dsh-xdpool 2.4.1 → 2.4.3

package/CHANGELOG.md

@@ -1,6 +1,93 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
+## 2.4.3 — 渠道包补上 11128、粘性绑定跨重启、网关白名单、目录 TTL，外加 CodeArts 重签开关
+
+> 2.4.1 与 2.4.2 修的是**池车道**（`src/upstream.ts`）；这一版把同一套 11128 规则补进**渠道车道**自己那份 channel pack，并顺带解决三件独立的事：会话粘性绑定不该止于进程边界、网关页面的勾选该是真开关、远端模型目录该会过期。四个 PR 来自社区（[@GIGIGIGIbaby](https://github.com/GIGIGIGIbaby)），复核与发布由维护者完成。另附一个默认关闭的 CodeArts 重签开关（见末节）。
+
+### 渠道账号也吃 400 / 11128（PR [#63](https://github.com/XDTrees/dsh-xdpool/pull/63)）
+
+`workbuddy` 渠道在 `channels.ts` 的 `POOL_OWNED_CHANNELS` 列表里，但它**不走** `src/upstream.ts` —— 它由 channel pack 自己的 WorkBuddy 适配器应答。2.4.1 的两道内容指纹、2.4.2 的 role 转换与三个会话身份头都只加在了池车道，于是渠道账号继续吃到 2.4.2 已经替别人修好的那个 `400 / 11128`：
+
+| 项 | 渠道适配器改前 | 改后 |
+|---|---|---|
+| 首条消息 role | `developer` | `system`（就地转换） |
+| `powered by DeepSeek Harness` | 原样发出 | `running on DeepSeek Harness` |
+| `DeepSeek Harness Web GUI` | 原样发出 | `DeepSeek Harness web interface` |
+| `X-Conversation-ID` / `-Request-ID` / `-Message-ID` | 一个都不带 | 三个都带 |
+
+三处编辑各自标了 `[xdpool-local]`，配套的 `tests/chat-identity-headers.test.ts` 直接对**已发布的 bundle** 做源断言（pack.js 是外部构建产物、无法 `import`，所以只能在字节层 pin 住）—— 下次 pack 刷新若把这三处冲掉，测试会变红，而不是静默回退。
+
+### 会话粘性绑定跨过进程边界（PR [#64](https://github.com/XDTrees/dsh-xdpool/pull/64)）
+
+卡片承诺「一个会话一个账号」，但这个承诺原先止于进程边界：绑定存在一个 `Map` 里，每次重启都重新挑选，于是同一个会话一天里可能被三个账号各服务一遍，每次都按完整 prompt 计费。现在这张表写进插件状态目录（只存哈希到账号 id，不含任何消息内容），构造时加载，写入合并成一次原子 rename，并沿用与内存版相同的 LRU 上限。
+
+测试特意把会话绑到一个「默认挑选不会选中」的账号 —— 新建的空池本来就会同意未绑定会话的选择，所以「两个池答案一致」在禁用加载时也能通过；实测把加载去掉会让其中三个用例变红。
+
+### 网关页面的勾选不再是纯展示（PR [#65](https://github.com/XDTrees/dsh-xdpool/pull/65)）
+
+Gateway 页的模型勾选框与 LAN 共享列表此前只是**展示过滤器**：`/v1/models` 会隐藏没勾的模型，但请求路径照单全收。一台还留着旧模型 id 的手机、或照文档猜一个 id 的第二编辑器，就能继续拿卡片上写着「关」的模型花用户的钱。
+
+现在强制发生在**调用方实际发出的那个 id 上**，且在任何车道剥前缀或改写 body **之前**，覆盖每条车道：pool、aggregate、free、combo，以及登录渠道。列表与闸门读同一份集合——这正是让卡片上的勾选有意义的原因。
+
+### 远端模型目录会过期（PR [#66](https://github.com/XDTrees/dsh-xdpool/pull/66)）
+
+bundle 里每个适配器都把 `remoteModels` 缓存到进程结束，于是厂商改名或调整倍率要等重启才反映到卡片上——而**改名通常就是改价**，因为倍率是名字的一部分。现在由一道 TTL 闸门决定缓存能否应答，时长十分钟，可用 `DSH_XDPOOL_CATALOG_TTL_MS` 覆盖以便测试。
+
+闸门刻意**不清缓存**：加载器只在成功时覆盖，所以刷新失败会继续沿用最后一份已知良好的目录，而不是退化成一堆裸 id；网关侧 30s 的冷却又限住了重试速率。同样无需重建 lib —— `channels.ts` 在运行期按路径加载 `pack.js`。
+
+### 可选：CodeArts 请求带重签头（默认关闭，`[xdpool-local]`）
+
+在 CodeArts 的 chat 请求上追加两个头：
+
+```
+x-bili-resign: sdk-hmac-sha256
+x-bili-resign-credential: base64({"ak":"…","sk":"…","token":"…"})
+```
+
+用途是让 billion-context 用这对凭证**重签**一条它接管的 SDK-HMAC-SHA256 请求：该方案的签名覆盖请求体，压缩改写会让签名失效，而 bili 拿不到重签凭证时会按 compress-or-refuse 契约**本地拒发**（`bili_resign_unavailable`，表现为 403，再被误读成「密钥无效」）。带上这对头，bili 就能重算签名，压缩能力得以保留（billion-context 的 #1884 逃生口）。
+
