mslxdff 0.1.65 → 0.1.66

package/src/cli/commands/provider/add.js

@@ -0,0 +1,106 @@
+import { join } from "node:path";
+
+export async function handleProviderAdd(id, sub, rest) {
+  if (id !== "add") return false;
+  const gid = sub;
+  const gBase = rest[1];
+  const gKey = rest[2];
+  if (!gid || !gBase || !gKey) {
+    console.error("usage: mslxdff -provider add <id> <baseUrl> <key> [allowedModel...] [--models-path <path>] [--chat-path <path>]");
+    console.error("       e.g. mslxdff -provider add myapi https://api.example.com/v1 sk-xxx");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx gpt-4 gpt-3.5");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx --models-path /v1/models --chat-path /v1/chat/completions");
+    process.exit(1);
+  }
+  if (gid === "opencode" || gid === "oc" || gid === "openrouter") {
+    console.error(`provider "${gid}" is built-in — use: mslxdff -provider ${gid} add <key>  or  mslxdff -provider ${gid} set-url <url>`);
+    process.exit(1);
+  }
+  const { saveProviderConfig, loadProviderConfig, loadProviderShareKeys } = await import("../../../state.js");
+  const { normalizeProviderId } = await import("../../../providers/model-id.js");
+  const nid = normalizeProviderId(gid);
+  if (!nid) { console.error(`invalid provider id: ${gid}`); process.exit(1); }
+  if (!/^https?:\/\/.+/.test(String(gBase).trim())) { console.error(`invalid baseUrl: ${gBase} (must start with http:// or https://)`); process.exit(1); }
+  const cur = loadProviderConfig(nid) || { baseUrl: "", keys: [], allowedModels: [], auths: [], modelsPath: "", chatPath: "" };
+  let keys, auths, baseUrl;
+  baseUrl = String(gBase).trim();
+  let parsedModelsPath = null;
+  let parsedChatPath = null;
+  const extraTokens = [];
+  for (let _i = 3; _i < rest.length; _i++) {
+    const tok = String(rest[_i] || "");
+    if (tok === "--models-path" || tok === "--modelsPath" || tok === "--models_path") { parsedModelsPath = String(rest[_i + 1] || "").trim() || null; _i++; }
+    else if (tok.startsWith("--models-path=")) { parsedModelsPath = tok.slice("--models-path=".length).trim() || null; }
+    else if (tok === "--chat-path" || tok === "--chatPath" || tok === "--chat_path") { parsedChatPath = String(rest[_i + 1] || "").trim() || null; _i++; }
+    else if (tok.startsWith("--chat-path=")) { parsedChatPath = tok.slice("--chat-path=".length).trim() || null; }
+    else extraTokens.push(tok);
+  }
+  if (parsedModelsPath && !String(parsedModelsPath).startsWith("/")) { console.error(`invalid --models-path: ${parsedModelsPath} (must start with /)`); process.exit(1); }
+  if (parsedChatPath && !String(parsedChatPath).startsWith("/")) { console.error(`invalid --chat-path: ${parsedChatPath} (must start with /)`); process.exit(1); }
+  const extraModels = extraTokens.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+  const allowedModels = extraModels.length ? [...new Set([...(cur.allowedModels || []), ...extraModels])] : (cur.allowedModels || []);
+  if (nid === "workbuddy") {
+    const token = String(gKey).trim();
+    let uid = "";
+    try { const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString()); uid = payload.uid || payload.sub || payload.userId || payload.user_id || ""; } catch {}
+    if (!uid) uid = "manual-" + token.slice(-8);
+    const curKeys = Array.isArray(cur.keys) ? [...cur.keys] : [];
+    const curAuths = Array.isArray(cur.auths) ? [...cur.auths] : [];
+    let idx2 = curAuths.findIndex(a => a.uid === uid);
+    if (idx2 < 0) idx2 = curKeys.findIndex(k => k === token);
+    let newKeys, newAuths;
+    if (idx2 >= 0) {
+      newKeys = [...curKeys]; newKeys[idx2] = token;
+      newAuths = [...curAuths]; newAuths[idx2] = { uid, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" };
+      while (newAuths.length < newKeys.length) newAuths.push({ uid: `manual-${newKeys[newAuths.length].slice(-8)}`, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" });
+    } else {
+      newKeys = [...new Set([...curKeys, token].filter(Boolean))];
+      newAuths = [...curAuths, { uid, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" }];
+      while (newAuths.length < newKeys.length) newAuths.push({ uid: `manual-${newKeys[newAuths.length].slice(-8)}`, domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" });
+      while (newKeys.length < newAuths.length) newKeys.push(token);
+    }
+    keys = newKeys; auths = newAuths;
+    const cfgToSave = { baseUrl, keys, auths, allowedModels };
+    if (parsedModelsPath) cfgToSave.modelsPath = parsedModelsPath;
