npm - myapikey - Versions diffs - 0.48.3 → 1.0.1 - Mend

myapikey 0.48.3 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/README.md +35 -93
package/README.zh-CN.md +37 -95
package/dist/assets/index-mSuIT48J.js +346 -0
package/{packages/web/dist → dist}/index.html +1 -1
package/package.json +25 -16
package/{packages/core/src → src}/server/admin.ts +30 -0
package/{packages/core/src → src}/server/app.ts +4 -2
package/{packages/core/src → src}/server/auth.ts +8 -4
package/src/server/index.ts +44 -0
package/{packages/core/src → src}/server/proxy.ts +5 -8
package/{packages/core/src → src}/server/store.ts +1 -34
package/{packages/core/src → src}/shared/config.ts +2 -2
package/{packages/core/src → src}/shared/types.ts +2 -1
package/packages/core/src/cli/client.ts +0 -69
package/packages/core/src/cli/config.ts +0 -64
package/packages/core/src/cli/index.ts +0 -404
package/packages/web/dist/assets/index-CIGEPkrP.js +0 -346
/package/{packages/web/dist → dist}/assets/index-CWGc5RaE.css +0 -0
/package/{packages/core/src → src}/server/logger.ts +0 -0
/package/{packages/core/src → src}/server/tokens.ts +0 -0

package/README.md CHANGED Viewed

@@ -2,133 +2,75 @@
 [![npm version](https://img.shields.io/npm/v/myapikey?logo=npm)](https://www.npmjs.com/package/myapikey)
 [![license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
-[![node](https://img.shields.io/badge/node.js-%3E%3E18-339933?logo=node.js&logoColor=white)](#up-and-running-in-60-seconds)
+[![node](https://img.shields.io/badge/node.js-%3E%3D18-339933?logo=node.js&logoColor=white)](#quick-start)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5-3178C6?logo=typescript&logoColor=white)](#development)
 English | [简体中文](README.zh-CN.md)
-**One address, one key, every AI tool you use.** A tiny self-hosted LLM gateway for your home server: keep your provider keys in one place, point every tool at the same URL with the same key, and fail over automatically when a backend breaks.
+A lightweight self-hosted LLM gateway. Tools point at one URL with one gateway key; provider keys, model routing, failover, and logging live on your own server.
-## Sound familiar?
+## Why use it
-- You use **Claude Code, a few OpenAI-compatible CLIs, editor plugins, scripts** — and each one needs its own base URL + API key pasted in.
-- Your **real keys** (OpenAI, Anthropic, OpenRouter, a local Ollama…) are scattered across a dozen config files. Rotating one means remembering everywhere it's pasted.
-- Your **main provider 429s or goes down** mid-task and the tool just dies. Switching to a backup means re-editing configs.
-- You tried **one-api / new-api-style gateways**, which *translate* between formats — and drop fields, mangle streams, or hold new upstream parameters hostage until someone updates the gateway.
+- **Keep provider keys private:** real public-cloud keys stay only on your gateway. Client tools receive a local gateway key, so a leaked tool config does not expose the upstream account.
+- **Own the model interface:** expose stable model names to tools. If a provider, deployment, or pricing changes, update the mapping and routing—client configurations stay unchanged.
+- **Stay protocol-aware:** choose OpenAI or Anthropic format explicitly and forward it without translation. You know which protocol each tool and backend is using, and upstream fields do not depend on a converter catching up.
+- **Light enough to modify:** one focused TypeScript codebase with no database and a file-based store. It is easy to run, inspect, and adapt to your own ideas—without first learning a heavyweight gateway.
-MyAPIKey is built to end exactly this.
-## What you get
-- **One address, one key.** Every tool points at `http://<your-server>:7800` with a single `sk-myapikey-…` key. Real provider keys live only inside the gateway — rotate one, swap a backend, and no tool config ever changes again.
-- **Automatic failover + circuit breaker.** Give a model an ordered chain of backends. On `429` / `5xx` / timeout the next one takes over; a source that keeps failing cools down (30 s → 5 min) so later calls skip it. Your agent never notices.
-- **Pure passthrough, zero translation.** OpenAI-format calls reach OpenAI-speaking backends, Anthropic-format calls reach Anthropic-speaking backends — bodies forwarded byte-for-byte, streaming straight through. New upstream fields and parameters work without the gateway "supporting" them first.
