mslxdff 0.1.65 → 0.1.67

package/src/cli/commands/provider/config.js

@@ -0,0 +1,82 @@
+export async function handleProviderConfig(id, sub, rest) {
+  if (sub === "set-models-path" || sub === "setModelsPath" || sub === "models-path") {
+    const p = rest[1];
+    if (!p) {
+      console.error(`usage: mslxdff -provider ${id} set-models-path <path>  (e.g. /v1/models)`);
+      process.exit(1);
+    }
+    if (!String(p).trim().startsWith("/")) {
+      console.error(`invalid modelsPath: ${p} (must start with /)`);
+      process.exit(1);
+    }
+    const { loadProviderConfig, saveProviderConfig } = await import("../../../state.js");
+    const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+    const { normalizeProviderId } = await import("../../../providers/model-id.js");
+    const nid = normalizeProviderId(id);
+    saveProviderConfig(nid || id, { baseUrl: cur.baseUrl || "", keys: cur.keys || [], modelsPath: String(p).trim() });
+    console.log(`set ${nid || id} modelsPath: ${String(p).trim()} — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub === "set-chat-path" || sub === "setChatPath" || sub === "chat-path") {
+    const p = rest[1];
+    if (!p) {
+      console.error(`usage: mslxdff -provider ${id} set-chat-path <path>  (e.g. /v1/chat/completions)`);
+      process.exit(1);
+    }
+    if (!String(p).trim().startsWith("/")) {
+      console.error(`invalid chatPath: ${p} (must start with /)`);
+      process.exit(1);
+    }
+    const { loadProviderConfig, saveProviderConfig } = await import("../../../state.js");
+    const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+    const { normalizeProviderId } = await import("../../../providers/model-id.js");
+    const nid = normalizeProviderId(id);
+    saveProviderConfig(nid || id, { baseUrl: cur.baseUrl || "", keys: cur.keys || [], chatPath: String(p).trim() });
+    console.log(`set ${nid || id} chatPath: ${String(p).trim()} — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub === "clear") {
+    const { loadProviderConfigs, loadProviderConfig, saveProviderConfig, saveProviderKeys } = await import("../../../state.js");
+    const configs = loadProviderConfigs();
+    if (configs[id]) {
+      saveProviderConfig(id, { baseUrl: "", keys: [] });
+    } else {
+      saveProviderKeys(id, []);
+    }
+    console.log(`cleared ${id} API keys (provider disabled on next daemon start)`);
+    process.exit(0);
+  }
+  if (sub === "set-url" || sub === "setUrl" || sub === "url") {
+    const url = rest[1];
+    if (!url) {
+      console.error(`usage: mslxdff -provider ${id} set-url <baseUrl>`);
+      process.exit(1);
+    }
+    if (!/^https?:\/\/.+/.test(String(url).trim())) {
+      console.error(`invalid baseUrl: ${url} (must start with http:// or https://)`);
+      process.exit(1);
+    }
+    const { loadProviderConfig, saveProviderConfig } = await import("../../../state.js");
+    const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+    saveProviderConfig(id, { baseUrl: String(url).trim(), keys: cur.keys || [] });
+    console.log(`set ${id} baseUrl: ${String(url).trim().replace(/\/+$/, "")} — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub === "share") {
+    const { loadProviderShareKeys, saveProviderShareKeys } = await import("../../../state.js");
+    const on = rest[1];
+    if (!on) {
+      console.log(`share keys to peers: ${loadProviderShareKeys(id) ? "ON" : "off"}`);
+      process.exit(0);
+    }
+    if (!["on", "off", "1", "0", "true", "false"].includes(String(on).toLowerCase())) {
+      console.error("usage: mslxdff -provider openrouter share on|off");
+      process.exit(1);
+    }
+    const state = ["on", "1", "true"].includes(String(on).toLowerCase());
+    saveProviderShareKeys(id, state);
+    console.log(`share keys to peers: ${state ? "ON" : "off"} — restart daemon to activate`);
+    process.exit(0);
+  }
+  return false;
+}

package/src/cli/commands/provider/index.js

@@ -0,0 +1,193 @@
+import { readFileSync } from "node:fs";
+import { defaultStateFile } from "../../../state.js";
+
+export async function handleProviders(args) {
+  if (!(args.includes("-providers") || args.includes("--providers"))) return false;
+  const idx = args.findIndex((x) => x === "-providers" || x === "--providers");
+  const sub = args[idx + 1];