+**为什么默认关闭**：`billion-context` 只在 `optionalDependencies` 里，未安装时这两个头会**直达上游**，而它们携带的是 AK/SK；另外 bili 的进程内 native client 自己会构造这两个头（`resignExtra`），xdpool 加不加都不影响它。开关留给「xdpool 直接对接 bili 代理路径」或将来需要显式携带凭证的场合 —— 启用方式是在 pool 构造时传 `codeartsResignHeaders: true`（当前没有对应的用户级配置项）。
+
+配套 `tests/codearts-resign-headers.test.ts` 用源断言 pin 住四件事：两个头名齐全、字段名与 bili `decodeApigCredential` 读取的 `ak`/`sk`/`token` 一致、插入位置在 `signRequestHuawei` 之后、以及默认关闭。
+
+### 其他
+
+- 新增测试：渠道包 11128 规则源断言、粘性绑定跨重启（含「去掉加载即变红」的对照）、网关白名单与列表一致性、目录 TTL。
+
+## 2.4.2 — 第二道内容指纹：`Web GUI` 那句，以及 assistant 历史
+> 2.4.1 之后仍有 11128。这一版补上第二道内容指纹，并把改写范围扩到 assistant 历史。修复来自社区 PR [#62](https://github.com/XDTrees/dsh-xdpool/pull/62)（[@jmglsi](https://github.com/jmglsi)），实测复核与发布由维护者完成。
+### 同一条提示词里还有第二道指纹
+2.4.1 只改写了 `You are an AI agent powered by DeepSeek Harness` 那一句的开头。把这一句改掉之后，请求仍然 `400 / 11128`，因为网关还在看提示词的另一段——介绍 Web GUI 的那一对句子：
+
+```
+You are interacting with the user through the DeepSeek Harness Web GUI
+whose URL the runtime context names. When the user refers to "this page",
+"this GUI", or "this app" without naming another target, they mean this GUI.
+```
+
+这两句是**合起来**才算的：单独发任一句都 `200`，两句凑齐就 `400`；在这对句子里做任何小改动都放行。所以这是第二道**内容指纹**，不是请求长度限制，也不是别的头。
+
+修法是把产品名后的 `Web GUI` 改称 `web interface`——保住原意的最小改动。改写清单仍是数组，这一条只是新的一行。
+
+### 被扫的是 system 和 assistant，user/tool 不扫
+同一句话放进 `assistant` 消息同样 `400`，改写后 `200`；放进 `user` 或 `tool` 则从来不管。这一条很重要：**只要历史里有一条助手回复带着这段文字，之后这个会话的每一次请求都会失败**。所以改写范围从「只改 system」扩到 system + assistant。
+
+### 实测（真实国内网关，改写前 → 改写后）
+| 请求体 | 修复前 | 修复后 |
+|---|---|---|
+| 主 agent 提示词（含 Web GUI 那对句子） | `400 / 11128` | `200` |
+| 同一对句子放在 `assistant` 历史里 | `400 / 11128` | `200` |
+| 两句合一的提示词（两道指纹同时在） | `400 / 11128` | `200` |
+| 埋进数百字长提示词中间 | `400 / 11128` | `200` |
+| 只有无关填充的长提示词（基线） | `200` | `200` |
+
+维护者复核时额外确认了一件事：DSH 当前版本真正发出的那几句（`The runtime context names the DeepSeek Harness implementation checkout…`、`… the DeepSeek Harness Web GUI at <url>.`、`Current DeepSeek Harness Web GUI URL: …`）**原样发送就是 `200`**，不触发任何检查——它们含产品名却不是模板命中的句式。也就是说命中的是句式，不是「出现产品名」；这也是为什么没有采用「把 `DeepSeek Harness` 全局替换成 `DSH`」那种更宽的改法：它会连 `D:\DeepSeek Harness\resources\app\dsh\` 这类要求模型逐字使用的路径一起改掉，而换不来任何额外的放行。
+### 同时并入的两个社区修复
+- **PR [#49](https://github.com/XDTrees/dsh-xdpool/pull/49)**（[@GIGIGIGIbaby](https://github.com/GIGIGIGIbaby)）：模型连通性探测的 `content` 改用内容块数组。宿主按 `content.some(...)` 校验每条出站消息，裸字符串没有 `.some`，探测在进程内就炸了，卡片上显示成 `content.some is not a function`——一个形状错误伪装成模型坏了。
+- **PR [#50](https://github.com/XDTrees/dsh-xdpool/pull/50)**（[@GIGIGIGIbaby](https://github.com/GIGIGIGIbaby)）：禁用按钮划过时会「消失」。`.dsm-btn:disabled:hover` 里的 `background:transparent` 优先级 (0,3,0)，压过了 `.dsm-btn-primary` 的填充色 (0,1,0)；主按钮文字是深色、为浅底设计的，底一变透明文字就看不见了。现在这条规则只保留 `transform` 部分。
+### 其他
+- 测试：新增指纹改写与被扫角色 9 例 + 运行时上下文指纹 5 例 + 探测请求形状 4 例 + 禁用按钮悬停 6 例，全套 72 文件 947 用例。
 ## 2.4.1 — 11128 的真正成因：system 内容指纹
 > 2.4.0 之后仍有用户撞上 `400 / 11128 Illegal API invocation from an unapproved channel`。定位下来，2.4.0 的归因是错的，这一版修的是真原因。