-- **Rate limiting that queues instead of 429ing.** Cap each backend's rpm, or give a model an even per-minute pace; excess calls wait in the gateway instead of coming straight back as `429`.
-- **Model name mapping.** Expose a friendly name to your tools (`claude-sonnet-4`); each backend maps it to its own real id (`claude-sonnet-4-20250514` here, something else there).
-- **A default thinking level per slot.** Pin a reasoning effort / token budget on a route; it overrides whatever the request carried — handy for taming Claude Code.
-- **See everything.** Web UI (English / 简体中文): live call log, success rate, p50/p95 latency, per-model / per-backend / per-day stats. The CLI can do all of it too.
-- **Featherweight.** No database — one `data.json` plus a `logs.jsonl`. Runs with `npx`. Built for LAN / home-server use.
-## Up and running in 60 seconds
+## Quick start
 Requires Node.js 18+.
 ```bash
-npx myapikey serve          # → http://localhost:7800
+npx myapikey
 ```
-First run prints your credentials and also saves them to `~/.myapikey/credentials.txt`:
+Open `http://localhost:7800`, set your web username and password on first use, then sign in.
-1. Open `http://localhost:7800` and sign in with the printed **username / password** (web login).
-2. **Models** tab → **Add backend**: paste the backend's base URL + its real API key, tick the formats it speaks (`openai` / `anthropic`), then **discover** → **enable** the models you want.
-3. Point your tools at the gateway — every tool's "API key" field gets the **gateway key**, not your web password:
+1. In **Models**, add each backend with its real base URL and API key, select its format (`openai` / `anthropic`), discover models, and enable the ones you need.
+2. Point tools at the gateway and use the generated `sk-myapikey-…` key, **not** your web login password:
 ```bash
-# Claude Code / anything Anthropic
+# Claude Code / Anthropic SDKs
 export ANTHROPIC_BASE_URL=http://localhost:7800/anthropic
 export ANTHROPIC_API_KEY=sk-myapikey-…
-# OpenAI-compatible tools (Codex, CLIs, plugins)
+# OpenAI-compatible tools
 export OPENAI_BASE_URL=http://localhost:7800/openai/v1
 export OPENAI_API_KEY=sk-myapikey-…
 ```
-> Why `…/openai/v1` but `…/anthropic`? Each SDK appends its own paths (OpenAI adds `/chat/completions`, Anthropic adds `/v1/messages`), so the gateway follows each ecosystem's own convention. Each surface also has its own `/models`, listing only models enabled for that format. `myapikey whoami` prints all of this ready to paste, anytime.
-4. Smoke test without any tool:
-```bash
-myapikey call gpt-4o-mini "Say hello in one sentence."
-```
-Prefer the terminal? `provider add` → `provider models` → `model enable` does the same job — cheat sheet below.
-## How routing works (the whole story)
+OpenAI base URLs include the version segment (`/v1`, `/api/v3`); Anthropic base URLs exclude it.
-- The gateway has two entrances: `/openai/v1/*` (chat completions, responses, models) and `/anthropic/v1/*` (messages, models). A request is forwarded in the entrance's format, **never translated**.
-- Each model has an independent, ordered backend chain **per format**. Within a chain, `429` / `5xx` / timeouts fail over to the next backend; other `4xx` errors come back as-is (they're the caller's fault, not the backend's). No failover once streaming has started. If no backend serves that model on that format, you get a `404` — a clear failure beats a silent translation.
-- Anything that speaks either format works: OpenAI, Anthropic, OpenRouter, Ollama / vLLM, Volcengine Ark, your company's internal gateway…
+## What it does
-## Why no translation?
+- **Unified access:** one endpoint and gateway key for Claude Code, OpenAI-compatible CLIs, plugins, and scripts.
+- **Pure passthrough:** OpenAI calls reach OpenAI-format backends; Anthropic calls reach Anthropic-format backends. Bodies and streams are not translated, so new upstream parameters work without gateway support.
+- **Reliability:** configure ordered backends per model and format. `429`, `5xx`, and timeouts fail over; repeated failures trigger a 30-second-to-5-minute cooldown. Streaming is not retried after it starts.
+- **Rate control:** backend RPM or model pacing queues excess requests instead of immediately returning `429`.
+- **Friendly routing:** expose a simple model name and map it to each backend’s real model ID; optionally pin a default thinking level per route.
+- **Visibility:** bilingual web UI with live logs, success rates, and p50/p95 latency by model, backend, and day.
