mslxdff 0.1.203 → 0.1.207

package/src/cli/commands/model.js

@@ -1,51 +1,51 @@
-import { join } from "node:path";
-import { createModelsService } from "../../models.js";
-import { createUpstreamClient } from "../../upstream.js";
-import { logDir } from "../../logs.js";
-import { handleModelStatus } from "./model/status.js";
-import { handleModelStats } from "./model/stats.js";
-import { handlePicksCommand } from "./model/picks.js";
-import { handleModelList } from "./model/list.js";
-
-/**
- * `-model` 门面 — 仅分发：refresh 直连，status/stats/picks/list 下沉子模块。
- * 对外接缝 `handleModel(args)` 不变（src/cli/index.js 动态 import）。
- */
-export async function handleModel(args) {
-  if (!(args.includes("-model") || args.includes("-models"))) return false;
-  const idx = args.findIndex((x) => x === "-model" || x === "-models");
-  const sub = args[idx + 1];
-  if (sub === "refresh") {
-    const models = createModelsService({
-      baseUrl: process.env.UPSTREAM_BASE_URL || "https://opencode.ai",
-      headers: createUpstreamClient({}).headers,
-      refreshMs: 0,
-      cacheFile: join(logDir(), "models.json"),
-    });
-    try {
-      const list = await models.get();
-      const ids = (list.data || []).map((m) => m.id).filter(Boolean);
-      console.log(`refreshed: ${ids.length} free model(s)`);
-      for (const id of ids) console.log(`  ${id}`);
-    } catch (err) {
-      console.error(`could not refresh models: ${String(err?.message || err)}`);
-      process.exit(1);
-    }
-    process.exit(0);
-  }
-  if (sub === "status") {
-    await handleModelStatus(args);
-    return true;
-  }
-  if (sub === "stats") {
-    await handleModelStats(args);
-    return true;
-  }
-  if (await handlePicksCommand(args, idx, sub)) return true;
-  if (sub !== undefined && sub !== "list") {
-    console.error("usage: mslxdff -models (interactive multi-pick) | mslxdff -model list [--provider <id>] [--json] | mslxdff -model set <id> | mslxdff -model pick <id> | mslxdff -model unpick <id> | mslxdff -model pick clear | mslxdff -model picks | mslxdff -model status [--all] | mslxdff -model stats [--all] | mslxdff -model refresh");
-    process.exit(1);
-  }
-  await handleModelList(args, idx, sub);
-  return true;
-}
+import { join } from "node:path";
+import { createModelsService } from "../../models.js";
+import { createUpstreamClient } from "../../upstream.js";
+import { logDir } from "../../logs.js";
+import { handleModelStatus } from "./model/status.js";
+import { handleModelStats } from "./model/stats.js";
+import { handlePicksCommand } from "./model/picks.js";
+import { handleModelList } from "./model/list.js";
+
+/**
+ * `-model` 门面 — 仅分发：refresh 直连，status/stats/picks/list 下沉子模块。
+ * 对外接缝 `handleModel(args)` 不变（src/cli/index.js 动态 import）。
+ */
+export async function handleModel(args) {
+  if (!(args.includes("-model") || args.includes("-models"))) return false;
+  const idx = args.findIndex((x) => x === "-model" || x === "-models");
+  const sub = args[idx + 1];
+  if (sub === "refresh") {
+    const models = createModelsService({
+      baseUrl: process.env.UPSTREAM_BASE_URL || "https://opencode.ai",
+      headers: createUpstreamClient({}).headers,
+      refreshMs: 0,
+      cacheFile: join(logDir(), "models.json"),
+    });
+    try {
+      const list = await models.get();
+      const ids = (list.data || []).map((m) => m.id).filter(Boolean);
+      console.log(`refreshed: ${ids.length} free model(s)`);
+      for (const id of ids) console.log(`  ${id}`);
+    } catch (err) {
+      console.error(`could not refresh models: ${String(err?.message || err)}`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+  if (sub === "status") {
+    await handleModelStatus(args);
+    return true;
+  }
+  if (sub === "stats") {
+    await handleModelStats(args);
+    return true;
+  }
