dsh-model 0.0.1 → 0.15.0

package/dist/bridge/workbuddy/variants.js

@@ -0,0 +1,101 @@
+// Ported from dsh-workbuddy-connect v0.7.1 (commit 390582e04da4e8e8bf746d71997440e4b716ec47),
+// https://github.com/corrinehu/dsh-workbuddy-connect — MIT License, Copyright (c) 2026 Corrine Hu.
+// See LICENSE.dsh-workbuddy-connect in this directory. Changes: imports adapted to dsh-model (./_compat.js).
+/**
+ * The two WorkBuddy desktop apps this one plugin serves.
+ *
+ * Both products are the same client framework in different regions, and both
+ * write their sign-in into the *same* shared `CodeBuddyExtension` auth
+ * directory — they differ by file basename, base URL, catalog endpoint, and
+ * display identity. Everything that varies between them is collected here as
+ * one descriptor, so no module has to carry its own `if (international)`
+ * branch and a third variant would be a data change rather than a refactor.
+ *
+ * This module is host-side (it names files and env vars). The browser half
+ * takes the same ids and routes from the Node-free `status-paths.ts`, which
+ * stays the single source shared by both halves.
+ *
+ * @module dsh-workbuddy-connect/variants
+ */
+import { WORKBUDDY_AI_STATUS_PATH, WORKBUDDY_AI_PROBE_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_STATUS_PATH } from './status-paths.js';
+/** CN WorkBuddy first: the existing provider keeps its id, paths, and copy. */
+export const WORKBUDDY_VARIANTS = [
+    {
+        id: 'workbuddy',
+        displayName: 'WorkBuddy',
+        appName: 'WorkBuddy',
+        region: 'cn',
+        env: 'WORKBUDDY_AUTH_FILE',
+        electron: {
+            productName: 'WorkBuddy',
+            envVar: 'WORKBUDDY_ELECTRON_BIN',
+            macOS: {
+                bundleId: 'com.tencent.workbuddy.mac',
+                defaultPath: '/Applications/WorkBuddy.app/Contents/MacOS/Electron',
+            },
+            windows: {
+                displayNamePattern: /^WorkBuddy(?:\s+\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.-]+)?)?$/u,
+                exeBasename: 'workbuddy.exe',
+                defaultPathSegments: ['Programs', 'WorkBuddy', 'WorkBuddy.exe'],
+            },
+        },
+        desktopFilename: 'workbuddy-desktop.info',
+        ownFilename: '.workbuddy-auth.json',
+        probeFilename: '.workbuddy-probe.json',
+        catalogFilename: '.workbuddy-catalog.json',
+        visibilityFilename: '.workbuddy-model-visibility.json',
+        statusPath: WORKBUDDY_STATUS_PATH,
+        probePath: WORKBUDDY_PROBE_PATH,
+    },
+    {
+        id: 'workbuddy-ai',
+        displayName: 'WorkBuddy AI',
+        appName: 'WorkBuddy AI',
+        region: 'global',
+        env: 'WORKBUDDY_AI_AUTH_FILE',
+        electron: {
+            productName: 'WorkBuddy AI',
+            envVar: 'WORKBUDDY_AI_ELECTRON_BIN',
+            macOS: {
+                bundleId: 'com.workbuddy.workbuddy-ai',
+                defaultPath: '/Applications/WorkBuddy AI.app/Contents/MacOS/Electron',
+            },
+            windows: {
+                // Measured in #60: `WorkBuddy AI 5.6.2`. The CN pattern cannot match
+                // this value ("AI" is not a version) and this pattern cannot match
+                // `WorkBuddy 5.6.2` (missing the literal " AI"), so the two records
+                // never feed each other's discovery.
