dsh-model 0.0.1 → 0.15.0

package/dist/commands/login.js

@@ -0,0 +1,113 @@
+// commands/login.ts — 引导登录上游（交互交给引擎），之后同步模型到 dsh；以及 logout
+import { mkdir, rename, rm } from 'node:fs/promises';
+import { hostname, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { requireRootInVps } from '../context.js';
+import { filesFor, listAuthFiles, tightenAuthPerms } from '../engine/auth.js';
+import { listModels } from '../engine/client.js';
+import { currentBinary } from '../engine/install.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { dshKey, loadAll, saveAll, syncModels } from '../ops.js';
+import { withLock } from '../state.js';
+import { ensureEngine } from './setup.js';
+import { getUpstream, riskNotice } from '../upstreams.js';
+import { runInherit } from '../util/exec.js';
+import { exists } from '../util/fs.js';
+import { bold, info, ok } from '../util/output.js';
+function isHeadless(ctx) {
+    if (ctx.mode === 'vps' || ctx.env.SSH_CONNECTION || ctx.env.SSH_TTY)
+        return true;
+    if (ctx.platform === 'linux')
+        return !ctx.env.DISPLAY && !ctx.env.WAYLAND_DISPLAY;
+    return false;
+}
+/** 远端主机名：优先 SSH_CONNECTION 里的服务器地址 */
+function sshTarget(ctx) {
+    const serverIp = ctx.env.SSH_CONNECTION?.split(' ')[2];
+    const user = ctx.env.SUDO_USER || userInfo().username;
+    return `${user}@${serverIp || hostname()}`;
+}
+export async function login(ctx, upstream, opts) {
+    requireRootInVps(ctx);
+    const def = getUpstream(upstream);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        const bin = currentBinary(ctx);
+        if (!(await exists(bin)) || !(await exists(ctx.paths.engineYaml))) {
+            info(L('首次使用订阅上游，先安装引擎…', 'First subscription login: installing the engine…'));
+            await ensureEngine(ctx, all);
+        }
+        if (def.requiresRiskAck) {
+            if (!opts.acceptRisk) {
+                info(riskNotice(def));
+                return 2;
+            }
+            all.config.upstreams[def.id] = { ...all.config.upstreams[def.id], riskAcceptedAt: new Date().toISOString() };
+        }
+        // 单账号：已有凭据要 --replace；先挪走，成功后删，失败挪回
+        const existing = filesFor(await listAuthFiles(ctx), def);
+        if (existing.length && !opts.replace) {
+            throw new DshModelError('already_logged_in', L(`${def.label} 已经登录（${existing.join(', ')}）`, `${def.label} is already logged in (${existing.join(', ')})`), L(`换账号：dsh-model login ${def.id} --replace`, `To switch accounts: dsh-model login ${def.id} --replace`));
+        }
+        if (existing.length) {
+            await mkdir(ctx.paths.replaced, { recursive: true, mode: 0o700 });
+            for (const f of existing)
+                await rename(join(ctx.paths.auth, f), join(ctx.paths.replaced, f));
+        }
+        const before = await listModels(all.config.port, dshKey(all.keys)).then((m) => m.map((x) => x.id)).catch(() => []);
+        const headless = isHeadless(ctx);
+        const flag = opts.device && def.deviceFlag ? def.deviceFlag : def.flag;
+        const args = ['-config', ctx.paths.engineYaml, flag, ...(headless ? ['-no-browser'] : [])];
+        if (headless && def.callbackPort && flag === def.flag) {
+            info(bold(L('这台机器没有浏览器。两种方式任选其一：', 'No browser on this machine. Pick either way:')));
+            info(L(`  1. 在你自己的电脑上另开终端执行：ssh -N -L ${def.callbackPort}:127.0.0.1:${def.callbackPort} ${sshTarget(ctx)}`, `  1. On your own computer, in another terminal: ssh -N -L ${def.callbackPort}:127.0.0.1:${def.callbackPort} ${sshTarget(ctx)}`));