+  if (await handlePicksCommand(args, idx, sub)) return true;
+  if (sub !== undefined && sub !== "list") {
+    console.error("usage: mslxdff -models (interactive multi-pick) | mslxdff -model list [--provider <id>] [--json] | mslxdff -model set <id> | mslxdff -model pick <id> | mslxdff -model unpick <id> | mslxdff -model pick clear | mslxdff -model picks | mslxdff -model status [--all] | mslxdff -model stats [--all] | mslxdff -model refresh");
+    process.exit(1);
+  }
+  await handleModelList(args, idx, sub);
+  return true;
+}

package/src/cli/commands/provider/add.js

@@ -1,108 +1,108 @@
-import { join } from "node:path";
-
-export async function handleProviderAdd(id, sub, rest) {
-  if (id !== "add") return false;
-  const gid = sub;
-  const gBase = rest[1];
-  const gKey = rest[2];
-  if (!gid || !gBase || !gKey) {
-    console.error("usage: mslxdff -provider add <id> <baseUrl> <key> [allowedModel...] [--models-path <path>] [--chat-path <path>]");
-    console.error("       e.g. mslxdff -provider add myapi https://api.example.com/v1 sk-xxx");
-    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx gpt-4 gpt-3.5");
-    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx --models-path /v1/models --chat-path /v1/chat/completions");
-    process.exit(1);
-  }
-  if (gid === "opencode" || gid === "oc" || gid === "openrouter") {
-    console.error(`provider "${gid}" is built-in — use: mslxdff -provider ${gid} add <key>  or  mslxdff -provider ${gid} set-url <url>`);
-    process.exit(1);
-  }
-  const { saveProviderConfig, loadProviderConfig } = await import("../../../state.js");
-  const { normalizeProviderId } = await import("../../../providers/model-id.js");
-  const nid = normalizeProviderId(gid);
-  if (!nid) { console.error(`invalid provider id: ${gid}`); process.exit(1); }
-  if (!/^https?:\/\/.+/.test(String(gBase).trim())) { console.error(`invalid baseUrl: ${gBase} (must start with http:// or https://)`); process.exit(1); }
-  const cur = loadProviderConfig(nid) || { baseUrl: "", keys: [], allowedModels: [], auths: [], modelsPath: "", chatPath: "" };
-  let keys, auths, baseUrl;
-  baseUrl = String(gBase).trim();
-  let parsedModelsPath = null;
-  let parsedChatPath = null;
-  const extraTokens = [];
-  for (let _i = 3; _i < rest.length; _i++) {
-    const tok = String(rest[_i] || "");
-    if (tok === "--models-path" || tok === "--modelsPath" || tok === "--models_path") { parsedModelsPath = String(rest[_i + 1] || "").trim() || null; _i++; }
-    else if (tok.startsWith("--models-path=")) { parsedModelsPath = tok.slice("--models-path=".length).trim() || null; }
-    else if (tok === "--chat-path" || tok === "--chatPath" || tok === "--chat_path") { parsedChatPath = String(rest[_i + 1] || "").trim() || null; _i++; }
-    else if (tok.startsWith("--chat-path=")) { parsedChatPath = tok.slice("--chat-path=".length).trim() || null; }
-    else extraTokens.push(tok);
-  }
-  if (parsedModelsPath && !String(parsedModelsPath).startsWith("/")) { console.error(`invalid --models-path: ${parsedModelsPath} (must start with /)`); process.exit(1); }
-  if (parsedChatPath && !String(parsedChatPath).startsWith("/")) { console.error(`invalid --chat-path: ${parsedChatPath} (must start with /)`); process.exit(1); }
-  const extraModels = extraTokens.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
-  const allowedModels = extraModels.length ? [...new Set([...(cur.allowedModels || []), ...extraModels])] : (cur.allowedModels || []);
-  if (nid === "workbuddy") {
-    const token = String(gKey).trim();
-    let uid = "";
-    try { const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString()); uid = payload.uid || payload.sub || payload.userId || payload.user_id || ""; } catch {}
-    if (!uid) uid = "manual-" + token.slice(-8);