 ### 11128 不是身份头的问题，是 system 内容里的自报句

package/lib/bin.js

@@ -1,5 +1,5 @@
 import { createDecipheriv, createHash, randomUUID } from "node:crypto";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
 import { copyFile, mkdir, readFile, readdir, rename, rm, writeFile, writeFile as writeFile$1 } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
@@ -300,8 +300,11 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 *     it" above is the same finding from the other side).
 *   - it is case-insensitive (`you are an ai agent powered by deepseek harness`
 *     is blocked too).
-*   - only `role: "system"` is inspected: the same sentence in a `user` or
-*     `tool` message passes, and it is blocked in a second system message too.
+*   - the scanned roles are `system` and `assistant`: the same sentence in a
+*     `user` or `tool` message passes, and it is blocked in a second system
+*     message too. 2.4.1 recorded this as system-only; re-measured
+*     2026-10-21, an `assistant` message carrying the sentence 400s as well,
+*     so `prepareChatBody` rewrites both roles.
 *   - `deepseek harness` alone, or `powered by deepseek` alone, passes — the
 *     whole phrase is what matches.
 *   - replacing `powered by` with `running on` passes, which is the rewrite
@@ -313,14 +316,38 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 * lose its anchor tomorrow. Rewriting the phrase is what the report's repro
 * verified, so that is what this does.
 *
+* A SECOND FINGERPRINT (measured against the live domestic gateway 2026-10-21)
+*
+* Once the sentence above was rewritten, requests still 400/11128'd, and the
+* blocker turned out to be another region of the same DSH system prompt: the
+* runtime-context sentence pair
+*
+*   You are interacting with the user through the DeepSeek Harness Web GUI
+*   whose URL the runtime context names. When the user refers to "this page",
+*   "this GUI", or "this app" without naming another target, they mean this GUI.
+*
+* The pair is load-bearing: either sentence alone 200s, and so does the pair
+* with any small edit inside it — so this is a second CONTENT fingerprint, not
+* a prompt-length rule and not another header rule. Renaming the product's
+* "Web GUI" to "web interface" is the smallest edit that keeps the meaning for
+* the model and clears the check; it was verified at 200 against both a main
+* agent system prompt and a subagent system prompt, on the same account that
+* reproduced the 400.
+*
+* The same window in an `assistant` message also answers 400, and 200 after
+* this rewrite; `user` and `tool` messages are not scanned. That is why the
+* rewrite is applied to assistant history too — one past reply carrying a
+* fingerprint would otherwise fail every later request in the conversation.