+  if (!sub || sub === "list" || sub === "status") {
+    const { loadProviderConfigs, loadProviderKeys, loadProviderShareKeys, loadProviderBaseUrl, loadProviderAllowedModels } = await import("../../../state.js");
+    const configs = loadProviderConfigs();
+    const opencodeEnabled = true;
+    const opencodeBase = process.env.UPSTREAM_BASE_URL || "https://opencode.ai";
+    const orKeys = loadProviderKeys("openrouter");
+    const orBase = "https://openrouter.ai/api/v1";
+    const orShare = loadProviderShareKeys("openrouter");
+    const orAllowed = loadProviderAllowedModels("openrouter");
+    const genericIds = new Set(Object.keys(configs).filter((id) => id !== "opencode" && id !== "openrouter"));
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const pk = raw.providerKeys || {};
+      for (const id of Object.keys(pk)) if (id !== "opencode" && id !== "openrouter") genericIds.add(id);
+      const cfgRaw = raw.providerConfigs || {};
+      for (const id of Object.keys(cfgRaw)) if (id !== "opencode" && id !== "openrouter") genericIds.add(id);
+    } catch {}
+    for (const k of Object.keys(process.env)) {
+      const m = k.match(/^MSLXDFF_(.+)_KEY$/);
+      if (m) {
+        const id = m[1].toLowerCase().replace(/__/g, "-");
+        if (id !== "openrouter" && id !== "opencode") genericIds.add(id);
+      }
+    }
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const cfgs = raw.providerConfigs || {};
+      for (const id of Object.keys(cfgs)) {
+        if (id === "opencode" || id === "openrouter") continue;
+        const am = cfgs[id]?.allowedModels;
+        if (Array.isArray(am) && am.length) genericIds.add(id);
+      }
+    } catch {}
+    const list = [];
+    const { loadProviderAllowAnyModels: _la0 } = await import("../../../state.js");
+    const opAllowAny = _la0("opencode");
+    const orAllowAny = _la0("openrouter");
+    const opAllowed = loadProviderAllowedModels("opencode");
+    list.push({ id: "opencode", enabled: opencodeEnabled, baseUrl: opencodeBase, keys: [], share: false, allowed: opAllowed, allowAny: opAllowAny, note: "built-in, no key, cannot share" });
+    list.push({ id: "openrouter", enabled: orKeys.length > 0, baseUrl: orBase, keys: orKeys, share: orShare, allowed: orAllowed, allowAny: orAllowAny, note: orKeys.length ? "" : "no keys" });
+    for (const gid of [...genericIds].sort()) {
+      const cfg = configs[gid];
+      const keys = loadProviderKeys(gid);
+      const baseUrl = loadProviderBaseUrl(gid) || cfg?.baseUrl || "";
+      const share = loadProviderShareKeys(gid);
+      const allowed = loadProviderAllowedModels(gid);
+      const allowAny = _la0(gid);
+      const enabled = Boolean(baseUrl && keys.length);
+      let note = "";
+      if (!baseUrl && !keys.length && !allowed.length && allowAny === false) note = "no baseUrl, no keys, BLOCKED (allowAny OFF)";
+      else if (!baseUrl && !keys.length && !allowed.length) note = "no baseUrl, no keys";
+      else if (!baseUrl && !allowed.length && !allowAny) note = "missing baseUrl, BLOCKED";
+      else if (!keys.length && !allowed.length && !allowAny) note = "no keys, BLOCKED";
+      else if (!baseUrl) note = "missing baseUrl";
+      else if (!keys.length) note = "no keys";
+      list.push({ id: gid, enabled, baseUrl: baseUrl || "(none)", keys, share, allowed, allowAny, note });
+    }
+    console.log(`providers (${list.length}):`);
+    for (const p of list) {
+      const state = p.enabled ? "enabled " : "disabled";
+      const keysInfo = p.keys.length ? `${p.keys.length} key${p.keys.length > 1 ? "s" : ""} ${p.keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}` : "0 keys";
+      const shareInfo = p.id === "opencode" ? "cannot share" : `share=${p.share ? "ON" : "off"}`;
+      const allowInfo = p.allowed.length ? `allow=${p.allowed.length}(${p.allowed.slice(0, 3).join(",")}${p.allowed.length > 3 ? "..." : ""})` : (p.allowAny ? "allow=all" : "allow=none(BLOCKED)");
+      const note = p.note ? `  (${p.note})` : "";
+      console.log(`  ${p.id.padEnd(12)} ${state}  ${keysInfo.padEnd(28)}  ${allowInfo.padEnd(22)}  baseUrl=${p.baseUrl}  ${shareInfo}${note}`);
+    }
+    console.log(`\nuse: mslxdff -provider <id> list  to inspect one,  mslxdff -provider <id> allowlist set <model...>  to restrict`);