-    const curKeys = Array.isArray(cur.keys) ? [...cur.keys] : [];
-    const curAuths = Array.isArray(cur.auths) ? [...cur.auths] : [];
-    let idx2 = curAuths.findIndex(a => a.uid === uid);
-    if (idx2 < 0) idx2 = curKeys.findIndex(k => k === token);
-    let newKeys, newAuths;
-    if (idx2 >= 0) {
-      newKeys = [...curKeys]; newKeys[idx2] = token;
-      newAuths = [...curAuths]; newAuths[idx2] = { uid, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" };
-      while (newAuths.length < newKeys.length) newAuths.push({ uid: `manual-${newKeys[newAuths.length].slice(-8)}`, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" });
-    } else {
-      newKeys = [...new Set([...curKeys, token].filter(Boolean))];
-      newAuths = [...curAuths, { uid, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" }];
-      while (newAuths.length < newKeys.length) newAuths.push({ uid: `manual-${newKeys[newAuths.length].slice(-8)}`, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" });
-      while (newKeys.length < newAuths.length) newKeys.push(token);
-    }
-    keys = newKeys; auths = newAuths;
-    const cfgToSave = { baseUrl, keys, auths, allowedModels };
-    if (parsedModelsPath) cfgToSave.modelsPath = parsedModelsPath;
-    else if (cur.modelsPath) cfgToSave.modelsPath = cur.modelsPath;
-    if (parsedChatPath) cfgToSave.chatPath = parsedChatPath;
-    else if (cur.chatPath) cfgToSave.chatPath = cur.chatPath;
-    saveProviderConfig(nid, cfgToSave);
-    try {
-      const { writeFileSync, mkdirSync } = await import("node:fs");
-      const { join } = await import("node:path");
-      const { resolveAuthDir } = await import("../../providers/workbuddy/account-store.js");
-      const dir = resolveAuthDir();
-      mkdirSync(dir, { recursive: true });
-      const fp = join(dir, `workbuddy-${uid}.json`);
-      const doc = { account: { uid, enterpriseId: "", nickname: "" }, auth: { accessToken: token, refreshToken: "", expiresAt: Math.floor(Date.now()/1000)+3600, domain: "www.codebuddy.cn" } };
-      writeFileSync(fp + ".tmp", JSON.stringify(doc, null, 2), { mode: 0o600 });
-      try { const { renameSync, unlinkSync, existsSync } = await import("node:fs"); if (existsSync(fp)) unlinkSync(fp); renameSync(fp + ".tmp", fp); } catch { writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 }); }
-    } catch {}
-  } else {
-    const trimmed = String(gKey).trim();
-    const already = (cur.keys || []).some((k) => String(k).trim() === trimmed);
-    if (already) {
-      console.log(`key already exists for ${nid} (${trimmed.slice(0, 4)}…${trimmed.slice(-4)}), skipped — still ${cur.keys.length} key(s)`);
-      console.log(`  use: mslxdff -provider ${nid} list  to see keys`);
-      process.exit(0);
-    }
-    keys = [...new Set([...(cur.keys || []), trimmed].filter(Boolean))];
-    auths = undefined;
-    const cfgToSave2 = { baseUrl, keys, allowedModels };
-    if (parsedModelsPath) cfgToSave2.modelsPath = parsedModelsPath;
-    else if (cur.modelsPath) cfgToSave2.modelsPath = cur.modelsPath;
-    if (parsedChatPath) cfgToSave2.chatPath = parsedChatPath;
-    else if (cur.chatPath) cfgToSave2.chatPath = cur.chatPath;
-    saveProviderConfig(nid, cfgToSave2);
-  }
-  console.log(`added generic provider: ${nid}`);
-  console.log(`  baseUrl: ${String(gBase).trim().replace(/\/+$/, "")}`);
-  console.log(`  keys: ${keys.length} (${keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")})`);
-  if (allowedModels.length) console.log(`  allowedModels: ${allowedModels.length} (${allowedModels.join(", ")})`);
-  else console.log(`  allowedModels: (none — BLOCKED, otherwise unusable)  → mslxdff -provider ${nid} allowlist set <model...>  OR  mslxdff -provider ${nid} allowAny on (allow all)`);
-  console.log(`  share: 借出（默认，key 随转发自动附带，ADR-0019）`);
