grix-connector 3.7.1 → 3.8.1

package/dist/core/admin/admin-server.js

@@ -1 +1 @@
-import{createServer as u}from"node:http";import{log as c}from"../log/logger.js";class f{server=null;token;handler=null;upgradeHandler=null;probeHandler=null;installHandler=null;proxyHandler=null;constructor(e){this.token=e}setAgentHandler(e){this.handler=e}setUpgradeHandler(e){this.upgradeHandler=e}setProbeHandler(e){this.probeHandler=e}setInstallHandler(e){this.installHandler=e}setProxyHandler(e){this.proxyHandler=e}async start(e){return new Promise((n,t)=>{this.server=u((r,s)=>this.handleRequest(r,s)),this.server.listen(e,"127.0.0.1",()=>{c.info("admin",`Listening on 127.0.0.1:${e}`),n()}),this.server.on("error",t)})}async stop(){if(this.server)return new Promise(e=>{this.server.close(()=>e())})}handleRequest(e,n){const t=e.method??"",r=e.url??"";if(r==="/api/agents"&&t==="GET")this.handleList(n);else if(r==="/api/agents"&&t==="POST")this.readBody(e).then(s=>this.handleAdd(n,s)).catch(s=>this.error(n,s));else if(t==="DELETE"&&r.startsWith("/api/agents/")){const s=decodeURIComponent(r.slice(12));this.handleRemove(n,s)}else if(t==="POST"&&r.match(/^\/api\/agents\/[^/]+\/restart$/)){const s=decodeURIComponent(r.slice(12,r.lastIndexOf("/restart")));this.handleRestart(n,s)}else if(r==="/api/reload"&&t==="POST")this.handleReload(n);else if(r==="/api/upgrade"&&t==="GET")this.handleCheckUpgrade(n);else if(r==="/api/upgrade"&&t==="POST")this.handleTriggerUpgrade(n);else if(t==="GET"&&r.startsWith("/api/probe"))this.handleProbe(e,n,r);else if(r==="/api/install"&&t==="GET")this.handleInstallList(n);else if(r==="/api/install"&&t==="POST")this.readBody(e).then(s=>this.handleInstall(n,s)).catch(s=>this.error(n,s));else if(t==="GET"&&r.startsWith("/api/install/")){const s=decodeURIComponent(r.slice(13));this.handleInstallProgress(n,s)}else if(r==="/api/proxy"&&t==="GET")this.handleProxyStatus(n);else if(t==="PUT"&&r.match(/^\/api\/proxy\/agents\/[^/]+\/enabled$/)){const s=decodeURIComponent(r.slice(18,-8));this.readBody(e).then(o=>this.handleProxySetAgentRelay(n,s,o)).catch(o=>this.error(n,o))}else if(t==="PUT"&&r.match(/^\/api\/proxy\/agents\/[^/]+\/relay-credential$/)){const s=decodeURIComponent(r.slice(18,-17));this.readBody(e).then(o=>this.handleProxySetAgentRelayCredential(n,s,o)).catch(o=>this.error(n,o))}else if(t==="PUT"&&r==="/api/proxy/enabled")this.readBody(e).then(s=>this.handleProxySetEnabled(n,s)).catch(s=>this.error(n,s));else if(t==="PUT"&&r==="/api/proxy/default-route")this.readBody(e).then(s=>this.handleProxySetDefaultRoute(n,s)).catch(s=>this.error(n,s));else if(t==="PUT"&&r==="/api/proxy/intercept-hosts")this.readBody(e).then(s=>this.handleProxySetInterceptHosts(n,s)).catch(s=>this.error(n,s));else if(t==="PUT"&&r.match(/^\/api\/proxy\/routes\/[^/]+$/)){const s=decodeURIComponent(r.slice(18));this.readBody(e).then(o=>this.handleProxySetRoute(n,s,o)).catch(o=>this.error(n,o))}else if(t==="DELETE"&&r.startsWith("/api/proxy/routes/")){const s=decodeURIComponent(r.slice(18));this.handleProxyDeleteRoute(n,s)}else this.json(n,404,{error:"not_found"})}ensureProxy(e){return this.proxyHandler?!0:(this.json(e,501,{error:"proxy not configured"}),!1)}handleProxyStatus(e){if(this.ensureProxy(e))try{this.json(e,200,this.proxyHandler.status())}catch(n){this.error(e,n)}}async handleProxySetRoute(e,n,t){if(!this.ensureProxy(e))return;const r=t;if(!r||typeof r.targetBaseUrl!="string"||!r.targetBaseUrl.trim()){this.json(e,400,{error:"targetBaseUrl is required"});return}try{new URL(r.targetBaseUrl)}catch{this.json(e,400,{error:"targetBaseUrl must be a valid URL"});return}if(r.headers!==void 0&&!this.isStringRecord(r.headers)){this.json(e,400,{error:"headers must be a string map"});return}if(r.model!==void 0&&typeof r.model!="string"){this.json(e,400,{error:"model must be a string"});return}if(r.modelMap!==void 0&&!this.isStringRecord(r.modelMap)){this.json(e,400,{error:"modelMap must be a string map"});return}if(r.passthrough!==void 0&&typeof r.passthrough!="boolean"){this.json(e,400,{error:"passthrough must be a boolean"});return}if(r.relayOnly!==void 0&&typeof r.relayOnly!="boolean"){this.json(e,400,{error:"relayOnly must be a boolean"});return}if(r.codexResponsesToChat!==void 0&&typeof r.codexResponsesToChat!="boolean"){this.json(e,400,{error:"codexResponsesToChat must be a boolean"});return}if(r.passthrough===!0&&r.codexResponsesToChat===!0){this.json(e,400,{error:"passthrough and codexResponsesToChat are mutually exclusive"});return}try{const s=await this.proxyHandler.setRoute(n,t);this.json(e,200,s??{ok:!0})}catch(s){this.error(e,s)}}handleProxyDeleteRoute(e,n){this.ensureProxy(e)&&this.proxyHandler.deleteRoute(n).then(()=>{e.writeHead(204),e.end()}).catch(t=>this.error(e,t))}async handleProxySetAgentRelay(e,n,t){if(!this.ensureProxy(e))return;const r=n.trim();if(!r){this.json(e,400,{error:"agent name is required"});return}const s=t;if(typeof s?.enabled!="boolean"){this.json(e,400,{error:"enabled must be a boolean"});return}try{const o=await this.proxyHandler.setAgentRelay(r,s.enabled);this.json(e,200,o??{ok:!0})}catch(o){this.error(e,o)}}async handleProxySetAgentRelayCredential(e,n,t){if(!this.ensureProxy(e))return;const r=n.trim();if(!r){this.json(e,400,{error:"agent name is required",code:"INVALID_ARGUMENT"});return}const s=t;if(typeof s?.agent_id!="string"||!s.agent_id.trim()){this.json(e,400,{error:"agent_id is required",code:"MISSING_AGENT_ID"});return}if(typeof s?.virtual_key!="string"||!s.virtual_key.trim()){this.json(e,400,{error:"virtual_key is required",code:"MISSING_VIRTUAL_KEY"});return}if(s.anthropic_base_url!==void 0&&typeof s.anthropic_base_url!="string"){this.json(e,400,{error:"anthropic_base_url must be a string",code:"INVALID_ARGUMENT"});return}if(s.openai_base_url!==void 0&&typeof s.openai_base_url!="string"){this.json(e,400,{error:"openai_base_url must be a string",code:"INVALID_ARGUMENT"});return}if(s.model!==void 0&&typeof s.model!="string"){this.json(e,400,{error:"model must be a string",code:"INVALID_ARGUMENT"});return}try{const o=await this.proxyHandler.setAgentRelayCredential(r,{agentId:s.agent_id,virtualKey:s.virtual_key,anthropicBaseUrl:typeof s.anthropic_base_url=="string"?s.anthropic_base_url:void 0,openaiBaseUrl:typeof s.openai_base_url=="string"?s.openai_base_url:void 0,model:typeof s.model=="string"?s.model:void 0});this.json(e,200,o??{ok:!0})}catch(o){this.error(e,o)}}async handleProxySetEnabled(e,n){if(!this.ensureProxy(e))return;const t=n;if(typeof t?.enabled!="boolean"){this.json(e,400,{error:"enabled must be a boolean"});return}if(t.enabled){this.json(e,400,{error:'relay is per-agent; use PUT /api/proxy/agents/<name>/enabled {"enabled":true}'});return}try{const r=await this.proxyHandler.disableAll();this.json(e,200,r??{ok:!0})}catch(r){this.error(e,r)}}async handleProxySetDefaultRoute(e,n){if(!this.ensureProxy(e))return;const r=n?.routeKey??null;if(r!==null&&typeof r!="string"){this.json(e,400,{error:"routeKey must be a string or null"});return}try{const s=await this.proxyHandler.setDefaultRoute(r);this.json(e,200,s??{ok:!0})}catch(s){this.error(e,s)}}async handleProxySetInterceptHosts(e,n){if(!this.ensureProxy(e))return;const t=n;if(!Array.isArray(t?.hosts)||!t.hosts.every(r=>typeof r=="string")){this.json(e,400,{error:"hosts must be a string array"});return}try{const r=await this.proxyHandler.setInterceptHosts(t.hosts);this.json(e,200,r??{ok:!0})}catch(r){this.error(e,r)}}isStringRecord(e){return typeof e!="object"||e===null||Array.isArray(e)?!1:Object.values(e).every(n=>typeof n=="string")}handleList(e){try{const n=this.handler?.list()??[];this.json(e,200,n)}catch(n){this.error(e,n)}}async handleAdd(e,n){try{const t=await this.handler.add(n);this.json(e,201,t??