+            info(L('     然后在本地浏览器打开下面打印的授权链接。', '     then open the authorization URL printed below in your local browser.'));
+            info(L('  2. 直接在本地浏览器打开授权链接，授权后把浏览器跳转到的地址（打不开也没关系）粘贴回这里。', '  2. Open the URL in your local browser; after approving, paste the address it redirects to (even if the page fails to load) back here.'));
+            if (def.deviceFlag)
+                info(L(`  也可以改用 device-code：dsh-model login ${def.id} --device`, `  Or use device code instead: dsh-model login ${def.id} --device`));
+            info('');
+        }
+        const cmd = ctx.runAs && ctx.isRoot ? 'sudo' : bin;
+        const cmdArgs = ctx.runAs && ctx.isRoot ? ['-u', ctx.runAs, '-H', bin, ...args] : args;
+        const env = { ...ctx.env, ...(all.config.proxy ? { HTTPS_PROXY: all.config.proxy, HTTP_PROXY: all.config.proxy } : {}) };
+        const code = await runInherit(cmd, all.config.proxy && cmd === 'sudo' ? ['--preserve-env=HTTPS_PROXY,HTTP_PROXY', ...cmdArgs] : cmdArgs, { cwd: ctx.paths.home, env });
+        const after = filesFor(await listAuthFiles(ctx), def);
+        if (code !== 0 || after.length === 0) {
+            for (const f of existing)
+                await rename(join(ctx.paths.replaced, f), join(ctx.paths.auth, f)).catch(() => { });
+            // 引擎等授权回调超时（5 分钟）或被取消时也返回 0，所以按"没拿到凭据"来提示
+            const hint = def.deviceFlag && flag !== def.deviceFlag
+                ? L(`没收到授权回调。网页报错或超时多半是网络 / 代理节点问题：换个节点重试，或改用 device-code：dsh-model login ${def.id} --device`, `No authorization callback received. A web error or timeout is usually a network / proxy-node issue: retry on another node, or use device code: dsh-model login ${def.id} --device`)
+                : L('没收到授权结果，请重试；引擎日志：dsh-model logs', 'No authorization result; please retry. Engine log: dsh-model logs');
+            const message = code === 0
+                ? L(`${def.label} 登录没有完成（超时或已取消）`, `${def.label} login did not complete (timed out or cancelled)`)
+                : L(`${def.label} 登录失败（退出码 ${code}）`, `${def.label} login failed (exit code ${code})`);
+            throw new DshModelError('login_failed', message, hint);
+        }
+        await rm(ctx.paths.replaced, { recursive: true, force: true });
+        await tightenAuthPerms(ctx);
+        ok(L(`${def.label} 已登录`, `${def.label} logged in`));
+        await saveAll(ctx, all);
+        await syncModels(ctx, all, { before });
+        return 0;
+    });
+}
+export async function logout(ctx, upstream) {
+    requireRootInVps(ctx);
+    const def = getUpstream(upstream);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        const files = filesFor(await listAuthFiles(ctx), def);
+        if (!files.length) {
+            info(L(`${def.label} 没有登录`, `${def.label} is not logged in`));
+            return 0;
+        }
+        const before = await listModels(all.config.port, dshKey(all.keys)).then((m) => m.map((x) => x.id)).catch(() => []);
+        for (const f of files)
+            await rm(join(ctx.paths.auth, f), { force: true });
+        ok(L(`${def.label} 已退出登录`, `${def.label} logged out`));
+        await syncModels(ctx, all, { before });
+        return 0;
+    });
+}

package/dist/commands/logs.js

@@ -0,0 +1,19 @@
+// commands/logs.ts — 打印引擎日志末尾
+import { join } from 'node:path';
+import { L } from '../i18n.js';
