magpie-gemini-web 0.5.2 → 0.5.4

package/README.en.md

@@ -17,7 +17,7 @@ The plugin provides two independent providers that can be used individually or t
 | **Thinking levels** | `minimal` / `low` / `medium` / `high` (`minimal` is fastest & cheapest) | `low` (base) / `high` (`-thinking` extended thinking) |
 | **Sign-in method** | Sign in directly in an isolated popup browser window | Copy `cookie` from a private/incognito window |
 | **Usage cards** | Shows models currently on cooldown and recovery times | Syncs **5-hour** & **weekly** usage and reset times from the web |
-| **Local backend** | AIStudio2API (`v0.2.13`) | gemini-web2api-go (`4.22.0-magpie.1` optimized build) |
+| **Local backend** | AIStudio2API (`v0.2.14`) | gemini-web2api-go (`4.22.0-magpie.1` optimized build) |
 
 ---
 
@@ -82,12 +82,17 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 | `stripCitations` | `true` | `gemini-web` only | Strip `[cite: 1]` and `[cite_start]` markers from replies and tool arguments (not supported on AI Studio) |
 | `baseURL` | `http://127.0.0.1:8083/v1` | `gemini-web` only | Default Gemini Web backend URL |
 | `contextLimit` / `outputLimit` | `1000000` / `8192` | `gemini-web` only | Context and output limits reported to clients |
-| `studio.proxy` | none | `ai-studio` only | Proxy for reaching Google (`http` / `https` / `socks5`), or set `AI_STUDIO_PROXY` env var |
+| `studio.proxy` | none | `ai-studio` only | Proxy for reaching Google (`http` / `https` / `socks5`), or set `AI_STUDIO_PROXY` env var; when set, it takes precedence over the proxy saved in the admin page. An empty value counts as unset |
 | `studio.baseURL` | `http://127.0.0.1:2048/v1` | `ai-studio` only | Default URL when connecting an existing AIStudio2API instance |
 | `studio.contextLimit` / `studio.outputLimit` | Model catalog defaults | `ai-studio` only | Limits reported to clients (can only lower the catalog defaults) |
 
 **Using a proxy to reach Google:**
-- **AI Studio:** Set `studio.proxy` in plugin options or the `AI_STUDIO_PROXY` environment variable.
+- **AI Studio:** Preferably set it in the local admin page. Open the address on the usage card's "管理页" (admin page) line (default `http://127.0.0.1:2048`) and sign in as `magpie` with `adminPassword` from `config.json` in the data directory. Save the proxy, then restart the service from the admin page. The plugin keeps the saved value when it restarts the backend.
+  - Alternatively, `studio.proxy` or `AI_STUDIO_PROXY` take precedence over the saved proxy. A change applies after the local service restarts (`npm run studio:stop`; the next request starts it again).
+  - With neither set, the backend falls back to the `HTTPS_PROXY` environment variable or the system proxy (Windows proxy settings).
+  - **The provider proxy set for `ai-studio` in Magpie is not passed to the local backend**; use one of the options above.
+  - The usage card's "代理出口" (proxy) line, the Google sign-in instructions and failure messages, and `npm run studio:status` show the proxy the backend actually uses, where it comes from, and whether a new setting still needs a restart.
+  - The listen address, API key and admin credentials are managed by the plugin; changing them in the admin page has no effect.
 - **Gemini Web:** The backend ignores `HTTP_PROXY`. Add your proxy to the proxy pool in the local admin panel at `http://127.0.0.1:8083/admin` (password is `adminToken` in `secrets.json` inside the data directory).
   - *Note:* When using a proxy pool, send one request with a newly added account so the backend binds it to a proxy, then re-add it via "Add an existing Google account from the local backend" to load its email and usage (SOCKS proxies are not supported for usage reads).
 
@@ -130,8 +135,8 @@ When a plugin error asks you to run a command, it includes the full ready-to-cop
 - Concurrency is capped at 1, but Google account rate-limiting or flagging cannot be completely ruled out—use at your own risk.
 
 **AI Studio upgrades and model selection:**
-- The plugin pins SHA-256-verified `v0.2.13-magpie.1`, based on upstream `v0.2.13`. Upgrade the plugin to update the backend. Official managed releases at or below that upstream version are upgraded on the next managed startup, preserving accounts, port and sign-in credentials.
-- **Online updates are disabled in the managed backend on macOS, Linux, and Windows.** The admin page directs users to upgrade through the Magpie plugin; the update endpoint returns HTTP 403 and update checks do not contact GitHub. Independently managed external servers are unaffected. See [docs/studio-release.md](docs/studio-release.md) for the patch and reproducible build process.
+- The plugin pins SHA-256-verified `v0.2.14-magpie.1`, based on upstream `v0.2.14`. Upgrade the plugin to update the backend. Official releases at or below that upstream version, and managed backends an older plugin installed, are upgraded on the next managed startup, preserving accounts, port and sign-in credentials.
+- **Online updates are disabled in the managed backend on macOS, Linux, and Windows.** The admin page says updates are managed by magpie-gemini-web; the update endpoint returns HTTP 409 and update checks do not contact GitHub. Independently managed external servers are unaffected. See [docs/studio-release.md](docs/studio-release.md) for how the managed build is made and reproduced.
 - Managed Unix installs still attempt to set `package/` to `0555` as additional file protection. Permission failures do not block service, and disabling online updates does not depend on permissions. To reset by manually deleting the data directory, stop the service first, then run `chmod -R u+w "<data-dir>/package"` before deleting it; replace `<data-dir>` with the actual path.
 - If a newer or custom version is installed, the plugin reports a conflict with `stop`, `install`, and `start` commands carrying the correct `--data-dir`. Stop can recover a changed listener PID and verifies its executable path before signaling it. If HTTP is down but the process is still alive, the plugin refuses to reinstall or launch a second process.
 - When stopped, a replaced executable is restored from the verified pinned archive; failed verification never launches the replacement. Existing account and runtime data files are kept, but **an older backend may not read data migrated by a newer version**. Before manually downgrading, stop the service and back up the entire data directory, including `auth/` and `runtime/requests.db`. If data migration is known to have occurred, update the plugin to match the newer backend.