+    console.log(`     mslxdff -provider <id> allowAny on|off  (empty allowlist = block or allow all)`);
+    process.exit(0);
+  }
+  console.error("usage: mslxdff -providers list");
+  process.exit(1);
+}
+
+export async function handleProvider(args) {
+  if (!(args.includes("-provider") || args.includes("--provider"))) return false;
+  const idx = args.findIndex((x) => x === "-provider" || x === "--provider");
+  const id = args[idx + 1];
+  const sub = args[idx + 2];
+  const rest = args.slice(idx + 2);
+  if (!id) {
+    console.error("usage: mslxdff -provider <id> [key...|add|remove|list|models|clear|share|set-url|allowlist|allowAny]");
+    console.error("       e.g. mslxdff -provider openrouter sk-1 sk-2 sk-3      set multiple keys (replaces all)");
+    console.error("            mslxdff -provider openrouter add sk-4             append one key");
+    console.error("            mslxdff -provider openrouter remove sk-1          remove a key by value");
+    console.error("            mslxdff -provider openrouter list                 list all keys (masked)");
+    console.error("            mslxdff -provider openrouter models [--json]      list provider models (allowlist filtered)");
+    console.error("            mslxdff -provider openrouter share on|off         share keys with peers on outgoing forward (ADR-0008)");
+    console.error("            mslxdff -provider openrouter set-url https://api.example.com/v1");
+    console.error("            mslxdff -provider openrouter set-models-path /v1/models");
+    console.error("            mslxdff -provider openrouter set-chat-path /v1/chat/completions");
+    console.error("            mslxdff -provider openrouter allowlist set gpt-4 gpt-3.5  manage allowed models (empty=block unless allowAny ON)");
+    console.error("            mslxdff -provider openrouter allowAny on|off     empty allowlist = allow all or block all (default OFF, secure)");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx   add generic OpenAI-compatible provider");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx gpt-4  add with allowlist");
+    console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx --models-path /v1/models --chat-path /v1/chat/completions");
+    console.error("            mslxdff -provider openrouter                      interactive hidden input (append)");
+    console.error("            mslxdff -provider openrouter clear                remove all keys");
+    process.exit(1);
+  }
+  if (id === "list" || id === "status") {
+    const { loadProviderConfigs, loadProviderKeys, loadProviderShareKeys, loadProviderBaseUrl } = await import("../../../state.js");
+    const configs = loadProviderConfigs();
+    const opencodeBase = process.env.UPSTREAM_BASE_URL || "https://opencode.ai";
+    const orKeys = loadProviderKeys("openrouter");
+    const orBase = "https://openrouter.ai/api/v1";
+    const orShare = loadProviderShareKeys("openrouter");
+    const genericIds = new Set(Object.keys(configs).filter((x) => x !== "opencode" && x !== "openrouter"));
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const pk = raw.providerKeys || {};
+      for (const k of Object.keys(pk)) if (k !== "opencode" && k !== "openrouter") genericIds.add(k);
+      const cfgRaw = raw.providerConfigs || {};
+      for (const k of Object.keys(cfgRaw)) if (k !== "opencode" && k !== "openrouter") genericIds.add(k);
+    } catch {}
+    for (const k of Object.keys(process.env)) {
+      const m = k.match(/^MSLXDFF_(.+)_KEY$/);
+      if (m) {
+        const gid = m[1].toLowerCase().replace(/__/g, "-");
+        if (gid !== "openrouter" && gid !== "opencode") genericIds.add(gid);
+      }
+    }
+    try {
+      const raw = JSON.parse(readFileSync(defaultStateFile(), "utf8"));
+      const cfgs = raw.providerConfigs || {};
+      for (const gid of Object.keys(cfgs)) {
+        if (gid === "opencode" || gid === "openrouter") continue;
+        const am = cfgs[gid]?.allowedModels;
+        if (Array.isArray(am) && am.length) genericIds.add(gid);
+      }
+    } catch {}
+    const list = [];
+    const { loadProviderAllowAnyModels: _la0 } = await import("../../../state.js");
+    const { loadProviderAllowedModels } = await import("../../../state.js");