-  console.log(`  allowAny: OFF (secure, empty allowlist = 403 block before upstream) — enable via: mslxdff -provider ${nid} allowAny on`);
-  console.log(`  use as: ${nid}/<model-id>  — restart daemon to activate`);
-  if (allowedModels.length) console.log(`  opencode 中使用: mslxdff -setto opencode ${nid}/${allowedModels[0]}  (同步进 opencode.json，会一并设为默认模型)`);
-  console.log(`  NOTE: empty allowlist = 403 before upstream, no cost — must set allowlist to use`);
-  process.exit(0);
-}
+import { join } from "node:path";
+
+export async function handleProviderAdd(id, sub, rest) {
+  if (id !== "add") return false;
+  const gid = sub;
+  const gBase = rest[1];
+  const gKey = rest[2];
+  if (!gid || !gBase || !gKey) {
+    console.error("usage: mslxdff -provider add <id> <baseUrl> <key> [allowedModel...] [--models-path <path>] [--chat-path <path>]");
+    console.error("       e.g. mslxdff -provider add myapi https://api.example.com/v1 sk-xxx");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx gpt-4 gpt-3.5");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx --models-path /v1/models --chat-path /v1/chat/completions");
+    process.exit(1);
+  }
+  if (gid === "opencode" || gid === "oc" || gid === "openrouter") {
+    console.error(`provider "${gid}" is built-in — use: mslxdff -provider ${gid} add <key>  or  mslxdff -provider ${gid} set-url <url>`);
+    process.exit(1);
+  }
+  const { saveProviderConfig, loadProviderConfig } = await import("../../../state.js");
+  const { normalizeProviderId } = await import("../../../providers/model-id.js");
+  const nid = normalizeProviderId(gid);
+  if (!nid) { console.error(`invalid provider id: ${gid}`); process.exit(1); }
+  if (!/^https?:\/\/.+/.test(String(gBase).trim())) { console.error(`invalid baseUrl: ${gBase} (must start with http:// or https://)`); process.exit(1); }
+  const cur = loadProviderConfig(nid) || { baseUrl: "", keys: [], allowedModels: [], auths: [], modelsPath: "", chatPath: "" };
+  let keys, auths, baseUrl;
+  baseUrl = String(gBase).trim();
+  let parsedModelsPath = null;
+  let parsedChatPath = null;
+  const extraTokens = [];
+  for (let _i = 3; _i < rest.length; _i++) {
+    const tok = String(rest[_i] || "");
+    if (tok === "--models-path" || tok === "--modelsPath" || tok === "--models_path") { parsedModelsPath = String(rest[_i + 1] || "").trim() || null; _i++; }
+    else if (tok.startsWith("--models-path=")) { parsedModelsPath = tok.slice("--models-path=".length).trim() || null; }
+    else if (tok === "--chat-path" || tok === "--chatPath" || tok === "--chat_path") { parsedChatPath = String(rest[_i + 1] || "").trim() || null; _i++; }
+    else if (tok.startsWith("--chat-path=")) { parsedChatPath = tok.slice("--chat-path=".length).trim() || null; }
+    else extraTokens.push(tok);
+  }
+  if (parsedModelsPath && !String(parsedModelsPath).startsWith("/")) { console.error(`invalid --models-path: ${parsedModelsPath} (must start with /)`); process.exit(1); }
+  if (parsedChatPath && !String(parsedChatPath).startsWith("/")) { console.error(`invalid --chat-path: ${parsedChatPath} (must start with /)`); process.exit(1); }
+  const extraModels = extraTokens.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+  const allowedModels = extraModels.length ? [...new Set([...(cur.allowedModels || []), ...extraModels])] : (cur.allowedModels || []);
+  if (nid === "workbuddy") {
+    const token = String(gKey).trim();
+    let uid = "";
+    try { const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString()); uid = payload.uid || payload.sub || payload.userId || payload.user_id || ""; } catch {}
+    if (!uid) uid = "manual-" + token.slice(-8);
+    const curKeys = Array.isArray(cur.keys) ? [...cur.keys] : [];
+    const curAuths = Array.isArray(cur.auths) ? [...cur.auths] : [];
+    let idx2 = curAuths.findIndex(a => a.uid === uid);