+    else if (cur.modelsPath) cfgToSave.modelsPath = cur.modelsPath;
+    if (parsedChatPath) cfgToSave.chatPath = parsedChatPath;
+    else if (cur.chatPath) cfgToSave.chatPath = cur.chatPath;
+    saveProviderConfig(nid, cfgToSave);
+    try {
+      const { writeFileSync, mkdirSync } = await import("node:fs");
+      const { join } = await import("node:path");
+      const dir = process.env.WORKBUDDY_AUTH_DIR || join(process.cwd(), "auths");
+      mkdirSync(dir, { recursive: true });
+      const fp = join(dir, `workbuddy-${uid}.json`);
+      const doc = { account: { uid, enterpriseId: "", nickname: "" }, auth: { accessToken: token, refreshToken: "", expiresAt: Math.floor(Date.now()/1000)+3600, domain: "www.codebuddy.cn" } };
+      writeFileSync(fp + ".tmp", JSON.stringify(doc, null, 2), { mode: 0o600 });
+      try { const { renameSync, unlinkSync, existsSync } = await import("node:fs"); if (existsSync(fp)) unlinkSync(fp); renameSync(fp + ".tmp", fp); } catch { writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 }); }
+    } catch {}
+  } else {
+    const trimmed = String(gKey).trim();
+    const already = (cur.keys || []).some((k) => String(k).trim() === trimmed);
+    if (already) {
+      console.log(`key already exists for ${nid} (${trimmed.slice(0, 4)}…${trimmed.slice(-4)}), skipped — still ${cur.keys.length} key(s)`);
+      console.log(`  use: mslxdff -provider ${nid} list  to see keys`);
+      process.exit(0);
+    }
+    keys = [...new Set([...(cur.keys || []), trimmed].filter(Boolean))];
+    auths = undefined;
+    const cfgToSave2 = { baseUrl, keys, allowedModels };
+    if (parsedModelsPath) cfgToSave2.modelsPath = parsedModelsPath;
+    else if (cur.modelsPath) cfgToSave2.modelsPath = cur.modelsPath;
+    if (parsedChatPath) cfgToSave2.chatPath = parsedChatPath;
+    else if (cur.chatPath) cfgToSave2.chatPath = cur.chatPath;
+    saveProviderConfig(nid, cfgToSave2);
+  }
+  console.log(`added generic provider: ${nid}`);
+  console.log(`  baseUrl: ${String(gBase).trim().replace(/\/+$/, "")}`);
+  console.log(`  keys: ${keys.length} (${keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")})`);
+  if (allowedModels.length) console.log(`  allowedModels: ${allowedModels.length} (${allowedModels.join(", ")})`);
+  else console.log(`  allowedModels: (none — BLOCKED, otherwise unusable)  → mslxdff -provider ${nid} allowlist set <model...>  OR  mslxdff -provider ${nid} allowAny on (allow all)`);
+  console.log(`  share: ${loadProviderShareKeys(nid) ? "ON" : "off"}   (mslxdff -provider ${nid} share on|off)`);
+  console.log(`  allowAny: OFF (secure, empty allowlist = 403 block before upstream) — enable via: mslxdff -provider ${nid} allowAny on`);
+  console.log(`  use as: ${nid}/<model-id>  — restart daemon to activate`);
+  console.log(`  NOTE: empty allowlist = 403 before upstream, no cost — must set allowlist to use`);
+  process.exit(0);
+}

package/src/cli/commands/provider/allowlist.js

@@ -0,0 +1,99 @@
+export async function handleProviderAllowlist(id, sub, rest) {
+  if (sub === "allowAny" || sub === "allow-any" || sub === "allow_any" || sub === "allowany") {
+    const { loadProviderAllowAnyModels, saveProviderAllowAnyModels } = await import("../../../state.js");
+    const on = rest[1];
+    if (!on) {
+      const cur = loadProviderAllowAnyModels(id);
+      console.log(`allowAnyModels: ${cur ? "ON (allow all when allowlist empty)" : "OFF (empty allowlist = block all)"}`);
+      console.log(`  set: mslxdff -provider ${id} allowAny on|off`);
+      process.exit(0);
+    }
+    if (!["on", "off", "1", "0", "true", "false"].includes(String(on).toLowerCase())) {
+      console.error(`usage: mslxdff -provider ${id} allowAny on|off`);
+      process.exit(1);
+    }
+    const state = ["on", "1", "true"].includes(String(on).toLowerCase());
+    saveProviderAllowAnyModels(id, state);
+    console.log(`allowAnyModels: ${state ? "ON (empty allowlist = allow all)" : "OFF (empty allowlist = block all)"} — takes effect immediately (hot-reloaded)`);
+    process.exit(0);
+  }
+  if (sub === "allowlist" || sub === "allow" || sub === "allowed" || sub === "whitelist") {
+    const { loadProviderAllowedModels, saveProviderAllowedModels, loadProviderConfig, loadProviderAllowAnyModels } = await import("../../../state.js");
+    const action = rest[1];
+    const rawTargets = rest.slice(2);
+    if (!action || action === "list" || action === "status") {
+      const list = loadProviderAllowedModels(id);