+    const opAllowed = loadProviderAllowedModels("opencode");
+    const opAllowAny = _la0("opencode");
+    const orAllowed = loadProviderAllowedModels("openrouter");
+    const orAllowAny = _la0("openrouter");
+    list.push({ id: "opencode", enabled: true, baseUrl: opencodeBase, keys: [], share: false, allowed: opAllowed, allowAny: opAllowAny, note: "built-in, no key, cannot share" });
+    list.push({ id: "openrouter", enabled: orKeys.length > 0, baseUrl: orBase, keys: orKeys, share: orShare, allowed: orAllowed, allowAny: orAllowAny, note: orKeys.length ? "" : "no keys" });
+    for (const gid of [...genericIds].sort()) {
+      const cfg = configs[gid];
+      const keys = loadProviderKeys(gid);
+      const baseUrl = loadProviderBaseUrl(gid) || cfg?.baseUrl || "";
+      const share = loadProviderShareKeys(gid);
+      const allowed = loadProviderAllowedModels(gid);
+      const allowAny = _la0(gid);
+      const enabled = Boolean(baseUrl && keys.length);
+      let note = "";
+      if (!baseUrl && !keys.length) note = "no baseUrl, no keys";
+      else if (!baseUrl) note = "missing baseUrl";
+      else if (!keys.length) note = "no keys";
+      list.push({ id: gid, enabled, baseUrl: baseUrl || "(none)", keys, share, note });
+    }
+    console.log(`providers (${list.length}):`);
+    for (const p of list) {
+      const state = p.enabled ? "enabled " : "disabled";
+      const keysInfo = p.keys.length ? `${p.keys.length} key${p.keys.length > 1 ? "s" : ""} ${p.keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}` : "0 keys";
+      const shareInfo = p.id === "opencode" ? "cannot share" : `share=${p.share ? "ON" : "off"}`;
+      const note = p.note ? `  (${p.note})` : "";
+      console.log(`  ${p.id.padEnd(12)} ${state}  ${keysInfo.padEnd(28)}  baseUrl=${p.baseUrl}  ${shareInfo}${note}`);
+    }
+    console.log(`\nuse: mslxdff -provider <id> list  to inspect one,  mslxdff -provider add <id> <baseUrl> <key>  to add generic`);
+    process.exit(0);
+  }
+  if (id === "add") {
+    const { handleProviderAdd } = await import("./add.js");
+    await handleProviderAdd(id, sub, rest);
+    return true;
+  }
+  if ((id === "opencode" || id === "oc") && sub !== "allowlist" && sub !== "allow" && sub !== "allowed" && sub !== "whitelist" && sub !== "list" && sub !== "status" && sub !== "allowAny" && sub !== "allow-any" && sub !== "allow_any" && sub !== "allowany") {
+    console.log("opencode is the default (bare) provider — it needs no API key and can never be shared with peers");
+    console.log("(its IP-based rate limit is spread by peer forwarding itself)");
+    console.log(`  allowlist: mslxdff -provider opencode allowlist [list|set|add|remove|clear]  — restrict models (empty=allow all)`);
+    process.exit(0);
+  }
+  const { handleProviderConfig } = await import("./config.js");
+  if (await handleProviderConfig(id, sub, rest)) return true;
+  const { handleProviderAllowlist } = await import("./allowlist.js");
+  if (await handleProviderAllowlist(id, sub, rest)) return true;
+  const { handleProviderModels } = await import("./models.js");
+  if (await handleProviderModels(id, sub, args, rest)) return true;
+  const { handleProviderKeys } = await import("./keys.js");
+  await handleProviderKeys(id, sub, rest, args);
+  return true;
+}

package/src/cli/commands/provider/keys.js

@@ -0,0 +1,135 @@
+export async function handleProviderKeys(id, sub, rest, args) {
+  if (sub === "list" || sub === "status") {
+    const { loadProviderKeys, loadProviderConfig, loadProviderShareKeys, loadProviderAllowedModels, loadProviderAllowAnyModels } = await import("../../../state.js");
+    const keys = loadProviderKeys(id);
+    const cfg = loadProviderConfig(id);
+    const allowed = loadProviderAllowedModels(id);
+    const allowAny = loadProviderAllowAnyModels(id);
+    const baseUrl = cfg?.baseUrl || "";
+    if (baseUrl) console.log(`provider: ${id}  baseUrl: ${baseUrl}`);
+    else console.log(`provider: ${id}${id === "openrouter" ? " (built-in baseUrl: https://openrouter.ai/api/v1)" : ""}`);
+    if (keys.length) {
+      console.log(`  keys: ${keys.length} key${keys.length > 1 ? "s" : ""}`);
+      keys.forEach((k, i) => console.log(`  [${i + 1}]  ${k.slice(0, 4)}…${k.slice(-4)} (${k.length} chars)`));