{ok:!0})}catch(t){this.error(e,t)}}handleRemove(e,n){this.handler.remove(n).then(()=>{e.writeHead(204),e.end()}).catch(t=>this.error(e,t))}handleRestart(e,n){this.handler.restart(n).then(()=>{this.json(e,200,{ok:!0})}).catch(t=>this.error(e,t))}handleReload(e){this.handler.reload().then(n=>{this.json(e,200,{ok:!0,result:n})}).catch(n=>this.error(e,n))}handleCheckUpgrade(e){if(!this.upgradeHandler){this.json(e,501,{error:"upgrade not configured"});return}this.upgradeHandler.check().then(n=>{this.json(e,200,n)}).catch(n=>this.error(e,n))}handleTriggerUpgrade(e){if(!this.upgradeHandler){this.json(e,501,{error:"upgrade not configured"});return}this.upgradeHandler.trigger(),this.json(e,200,{ok:!0,message:"upgrade check triggered"})}error(e,n){const t=n;t.code==="NOT_FOUND"?this.json(e,404,{error:t.message??"not found"}):t.code==="RELOAD_UNSAFE"||t.code==="NO_RELAY_ROUTE"||t.code==="AGENT_ID_MISMATCH"?this.json(e,409,{error:t.message,code:t.code}):t.code==="UNKNOWN_AGENT"||t.code==="UNSUPPORTED_OS"||t.code==="UNSUPPORTED_CLIENT_TYPE"||t.code==="MISSING_AGENT_ID"||t.code==="MISSING_VIRTUAL_KEY"||t.code==="MISSING_TARGET_BASE_URL"||t.code==="MISSING_MODEL"||t.code==="INVALID_TARGET_BASE_URL"||t.code==="INVALID_ARGUMENT"?this.json(e,400,{error:t.message,code:t.code}):t.code==="ALREADY_INSTALLED"||t.code==="INSTALL_IN_PROGRESS"?this.json(e,409,{error:t.message,code:t.code}):t.code==="INSTALL_FAILED"||t.code==="INSTALL_TIMEOUT"||t.code==="PREFLIGHT_FAILED"||t.code==="VERIFICATION_FAILED"||t.code==="PREREQ_MISSING"||t.code==="PREREQ_INSTALL_FAILED"||t.code==="FALLBACK_EXHAUSTED"||t.code==="ENVIRONMENT_UNSUPPORTED"?this.json(e,500,{error:t.message,code:t.code}):(c.error("admin",`Handler error: ${t.message??n}`),this.json(e,500,{error:t.message??"internal error"}))}json(e,n,t){const r=JSON.stringify(t);e.writeHead(n,{"Content-Type":"application/json"}),e.end(r)}readBody(e){return new Promise((n,t)=>{let r="";e.setEncoding("utf8"),e.on("data",s=>{r+=s}),e.on("end",()=>{try{n(JSON.parse(r))}catch{t(new Error("invalid JSON body"))}}),e.on("error",t)})}handleProbe(e,n,t){if(!this.probeHandler){this.json(n,501,{error:"probe not configured"});return}const r=t.indexOf("?"),s=r>=0?t.slice(0,r):t,o=r>=0?new URLSearchParams(t.slice(r+1)):new URLSearchParams,a={};o.get("conversation")==="true"&&(a.conversation=!0),o.get("fresh")==="true"&&(a.fresh=!0);const l=Number(o.get("timeoutMs"));Number.isFinite(l)&&l>0&&(a.timeoutMs=l);const d=s.match(/^\/api\/probe\/(.+)$/);if(d){const i=decodeURIComponent(d[1]);this.probeHandler.probeOne(i,a).then(h=>{this.json(n,200,h)}).catch(h=>this.error(n,h));return}this.probeHandler.probeAll(a).then(i=>{this.json(n,200,i)}).catch(i=>this.error(n,i))}handleInstallList(e){if(!this.installHandler){this.json(e,501,{error:"install not configured"});return}try{const n=this.installHandler.listInstallable();this.json(e,200,n)}catch(n){this.error(e,n)}}handleInstallProgress(e,n){if(!this.installHandler){this.json(e,501,{error:"install not configured"});return}const t=this.installHandler.getInstallProgress(n);if(!t){this.json(e,200,{agentType:n,status:"unknown",inProgress:!1,progress:null});return}let r,s,o;switch(t.phase){case"completed":r="done",s="\u5B89\u88C5\u5B8C\u6210";break;case"failed":r="error",o=t.outputTail||"\u5B89\u88C5\u5931\u8D25";break;case"preflight":r="pending",s="\u68C0\u67E5\u524D\u7F6E\u4F9D\u8D56...";break;case"installing_prereq":r="downloading",s=t.currentPrereq?`\u6B63\u5728\u5B89\u88C5\u524D\u7F6E\u4F9D\u8D56: ${t.currentPrereq}`:"\u6B63\u5728\u5B89\u88C5\u524D\u7F6E\u4F9D\u8D56...";break;case"installing":r="installing",s=`\u6B63\u5728\u5B89\u88C5 ${n}...`;break;case"verifying":r="installing",s="\u9A8C\u8BC1\u5B89\u88C5...";break;default:r="unknown"}this.json(e,200,{agentType:n,status:r,inProgress:!0,progress:t.elapsedMs?Math.min(.9,t.elapsedMs/3e4):.1,message:s,error:o})}async handleInstall(e,n){if(!this.installHandler){this.json(e,501,{error:"install not configured"});return}try{const t=n;if(!t||typeof t.agentType!="string"||!t.agentType){this.json(e,400,{error:"agentType is required"});return}const r=await this.installHandler.installAgent(t);if(r.ok)this.json(e,200,r);else{const s=r.error?.code;s==="UNKNOWN_AGENT"||s==="UNSUPPORTED_OS"?this.json(e,400,r):s==="INSTALL_IN_PROGRESS"?this.json(e,409,r):this.json(e,500,r)}}catch(t){this.error(e,t)}}}export{f as AdminServer};
+import{createServer as u}from"node:http";import{log as c}from"../log/logger.js";class g{server=null;token;handler=null;upgradeHandler=null;probeHandler=null;installHandler=null;proxyHandler=null;relayCredentialHandler=null;constructor(e){this.token=e}setAgentHandler(e){this.handler=e}setUpgradeHandler(e){this.upgradeHandler=e}setProbeHandler(e){this.probeHandler=e}setInstallHandler(e){this.installHandler=e}setProxyHandler(e){this.proxyHandler=e}setRelayCredentialHandler(e){this.relayCredentialHandler=e}async start(e){return new Promise((n,t)=>{this.server=u((r,o)=>this.handleRequest(r,o)),this.server.listen(e,"127.0.0.1",()=>{c.info("admin",`Listening on 127.0.0.1:${e}`),n()}),this.server.on("error",t)})}async stop(){if(this.server)return new Promise(e=>{this.server.close(()=>e())})}handleRequest(e,n){const t=e.method??"",r=e.url??"";if(r==="/api/agents"&&t==="GET")this.handleList(n);else if(r==="/api/agents"&&t==="POST")this.readBody(e).then(o=>this.handleAdd(n,o)).catch(o=>this.error(n,o));else if(t==="DELETE"&&r.startsWith("/api/agents/")){const o=decodeURIComponent(r.slice(12));this.handleRemove(n,o)}else if(t==="POST"&&r.match(/^\/api\/agents\/[^/]+\/restart$/)){const o=decodeURIComponent(r.slice(12,r.lastIndexOf("/restart")));this.handleRestart(n,o)}else if(r==="/api/reload"&&t==="POST")this.handleReload(n);else if(r==="/api/upgrade"&&t==="GET")this.handleCheckUpgrade(n);else if(r==="/api/upgrade"&&t==="POST")this.handleTriggerUpgrade(n);else if(t==="GET"&&r.startsWith("/api/probe"))this.handleProbe(e,n,r);else if(r==="/api/install"&&t==="GET")this.handleInstallList(n);else if(r==="/api/install"&&t==="POST")this.readBody(e).then(o=>this.handleInstall(n,o)).catch(o=>this.error(n,o));else if(t==="GET"&&r.startsWith("/api/install/")){const o=decodeURIComponent(r.slice(13));this.handleInstallProgress(n,o)}else if(r==="/api/proxy"&&t==="GET")this.handleProxyStatus(n);else if(t==="PUT"&&r.match(/^\/api\/proxy\/agents\/[^/]+\/enabled$/)){const o=decodeURIComponent(r.slice(18,-8));this.readBody(e).then(s=>this.handleProxySetAgentRelay(n,o,s)).catch(s=>this.error(n,s))}else if(t==="PUT"&&r.match(/^\/api\/proxy\/agents\/[^/]+\/relay-credential$/)){const o=decodeURIComponent(r.slice(18,-17));this.readBody(e).then(s=>this.handleProxySetAgentRelayCredential(n,o,s)).catch(s=>this.error(n,s))}else if(r==="/api/proxy/hermes-profiles"&&t==="GET")this.handleHermesProfileList(n);else if(t==="PUT"&&r.match(/^\/api\/proxy\/relay-credential\/[^/]+$/)){const o=decodeURIComponent(r.slice(28));this.readBody(e).then(s=>this.handleRelayCredentialEnable(n,o,s)).catch(s=>this.error(n,s))}else if(t==="DELETE"&&r.match(/^\/api\/proxy\/relay-credential\/[^/]+$/)){const o=decodeURIComponent(r.slice(28));this.handleRelayCredentialDisable(n,o)}else if(t==="PUT"&&r==="/api/proxy/enabled")this.readBody(e).then(o=>this.handleProxySetEnabled(n,o)).catch(o=>this.error(n,o));else if(t==="PUT"&&r==="/api/proxy/default-route")this.readBody(e).then(o=>this.handleProxySetDefaultRoute(n,o)).catch(o=>this.error(n,o));else if(t==="PUT"&&r==="/api/proxy/intercept-hosts")this.readBody(e).then(o=>this.handleProxySetInterceptHosts(n,o)).catch(o=>this.error(n,o));else if(t==="PUT"&&r.match(/^\/api\/proxy\/routes\/[^/]+$/)){const o=decodeURIComponent(r.slice(18));this.readBody(e).then(s=>this.handleProxySetRoute(n,o,s)).catch(s=>this.error(n,s))}else if(t==="DELETE"&&r.startsWith("/api/proxy/routes/")){const o=decodeURIComponent(r.slice(18));this.handleProxyDeleteRoute(n,o)}else this.json(n,404,{error:"not_found"})}ensureRelayCredential(e){return this.relayCredentialHandler?!0:(this.json(e,501,{error:"relay credential handler not configured"}),!1)}handleHermesProfileList(e){this.ensureRelayCredential(e)&&this.relayCredentialHandler.listHermesProfiles().then(n=>this.json(e,200,{profiles:n})).catch(n=>this.error(e,n))}async handleRelayCredentialEnable(e,n,t){if(!this.ensureRelayCredential(e))return;const r=t,o=s=>typeof s=="string"&&s.trim()?s.trim():void 0;try{const s=await this.relayCredentialHandler.enable(n.trim(),{virtualKey:o(r?.virtual_key)??"",anthropicBaseUrl:o(r?.anthropic_base_url),openaiBaseUrl:o(r?.openai_base_url),model:o(r?.model)});this.json(e,200,s??{ok:!0})}catch(s){this.error(e,s)}}handleRelayCredentialDisable(e,n){this.ensureRelayCredential(e)&&this.relayCredentialHandler.disable(n.trim()).then(t=>this.json(e,200,t??