+*
 * The list is an ARRAY because these fingerprints are appended to over time; a
 * future rejection should be one more row here, not a new code path.
 */
-const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"]]);
+const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"], [/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"]]);
 /**
-* Rewrite fingerprinted system content, leaving everything else byte-identical.
+* Rewrite fingerprinted system/assistant content, leaving everything else
+* byte-identical.
 *
-* System content arrives as either a plain string or an array of content blocks
+* Message content arrives as either a plain string or an array of content blocks
 * (an OpenAI-compatible body allows both), so both shapes are handled — fixing
 * only the string form would miss every request that carries an image or a
 * cache-control block.
@@ -962,9 +989,9 @@ var WorkBuddyUpstreamClient = class {
 	* Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
 	* force `stream: true` (the upstream rejects non-streaming), convert the
 	* DSH `developer` role into `system` (upstream rejects `developer` with
-	* business code 11128), rewrite system content the gateway fingerprints as a
-	* non-official client (also 11128), and flatten `tool_choice` into its string
-	* form.
+	* business code 11128), rewrite fingerprinted system/assistant content the
+	* gateway reads as a non-official client (also 11128), and flatten
+	* `tool_choice` into its string form.
 	*
 	* This is the REGION-BLIND half. Everything here is measured good on both
 	* gateways, so it runs before the region is known — the pool lane picks its
@@ -989,7 +1016,7 @@ var WorkBuddyUpstreamClient = class {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 			const message = value;
 			if (message["role"] === "developer") message["role"] = "system";
-			if (message["role"] === "system") message["content"] = sanitizeSystemContent(message["content"]);
+			if (message["role"] === "system" || message["role"] === "assistant") message["content"] = sanitizeSystemContent(message["content"]);
 		}
 		const choice = obj["tool_choice"];
 		if (typeof choice === "string") {
@@ -3336,6 +3363,9 @@ var WorkBuddyAccountPool = class {
 	* the LRU order: re-binding deletes then re-inserts.
 	*/
 	affinity = /* @__PURE__ */ new Map();
+	/** Where the bindings above are persisted; undefined keeps them in memory. */
+	affinityPath;
+	affinitySaveTimer;
 	lastScanAtMs = 0;
 	/**
 	* The account id the user pinned, or undefined for none.
@@ -3445,6 +3475,8 @@ var WorkBuddyAccountPool = class {
 		this.distribution = options.distribution ?? "priority";
 		this.persistent = options.persistent ?? false;
 		this.storePath = accountStorePath();
+		this.affinityPath = options.affinityPath;
+		if (this.affinityPath !== void 0) this.loadAffinity();
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -3720,6 +3752,49 @@ var WorkBuddyAccountPool = class {
 			if (oldest === void 0) break;
 			this.affinity.delete(oldest);
 		}
+		this.scheduleAffinitySave();
+	}
+	/**
+	* Restore bindings written by a previous process.
+	*
+	* Tolerant like the other state files: a malformed document or one bad entry
+	* must not take the pool down, and an account id that no longer exists is
+	* simply never matched (the next acquire re-picks and rebinds).
