置 opencode 路由、dsh-workbuddy-connect 插件）迁到统一端点
+        await step('migrate', async () => {
+            if (await migrateDshOpencode(ctx, all))
+                ok(L('已把 OpenCode 从 dsh 内置路由迁到统一端点', 'Moved OpenCode from the dsh built-in route to the unified endpoint'));
+            if (await removeWorkbuddyPlugin(ctx, all))
+                ok(L('已移除上一版安装的 dsh-workbuddy-connect 插件，改用 dsh-model 自己的 bridge', 'Removed the dsh-workbuddy-connect plugin installed by the previous version; using dsh-model\'s own bridge'));
+        });
+        info('');
+        info(bold(L('统一端点（引擎）', 'Unified endpoint (engine)')));
+        let engineRunning = false;
+        await step('engine', async () => {
+            engineRunning = await ensureEngine(ctx, all, { port: opts.port });
+        });
+        if (failures.includes('engine')) {
+            warn(L('引擎没装好，后面的步骤都依赖它，先停在这里', 'The engine is not ready and everything else depends on it; stopping here'));
+            return 1;
+        }
+        info('');
+        info(bold(L('守护进程', 'Daemon')));
+        await step('daemon', () => ensureDaemon(ctx, all));
+        info('');
+        info(bold('OpenCode Zen'));
+        if (opts.skipOpencode)
+            skip(L('已跳过（--skip-opencode）', 'Skipped (--skip-opencode)'));
+        else
+            await step('opencode', () => configureOpencode(ctx, all, opencodeKey !== undefined ? { key: opencodeKey } : {}));
+        info('');
+        info(bold('WorkBuddy'));
+        if (opts.skipWorkbuddy)
+            skip(L('已跳过（--skip-workbuddy）', 'Skipped (--skip-workbuddy)'));
+        else {
+            await step('workbuddy', () => enableWorkbuddy(ctx, all));
+            if (await userPluginInstalled(ctx, all))
+                warn(L('你自己装了 dsh-workbuddy-connect 插件：dsh 里会有两组 WorkBuddy 模型。不需要的话可在 dsh 的插件页移除它', 'You installed the dsh-workbuddy-connect plugin yourself: dsh will show two WorkBuddy groups. Remove it from the dsh Plugins page if you do not need it'));
+        }
+        info('');
+        info(bold(L('dsh 插件页', 'dsh plugin page')));
+        if (opts.skipDshPlugin)
+            skip(L('已跳过（--skip-dsh-plugin）', 'Skipped (--skip-dsh-plugin)'));
+        else
+            await step('dsh-plugin', () => installDshPlugin(ctx, all));
+        // vps：自动在 dsh 的域名上开对外端点（没有域名就用 IP），自己的其他设备直接能用
+        if (ctx.mode === 'vps') {
+            info('');
+            info(bold(L('对外端点', 'Public endpoint')));
+            if (all.state.remote?.mode && all.state.remote.mode !== 'off' && all.state.remote.mode !== 'caddy')
+                skip(L(`已用 ${all.state.remote.mode} 方式开放，保持不变`, `Already exposed via ${all.state.remote.mode}; unchanged`));
+            else
+                await step('public-endpoint', async () => {
+                    const host = await publicHost(all.config.remote.domain);
+                    const port = all.config.remote.publicPort ?? DEFAULT_PUBLIC_PORT;
+                    await enableCaddy(ctx, all, host, port);
+                    all.config.remote.domain = host;
+                    all.config.remote.publicPort = port;
+                    ok(`https://${host}:${port}/v1`);
+                });
+        }
+        info('');
+        info(bold(L('同步到 dsh', 'Sync to dsh')));
+        let ids = [];
+        if (engineRunning) {
+            await step('sync', async () => {
+                ids = await syncAll(ctx, all);
+            });
+        }
+        else {
+            await applyEngineConfig(ctx, all);
+            skip(L('引擎没在运行，跳过同步到 dsh（启动后执行 dsh-model models sync）', 'Engine not running; skipped syncing to dsh (run dsh-model models sync once it is up)'));
+        }
+        const groups = new Map();
+        for (const id of ids) {
+            const g = id.includes('/') ? id.split('/')[0] : L('订阅', 'subscription');
+            groups.set(g, (groups.get(g) ?? 0) + 1);
+        }
+        if (groups.size)
+            info(`  ${[...groups].map(([g, n]) => `${g} ${n}`).join(' · ')}`);
+        info('');
+        if (failures.length)