package/README.md

@@ -17,7 +17,7 @@
 | **思考档位** | `minimal` / `low` / `medium` / `high` 四档（`minimal` 最快最省） | `low`（普通）/ `high`（`-thinking` 扩展思考）两档 |
 | **登录方式** | 弹出独立浏览器窗口直接登录 Google | 用无痕窗口登录并复制 `cookie` |
 | **额度卡片** | 显示冷却中的模型与恢复时间 | 同步网页版 **5 小时** 与 **每周** 用量及重置时间 |
-| **本地后端** | AIStudio2API (`v0.2.13`) | gemini-web2api-go (`4.22.0-magpie.1` 优化版) |
+| **本地后端** | AIStudio2API (`v0.2.14`) | gemini-web2api-go (`4.22.0-magpie.1` 优化版) |
 
 ---
 
@@ -82,12 +82,17 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 | `stripCitations` | `true` | 仅 `gemini-web` | 剥离回复与工具参数中的 `[cite: 1]`、`[cite_start]` 标记（AI Studio 不支持剥离） |
 | `baseURL` | `http://127.0.0.1:8083/v1` | 仅 `gemini-web` | Gemini Web 默认后端地址 |
 | `contextLimit` / `outputLimit` | `1000000` / `8192` | 仅 `gemini-web` | 向客户端声明的上下文 / 输出上限 |
-| `studio.proxy` | 无 | 仅 `ai-studio` | 访问 Google 的代理（`http` / `https` / `socks5`），也可用环境变量 `AI_STUDIO_PROXY` |
+| `studio.proxy` | 无 | 仅 `ai-studio` | 访问 Google 的代理（`http` / `https` / `socks5`），也可用环境变量 `AI_STUDIO_PROXY`；设置后优先于管理页里保存的代理，留空等于不设置 |
 | `studio.baseURL` | `http://127.0.0.1:2048/v1` | 仅 `ai-studio` | 连接已有 AIStudio2API 时的默认地址 |
 | `studio.contextLimit` / `studio.outputLimit` | 模型目录默认值 | 仅 `ai-studio` | 向客户端声明的上限（仅支持在目录值基础上调低） |
 
 **配置代理访问 Google：**
-- **AI Studio**：配置上表中的 `studio.proxy` 或环境变量 `AI_STUDIO_PROXY`。
+- **AI Studio**：推荐在本地管理页设置。打开额度卡片「管理页」一行里的地址（默认 `http://127.0.0.1:2048`），用户名 `magpie`，密码是数据目录 `config.json` 里的 `adminPassword`；保存代理后在管理页重启服务即可生效，之后插件重启后端也不会覆盖它。
+  - 也可以用上表的 `studio.proxy` 或环境变量 `AI_STUDIO_PROXY`，它们优先于管理页里保存的代理。改了要重启本地服务才生效（`npm run studio:stop`，下一次请求会自动启动）。
+  - 都没设置时，后端自动使用 `HTTPS_PROXY` 环境变量或系统代理（Windows 的「代理」设置）。
+  - **Magpie 里给 `ai-studio` 设置的供应商代理不会传给本地后端**，请用上面两种方式之一设置。
+  - 额度卡片的「代理出口」一行会显示后端当前实际使用的代理、它来自哪里，以及新设置是否还要重启才生效；登录 Google 时的说明、登录失败的提示和 `npm run studio:status` 也会显示。
+  - 监听地址、API Key、管理员账号等由插件管理，在管理页修改不会生效。
 - **Gemini Web**：后端不读取 `HTTP_PROXY`，请打开本地管理面板 `http://127.0.0.1:8083/admin` 在代理池中添加（登录口令为数据目录 `secrets.json` 中的 `adminToken`）。
   - *注意*：配置代理池后，新添加的账号需先发送一次请求以绑定代理，再通过「添加本地后端里已有的 Google 账号」重新添加，才能正常读取邮箱和用量（不支持通过 SOCKS 代理读取用量）。
 
@@ -130,8 +135,8 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 - 插件将请求并发限制为 1，但仍无法完全排除 Google 账号风控风险，请自行评估使用。
 