+import { readText } from '../util/fs.js';
+import { info, warn } from '../util/output.js';
+export async function logs(ctx, lines = 80, which = 'engine') {
+    const files = which === 'bridge' ? [join(ctx.paths.home, 'bridge.stdout.log')] : [join(ctx.paths.logs, 'main.log'), join(ctx.paths.home, 'engine.stdout.log')];
+    for (const file of files) {
+        const text = await readText(file);
+        if (text == null)
+            continue;
+        info(`==> ${file}`);
+        info(text.trimEnd().split('\n').slice(-lines).join('\n'));
+        info('');
+        return 0;
+    }
+    warn(L('还没有日志', 'No logs yet'));
+    return 0;
+}

package/dist/commands/opencode.js

@@ -0,0 +1,83 @@
+// commands/opencode.ts — dsh-model opencode [status|key|remove]，以及 setup 里的 OpenCode 步骤
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { OPENCODE_KEY_PAGE, opencodeConfigured, refreshOpencodeModels, removeOpencodeKey, saveOpencodeKey, validateKeyShape, verifyOpencodeKey, } from '../integrations/opencode.js';
+import { loadAll, syncAll } from '../ops.js';
+import { withLock } from '../state.js';
+import { info, isJsonMode, ok, printJson, skip } from '../util/output.js';
+import { canPrompt, promptSecret, readStdin } from '../util/prompt.js';
+/** 交互地问 OpenCode key（回车跳过 → ''；不能交互 → undefined） */
+export async function askOpencodeKey() {
+    if (!canPrompt())
+        return undefined;
+    info(L(`OpenCode Zen 的 API key（${OPENCODE_KEY_PAGE}，要先充值；没有就直接回车跳过，以后在 dsh 的管理页填）。输入不会显示。`, `Your OpenCode Zen API key (${OPENCODE_KEY_PAGE}; needs a top-up. Press Enter to skip and add it later in dsh's management page). Input is hidden.`));
+    return promptSecret('OpenCode Zen API key: ');
+}
+/** 拿 key → 实测 → 存进 secrets.json → 拉模型目录。返回是否有变化（调用方随后 syncAll） */
+export async function configureOpencode(ctx, all, opts = {}) {
+    if ((await opencodeConfigured(ctx)) && !opts.replace) {
+        const n = await refreshOpencodeModels(ctx, all.config.proxy).catch(() => 0);
+        skip(L(`已配置${n ? `（${n} 个模型）` : ''}；换 key：dsh-model opencode key`, `Configured${n ? ` (${n} models)` : ''}; to change the key: dsh-model opencode key`));
+        return n > 0;
+    }
+    let key;
+    if (opts.stdin) {
+        key = await readStdin();
+    }
+    else if (opts.key !== undefined || canPrompt()) {
+        key = opts.key ?? (await askOpencodeKey()) ?? '';
+        if (!key) {
+            skip(L('已跳过；之后可执行 dsh-model opencode key', 'Skipped; later run dsh-model opencode key'));
+            return false;
+        }
+    }
+    else {
+        skip(L('非交互环境，跳过；之后执行 dsh-model opencode key（或 echo <key> | dsh-model opencode key --stdin）', 'Non-interactive; skipped. Later run dsh-model opencode key (or echo <key> | dsh-model opencode key --stdin)'));
+        return false;
+    }
+    validateKeyShape(key);
+    let verifiedModel;
+    if (!opts.skipVerify) {
+        info(L('正在用一个免费模型实测这把 key…', 'Testing the key against a free model…'));
+        const v = await verifyOpencodeKey(key, all.config.proxy);
+        if (!v.ok) {
+            throw new DshModelError('opencode_key_rejected', L(`实测失败（${v.model ?? '-'}）：${v.detail}`, `Test failed (${v.model ?? '-'}): ${v.detail}`), L('确认 key 正确后重试；确定要先写入可加 --skip-verify', 'Check the key and retry; to write it anyway add --skip-verify'));
+        }
+        verifiedModel = v.model;