+            warn(L(`有 ${failures.length} 项没完成：${failures.join('、')}。修好后重新执行 dsh-model setup 即可`, `${failures.length} item(s) not done: ${failures.join(', ')}. Fix them and re-run dsh-model setup`));
+        const base = all.state.remote?.mode === 'caddy' && all.state.remote.publicUrl ? all.state.remote.publicUrl : `http://127.0.0.1:${all.config.port}/v1`;
+        next(L(`在 dsh 的模型列表里选 dsh-model 下的模型。其他软件：Base URL ${base}，key 用 dsh-model key add <名称> 领取`, `Pick a dsh-model model in dsh. Other software: Base URL ${base}, get a key with dsh-model key add <name>`));
+        info(L('  订阅上游（codex 等）：dsh-model login <上游>', '  Subscription upstreams (codex etc.): dsh-model login <upstream>'));
+        return failures.length ? 1 : 0;
+    });
+}
+function resolveProxy(all, opts, found) {
+    if (opts.proxy !== undefined) {
+        all.config.proxy = opts.proxy === 'none' ? null : normalizeProxyUrl(opts.proxy);
+    }
+    else if (all.config.proxy === undefined) {
+        all.config.proxy = found?.url ?? null;
+        if (found)
+            ok(L(`检测到代理 ${redactProxy(found.url)}（来自 ${found.source}）`, `Detected proxy ${redactProxy(found.url)} (from ${found.source})`));
+    }
+    if (all.config.proxy)
+        skip(L(`出站代理：${redactProxy(all.config.proxy)}（改用 --proxy <地址> 或 --proxy none）`, `Outbound proxy: ${redactProxy(all.config.proxy)} (change with --proxy <url> or --proxy none)`));
+}
+/** 订阅引擎：下载校验 → key → 端口 → engine.yaml → 服务 → 鉴权自检 → 同步模型到 dsh。setup --engine 与首次 login 共用 */
+/** 返回引擎是否在运行（DSH_MODEL_SERVICE=none 时可能没跑） */
+export async function ensureEngine(ctx, all, opts = {}) {
+    const { config, state, keys } = all;
+    if (config.proxy === undefined) {
+        const found = await detectProxy(ctx.env, ctx.platform);
+        config.proxy = found?.url ?? null;
+    }
+    await ensureDir(ctx.paths.auth, { owner: ctx.owner });
+    const manifest = await loadManifest();
+    const target = platformTarget();
+    const version = config.engine.version ?? manifest.version;
+    const asset = version === manifest.version ? manifest.assets[target] : await fetchUpstreamAsset(manifest, version, target);
+    if (!asset)
+        throw new DshModelError('unsupported_platform', L(`引擎没有 ${target} 的发布包`, `No engine build for ${target}`));
+    const installed = await installVersion(ctx, version, asset);
+    if ((await currentVersion(ctx)) !== version)
+        await activateVersion(ctx, version);
+    config.engine.version = version;
+    if (!state.engine.versions.includes(version))
+        state.engine.versions.push(version);
+    (installed ? ok : skip)(L(`引擎 CLIProxyAPI v${version}${installed ? ' 已下载并校验' : ' 已安装'}`, `Engine CLIProxyAPI v${version} ${installed ? 'downloaded and verified' : 'already installed'}`));
+    const { created } = ensureDshKey(keys);
+    if (created)
+        await saveKeys(ctx, keys);
+    if (opts.port)
+        config.port = opts.port;
+    if (!(await isPortFree(config.port)) && !(await portIsOurs(config.port, keys))) {
+        const free = await findFreePort(config.port + 1);
+        warn(L(`端口 ${config.port} 被其他程序占用，改用 ${free}`, `Port ${config.port} is taken by another program; using ${free}`));
+        config.port = free;
+    }
+    await saveAll(ctx, all);
+    await applyEngineConfig(ctx, all);
+    if (ctx.serviceDisabled) {
+        skip(L('已跳过系统服务（DSH_MODEL_SERVICE=none）', 'Skipped system service (DSH_MODEL_SERVICE=none)'));
+    }
+    else {
+        const svc = serviceFor(ctx);
+        await svc.install();
+        state.service = { kind: svc.kind, file: svc.spec.file, label: svc.spec.label };
+        await saveAll(ctx, all);
+        if (installed)
+            await svc.restart();
+    }
+    if (!(await waitHealthy(config.port, ctx.serviceDisabled ? 1500 : 15_000))) {
+        if (ctx.serviceDisabled) {
+            warn(L('引擎未运行（服务已跳过）', 'Engine not running (service skipped)'));
+            return false;
+        }
+        throw new DshModelError('engine_unhealthy', L(`引擎没有在 127.0.0.1:${config.port} 上启动`, `Engine did not come up on 127.0.0.1:${config.port}`), L('查看日志：dsh-model logs', 'Check logs: dsh-model logs'));
+    }
+    const unauth = await unauthStatus(config.port);
+    if (unauth !== 401)