+- **Light storage:** no database—only `data.json` and `logs.jsonl`.
-one-api / new-api convert OpenAI ↔ Anthropic shapes. Convenient, until a field gets dropped, a stream gets mangled, or a new upstream parameter needs a gateway update before you can send it. OpenRouter is hosted and takes a cut per call. MyAPIKey's answer is to not have a translation layer at all:
+Requests enter through `/openai/v1/*` or `/anthropic/v1/*` and stay in that format. Unsupported model/format combinations return `404`; other caller-side `4xx` errors return unchanged. If you need OpenAI ↔ Anthropic translation, this gateway is intentionally not that tool.
-| | MyAPIKey | one-api / new-api | OpenRouter |
-|---|---|---|---|
-| Deploy | self-hosted, one `npx` | self-hosted, heavier | hosted service |
-| Cost | free | free | markup per call |
-| Formats | passthrough, byte-for-byte | translated | translated |
-| New upstream params | work immediately | wait for gateway support | wait for platform support |
-| Provider keys | on your machine | on your machine | on their platform |
+## Operations
-The trade-off, stated plainly: an Anthropic-format backend cannot be called through the OpenAI entrance. If what you want is format conversion, this isn't your tool (yet).
+Data defaults to `~/.myapikey`; override it with `--data-dir` or `MYAPIKEY_DATA_DIR`.
-## Managing it
-**Web UI** — `http://localhost:7800`, English + 简体中文. Five tabs: **Connect** (copy-paste-ready env lines), **Models** (backends, discovery, per-format enable, drag-to-order chains, name mapping, test call), **Logs** (live timeline), **Stats** (counts, success rate, p50/p95 by model / backend / day), **Settings** (rotate API key, change password, circuit-breaker state, storage paths).
-**CLI cheat sheet** (same admin API as the web UI — the two never drift apart):
-| I want to… | Command |
+| File | Contents |
 |---|---|
-| run the gateway | `myapikey serve [--port 7800] [--data-dir <dir>]` |
-| print what to paste into tools | `myapikey whoami` |
-| add a backend | `myapikey provider add <name> --base-url-openai https://api.openai.com/v1 --key sk-… --formats openai` |
-| see a backend's models | `myapikey provider models <name>` |
-| enable a model | `myapikey model enable <model> --format openai --via <backend>` |
-| add a fallback + set order | `myapikey model add-provider <model> <backend> --format openai` · `myapikey model prioritize <model> <primary> <backup> --format openai` |
-| see the routing table | `myapikey model list` |
-| pace a model | `myapikey model pace <model> <rpm\|0>` |
-| pin a slot's thinking level | `myapikey model thinking <model> <index> [value] --format <fmt>` |
-| quick test | `myapikey call <model> "hi"` |
-> OpenAI base URLs **include** the version segment (`/v1`, Ark's `/api/v3`); Anthropic base URLs **exclude** it (`https://api.anthropic.com`). The `responses` format only accepts backends you've marked `supportsResponses` (web UI toggle).
-> CLI global flags: `-u/--url`, `--user`, `--pass`, `--api-key`, or env `MYAPIKEY_URL` / `MYAPIKEY_USER` / `MYAPIKEY_PASS` / `MYAPIKEY_API_KEY`.
-## Where your data lives
+| `data.json` | backends, routing, account, and gateway API key |
+| `logs.jsonl` | call history (~90 days / 1M lines) |
-One directory (default `~/.myapikey`, override with `--data-dir` or `MYAPIKEY_DATA_DIR`):
-| File | What |
-|---|---|
-| `data.json` | all config: backends, routing table, account, API key |
-| `logs.jsonl` | call history (kept ~90 days / 1 M lines) |
-| `credentials.txt` | your login + API key in plain text, rewritten every start |
-| `client.json` | the CLI's saved connection profile |
+The web UI includes Connect, Models, Logs, Stats, and Settings. Settings can rotate the gateway key or change the password. This tool is single-user and has no TLS; place it behind a reverse proxy before exposing it beyond a trusted network.
 ## Development
 ```bash
 npm install
-npm run build:web      # build the Vue UI into packages/web/dist
-npm run dev            # gateway with watch reload
-npm run dev:web        # vite dev server (proxies API calls to :7800)
-npm test               # vitest unit + integration
-npm run typecheck      # tsc + vue-tsc
+npm run build:web
+npm run dev
+npm run dev:web
+npm test
+npm run typecheck
 ```
-## Honest limits
-- **No OpenAI↔Anthropic translation.** Wrong entrance for a model → `404`.