+        ok(L(`key 可用（${v.model} 实测通过${v.detail !== 'ok' ? `；${v.detail}` : ''}）`, `Key works (${v.model} test passed${v.detail !== 'ok' ? `; ${v.detail}` : ''})`));
+    }
+    await saveOpencodeKey(ctx, key, verifiedModel);
+    const n = await refreshOpencodeModels(ctx, all.config.proxy);
+    ok(L(`OpenCode Zen 已接入统一端点（${n} 个模型，名字前缀 opencode/）`, `OpenCode Zen connected to the unified endpoint (${n} models, prefixed opencode/)`));
+    return true;
+}
+export async function opencode(ctx, sub, opts) {
+    if (!sub || sub === 'status') {
+        const configured = await opencodeConfigured(ctx);
+        if (isJsonMode())
+            printJson({ configured });
+        else
+            info(configured ? L('已配置（key 在 dsh-model 的 secrets.json，由引擎持有）', 'Configured (key in dsh-model secrets.json, held by the engine)') : L('未配置（dsh-model opencode key）', 'Not configured (dsh-model opencode key)'));
+        return 0;
+    }
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (sub === 'key') {
+            if (await configureOpencode(ctx, all, { stdin: opts.stdin, skipVerify: opts.skipVerify, replace: true }))
+                await syncAll(ctx, all);
+            return 0;
+        }
+        if (sub === 'remove') {
+            if (!(await removeOpencodeKey(ctx))) {
+                skip(L('OpenCode 本来就没配置', 'OpenCode was not configured'));
+                return 0;
+            }
+            await syncAll(ctx, all, { quiet: true });
+            ok(L('已移除 OpenCode Zen（key 与模型）', 'Removed OpenCode Zen (key and models)'));
+            return 0;
+        }
+        throw new DshModelError('unknown_command', L(`未知子命令：opencode ${sub}`, `Unknown subcommand: opencode ${sub}`));
+    });
+}

package/dist/commands/remote.js

@@ -0,0 +1,129 @@
+// commands/remote.ts — 让本人其他设备访问引擎。引擎始终只绑 127.0.0.1，入口只有三种：
+// ssh（默认，服务端零改动）/ tailscale serve / caddy（仅 vps，复用 dsh-vps 的 Caddy）
+import { readFile, rm } from 'node:fs/promises';
+import { hostname, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { loadAll, saveAll } from '../ops.js';
+import { withLock } from '../state.js';
+import { run, which } from '../util/exec.js';
+import { atomicWrite, exists, timestamp } from '../util/fs.js';
+import { bold, info, next, ok, skip } from '../util/output.js';
+import { DEFAULT_PUBLIC_PORT, closeFirewall, openFirewall, publicHost, siteBlock } from '../remote/public.js';
+const CADDYFILE = '/etc/caddy/Caddyfile';
+const CADDY_SNIPPET = '/etc/caddy/dsh-model.conf';
+const IMPORT_LINE = `import ${CADDY_SNIPPET}`;
+const DOMAIN_RE = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+export async function remote(ctx, sub, opts) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        if (sub === 'disable') {
+            await disable(ctx, all);
+            await saveAll(ctx, all);
+            return 0;
+        }
+        if (sub !== 'enable')
+            throw new DshModelError('unknown_command', L('用法：dsh-model remote enable --via ssh|tailscale|caddy / remote disable', 'Usage: dsh-model remote enable --via ssh|tailscale|caddy / remote disable'));
+        const via = (opts.via ?? 'ssh');
+        if (all.state.remote && all.state.remote.mode !== 'off' && all.state.remote.mode !== via)
+            await disable(ctx, all);
+        const port = all.config.port;
+        if (via === 'ssh') {
+            all.state.remote = { mode: 'ssh', files: [] };
+            const target = `${ctx.env.SUDO_USER || userInfo().username}@${ctx.env.SSH_CONNECTION?.split(' ')[2] || hostname()}`;