+        throw new DshModelError('auth_not_enforced', L(`不带 key 的请求返回了 ${unauth}（应为 401），已停止`, `Unauthenticated request returned ${unauth} (expected 401); stopping`));
+    ok(L(`引擎已在 127.0.0.1:${config.port} 运行，鉴权已生效`, `Engine running on 127.0.0.1:${config.port} with auth enforced`));
+    return true;
+}
+async function portIsOurs(port, keys) {
+    for (const k of keys.keys.filter((x) => !x.revokedAt)) {
+        try {
+            await listModels(port, k.key);
+            return true;
+        }
+        catch {
+            // 不是我们
+        }
+    }
+    return false;
+}

package/dist/commands/sources.js

@@ -0,0 +1,196 @@
+// commands/sources.ts — 来源开关与登录（CLI 版；dsh 插件页调同一套守护进程接口）
+//   dsh-model sources
+//   dsh-model source enable|disable|logout <来源> [--accept-risk]
+//   dsh-model stats
+import { createInterface } from 'node:readline';
+import { control } from '../daemon/client.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { bold, dim, green, info, isJsonMode, ok, printJson, red, table, warn, yellow } from '../util/output.js';
+import { canPrompt } from '../util/prompt.js';
+/** "2 小时 13 分后重置" */
+function untilText(iso) {
+    if (!iso)
+        return '';
+    const ms = Date.parse(iso) - Date.now();
+    if (!(ms > 0))
+        return L('即将重置', 'resetting');
+    const m = Math.round(ms / 60000);
+    const d = Math.floor(m / 1440);
+    const h = Math.floor((m % 1440) / 60);
+    const mm = m % 60;
+    const t = d ? L(`${d} 天 ${h} 小时`, `${d}d ${h}h`) : h ? L(`${h} 小时 ${mm} 分`, `${h}h ${mm}m`) : L(`${mm} 分`, `${mm}m`);
+    return L(`${t}后重置`, `resets in ${t}`);
+}
+function bar(pct) {
+    const n = Math.max(0, Math.min(10, Math.round(pct / 10)));
+    const s = '█'.repeat(n) + '░'.repeat(10 - n);
+    return pct >= 90 ? red(s) : pct >= 70 ? yellow(s) : green(s);
+}
+/** 每个来源的用量行（设计 §14.6） */
+export function usageLines(s) {
+    const u = s.usage;
+    if (!u)
+        return [];
+    if (u.noAccess)
+        return [yellow(L(`    当前账号没有可用订阅（调用会被拒绝、不扣费），模型已在 dsh 中隐藏${s.subscribeUrl ? `；开通：${s.subscribeUrl}` : ''}`, `    No usable subscription on this account (calls refused, no charge); its models are hidden in dsh${s.subscribeUrl ? `; subscribe: ${s.subscribeUrl}` : ''}`))];
+    if (u.unsupported)
+        return [dim(L('    已实测可以调用；用量暂不支持查询', '    tested OK; usage not available yet'))];
+    const out = [];
+    for (const w of u.windows) {
+        const pct = w.usedPercent;
+        const amount = w.used !== undefined && w.limit !== undefined ? `  ${w.used}/${w.limit}` : '';
+        out.push(`    ${w.label.padEnd(8)} ${pct !== undefined ? `${bar(pct)} ${Math.round(pct)}%` : ''}${amount}  ${dim(untilText(w.resetAt))}`);
+    }
+    if (u.credits) {
+        const c = u.credits;
+        out.push(`    ${L('积分', 'credits')}     ${c.unlimited ? L('不限量', 'unlimited') : L(`剩余 ${c.remaining.toLocaleString()}${c.total ? ` / ${c.total.toLocaleString()}` : ''}`, `${c.remaining.toLocaleString()} left${c.total ? ` of ${c.total.toLocaleString()}` : ''}`)}`);
+    }
+    if (u.plan)
+        out.unshift(dim(`    ${L('套餐', 'plan')}：${u.plan}`));
+    if (u.error)
+        out.push(yellow(L(`    用量暂不可用：${u.error}`, `    usage unavailable: ${u.error}`)));
+    return out;
+}
+export function pricingTag(s) {
+    const t = s.pricing?.tier;
+    return t === 'free' ? green(L('免费', 'free')) : t === 'limited' ? yellow(L('免费·额度少', 'free·limited')) : t === 'paid' ? red(L('需付费', 'paid')) : '-';
+}
+export async function sources(ctx, opts = {}) {
+    // 高风险来源（Claude、Antigravity）默认不列出；已登录的照常显示，方便退出登录
+    const list = (await control(ctx, 'GET', '/sources?refresh=1')).filter((s) => opts.all || !s.risky || s.loggedIn);
+    if (isJsonMode()) {
+        printJson(list);
+        return 0;
+    }
+    info(table([
+        [L('开关', 'On'), L('来源', 'Source'), L('费用', 'Cost'), L('状态', 'State'), L('账号', 'Account'), L('模型', 'Models')],
+        ...list.map((s) => [
+            s.enabled ? green('●') : dim('○'),
+            s.id,
+            pricingTag(s),