+    if (idx2 < 0) idx2 = curKeys.findIndex(k => k === token);
+    let newKeys, newAuths;
+    if (idx2 >= 0) {
+      newKeys = [...curKeys]; newKeys[idx2] = token;
+      newAuths = [...curAuths]; newAuths[idx2] = { uid, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" };
+      while (newAuths.length < newKeys.length) newAuths.push({ uid: `manual-${newKeys[newAuths.length].slice(-8)}`, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" });
+    } else {
+      newKeys = [...new Set([...curKeys, token].filter(Boolean))];
+      newAuths = [...curAuths, { uid, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" }];
+      while (newAuths.length < newKeys.length) newAuths.push({ uid: `manual-${newKeys[newAuths.length].slice(-8)}`, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" });
+      while (newKeys.length < newAuths.length) newKeys.push(token);
+    }
+    keys = newKeys; auths = newAuths;
+    const cfgToSave = { baseUrl, keys, auths, allowedModels };
+    if (parsedModelsPath) cfgToSave.modelsPath = parsedModelsPath;
+    else if (cur.modelsPath) cfgToSave.modelsPath = cur.modelsPath;
+    if (parsedChatPath) cfgToSave.chatPath = parsedChatPath;
+    else if (cur.chatPath) cfgToSave.chatPath = cur.chatPath;
+    saveProviderConfig(nid, cfgToSave);
+    try {
+      const { writeFileSync, mkdirSync } = await import("node:fs");
+      const { join } = await import("node:path");
+      const { resolveAuthDir } = await import("../../providers/workbuddy/account-store.js");
+      const dir = resolveAuthDir();
+      mkdirSync(dir, { recursive: true });
+      const fp = join(dir, `workbuddy-${uid}.json`);
+      const doc = { account: { uid, enterpriseId: "", nickname: "" }, auth: { accessToken: token, refreshToken: "", expiresAt: Math.floor(Date.now()/1000)+3600, domain: "www.codebuddy.cn" } };
+      writeFileSync(fp + ".tmp", JSON.stringify(doc, null, 2), { mode: 0o600 });
+      try { const { renameSync, unlinkSync, existsSync } = await import("node:fs"); if (existsSync(fp)) unlinkSync(fp); renameSync(fp + ".tmp", fp); } catch { writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 }); }
+    } catch {}
+  } else {
+    const trimmed = String(gKey).trim();
+    const already = (cur.keys || []).some((k) => String(k).trim() === trimmed);
+    if (already) {
+      console.log(`key already exists for ${nid} (${trimmed.slice(0, 4)}…${trimmed.slice(-4)}), skipped — still ${cur.keys.length} key(s)`);
+      console.log(`  use: mslxdff -provider ${nid} list  to see keys`);
+      process.exit(0);
+    }
+    keys = [...new Set([...(cur.keys || []), trimmed].filter(Boolean))];
+    auths = undefined;
+    const cfgToSave2 = { baseUrl, keys, allowedModels };
+    if (parsedModelsPath) cfgToSave2.modelsPath = parsedModelsPath;
+    else if (cur.modelsPath) cfgToSave2.modelsPath = cur.modelsPath;
+    if (parsedChatPath) cfgToSave2.chatPath = parsedChatPath;
+    else if (cur.chatPath) cfgToSave2.chatPath = cur.chatPath;
+    saveProviderConfig(nid, cfgToSave2);
+  }
+  console.log(`added generic provider: ${nid}`);
+  console.log(`  baseUrl: ${String(gBase).trim().replace(/\/+$/, "")}`);
+  console.log(`  keys: ${keys.length} (${keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")})`);
+  if (allowedModels.length) console.log(`  allowedModels: ${allowedModels.length} (${allowedModels.join(", ")})`);
+  else console.log(`  allowedModels: (none — BLOCKED, otherwise unusable)  → mslxdff -provider ${nid} allowlist set <model...>  OR  mslxdff -provider ${nid} allowAny on (allow all)`);
+  console.log(`  share: 借出（默认，key 随转发自动附带，ADR-0019）`);
+  console.log(`  allowAny: OFF (secure, empty allowlist = 403 block before upstream) — enable via: mslxdff -provider ${nid} allowAny on`);
+  console.log(`  use as: ${nid}/<model-id>  — restart daemon to activate`);