+                displayNamePattern: /^WorkBuddy AI(?:\s+\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.-]+)?)?$/u,
+                exeBasename: 'workbuddyai.exe',
+            },
+        },
+        desktopFilename: 'workbuddy-desktop-ai.info',
+        ownFilename: '.workbuddy-ai-auth.json',
+        probeFilename: '.workbuddy-ai-probe.json',
+        catalogFilename: '.workbuddy-ai-catalog.json',
+        visibilityFilename: '.workbuddy-ai-model-visibility.json',
+        statusPath: WORKBUDDY_AI_STATUS_PATH,
+        probePath: WORKBUDDY_AI_PROBE_PATH,
+    },
+];
+/** The CN variant; the plugin's long-standing default and compatibility anchor. */
+export const CN_VARIANT = WORKBUDDY_VARIANTS[0];
+/** The international variant. */
+export const AI_VARIANT = WORKBUDDY_VARIANTS[1];
+/** Look up a variant by provider id. */
+export function variantFor(id) {
+    return WORKBUDDY_VARIANTS.find(variant => variant.id === id);
+}
+/**
+ * The Electron profile a variant resolves with.
+ *
+ * Callers inside the plugin pass their known-complete variants; descriptors
+ * assembled outside (the type is public and predates the profile) fall back
+ * by variant id, so an id-less or unknown custom variant stays on the CN
+ * product — the same default the store's other legacy fields assume.
+ */
+export function electronProfileFor(variant) {
+    // Both shipped variants always carry their profile; the optional marker
+    // exists only for externally assembled descriptors, hence the assertion.
+    return variant?.electron ?? (variant?.id === AI_VARIANT.id ? AI_VARIANT : CN_VARIANT).electron;
+}

package/dist/cli.js

@@ -0,0 +1,215 @@
+// cli.ts — 参数解析与分发；统一错误输出（中英双语）与退出码
+import { parseArgs } from 'node:util';
+import { connect, disconnect, models } from './commands/connect.js';
+import { engine } from './commands/engine.js';
+import { key } from './commands/key.js';
+import { logs } from './commands/logs.js';
+import { remote } from './commands/remote.js';
+import { repair, service } from './commands/service.js';
+import { setup } from './commands/setup.js';
+import { doctor, status } from './commands/status.js';
+import { uninstall } from './commands/uninstall.js';
+import { selfUpdate } from './commands/self.js';
+import { opencode } from './commands/opencode.js';
+import { workbuddy } from './commands/workbuddy.js';
+import { bridge } from './commands/bridge.js';
+import { enableInteractive, source, sources, stats } from './commands/sources.js';
+import { createContext } from './context.js';
+import { isDshModelError } from './errors.js';
+import { L, initLang } from './i18n.js';
+import { UPSTREAMS } from './upstreams.js';
+import { dim, fail, isJsonMode, printJson, setJsonMode } from './util/output.js';
+import { pkgVersion } from './util/pkg.js';
+const OPTIONS = {
+    lang: { type: 'string' },
+    json: { type: 'boolean' },
+    help: { type: 'boolean', short: 'h' },
+    version: { type: 'boolean', short: 'v' },
+    port: { type: 'string' },
+    profile: { type: 'string' },
+    force: { type: 'boolean' },
+    'dry-run': { type: 'boolean' },
+    yes: { type: 'boolean', short: 'y' },
+    'keep-auth': { type: 'boolean' },
+    device: { type: 'boolean' },
+    replace: { type: 'boolean' },
+    'accept-risk': { type: 'boolean' },
+    via: { type: 'string' },
+    domain: { type: 'string' },
+    e2e: { type: 'boolean' },
+    all: { type: 'boolean' },
+    model: { type: 'string' },
+    lines: { type: 'string' },
+    proxy: { type: 'string' },
+    bridge: { type: 'boolean' },
+    'skip-opencode': { type: 'boolean' },
+    'skip-workbuddy': { type: 'boolean' },
+    'skip-dsh-plugin': { type: 'boolean' },
+    stdin: { type: 'boolean' },
+    'skip-verify': { type: 'boolean' },
+    to: { type: 'string' },
+    'remove-plugin': { type: 'boolean' },
+};
+function help() {
+    const ups = UPSTREAMS.map((u) => u.id).join('|');