+            s.loggedIn ? (s.usage?.noAccess ? yellow(L('已登录·无订阅', 'signed in · no plan')) : s.enabled ? green(L('已接入', 'connected')) : yellow(L('已登录·关闭', 'signed in · off'))) : dim(L('未登录', 'signed out')),
+            s.account ?? (s.detail ? dim(s.detail.slice(0, 40)) : '-'),
+            s.models ? String(s.models) : '-',
+        ]),
+    ]));
+    const unpaid = list.filter((s) => !s.loggedIn && s.pricing);
+    if (unpaid.length) {
+        info(bold(L('\n费用说明', '\nCost')));
+        for (const s of unpaid)
+            info(`  ${s.id.padEnd(13)}${L(s.pricing.zh, s.pricing.en)}${s.subscribeUrl ? dim(`  ${s.subscribeUrl}`) : ''}`);
+    }
+    const withUsage = list.filter((s) => s.usage);
+    if (withUsage.length) {
+        info(bold(L('\n订阅用量', '\nSubscription usage')));
+        for (const s of withUsage) {
+            info(`  ${s.label}${s.account ? dim(`  ${s.account}`) : ''}`);
+            for (const line of usageLines(s))
+                info(line);
+        }
+    }
+    info(dim(L('\n打开：dsh-model source enable <来源>   关闭：dsh-model source disable <来源>   高风险来源（Claude、Antigravity）：dsh-model sources --all', '\nTurn on: dsh-model source enable <source>   off: dsh-model source disable <source>   High-risk sources (Claude, Antigravity): dsh-model sources --all')));
+    return 0;
+}
+export async function source(ctx, sub, id, opts) {
+    if (!sub || !id || !['enable', 'disable', 'logout', 'on', 'off'].includes(sub)) {
+        throw new DshModelError('usage', L('用法：dsh-model source enable|disable|logout <来源>', 'Usage: dsh-model source enable|disable|logout <source>'));
+    }
+    if (sub === 'disable' || sub === 'off') {
+        await control(ctx, 'POST', `/sources/${id}/disable`);
+        ok(L(`${id} 已关闭（登录保留）`, `${id} turned off (sign-in kept)`));
+        return 0;
+    }
+    if (sub === 'logout') {
+        await control(ctx, 'POST', `/sources/${id}/logout`);
+        ok(L(`${id} 已退出登录`, `${id} signed out`));
+        return 0;
+    }
+    return enableInteractive(ctx, id, opts);
+}
+/** 打开一个来源；需要登录就在终端里完成（打印链接 / 码，回调式等你贴回地址） */
+export async function enableInteractive(ctx, id, opts = {}) {
+    const r = await control(ctx, 'POST', `/sources/${id}/enable`, { acceptRisk: Boolean(opts.acceptRisk) });
+    if (r.riskNotice) {
+        info(r.riskNotice);
+        return 2;
+    }
+    if (r.enabled) {
+        ok(L(`${id} 已接入`, `${id} connected`));
+        return 0;
+    }
+    if (!r.login)
+        throw new DshModelError('enable_failed', L(`${id} 没能打开`, `Could not turn on ${id}`));
+    return runLogin(ctx, id, r.login);
+}
+async function runLogin(ctx, id, s) {
+    info('');
+    info(bold(L('在任意设备的浏览器里打开下面的链接并授权：', 'Open this link in a browser on any device and approve:')));
+    info(`\n  ${s.url}\n`);
+    if (s.userCode)
+        info(L(`  授权页要求输入的码：${bold(s.userCode)}\n`, `  Code to enter on that page: ${bold(s.userCode)}\n`));
+    let rl;
+    if (s.needsPaste) {
+        info(L('授权后浏览器会跳到一个打不开的 localhost 地址——把地址栏里的完整地址粘贴到这里，回车。', 'After approving, the browser lands on a localhost address that will not load — paste that full address here and press Enter.'));
+        if (canPrompt()) {
+            rl = createInterface({ input: process.stdin, output: process.stdout });
+            rl.question(L('跳转地址：', 'Redirected address: '), (answer) => {
+                const url = answer.trim();
+                if (url) {
+                    void control(ctx, 'POST', `/login/${s.id}/callback`, { redirectUrl: url }).catch((e) => warn(String(e.message)));
+                }
+            });
+        }
+    }
+    else {
+        info(L('等待授权中（Ctrl+C 取消）…', 'Waiting for approval (Ctrl+C to cancel)…'));
+    }
+    try {
+        for (;;) {
+            await new Promise((r) => setTimeout(r, 2000));
+            const st = await control(ctx, 'GET', `/login/${s.id}`);
+            if (st.status === 'ok') {
+                ok(L(`${id} 已登录并接入`, `${id} signed in and connected`));
+                return 0;
+            }
+            if (st.status === 'error' || st.status === 'cancelled') {
+                warn(L(`登录没有完成：${st.error ?? st.status}`, `Login did not complete: ${st.error ?? st.status}`));
+                return 1;