+            info(bold(L('在你自己的设备上执行（保持运行）：', 'On your own device, run (keep it open):')));
+            info(`  ssh -N -L ${port}:127.0.0.1:${port} ${target}`);
+            info(L(`然后在那台设备的软件里填：Base URL http://127.0.0.1:${port}/v1`, `Then in software on that device use: Base URL http://127.0.0.1:${port}/v1`));
+        }
+        else if (via === 'tailscale') {
+            if (!(await which('tailscale')))
+                throw new DshModelError('tailscale_missing', L('没找到 tailscale 命令', 'tailscale command not found'), L('先安装并登录 Tailscale', 'Install and log in to Tailscale first'));
+            const r = await run('tailscale', ['serve', '--bg', `--https=${port}`, `http://127.0.0.1:${port}`]);
+            if (r.code !== 0)
+                throw new DshModelError('tailscale_failed', L(`tailscale serve 失败：${r.stderr.trim()}`, `tailscale serve failed: ${r.stderr.trim()}`));
+            all.state.remote = { mode: 'tailscale', files: [], tailscaleHttpsPort: port };
+            const dns = await run('tailscale', ['status', '--json']);
+            const name = (() => {
+                try {
+                    return String(JSON.parse(dns.stdout).Self?.DNSName ?? '').replace(/\.$/, '');
+                }
+                catch {
+                    return '';
+                }
+            })();
+            ok(L('已通过 tailscale serve 开放给你的 tailnet', 'Exposed to your tailnet via tailscale serve'));
+            info(L(`  Base URL：https://${name || '<本机 tailnet 域名>'}:${port}/v1`, `  Base URL: https://${name || '<this machine tailnet name>'}:${port}/v1`));
+        }
+        else if (via === 'caddy') {
+            if (ctx.mode !== 'vps')
+                throw new DshModelError('caddy_vps_only', L('caddy 方式只用于 dsh-vps 所在的服务器', 'The caddy method is only for the dsh-vps server'));
+            if (opts.domain && !DOMAIN_RE.test(opts.domain))
+                throw new DshModelError('invalid_domain', L(`域名不合法：${opts.domain}`, `Invalid domain: ${opts.domain}`));
+            // 默认用 dsh 自己的域名（只有 IP 时用 <ip>.sslip.io），另开一个端口
+            const host = await publicHost(opts.domain ?? all.config.remote.domain);
+            const publicPort = all.config.remote.publicPort ?? DEFAULT_PUBLIC_PORT;
+            await enableCaddy(ctx, all, host, publicPort);
+            all.config.remote.domain = host;
+            all.config.remote.publicPort = publicPort;
+            ok(L(`对外端点已开通：https://${host}:${publicPort}/v1（只认 dsh-model 的 key）`, `Public endpoint enabled: https://${host}:${publicPort}/v1 (dsh-model keys only)`));
+        }
+        else {
+            throw new DshModelError('unknown_remote', L(`不支持的方式：${via}`, `Unsupported method: ${via}`));
+        }
+        all.config.remote.mode = via;
+        await saveAll(ctx, all);
+        next(L('为每台设备单独发一把 key：dsh-model key add <设备名>（丢了就 key revoke）', 'Issue one key per device: dsh-model key add <device> (revoke it if lost)'));
+        return 0;
+    });
+}
+export async function enableCaddy(ctx, all, domain, publicPort = DEFAULT_PUBLIC_PORT) {
+    if (!(await exists(CADDYFILE)))
+        throw new DshModelError('caddy_missing', L(`没找到 ${CADDYFILE}`, `${CADDYFILE} not found`));
+    const original = await readFile(CADDYFILE, 'utf8');
+    const backup = join(ctx.paths.backups, `Caddyfile.${timestamp()}`);
+    await atomicWrite(backup, original);
+    await atomicWrite(CADDY_SNIPPET, siteBlock(domain, publicPort, all.config.port), { mode: 0o644 });