+  if (allowedModels.length) console.log(`  opencode 中使用: mslxdff -setto opencode ${nid}/${allowedModels[0]}  (同步进 opencode.json，会一并设为默认模型)`);
+  console.log(`  NOTE: empty allowlist = 403 before upstream, no cost — must set allowlist to use`);
+  process.exit(0);
+}

package/src/cli/commands/provider/allowlist.js

@@ -1,99 +1,99 @@
-export async function handleProviderAllowlist(id, sub, rest) {
-  if (sub === "allowAny" || sub === "allow-any" || sub === "allow_any" || sub === "allowany") {
-    const { loadProviderAllowAnyModels, saveProviderAllowAnyModels } = await import("../../../state.js");
-    const on = rest[1];
-    if (!on) {
-      const cur = loadProviderAllowAnyModels(id);
-      console.log(`allowAnyModels: ${cur ? "ON (allow all when allowlist empty)" : "OFF (empty allowlist = block all)"}`);
-      console.log(`  set: mslxdff -provider ${id} allowAny on|off`);
-      process.exit(0);
-    }
-    if (!["on", "off", "1", "0", "true", "false"].includes(String(on).toLowerCase())) {
-      console.error(`usage: mslxdff -provider ${id} allowAny on|off`);
-      process.exit(1);
-    }
-    const state = ["on", "1", "true"].includes(String(on).toLowerCase());
-    saveProviderAllowAnyModels(id, state);
-    console.log(`allowAnyModels: ${state ? "ON (empty allowlist = allow all)" : "OFF (empty allowlist = block all)"} — takes effect immediately (hot-reloaded)`);
-    process.exit(0);
-  }
-  if (sub === "allowlist" || sub === "allow" || sub === "allowed" || sub === "whitelist") {
-    const { loadProviderAllowedModels, saveProviderAllowedModels, loadProviderConfig, loadProviderAllowAnyModels } = await import("../../../state.js");
-    const action = rest[1];
-    const rawTargets = rest.slice(2);
-    if (!action || action === "list" || action === "status") {
-      const list = loadProviderAllowedModels(id);
-      const cfg = loadProviderConfig(id);
-      const baseUrl = cfg?.baseUrl || "";
-      const allowAny = loadProviderAllowAnyModels(id);
-      console.log(`provider: ${id}${baseUrl ? `  baseUrl: ${baseUrl}` : ""}`);
-      if (!list.length) {
-        if (allowAny) {
-          console.log(`  allowedModels: (none — allow all, because allowAny=ON)`);
-          console.log(`  to secure: mslxdff -provider ${id} allowAny off  or  mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
-        } else {
-          console.log(`  allowedModels: (none — BLOCK ALL, provider disabled until allowlist set or allowAny ON)`);
-          console.log(`  set via: mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
-          console.log(`  or:      mslxdff -provider ${id} allowAny on   (allow all when allowlist empty)`);
-        }
-      } else {
-        console.log(`  allowedModels: ${list.length} model${list.length > 1 ? "s" : ""} (only these can be used)`);
-        list.forEach((m, i) => console.log(`  [${i + 1}]  ${m}`));
-        console.log(`  manage: mslxdff -provider ${id} allowlist add <model> | remove <model> | set <m1> <m2> ... | clear`);
-        console.log(`  allowAny: ${allowAny ? "ON" : "OFF"} (empty list behavior) — mslxdff -provider ${id} allowAny on|off`);
-      }
-      console.log(`  NOTE: empty allowlist + allowAny OFF = 403 block (hot-reloaded, no restart needed)`);
-      process.exit(0);
-    }
-    if (action === "clear") {
-      saveProviderAllowedModels(id, []);
-      const allowAny = loadProviderAllowAnyModels(id);
-      console.log(`cleared ${id} allowlist (now ${allowAny ? "allow all (allowAny ON)" : "BLOCK ALL (allowAny OFF)"}) — takes effect immediately (hot-reloaded)`);
-      process.exit(0);
-    }
-    if (action === "set") {
-      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
-      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
-      if (!flat.length) {