+            }
+        }
+    }
+    finally {
+        rl?.close();
+    }
+}
+const pct = (w) => (w.successRate == null ? '-' : `${Math.round(w.successRate * 100)}%`);
+const ms = (w) => (w.avgLatencyMs == null ? '-' : w.avgLatencyMs >= 1000 ? `${(w.avgLatencyMs / 1000).toFixed(1)}s` : `${w.avgLatencyMs}ms`);
+const tps = (w) => (w.tokensPerSec == null ? '-' : `${w.tokensPerSec}`);
+const rate = (w) => {
+    const p = w.successRate;
+    const s = pct(w);
+    return p == null ? s : p >= 0.98 ? green(s) : p >= 0.9 ? yellow(s) : red(s);
+};
+export async function stats(ctx) {
+    const snap = await control(ctx, 'GET', '/stats');
+    if (isJsonMode()) {
+        printJson(snap);
+        return 0;
+    }
+    const rows = (title, m) => {
+        const entries = Object.entries(m).sort((a, b) => b[1].d1.requests - a[1].d1.requests);
+        if (!entries.length)
+            return;
+        info(bold(`\n${title}`));
+        info(table([
+            ['', L('请求(1h/24h)', 'Req (1h/24h)'), L('成功率', 'Success'), L('平均延迟', 'Avg latency'), 'tokens/s', L('最近失败', 'Last failure')],
+            ...entries.map(([k, v]) => [k, `${v.h1.requests}/${v.d1.requests}`, rate(v.d1), ms(v.d1), tps(v.d1), v.d1.lastFailureAt ? v.d1.lastFailureAt.slice(5, 16).replace('T', ' ') : '-']),
+        ]));
+    };
+    rows(L('按 key', 'By key'), snap.byKey);
+    rows(L('按来源', 'By source'), snap.bySource);
+    rows(L('按模型', 'By model'), snap.byModel);
+    if (!Object.keys(snap.byKey).length)
+        info(dim(L('还没有请求记录', 'No requests recorded yet')));
+    return 0;
+}

package/dist/commands/status.js

@@ -0,0 +1,216 @@
+// commands/status.ts — status（一屏总览）与 doctor（逐项检查，--e2e 实测每个模型）
+import { join } from 'node:path';
+import { availableVariants, bridgeConfigPath, loadBridgeConfig, loadCatalogs } from '../bridge/runtime.js';
+import { anyProviderPresent } from '../dsh/connect.js';
+import { KEY_REF, readRef } from '../dsh/credentials.js';
+import { listAuthFiles, summarize } from '../engine/auth.js';
+import { healthy, listModels, probeStream, probeToolCall, unauthStatus } from '../engine/client.js';
+import { currentBinary, currentVersion } from '../engine/install.js';
+import { L } from '../i18n.js';
+import { opencodeConfigured } from '../integrations/opencode.js';
+import { bridgeHealthy, userPluginInstalled } from '../integrations/workbuddy.js';
+import { findActive, DSH_KEY_NAME } from '../keys.js';
+import { loadAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { UPSTREAMS } from '../upstreams.js';
+import { exists, fileMode, readText, sha256 } from '../util/fs.js';
+import { dim, green, info, isJsonMode, printJson, red, table, yellow } from '../util/output.js';
+import { proxyReachable, redactProxy } from '../util/proxy.js';
+/** 模型 id 的分组：opencode/… workbuddy/… 其余算订阅 */
+function groupCounts(models) {
+    const g = new Map();
+    for (const m of models) {
+        const k = m.id.includes('/') ? m.id.split('/')[0] : 'subscription';
+        g.set(k, (g.get(k) ?? 0) + 1);
+    }
+    return g;
+}
+export async function status(ctx) {
+    const all = await loadAll(ctx);
+    const key = findActive(all.keys, DSH_KEY_NAME)?.key;
+    const engineInstalled = await exists(currentBinary(ctx));
+    const version = engineInstalled ? await currentVersion(ctx) : null;
+    const svc = engineInstalled && !ctx.serviceDisabled ? await serviceFor(ctx).status() : null;
+    const up = engineInstalled ? await healthy(all.config.port) : false;
+    const models = up && key ? await listModels(all.config.port, key).catch(() => []) : [];
+    const groups = groupCounts(models);
+    const { byUpstream } = summarize(await listAuthFiles(ctx));
+    const dshOk = await anyProviderPresent(all.state).catch(() => false);
+    const oc = await opencodeConfigured(ctx);
+    const bridgeCfg = await loadBridgeConfig(ctx.paths.home);
+    const bridgeUp = bridgeCfg ? await bridgeHealthy(bridgeCfg.port, bridgeCfg.secret) : false;
+    const cats = await loadCatalogs(ctx.paths.home);
+    const apps = await availableVariants(ctx.paths.home);
+    const logged = UPSTREAMS.filter((u) => byUpstream[u.id]?.length).map((u) => u.id);