 **AI Studio 升级与模型范围：**
-- 插件固定使用经过 SHA-256 校验的 `v0.2.13-magpie.1`（基于上游 `v0.2.13`），通过升级插件更新后端。同基线或更旧的官方托管后端在下次管理启动时自动升级，保留账号、端口与登录凭据。
-- **托管后端已在 macOS、Linux、Windows 统一禁用在线更新**：管理页提示“请通过 Magpie 插件升级”，更新接口返回 HTTP 403，检查更新也不会访问 GitHub。用户自行连接的外部服务不受影响。补丁和可复现构建流程见 [docs/studio-release.md](docs/studio-release.md)。
+- 插件固定使用经过 SHA-256 校验的 `v0.2.14-magpie.1`（基于上游 `v0.2.14`），通过升级插件更新后端。同基线或更旧的官方版、以及旧版插件装的托管后端，在下次管理启动时自动升级，保留账号、端口与登录凭据。
+- **托管后端已在 macOS、Linux、Windows 统一禁用在线更新**：管理页提示“更新由 magpie-gemini-web 管理”，更新接口返回 HTTP 409，检查更新也不会访问 GitHub。用户自行连接的外部服务不受影响。托管构建方式和可复现构建流程见 [docs/studio-release.md](docs/studio-release.md)。
 - Unix 的 `package/` 仍尽力设置为 `0555`，作为额外的文件保护；权限设置失败不阻断服务，在线更新的禁用也不依赖该权限。若要手动删除数据目录来重置，请先停止服务，再运行 `chmod -R u+w "<数据目录>/package"` 恢复可写权限，然后删除；将 `<数据目录>` 替换为实际路径。
 - 若自行更新到更新版或定制版，插件会提示版本冲突，并提供带正确 `--data-dir` 的 `stop`、`install`、`start` 命令。停止时会找回更新后的监听进程 PID，并核对可执行文件路径；无法核实身份就不会发送终止信号。HTTP 端口关闭但进程尚未退出时，插件不会重装或启动第二个进程。
 - 已停止但文件被替换的后端会从校验通过的固定版本安装包恢复；校验失败不会启动替换文件。安装会保留账号和运行数据文件，但**不保证旧版本能读取新版迁移过的数据**。手动降级前先停止服务并备份整个数据目录（包括 `auth/`、`runtime/requests.db` 等）；已知发生数据迁移时应升级插件以匹配新版后端。

package/docs/studio-release.md

@@ -1,29 +1,29 @@
 # AI Studio 托管后端构建
 
-插件使用 `0.2.13-magpie.1`，基于 AIStudio2API `v0.2.13` 的固定 commit。上游版本、commit、Go 工具链、安装包及二进制 SHA-256 均记录在 `lib/studio-release.json`。MIT 许可见 `LICENSE-AISTUDIO`。
+插件使用 `0.2.14-magpie.1`，基于 AIStudio2API `v0.2.14` 的固定 commit。上游版本、commit、Go 工具链、安装包及二进制 SHA-256 均记录在 `lib/studio-release.json`。MIT 许可见 `LICENSE-AISTUDIO`。
 
 ## 在线更新策略
 
-`patches/studio-managed.patch` 包含后端与管理页面修改：
+上游从 v0.2.14 起支持由分发方管理更新，不再需要补丁。构建时通过 `-ldflags` 写入两个值：
 
-- 后端移除在线更新的下载、文件替换逻辑；`GET /api/update`（包括 `?refresh=1`）仅返回本地版本及 `mode: managed`，不访问 GitHub。
-- `POST /api/update` 返回 HTTP 403，提示通过 Magpie 插件升级；不替换文件、不重启。此策略无环境变量或管理页开关，在所有构建平台相同。
-- 管理页版本面板显示当前版本及中英文升级提示，不提供检查更新或安装更新按钮。
-- 设置明确的 `v0.2.13-magpie.1` 版本标识。插件将同基线或更旧的官方版视为需要升级；更新的官方版或不认识的定制版仍提示冲突。
-- 普通插件升级、账户登录、模型调用及管理功能继续保留。用户自行连接的外部 AIStudio2API 服务不受此补丁控制。
+- `internal/app.version=v0.2.14-magpie.1`：明确的版本标识。插件把同基线或更旧的官方版、以及更旧的托管版（`-magpie.N` 的基线更低，或同基线但 N 更小）视为需要升级；更新的官方版、更新的托管版或不认识的定制版仍提示冲突。
+- `internal/app.managedBy=magpie-gemini-web`：更新模式为 `managed`。`GET /api/update`（包括 `?refresh=1`）只返回本地版本、`mode: managed` 和 `managed_by`，不访问 GitHub；`POST /api/update` 返回 HTTP 409，说明更新由 magpie-gemini-web 管理，不下载、不替换文件、不重启。这两个值在链接时写死，没有环境变量或管理页开关，在所有构建平台相同。
+- 管理页版本面板显示当前版本和"更新由 magpie-gemini-web 管理"，不显示检查更新或安装按钮。上游的在线更新代码仍然编译在内，但托管模式下走不到；`studio:managed:smoke` 用真实二进制验证这一点。
+- 构建不带 `desktop` 标签，即上游的命令行版，不包含桌面窗口。
+- 普通插件升级、账户登录、模型调用及管理功能继续保留。用户自行连接的外部 AIStudio2API 服务不受影响。
 
 ## 复现构建
 
 维护者需要 Git、tar、Node.js 26.8.2（构建页面用）、Go 1.27.1。Windows 使用 Git Bash 执行以下命令，安装包运行和解压使用 Windows 自带 PowerShell。最终用户不需要这些构建工具。
 
 ```bash
-# 按固定源代码和补丁构建所有五个平台，并核对现有 pin。
+# 按固定源代码构建所有五个平台，并核对现有 pin。
 npm run studio:release:build
 
 # 仅构建当前平台。
 node scripts/studio-release.mjs --target=host --verify
 
-# 制作新版本：审查源码/补丁后重新生成所有平台 pin。
+# 制作新版本：审查上游源码后重新生成所有平台 pin。
 node scripts/studio-release.mjs --write-pins
 
 # 可复用本地上游 git 仓库，但始终导出固定 commit，不使用工作区修改。
@@ -42,8 +42,8 @@ npm run studio:managed:smoke
 AI_STUDIO_TEST_ARCHIVE=/absolute/path/to/archive.tar.gz npm test
 ```
 