+      const cfg = loadProviderConfig(id);
+      const baseUrl = cfg?.baseUrl || "";
+      const allowAny = loadProviderAllowAnyModels(id);
+      console.log(`provider: ${id}${baseUrl ? `  baseUrl: ${baseUrl}` : ""}`);
+      if (!list.length) {
+        if (allowAny) {
+          console.log(`  allowedModels: (none — allow all, because allowAny=ON)`);
+          console.log(`  to secure: mslxdff -provider ${id} allowAny off  or  mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
+        } else {
+          console.log(`  allowedModels: (none — BLOCK ALL, provider disabled until allowlist set or allowAny ON)`);
+          console.log(`  set via: mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
+          console.log(`  or:      mslxdff -provider ${id} allowAny on   (allow all when allowlist empty)`);
+        }
+      } else {
+        console.log(`  allowedModels: ${list.length} model${list.length > 1 ? "s" : ""} (only these can be used)`);
+        list.forEach((m, i) => console.log(`  [${i + 1}]  ${m}`));
+        console.log(`  manage: mslxdff -provider ${id} allowlist add <model> | remove <model> | set <m1> <m2> ... | clear`);
+        console.log(`  allowAny: ${allowAny ? "ON" : "OFF"} (empty list behavior) — mslxdff -provider ${id} allowAny on|off`);
+      }
+      console.log(`  NOTE: empty allowlist + allowAny OFF = 403 block (hot-reloaded, no restart needed)`);
+      process.exit(0);
+    }
+    if (action === "clear") {
+      saveProviderAllowedModels(id, []);
+      const allowAny = loadProviderAllowAnyModels(id);
+      console.log(`cleared ${id} allowlist (now ${allowAny ? "allow all (allowAny ON)" : "BLOCK ALL (allowAny OFF)"}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    if (action === "set") {
+      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
+      if (!flat.length) {
+        console.error(`usage: mslxdff -provider ${id} allowlist set <model1> <model2> ...`);
+        process.exit(1);
+      }
+      const saved = saveProviderAllowedModels(id, flat);
+      console.log(`set ${id} allowlist: ${saved.length} model${saved.length > 1 ? "s" : ""} (${saved.join(", ")}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    if (action === "add") {
+      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
+      if (!flat.length) {
+        console.error(`usage: mslxdff -provider ${id} allowlist add <model> [model2 ...]`);
+        process.exit(1);
+      }
+      const cur = loadProviderAllowedModels(id);
+      const next = [...new Set([...cur, ...flat])];
+      saveProviderAllowedModels(id, next);
+      console.log(`added ${flat.length} model${flat.length > 1 ? "s" : ""} to ${id} allowlist (now ${next.length}: ${next.join(", ")}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    if (action === "remove" || action === "rm" || action === "del") {
+      const models = rawTargets.filter((x) => x && !String(x).startsWith("-")).map((m) => String(m).trim()).filter(Boolean);
+      const flat = models.flatMap((m) => String(m).split(",")).map((m) => m.trim()).filter(Boolean);
+      if (!flat.length) {
+        console.error(`usage: mslxdff -provider ${id} allowlist remove <model> [model2 ...]`);
+        process.exit(1);
+      }
+      const cur = loadProviderAllowedModels(id);
+      const set = new Set(flat);
+      const next = cur.filter((m) => !set.has(m));
+      saveProviderAllowedModels(id, next);
+      const { loadProviderAllowAnyModels: _la } = await import("../../../state.js");
+      const _allowAny = _la(id);
+      console.log(`removed ${cur.length - next.length} model${cur.length - next.length !== 1 ? "s" : ""} from ${id} allowlist (now ${next.length ? next.join(", ") : (_allowAny ? "(allow all)" : "(BLOCK ALL)")}) — takes effect immediately (hot-reloaded)`);
+      process.exit(0);
+    }
+    console.error(`usage: mslxdff -provider ${id} allowlist [list|set|add|remove|clear] [models...]`);
+    console.error(`       mslxdff -provider ${id} allowAny on|off   (empty allowlist = block or allow all)`);
+    process.exit(1);
+  }
+  return false;
+}

package/src/cli/commands/provider/config.js

@@ -0,0 +1,82 @@
+export async function handleProviderConfig(id, sub, rest) {
+  if (sub === "set-models-path" || sub === "setModelsPath" || sub === "models-path") {
+    const p = rest[1];
+    if (!p) {
+      console.error(`usage: mslxdff -provider ${id} set-models-path <path>  (e.g. /v1/models)`);
+      process.exit(1);
+    }
+    if (!String(p).trim().startsWith("/")) {
+      console.error(`invalid modelsPath: ${p} (must start with /)`);