+      console.log(`  remove by: mslxdff -provider ${id} remove <seq> [seq...] | <key-value>`);
+    } else {
+      console.log(`  keys: (no keys configured)`);
+    }
+    console.log(`  share keys to peers:   ${loadProviderShareKeys(id) ? "ON" : "off"}   (mslxdff -provider ${id} share on|off)`);
+    console.log(`  allowAnyModels: ${allowAny ? "ON (empty allowlist = allow all)" : "OFF (empty allowlist = BLOCK ALL)"}  (mslxdff -provider ${id} allowAny on|off)`);
+    if (allowed.length) console.log(`  allowedModels: ${allowed.length} (${allowed.join(", ")})  — only these can be used`);
+    else console.log(`  allowedModels: (none — ${allowAny ? "allow all" : "BLOCK ALL"})  (mslxdff -provider ${id} allowlist set <model...>  or  allowAny on)`);
+    if (baseUrl) console.log(`  set url: mslxdff -provider ${id} set-url <baseUrl>`);
+    console.log(`  NOTE: opencode is the default provider and can never be shared`);
+    process.exit(0);
+  }
+  if (sub === "add") {
+    const key = rest[1];
+    if (!key) {
+      console.error("usage: mslxdff -provider openrouter add <key>");
+      process.exit(1);
+    }
+    const trimmed = String(key).trim();
+    const { loadProviderKeys, loadProviderConfig, saveProviderConfig, addProviderKey, loadProviderConfigs } = await import("../../../state.js");
+    const curKeys = loadProviderKeys(id);
+    if (curKeys.some((k) => String(k).trim() === trimmed)) {
+      console.log(`key already exists for ${id} (${trimmed.slice(0, 4)}…${trimmed.slice(-4)}), skipped — still ${curKeys.length} key(s)`);
+      console.log(`  use: mslxdff -provider ${id} list  to see keys`);
+      process.exit(0);
+    }
+    const configs = loadProviderConfigs();
+    if (configs[id]) {
+      const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+      const keys = [...new Set([...(cur.keys || []), trimmed].filter(Boolean))];
+      saveProviderConfig(id, { baseUrl: cur.baseUrl || "", keys });
+      console.log(`added ${id} API key (now ${keys.length} total) — restart daemon to activate`);
+    } else {
+      const added = addProviderKey(id, key);
+      console.log(`added ${id} API key (now ${added.length} total) — restart daemon to activate`);
+    }
+    process.exit(0);
+  }
+  if (sub === "remove") {
+    const { loadProviderKeys, loadProviderConfig, saveProviderConfig, removeProviderKeys, loadProviderConfigs } = await import("../../../state.js");
+    const targets = rest.slice(1).filter((k) => !k.startsWith("-"));
+    if (!targets.length) {
+      console.error("usage: mslxdff -provider openrouter remove <seq|key> [seq|key ...]   (seq = index shown by 'list')");
+      process.exit(1);
+    }
+    const current = loadProviderKeys(id);
+    const toRemove = [];
+    for (const raw of targets.flatMap((t) => String(t).split(","))) {
+      const t = raw.trim();
+      if (!t) continue;
+      if (/^\d+$/.test(t)) {
+        const seq = Number(t);
+        const idx2 = seq - 1;
+        if (Number.isInteger(seq) && idx2 >= 0 && idx2 < current.length) toRemove.push(current[idx2]);
+        else console.log(`  ! no key at sequence ${seq} (provider has ${current.length}) — skipped`);
+      } else {
+        toRemove.push(t);
+      }
+    }
+    if (!toRemove.length) {
+      console.log("nothing to remove");
+      process.exit(0);
+    }
+    const configs = loadProviderConfigs();
+    let remaining;
+    if (configs[id]) {
+      const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+      const set = new Set([...new Set(toRemove)].map((k) => String(k).trim()));
+      const keys = (cur.keys || []).filter((k) => !set.has(k));
+      saveProviderConfig(id, { baseUrl: cur.baseUrl || "", keys });
+      remaining = keys;
+    } else {
+      remaining = removeProviderKeys(id, [...new Set(toRemove)]);
+    }
+    console.log(`removed ${current.length - remaining.length} ${id} API key(s) (now ${remaining.length} total) — restart daemon to activate`);
+    process.exit(0);
+  }
+  if (sub && !sub.startsWith("-")) {
+    const { loadProviderKeys, loadProviderConfig, saveProviderConfig, saveProviderKeys, loadProviderConfigs } = await import("../../../state.js");
+    const keys = rest.filter((k) => !k.startsWith("-"));
+    if (!keys.length) {
+      console.error("no key given");
+      process.exit(1);
+    }
+    const configs = loadProviderConfigs();