-真实安装验证检查启动、版本、GET 更新状态、POST 更新返回 403、二进制及 PID 不变、管理页面无更新入口、停止与状态。`.github/workflows/studio.yml` 在五种系统/架构上重新构建、对比 SHA-256 并运行该验证；本机交叉编译不代替 Windows 真机验证。
+真实安装验证检查启动、版本、GET 更新状态、POST 更新返回 409、二进制及 PID 不变、管理页面显示托管提示、停止与状态。`.github/workflows/studio.yml` 在五种系统/架构上重新构建、对比 SHA-256 并运行该验证；本机交叉编译不代替 Windows 真机验证。
 
-发布时先审查构建记录和各平台 CI 结果，再将安装包及许可证上传到本仓库 `studio-v0.2.13-magpie.1` release。该 release 可公开下载后，才能发布引用它的插件版本，否则新安装会遇到 404。构建脚本及 CI 不自动发布 release，也不发布 npm 包。
+发布时先审查构建记录和各平台 CI 结果，再将安装包及许可证上传到本仓库 `studio-v0.2.14-magpie.1` release。该 release 可公开下载后，才能发布引用它的插件版本，否则新安装会遇到 404。构建脚本及 CI 不自动发布 release，也不发布 npm 包。
 
-本地试用无需发布：先停止当前托管后端，再执行 `node scripts/studio.mjs install --archive /absolute/path/to/archive` 和 `node scripts/studio.mjs start`。可用 `--data-dir` 指定目录。修改前备份账号和配置；该定制版本与上游 v0.2.13 使用相同的数据格式。
+本地试用无需发布：先停止当前托管后端，再执行 `node scripts/studio.mjs install --archive /absolute/path/to/archive` 和 `node scripts/studio.mjs start`。可用 `--data-dir` 指定目录。修改前备份账号和配置；该版本与上游 v0.2.14 使用相同的数据格式。v0.2.14 对数据的改动都是新增的（账号记录的可选字段、新的 `runtime/prompts.db`、`.env` 的新设置），用真实账号验证过：`v0.2.13-magpie.1` 的数据可以直接被它读取，用它运行过之后退回 `v0.2.13-magpie.1` 也能正常使用。

package/lib/studio-native.mjs

@@ -109,12 +109,36 @@ export function validateProxy(proxy) {
   return trimmed;
 }
 
-// effectiveProxy is the proxy the service and its downloads go through: the one given, else
-// AI_STUDIO_PROXY, else the one saved in config.json.
-function effectiveProxy(explicit, saved) {
+// pluginProxy is the proxy this plugin sets for the service over the one saved in its .env: the
+// one given (studio.proxy, or a CLI --proxy), else AI_STUDIO_PROXY, with where it comes from. An
+// empty one names none, so the saved one applies; null when neither names one.
+export function pluginProxy(explicit) {
+  const given = validateProxy(explicit);
+  if (given) return { proxy: given, source: 'option' };
+  const env = validateProxy(process.env.AI_STUDIO_PROXY);
+  if (env) return { proxy: env, source: 'env' };
+  return null;
+}
+
+// downloadProxy is the proxy an install downloads through: the one given (an empty one turns it
+// off), else AI_STUDIO_PROXY, else the service's saved one, else the one an older config.json kept.
+function downloadProxy(dataDir, explicit, savedConfig) {
   if (explicit !== undefined) return validateProxy(explicit);
   if (process.env.AI_STUDIO_PROXY !== undefined) return validateProxy(process.env.AI_STUDIO_PROXY);
-  return validateProxy(saved);
+  let saved;
+  try {
+    saved = readStudioEnv(dataDir).PROXY;
+  } catch {}
+  return saved !== undefined ? firstProxy(saved) : validateProxy(savedConfig?.proxy);
+}
+
+// firstProxy is the first of a PROXY list (upstream takes several, comma-separated, as a pool).
+function firstProxy(value) {
+  return proxyList(value)[0] ?? '';
+}
+
+function proxyList(value) {
+  return [...new Set(String(value ?? '').split(',').map(p => p.trim()).filter(Boolean))];
 }
 
 export function validateConfig(config) {
@@ -148,9 +172,34 @@ export function validateConfig(config) {
   };
 }
 