+      process.exit(1);
+    }
+    const { loadProviderConfig, saveProviderConfig } = await import("../../../state.js");
+    const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+    const { normalizeProviderId } = await import("../../../providers/model-id.js");
+    const nid = normalizeProviderId(id);
+    saveProviderConfig(nid || id, { baseUrl: cur.baseUrl || "", keys: cur.keys || [], modelsPath: String(p).trim() });
+    console.log(`set ${nid || id} modelsPath: ${String(p).trim()} — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub === "set-chat-path" || sub === "setChatPath" || sub === "chat-path") {
+    const p = rest[1];
+    if (!p) {
+      console.error(`usage: mslxdff -provider ${id} set-chat-path <path>  (e.g. /v1/chat/completions)`);
+      process.exit(1);
+    }
+    if (!String(p).trim().startsWith("/")) {
+      console.error(`invalid chatPath: ${p} (must start with /)`);
+      process.exit(1);
+    }
+    const { loadProviderConfig, saveProviderConfig } = await import("../../../state.js");
+    const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+    const { normalizeProviderId } = await import("../../../providers/model-id.js");
+    const nid = normalizeProviderId(id);
+    saveProviderConfig(nid || id, { baseUrl: cur.baseUrl || "", keys: cur.keys || [], chatPath: String(p).trim() });
+    console.log(`set ${nid || id} chatPath: ${String(p).trim()} — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub === "clear") {
+    const { loadProviderConfigs, loadProviderConfig, saveProviderConfig, saveProviderKeys } = await import("../../../state.js");
+    const configs = loadProviderConfigs();
+    if (configs[id]) {
+      saveProviderConfig(id, { baseUrl: "", keys: [] });
+    } else {
+      saveProviderKeys(id, []);
+    }
+    console.log(`cleared ${id} API keys (provider disabled on next daemon start)`);
+    process.exit(0);
+  }
+  if (sub === "set-url" || sub === "setUrl" || sub === "url") {
+    const url = rest[1];
+    if (!url) {
+      console.error(`usage: mslxdff -provider ${id} set-url <baseUrl>`);
+      process.exit(1);
+    }
+    if (!/^https?:\/\/.+/.test(String(url).trim())) {
+      console.error(`invalid baseUrl: ${url} (must start with http:// or https://)`);
+      process.exit(1);
+    }
+    const { loadProviderConfig, saveProviderConfig } = await import("../../../state.js");
+    const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+    saveProviderConfig(id, { baseUrl: String(url).trim(), keys: cur.keys || [] });
+    console.log(`set ${id} baseUrl: ${String(url).trim().replace(/\/+$/, "")} — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub === "share") {
+    const { loadProviderShareKeys, saveProviderShareKeys } = await import("../../../state.js");
+    const on = rest[1];
+    if (!on) {
+      console.log(`share keys to peers: ${loadProviderShareKeys(id) ? "ON" : "off"}`);
+      process.exit(0);
+    }
+    if (!["on", "off", "1", "0", "true", "false"].includes(String(on).toLowerCase())) {
+      console.error("usage: mslxdff -provider openrouter share on|off");
+      process.exit(1);
+    }
+    const state = ["on", "1", "true"].includes(String(on).toLowerCase());
+    saveProviderShareKeys(id, state);
+    console.log(`share keys to peers: ${state ? "ON" : "off"} — restart daemon to activate`);
+    process.exit(0);
+  }
+  return false;
+}

package/src/cli/commands/provider/index.js

@@ -0,0 +1,193 @@
+import { readFileSync } from "node:fs";
+import { defaultStateFile } from "../../../state.js";
+
+export async function handleProviders(args) {
+  if (!(args.includes("-providers") || args.includes("--providers"))) return false;
+  const idx = args.findIndex((x) => x === "-providers" || x === "--providers");
+  const sub = args[idx + 1];
+  if (!sub || sub === "list" || sub === "status") {
+    const { loadProviderConfigs, loadProviderKeys, loadProviderShareKeys, loadProviderBaseUrl, loadProviderAllowedModels } = await import("../../../state.js");
+    const configs = loadProviderConfigs();
+    const opencodeEnabled = true;
+    const opencodeBase = process.env.UPSTREAM_BASE_URL || "https://opencode.ai";
+    const orKeys = loadProviderKeys("openrouter");
+    const orBase = "https://openrouter.ai/api/v1";
+    const orShare = loadProviderShareKeys("openrouter");
+    const orAllowed = loadProviderAllowedModels("openrouter");
+    const genericIds = new Set(Object.keys(configs).filter((id) => id !== "opencode" && id !== "openrouter"));