{ok:!0})).catch(t=>this.error(e,t))}ensureProxy(e){return this.proxyHandler?!0:(this.json(e,501,{error:"proxy not configured"}),!1)}handleProxyStatus(e){if(this.ensureProxy(e))try{this.json(e,200,this.proxyHandler.status())}catch(n){this.error(e,n)}}async handleProxySetRoute(e,n,t){if(!this.ensureProxy(e))return;const r=t;if(!r||typeof r.targetBaseUrl!="string"||!r.targetBaseUrl.trim()){this.json(e,400,{error:"targetBaseUrl is required"});return}try{new URL(r.targetBaseUrl)}catch{this.json(e,400,{error:"targetBaseUrl must be a valid URL"});return}if(r.headers!==void 0&&!this.isStringRecord(r.headers)){this.json(e,400,{error:"headers must be a string map"});return}if(r.model!==void 0&&typeof r.model!="string"){this.json(e,400,{error:"model must be a string"});return}if(r.modelMap!==void 0&&!this.isStringRecord(r.modelMap)){this.json(e,400,{error:"modelMap must be a string map"});return}if(r.passthrough!==void 0&&typeof r.passthrough!="boolean"){this.json(e,400,{error:"passthrough must be a boolean"});return}if(r.relayOnly!==void 0&&typeof r.relayOnly!="boolean"){this.json(e,400,{error:"relayOnly must be a boolean"});return}if(r.codexResponsesToChat!==void 0&&typeof r.codexResponsesToChat!="boolean"){this.json(e,400,{error:"codexResponsesToChat must be a boolean"});return}if(r.passthrough===!0&&r.codexResponsesToChat===!0){this.json(e,400,{error:"passthrough and codexResponsesToChat are mutually exclusive"});return}try{const o=await this.proxyHandler.setRoute(n,t);this.json(e,200,o??{ok:!0})}catch(o){this.error(e,o)}}handleProxyDeleteRoute(e,n){this.ensureProxy(e)&&this.proxyHandler.deleteRoute(n).then(()=>{e.writeHead(204),e.end()}).catch(t=>this.error(e,t))}async handleProxySetAgentRelay(e,n,t){if(!this.ensureProxy(e))return;const r=n.trim();if(!r){this.json(e,400,{error:"agent name is required"});return}const o=t;if(typeof o?.enabled!="boolean"){this.json(e,400,{error:"enabled must be a boolean"});return}try{const s=await this.proxyHandler.setAgentRelay(r,o.enabled);this.json(e,200,s??{ok:!0})}catch(s){this.error(e,s)}}async handleProxySetAgentRelayCredential(e,n,t){if(!this.ensureProxy(e))return;const r=n.trim();if(!r){this.json(e,400,{error:"agent name is required",code:"INVALID_ARGUMENT"});return}const o=t;if(typeof o?.agent_id!="string"||!o.agent_id.trim()){this.json(e,400,{error:"agent_id is required",code:"MISSING_AGENT_ID"});return}if(typeof o?.virtual_key!="string"||!o.virtual_key.trim()){this.json(e,400,{error:"virtual_key is required",code:"MISSING_VIRTUAL_KEY"});return}if(o.anthropic_base_url!==void 0&&typeof o.anthropic_base_url!="string"){this.json(e,400,{error:"anthropic_base_url must be a string",code:"INVALID_ARGUMENT"});return}if(o.openai_base_url!==void 0&&typeof o.openai_base_url!="string"){this.json(e,400,{error:"openai_base_url must be a string",code:"INVALID_ARGUMENT"});return}if(o.model!==void 0&&typeof o.model!="string"){this.json(e,400,{error:"model must be a string",code:"INVALID_ARGUMENT"});return}try{const s=await this.proxyHandler.setAgentRelayCredential(r,{agentId:o.agent_id,virtualKey:o.virtual_key,anthropicBaseUrl:typeof o.anthropic_base_url=="string"?o.anthropic_base_url:void 0,openaiBaseUrl:typeof o.openai_base_url=="string"?o.openai_base_url:void 0,model:typeof o.model=="string"?o.model:void 0});this.json(e,200,s??{ok:!0})}catch(s){this.error(e,s)}}async handleProxySetEnabled(e,n){if(!this.ensureProxy(e))return;const t=n;if(typeof t?.enabled!="boolean"){this.json(e,400,{error:"enabled must be a boolean"});return}if(t.enabled){this.json(e,400,{error:'relay is per-agent; use PUT /api/proxy/agents/<name>/enabled {"enabled":true}'});return}try{const r=await this.proxyHandler.disableAll();this.json(e,200,r??{ok:!0})}catch(r){this.error(e,r)}}async handleProxySetDefaultRoute(e,n){if(!this.ensureProxy(e))return;const r=n?.routeKey??null;if(r!==null&&typeof r!="string"){this.json(e,400,{error:"routeKey must be a string or null"});return}try{const o=await this.proxyHandler.setDefaultRoute(r);this.json(e,200,o??{ok:!0})}catch(o){this.error(e,o)}}async handleProxySetInterceptHosts(e,n){if(!this.ensureProxy(e))return;const t=n;if(!Array.isArray(t?.hosts)||!t.hosts.every(r=>typeof r=="string")){this.json(e,400,{error:"hosts must be a string array"});return}try{const r=await this.proxyHandler.setInterceptHosts(t.hosts);this.json(e,200,r??{ok:!0})}catch(r){this.error(e,r)}}isStringRecord(e){return typeof e!="object"||e===null||Array.isArray(e)?!1:Object.values(e).every(n=>typeof n=="string")}handleList(e){try{const n=this.handler?.list()??[];this.json(e,200,n)}catch(n){this.error(e,n)}}async handleAdd(e,n){try{const t=await this.handler.add(n);this.json(e,201,t??{ok:!0})}catch(t){this.error(e,t)}}handleRemove(e,n){this.handler.remove(n).then(()=>{e.writeHead(204),e.end()}).catch(t=>this.error(e,t))}handleRestart(e,n){this.handler.restart(n).then(()=>{this.json(e,200,{ok:!0})}).catch(t=>this.error(e,t))}handleReload(e){this.handler.reload().then(n=>{this.json(e,200,{ok:!0,result:n})}).catch(n=>this.error(e,n))}handleCheckUpgrade(e){if(!this.upgradeHandler){this.json(e,501,{error:"upgrade not configured"});return}this.upgradeHandler.check().then(n=>{this.json(e,200,n)}).catch(n=>this.error(e,n))}handleTriggerUpgrade(e){if(!this.upgradeHandler){this.json(e,501,{error:"upgrade not configured"});return}this.upgradeHandler.trigger(),this.json(e,200,{ok:!0,message:"upgrade check triggered"})}error(e,n){const t=n;t.code==="NOT_FOUND"?this.json(e,404,{error:t.message??"not found"}):t.code==="PROFILE_NOT_FOUND"?this.json(e,404,{error:t.message,code:t.code}):t.code==="PROXY_UNAVAILABLE"?this.json(e,503,{error:t.message,code:t.code}):t.code==="AMBIGUOUS_AGENT_ID"?this.json(e,409,{error:t.message,code:t.code}):t.code==="HERMES_NOT_FOUND"||t.code==="HERMES_IMPORT_FAILED"||t.code==="SCRIPT_MISSING"||t.code==="SCRIPT_FAILED"||t.code==="CONFIG_WRITE_FAILED"||t.code==="CONFIG_WRITE_VERIFY_FAILED"||t.code==="CONFIG_UNREADABLE"?this.json(e,500,{error:t.message,code:t.code}):t.code==="RELOAD_UNSAFE"||t.code==="NO_RELAY_ROUTE"||t.code==="AGENT_ID_MISMATCH"?this.json(e,409,{error:t.message,code:t.code}):t.code==="UNKNOWN_AGENT"||t.code==="UNSUPPORTED_OS"||t.code==="UNSUPPORTED_CLIENT_TYPE"||t.code==="MISSING_AGENT_ID"||t.code==="MISSING_VIRTUAL_KEY"||t.code==="MISSING_TARGET_BASE_URL"||t.code==="MISSING_MODEL"||t.code==="MISSING_BASE_URL"||t.code==="MISSING_API_KEY"||t.code==="INVALID_BASE_URL"||t.code==="BAD_REQUEST"||t.code==="INVALID_TARGET_BASE_URL"||t.code==="INVALID_ARGUMENT"?this.json(e,400,{error:t.message,code:t.code}):t.code==="ALREADY_INSTALLED"||t.code==="INSTALL_IN_PROGRESS"?this.json(e,409,{error:t.message,code:t.code}):t.code==="INSTALL_FAILED"||t.code==="INSTALL_TIMEOUT"||t.code==="PREFLIGHT_FAILED"||t.code==="VERIFICATION_FAILED"||t.code==="PREREQ_MISSING"||t.code==="PREREQ_INSTALL_FAILED"||t.code==="FALLBACK_EXHAUSTED"||t.code==="ENVIRONMENT_UNSUPPORTED"?this.json(e,500,{error:t.message,code:t.code}):(c.error("admin",`Handler error: ${t.message??n}`),this.json(e,500,{error:t.message??"internal error"}))}json(e,n,t){const r=JSON.stringify(t);e.writeHead(n,{"Content-Type":"application/json"}),e.end(r)}readBody(e){return new Promise((n,t)=>{let r="";e.setEncoding("utf8"),e.on("data",o=>{r+=o}),e.on("end",()=>{try{n(JSON.parse(r))}catch{t(new Error("invalid JSON body"))}}),e.on("error",t)})}handleProbe(e,n,t){if(!this.probeHandler){this.json(n,501,{error:"probe not configured"});return}const r=t.indexOf("?"),o=r>=0?t.slice(0,r):t,s=r>=0?new URLSearchParams(t.slice(r+1)):new URLSearchParams,a={};s.get("conversation")==="true"&&(a.conversation=!0),s.get("fresh")==="true"&&(a.fresh=!0);const l=Number(s.get("timeoutMs"));Number.isFinite(l)&&l>0&&(a.timeoutMs=l);const h=o.match(/^\/api\/probe\/(.