+    if (configs[id]) {
+      const cur = loadProviderConfig(id) || { baseUrl: "", keys: [] };
+      const clean = [...new Set(keys.map((k) => String(k).trim()).filter(Boolean))];
+      saveProviderConfig(id, { baseUrl: cur.baseUrl || "", keys: clean });
+      console.log(`set ${id} API keys (${clean.length}: ${clean.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}) — restart daemon to activate`);
+    } else {
+      saveProviderKeys(id, keys);
+      console.log(`set ${id} API keys (${keys.length}: ${keys.map((k) => `${k.slice(0, 4)}…${k.slice(-4)}`).join(", ")}) — restart daemon to activate`);
+    }
+    process.exit(0);
+  }
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const { loadProviderKeys, addProviderKey } = await import("../../../state.js");
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    console.log(`Enter ${id} API keys, one per line (input hidden). Blank line to finish:`);
+    const existing = loadProviderKeys(id);
+    const collected = [];
+    for (;;) {
+      const key = await rl.question(existing.length || collected.length ? "" : "");
+      const clean = String(key || "").trim();
+      if (!clean) break;
+      collected.push(clean);
+    }
+    rl.close();
+    if (!collected.length) {
+      console.log("empty input — nothing changed");
+      process.exit(0);
+    }
+    for (const k of collected) addProviderKey(id, k);
+    const total = (await import("../../../state.js")).loadProviderKeys(id).length;
+    console.log(`added ${collected.length} ${id} API key(s) (now ${total} total) — restart daemon to activate`);
+    process.exit(0);
+  }
+  console.error("provide keys inline (non-TTY): mslxdff -provider openrouter <key1> [key2 ...]");
+  process.exit(1);
+}

package/src/cli/commands/provider/models.js

@@ -0,0 +1,99 @@
+import { join } from "node:path";
+import { defaultStateFile } from "../../../state.js";
+import { logDir } from "../../../logs.js";
+
+export async function handleProviderModels(id, sub, args, rest) {
+  if (!(sub === "models" || sub === "show-models" || sub === "list-models" || sub === "ls")) return false;
+  const { loadProviderConfig, loadProviderKeys, isModelAllowed } = await import("../../../state.js");
+  const wantsJson = args.includes("--json") || args.includes("-json");
+  const cfg = loadProviderConfig(id);
+  if (id === "opencode" || id === "oc") {
+    try {
+      const cacheFile = join(logDir(), "models.json");
+      const { readFileSync } = await import("node:fs");
+      const raw = JSON.parse(readFileSync(cacheFile, "utf8"));
+      const ids = (raw.data || []).map((m) => m.id).filter((x) => !String(x).includes("/"));
+      if (wantsJson) {
+        console.log(JSON.stringify({ object: "list", data: ids.map((id) => ({ id, object: "model" })) }, null, 2));
+      } else {
+        console.log(`opencode models (${ids.length}):`);
+        for (const mid of ids) console.log(`  ${mid}`);
+      }
+    } catch (e) {
+      console.error(`could not read models cache: ${String(e?.message || e)}`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+  try {
+    const { createGenericProvider } = await import("../../../providers/generic.js");
+    const { createWorkbuddyProvider } = await import("../../../providers/workbuddy.js");
+    const baseUrl = cfg?.baseUrl || (id === "workbuddy" ? "https://copilot.tencent.com" : "");
+    const keys = loadProviderKeys(id);
+    const auths = cfg?.auths || [];
+    let provider;
+    if (id === "workbuddy") {
+      provider = createWorkbuddyProvider({ baseUrl, apiKeys: keys, auths, file: defaultStateFile() });
+    } else {
+      if (!baseUrl) {
+        console.error(`provider ${id}: missing baseUrl — set via: mslxdff -provider ${id} set-url <baseUrl>`);
+        process.exit(1);
+      }
+      provider = createGenericProvider({ id, baseUrl, apiKeys: keys, file: defaultStateFile() });
+    }
+    const all = await provider.listModels();
+    const markAllowed = (mid) => {
+      const raw = String(mid || "").includes("/") ? String(mid).split("/").slice(1).join("/") : String(mid);
+      const checkRaw = mid.startsWith(`${id}/`) ? mid.slice(id.length + 1) : raw;
+      return isModelAllowed(id, checkRaw);
+    };
+    if (wantsJson) {
+      const filtered = all.filter((m) => markAllowed(m.id));