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const pk = raw.providerKeys || {};
+      for (const id of Object.keys(pk)) if (id !== "opencode" && id !== "openrouter") genericIds.add(id);
+      const cfgRaw = raw.providerConfigs || {};
+      for (const id of Object.keys(cfgRaw)) if (id !== "opencode" && id !== "openrouter") genericIds.add(id);
+    } catch {}
+    for (const k of Object.keys(process.env)) {
+      const m = k.match(/^MSLXDFF_(.+)_KEY$/);
+      if (m) {
+        const id = m[1].toLowerCase().replace(/__/g, "-");
+        if (id !== "openrouter" && id !== "opencode") genericIds.add(id);
+      }
+    }
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const cfgs = raw.providerConfigs || {};
+      for (const id of Object.keys(cfgs)) {
+        if (id === "opencode" || id === "openrouter") continue;
+        const am = cfgs[id]?.allowedModels;
+        if (Array.isArray(am) && am.length) genericIds.add(id);
+      }
+    } catch {}
+    const list = [];
+    const { loadProviderAllowAnyModels: _la0 } = await import("../../../state.js");
+    const opAllowAny = _la0("opencode");
+    const orAllowAny = _la0("openrouter");
+    const opAllowed = loadProviderAllowedModels("opencode");
+    list.push({ id: "opencode", enabled: opencodeEnabled, baseUrl: opencodeBase, keys: [], share: false, allowed: opAllowed, allowAny: opAllowAny, note: "built-in, no key, cannot share" });
+    list.push({ id: "openrouter", enabled: orKeys.length > 0, baseUrl: orBase, keys: orKeys, share: orShare, allowed: orAllowed, allowAny: orAllowAny, note: orKeys.length ? "" : "no keys" });
+    for (const gid of [...genericIds].sort()) {
+      const cfg = configs[gid];
+      const keys = loadProviderKeys(gid);
+      const baseUrl = loadProviderBaseUrl(gid) || cfg?.baseUrl || "";
+      const share = loadProviderShareKeys(gid);
+      const allowed = loadProviderAllowedModels(gid);
+      const allowAny = _la0(gid);
+      const enabled = Boolean(baseUrl && keys.length);
+      let note = "";
+      if (!baseUrl && !keys.length && !allowed.length && allowAny === false) note = "no baseUrl, no keys, BLOCKED (allowAny OFF)";
+      else if (!baseUrl && !keys.length && !allowed.length) note = "no baseUrl, no keys";
+      else if (!baseUrl && !allowed.length && !allowAny) note = "missing baseUrl, BLOCKED";
+      else if (!keys.length && !allowed.length && !allowAny) note = "no keys, BLOCKED";
+      else if (!baseUrl) note = "missing baseUrl";
+      else if (!keys.length) note = "no keys";
+      list.push({ id: gid, enabled, baseUrl: baseUrl || "(none)", keys, share, allowed, allowAny, note });
+    }
+    console.log(`providers (${list.length}):`);
+    for (const p of list) {
+      const state = p.enabled ? "enabled " : "disabled";
+      const keysInfo = p.keys.length ? `${p.keys.length} key${p.keys.length > 1 ? "s" : ""} ${p.keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}` : "0 keys";
+      const shareInfo = p.id === "opencode" ? "cannot share" : `share=${p.share ? "ON" : "off"}`;
+      const allowInfo = p.allowed.length ? `allow=${p.allowed.length}(${p.allowed.slice(0, 3).join(",")}${p.allowed.length > 3 ? "..." : ""})` : (p.allowAny ? "allow=all" : "allow=none(BLOCKED)");
+      const note = p.note ? `  (${p.note})` : "";
+      console.log(`  ${p.id.padEnd(12)} ${state}  ${keysInfo.padEnd(28)}  ${allowInfo.padEnd(22)}  baseUrl=${p.baseUrl}  ${shareInfo}${note}`);
+    }
+    console.log(`\nuse: mslxdff -provider <id> list  to inspect one,  mslxdff -provider <id> allowlist set <model...>  to restrict`);
+    console.log(`     mslxdff -provider <id> allowAny on|off  (empty allowlist = block or allow all)`);
+    process.exit(0);
+  }
+  console.error("usage: mslxdff -providers list");
+  process.exit(1);
+}
+
+export async function handleProvider(args) {
+  if (!(args.includes("-provider") || args.includes("--provider"))) return false;
+  const idx = args.findIndex((x) => x === "-provider" || x === "--provider");
+  const id = args[idx + 1];
+  const sub = args[idx + 2];
+  const rest = args.slice(idx + 2);
+  if (!id) {
+    console.error("usage: mslxdff -provider <id> [key...|add|remove|list|models|clear|share|set-url|allowlist|allowAny]");
+    console.error("       e.g. mslxdff -provider openrouter sk-1 sk-2 sk-3      set multiple keys (replaces all)");
+    console.error("            mslxdff -provider openrouter add sk-4             append one key");
+    console.error("            mslxdff -provider openrouter remove sk-1          remove a key by value");