+    return L(`dsh-model ${pkgVersion()} — 把你自己的 CLI 订阅接进 dsh（本机 OpenAI 兼容端点，默认鉴权，可干净卸载）
+
+用法：dsh-model <命令> [选项]
+
+  setup [--profile P] [--proxy URL|none] [--skip-opencode] [--skip-workbuddy]
+                                       一键安装统一端点，接入 OpenCode Zen（你的 key）与 WorkBuddy（自有 bridge），并接进 dsh；可重复执行
+  opencode [status|key|remove] [--stdin] [--skip-verify]
+                                       OpenCode Zen：设置 / 更换 key，或移除
+  workbuddy [status|login [cn|ai]|logout [cn|ai]|enable|refresh|disable]
+                                       WorkBuddy：桌面 App 登录态，或 login 打印链接、在任意浏览器授权（服务器可用）
+  sources                              来源列表：开关、登录状态、账号、模型数
+  source enable|disable|logout <来源> [--accept-risk]
+                                       打开（未登录就打印链接登录）/ 关闭（保留登录）/ 退出登录
+  login <来源> / logout <来源>          同 source enable / source logout
+  stats                                按 key / 来源 / 模型的成功率、延迟、速度
+  status                               一屏总览
+  doctor [--e2e] [--all] [--model M]   逐项自检；--e2e 实测流式与工具调用
+  connect-dsh [--dry-run] [--force]    写入 / 刷新 dsh 配置
+  disconnect-dsh                       还原 dsh 配置
+  models [sync]                        列出模型 / 同步到 dsh
+  key list|add|revoke|rotate <名称>     管理访问 key（每台设备一把）
+  remote enable --via ssh|tailscale|caddy [--domain D] / remote disable
+                                       让你自己的其他设备访问
+  engine version|upgrade [版本]|rollback 引擎版本管理
+  service status|install|start|stop|restart|uninstall
+  repair                               按台账修复配置、服务与接线
+  logs [--lines N] [--bridge]          引擎 / bridge 日志
+  update [--to 版本]                   更新到 npm 上的最新版（程序、dsh 插件、服务一起）
+  uninstall [--yes] [--keep-auth]      干净卸载
+
+通用选项：--lang zh|en  --json  --help  --version
+环境变量：DSH_HOME、DSH_MODEL_HOME、DSH_MODEL_LANG`, `dsh-model ${pkgVersion()} — wire your own CLI subscriptions into dsh (local OpenAI-compatible endpoint, auth by default, clean uninstall)
+
+Usage: dsh-model <command> [options]
+
+  setup [--profile P] [--proxy URL|none] [--skip-opencode] [--skip-workbuddy]
+                                       Install the unified endpoint, connect OpenCode Zen (your key) and WorkBuddy (own bridge), wire into dsh; idempotent
+  opencode [status|key|remove] [--stdin] [--skip-verify]
+                                       OpenCode Zen: set / change the key, or remove
+  workbuddy [status|login [cn|ai]|logout [cn|ai]|enable|refresh|disable]
+                                       WorkBuddy: desktop app sign-in, or login prints a link to approve in any browser (works on servers)
+  sources                              Sources: switch, sign-in state, account, models
+  source enable|disable|logout <source> [--accept-risk]
+                                       Turn on (prints a login link if needed) / off (keeps sign-in) / sign out
+  login <source> / logout <source>     Same as source enable / source logout
+  stats                                Success rate, latency and speed by key / source / model
+  status                               Overview
+  doctor [--e2e] [--all] [--model M]   Health checks; --e2e tests streaming and tool calls
+  connect-dsh [--dry-run] [--force]    Write / refresh dsh config
+  disconnect-dsh                       Restore dsh config
+  models [sync]                        List models / sync them to dsh
+  key list|add|revoke|rotate <name>    Manage access keys (one per device)
+  remote enable --via ssh|tailscale|caddy [--domain D] / remote disable
+                                       Access from your other devices
+  engine version|upgrade [ver]|rollback  Engine version management
+  service status|install|start|stop|restart|uninstall
+  repair                               Repair config, service and wiring from the ledger
+  logs [--lines N] [--bridge]          Engine / bridge logs
+  update [--to ver]                    Update to the latest npm version (program, dsh plugin and services)