+    const hasImport = original.split('\n').some((l) => l.trim() === IMPORT_LINE);
+    if (!hasImport)
+        await atomicWrite(CADDYFILE, original.replace(/\n*$/, '\n') + IMPORT_LINE + '\n', { mode: 0o644 });
+    const v = await run('caddy', ['validate', '--config', CADDYFILE, '--adapter', 'caddyfile']);
+    if (v.code !== 0) {
+        await atomicWrite(CADDYFILE, original, { mode: 0o644 });
+        await rm(CADDY_SNIPPET, { force: true });
+        throw new DshModelError('caddy_invalid', L(`Caddy 配置校验失败，已回滚：${v.stderr.trim().slice(-300)}`, `Caddy config validation failed; rolled back: ${v.stderr.trim().slice(-300)}`));
+    }
+    const r = await run('systemctl', ['reload', 'caddy']);
+    if (r.code !== 0)
+        throw new DshModelError('caddy_reload_failed', L(`Caddy 重载失败：${r.stderr.trim()}`, `Caddy reload failed: ${r.stderr.trim()}`));
+    await openFirewall(publicPort);
+    all.state.remote = { mode: 'caddy', files: [CADDY_SNIPPET], caddyImportLine: hasImport ? undefined : IMPORT_LINE, caddyfile: CADDYFILE, publicUrl: `https://${domain}:${publicPort}/v1`, firewallPort: publicPort };
+    all.config.remote.mode = 'caddy';
+}
+export async function disable(ctx, all) {
+    const r = all.state.remote;
+    if (!r || r.mode === 'off') {
+        skip(L('远程访问本来就是关闭的', 'Remote access is already off'));
+        return;
+    }
+    if (r.mode === 'tailscale' && r.tailscaleHttpsPort) {
+        await run('tailscale', ['serve', `--https=${r.tailscaleHttpsPort}`, 'off']);
+    }
+    if (r.mode === 'caddy') {
+        for (const f of r.files)
+            await rm(f, { force: true });
+        if (r.caddyImportLine && r.caddyfile && (await exists(r.caddyfile))) {
+            const text = await readFile(r.caddyfile, 'utf8');
+            const kept = text.split('\n').filter((l) => l.trim() !== r.caddyImportLine).join('\n');
+            await atomicWrite(r.caddyfile, kept, { mode: 0o644 });
+        }
+        await run('systemctl', ['reload', 'caddy']);
+        if (r.firewallPort)
+            await closeFirewall(r.firewallPort);
+    }
+    all.state.remote = { mode: 'off', files: [] };
+    all.config.remote.mode = 'off';
+    ok(L('已关闭远程访问', 'Remote access disabled'));
+}

package/dist/commands/self.js

@@ -0,0 +1,116 @@
+// commands/self.ts — 更新 dsh-model 自己（命令行与 dsh 管理页的「更新」共用）
+//
+// 1. 新版本装到原来的位置：npm 全局装的就 npm install -g；从 dsh 管理页一键安装的（程序就在插件目录里）跳过这步；
+// 2. dsh 里的插件换成同一版本（插件页的新代码要重启一次 dsh 才生效）；
+// 3. 用新版本执行一次 repair：重写服务文件、重启引擎与守护进程、同步模型。
+import { realpath } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { requireRootInVps } from '../context.js';
+import { DshModelError, isDshModelError } from '../errors.js';
+import { L, lang } from '../i18n.js';
+import { installDshPlugin, pluginRoot } from '../integrations/dshplugin.js';
+import { loadAll, saveAll } from '../ops.js';
+import { withLock } from '../state.js';
+import { run, runInherit } from '../util/exec.js';
+import { exists } from '../util/fs.js';
+import { info, next, ok, skip, warn } from '../util/output.js';
+import { PKG_ROOT, pkgVersion } from '../util/pkg.js';
+const REGISTRY = 'https://registry.npmjs.org/dsh-model';
+/** a 比 b 新（只比 major.minor.patch） */
+export function isNewer(a, b) {
+    const pa = a.split(/[.-]/).map((x) => parseInt(x, 10) || 0);
+    const pb = b.split(/[.-]/).map((x) => parseInt(x, 10) || 0);
+    for (let i = 0; i < 3; i++)