-- **Single user, no TLS.** Meant for your own network; put a reverse proxy in front if you expose it.
-- **Web password ≠ API key.** The password administers the UI/CLI; agents use the `sk-myapikey-…` key. If a tool config leaks, rotate the key (Settings, or `POST /admin/api-key/rotate`) and nothing else changes.

package/README.zh-CN.md CHANGED Viewed

@@ -2,133 +2,75 @@
 [![npm version](https://img.shields.io/npm/v/myapikey?logo=npm)](https://www.npmjs.com/package/myapikey)
 [![license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
-[![node](https://img.shields.io/badge/node.js-%3E%3E18-339933?logo=node.js&logoColor=white)](#60-秒跑起来)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5-3178C6?logo=typescript&logoColor=white)](#开发)
+[![node](https://img.shields.io/badge/node.js-%3E%3D18-339933?logo=node.js&logoColor=white)](#quick-start)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5-3178C6?logo=typescript&logoColor=white)](#development)
 [English](README.md) | 简体中文
-**一个地址、一把 key,接上你所有的 AI 工具。** 一个跑在自己家用服务器上的轻量 LLM 网关:供应商的 key 收进网关统一保管,所有工具只认同一个地址 + 同一把 key,后端挂了自动切换。
+轻量自托管 LLM 网关。所有工具只填一个地址和一把网关 key;供应商 key、模型路由、故障转移和调用记录都保存在你自己的服务器上。
-## 是不是在说你
+## Why use it
-- 你用着 **Claude Code、好几个 OpenAI 兼容 CLI、编辑器插件、脚本**——每个都得单独填一遍 base URL + API key。
-- 你的**真实 key**(OpenAI、Anthropic、OpenRouter、本地 Ollama……)散落在十几个配置文件里。想换一把 key?先想清楚它粘在了哪儿。
-- **主力供应商一限流或宕机**,活儿干到一半就断。切备用?又得改一轮配置。
-- 你试过 **one-api / new-api 这类网关**,它们在格式之间做*翻译*——然后你遇到丢字段、流式错乱、新参数要等网关适配才能用。
+- **保护云端 key:** 真实的公网供应商 key 只保存在自己的网关里。客户端工具拿到的是本地网关 key,即使工具配置泄露,也不会直接暴露上游账号。
+- **自定义模型接口:** 对工具暴露稳定的模型名。供应商、部署方式或价格变化时,只需要更新映射和路由,客户端配置不用改。
+- **明确多协议:** 显式选择 OpenAI 或 Anthropic 格式并原样转发。你清楚每个工具和后端到底用什么协议,上游新字段也不需要等转换层适配。
+- **轻到敢直接改:** 一个专注的 TypeScript 代码库,无数据库、文件存储。拿过去就能读懂和修改,不用先啃一个过于复杂、不适合个人使用的重型网关。
-MyAPIKey 就是为治这些而生的。
-## 你能得到什么
-- **一个地址 + 一把 key。** 所有工具都指向 `http://你的机器:7800`,只用一把 `sk-myapikey-…`。真实供应商 key 只存在网关里——轮换、换后端,都不用再碰任何工具的配置。
-- **自动故障转移 + 熔断。** 给同一个模型配一条有序的后端链:429 / 5xx / 超时自动切下一条;连续失败的后端进入冷却(30 秒 → 5 分钟),后续请求先跳过它。你的 agent 毫无感知。
-- **纯透传,零翻译。** OpenAI 格式的调用只发给说 OpenAI 格式的后端,Anthropic 同理——请求/响应逐字节转发,流式直通。上游新出的字段、新参数,不需要网关"适配"就能用。