+    const data = {
+        mode: ctx.mode,
+        home: ctx.paths.home,
+        endpoint: { version, running: up, port: all.config.port, service: svc, models: Object.fromEntries(groups) },
+        opencode: { configured: oc, models: groups.get('opencode') ?? 0 },
+        workbuddy: { apps: apps.map((v) => v.displayName), bridge: bridgeCfg ? { port: bridgeCfg.port, running: bridgeUp } : null, catalogs: cats.map((c) => ({ label: c.label, signedIn: c.signedIn, models: c.models.length, error: c.error })) },
+        subscriptions: logged,
+        dsh: all.state.dsh ? { profile: all.state.dsh.profile, providerPresent: dshOk } : null,
+        remote: all.config.remote.mode,
+        proxy: all.config.proxy ? redactProxy(all.config.proxy) : null,
+        keys: all.keys.keys.filter((k) => !k.revokedAt).map((k) => k.name),
+    };
+    if (isJsonMode()) {
+        printJson(data);
+        return 0;
+    }
+    const yes = (b, t, f) => (b ? green(t) : red(f));
+    const wbLine = !apps.length
+        ? dim(L('未登录（dsh-model workbuddy login）', 'not signed in (dsh-model workbuddy login)'))
+        : !bridgeCfg
+            ? yellow(L('未启用（dsh-model workbuddy enable）', 'not enabled (dsh-model workbuddy enable)'))
+            : !bridgeUp
+                ? red(L(`bridge 没在运行（127.0.0.1:${bridgeCfg.port}，dsh-model repair）`, `bridge not running (127.0.0.1:${bridgeCfg.port}, dsh-model repair)`))
+                : cats.map((c) => (c.signedIn ? green(`${c.label} ${c.models.length}`) : yellow(L(`${c.label} 未登录`, `${c.label} signed out`)))).join(' · ') || yellow(L('目录还没读到', 'catalog not read yet'));
+    info(table([
+        [L('统一端点', 'Endpoint'), engineInstalled ? yes(up, `127.0.0.1:${all.config.port}`, L('未运行（dsh-model repair）', 'not running (dsh-model repair)')) + dim(`  v${version ?? '-'}${svc ? ` · ${svc.detail ?? '-'}` : ''}`) : red(L('未安装（dsh-model setup）', 'not installed (dsh-model setup)'))],
+        [L('模型', 'Models'), models.length ? [...groups].map(([g, n]) => `${g === 'subscription' ? L('订阅', 'subscription') : g} ${n}`).join(' · ') : yellow('0')],
+        ['OpenCode Zen', oc ? green(L(`已配置 · ${groups.get('opencode') ?? 0} 个模型`, `configured · ${groups.get('opencode') ?? 0} models`)) : yellow(L('未配置（dsh-model opencode key）', 'not configured (dsh-model opencode key)'))],
+        ['WorkBuddy', wbLine],
+        [L('订阅', 'Subscriptions'), logged.length ? logged.join(', ') : dim(L('无（dsh-model login <上游>）', 'none (dsh-model login <upstream>)'))],
+        ['dsh', data.dsh ? yes(dshOk, `${data.dsh.profile} ✓`, L(`${data.dsh.profile}：provider 不在了（dsh-model repair）`, `${data.dsh.profile}: provider missing (dsh-model repair)`)) : yellow(L('未接入', 'not connected'))],
+        [L('远程访问', 'Remote'), all.config.remote.mode],
+        [L('出站代理', 'Proxy'), data.proxy ?? L('不使用', 'none')],
+        ['Keys', data.keys.join(', ') || '-'],
+    ]));
+    return 0;
+}
+export async function doctor(ctx, opts) {
+    const all = await loadAll(ctx);
+    const checks = [];
+    const add = (id, level, message) => checks.push({ id, level, message });
+    const key = findActive(all.keys, DSH_KEY_NAME)?.key;
+    const homeMode = await fileMode(ctx.paths.home);
+    if (homeMode == null)
+        add('home', 'fail', L(`${ctx.paths.home} 不存在（先 setup）`, `${ctx.paths.home} missing (run setup)`));
+    else
+        add('home', homeMode & 0o077 ? 'warn' : 'ok', L(`home 权限 ${homeMode.toString(8)}`, `home mode ${homeMode.toString(8)}`));
+    for (const [id, file] of [['keys', ctx.paths.keys], ['engine-yaml', ctx.paths.engineYaml], ['secrets', join(ctx.paths.home, 'secrets.json')], ['bridge-config', bridgeConfigPath(ctx.paths.home)]]) {
+        const m = await fileMode(file);
+        if (m != null)
+            add(id, m & 0o077 ? 'warn' : 'ok', `${file.split('/').pop()} ${m.toString(8)}`);
+    }
+    const authFiles = await listAuthFiles(ctx);
+    const loose = [];
+    for (const f of authFiles)
+        if (((await fileMode(join(ctx.paths.auth, f))) ?? 0) & 0o077)
+            loose.push(f);
+    if (authFiles.length)