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) > (pb[i] ?? 0);
+    return false;
+}
+export async function latestVersion() {
+    try {
+        const r = await fetch(`${REGISTRY}/latest`, { signal: AbortSignal.timeout(10_000) });
+        if (!r.ok)
+            return null;
+        return String((await r.json()).version ?? '') || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 和当前 node 同目录的 npm，以及让它能找到 node 的环境 */
+async function npmBeside() {
+    if (process.versions.electron)
+        return null;
+    const dir = dirname(process.execPath);
+    const npm = join(dir, 'npm');
+    if (!(await exists(npm)))
+        return null;
+    return { npm, env: { ...process.env, PATH: `${dir}:${process.env.PATH ?? ''}` } };
+}
+/** 当前程序是不是 npm 全局装的（是就能用 npm install -g 原地更新） */
+async function npmGlobalInstall() {
+    const n = await npmBeside();
+    if (!n)
+        return null;
+    const r = await run(n.npm, ['root', '-g'], { env: n.env, timeoutMs: 20_000 });
+    if (r.code !== 0)
+        return null;
+    try {
+        return (await realpath(join(r.stdout.trim(), 'dsh-model'))) === (await realpath(PKG_ROOT)) ? n : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function selfUpdate(ctx, opts = {}) {
+    requireRootInVps(ctx);
+    const current = pkgVersion();
+    const target = opts.to ?? (await latestVersion());
+    if (!target)
+        throw new DshModelError('no_latest', L('查不到 npm 上的最新版本（网络？）', 'Could not get the latest version from npm (network?)'), L('稍后再试，或指定：dsh-model self-update --to <版本>', 'Try later, or pass one: dsh-model self-update --to <version>'));
+    if (!opts.to && !isNewer(target, current)) {
+        ok(L(`已是最新（${current}；npm 上最新 ${target}）`, `Up to date (${current}; latest on npm is ${target})`));
+        return 0;
+    }
+    info(L(`当前 ${current}，目标 ${target}`, `Current ${current}, target ${target}`));
+    // 1. 程序本身
+    let root = PKG_ROOT;
+    const npm = await npmGlobalInstall();
+    if (target === current)
+        skip(L('程序已是这个版本', 'The program is already at this version'));
+    else if (npm) {
+        info(L(`npm install -g dsh-model@${target}`, `npm install -g dsh-model@${target}`));
+        const code = await runInherit(npm.npm, ['install', '-g', `dsh-model@${target}`], { env: npm.env });
+        if (code !== 0)
+            throw new DshModelError('update_failed', L(`npm 安装失败（退出码 ${code}）`, `npm install failed (exit code ${code})`));
+        ok(L(`程序已更新到 ${target}`, `Program updated to ${target}`));
+    }
+    else {
+        skip(L('程序在 dsh 的插件目录里，随插件一起更新', 'The program lives in the dsh plugin directory and is updated with it'));
+    }
+    // 2. dsh 里的插件
+    // 插件没换成也继续：服务照样要用新版本重装，插件之后可以在 dsh 的插件市场更新
+    try {
+        await withLock(ctx, async () => {
+            const all = await loadAll(ctx);
+            await installDshPlugin(ctx, all, { version: target, replaceUser: true });
+            await saveAll(ctx, all);
+            if (!npm)
+                root = (await pluginRoot(ctx, all.config.dsh.profile)) ?? root;
+        });
+    }
+    catch (error) {
+        warn(`${error.message}${isDshModelError(error) && error.hint ? ` — ${error.hint}` : ''}`);
+    }
+    // 3. 用新版本重装服务并重启
+    info(L('用新版本重装服务…', 'Reinstalling the services with the new version…'));
+    const code = await runInherit(process.execPath, [join(root, 'bin', 'dsh-model.js'), 'repair', '--lang', lang()], {