-- **限流靠排队,不甩 429。** 给每个后端设 rpm 上限,或给模型设匀速节奏;超出的调用先在网关排队,而不是直接把 429 甩回工具。
-- **模型名映射。** 对工具暴露一个好记的名字(`claude-sonnet-4`);每个后端各自映射到真实 id(这里发 `claude-sonnet-4-20250514`,那边发别的)。
-- **每个槽位可固定默认 thinking 档位。** 在路由上钉死一个推理档位 / 预算,覆盖请求里带的设置——想管住 Claude Code 的思考行为,网关说了算。
-- **全程看得见。** Web 界面(中/英):实时调用日志、成功率、p50/p95 延迟,按模型 / 来源 / 日期的统计;CLI 功能完全对等。
-- **轻得没负担。** 无数据库——一个 `data.json` 加一个 `logs.jsonl`;`npx` 一行起跑;为局域网 / 家用服务器设计。
-## 60 秒跑起来
+## Quick start
 需要 Node.js 18+。
 ```bash
-npx myapikey serve          # → http://localhost:7800
+npx myapikey
 ```
-首次启动会打印凭据,并同时存到 `~/.myapikey/credentials.txt`:
+打开 `http://localhost:7800`,首次使用时设置网页用户名和密码,然后登录。
-1. 浏览器打开 `http://localhost:7800`,用打印出来的**用户名 / 密码**登录(网页管理用)。
-2. **模型**页 → **添加后端**:填后端的 base URL + 它的真实 key,勾选它说的格式(`openai` / `anthropic`),然后**刷新模型** → 在对应格式上**启用**你想要的。
-3. 把工具指过来——所有工具里的 "API key" 字段都填**网关 key**,不是网页登录密码:
+1. 在 **Models** 中添加后端的真实 base URL 和 API key,选择格式(`openai` / `anthropic`),刷新模型并启用需要的模型。
+2. 让工具指向网关,使用生成的 `sk-myapikey-…`,**不要**填网页登录密码:
 ```bash
-# Claude Code / Anthropic 系
+# Claude Code / Anthropic SDK
 export ANTHROPIC_BASE_URL=http://localhost:7800/anthropic
 export ANTHROPIC_API_KEY=sk-myapikey-…
-# OpenAI 兼容工具(Codex、各种 CLI / 插件)
+# OpenAI 兼容工具
 export OPENAI_BASE_URL=http://localhost:7800/openai/v1
 export OPENAI_API_KEY=sk-myapikey-…
 ```
-> 为什么一个是 `…/openai/v1` 一个是 `…/anthropic`?各生态 SDK 自己补路径(OpenAI 补 `/chat/completions`,Anthropic 补 `/v1/messages`),网关按各自的约定来。两边各有独立的 `/models`,只列出各自格式启用的模型。`myapikey whoami` 随时打印这些可直接粘贴的配置。
-4. 不开工具也能冒烟测试:
-```bash
-myapikey call gpt-4o-mini "用一句话介绍你自己"
-```
-喜欢全程命令行?`provider add` → `provider models` → `model enable` 干的是同一件事,速查表在下面。
-## 路由是怎么回事(就这么多)
-- 网关开两个入口:`/openai/v1/*`(chat completions、responses、models)和 `/anthropic/v1/*`(messages、models)。请求从哪个口进,就按哪个口的格式转发,**绝不翻译**。
-- 每个模型在每个格式上有一条独立、有序的后端链。链内按序故障转移:429 / 5xx / 超时切下一条;其他 4xx 原样返回(那是调用方的错);开始流式后不再切换。该格式下没有任何后端能服务这个模型,就返回 `404`——宁可失败得明明白白,也不悄悄翻译。
-- 只要"会说"这两种格式的都能接:OpenAI、Anthropic、OpenRouter、Ollama / vLLM、火山 Ark、公司内部网关……
+OpenAI 的 base URL 含版本段(`/v1`、`/api/v3`);Anthropic 的 base URL 不含它。
-## 为什么不做翻译?