-// serviceEnv is the fixed settings the service runs with. The service is started with them and
-// they are written to its .env, which it reads again when its generation service restarts.
-function serviceEnv(dataDir, config, options = {}) {
+// ENV_KEYS are the settings upstream reads from .env, in the order it writes them (config.configKeys).
+const ENV_KEYS = [
+  'AISTUDIO_AUTH_STATES', 'LISTEN_ADDR', 'PROXY_API_KEY', 'PROXY', 'INIT_TIMEOUT', 'REQUEST_TIMEOUT',
+  'WARM_WORKER_LIMIT', 'MAX_ACTIVE_WORKERS', 'WARM_STARTUP_CONCURRENCY', 'PER_ACCOUNT_CONCURRENCY',
+  'ROUTING_STRATEGY', 'UPSTREAM_CHANNELS', 'MODEL_MAPPING', 'TEMPORARY_CHAT', 'WAA_BACKEND', 'AUTO_START',
+  'REQUEST_BODY_LOG', 'LOG_FILE', 'LOG_MAX_TOTAL_MB', 'ADMIN_AUTH_ENABLED', 'ADMIN_USERNAME', 'ADMIN_PASSWORD',
+  'BUILD_NATIVE_NONSTREAM', 'MODEL_CHANNELS', 'MEDIA_OUTPUT', 'MEDIA_BASE_URL'
+];
+
+// SETTING_DEFAULTS are the settings the admin page owns, as a new setup has them. They are written
+// to .env when it lacks them and left as the admin page saves them after that.
+const SETTING_DEFAULTS = {
+  REQUEST_BODY_LOG: 'false',
+  LOG_FILE: 'false',
+  TEMPORARY_CHAT: 'true',
+  PER_ACCOUNT_CONCURRENCY: '1',
+  WARM_WORKER_LIMIT: '1',
+  MAX_ACTIVE_WORKERS: '1',
+  WARM_STARTUP_CONCURRENCY: '1',
+  ROUTING_STRATEGY: 'fill-first',
+  REQUEST_TIMEOUT: '30m',
+  INIT_TIMEOUT: '2m'
+};
+
+// pluginEnv is the settings this plugin depends on to reach, trust and drive the service. The
+// service is started with them in its environment, which upstream reads over .env, so saving
+// others in the admin page can't break them.
+function pluginEnv(dataDir, config) {
   const authDir = path.resolve(dataDir, 'auth');
   if (/[\r\n]/.test(authDir) || /[\r\n]/.test(config.apiKey) || /[\r\n]/.test(config.adminUsername) || /[\r\n]/.test(config.adminPassword)) {
     throw new Error('Configuration paths or credentials must not contain newlines');
@@ -163,29 +212,103 @@ function serviceEnv(dataDir, config, options = {}) {
     ADMIN_USERNAME: config.adminUsername,
     ADMIN_PASSWORD: config.adminPassword,
     AUTO_START: 'true',
-    REQUEST_BODY_LOG: 'false',
-    LOG_FILE: 'false',
     WAA_BACKEND: 'go',
     UPSTREAM_CHANNELS: 'playground',
-    BUILD_NATIVE_NONSTREAM: 'false',
-    TEMPORARY_CHAT: 'true',
-    PER_ACCOUNT_CONCURRENCY: '1',
-    WARM_WORKER_LIMIT: '1',
-    MAX_ACTIVE_WORKERS: '1',
-    WARM_STARTUP_CONCURRENCY: '1',
-    ROUTING_STRATEGY: 'fill-first',
-    REQUEST_TIMEOUT: '30m',
-    INIT_TIMEOUT: '2m',
-    PROXY: effectiveProxy(options.proxy, config.proxy)
+    BUILD_NATIVE_NONSTREAM: 'false'
   };
 }
 
-export function generateEnv(dataDir, config, options = {}) {
-  return Object.entries(serviceEnv(dataDir, config, options)).map(([k, v]) => `${k}=${v}\n`).join('');
+// serviceEnv is the environment the service is started with: this plugin's settings, and PROXY
+// only when the plugin sets one (see pluginProxy). Without it the service takes the PROXY saved
+// in .env, which the admin page changes.
+export function serviceEnv(dataDir, config, options = {}) {
+  const env = pluginEnv(dataDir, config);
+  const owned = pluginProxy(options.proxy);
+  if (owned) env.PROXY = owned.proxy;
+  return env;
+}
+
+// parseEnvValue and formatEnvValue read and write a .env value as upstream does.
+function parseEnvValue(raw, where) {
+  if (!raw) return '';
+  if (raw[0] === "'") {
+    if (raw.length < 2 || !raw.endsWith("'")) throw new Error(`${where}: unterminated single quote`);
+    return raw.slice(1, -1);
+  }
+  if (raw[0] === '"') {
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`${where}: invalid double-quoted value`);
+    }
+  }
+  const comment = raw.indexOf(' #');
+  return comment >= 0 ? raw.slice(0, comment).trim() : raw;
+}
+
+function formatEnvValue(value) {
+  return /[ \t\r\n#"']/.test(value) ? JSON.stringify(value) : value;
+}
+
+// readStudioEnv is the settings saved in the service's .env (none when it has no .env).
+export function readStudioEnv(dataDir) {
+  const envPath = path.join(dataDir, '.env');
+  let text;
+  try {
+    text = fs.readFileSync(envPath, 'utf8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return {};
+    throw err;
+  }
+  const values = {};
+  text.split(/\r?\n/).forEach((line, i) => {
+    line = line.trim();
+    if (!line || line.startsWith('#')) return;
+    const eq = line.indexOf('=');
+    if (eq < 0) throw new Error(`${envPath}:${i + 1}: missing "="`);
+    const key = line.slice(0, eq).trim();
+    if (ENV_KEYS.includes(key)) values[key] = parseEnvValue(line.slice(eq + 1).trim(), `${envPath}:${i + 1}`);
+  });
+  return values;
+}
+
+function writeStudioEnv(dataDir, values) {
+  const envPath = path.join(dataDir, '.env');
+  const content = ENV_KEYS.filter(k => values[k] !== undefined).map(k => `${k}=${formatEnvValue(String(values[k]))}\n`).join('');
+  let current;
+  try {
+    current = fs.readFileSync(envPath, 'utf8');
+  } catch {}
+  if (current !== content) {
+    const tmpEnv = `${envPath}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    fs.writeFileSync(tmpEnv, content, { mode: 0o600 });
+    fs.renameSync(tmpEnv, envPath);
+  }
+  fs.chmodSync(envPath, 0o600);
+}
+
+// syncStudioEnv brings .env up to date with config.json, keeping what the admin page saved: this
+// plugin's settings are written over, the others only when missing. A missing PROXY is the one
+// given, else the one an older config.json kept (which nothing reads after that).
+function syncStudioEnv(dataDir, config, seedProxy) {
+  const values = readStudioEnv(dataDir);
+  Object.assign(values, pluginEnv(dataDir, config));
+  for (const [key, value] of Object.entries(SETTING_DEFAULTS)) values[key] ??= value;
+  values.PROXY ??= validateProxy(seedProxy) || config.proxy;
+  writeStudioEnv(dataDir, values);
+}
+
+// saveStudioProxy saves the service's proxy in its .env, as the admin page does. The service
+// takes it the next time its generation service starts.
+export function saveStudioProxy(dataDir, proxy) {
+  const values = readStudioEnv(dataDir);
+  values.PROXY = validateProxy(proxy);
+  writeStudioEnv(dataDir, values);
 }
 