+    console.error("            mslxdff -provider openrouter list                 list all keys (masked)");
+    console.error("            mslxdff -provider openrouter models [--json]      list provider models (allowlist filtered)");
+    console.error("            mslxdff -provider openrouter share on|off         share keys with peers on outgoing forward (ADR-0008)");
+    console.error("            mslxdff -provider openrouter set-url https://api.example.com/v1");
+    console.error("            mslxdff -provider openrouter set-models-path /v1/models");
+    console.error("            mslxdff -provider openrouter set-chat-path /v1/chat/completions");
+    console.error("            mslxdff -provider openrouter allowlist set gpt-4 gpt-3.5  manage allowed models (empty=block unless allowAny ON)");
+    console.error("            mslxdff -provider openrouter allowAny on|off     empty allowlist = allow all or block all (default OFF, secure)");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx   add generic OpenAI-compatible provider");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx gpt-4  add with allowlist");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx --models-path /v1/models --chat-path /v1/chat/completions");
+    console.error("            mslxdff -provider openrouter                      interactive hidden input (append)");
+    console.error("            mslxdff -provider openrouter clear                remove all keys");
+    process.exit(1);
+  }
+  if (id === "list" || id === "status") {
+    const { loadProviderConfigs, loadProviderKeys, loadProviderShareKeys, loadProviderBaseUrl } = await import("../../../state.js");
+    const configs = loadProviderConfigs();
+    const opencodeBase = process.env.UPSTREAM_BASE_URL || "https://opencode.ai";
+    const orKeys = loadProviderKeys("openrouter");
+    const orBase = "https://openrouter.ai/api/v1";
+    const orShare = loadProviderShareKeys("openrouter");
+    const genericIds = new Set(Object.keys(configs).filter((x) => x !== "opencode" && x !== "openrouter"));
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const pk = raw.providerKeys || {};
+      for (const k of Object.keys(pk)) if (k !== "opencode" && k !== "openrouter") genericIds.add(k);
+      const cfgRaw = raw.providerConfigs || {};
+      for (const k of Object.keys(cfgRaw)) if (k !== "opencode" && k !== "openrouter") genericIds.add(k);
+    } catch {}
+    for (const k of Object.keys(process.env)) {
+      const m = k.match(/^MSLXDFF_(.+)_KEY$/);
+      if (m) {
+        const gid = m[1].toLowerCase().replace(/__/g, "-");
+        if (gid !== "openrouter" && gid !== "opencode") genericIds.add(gid);
+      }
+    }
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const cfgs = raw.providerConfigs || {};
+      for (const gid of Object.keys(cfgs)) {
+        if (gid === "opencode" || gid === "openrouter") continue;
+        const am = cfgs[gid]?.allowedModels;
+        if (Array.isArray(am) && am.length) genericIds.add(gid);
+      }
+    } catch {}
+    const list = [];
+    const { loadProviderAllowAnyModels: _la0 } = await import("../../../state.js");
+    const { loadProviderAllowedModels } = await import("../../../state.js");
+    const opAllowed = loadProviderAllowedModels("opencode");
+    const opAllowAny = _la0("opencode");
+    const orAllowed = loadProviderAllowedModels("openrouter");
+    const orAllowAny = _la0("openrouter");
+    list.push({ id: "opencode", enabled: true, baseUrl: opencodeBase, keys: [], share: false, allowed: opAllowed, allowAny: opAllowAny, note: "built-in, no key, cannot share" });
+    list.push({ id: "openrouter", enabled: orKeys.length > 0, baseUrl: orBase, keys: orKeys, share: orShare, allowed: orAllowed, allowAny: orAllowAny, note: orKeys.length ? "" : "no keys" });
+    for (const gid of [...genericIds].sort()) {
+      const cfg = configs[gid];
+      const keys = loadProviderKeys(gid);
+      const baseUrl = loadProviderBaseUrl(gid) || cfg?.baseUrl || "";
+      const share = loadProviderShareKeys(gid);
+      const allowed = loadProviderAllowedModels(gid);
+      const allowAny = _la0(gid);
+      const enabled = Boolean(baseUrl && keys.length);
+      let note = "";
+      if (!baseUrl && !keys.length) note = "no baseUrl, no keys";
+      else if (!baseUrl) note = "missing baseUrl";
+      else if (!keys.length) note = "no keys";
+      list.push({ id: gid, enabled, baseUrl: baseUrl || "(none)", keys, share, note });
+    }