-        console.error(`usage: mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
-        process.exit(1);
-      }
-      const saved = saveProviderAllowedModels(id, flat);
-      console.log(`set ${id} allowlist: ${saved.length} model${saved.length > 1 ? "s" : ""} (${saved.join(", ")}) — takes effect immediately (hot-reloaded)`);
-      process.exit(0);
-    }
-    if (action === "add") {
-      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
-      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
-      if (!flat.length) {
-        console.error(`usage: mslxdff -provider ${id} allowlist add <model> [model2 ...]`);
-        process.exit(1);
-      }
-      const cur = loadProviderAllowedModels(id);
-      const next = [...new Set([...cur, ...flat])];
-      saveProviderAllowedModels(id, next);
-      console.log(`added ${flat.length} model${flat.length > 1 ? "s" : ""} to ${id} allowlist (now ${next.length}: ${next.join(", ")}) — takes effect immediately (hot-reloaded)`);
-      process.exit(0);
-    }
-    if (action === "remove" || action === "rm" || action === "del") {
-      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
-      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
-      if (!flat.length) {
-        console.error(`usage: mslxdff -provider ${id} allowlist remove <model> [model2 ...]`);
-        process.exit(1);
-      }
-      const cur = loadProviderAllowedModels(id);
-      const set = new Set(flat);
-      const next = cur.filter((m) => !set.has(m));
-      saveProviderAllowedModels(id, next);
-      const { loadProviderAllowAnyModels: _la } = await import("../../../state.js");
-      const _allowAny = _la(id);
-      console.log(`removed ${cur.length - next.length} model${cur.length - next.length !== 1 ? "s" : ""} from ${id} allowlist (now ${next.length ? next.join(", ") : (_allowAny ? "(allow all)" : "(BLOCK ALL)")}) — takes effect immediately (hot-reloaded)`);
-      process.exit(0);
-    }
-    console.error(`usage: mslxdff -provider ${id} allowlist [list|set|add|remove|clear] [models...]`);
-    console.error(`       mslxdff -provider ${id} allowAny on|off   (empty allowlist = block or allow all)`);
-    process.exit(1);
-  }
-  return false;
-}
+export async function handleProviderAllowlist(id, sub, rest) {
+  if (sub === "allowAny" || sub === "allow-any" || sub === "allow_any" || sub === "allowany") {
+    const { loadProviderAllowAnyModels, saveProviderAllowAnyModels } = await import("../../../state.js");
+    const on = rest[1];
+    if (!on) {
+      const cur = loadProviderAllowAnyModels(id);
+      console.log(`allowAnyModels: ${cur ? "ON (allow all when allowlist empty)" : "OFF (empty allowlist = block all)"}`);
+      console.log(`  set: mslxdff -provider ${id} allowAny on|off`);
+      process.exit(0);
+    }
+    if (!["on", "off", "1", "0", "true", "false"].includes(String(on).toLowerCase())) {
+      console.error(`usage: mslxdff -provider ${id} allowAny on|off`);
+      process.exit(1);
+    }
+    const state = ["on", "1", "true"].includes(String(on).toLowerCase());
+    saveProviderAllowAnyModels(id, state);
+    console.log(`allowAnyModels: ${state ? "ON (empty allowlist = allow all)" : "OFF (empty allowlist = block all)"} — takes effect immediately (hot-reloaded)`);
+    process.exit(0);
+  }
+  if (sub === "allowlist" || sub === "allow" || sub === "allowed" || sub === "whitelist") {
+    const { loadProviderAllowedModels, saveProviderAllowedModels, loadProviderConfig, loadProviderAllowAnyModels } = await import("../../../state.js");
+    const action = rest[1];
+    const rawTargets = rest.slice(2);
+    if (!action || action === "list" || action === "status") {
+      const list = loadProviderAllowedModels(id);
+      const cfg = loadProviderConfig(id);
+      const baseUrl = cfg?.baseUrl || "";