 // ensureStudioConfig reads config.json, writing a new one if there is none: on options.port when
-// given (see pickStudioPort), else on DEFAULT_STUDIO_PORT.
+// given (see pickStudioPort), else on DEFAULT_STUDIO_PORT. It then brings .env up to date (see
+// syncStudioEnv), with explicitProxy as the proxy to save if .env has none yet.
 export function ensureStudioConfig(dataDir, explicitProxy = undefined, options = {}) {
   fs.mkdirSync(dataDir, { recursive: true, mode: 0o700 });
   fs.chmodSync(dataDir, 0o700);
@@ -204,29 +327,24 @@ export function ensureStudioConfig(dataDir, explicitProxy = undefined, options =
     fs.chmodSync(configPath, 0o600);
   } catch (err) {
     if (err.code === 'ENOENT') {
-      config = {
+      const created = {
         version: 1,
         port: options.port ?? DEFAULT_STUDIO_PORT,
         apiKey: 'as_' + crypto.randomBytes(32).toString('hex'),
         adminUsername: 'magpie',
-        adminPassword: crypto.randomBytes(32).toString('hex'),
-        proxy: validateProxy(explicitProxy ?? '')
+        adminPassword: crypto.randomBytes(32).toString('hex')
       };
       const tmp = `${configPath}.${crypto.randomBytes(4).toString('hex')}.tmp`;
-      fs.writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+      fs.writeFileSync(tmp, JSON.stringify(created, null, 2) + '\n', { mode: 0o600 });
       fs.renameSync(tmp, configPath);
       fs.chmodSync(configPath, 0o600);
+      config = validateConfig(created);
     } else {
       throw err;
     }
   }
 
-  const envPath = path.join(dataDir, '.env');
-  const envContent = generateEnv(dataDir, config, { proxy: explicitProxy });
-  const tmpEnv = `${envPath}.${crypto.randomBytes(4).toString('hex')}.tmp`;
-  fs.writeFileSync(tmpEnv, envContent, { mode: 0o600 });
-  fs.renameSync(tmpEnv, envPath);
-  fs.chmodSync(envPath, 0o600);
+  syncStudioEnv(dataDir, config, explicitProxy);
 
   const authDir = path.join(dataDir, 'auth');
   fs.mkdirSync(authDir, { recursive: true, mode: 0o700 });
@@ -425,6 +543,114 @@ export async function studioAccounts(options = {}) {
   return accounts.filter(a => a.enabled !== false);
 }
 
+// PROXY_SOURCES names where the proxy the service goes out through comes from.
+export const PROXY_SOURCES = {
+  option: '插件选项 studio.proxy',
+  env: '环境变量 AI_STUDIO_PROXY',
+  saved: '管理页',
+  startup: '服务启动时的设置',
+  unknown: '来源待确认',
+  system: '自动检测：HTTPS_PROXY 环境变量或系统代理',
+  direct: '直连'
+};
+
+// redactProxy hides the passwords in a PROXY list.
+export function redactProxy(value) {
+  return proxyList(value).map(p => {
+    try {
+      const u = new URL(p);
+      if (u.password) u.password = '***';
+      return u.toString().replace(/\/$/, '');
+    } catch {
+      return p;
+    }
+  }).join(',');
+}
+
+// LAUNCH_RECORD says, for the service process this plugin last started, whether it was started
+// with a PROXY of the plugin's over the saved one, and whose: 'option' or 'env' (see pluginProxy),
+// null for none. A caller that doesn't know the plugin's options (the CLI) reads it from there.
+const LAUNCH_RECORD = 'backend.launch.json';
+
+function writeLaunchRecord(dataDir, pid, proxy) {
+  const record = { pid, proxy: pluginProxy(proxy)?.source ?? null };
+  try {
+    fs.writeFileSync(path.join(dataDir, LAUNCH_RECORD), JSON.stringify(record) + '\n', { mode: 0o600 });
+  } catch {}
+}
+
+// launchRecord is the record of the running service's start, or null when the running service
+// isn't the one it was written for (or an older plugin started it, which wrote none).
+function launchRecord(dataDir) {
+  try {
+    const record = JSON.parse(fs.readFileSync(path.join(dataDir, LAUNCH_RECORD), 'utf8'));
+    if (record?.pid !== recordedPid(dataDir) || !(record.proxy === null || record.proxy in PROXY_SOURCES)) return null;
+    return record;
+  } catch {
+    return null;
+  }
+}
+
+// studioProxy is how the running service reaches Google:
+//   active  the proxy it goes out through now ('' for none), and source where that comes from (a
+//           PROXY_SOURCES key; 'unknown' when the service can't tell it from a change not yet applied);
+//   saved   the proxy saved in .env, as the admin page shows it;
+//   overridden, when another one is used over a saved one: whose it is ('option' or 'env'), or
+//           'unknown' when the service was started with another one in its environment and
+//           nothing tells whose;
+//   pending what it takes for the one set (wanted, from wantedSource) to apply: 'restart', the
+//           service must start again; 'generation', its generation service must; null, nothing.
+// A standalone caller (the CLI) doesn't know the plugin's options, so it can't tell what the
+// service will be started with next: it reads what it was started with from the launch record.
+// Passwords are hidden.
+export async function studioProxy(local, options = {}) {
+  const saved = proxyList(readStudioEnv(local.dataDir).PROXY).join(',');
+  const override = options.standalone ? null : pluginProxy(options.proxy);
+  const cfg = await studioAdmin(local, 'GET', '/api/config', null, { timeoutMs: 3000, fetchFn: options.fetchFn });
+  // What the service reads as its PROXY now: .env, or the environment it was started with over it
+  const loaded = proxyList(cfg?.proxy).join(',');
+  const active = proxyList(cfg?.active_proxy).join(',');
+
+  let want = override ? override.proxy : saved;
+  let wantedSource = override ? override.source : 'saved';
+  let overridden = override && saved && saved !== override.proxy ? override.source : null;
+  if (options.standalone && loaded !== saved) {
+    // Started with another proxy in its environment: one of the plugin's, which applies as long as
+    // it is set, or, with no record of whose, one a restart may or may not set again
+    const launched = launchRecord(local.dataDir)?.proxy;
+    overridden = launched || 'unknown';
+    if (launched) {
+      want = loaded;
+      wantedSource = launched;
+    }
+  }
+
+  let pending = null;
+  if (loaded !== want) pending = 'restart';
+  else if (want && active !== want) pending = 'generation';
+  // Saved none, going out through one: the system's, or one saved before that the generation
+  // service still has. A change not yet applied leaves which it is open.
+  const unsure = !want && active && cfg?.service_restart_required === true;
+  if (unsure) pending = 'generation';
+
+  let source;
+  if (!active) source = 'direct';
+  else if (unsure) source = 'unknown';
+  else if (pending) source = 'startup';
+  else if (!loaded) source = 'system';
+  else source = wantedSource;
+
+  return {
+    active: redactProxy(active),
+    source,
+    saved: redactProxy(saved),
+    overridden,
+    wanted: redactProxy(want),
+    wantedSource,
+    pending
+  };
+}
+
 export function isConnectRefused(err) {
   if (!err) return false;
   const visited = new Set();
@@ -442,6 +668,20 @@ export function isConnectRefused(err) {
   return false;
 }
 