+        env: { ...process.env, ...(process.versions.electron ? { ELECTRON_RUN_AS_NODE: '1' } : {}) },
+    });
+    if (code !== 0) {
+        warn(L(`repair 没有完成（退出码 ${code}）：执行 dsh-model repair 重试`, `repair did not finish (exit code ${code}); run dsh-model repair to retry`));
+        return 1;
+    }
+    ok(L(`已更新到 ${target}`, `Updated to ${target}`));
+    next(L('重启一次 dsh，管理页的新代码才会生效', 'Restart dsh once so the management page picks up the new code'));
+    return 0;
+}

package/dist/commands/service.js

@@ -0,0 +1,72 @@
+// commands/service.ts — service install|start|stop|restart|status|uninstall，以及 repair
+import { requireRootInVps } from '../context.js';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { applyEngineConfig, loadAll, saveAll, syncAll } from '../ops.js';
+import { serviceFor } from '../service/index.js';
+import { withLock } from '../state.js';
+import { ensureDaemon } from '../daemon/service.js';
+import { waitHealthy } from '../engine/client.js';
+import { info, isJsonMode, ok, printJson } from '../util/output.js';
+export async function service(ctx, sub) {
+    const svc = serviceFor(ctx);
+    if (!sub || sub === 'status') {
+        const s = await svc.status();
+        if (isJsonMode())
+            printJson({ kind: svc.kind, file: svc.spec.file, ...s });
+        else
+            info(`${svc.kind}  ${svc.spec.file}\n${L('已安装', 'installed')}: ${s.installed}  ${L('运行中', 'running')}: ${s.running}${s.pid ? `  pid ${s.pid}` : ''}${s.detail ? `  (${s.detail})` : ''}`);
+        return 0;
+    }
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        switch (sub) {
+            case 'install':
+                await svc.install();
+                all.state.service = { kind: svc.kind, file: svc.spec.file, label: svc.spec.label };
+                await saveAll(ctx, all);
+                break;
+            case 'start':
+                await svc.start();
+                break;
+            case 'stop':
+                await svc.stop();
+                break;
+            case 'restart':
+                await svc.restart();
+                break;
+            case 'uninstall':
+                await svc.uninstall();
+                delete all.state.service;
+                await saveAll(ctx, all);
+                break;
+            default:
+                throw new DshModelError('unknown_command', L(`未知子命令：service ${sub}`, `Unknown subcommand: service ${sub}`));
+        }
+        ok(`service ${sub}`);
+        return 0;
+    });
+}
+/** 按台账把一切拉回应有状态：engine.yaml、服务文件、dsh 接线 */
+export async function repair(ctx) {
+    requireRootInVps(ctx);
+    return withLock(ctx, async () => {
+        const all = await loadAll(ctx);
+        await applyEngineConfig(ctx, all);
+        ok(L('engine.yaml 已重新生成', 'engine.yaml regenerated'));
+        if (!ctx.serviceDisabled) {
+            const svc = serviceFor(ctx);
+            await svc.install();
+            all.state.service = { kind: svc.kind, file: svc.spec.file, label: svc.spec.label };
+            await saveAll(ctx, all);
+            await svc.restart();
+            if (!(await waitHealthy(all.config.port, 15_000)))
+                throw new DshModelError('engine_unhealthy', L('引擎没有启动，查看 dsh-model logs', 'Engine did not start; see dsh-model logs'));
+            ok(L('服务已重装并重启', 'Service reinstalled and restarted'));
+            await ensureDaemon(ctx, all);
+        }
+        await syncAll(ctx, all);
+        return 0;
+    });
+}