+  uninstall [--yes] [--keep-auth]      Clean uninstall
+
+Global: --lang zh|en  --json  --help  --version
+Env: DSH_HOME, DSH_MODEL_HOME, DSH_MODEL_LANG`);
+}
+export async function main(argv) {
+    let parsed;
+    try {
+        parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
+    }
+    catch (error) {
+        initLang();
+        fail(String(error.message));
+        return 2;
+    }
+    const { values: o, positionals: [cmd, a1, a2] } = parsed;
+    initLang(o.lang);
+    setJsonMode(Boolean(o.json));
+    if (o.version) {
+        console.log(pkgVersion());
+        return 0;
+    }
+    if (o.help || !cmd || cmd === 'help') {
+        console.log(help());
+        return 0;
+    }
+    try {
+        const ctx = await createContext();
+        const port = o.port ? Number(o.port) : undefined;
+        if (port !== undefined && !(Number.isInteger(port) && port > 0 && port < 65536))
+            throw new Error(L(`端口不合法：${o.port}`, `Invalid port: ${o.port}`));
+        switch (cmd) {
+            case 'setup':
+                return await setup(ctx, { port, profile: o.profile, force: o.force, proxy: o.proxy, skipOpencode: o['skip-opencode'], skipWorkbuddy: o['skip-workbuddy'], skipDshPlugin: o['skip-dsh-plugin'] });
+            case 'opencode':
+                return await opencode(ctx, a1, { stdin: o.stdin, skipVerify: o['skip-verify'] });
+            case 'workbuddy':
+                return await workbuddy(ctx, a1, a2);
+            case 'bridge':
+                return await bridge(ctx, a1);
+            case 'login':
+                // 统一走守护进程：链接 + 码 / 贴回跳转地址，服务器上不需要浏览器（设计 §14.2）
+                if (!a1)
+                    throw new Error(L('用法：dsh-model login <来源>（dsh-model sources 查看）', 'Usage: dsh-model login <source> (see dsh-model sources)'));
+                return await enableInteractive(ctx, a1, { acceptRisk: o['accept-risk'] });
+            case 'logout':
+                if (!a1)
+                    throw new Error(L('用法：dsh-model logout <来源>', 'Usage: dsh-model logout <source>'));
+                return await source(ctx, 'logout', a1, {});
+            case 'sources':
+                return await sources(ctx, { all: o.all });
+            case 'source':
+                return await source(ctx, a1, a2, { acceptRisk: o['accept-risk'] });
+            case 'stats':
+                return await stats(ctx);
+            case 'status':
+                return await status(ctx);
+            case 'doctor':
+                return await doctor(ctx, { e2e: o.e2e, all: o.all, model: o.model });
+            case 'connect-dsh':
+                return await connect(ctx, { dryRun: o['dry-run'], profile: o.profile, force: o.force });
+            case 'disconnect-dsh':
+                return await disconnect(ctx);
+            case 'models':
+                return await models(ctx, a1);
+            case 'key':
+                return await key(ctx, a1, a2);
+            case 'remote':
+                return await remote(ctx, a1, { via: o.via, domain: o.domain });
+            case 'engine':
+                return await engine(ctx, a1, a2);
+            case 'service':
+                return await service(ctx, a1);
+            case 'repair':
+                return await repair(ctx);
+            case 'logs':
+                return await logs(ctx, o.lines ? Number(o.lines) : undefined, o.bridge ? 'bridge' : 'engine');
+            case 'uninstall':
+                return await uninstall(ctx, { yes: o.yes, keepAuth: o['keep-auth'], removePlugin: o['remove-plugin'] });
+            case 'self-update':
+            case 'update':
+                return await selfUpdate(ctx, { to: o.to });
+            default:
+                fail(L(`未知命令：${cmd}`, `Unknown command: ${cmd}`));
+                console.log(dim(L('查看帮助：dsh-model --help', 'See: dsh-model --help')));