+// olderStudioVersion says whether a version (without its v) is one this plugin may replace: an
+// official X.Y.Z at or below the upstream base, or a managed X.Y.Z-magpie.N on an older base, or
+// on the same base with a lower N.
+function olderStudioVersion(version) {
+  const running = /^(\d+)\.(\d+)\.(\d+)(?:-magpie\.(\d+))?$/.exec(version);
+  if (!running) return false;
+  const ours = /-magpie\.(\d+)$/.exec(release.version);
+  const base = running.slice(1, 4).map(Number);
+  const expected = release.upstream.version.split('.').map(Number);
+  const different = base.findIndex((n, i) => n !== expected[i]);
+  if (different !== -1) return base[different] < expected[different];
+  return running[4] === undefined || Number(running[4]) < Number(ours[1]);
+}
+
 // checkStudioHealth says what answers on the setup's port: 'down' (nothing), 'up' (this setup's
 // service, at the pinned version), 'outdated' (an older official version),
 // 'version_conflict' (a newer or custom version installed outside this plugin),
@@ -487,14 +727,11 @@ export async function checkStudioHealth(local, fetchFn) {
     }
   }
 
-  // Official releases at or below our upstream base can move to the managed
-  // build. Newer/custom installations require an explicit recovery decision.
+  // Official releases at or below our upstream base, and managed builds older than this one, can
+  // move to this managed build. Newer/custom installations require an explicit recovery decision.
   const runningVersion = String(status.version).replace(/^v/, '');
   if (runningVersion !== release.version) {
-    const parts = /^\d+\.\d+\.\d+$/.test(runningVersion) ? runningVersion.split('.').map(Number) : null;
-    const expected = release.upstream.version.split('.').map(Number);
-    const different = parts?.findIndex((n, i) => n !== expected[i]);
-    const older = parts && (different === -1 || parts[different] < expected[different]);
+    const older = olderStudioVersion(runningVersion);
     return { state: older ? 'outdated' : 'version_conflict', status, reason: `Running version ${status.version}, expected ${STUDIO_VERSION}` };
   }
 
@@ -799,7 +1036,7 @@ export async function installStudio(options = {}) {
     } else {
       const downloadUrl = `https://github.com/${release.repository}/releases/download/${release.tag}/${pin.asset}`;
       archivePath = path.join(stageDir, pin.asset);
-      const proxy = effectiveProxy(options.proxy, savedConfig?.proxy);
+      const proxy = downloadProxy(dataDir, options.proxy, savedConfig);
 
       if (options.fetchFn && options.fetchFn !== globalThis.fetch) {
         const res = await options.fetchFn(downloadUrl, { signal: AbortSignal.timeout(300000) });
@@ -1036,7 +1273,9 @@ function shared(map, key, fn) {
 }
 
 // ensureStudio makes sure the service is installed and running, and, unless managementOnly,
-// that it takes generation requests. Callers share one start of the service and one wait for
+// that it takes generation requests. options.proxy is a proxy it is started with over the saved
+// one (studio.proxy); options.savedProxy is one saved as the service's own before it starts, as
+// the admin page saves one. Callers share one start of the service and one wait for
 // it to take requests; a managementOnly caller doesn't wait for the latter.
 export async function ensureStudio(options = {}) {
   const dataDir = options.dataDir || studioDataDir();
@@ -1113,10 +1352,11 @@ async function launchStudio(options) {
     }
 
     if (!manifestValid) {
-      await installStudio({ dataDir, platform, arch, fetchFn, archivePath: options.archivePath, proxy: options.proxy, preferredPort: options.preferredPort });
+      await installStudio({ dataDir, platform, arch, fetchFn, archivePath: options.archivePath, proxy: options.proxy ?? options.savedProxy, preferredPort: options.preferredPort });
     }
 
     const config = ensureStudioConfig(dataDir, options.proxy, { port: await newConfigPort(dataDir, options) });
+    if (options.savedProxy !== undefined) saveStudioProxy(dataDir, options.savedProxy);
     local = localStudio({ dataDir, platform });
     if (!local) throw new Error(`Invalid AI Studio configuration in ${dataDir}`);
 