+    console.log(`providers (${list.length}):`);
+    for (const p of list) {
+      const state = p.enabled ? "enabled " : "disabled";
+      const keysInfo = p.keys.length ? `${p.keys.length} key${p.keys.length > 1 ? "s" : ""} ${p.keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}` : "0 keys";
+      const shareInfo = p.id === "opencode" ? "cannot share" : `share=${p.share ? "ON" : "off"}`;
+      const note = p.note ? `  (${p.note})` : "";
+      console.log(`  ${p.id.padEnd(12)} ${state}  ${keysInfo.padEnd(28)}  baseUrl=${p.baseUrl}  ${shareInfo}${note}`);
+    }
+    console.log(`\nuse: mslxdff -provider <id> list  to inspect one,  mslxdff -provider add <id> <baseUrl> <key>  to add generic`);
+    process.exit(0);
+  }
+  if (id === "add") {
+    const { handleProviderAdd } = await import("./add.js");
+    await handleProviderAdd(id, sub, rest);
+    return true;
+  }
+  if ((id === "opencode" || id === "oc") && sub !== "allowlist" && sub !== "allow" && sub !== "allowed" && sub !== "whitelist" && sub !== "list" && sub !== "status" && sub !== "allowAny" && sub !== "allow-any" && sub !== "allow_any" && sub !== "allowany") {
+    console.log("opencode is the default (bare) provider — it needs no API key and can never be shared with peers");
+    console.log("(its IP-based rate limit is spread by peer forwarding itself)");
+    console.log(`  allowlist: mslxdff -provider opencode allowlist [list|set|add|remove|clear]  — restrict models (empty=allow all)`);
+    process.exit(0);
+  }
+  const { handleProviderConfig } = await import("./config.js");
+  if (await handleProviderConfig(id, sub, rest)) return true;
+  const { handleProviderAllowlist } = await import("./allowlist.js");
+  if (await handleProviderAllowlist(id, sub, rest)) return true;
+  const { handleProviderModels } = await import("./models.js");
+  if (await handleProviderModels(id, sub, args, rest)) return true;
+  const { handleProviderKeys } = await import("./keys.js");
+  await handleProviderKeys(id, sub, rest, args);
+  return true;
+}

package/src/cli/commands/provider/keys.js

@@ -0,0 +1,135 @@
+export async function handleProviderKeys(id, sub, rest, args) {
+  if (sub === "list" || sub === "status") {
+    const { loadProviderKeys, loadProviderConfig, loadProviderShareKeys, loadProviderAllowedModels, loadProviderAllowAnyModels } = await import("../../../state.js");
+    const keys = loadProviderKeys(id);
+    const cfg = loadProviderConfig(id);
+    const allowed = loadProviderAllowedModels(id);
+    const allowAny = loadProviderAllowAnyModels(id);
+    const baseUrl = cfg?.baseUrl || "";
+    if (baseUrl) console.log(`provider: ${id}  baseUrl: ${baseUrl}`);
+    else console.log(`provider: ${id}${id === "openrouter" ? " (built-in baseUrl: https://openrouter.ai/api/v1)" : ""}`);
+    if (keys.length) {
+      console.log(`  keys: ${keys.length} key${keys.length > 1 ? "s" : ""}`);
+      keys.forEach((k, i) => console.log(`  [${i + 1}]  ${k.slice(0, 4)}…${k.slice(-4)} (${k.length} chars)`));
+      console.log(`  remove by: mslxdff -provider ${id} remove <seq> [seq...] | <key-value>`);
+    } else {
+      console.log(`  keys: (no keys configured)`);
+    }
+    console.log(`  share keys to peers:   ${loadProviderShareKeys(id) ? "ON" : "off"}   (mslxdff -provider ${id} share on|off)`);
+    console.log(`  allowAnyModels: ${allowAny ? "ON (empty allowlist = allow all)" : "OFF (empty allowlist = BLOCK ALL)"}  (mslxdff -provider ${id} allowAny on|off)`);
+    if (allowed.length) console.log(`  allowedModels: ${allowed.length} (${allowed.join(", ")})  — only these can be used`);
+    else console.log(`  allowedModels: (none — ${allowAny ? "allow all" : "BLOCK ALL"})  (mslxdff -provider ${id} allowlist set <model...>  or  allowAny on)`);
+    if (baseUrl) console.log(`  set url: mslxdff -provider ${id} set-url <baseUrl>`);
+    console.log(`  NOTE: opencode is the default provider and can never be shared`);
+    process.exit(0);
+  }
+  if (sub === "add") {
+    const key = rest[1];
+    if (!key) {
+      console.error("usage: mslxdff -provider openrouter add <key>");
+      process.exit(1);
+    }
+    const trimmed = String(key).trim();
+    const { loadProviderKeys, loadProviderConfig, saveProviderConfig, addProviderKey, loadProviderConfigs } = await import("../../../state.js");
+    const curKeys = loadProviderKeys(id);
+    if (curKeys.some((k) => String(k).trim() === trimmed)) {
+      console.log(`key already exists for ${id} (${trimmed.slice(0, 4)}…${trimmed.slice(-4)}), skipped — still ${curKeys.length} key(s)`);