+                return 2;
+        }
+    }
+    catch (error) {
+        if (isJsonMode()) {
+            printJson({ ok: false, code: isDshModelError(error) ? error.code : 'error', message: error.message, hint: isDshModelError(error) ? error.hint : undefined });
+        }
+        else {
+            fail(error.message);
+            if (isDshModelError(error) && error.hint)
+                console.error(dim(`  ${error.hint}`));
+            if (!isDshModelError(error) && process.env.DSH_MODEL_DEBUG)
+                console.error(error.stack);
+        }
+        return 1;
+    }
+}

package/dist/commands/bridge.js

@@ -0,0 +1,68 @@
+// commands/bridge.ts — dsh-model bridge run（守护进程入口，系统服务调用，常驻）与 bridge status
+//
+// 守护进程 = WorkBuddy bridge（OpenAI 兼容转发）+ 控制接口（来源开关、登录、key、统计，设计 §14）。
+import { createBridge } from '../bridge/server.js';
+import { loadBridgeConfig } from '../bridge/runtime.js';
+import { Daemon } from '../daemon/core.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { info, isJsonMode, printJson } from '../util/output.js';
+const log = (m) => console.error(`[${new Date().toISOString()}] ${m}`);
+export async function bridge(ctx, sub) {
+    if (sub === 'run')
+        return run(ctx);
+    if (!sub || sub === 'status')
+        return status(ctx);
+    throw new DshModelError('unknown_command', L(`未知子命令：bridge ${sub}`, `Unknown subcommand: bridge ${sub}`));
+}
+async function status(ctx) {
+    const cfg = await loadBridgeConfig(ctx.paths.home);
+    if (!cfg) {
+        info(L('守护进程未配置（dsh-model setup）', 'Daemon not configured (dsh-model setup)'));
+        return 1;
+    }
+    try {
+        const r = await fetch(`http://127.0.0.1:${cfg.port}/status`, { headers: { Authorization: `Bearer ${cfg.secret}` }, signal: AbortSignal.timeout(5000) });
+        const body = await r.json();
+        if (isJsonMode())
+            printJson(body);
+        else
+            info(JSON.stringify(body, null, 2));
+        return 0;
+    }
+    catch {
+        info(L(`守护进程没在 127.0.0.1:${cfg.port} 上运行`, `Daemon is not running on 127.0.0.1:${cfg.port}`));
+        return 1;
+    }
+}
+async function run(ctx) {
+    const cfg = await loadBridgeConfig(ctx.paths.home);
+    if (!cfg)
+        throw new DshModelError('bridge_not_configured', L('守护进程未配置，先执行 dsh-model setup', 'Daemon not configured; run dsh-model setup first'));
+    const daemon = new Daemon(ctx);
+    await daemon.start();
+    log(`daemon: products ${daemon.runtimes.map((r) => r.label).join(', ') || '(none)'}`);
+    const server = createBridge({
+        port: cfg.port,
+        secret: cfg.secret,
+        variants: daemon.runtimes,
+        log,
+        onRefresh: async () => {
+            const changed = await daemon.refreshCatalogs();
+            if (changed)
+                await daemon.resync();
+            return { changed };
+        },
+        onControl: (method, path, body, query) => daemon.handle(method, path, body, query),
+    });
+    await server.ready;
+    log(`daemon: listening on 127.0.0.1:${cfg.port}`);
+    await new Promise((resolve) => {
+        const stop = () => {
+            void daemon.stop().then(() => server.close()).then(resolve);
+        };
+        process.once('SIGTERM', stop);
+        process.once('SIGINT', stop);
+    });
+    return 0;
+}

package/dist/commands/connect.js

@@ -0,0 +1,67 @@
+// commands/connect.ts — connect-dsh / disconnect-dsh / models
+import { requireRootInVps } from '../context.js';
+import { connectDsh, disconnectDsh } from '../dsh/connect.js';
+import { listModels } from '../engine/client.js';
+import { L } from '../i18n.js';
+import { dshKey, loadAll, saveAll, syncModels } from '../ops.js';
+import { withLock } from '../state.js';
+import { info, isJsonMode, ok, printJson, skip } from '../util/output.js';
+export async function connect(ctx, opts) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (opts.dryRun) {