+      console.log(JSON.stringify({ object: "list", data: filtered }, null, 2));
+    } else {
+      const allowedCount = all.filter((m) => markAllowed(m.id)).length;
+      console.log(`${id} models (${all.length} total, ${allowedCount} ✓ allowed${allowedCount !== all.length ? `, ${all.length - allowedCount} x blocked by allowlist` : ""}):`);
+      const fmtPrice = (m) => {
+        const c = String(m.credits || "").trim();
+        if (c) {
+          const m0 = c.match(/x\s*([\d.]+)/i);
+          if (m0) return `x${m0[1]}`;
+          return c.replace(/\s*credits\s*/gi, "").trim().replace(/\s+/g, " ");
+        }
+        if (m.pricing && typeof m.pricing === "object") {
+          const p = m.pricing.prompt ?? m.pricing.input ?? m.pricing.completion ?? "";
+          if (p) return String(p);
+        }
+        if (m.price != null && String(m.price).trim()) return String(m.price).trim();
+        if (String(m.id).endsWith("/auto")) return "浮动";
+        return "—";
+      };
+      const fmtBadge = (m) => {
+        const tags = Array.isArray(m.tags) ? m.tags : [];
+        const b = tags.find((t) => String(t).includes("限时免费") || String(t).toLowerCase().includes("free"));
+        if (!b) return "";
+        const part = String(b).split(":")[1];
+        return part ? ` [${part}]` : ` [${b}]`;
+      };
+      const idW = Math.max(22, ...all.map((m) => String(m.id).length)) + 2;
+      const priceW = Math.max(6, ...all.map((m) => fmtPrice(m).length)) + 2;
+      for (const m of all) {
+        const ok = markAllowed(m.id);
+        const price = fmtPrice(m);
+        const badge = fmtBadge(m);
+        const name = m.name ? ` ${m.name}` : "";
+        const blocked = ok ? "" : "  [blocked — allowlist]";
+        const line = `  ${ok ? "✓" : "x"} ${String(m.id).padEnd(idW)}${String(price).padEnd(priceW)}${name}${badge}${blocked}`;
+        console.log(line);
+      }
+      if (!all.length) console.log(`  (no models — check baseUrl/keys or try: curl ${baseUrl}/models)`);
+      else if (allowedCount === 0) console.log(`  tip: all blocked — mslxdff -provider ${id} allowAny on  或  allowlist set <model...>`);
+      else if (allowedCount !== all.length) console.log(`  tip: blocked 仅影响 /v1/chat 调用，展示已全量列出`);
+    }
+    try { await provider.close?.(); } catch {}
+  } catch (e) {
+    console.error(`could not list ${id} models: ${String(e?.message || e)}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}

package/src/cli/commands/provider.js

@@ -0,0 +1 @@
+export * from "./provider/index.js";

package/src/cli/commands/sync.js

@@ -0,0 +1,143 @@
+import { join } from "node:path";
+import { loadToken, getPort, savePreferredModel, loadPreferredModel } from "../../state.js";
+import { getPreferredModel as getPref } from "../../auto.js";
+import { normalizeModel } from "../../reasoning.js";
+import { syncToWorkbuddy, workbuddyModelsPath } from "../../sync-workbuddy.js";
+import { syncToOpencode, opencodeConfigPath, toExternalAlias, toInternalId } from "../../sync-opencode.js";
+import { createModelsService } from "../../models.js";
+import { createUpstreamClient } from "../../upstream.js";
+import { logDir } from "../../logs.js";
+
+export async function handleSetto(args) {
+  if (!(args.includes("-setto") || args.includes("--setto"))) return false;
+  const idx = args.findIndex((x) => x === "-setto" || x === "--setto");
+  const target = args[idx + 1];
+  if (!["workbuddy", "opencode"].includes(target)) {
+    console.error("usage: mslxdff -setto workbuddy [modelId] | mslxdff -setto opencode [modelId]");
+    process.exit(1);
+  }
+  if (target === "opencode") {
+    const raw = args[idx + 2] && !String(args[idx + 2]).startsWith("-") ? String(args[idx + 2]).trim() : null;
+    let id;
+    let internal;
+    if (raw) {
+      if (raw === "auto" || !raw) {
+        console.error("modelId 不能为 auto 或空");
+        process.exit(1);
+      }
+      const norm = normalizeModel(raw);
+      if (!norm) {
+        console.error("modelId 不能为空");
+        process.exit(1);
+      }
+      savePreferredModel(norm);
+      console.log(`default model set to: ${norm} (daemon hot-reloads on next request)`);
+      internal = toInternalId(norm);
+      id = toExternalAlias(internal);
+    } else {
+      const pref = loadPreferredModel() || getPref();