+      console.log(`  use: mslxdff -provider ${id} list  to see keys`);
+      process.exit(0);
+    }
+    const configs = loadProviderConfigs();
+    if (configs[id]) {
+      const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+      const keys = [...new Set([...(cur.keys || []), trimmed].filter(Boolean))];
+      saveProviderConfig(id, { baseUrl: cur.baseUrl || "", keys });
+      console.log(`added ${id} API key (now ${keys.length} total) — restart daemon to activate`);
+    } else {
+      const added = addProviderKey(id, key);
+      console.log(`added ${id} API key (now ${added.length} total) — restart daemon to activate`);
+    }
+    process.exit(0);
+  }
+  if (sub === "remove") {
+    const { loadProviderKeys, loadProviderConfig, saveProviderConfig, removeProviderKeys, loadProviderConfigs } = await import("../../../state.js");
+    const targets = rest.slice(1).filter((k) => !k.startsWith("-"));
+    if (!targets.length) {
+      console.error("usage: mslxdff -provider openrouter remove <seq|key> [seq|key ...]   (seq = index shown by 'list')");
+      process.exit(1);
+    }
+    const current = loadProviderKeys(id);
+    const toRemove = [];
+    for (const raw of targets.flatMap((t) => String(t).split(","))) {
+      const t = raw.trim();
+      if (!t) continue;
+      if (/^\d+$/.test(t)) {
+        const seq = Number(t);
+        const idx2 = seq - 1;
+        if (Number.isInteger(seq) && idx2 >= 0 && idx2 < current.length) toRemove.push(current[idx2]);
+        else console.log(`  ! no key at sequence ${seq} (provider has ${current.length}) — skipped`);
+      } else {
+        toRemove.push(t);
+      }
+    }
+    if (!toRemove.length) {
+      console.log("nothing to remove");
+      process.exit(0);
+    }
+    const configs = loadProviderConfigs();
+    let remaining;
+    if (configs[id]) {
+      const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+      const set = new Set([...new Set(toRemove)].map((k) => String(k).trim()));
+      const keys = (cur.keys || []).filter((k) => !set.has(k));
+      saveProviderConfig(id, { baseUrl: cur.baseUrl || "", keys });
+      remaining = keys;
+    } else {
+      remaining = removeProviderKeys(id, [...new Set(toRemove)]);
+    }
+    console.log(`removed ${current.length - remaining.length} ${id} API key(s) (now ${remaining.length} total) — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub && !sub.startsWith("-")) {
+    const { loadProviderKeys, loadProviderConfig, saveProviderConfig, saveProviderKeys, loadProviderConfigs } = await import("../../../state.js");
+    const keys = rest.filter((k) => !k.startsWith("-"));
+    if (!keys.length) {
+      console.error("no key given");
+      process.exit(1);
+    }
+    const configs = loadProviderConfigs();
+    if (configs[id]) {
+      const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+      const clean = [...new Set(keys.map((k) => String(k).trim()).filter(Boolean))];
+      saveProviderConfig(id, { baseUrl: cur.baseUrl || "", keys: clean });
+      console.log(`set ${id} API keys (${clean.length}: ${clean.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}) — restart daemon to activate`);
+    } else {
+      saveProviderKeys(id, keys);
+      console.log(`set ${id} API keys (${keys.length}: ${keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}) — restart daemon to activate`);
+    }
+    process.exit(0);
+  }
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const { loadProviderKeys, addProviderKey } = await import("../../../state.js");
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    console.log(`Enter ${id} API keys, one per line (input hidden). Blank line to finish:`);
+    const existing = loadProviderKeys(id);
+    const collected = [];
+    for (;;) {
+      const key = await rl.question(existing.length || collected.length ? "" : "");
+      const clean = String(key || "").trim();
+      if (!clean) break;
+      collected.push(clean);
+    }
+    rl.close();
+    if (!collected.length) {
+      console.log("empty input — nothing changed");
+      process.exit(0);
+    }
+    for (const k of collected) addProviderKey(id, k);
+    const total = (await import("../../../state.js")).loadProviderKeys(id).length;
+    console.log(`added ${collected.length} ${id} API key(s) (now ${total} total) — restart daemon to activate`);
+    process.exit(0);
+  }
+  console.error("provide keys inline (non-TTY): mslxdff -provider openrouter <key1> [key2 ...]");
+  process.exit(1);
+}