+            const key = dshKey(all.keys);
+            const ids = (await listModels(all.config.port, key)).map((m) => m.id);
+            const r = await connectDsh(ctx, structuredClone(all.state), all.keys, {
+                providerId: all.config.dsh.providerId,
+                port: all.config.port,
+                key,
+                models: ids.map((id) => ({ id, name: id })),
+                profile: opts.profile ?? all.config.dsh.profile,
+                force: opts.force,
+                dryRun: true,
+            });
+            info(r.changed ? r.diff : L('没有变化', 'No changes'));
+            return 0;
+        }
+        await syncModels(ctx, all, { profile: opts.profile ?? null, force: opts.force });
+        return 0;
+    });
+}
+export async function disconnect(ctx) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (!all.state.dsh) {
+            skip(L('没有接入过 dsh', 'Not connected to dsh'));
+            return 0;
+        }
+        const r = await disconnectDsh(ctx, all.state);
+        await saveAll(ctx, all);
+        const say = (what, how) => how === 'restored'
+            ? ok(L(`${what}：已逐字节还原`, `${what}: restored byte-for-byte`))
+            : how === 'surgical'
+                ? ok(L(`${what}：期间被修改过，只移除了 dsh-model 写入的部分`, `${what}: modified meanwhile; removed only dsh-model's part`))
+                : skip(L(`${what}：无需改动`, `${what}: nothing to change`));
+        say('cordis.patch.yml', r.patch);
+        say('.credentials.yaml', r.cred);
+        return 0;
+    });
+}
+export async function models(ctx, sub) {
+    const all = await loadAll(ctx);
+    if (sub === 'sync') {
+        requireRootInVps(ctx);
+        return withLock(ctx, async () => {
+            await syncModels(ctx, all);
+            return 0;
+        });
+    }
+    const list = await listModels(all.config.port, dshKey(all.keys));
+    if (isJsonMode())
+        printJson(list);
+    else
+        list.forEach((m) => info(`${m.id}${m.owned_by ? `  (${m.owned_by})` : ''}`));
+    return 0;
+}

package/dist/commands/engine.js

@@ -0,0 +1,122 @@
+// commands/engine.ts — engine version / upgrade / rollback
+//
+// 升级：装新版本 → 在临时端口、用 auth 的副本起一个试运行实例 → healthz 与 /v1/models 通过才切换 → 重启服务 → 失败自动切回
+import { spawn } from 'node:child_process';
+import { cp, mkdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import YAML from 'yaml';
+import { requireRootInVps } from '../context.js';
+import { listModels, waitHealthy } from '../engine/client.js';
+import { renderEngineConfig } from '../engine/config.js';
+import { activateVersion, currentVersion, fetchUpstreamAsset, installVersion, loadManifest, platformTarget, probeBinaryVersion, versionBinary, currentBinary } from '../engine/install.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { dshKey, loadAll, saveAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { withLock } from '../state.js';
+import { atomicWrite } from '../util/fs.js';
+import { info, ok, warn } from '../util/output.js';
+import { findFreePort } from '../util/port.js';
+export async function engine(ctx, sub, arg) {
+    if (!sub || sub === 'version') {
+        const v = await currentVersion(ctx);
+        const probed = v ? await probeBinaryVersion(currentBinary(ctx)) : null;
+        const manifest = await loadManifest();
+        info(L(`在用：${v ?? '未安装'}${probed && probed !== v ? `（二进制报告 ${probed}）` : ''}；本版 dsh-model 锁定：${manifest.version}`, `Active: ${v ?? 'not installed'}${probed && probed !== v ? ` (binary reports ${probed})` : ''}; pinned by this dsh-model: ${manifest.version}`));
+        return 0;
+    }
+    requireRootInVps(ctx);
+    if (sub === 'upgrade')
+        return withLock(ctx, () => upgrade(ctx, arg));
+    if (sub === 'rollback')
+        return withLock(ctx, () => rollback(ctx));
+    throw new DshModelError('unknown_command', L(`未知子命令：engine ${sub}`, `Unknown subcommand: engine ${sub}`));