+        add('auth-perms', loose.length ? 'warn' : 'ok', loose.length ? L(`凭据文件权限过宽：${loose.join(', ')}`, `Credential files too permissive: ${loose.join(', ')}`) : L(`订阅凭据 ${authFiles.length} 个，权限正常`, `${authFiles.length} subscription credentials, permissions OK`));
+    const { byUpstream, other } = summarize(authFiles);
+    const multi = Object.entries(byUpstream).filter(([, f]) => f.length > 1);
+    if (multi.length)
+        add('single-account', 'warn', L(`同一上游有多个账号：${multi.map(([u]) => u).join(', ')}`, `Multiple accounts for: ${multi.map(([u]) => u).join(', ')}`));
+    if (other.length)
+        add('unknown-auth', 'warn', L(`不认识的凭据文件：${other.join(', ')}`, `Unrecognized credential files: ${other.join(', ')}`));
+    // —— 统一端点 ——
+    const engineInstalled = await exists(currentBinary(ctx));
+    const version = engineInstalled ? await currentVersion(ctx) : null;
+    add('engine', engineInstalled ? (version === all.config.engine.version ? 'ok' : 'warn') : 'fail', engineInstalled ? `v${version}` : L('未安装（dsh-model setup）', 'not installed (dsh-model setup)'));
+    if (engineInstalled && !ctx.serviceDisabled) {
+        const s = await serviceFor(ctx).status();
+        add('engine-service', s.running ? 'ok' : 'fail', `${serviceFor(ctx).kind}: ${s.detail ?? '-'}`);
+    }
+    if (all.config.proxy) {
+        const reach = await proxyReachable(all.config.proxy);
+        add('proxy', reach ? 'ok' : 'fail', reach ? L(`代理 ${redactProxy(all.config.proxy)} 可连接`, `Proxy ${redactProxy(all.config.proxy)} reachable`) : L(`代理 ${redactProxy(all.config.proxy)} 连不上（代理软件没开？dsh-model setup --proxy <地址>|none）`, `Proxy ${redactProxy(all.config.proxy)} unreachable (proxy app not running? dsh-model setup --proxy <url>|none)`));
+    }
+    const up = engineInstalled ? await healthy(all.config.port) : false;
+    if (engineInstalled)
+        add('healthz', up ? 'ok' : 'fail', `127.0.0.1:${all.config.port}`);
+    if (up) {
+        const code = await unauthStatus(all.config.port);
+        add('auth-enforced', code === 401 ? 'ok' : 'fail', L(`不带 key 请求返回 ${code}`, `unauthenticated request → ${code}`));
+    }
+    let models = [];
+    if (up && key) {
+        try {
+            models = await listModels(all.config.port, key);
+            const g = groupCounts(models);
+            add('models', models.length ? 'ok' : 'warn', models.length ? [...g].map(([k, n]) => `${k} ${n}`).join(' · ') : L('0 个模型', '0 models'));
+        }
+        catch (error) {
+            add('models', 'fail', String(error.message));
+        }
+    }
+    // —— OpenCode / WorkBuddy ——
+    const oc = await opencodeConfigured(ctx);
+    const ocModels = models.filter((m) => m.id.startsWith('opencode/')).length;
+    add('opencode', !oc ? 'warn' : up && !ocModels ? 'fail' : 'ok', !oc ? L('OpenCode Zen 未配置（dsh-model opencode key）', 'OpenCode Zen not configured (dsh-model opencode key)') : up && !ocModels ? L('已配置但引擎里没有 opencode/ 模型（dsh-model repair）', 'configured but no opencode/ models in the engine (dsh-model repair)') : L(`OpenCode Zen：${ocModels} 个模型`, `OpenCode Zen: ${ocModels} models`));
+    const apps = await availableVariants(ctx.paths.home);
+    const bridgeCfg = await loadBridgeConfig(ctx.paths.home);
+    // 守护进程（来源开关、登录、统计、WorkBuddy 转发）总要在跑；只有刻意跳过系统服务时不查
+    if (!ctx.serviceDisabled) {
+        if (!bridgeCfg)
+            add('daemon', 'fail', L('守护进程没配置（dsh-model setup）', 'Daemon not configured (dsh-model setup)'));
+        else {
+            const bUp = await bridgeHealthy(bridgeCfg.port, bridgeCfg.secret);
+            add('daemon', bUp ? 'ok' : 'fail', bUp ? L(`守护进程 127.0.0.1:${bridgeCfg.port} 运行中`, `daemon 127.0.0.1:${bridgeCfg.port} running`) : L('守护进程没在运行（dsh-model logs --bridge；dsh-model repair）', 'daemon not running (dsh-model logs --bridge; dsh-model repair)'));
+        }
+    }
+    if (apps.length && bridgeCfg) {
+        {
+            for (const c of await loadCatalogs(ctx.paths.home)) {
+                const inEngine = models.filter((m) => m.id.startsWith(`${c.prefix}/`)).length;
+                if (!c.signedIn)