+      if (!pref) {
+        console.error("no preferred model set; use: mslxdff -setto opencode <modelId>");
+        process.exit(1);
+      }
+      const norm = normalizeModel(pref);
+      if (!norm) {
+        console.error("modelId 不能为空");
+        process.exit(1);
+      }
+      internal = toInternalId(norm);
+      id = toExternalAlias(internal);
+    }
+    try {
+      const cacheFile = join(logDir(), "models.json");
+      const models = createModelsService({
+        baseUrl: process.env.UPSTREAM_BASE_URL || "https://opencode.ai",
+        headers: createUpstreamClient({}).headers,
+        refreshMs: 0,
+        cacheFile,
+      });
+      const fresh = await Promise.race([
+        models.get(),
+        new Promise((_, rej) => setTimeout(() => rej(new Error("refresh timeout")), 4000)),
+      ]);
+      if (fresh?.data?.length) {
+        const ids = fresh.data.map((m) => m.id);
+        if (!ids.includes(internal) && !ids.includes(id)) {
+          console.log(`warn: "${internal}" not in current free list (${ids.length} models), still syncing to opencode (alias ${id})`);
+        }
+      }
+    } catch {}
+    try {
+      const { token } = await loadToken();
+      const persisted = getPort();
+      const envPort = Number(process.env.MSLXDFF_PORT);
+      const port = persisted !== null ? persisted : (Number.isInteger(envPort) && envPort > 0 ? envPort : 8989);
+      const file = opencodeConfigPath();
+      const r = await syncToOpencode({ id, token, port, file });
+      const aliasLabel = r.alias && r.alias !== r.id ? ` (alias ${r.alias} 对应内部 ${r.internal})` : (r.id !== r.internal ? ` (alias for "${r.internal}", 原名仍兼容)` : ` (原名兼容)`);
+      console.log(`synced to opencode: ${r.action} "${r.id}"${aliasLabel} @ ${file}`);
+      console.log(`  url: http://127.0.0.1:${port}/v1`);
+      if (r.id !== r.internal) console.log(`  alias: ${r.id} -> ${r.internal} (opencode 选 mslxdff/${r.id} 直达本地 ${r.internal})`);
+      else console.log(`  alias: ${r.internal} (原名直用，opencode 选 mslxdff/${r.id} 直达本地 ${r.internal})`);
+    } catch (err) {
+      console.error(`failed to sync to opencode: ${String(err?.message || err)}`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+  const raw = args[idx + 2] && !String(args[idx + 2]).startsWith("-") ? String(args[idx + 2]).trim() : null;
+  let id;
+  if (raw) {
+    if (raw === "auto" || !raw) {
+      console.error("modelId 不能为 auto 或空");
+      process.exit(1);
+    }
+    const norm = normalizeModel(raw);
+    if (!norm) {
+      console.error("modelId 不能为空");
+      process.exit(1);
+    }
+    savePreferredModel(norm);
+    console.log(`default model set to: ${norm} (daemon hot-reloads on next request)`);
+    id = norm;
+  } else {
+    id = loadPreferredModel() || getPref();
+    if (!id) {
+      console.error("no preferred model set; use: mslxdff -setto workbuddy <modelId>");
+      process.exit(1);
+    }
+  }
+  try {
+    const cacheFile = join(logDir(), "models.json");
+    const models = createModelsService({
+      baseUrl: process.env.UPSTREAM_BASE_URL || "https://opencode.ai",
+      headers: createUpstreamClient({}).headers,
+      refreshMs: 0,
+      cacheFile,
+    });
+    const fresh = await Promise.race([
+      models.get(),
+      new Promise((_, rej) => setTimeout(() => rej(new Error("refresh timeout")), 4000)),
+    ]);
+    if (fresh?.data?.length) {
+      const ids = fresh.data.map((m) => m.id);
+      if (!ids.includes(id)) {
+        console.log(`warn: "${id}" not in current free list (${ids.length} models), still syncing to WorkBuddy`);
+      }
+    }
+  } catch {}
+  try {
+    const { token } = await loadToken();
+    const persisted = getPort();
+    const envPort = Number(process.env.MSLXDFF_PORT);
+    const port = persisted !== null ? persisted : (Number.isInteger(envPort) && envPort > 0 ? envPort : 8989);
+    const file = workbuddyModelsPath();
+    const r = await syncToWorkbuddy({ id, token, port, file });
+    console.log(`synced to WorkBuddy: ${r.action} "${id}" @ ${file}`);
+    console.log(`  url: http://127.0.0.1:${port}/v1/chat/completions`);
+  } catch (err) {
+    console.error(`failed to sync to WorkBuddy: ${String(err?.message || err)}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}