+}
+async function upgrade(ctx, requested) {
+    const all = await loadAll(ctx);
+    const manifest = await loadManifest();
+    const target = platformTarget();
+    const version = (requested ?? manifest.version).replace(/^v/, '');
+    const from = await currentVersion(ctx);
+    if (from === version) {
+        ok(L(`已经是 v${version}`, `Already on v${version}`));
+        return 0;
+    }
+    let asset = version === manifest.version ? manifest.assets[target] : undefined;
+    if (!asset) {
+        warn(L(`v${version} 不在本版 dsh-model 的锁定清单里，校验值取自上游发布的 checksums.txt`, `v${version} is not pinned by this dsh-model; using the checksum from the upstream checksums.txt`));
+        asset = await fetchUpstreamAsset(manifest, version, target);
+    }
+    await installVersion(ctx, version, asset);
+    ok(L(`v${version} 已下载并校验`, `v${version} downloaded and verified`));
+    await trialRun(ctx, all, versionBinary(ctx, version));
+    ok(L('试运行通过', 'Trial run passed'));
+    all.state.engine.previous = from ?? undefined;
+    if (!all.state.engine.versions.includes(version))
+        all.state.engine.versions.push(version);
+    await activateVersion(ctx, version);
+    all.config.engine.version = version;
+    await saveAll(ctx, all);
+    if (!(await restartAndCheck(ctx, all.config.port))) {
+        warn(L('新版本启动失败，正在切回旧版本', 'New version failed to start; switching back'));
+        if (from) {
+            await activateVersion(ctx, from);
+            all.config.engine.version = from;
+            await saveAll(ctx, all);
+            await restartAndCheck(ctx, all.config.port);
+        }
+        throw new DshModelError('engine_upgrade_failed', L('升级失败，已回滚', 'Upgrade failed and was rolled back'));
+    }
+    ok(L(`引擎已升级：${from ?? '-'} → v${version}`, `Engine upgraded: ${from ?? '-'} → v${version}`));
+    return 0;
+}
+async function rollback(ctx) {
+    const all = await loadAll(ctx);
+    const prev = all.state.engine.previous;
+    if (!prev)
+        throw new DshModelError('no_previous_engine', L('没有可回滚的旧版本', 'No previous engine version to roll back to'));
+    const from = await currentVersion(ctx);
+    await activateVersion(ctx, prev);
+    all.config.engine.version = prev;
+    all.state.engine.previous = from ?? undefined;
+    await saveAll(ctx, all);
+    if (!(await restartAndCheck(ctx, all.config.port)))
+        throw new DshModelError('engine_unhealthy', L('回滚后引擎没有启动', 'Engine did not start after rollback'));
+    ok(L(`已回滚到 v${prev}`, `Rolled back to v${prev}`));
+    return 0;
+}
+async function restartAndCheck(ctx, port) {
+    if (ctx.serviceDisabled)
+        return true;
+    await serviceFor(ctx).restart();
+    return waitHealthy(port, 15_000);
+}
+/** 用 auth 的副本在临时端口起新二进制，确认能启动、鉴权、列模型 */
+async function trialRun(ctx, all, bin) {
+    const dir = join(ctx.paths.tmp, 'trial');
+    await rm(dir, { recursive: true, force: true });
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    try {
+        await cp(ctx.paths.auth, join(dir, 'auth'), { recursive: true, filter: (src) => !src.includes('/logs') });
+        const port = await findFreePort(all.config.port + 100);
+        const doc = YAML.parse(renderEngineConfig(ctx, all.config, all.keys, port));
+        doc.oauth['auth-dir'] = join(dir, 'auth');
+        const cfg = join(dir, 'engine.yaml');
+        await atomicWrite(cfg, YAML.stringify(doc));
+        const child = spawn(bin, ['-config', cfg], { cwd: dir, stdio: 'ignore' });
+        try {
+            if (!(await waitHealthy(port, 15_000)))
+                throw new DshModelError('engine_trial_failed', L('新版本试运行没有启动', 'New version did not start in trial run'));
+            const before = await listModels(all.config.port, dshKey(all.keys)).catch(() => []);
+            const models = await listModels(port, dshKey(all.keys));
+            if (before.length && !models.length)