+	*/
+	loadAffinity() {
+		if (this.affinityPath === void 0) return;
+		try {
+			const bindings = JSON.parse(readFileSync(this.affinityPath, "utf8")).bindings;
+			if (typeof bindings !== "object" || bindings === null || Array.isArray(bindings)) return;
+			for (const [key, value] of Object.entries(bindings)) {
+				if (key === "" || typeof value !== "string" || value === "") continue;
+				this.affinity.set(key, value);
+			}
+			while (this.affinity.size > STICKY_AFFINITY_LIMIT) {
+				const oldest = this.affinity.keys().next().value;
+				if (oldest === void 0) break;
+				this.affinity.delete(oldest);
+			}
+		} catch {}
+	}
+	/** Write the bindings back, coalescing a burst into one atomic rename. */
+	scheduleAffinitySave() {
+		if (this.affinityPath === void 0 || this.affinitySaveTimer !== void 0) return;
+		this.affinitySaveTimer = setTimeout(() => {
+			this.affinitySaveTimer = void 0;
+			const path = this.affinityPath;
+			if (path === void 0) return;
+			try {
+				mkdirSync(dirname(path), { recursive: true });
+				writeFileSync(`${path}.tmp`, `${JSON.stringify({
+					version: 1,
+					bindings: Object.fromEntries(this.affinity)
+				}, null, 2)}
+`, "utf8");
+				renameSync(`${path}.tmp`, path);
+			} catch {}
+		}, 500);
+		this.affinitySaveTimer.unref?.();
 	}
 	/**
 	* `sticky`: the account this conversation already used, when it can still
@@ -11190,7 +11265,8 @@ function createCore(logger) {
 	const pool = new WorkBuddyAccountPool({
 		...logger === void 0 ? {} : { logger },
 		client,
-		persistent: true
+		persistent: true,
+		affinityPath: join(pluginDataDir(), "sticky-affinity.json")
 	});
 	return {
 		pool,

package/lib/client.js

@@ -1255,6 +1255,21 @@ window.__ModuleLoader__.load({
 .dsm-xdpool-gw-actions{display:flex;align-items:center;gap:6px;flex-wrap:wrap}
 .dsm-xdpool-gw-flash{margin:0;padding:6px 10px;border-radius:9px;border:1px solid color-mix(in srgb, var(--dsw-alias-border-l1,#ffffff14) 70%, transparent);background:color-mix(in srgb, var(--dsw-alias-bg-layer-1,#191a1e) 72%, transparent);color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:11px;line-height:17px;word-break:break-word}
 .dsm-xdpool-gw-btn{appearance:none;display:inline-flex;align-items:center;gap:6px;font:inherit;font-size:11.5px;font-weight:560;line-height:17px;padding:4px 12px;border-radius:8px;border:1px solid color-mix(in srgb, var(--dsw-alias-border-l2,#36373b) 85%, transparent);background:color-mix(in srgb, var(--dsw-alias-bg-layer-3,#2a2c33) 70%, transparent);color:var(--dsw-alias-label-secondary,#c6c9d0);cursor:pointer;white-space:nowrap;transition:border-color .16s ease,color .16s ease,background .16s ease,transform .18s var(--ease-instrument,cubic-bezier(.16,1,.3,1))}
+/* The gateway's shared-model picker. Grouped by lane, and each row carries BOTH
+   the display name and the wire id, because for the login channels they are
+   different words: the user knows the model as "Qwen3.8-Flash · 免费" and has to
+   type "qfmodel" into the client. Showing only one of the two makes the list
+   either unreadable or unusable. */
+.dsm-xdpool-gw-group{margin-top:10px;display:flex;flex-direction:column;gap:2px;min-width:0}
+.dsm-xdpool-gw-group-title{margin:0 0 2px;color:var(--dsw-alias-label-tertiary,#8a90a0);font-size:11px;line-height:16px;font-weight:650;letter-spacing:.1px;text-transform:lowercase}
+.dsm-xdpool-gw-model{display:grid;grid-template-columns:16px minmax(0,1fr) auto;align-items:center;gap:8px;padding:3px 6px;border-radius:8px;cursor:pointer;min-width:0}
+.dsm-xdpool-gw-model:hover{background:color-mix(in srgb, var(--dsw-alias-bg-layer-1,#191a1e) 60%, transparent)}
+.dsm-xdpool-gw-model input{appearance:none;width:14px;height:14px;margin:0;border-radius:4px;border:1px solid var(--dsw-alias-border-l2,#36373b);background:color-mix(in srgb, var(--dsw-alias-bg-layer-1,#191a1e) 78%, transparent);cursor:pointer;display:grid;place-items:center}
+.dsm-xdpool-gw-model input:checked{background:var(--dsw-alias-brand-primary,#5686fe);border-color:var(--dsw-alias-brand-primary,#5686fe)}
+.dsm-xdpool-gw-model input:checked::after{content:"";width:6px;height:3px;border-left:1.5px solid #fff;border-bottom:1.5px solid #fff;transform:rotate(-45deg) translateY(-1px)}
+.dsm-xdpool-gw-model input:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:1px}
+.dsm-xdpool-gw-model-name{color:var(--dsw-alias-label-primary,#e8e8ea);font-size:12px;line-height:17px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:0}