+                    add(`workbuddy-${c.key}`, 'warn', L(`${c.label}：未登录${c.error ? `（${c.error}）` : ''}——在 App 里登录后执行 dsh-model workbuddy refresh`, `${c.label}: signed out${c.error ? ` (${c.error})` : ''} — sign in to the app, then dsh-model workbuddy refresh`));
+                else
+                    add(`workbuddy-${c.key}`, up && !inEngine ? 'fail' : 'ok', L(`${c.label}：已登录，${c.models.length} 个模型${up ? `（引擎里 ${inEngine} 个）` : ''}${c.error ? `；${c.error}` : ''}`, `${c.label}: signed in, ${c.models.length} models${up ? ` (${inEngine} in engine)` : ''}${c.error ? `; ${c.error}` : ''}`));
+            }
+        }
+        if (await userPluginInstalled(ctx, all))
+            add('workbuddy-plugin', 'warn', L('同时装了 dsh-workbuddy-connect 插件：dsh 里会有两组 WorkBuddy 模型', 'dsh-workbuddy-connect is also installed: dsh shows two WorkBuddy groups'));
+    }
+    // —— dsh 接线 ——
+    if (all.state.dsh) {
+        const d = all.state.dsh;
+        const present = await anyProviderPresent(all.state).catch(() => false);
+        add('dsh-provider', present ? 'ok' : models.length ? 'fail' : 'warn', present ? L(`dsh（${d.profile}）里有 dsh-model`, `dsh-model present in dsh (${d.profile})`) : models.length ? L('dsh 里没有 dsh-model（dsh-model repair）', 'dsh-model missing in dsh (dsh-model repair)') : L('dsh 里还没有 dsh-model：引擎里还没有模型', 'dsh-model not in dsh yet: the engine has no models'));
+        const credText = await readText(d.credFile);
+        add('dsh-key', readRef(credText) === key ? 'ok' : 'fail', readRef(credText) === key ? L(`${KEY_REF} 与 key 一致`, `${KEY_REF} matches`) : L(`${KEY_REF} 与 key 不一致（dsh-model repair）`, `${KEY_REF} does not match (dsh-model repair)`));
+        const cm = await fileMode(d.credFile);
+        if (cm != null)
+            add('dsh-cred-perms', cm === 0o600 ? 'ok' : 'fail', L(`.credentials.yaml 权限 ${cm.toString(8)}（dsh 要求 600）`, `.credentials.yaml mode ${cm.toString(8)} (dsh requires 600)`));
+        const patchText = await readText(d.patchFile);
+        if (patchText != null && d.writtenPatchSha && sha256(patchText) !== d.writtenPatchSha) {
+            add('dsh-patch-edited', 'ok', L('cordis.patch.yml 在接线后被修改过（卸载时只会移除 dsh-model 的部分）', 'cordis.patch.yml edited since connect (uninstall will remove only dsh-model parts)'));
+        }
+    }
+    else {
+        add('dsh-provider', 'warn', L('还没接入 dsh（dsh-model setup）', 'Not connected to dsh (dsh-model setup)'));
+    }
+    if (ctx.env[KEY_REF])
+        add('env-override', 'warn', L(`环境变量 ${KEY_REF} 会覆盖 dsh 凭据里的值`, `Env var ${KEY_REF} overrides the value in dsh credentials`));
+    if ((await exists('/etc/caddy/dsh-model.conf')) && all.config.remote.mode !== 'caddy')
+        add('caddy-orphan', 'warn', L('发现残留的 /etc/caddy/dsh-model.conf', 'Found leftover /etc/caddy/dsh-model.conf'));
+    // —— e2e：默认每组（订阅按 owned_by，opencode/workbuddy 按前缀）取一个模型 ——
+    const e2e = [];
+    if (opts.e2e && key && models.length) {
+        const groupOf = (m) => (m.id.includes('/') ? m.id.split('/')[0] : (m.owned_by ?? m.id));
+        const pick = opts.model ? models.filter((m) => m.id === opts.model) : opts.all ? models : [...new Map(models.map((m) => [groupOf(m), m])).values()];
+        for (const m of pick) {
+            const s = await probeStream(all.config.port, key, m.id);
+            const t = await probeToolCall(all.config.port, key, m.id);
+            e2e.push({ model: m.id, stream: s.detail, tool: t.detail, ok: s.ok && t.ok });
+        }
+    }
+    const failed = checks.some((c) => c.level === 'fail') || e2e.some((r) => !r.ok);
+    if (isJsonMode()) {
+        printJson({ ok: !failed, checks, e2e });
+        return failed ? 1 : 0;
+    }
+    const mark = (l) => (l === 'ok' ? green('✓') : l === 'warn' ? yellow('!') : red('✗'));
+    info(table(checks.map((c) => [mark(c.level), c.id, c.message])));
+    if (e2e.length) {
+        info('');
+        info(table([[L('模型', 'Model'), L('流式', 'Stream'), L('工具调用', 'Tool call')], ...e2e.map((r) => [`${r.ok ? green('✓') : red('✗')} ${r.model}`, r.stream, r.tool])]));
+    }
+    else if (opts.e2e) {
+        info(yellow(L('没有可测的模型', 'No models to test')));
+    }
+    return failed ? 1 : 0;
+}