+)$/);if(h){const i=decodeURIComponent(h[1]);this.probeHandler.probeOne(i,a).then(d=>{this.json(n,200,d)}).catch(d=>this.error(n,d));return}this.probeHandler.probeAll(a).then(i=>{this.json(n,200,i)}).catch(i=>this.error(n,i))}handleInstallList(e){if(!this.installHandler){this.json(e,501,{error:"install not configured"});return}try{const n=this.installHandler.listInstallable();this.json(e,200,n)}catch(n){this.error(e,n)}}handleInstallProgress(e,n){if(!this.installHandler){this.json(e,501,{error:"install not configured"});return}const t=this.installHandler.getInstallProgress(n);if(!t){this.json(e,200,{agentType:n,status:"unknown",inProgress:!1,progress:null});return}let r,o,s;switch(t.phase){case"completed":r="done",o="\u5B89\u88C5\u5B8C\u6210";break;case"failed":r="error",s=t.outputTail||"\u5B89\u88C5\u5931\u8D25";break;case"preflight":r="pending",o="\u68C0\u67E5\u524D\u7F6E\u4F9D\u8D56...";break;case"installing_prereq":r="downloading",o=t.currentPrereq?`\u6B63\u5728\u5B89\u88C5\u524D\u7F6E\u4F9D\u8D56: ${t.currentPrereq}`:"\u6B63\u5728\u5B89\u88C5\u524D\u7F6E\u4F9D\u8D56...";break;case"installing":r="installing",o=`\u6B63\u5728\u5B89\u88C5 ${n}...`;break;case"verifying":r="installing",o="\u9A8C\u8BC1\u5B89\u88C5...";break;default:r="unknown"}this.json(e,200,{agentType:n,status:r,inProgress:!0,progress:t.elapsedMs?Math.min(.9,t.elapsedMs/3e4):.1,message:o,error:s})}async handleInstall(e,n){if(!this.installHandler){this.json(e,501,{error:"install not configured"});return}try{const t=n;if(!t||typeof t.agentType!="string"||!t.agentType){this.json(e,400,{error:"agentType is required"});return}const r=await this.installHandler.installAgent(t);if(r.ok)this.json(e,200,r);else{const o=r.error?.code;o==="UNKNOWN_AGENT"||o==="UNSUPPORTED_OS"?this.json(e,400,r):o==="INSTALL_IN_PROGRESS"?this.json(e,409,r):this.json(e,500,r)}}catch(t){this.error(e,t)}}}export{g as AdminServer};

package/dist/core/installer/manual-guide.js

@@ -1,2 +1,2 @@
-import{getInstallCommand as f,getCliBinary as g}from"./registry.js";import{getPrereqManualInstructions as $}from"./prereq-installer.js";import{getMirrorInstallCommands as t}from"./npm-registry.js";function v(u){const{agentType:e,os:i,env:h,missingPrereqs:c}=u,s=[],a=g(e)??e,o=f(e,i),m=b(i);if(s.push(`=== ${e} \u4EBA\u5DE5\u5B89\u88C5\u6307\u5357 (${m}) ===`),s.push(""),s.push("\u5F53\u524D\u73AF\u5883:"),s.push(`  \u7CFB\u7EDF: ${h.osVersion} (${h.arch})`),s.push(`  Node.js: ${h.nodeVersion??"\u672A\u5B89\u88C5"}`),s.push(`  npm: ${h.npmVersion??"\u672A\u5B89\u88C5"}`),s.push(""),u.error&&(s.push("\u81EA\u52A8\u5B89\u88C5\u5931\u8D25\u539F\u56E0:"),s.push(`  ${u.error}`),s.push("")),c.length>0){s.push("--- \u6B65\u9AA4 1: \u5B89\u88C5\u524D\u7F6E\u4F9D\u8D56 ---"),s.push("");for(const n of c){const p=$(n.id,i);s.push(`\u25B8 ${n.label}${n.minVersion?` (\u9700\u8981 >= ${n.minVersion})`:""}`),p&&s.push(`  \u5B89\u88C5\u65B9\u6CD5: ${p}`),s.push(`  \u9A8C\u8BC1: ${n.id==="node"?"node --version":n.id==="npm"?"npm --version":`${n.id} --version`}`),s.push("")}}const l=c.length>0?"2":"1";if(s.push(`--- \u6B65\u9AA4 ${l}: \u5B89\u88C5 ${e} ---`),s.push(""),o){if(s.push("  \u63A8\u8350\u65B9\u5F0F:"),s.push(`    ${o.command}`),s.push(""),o.mode==="npm"&&o.npmPackage){const n=t(o.npmPackage);s.push("  \u955C\u50CF\u5B89\u88C5\uFF08\u56FD\u5185\u7F51\u7EDC\u6162\u6216\u88AB\u5899\u65F6\u4F7F\u7528\uFF09:");for(const p of n)s.push(`    # ${p.label}`),s.push(`    ${p.command}`);s.push("")}if(o.fallback){if(s.push("  \u5907\u9009\u65B9\u5F0F\uFF08\u63A8\u8350\u5B89\u88C5\u5931\u8D25\u65F6\u4F7F\u7528\uFF09:"),s.push(`    ${o.fallback.command}`),o.fallback.mode==="npm"&&o.fallback.npmPackage){const n=t(o.fallback.npmPackage);for(const p of n)s.push(`    # ${p.label}`),s.push(`    ${p.command}`)}s.push("")}}const d=c.length>0?"3":"2";s.push(`--- \u6B65\u9AA4 ${d}: \u9A8C\u8BC1\u5B89\u88C5 ---`),s.push(""),s.push(`  ${a} --version`),s.push(""),s.push("  \u5982\u679C\u663E\u793A\u7248\u672C\u53F7\uFF0C\u8BF4\u660E\u5B89\u88C5\u6210\u529F\u3002"),s.push(""),s.push("--- \u5E38\u89C1\u95EE\u9898 ---"),s.push(""),s.push("  Q: \u5B89\u88C5\u540E\u547D\u4EE4\u627E\u4E0D\u5230\uFF1F"),s.push("  A: \u53EF\u80FD\u9700\u8981\u91CD\u65B0\u6253\u5F00\u7EC8\u7AEF\uFF0C\u6216\u8FD0\u884C:"),i==="macos"||i==="linux"?(s.push("     source ~/.zshrc    # zsh"),s.push("     source ~/.bashrc    # bash")):s.push("     \u91CD\u65B0\u6253\u5F00 PowerShell \u6216 CMD \u7A97\u53E3"),s.push(""),o?.mode==="npm"&&(s.push("  Q: npm install -g \u62A5\u6743\u9650\u9519\u8BEF\uFF1F"),i==="macos"||i==="linux"?(s.push("  A: \u4E0D\u8981\u7528 sudo npm install -g\u3002\u5EFA\u8BAE\u7528\u4EE5\u4E0B\u65B9\u5F0F\u4E4B\u4E00:"),s.push("     1. brew install node (macOS\uFF0C\u63A8\u8350)"),s.push("     2. \u4F7F\u7528 fnm/nvm \u7BA1\u7406 Node.js (Linux)"),s.push("     3. \u914D\u7F6E npm \u5168\u5C40\u76EE\u5F55: npm config set prefix ~/.npm-global")):s.push("  A: \u4EE5\u7BA1\u7406\u5458\u8EAB\u4EFD\u6253\u5F00 PowerShell \u540E\u91CD\u8BD5"),s.push("")),s.push("--- \u5B98\u65B9\u6587\u6863 ---"),s.push("");const r={claude:"https://docs.anthropic.com/en/docs/claude-code/overview",codex:"https://github.com/openai/codex",gemini:"https://github.com/google-gemini/gemini-cli",qwen:"https://github.com/QwenLM/qwen-code",cursor:"https://cursor.com/docs/cli/installation",copilot:"https://github.com/github/copilot-cli",kiro:"https://kiro.dev/docs/cli/",openclaw:"https://github.com/openclaw/openclaw",reasonix:"https://github.com/esengine/DeepSeek-Reasonix"};return r[e]&&s.push(`  ${e}: ${r[e]}`),s.join(`
+import{getInstallCommand as f,getCliBinary as g}from"./registry.js";import{getPrereqManualInstructions as $}from"./prereq-installer.js";import{getMirrorInstallCommands as r}from"./npm-registry.js";function v(u){const{agentType:e,os:p,env:h,missingPrereqs:c}=u,s=[],a=g(e)??e,o=f(e,p),m=b(p);if(s.push(`=== ${e} \u4EBA\u5DE5\u5B89\u88C5\u6307\u5357 (${m}) ===`),s.push(""),s.push("\u5F53\u524D\u73AF\u5883:"),s.push(`  \u7CFB\u7EDF: ${h.osVersion} (${h.arch})`),s.push(`  Node.js: ${h.nodeVersion??"\u672A\u5B89\u88C5"}`),s.push(`  npm: ${h.npmVersion??"\u672A\u5B89\u88C5"}`),s.push(""),u.error&&(s.push("\u81EA\u52A8\u5B89\u88C5\u5931\u8D25\u539F\u56E0:"),s.push(`  ${u.error}`),s.push("")),c.length>0){s.push("--- \u6B65\u9AA4 1: \u5B89\u88C5\u524D\u7F6E\u4F9D\u8D56 ---"),s.push("");for(const n of c){const i=$(n.id,p);s.push(`\u25B8 ${n.label}${n.minVersion?` (\u9700\u8981 >= ${n.minVersion})`:""}`),i&&s.push(`  \u5B89\u88C5\u65B9\u6CD5: ${i}`),s.push(`  \u9A8C\u8BC1: ${n.id==="node"?"node --version":n.id==="npm"?"npm --version":`${n.id} --version`}`),s.push("")}}const l=c.length>0?"2":"1";if(s.push(`--- \u6B65\u9AA4 ${l}: \u5B89\u88C5 ${e} ---`),s.push(""),o){if(s.push("  \u63A8\u8350\u65B9\u5F0F:"),s.push(`    ${o.command}`),s.push(""),o.mode==="npm"&&o.npmPackage){const n=r(o.npmPackage);s.push("  \u955C\u50CF\u5B89\u88C5\uFF08\u56FD\u5185\u7F51\u7EDC\u6162\u6216\u88AB\u5899\u65F6\u4F7F\u7528\uFF09:");for(const i of n)s.push(`    # ${i.label}`),s.push(`    ${i.command}`);s.push("")}if(o.fallback){if(s.push("  \u5907\u9009\u65B9\u5F0F\uFF08\u63A8\u8350\u5B89\u88C5\u5931\u8D25\u65F6\u4F7F\u7528\uFF09:"),s.push(`    ${o.fallback.command}`),o.fallback.mode==="npm"&&o.fallback.npmPackage){const n=r(o.fallback.npmPackage);for(const i of n)s.push(`    # ${i.label}`),s.push(`    ${i.command}`)}s.push("")}}const d=c.length>0?"3":"2";s.push(`--- \u6B65\u9AA4 ${d}: \u9A8C\u8BC1\u5B89\u88C5 ---`),s.push(""),s.push(`  ${a} --version`),s.push(""),s.push("  \u5982\u679C\u663E\u793A\u7248\u672C\u53F7\uFF0C\u8BF4\u660E\u5B89\u88C5\u6210\u529F\u3002"),s.push(""),s.push("--- \u5E38\u89C1\u95EE\u9898 ---"),s.push(""),s.push("  Q: \u5B89\u88C5\u540E\u547D\u4EE4\u627E\u4E0D\u5230\uFF1F"),s.push("  A: \u53EF\u80FD\u9700\u8981\u91CD\u65B0\u6253\u5F00\u7EC8\u7AEF\uFF0C\u6216\u8FD0\u884C:"),p==="macos"||p==="linux"?(s.push("     source ~/.zshrc    # zsh"),s.push("     source ~/.bashrc    # bash")):s.push("     \u91CD\u65B0\u6253\u5F00 PowerShell \u6216 CMD \u7A97\u53E3"),s.push(""),o?.mode==="npm"&&(s.push("  Q: npm install -g \u62A5\u6743\u9650\u9519\u8BEF\uFF1F"),p==="macos"||p==="linux"?(s.push("  A: \u4E0D\u8981\u7528 sudo npm install -g\u3002\u5EFA\u8BAE\u7528\u4EE5\u4E0B\u65B9\u5F0F\u4E4B\u4E00:"),s.push("     1. brew install node (macOS\uFF0C\u63A8\u8350)"),s.push("     2. \u4F7F\u7528 fnm/nvm \u7BA1\u7406 Node.js (Linux)"),s.push("     3. \u914D\u7F6E npm \u5168\u5C40\u76EE\u5F55: npm config set prefix ~/.npm-global")):s.push("  A: \u4EE5\u7BA1\u7406\u5458\u8EAB\u4EFD\u6253\u5F00 PowerShell \u540E\u91CD\u8BD5"),s.push("")),s.push("--- \u5B98\u65B9\u6587\u6863 ---"),s.push("");const t={claude:"https://docs.anthropic.com/en/docs/claude-code/overview",codex:"https://github.com/openai/codex",gemini:"https://github.com/google-gemini/gemini-cli",qwen:"https://github.com/QwenLM/qwen-code",cursor:"https://cursor.com/docs/cli/installation",copilot:"https://github.com/github/copilot-cli",kiro:"https://kiro.dev/docs/cli/",kimi:"https://moonshotai.github.io/kimi-cli/",openclaw:"https://github.com/openclaw/openclaw",reasonix:"https://github.com/esengine/DeepSeek-Reasonix"};return t[e]&&s.push(`  ${e}: ${t[e]}`),s.join(`