+.dsm-xdpool-gw-model-id{font-family:var(--dsw-alias-font-mono,ui-monospace,Menlo,Consolas,monospace);font-size:11px;line-height:16px;color:var(--dsw-alias-label-tertiary,#8a90a0);white-space:nowrap}
 .dsm-xdpool-gw-btn:hover:not(:disabled){transform:translateY(-1px);border-color:color-mix(in srgb, var(--dsw-alias-brand-primary,#5686fe) 55%, var(--dsw-alias-border-l2,#36373b));color:var(--dsw-alias-label-primary,#e8e8ea)}
 .dsm-xdpool-gw-btn:active:not(:disabled){transform:translateY(0);box-shadow:inset 0 2px 4px rgb(0 0 0 / 22%)}
 .dsm-xdpool-gw-btn:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:2px}
@@ -1340,7 +1355,14 @@ window.__ModuleLoader__.load({
 .dsm-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid transparent;border-radius:8px;padding:5px 14px;font-size:13px;line-height:1.5}
 .dsm-btn:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:1px}
 .dsm-btn:disabled{opacity:.4;cursor:default;filter:saturate(.35);transform:none}
-.dsm-btn:disabled:hover{transform:none;background:transparent}
+/* Only the transform is neutralised here. Every variant's hover background is
+   already gated with ":not(:disabled)", so a disabled button never acquires one
+   and this rule has nothing to undo — but background:transparent used to sit
+   beside it, and at specificity (0,3,0) it beat .dsm-btn-primary's (0,1,0)
+   fill. The primary label is a dark colour designed for a light background, so
+   on a dark panel the fill went transparent, the text stayed dark, and the
+   button appeared to vanish the moment the cursor reached it. */
+.dsm-btn:disabled:hover{transform:none}
 .dsm-btn-outline{border-color:var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);background:transparent;font-weight:500}
 .dsm-btn-outline:hover:not(:disabled){color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-dimmed);background:rgba(255,255,255,.04)}
 .dsm-btn-primary{background:var(--dsw-alias-label-primary,#e6e6e6);color:var(--dsw-alias-bg-layer-3,#202126)}
@@ -10769,6 +10791,35 @@ window.__ModuleLoader__.load({
 			const [revealed, setRevealed] = (0, react.useState)(false);
 			const [host, setHost] = (0, react.useState)("127.0.0.1");
 			const [port, setPort] = (0, react.useState)("8326");
+			/**
+			* The in-progress share list, or undefined while it still mirrors the server.
+			*
+			* Held as a draft for the same reason the model card holds one: saving is a
+			* deliberate act here, because every unchecked row stops working on whatever
+			* device is already pointed at the gateway.
+			*/
+			const [draftShared, setDraftShared] = (0, react.useState)(void 0);
+			/**
+			* Which ids are shared right now.
+			*
+			* `status.shared === undefined` means the user has never chosen, and the
+			* gateway is serving everything — so the picker must show every row ticked
+			* rather than an empty list, which would read as "nothing is shared" and invite
+			* a save that closes a gateway that was open.
+			*/
+			const candidates = status?.candidates ?? [];
+			const serverShared = status?.shared ?? candidates.map((row) => row.id);
+			const shared = draftShared ?? new Set(serverShared);
+			const sharedDirty = draftShared !== void 0 && (draftShared.size !== serverShared.length || [...draftShared].some((id) => !serverShared.includes(id)));
+			const toggleShared = (id) => {
+				const next = new Set(shared);
+				if (next.has(id)) next.delete(id);
+				else next.add(id);
+				setDraftShared(next);
+			};
+			const setAllShared = (on) => {
+				setDraftShared(on ? new Set(candidates.map((row) => row.id)) : /* @__PURE__ */ new Set());
+			};
 			/** True once the server's values were adopted, so polls do not stomp edits. */
 			const seeded = (0, react.useRef)(false);
 			const mounted = (0, react.useRef)(true);
@@ -11008,6 +11059,92 @@ window.__ModuleLoader__.load({
 							})
 						]
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-xdpool-sec",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-xdpool-sectitle",
+								children: t?.("gw.share") ?? "Shared models"
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-xdpool-gw-note",
+								children: t?.("gw.shareHint") ?? ""
+							}),
+							candidates.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-xdpool-gw-note",
+								children: t?.("gw.shareNone") ?? ""
+							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "dsm-xdpool-gw-actions",
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: "dsm-xdpool-gw-btn",
+											"data-on": "false",