@@ -1128,10 +1368,11 @@ async function launchStudio(options) {
     assertStudioExited(dataDir, platform);
     protectPackage(dataDir, platform);
 
-    // Clean environment: no arbitrary host AISTUDIO_* or WAA_* vars
+    // Clean environment: no host AISTUDIO_* or WAA_* vars, nor any of upstream's settings, which
+    // would hide the ones saved in .env
     const cleanEnv = {};
     for (const [k, v] of Object.entries(process.env)) {
-      if (!k.startsWith('AISTUDIO_') && !k.startsWith('WAA_')) {
+      if (!k.startsWith('AISTUDIO_') && !k.startsWith('WAA_') && !ENV_KEYS.includes(k.toUpperCase())) {
         cleanEnv[k] = v;
       }
     }
@@ -1161,6 +1402,7 @@ async function launchStudio(options) {
       });
       if (child.pid) {
         fs.writeFileSync(path.join(dataDir, 'backend.pid'), `${child.pid}\n`, { mode: 0o600 });
+        writeLaunchRecord(dataDir, child.pid, options.proxy);
       }
       child.unref?.();
     } finally {

package/lib/studio-release.json

@@ -1,38 +1,38 @@
 {
-  "version": "0.2.13-magpie.1",
+  "version": "0.2.14-magpie.1",
   "repository": "BUKOWSKIREAL/magpie-gemini-web",
-  "tag": "studio-v0.2.13-magpie.1",
+  "tag": "studio-v0.2.14-magpie.1",
   "goVersion": "1.27.1",
   "upstream": {
-    "version": "0.2.13",
+    "version": "0.2.14",
     "repository": "https://github.com/Mag1cFall/AIStudio2API.git",
-    "commit": "a784c5193b3ba5c4894d536b2f4cd73e87f99475"
+    "commit": "370a313814099b508881807effa2a9d72f2d7e66"
   },
   "binaries": {
     "darwin-arm64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-darwin-arm64.tar.gz",
-      "sha256": "3145f1fc3e88dafc1c43ecfa4ed7c6f82d1126a2d8add02605d05f1c5c404144",
-      "binarySha256": "7d727bf1cc5a86d9c1a2a99d73d645f38a0597489ef62e2bf20b0d33dd87369d"
+      "asset": "aistudio2api-v0.2.14-magpie.1-darwin-arm64.tar.gz",
+      "sha256": "f649c21837741bdb448407f79a3bc998429b446408ef3117a897103b9a47ee72",
+      "binarySha256": "999e49572dede3a63f538e3f62ceed5f03349459bdf391fd49fd57784985e13b"
     },
     "darwin-x64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-darwin-amd64.tar.gz",
-      "sha256": "96994351570105a6de4e1c95800231ad20d762ee010cfa238bfef11101124c27",
-      "binarySha256": "428963b5bd3c9c35b88c7a7f29923c5a5a6bef5d0fcd511274daa8a8ebc9f686"
+      "asset": "aistudio2api-v0.2.14-magpie.1-darwin-amd64.tar.gz",
+      "sha256": "ece680b5dfef57b0b0e96d639b618b74570e6e194f58808d762da85fd41d9b4a",
+      "binarySha256": "970df3ac51719721d908162d0233d80711f6c3ee007e193d0a73b6e4e596ca9a"
     },
     "linux-x64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-linux-amd64.tar.gz",
-      "sha256": "9e24fb139abb0bcd8f6cbab23ac1875136f3ecacd30919fbcc25fe342feb369c",
-      "binarySha256": "de8c25f07870d83dd2ebc03b9be1f6e15b4f93f454dfe8f5c4182c72261bcbfa"
+      "asset": "aistudio2api-v0.2.14-magpie.1-linux-amd64.tar.gz",
+      "sha256": "f6c7b52a739e4534236f055280fcddd48e64b56fdb954a7844eb453226d5b67f",
+      "binarySha256": "316306225bcc343188d6d81635d4bd79e7e82bd5c51b1009cd25361deb3b5e61"
     },
     "linux-arm64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-linux-arm64.tar.gz",
-      "sha256": "7b7057abd8e298685f4ca835e014a48c9b1904a253ebfbc053e4b1d7712c532c",
-      "binarySha256": "151fd830cf0da8801d49e448021d73cde0adb51e982b3a8604cdcbc5babd21c4"
+      "asset": "aistudio2api-v0.2.14-magpie.1-linux-arm64.tar.gz",
+      "sha256": "a5b838b9b64e78d402372cae6b88e1f3faba406747e598e976728c71da3a75ef",
+      "binarySha256": "a5e9573b9edad7fb246178fb4c3d21a0d4905789fd59abf96656d57f26b7526e"
     },
     "win32-x64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-windows-amd64.zip",
-      "sha256": "aa337556362ce9c16cae71117a9c12e20b623b12665dd5f36cf01bf152d72fbb",
-      "binarySha256": "4a0c32be722dcc27c9046fe410d6af7efd576c4192cb1158c84468cada4fbd30"
+      "asset": "aistudio2api-v0.2.14-magpie.1-windows-amd64.zip",
+      "sha256": "ccd5b96dabebbc0f1d510959c698beb9d9af09bb65d8b0e021327970b3173384",
+      "binarySha256": "ce784c98f1558395a670421ef6cc7d36dde5313f74788f7df5772851c241ae06"
     }
   }
 }