 `)}function b(u){switch(u){case"macos":return"macOS";case"linux":return"Linux";case"windows":return"Windows"}}export{v as generateManualGuide};

package/dist/core/installer/registry.js

@@ -1 +1 @@
-function e(i,s){return{command:`npm install -g ${i}`,mode:"npm",npmPackage:i,timeoutMs:s?.timeoutMs??12e4,prerequisites:["node","npm"],minNodeVersion:s?.minNodeVersion}}function n(i,s){return{command:i,mode:"shell",timeoutMs:s?.timeoutMs??12e4,prerequisites:s?.prerequisites}}function c(i,s,o){return{command:i,mode:"exec",execArgs:s,timeoutMs:o?.timeoutMs??6e4,prerequisites:o?.prerequisites,skipVerification:o?.skipVerification}}const l={claude:{cliBinary:"claude",macos:e("@anthropic-ai/claude-code",{minNodeVersion:"18.0"}),linux:e("@anthropic-ai/claude-code",{minNodeVersion:"18.0"}),windows:e("@anthropic-ai/claude-code",{minNodeVersion:"18.0"})},codex:{cliBinary:"codex",macos:e("@openai/codex"),linux:e("@openai/codex"),windows:e("@openai/codex")},gemini:{cliBinary:"gemini",macos:{...e("@google/gemini-cli",{minNodeVersion:"18.0"}),fallback:n("npx @google/gemini-cli --yes",{timeoutMs:12e4})},linux:e("@google/gemini-cli",{minNodeVersion:"18.0"}),windows:e("@google/gemini-cli",{minNodeVersion:"18.0"})},qwen:{cliBinary:"qwen",macos:{...n("curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh | bash",{prerequisites:["curl"]}),fallback:e("@qwen-code/qwen-code@latest",{minNodeVersion:"22.0"})},linux:{...n("curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh | bash",{prerequisites:["curl"]}),fallback:e("@qwen-code/qwen-code@latest",{minNodeVersion:"22.0"})},windows:{...n(`powershell -Command "Invoke-WebRequest 'https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.bat' -OutFile (Join-Path $env:TEMP 'install-qwen.bat'); & (Join-Path $env:TEMP 'install-qwen.bat')"`),fallback:e("@qwen-code/qwen-code@latest",{minNodeVersion:"22.0"})}},cursor:{cliBinary:"agent",macos:n("curl https://cursor.com/install -fsS | bash",{prerequisites:["curl"]}),linux:n("curl https://cursor.com/install -fsS | bash",{prerequisites:["curl"]}),windows:n(`powershell -ExecutionPolicy ByPass -c "irm 'https://cursor.com/install?win32=true' | iex"`)},copilot:{cliBinary:"copilot",macos:e("@github/copilot",{minNodeVersion:"22.0"}),linux:e("@github/copilot",{minNodeVersion:"22.0"}),windows:e("@github/copilot",{minNodeVersion:"22.0"})},kiro:{cliBinary:"kiro-cli",macos:n("curl -fsSL https://cli.kiro.dev/install | bash",{prerequisites:["curl"]}),linux:n("curl -fsSL https://cli.kiro.dev/install | bash",{prerequisites:["curl"]}),windows:null},openclaw:{cliBinary:"openclaw",macos:e("openclaw@latest",{minNodeVersion:"22.0"}),linux:e("openclaw@latest",{minNodeVersion:"22.0"}),windows:e("openclaw@latest",{minNodeVersion:"22.0"})},reasonix:{cliBinary:"reasonix",macos:e("reasonix"),linux:e("reasonix"),windows:e("reasonix")},pi:{cliBinary:"pi",macos:e("@earendil-works/pi-coding-agent",{minNodeVersion:"22.19"}),linux:e("@earendil-works/pi-coding-agent",{minNodeVersion:"22.19"}),windows:e("@earendil-works/pi-coding-agent",{minNodeVersion:"22.19"})},agy:{cliBinary:"agy",macos:n("curl -fsSL https://antigravity.google/cli/install.sh | bash",{prerequisites:["curl"]}),linux:n("curl -fsSL https://antigravity.google/cli/install.sh | bash",{prerequisites:["curl"]}),windows:n('powershell -ExecutionPolicy ByPass -c "irm https://antigravity.google/cli/install.ps1 | iex"')},hermes:{cliBinary:"hermes",macos:null,linux:null,windows:null},codewhale:{cliBinary:"codewhale",macos:e("codewhale"),linux:e("codewhale"),windows:e("codewhale")},opencode:{cliBinary:"opencode",macos:{...n("curl -fsSL https://opencode.ai/install | bash",{prerequisites:["curl"]}),fallback:e("opencode-ai")},linux:{...n("curl -fsSL https://opencode.ai/install | bash",{prerequisites:["curl"]}),fallback:e("opencode-ai")},windows:e("opencode-ai")},openhuman:{cliBinary:"openhuman-core",macos:n("curl -fsSL https://raw.githubusercontent.com/tinyhumansai/openhuman/main/scripts/install.sh | bash",{prerequisites:["curl"]}),linux:n("curl -fsSL https://raw.githubusercontent.com/tinyhumansai/openhuman/main/scripts/install.sh | bash",{prerequisites:["curl"]}),windows:null}};function u(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"linux"}}function r(i){return i.mode==="exec"&&i.execArgs&&i.execArgs.length>0?[i.command,...i.execArgs].join(" "):i.command}function m(i,s){const o=l[i];return o?o[s]:null}function d(i){return l[i]?.cliBinary??null}function a(i,s){const o=l[i];if(!o)return null;const t=o[s];return{agentType:i,cliBinary:o.cliBinary,supported:t!==null,installCommand:t?r(t):null,prerequisites:t?.prerequisites}}function p(i){return Object.keys(l).sort().map(s=>a(s,i)).filter(s=>s!==null)}function w(i){return i in l}export{u as detectPlatformOS,r as formatInstallCommand,a as getAgentInstallInfo,p as getAllAgentInstallInfo,d as getCliBinary,m as getInstallCommand,w as isKnownAgent};
+function i(e,o){return{command:`npm install -g ${e}`,mode:"npm",npmPackage:e,timeoutMs:o?.timeoutMs??12e4,prerequisites:["node","npm"],minNodeVersion:o?.minNodeVersion}}function n(e,o){return{command:e,mode:"shell",timeoutMs:o?.timeoutMs??12e4,prerequisites:o?.prerequisites}}function a(e,o,s){return{command:e,mode:"exec",execArgs:o,timeoutMs:s?.timeoutMs??6e4,prerequisites:s?.prerequisites,skipVerification:s?.skipVerification}}const l={claude:{cliBinary:"claude",macos:i("@anthropic-ai/claude-code",{minNodeVersion:"18.0"}),linux:i("@anthropic-ai/claude-code",{minNodeVersion:"18.0"}),windows:i("@anthropic-ai/claude-code",{minNodeVersion:"18.0"})},codex:{cliBinary:"codex",macos:i("@openai/codex"),linux:i("@openai/codex"),windows:i("@openai/codex")},gemini:{cliBinary:"gemini",macos:{...i("@google/gemini-cli",{minNodeVersion:"18.0"}),fallback:n("npx @google/gemini-cli --yes",{timeoutMs:12e4})},linux:i("@google/gemini-cli",{minNodeVersion:"18.0"}),windows:i("@google/gemini-cli",{minNodeVersion:"18.0"})},qwen:{cliBinary:"qwen",macos:{...n("curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh | bash",{prerequisites:["curl"]}),fallback:i("@qwen-code/qwen-code@latest",{minNodeVersion:"22.0"})},linux:{...n("curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh | bash",{prerequisites:["curl"]}),fallback:i("@qwen-code/qwen-code@latest",{minNodeVersion:"22.0"})},windows:{...n(`powershell -Command "Invoke-WebRequest 'https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.bat' -OutFile (Join-Path $env:TEMP 'install-qwen.bat'); & (Join-Path $env:TEMP 'install-qwen.bat')"`),fallback:i("@qwen-code/qwen-code@latest",{minNodeVersion:"22.0"})}},cursor:{cliBinary:"agent",macos:n("curl https://cursor.com/install -fsS | bash",{prerequisites:["curl"]}),linux:n("curl https://cursor.com/install -fsS | bash",{prerequisites:["curl"]}),windows:n(`powershell -ExecutionPolicy ByPass -c "irm 'https://cursor.com/install?win32=true' | iex"`)},copilot:{cliBinary:"copilot",macos:i("@github/copilot",{minNodeVersion:"22.0"}),linux:i("@github/copilot",{minNodeVersion:"22.0"}),windows:i("@github/copilot",{minNodeVersion:"22.0"})},kiro:{cliBinary:"kiro-cli",macos:n("curl -fsSL https://cli.kiro.dev/install | bash",{prerequisites:["curl"]}),linux:n("curl -fsSL https://cli.kiro.dev/install | bash",{prerequisites:["curl"]}),windows:null},kimi:{cliBinary:"kimi",macos:n("curl -LsSf https://code.kimi.com/install.sh | bash",{prerequisites:["curl"],timeoutMs:3e5}),linux:n("curl -LsSf https://code.kimi.com/install.sh | bash",{prerequisites:["curl"],timeoutMs:3e5}),windows:n('powershell -ExecutionPolicy ByPass -c "irm https://code.kimi.com/install.ps1 | iex"',{timeoutMs:3e5})},openclaw:{cliBinary:"openclaw",macos:i("openclaw@latest",{minNodeVersion:"22.0"}),linux:i("openclaw@latest",{minNodeVersion:"22.0"}),windows:i("openclaw@latest",{minNodeVersion:"22.0"})},reasonix:{cliBinary:"reasonix",macos:i("reasonix"),linux:i("reasonix"),windows:i("reasonix")},pi:{cliBinary:"pi",macos:i("@earendil-works/pi-coding-agent",{minNodeVersion:"22.19"}),linux:i("@earendil-works/pi-coding-agent",{minNodeVersion:"22.19"}),windows:i("@earendil-works/pi-coding-agent",{minNodeVersion:"22.19"})},agy:{cliBinary:"agy",macos:n("curl -fsSL https://antigravity.google/cli/install.sh | bash",{prerequisites:["curl"]}),linux:n("curl -fsSL https://antigravity.google/cli/install.sh | bash",{prerequisites:["curl"]}),windows:n('powershell -ExecutionPolicy ByPass -c "irm https://antigravity.google/cli/install.ps1 | iex"')},hermes:{cliBinary:"hermes",macos:null,linux:null,windows:null},codewhale:{cliBinary:"codewhale",macos:i("codewhale"),linux:i("codewhale"),windows:i("codewhale")},opencode:{cliBinary:"opencode",macos:{...n("curl -fsSL https://opencode.ai/install | bash",{prerequisites:["curl"]}),fallback:i("opencode-ai")},linux:{...n("curl -fsSL https://opencode.ai/install | bash",{prerequisites:["curl"]}),fallback:i("opencode-ai")},windows:i("opencode-ai")}};function u(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"linux"}}function r(e){return e.mode==="exec"&&e.execArgs&&e.execArgs.length>0?[e.command,...e.execArgs].join(" "):e.command}function m(e,o){const s=l[e];return s?s[o]:null}function d(e){return l[e]?.cliBinary??null}function c(e,o){const s=l[e];if(!s)return null;const t=s[o];return{agentType:e,cliBinary:s.cliBinary,supported:t!==null,installCommand:t?r(t):null,prerequisites:t?.prerequisites}}function p(e){return Object.keys(l).sort().map(o=>c(o,e)).filter(o=>o!==null)}function w(e){return e in l}export{u as detectPlatformOS,r as formatInstallCommand,c as getAgentInstallInfo,p as getAllAgentInstallInfo,d as getCliBinary,m as getInstallCommand,w as isKnownAgent};

package/dist/core/proxy/hermes-profile-relay.js

@@ -0,0 +1 @@
+import{execFile as h}from"node:child_process";import{existsSync as a}from"node:fs";import{readFile as g}from"node:fs/promises";import{homedir as f}from"node:os";import{delimiter as w,dirname as S,join as l}from"node:path";import{fileURLToPath as I}from"node:url";const R=3e4,v="hermes-profile-relay.py";class i extends Error{code;constructor(o,n){super(o),this.code=n,this.name="HermesProfileRelayError"}}function E(){return l(S(I(import.meta.url)),v)}function P(){const e=(process.env.PATH??"").split(w).filter(Boolean),o=process.platform==="win32"?["hermes.exe","hermes.cmd","hermes"]:["hermes"];for(const n of e)for(const r of o){const t=l(n,r);if(a(t))return t}}async function A(){const e=process.env.GRIX_HERMES_PYTHON?.trim();if(e){if(!a(e))throw new i(`GRIX_HERMES_PYTHON points to a missing interpreter: ${e}`,"HERMES_NOT_FOUND");return e}const o=P();if(o)try{const r=(await g(o,"utf8")).slice(0,512),t=/^#!\s*(\S+)/.exec(r)?.[1];if(t&&a(t))return t}catch{}const n=l(f(),".hermes","hermes-agent",".venv","bin","python3");if(a(n))return n;throw new i("cannot locate hermes' python interpreter (set GRIX_HERMES_PYTHON to override)","HERMES_NOT_FOUND")}async function d(e){const o=await A(),n=E();if(!a(n))throw new i(`relay script is missing: ${n}`,"SCRIPT_MISSING");const r=await new Promise((m,_)=>{h(o,[n],{timeout:R,cwd:f(),maxBuffer:8388608},(u,s,y)=>{if(s&&s.trim())return m(s);if(u)return _(new i(`hermes relay script failed: ${String(y||u.message).slice(0,400)}`,"SCRIPT_FAILED"));m(s)}).stdin?.end(JSON.stringify(e))});let t;try{t=JSON.parse(r.trim())}catch{throw new i(`hermes relay script returned non-JSON output: ${r.slice(0,200)}`,"SCRIPT_FAILED")}if(!t.ok)throw new i(String(t.error_msg??"hermes relay script reported failure"),String(t.error_code??"SCRIPT_FAILED"));return t}function c(e){return typeof e=="boolean"?e:void 0}function p(e){return{profile:String(e.profile??""),home:String(e.home??""),gatewayRunning:e.gateway_running===!0,restartRequired:e.restart_required===!0,providerKept:c(e.provider_kept),restoredModel:c(e.restored_model),userSwitchedAway:c(e.user_switched_away),modelCleared:c(e.model_cleared),warning:typeof e.warning=="string"?e.warning:void 0,snapshot:typeof e.snapshot=="string"?e.snapshot:void 0}}async function G(){const e=await d({command:"discover"}),o=Array.isArray(e.profiles)?e.profiles:[],n=Array.isArray(e.unreadable)?e.unreadable:[];return{profiles:o.map(r=>N(r)),unreadable:n.map(r=>{const t=r;return{name:String(t.name??""),home:String(t.home??""),error:String(t.error??"")}})}}function N(e){return{name:String(e.name??""),home:String(e.home??""),agentId:String(e.agent_id??""),gatewayRunning:e.gateway_running===!0,relayActive:e.relay_active===!0,modelProvider:typeof e.model_provider=="string"?e.model_provider:void 0,modelDefault:typeof e.model_default=="string"?e.model_default:void 0}}async function L(){const e=await d({command:"discover"});return(Array.isArray(e.profiles)?e.profiles:[]).map(n=>{const r=n;return{name:String(r.name??""),home:String(r.home??""),agentId:String(r.agent_id??""),gatewayRunning:r.gateway_running===!0,relayActive:r.relay_active===!0,modelProvider:typeof r.model_provider=="string"?r.model_provider:void 0,modelDefault:typeof r.model_default=="string"?r.model_default:void 0}})}async function U(e){const o=e.agentId?.trim(),n=e.baseUrl?.trim(),r=e.virtualKey?.trim(),t=e.model?.trim();if(!o)throw new i("agent_id is required","MISSING_AGENT_ID");if(!r)throw new i("virtual_key is required","MISSING_VIRTUAL_KEY");if(!n)throw new i("openai_base_url is required","MISSING_BASE_URL");try{new URL(n)}catch{throw new i("openai_base_url must be a valid URL","INVALID_BASE_URL")}if(!t)throw new i("model is required for hermes","MISSING_MODEL");return p(await d({command:"apply",agent_id:o,base_url:n,api_key:r,model:t}))}async function q(e){const o=e?.trim();if(!o)throw new i("agent_id is required","MISSING_AGENT_ID");return p(await d({command:"clear",agent_id:o}))}export{i as HermesProfileRelayError,U as applyHermesProfileRelay,q as clearHermesProfileRelay,L as discoverHermesProfiles,G as discoverHermesProfilesRaw,A as resolveHermesPython};

package/dist/core/proxy/hermes-profile-relay.py

@@ -0,0 +1,497 @@
+#!/usr/bin/env python3
+"""Grix 中转（虚拟 Key）在**独立 Hermes** profile 上的落地执行端。
+
+与连接器托管的 agent 不同：独立 Hermes 是用户自己跑的 gateway 进程，连接器既不 spawn 它、
+也不在 agents.json 里认识它，因此没有"spawn 时注入 env"这一步——只能直接改它 profile 里的
+config.yaml。目标 profile **不靠传路径、靠 agent_id 认**：每个接了 Grix 的 profile 都在
+``channels.grix.wsUrl`` 里带着自己的 ``agent_id``，用它跟服务端下发的 agent_id 对上号。
+
+**为什么必须用 Hermes 自己的解释器跑**（而不是在连接器里用 Node 解析 YAML）：
+配置的读写全交给宿主的 ``hermes_cli.config``，它负责原子写（temp+fsync+replace）、保留原
+文件权限与 owner、对照 raw 配置剥离默认值、以及把文件尾那段注释区重新写回去。自己解析回写
+YAML 会把注释区丢掉，也会跟宿主的归一化规则漂移。写入语义与用户在聊天里敲 ``/model`` 完全
+一致，走的是同一个 ``save_config``。
+
+协议：stdin 收一条 JSON 请求，stdout 回一条 JSON 响应。api_key 绝不进输出。
+"""
+from __future__ import annotations
+
+import contextlib
+import copy
+import io
+import json
+import os
+import shutil
+import sys
+import time
+from typing import Any, Dict, List, Optional, Tuple
+from urllib.parse import parse_qs, urlparse
+
+# 这个脚本躺在连接器的源码树里，而 Python 会把"脚本所在目录"和 cwd 塞进 sys.path 的最前面。
+# 宿主 Hermes 内部大量使用顶层 import（utils、gateway 等），一旦连接器目录下有同名文件或目录，
+# 它就会解析错位并炸在 import 上。清掉这两个来源——本脚本不从相邻目录 import 任何东西。
+_HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path[:] = [
+    entry for entry in sys.path
+    if entry and os.path.abspath(entry) != _HERE
+]
+
+try:
+    from hermes_cli.config import (
+        clear_model_endpoint_credentials,
+        read_raw_config,
+        save_config,
+    )
+    from hermes_cli.profiles import list_profiles
+except Exception as _import_exc:  # noqa: BLE001 - 必须报清楚，不能被下游当成"没有 profile"
+    print(json.dumps({
+        "ok": False,
+        "error_code": "HERMES_IMPORT_FAILED",
+        "error_msg": f"cannot import hermes modules ({type(_import_exc).__name__}: {_import_exc}); "
+                     "this script must run with hermes' own interpreter",
+    }))
+    sys.exit(1)
+
+# 连接器写进 Hermes 的固定 provider id。
+GRIX_PROVIDER_ID = "grix"
+# 记录开中转前的原模型设置，供关闭时精确还原。放 profile 目录，不进 config.yaml。
+SIDECAR_NAME = ".grix-relay-state.json"
+SNAPSHOT_PREFIX = "config.yaml.grix-relay-snapshot."