+      const allowAny = loadProviderAllowAnyModels(id);
+      console.log(`provider: ${id}${baseUrl ? `  baseUrl: ${baseUrl}` : ""}`);
+      if (!list.length) {
+        if (allowAny) {
+          console.log(`  allowedModels: (none — allow all, because allowAny=ON)`);
+          console.log(`  to secure: mslxdff -provider ${id} allowAny off  or  mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
+        } else {
+          console.log(`  allowedModels: (none — BLOCK ALL, provider disabled until allowlist set or allowAny ON)`);
+          console.log(`  set via: mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
+          console.log(`  or:      mslxdff -provider ${id} allowAny on   (allow all when allowlist empty)`);
+        }
+      } else {
+        console.log(`  allowedModels: ${list.length} model${list.length > 1 ? "s" : ""} (only these can be used)`);
+        list.forEach((m, i) => console.log(`  [${i + 1}]  ${m}`));
+        console.log(`  manage: mslxdff -provider ${id} allowlist add <model> | remove <model> | set <m1> <m2> ... | clear`);
+        console.log(`  allowAny: ${allowAny ? "ON" : "OFF"} (empty list behavior) — mslxdff -provider ${id} allowAny on|off`);
+      }
+      console.log(`  NOTE: empty allowlist + allowAny OFF = 403 block (hot-reloaded, no restart needed)`);
+      process.exit(0);
+    }
+    if (action === "clear") {
+      saveProviderAllowedModels(id, []);
+      const allowAny = loadProviderAllowAnyModels(id);
+      console.log(`cleared ${id} allowlist (now ${allowAny ? "allow all (allowAny ON)" : "BLOCK ALL (allowAny OFF)"}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    if (action === "set") {
+      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
+      if (!flat.length) {
+        console.error(`usage: mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
+        process.exit(1);
+      }
+      const saved = saveProviderAllowedModels(id, flat);
+      console.log(`set ${id} allowlist: ${saved.length} model${saved.length > 1 ? "s" : ""} (${saved.join(", ")}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    if (action === "add") {
+      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
+      if (!flat.length) {
+        console.error(`usage: mslxdff -provider ${id} allowlist add <model> [model2 ...]`);
+        process.exit(1);
+      }
+      const cur = loadProviderAllowedModels(id);
+      const next = [...new Set([...cur, ...flat])];
+      saveProviderAllowedModels(id, next);
+      console.log(`added ${flat.length} model${flat.length > 1 ? "s" : ""} to ${id} allowlist (now ${next.length}: ${next.join(", ")}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    if (action === "remove" || action === "rm" || action === "del") {
+      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
+      if (!flat.length) {
+        console.error(`usage: mslxdff -provider ${id} allowlist remove <model> [model2 ...]`);
+        process.exit(1);
+      }
+      const cur = loadProviderAllowedModels(id);
+      const set = new Set(flat);
+      const next = cur.filter((m) => !set.has(m));
+      saveProviderAllowedModels(id, next);
+      const { loadProviderAllowAnyModels: _la } = await import("../../../state.js");
+      const _allowAny = _la(id);
+      console.log(`removed ${cur.length - next.length} model${cur.length - next.length !== 1 ? "s" : ""} from ${id} allowlist (now ${next.length ? next.join(", ") : (_allowAny ? "(allow all)" : "(BLOCK ALL)")}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    console.error(`usage: mslxdff -provider ${id} allowlist [list|set|add|remove|clear] [models...]`);
+    console.error(`       mslxdff -provider ${id} allowAny on|off   (empty allowlist = block or allow all)`);
+    process.exit(1);
+  }
+  return false;
+}