+                throw new DshModelError('engine_trial_failed', L('新版本试运行列不出模型', 'New version lists no models in trial run'));
+        }
+        finally {
+            child.kill('SIGTERM');
+        }
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}

package/dist/commands/key.js

@@ -0,0 +1,75 @@
+// commands/key.ts — key add / list / revoke / rotate
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { DSH_KEY_NAME, addKey, revokeKey, rotateKey, saveKeys } from '../keys.js';
+import { applyEngineConfig, dshKey, loadAll, syncModels } from '../ops.js';
+import { withLock } from '../state.js';
+import { baseUrl } from '../engine/client.js';
+import { bold, info, isJsonMode, ok, printJson, table, warn } from '../util/output.js';
+import { redactKey } from '../util/redact.js';
+export async function key(ctx, sub, name) {
+    if (!sub || sub === 'list')
+        return list(ctx);
+    requireRootInVps(ctx);
+    if (!name)
+        throw new DshModelError('missing_arg', L(`用法：dsh-model key ${sub} <名称>`, `Usage: dsh-model key ${sub} <name>`));
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        dshKey(all.keys); // 没 setup 过就报错
+        if (sub === 'add') {
+            const entry = addKey(all.keys, name);
+            await saveKeys(ctx, all.keys);
+            await applyEngineConfig(ctx, all);
+            if (isJsonMode())
+                printJson({ ok: true, name, key: entry.key, baseURL: `${baseUrl(all.config.port)}/v1` });
+            ok(L(`已新增 key：${name}（只显示这一次，请妥善保存）`, `Key added: ${name} (shown only once; keep it safe)`));
+            info(`\n  ${bold(entry.key)}\n`);
+            info(L(`  Base URL：${baseUrl(all.config.port)}/v1（远程访问见 dsh-model remote enable）`, `  Base URL: ${baseUrl(all.config.port)}/v1 (for remote access see dsh-model remote enable)`));
+            return 0;
+        }
+        if (sub === 'revoke') {
+            if (name === DSH_KEY_NAME) {
+                throw new DshModelError('cannot_revoke_dsh', L('dsh 用的 key 不能吊销，只能轮换', 'The dsh key cannot be revoked, only rotated'), L('dsh-model key rotate dsh', 'dsh-model key rotate dsh'));
+            }
+            revokeKey(all.keys, name);
+            await saveKeys(ctx, all.keys);
+            await applyEngineConfig(ctx, all);
+            ok(L(`已吊销 key：${name}`, `Key revoked: ${name}`));
+            return 0;
+        }
+        if (sub === 'rotate') {
+            const entry = rotateKey(all.keys, name);
+            await saveKeys(ctx, all.keys);
+            await applyEngineConfig(ctx, all);
+            if (name === DSH_KEY_NAME) {
+                // 引擎热重载约 1s：等新 key 生效后再改 dsh
+                await new Promise((r) => setTimeout(r, 1500));
+                await syncModels(ctx, all, { quiet: true });
+                ok(L('已轮换 dsh 用的 key，并同步到 dsh', 'Rotated the dsh key and updated dsh'));
+            }
+            else {
+                if (isJsonMode())
+                    printJson({ ok: true, name, key: entry.key });
+                ok(L(`已轮换 key：${name}`, `Key rotated: ${name}`));
+                info(`\n  ${bold(entry.key)}\n`);
+            }
+            return 0;
+        }
+        throw new DshModelError('unknown_command', L(`未知子命令：key ${sub}`, `Unknown subcommand: key ${sub}`));
+    });
+}
+async function list(ctx) {
+    const { keys } = await loadAll(ctx);
+    const active = keys.keys.filter((k) => !k.revokedAt);
+    if (isJsonMode()) {
+        printJson(active.map((k) => ({ name: k.name, key: redactKey(k.key), createdAt: k.createdAt })));
+        return 0;
+    }
+    if (!active.length) {
+        warn(L('还没有 key，先执行 dsh-model setup', 'No keys yet; run dsh-model setup first'));
+        return 0;
+    }
+    info(table([[L('名称', 'Name'), 'Key', L('创建时间', 'Created')], ...active.map((k) => [k.name, redactKey(k.key), k.createdAt.slice(0, 19).replace('T', ' ')])]));
+    return 0;
+}