+# 快照是含凭证的整份配置副本，不能无限堆。每次开中转建新的，只留最近这几个。
+SNAPSHOT_KEEP = 3
+
+
+class RelayError(Exception):
+    def __init__(self, code: str, msg: str) -> None:
+        super().__init__(msg)
+        self.code = code
+        self.msg = msg
+
+
+def _redact(text: str, req: Dict[str, Any]) -> str:
+    """把本次请求里的 api_key 从要吐出去的文本里抹掉。
+
+    宿主抛的异常今天恰好不回显输入，但那不是能长期依赖的保证——换个带输入回显的异常，Key 就
+    跟着错误信息出去了。真做脱敏，而不是在注释里许诺。
+    """
+    secret = str(req.get("api_key") or "").strip()
+    if secret and secret in text:
+        text = text.replace(secret, "***redacted***")
+    return text
+
+
+def _agent_id_of(cfg: Dict[str, Any]) -> str:
+    """从 ``channels.grix.wsUrl`` 的 query 里取 agent_id —— profile 与平台 agent 的唯一锚点。"""
+    channels = cfg.get("channels")
+    if not isinstance(channels, dict):
+        return ""
+    grix = channels.get(GRIX_PROVIDER_ID)
+    if not isinstance(grix, dict):
+        return ""
+    ws_url = grix.get("wsUrl")
+    if not isinstance(ws_url, str) or not ws_url.strip():
+        return ""
+    try:
+        values = parse_qs(urlparse(ws_url).query).get("agent_id") or []
+    except Exception:
+        return ""
+    return str(values[0]).strip() if values else ""
+
+
+def _config_path(home: str) -> str:
+    return os.path.join(home, "config.yaml")
+
+
+def _read_profile_config(home: str) -> Dict[str, Any]:
+    """读某个 profile 的原始配置（不合并默认值）。切 HERMES_HOME 即切目标 profile。
+
+    宿主的 ``read_raw_config`` **自己吞掉解析错误并回一个空 dict**，永远不抛。不识别这一点的话，
+    一个语法坏掉的 config.yaml 会表现成"这个 profile 没接 Grix"，最终报 PROFILE_NOT_FOUND——
+    把人引向完全错误的方向。文件有内容却解析成空 ⇒ 它是坏的，如实抛出去。
+    """
+    os.environ["HERMES_HOME"] = home
+    cfg = read_raw_config() or {}
+    if not cfg:
+        path = _config_path(home)
+        try:
+            broken = os.path.exists(path) and os.path.getsize(path) > 0
+        except OSError:
+            broken = False
+        if broken:
+            raise RelayError(
+                "CONFIG_UNREADABLE",
+                f"config.yaml exists but hermes parsed it as empty (likely malformed): {path}",
+            )
+    return cfg
+
+
+def _save_profile_config(home: str, cfg: Dict[str, Any]) -> None:
+    os.environ["HERMES_HOME"] = home
+    save_config(cfg)
+
+
+def _verify_write(home: str, expect_relay: bool) -> None:
+    """回读校验：写入必须真的落盘了。
+
+    宿主的 ``save_config`` 在托管安装下（``is_managed()``）只往 stderr 打一行就 return，**不抛
+    异常**——不校验的话，接口会在配置一个字节都没变的情况下报成功。跨进程覆盖（gateway 同时
+    在写同一份 config，双方都是 read-modify-write）同样会让我们的写入无声消失。回读是把这两种
+    假成功变成可见失败的唯一办法。
+    """
+    fresh = _read_profile_config(home)
+    providers = fresh.get("providers")
+    has_provider = isinstance(providers, dict) and GRIX_PROVIDER_ID in providers
+    on_grix = _relay_active(fresh)
+
+    if expect_relay and not (has_provider and on_grix):
+        raise RelayError(
+            "CONFIG_WRITE_VERIFY_FAILED",
+            "config.yaml did not take the relay settings after save "
+            f"(grix provider present={has_provider}, model points at grix={on_grix}); "
+            "the write was silently dropped — hermes may be a managed install, "
+            "or its gateway overwrote the file concurrently",
+        )
+    # 关中转只看"模型还指不指着 grix"。grix provider 本身是**故意留下**的（虚拟 Key 是按
+    # agent 绑定的长期凭证，删了下次开就得换新 Key、统计会断），它的存在不代表中转还开着。
+    if not expect_relay and on_grix:
+        raise RelayError(
+            "CONFIG_WRITE_VERIFY_FAILED",
+            "config.yaml still points the model at the grix provider after save; "
+            "the write was silently dropped — hermes may be a managed install, "
+            "or its gateway overwrote the file concurrently",
+        )
+
+
+def _iter_profiles() -> List[Tuple[str, str, bool]]:
+    """(name, home, gateway_running)，含 default profile。用宿主的枚举，不自己拼路径。"""
+    out: List[Tuple[str, str, bool]] = []
+    for info in list_profiles():
+        out.append((str(info.name), str(info.path), bool(getattr(info, "gateway_running", False))))
+    return out
+
+
+def _model_section(cfg: Dict[str, Any]) -> Dict[str, Any]:
+    raw = cfg.get("model")
+    if isinstance(raw, dict):
+        return raw
+    section: Dict[str, Any] = {}
+    # 历史上 model 可能是个裸字符串（模型名），按宿主的语义归一成 {default: <name>}。
+    if isinstance(raw, str) and raw.strip():
+        section["default"] = raw.strip()
+    cfg["model"] = section
+    return section
+
+
+def _relay_active(cfg: Dict[str, Any]) -> bool:
+    """这个 profile 当前是不是正开着中转。
+
+    判据是**模型指没指着 grix**，不是"sidecar 在不在"。两者在"用户中途自己 /model 切走后又
+    重开中转"这个场景里会分岔：sidecar 还在，但盘上的 model 段已经是用户的新选择了。
+    """
+    raw = cfg.get("model")
+    if not isinstance(raw, dict):
+        return False
+    return str(raw.get("provider") or "").strip() == GRIX_PROVIDER_ID
+
+
+def _sidecar_path(home: str) -> str:
+    return os.path.join(home, SIDECAR_NAME)
+
+
+def _read_sidecar(home: str) -> Optional[Dict[str, Any]]:
+    path = _sidecar_path(home)
+    if not os.path.exists(path):
+        return None
+    try:
+        with open(path, encoding="utf-8") as handle:
+            data = json.load(handle)
+        return data if isinstance(data, dict) else None
+    except Exception:
+        # 记录读坏了就当没有：宁可不还原 model 段，也不能拿瞎猜的值去覆盖用户配置。
+        return None
+
+
+def _write_sidecar(home: str, data: Dict[str, Any]) -> None:
+    # 用 os.open 一步带权限创建：先 open(w) 再 chmod 的话，中间有一个窗口文件是 umask 默认权限，
+    # 而这里面存着用户自己的 api_key（我们从 model 段抄下来的原值）。
+    path = _sidecar_path(home)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        json.dump(data, handle, indent=2, ensure_ascii=False)
+
+
+def _prune_snapshots(home: str, keep: int = SNAPSHOT_KEEP) -> None:
+    """只留最近 keep 个快照——每个都是含凭证的整份配置副本，不能无限堆。"""
+    try:
+        rows = sorted(
+            (name for name in os.listdir(home)
+             if name.startswith(SNAPSHOT_PREFIX) and name.endswith(".bak")),
+            reverse=True,
+        )
+        for name in rows[keep:]:
+            with contextlib.suppress(OSError):
+                os.remove(os.path.join(home, name))
+    except OSError:
+        pass
+
+
+def _snapshot(home: str) -> Optional[str]:
+    """开中转前存一份整份配置快照，纯逃生舱：不参与自动还原，只给人工兜底。"""
+    src = _config_path(home)
+    if not os.path.exists(src):
+        return None
+    # 时间戳带上微秒：只精确到秒的话，同一秒内的两次开启会互相覆盖。
+    stamp = time.strftime("%Y%m%d-%H%M%S") + "-%06d" % (int(time.time() * 1_000_000) % 1_000_000)
+    dst = os.path.join(home, SNAPSHOT_PREFIX + stamp + ".bak")
+    try:
+        shutil.copy2(src, dst)
+    except Exception:
+        return None
+    _prune_snapshots(home)
+    return os.path.basename(dst)
+
+
+def _find_profile(agent_id: str) -> Tuple[str, str, bool, Dict[str, Any]]:
+    """按 agent_id 定位 profile。匹配不到、或多个 profile 抢同一个 agent_id，都要报错不猜。"""
+    agent_id = (agent_id or "").strip()
+    if not agent_id:
+        raise RelayError("MISSING_AGENT_ID", "agent_id is required")
+
+    matches: List[Tuple[str, str, bool, Dict[str, Any]]] = []
+    unreadable: List[str] = []
+    for name, home, running in _iter_profiles():
+        try:
+            cfg = _read_profile_config(home)
+        except Exception as exc:  # noqa: BLE001
+            # 读不了的 profile 可能正是目标。绝不能静默跳过后报"没找到"——那会让一个坏掉的
+            # config.yaml 表现成"这个 agent 不是 hermes"，把人引向完全错误的方向。
+            unreadable.append(f"{name} ({type(exc).__name__}: {exc})")
+            continue
+        if _agent_id_of(cfg) == agent_id:
+            matches.append((name, home, running, cfg))
+
+    if not matches:
+        detail = f"no hermes profile is bound to agent_id {agent_id}"
+        if unreadable:
+            detail += f"; {len(unreadable)} profile(s) could not be read: {'; '.join(unreadable)}"
+        raise RelayError("PROFILE_NOT_FOUND", detail)
+    if len(matches) > 1:
+        names = ", ".join(sorted(m[0] for m in matches))
+        raise RelayError(
+            "AMBIGUOUS_AGENT_ID",
+            f"agent_id {agent_id} is claimed by multiple profiles: {names}",
+        )
+    return matches[0]
+
+
+def cmd_discover(_req: Dict[str, Any]) -> Dict[str, Any]:
+    profiles = []
+    unreadable: List[Dict[str, str]] = []
+    for name, home, running in _iter_profiles():
+        try:
+            cfg = _read_profile_config(home)
+        except Exception as exc:  # noqa: BLE001 - 报出来，不装作这个 profile 不存在
+            unreadable.append({"name": name, "home": home, "error": f"{type(exc).__name__}: {exc}"})
+            continue
+        model = _model_section(dict(cfg))
+        agent_id = _agent_id_of(cfg)
+        if not agent_id:
+            # 没接 Grix 的 profile（比如纯本地用的）不是我们的目标，直接跳过。
+            continue
+        profiles.append({
+            "name": name,
+            "home": home,
+            "agent_id": agent_id,
+            "gateway_running": running,
+            "relay_active": str(model.get("provider") or "").strip() == GRIX_PROVIDER_ID,
+            "model_provider": model.get("provider"),
+            "model_default": model.get("default"),
+        })
+    return {"ok": True, "profiles": profiles, "unreadable": unreadable}
+
+
+def cmd_apply(req: Dict[str, Any]) -> Dict[str, Any]:
+    base_url = str(req.get("base_url") or "").strip()
+    api_key = str(req.get("api_key") or "").strip()
+    model = str(req.get("model") or "").strip()
+    if not base_url:
+        raise RelayError("MISSING_BASE_URL", "base_url is required to enable Grix relay")
+    if not api_key:
+        raise RelayError("MISSING_API_KEY", "api_key is required to enable Grix relay")
+    if not model:
+        # hermes 的 provider 配置里模型名必填，缺了就是"写进去了、聊天必失败"的静默半配置。
+        raise RelayError("MISSING_MODEL", "model is required (hermes provider config needs a model name)")
+
+    name, home, running, cfg = _find_profile(req.get("agent_id"))
+    model_cfg = _model_section(cfg)
+
+    # 只在**当前没开着中转**时记原值——这时盘上的 model 段按定义就是用户自己的选择。
+    #
+    # 判据必须是"是否正在中转中"（_relay_active），不能是"sidecar 在不在"：
+    #  - 中转中重复下发 → 不记，否则会把"中转中"的 grix 当原值存下来，关了再也回不去；
+    #  - 用户中途 /model 切走后再重开 → sidecar 还在，但盘上已是用户的新选择，**必须刷新**，
+    #    否则关中转时会拿陈旧的旧值把用户的选择冲掉。
+    already_on = _relay_active(cfg)
+    sidecar = _read_sidecar(home) if already_on else None
+    if not already_on:
+        sidecar = {
+            # 整段快照，不手抄"我们会改哪些字段"的清单：宿主的 clear_model_endpoint_credentials
+            # 哪天多清一个字段，手抄清单就会静默丢掉那个字段的原值。
+            "previous_model": copy.deepcopy(model_cfg),
+            "snapshot": _snapshot(home),
+            "created_at": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
+        }
+        _write_sidecar(home, sidecar)
+
+    providers = cfg.get("providers")
+    if not isinstance(providers, dict):
+        providers = {}
+        cfg["providers"] = providers
+    providers[GRIX_PROVIDER_ID] = {
+        "name": "Grix",
+        "api": base_url,
+        "api_key": api_key,
+        "default_model": model,
+        "transport": "openai_chat",
+    }
+
+    # model.base_url / api_key 这些内联 endpoint 字段只对 provider=custom 有意义，留着会污染
+    # 命名 provider 的解析（宿主自己切换非 custom provider 时也做同样的清理）。
+    clear_model_endpoint_credentials(model_cfg, clear_base_url=True)
+    model_cfg["provider"] = GRIX_PROVIDER_ID
+    model_cfg["default"] = model
+
+    _save_profile_config(home, cfg)
+    _verify_write(home, expect_relay=True)
+    return {
+        "ok": True,
+        "profile": name,
+        "home": home,
+        "model": model,
+        "gateway_running": running,
+        "restart_required": True,
+        "snapshot": (sidecar or {}).get("snapshot"),
+    }
+
+
+def cmd_clear(req: Dict[str, Any]) -> Dict[str, Any]:
+    name, home, running, cfg = _find_profile(req.get("agent_id"))
+    model_cfg = _model_section(cfg)
+    sidecar = _read_sidecar(home)
+    snapshot = (sidecar or {}).get("snapshot")
+
+    # **grix provider 连同虚拟 Key 原样留着，不删。**
+    #
+    # 虚拟 Key 是按 agent 绑定的长期凭证：服务端只在签发那一刻给一次明文，之后再要只能
+    # resend——而 resend 会签一把新的并吊销旧的。关中转就把本地这份删掉的话，下次开中转
+    # 就只能换新 Key，于是每开关一轮换一把，按 Key 统计的用量被切成互不相连的碎片。
+    # 关中转要的是"不再走中转"，把模型指回用户原来的供应商就够了；留下的 grix provider
+    # 没有任何东西指向它，不影响推理，下次开中转直接指回来即可。
+    providers = cfg.get("providers")
+    provider_kept = isinstance(providers, dict) and GRIX_PROVIDER_ID in providers
+
+    # 中转开着的时候用户可能自己 /model 切走了——那是他的新选择，无脑把旧值写回去会把它冲掉。
+    # 只有确认模型还指着 grix 时才动 model 段。
+    still_on_grix = _relay_active(cfg)
+    previous = (sidecar or {}).get("previous_model")
+    restored = False
+    model_cleared = False
+
+    if still_on_grix:
+        if isinstance(previous, dict):
+            cfg["model"] = copy.deepcopy(previous)
+            restored = True
+        else:
+            # sidecar 丢了或读坏了。**绝不能把 model.provider=grix 留在盘上**——它会指向一个
+            # 刚被我们摘掉的 provider，配置直接是坏的，比还原和不还原都糟。清掉指向让 hermes
+            # 回落到它自己的默认，并在响应里如实说明我们没能还原成用户原来的模型。
+            model_cfg.pop("provider", None)
+            model_cfg.pop("default", None)
+            model_cleared = True
+
+    if restored or model_cleared:
+        _save_profile_config(home, cfg)
+        _verify_write(home, expect_relay=False)
+
+    sidecar_path = _sidecar_path(home)
+    if os.path.exists(sidecar_path):
+        with contextlib.suppress(Exception):
+            os.remove(sidecar_path)
+
+    result = {
+        "ok": True,
+        "profile": name,
+        "home": home,
+        # 中转 provider（连同虚拟 Key）留在配置里，供下次开中转直接复用——见上面为什么不删。
+        "provider_kept": provider_kept,
+        "restored_model": restored,
+        # 用户中途自己换过模型：model 段是他自己的选择，我们没动。
+        "user_switched_away": bool(not still_on_grix),
+        "gateway_running": running,
+        "restart_required": bool(restored or model_cleared),
+    }
+    if snapshot:
+        # 逃生舱得告诉人它在哪，否则等于没有。
+        result["snapshot"] = snapshot
+    if model_cleared:
+        result["model_cleared"] = True
+        result["warning"] = (
+            "relay state file was missing or unreadable: the grix provider was removed and the "
+            "model selection was cleared (hermes will fall back to its default). The previous "
+            "model settings could not be restored"
+            + (f"; a pre-relay snapshot is kept at {snapshot}" if snapshot else "")
+        )
+    return result
+
+
+COMMANDS = {"discover": cmd_discover, "apply": cmd_apply, "clear": cmd_clear}
+
+
+def main() -> int:
+    try:
+        raw = sys.stdin.read()
+        req = json.loads(raw) if raw.strip() else {}
+    except Exception as exc:
+        print(json.dumps({"ok": False, "error_code": "BAD_REQUEST", "error_msg": str(exc)}))
+        return 1
+
+    command = str(req.get("command") or "").strip()
+    handler = COMMANDS.get(command)
+    if handler is None:
+        print(json.dumps({
+            "ok": False,
+            "error_code": "BAD_REQUEST",
+            "error_msg": f"unknown command: {command or '(empty)'}",
+        }))
+        return 1
+
+    # 宿主的配置层会往 stdout 打提示（managed 配置等），那会污染我们的 JSON 协议。
+    # 业务执行期间把 stdout 折到 stderr，只有最终响应写回真正的 stdout。
+    real_stdout = sys.stdout
+    try:
+        with contextlib.redirect_stdout(io.StringIO()) as captured:
+            result = handler(req)
+        noise = captured.getvalue().strip()
+        if noise:
+            print(noise, file=sys.stderr)
+    except RelayError as exc:
+        print(json.dumps({
+            "ok": False,
+            "error_code": exc.code,
+            "error_msg": _redact(exc.msg, req),
+        }), file=real_stdout)
+        return 1
+    except Exception as exc:  # noqa: BLE001 - 兜底
+        print(json.dumps({
+            "ok": False,
+            "error_code": "CONFIG_WRITE_FAILED",
+            "error_msg": _redact(f"{type(exc).__name__}: {exc}", req),
+        }), file=real_stdout)
+        return 1
+
+    print(json.dumps(result, ensure_ascii=False), file=real_stdout)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/dist/core/proxy/relay-credential-router.js

@@ -0,0 +1 @@
+class o extends Error{code;constructor(r,e){super(r),this.code=e,this.name="RelayRouteError"}}function l(t,r,e){return t?.code!=="PROFILE_NOT_FOUND"?t:new o(`agent_id ${r} matches neither of the two places it could live on this machine: it is not among the ${e} agent(s) in this connector's agents.json, and no hermes profile is bound to it`,"NOT_FOUND")}async function c(t,r,e){const n=r?.trim();if(!n)throw new o("agent_id is required","MISSING_AGENT_ID");if(!e.virtualKey?.trim())throw new o("virtual_key is required","MISSING_VIRTUAL_KEY");const i=t.listAgents(),a=i.find(s=>(s.agentId??"").trim()===n);if(a)return{target:"managed-agent",result:await t.enableManaged(a.name,n,e)};try{return{target:"hermes-profile",result:await t.enableHermesProfile(n,e)}}catch(s){throw l(s,n,i.length)}}async function d(t,r){const e=r?.trim();if(!e)throw new o("agent_id is required","MISSING_AGENT_ID");const n=t.listAgents(),i=n.find(a=>(a.agentId??"").trim()===e);if(i)return{target:"managed-agent",result:await t.disableManaged(i.name)};try{return{target:"hermes-profile",result:await t.disableHermesProfile(e)}}catch(a){throw l(a,e,n.length)}}export{o as RelayRouteError,d as disableRelayCredential,c as enableRelayCredential};