+											disabled: busy,
+											onClick: () => {
+												setAllShared(true);
+											},
+											children: t?.("gw.shareAll") ?? "Select all"
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: "dsm-xdpool-gw-btn",
+											"data-on": "false",
+											disabled: busy,
+											onClick: () => {
+												setAllShared(false);
+											},
+											children: t?.("gw.shareNoneBtn") ?? "Select none"
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: "dsm-xdpool-gw-btn",
+											"data-on": "true",
+											disabled: busy || !sharedDirty,
+											onClick: () => {
+												write({ models: [...shared] }).then(() => {
+													setDraftShared(void 0);
+												});
+											},
+											children: t?.("gw.shareSave") ?? "Save"
+										})
+									]
+								}),
+								sharedDirty ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: "dsm-xdpool-gw-warn",
+									children: t?.("gw.shareDirty") ?? ""
+								}) : null,
+								[...new Set(candidates.map((row) => row.source))].map((source) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "dsm-xdpool-gw-group",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										className: "dsm-xdpool-gw-group-title",
+										children: source
+									}), candidates.filter((row) => row.source === source).map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										className: "dsm-xdpool-gw-model",
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+												type: "checkbox",
+												checked: shared.has(row.id),
+												disabled: busy,
+												onChange: () => {
+													toggleShared(row.id);
+												}
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsm-xdpool-gw-model-name",
+												children: row.name
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsm-xdpool-gw-model-id",
+												children: row.id
+											})
+										]
+									}, row.id))]
+								}, source))
+							] })
+						]
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dsm-xdpool-sec",
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -12188,7 +12325,7 @@ window.__ModuleLoader__.load({
 		*
 		* @module dsh-xdpool/version
 		*/
-		const POOL_VERSION = "2.4.1";
+		const POOL_VERSION = "2.4.3";
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**
@@ -14954,6 +15091,15 @@ window.__ModuleLoader__.load({
 			"gw.usageHint": "Any OpenAI-compatible app works. Set its base URL to the endpoint above, pick a model out of /v1/models, and send this key as the API key. The relay passes /v1/models and /v1/chat/completions only; everything else is refused before a byte is forwarded.",
 			"gw.loading": "Reading the relay status…",
 			"gw.saveFailed": "Could not save",
+			"gw.share": "Shared models",
+			"gw.shareHint": "Only the ticked models are reachable over the gateway. Unticking one does not just hide it from /v1/models — the gateway refuses it, because the relay key is a single secret shared by every device on the network, and a listing a client can ignore is not a restriction.",
+			"gw.shareNone": "Nothing to offer yet: no model is reachable until an account pool, an aggregate key or a signed-in channel provides one.",
+			"gw.shareAll": "Select all",
+			"gw.shareNoneBtn": "Select none",
+			"gw.shareSave": "Save sharing",
+			"gw.shareSaved": "Gateway sharing updated",
+			"gw.shareDirty": "Not saved yet. A device already using an unticked model will start getting 403.",
+			"gw.shareCount": "{shared} of {total} shared",
 			"ledger.title": "Data dashboard",
 			"ledger.sub": "Every number here is counted from calls this pool actually made.",
 			"ledger.window": "last {count} call(s)",
@@ -15456,6 +15602,15 @@ window.__ModuleLoader__.load({
 			"gw.usageHint": "任何 OpenAI 兼容的客户端都行：接口地址填上面那个入口，模型从 /v1/models 里挑，密钥填到这个 API 密钥的位置。中继只放行 /v1/models 和 /v1/chat/completions，其余路径在转发任何字节之前就拒掉。",
 			"gw.loading": "正在读取中继状态……",
 			"gw.saveFailed": "没能保存",
+			"gw.share": "共享哪些模型",
+			"gw.shareHint": "只有勾选的模型能通过网关访问。取消勾选不只是把它从 /v1/models 里藏起来——网关会直接拒绝它。因为中继密钥是整台网络上所有设备共用的同一把，而一份客户端可以无视的列表算不上限制。",
+			"gw.shareNone": "暂时无可提供：在账号池、聚合渠道密钥或已登录的渠道给出模型之前，这里不会有任何条目。",
+			"gw.shareAll": "全选",
+			"gw.shareNoneBtn": "全不选",
+			"gw.shareSave": "保存共享设置",
+			"gw.shareSaved": "网关共享设置已更新",
+			"gw.shareDirty": "尚未保存。已在使用某个被取消勾选模型的设备，会开始收到 403。",
+			"gw.shareCount": "已共享 {shared} / {total}",
 			"ledger.title": "数据看板",
 			"ledger.sub": "这里每个数字，都是这个池子真实发出去的调用数出来的。",
 			"ledger.window": "最近 {count} 次调用",