+## What it does
-one-api / new-api 在 OpenAI ↔ Anthropic 之间做格式转换,方便是方便,但字段会丢、流式会乱,上游出新参数还得等网关更新;OpenRouter 是托管服务,每次调用抽成。MyAPIKey 的答案是干脆没有翻译层:
+- **统一入口:** Claude Code、OpenAI 兼容 CLI、插件和脚本共用一个地址和网关 key。
+- **纯透传:** OpenAI 请求发给 OpenAI 格式后端,Anthropic 请求发给 Anthropic 格式后端;请求体和流式响应不翻译,上游新参数无需等待网关适配。
+- **可靠性:** 按模型和格式配置有序后端。`429`、`5xx`、超时自动切换;连续失败触发 30 秒到 5 分钟冷却。流式开始后不再重试。
+- **限流控制:** 后端 RPM 或模型匀速节奏会让超限请求排队,而不是立即返回 `429`。
+- **易记路由:** 对外暴露简洁模型名,并映射到每个后端的真实模型 ID;可按路由固定默认 thinking 档位。
+- **运行可见:** 中英文 Web UI 提供实时日志、成功率,以及按模型、后端、日期统计的 p50/p95 延迟。
+- **轻量存储:** 无数据库,只有 `data.json` 和 `logs.jsonl`。
-| | MyAPIKey | one-api / new-api | OpenRouter |
-|---|---|---|---|
-| 部署 | 自托管,`npx` 一行 | 自托管,较重 | 托管服务 |
-| 费用 | 免费 | 免费 | 按次加价 |
-| 格式 | 逐字节透传 | 翻译 | 翻译 |
-| 上游新参数 | 立即可用 | 等网关适配 | 等平台适配 |
-| 供应商 key | 在你自己机器上 | 在你自己机器上 | 在平台手里 |
+请求通过 `/openai/v1/*` 或 `/anthropic/v1/*` 进入,并保持原格式转发。模型和格式不匹配返回 `404`;调用方自身的 `4xx` 错误原样返回。如果你需要 OpenAI ↔ Anthropic 格式互转,这个网关明确不提供该能力。
-代价也直说:Anthropic 格式的后端没法从 OpenAI 入口调。如果你要的就是格式互转,这个工具暂时不适合你。
+## Operations
-## 怎么管
-**Web 界面** — `http://localhost:7800`,中英双语。五个页:**使用方式**(可直接粘贴的连接配置)、**模型**(后端、发现、按格式启用、拖拽排序、名称映射、测试调用)、**最近调用**(实时时间线)、**统计**(调用数 / 成功率 / p50 / p95,按模型 / 来源 / 日期)、**设置**(轮换 key、改密码、熔断状态、存储位置)。
-**CLI 速查**(和网页同一套 admin API,两边永远一致):
-| 我想…… | 命令 |
-|---|---|
-| 起网关 | `myapikey serve [--port 7800] [--data-dir <目录>]` |
-| 打印要粘给工具的配置 | `myapikey whoami` |
-| 加后端 | `myapikey provider add <名> --base-url-openai https://api.openai.com/v1 --key sk-… --formats openai` |
-| 看后端有哪些模型 | `myapikey provider models <名>` |
-| 启用模型 | `myapikey model enable <模型> --format openai --via <后端>` |
-| 加备用 + 排序 | `myapikey model add-provider <模型> <后端> --format openai` · `myapikey model prioritize <模型> <主> <备> --format openai` |
-| 看路由表 | `myapikey model list` |
-| 给模型设匀速限速 | `myapikey model pace <模型> <rpm\|0>` |
-| 钉死槽位 thinking 档位 | `myapikey model thinking <模型> <链上位次> [档位] --format <格式>` |
-| 快速试一把 | `myapikey call <模型> "你好"` |
-> OpenAI 的 base URL **含**版本段(`/v1`、火山 Ark 的 `/api/v3`);Anthropic 的 base URL **不含**(`https://api.anthropic.com`)。`responses` 格式只接受你标记了 `supportsResponses` 的后端(网页里勾选)。
-> CLI 全局参数:`-u/--url`、`--user`、`--pass`、`--api-key`,或环境变量 `MYAPIKEY_URL` / `MYAPIKEY_USER` / `MYAPIKEY_PASS` / `MYAPIKEY_API_KEY`。
-## 数据都在哪
-一个目录(默认 `~/.myapikey`,可用 `--data-dir` 或 `MYAPIKEY_DATA_DIR` 改):
+数据默认在 `~/.myapikey`;可用 `--data-dir` 或 `MYAPIKEY_DATA_DIR` 覆盖。
 | 文件 | 内容 |
 |---|---|
-| `data.json` | 全部配置:后端、路由表、账号、API key |
-| `logs.jsonl` | 调用历史(保留约 90 天 / 100 万行) |
-| `credentials.txt` | 明文的登录信息 + API key,每次启动重写 |
-| `client.json` | CLI 自己存的连接配置 |
+| `data.json` | 后端、路由、账号和网关 API key |
+| `logs.jsonl` | 调用历史(约 90 天 / 100 万行) |
+Web UI 包含 Connect、Models、Logs、Stats 和 Settings。设置页可轮换网关 key、修改密码。工具为单用户设计且不内置 TLS;暴露到可信网络之外时请使用反向代理。
-## 开发
+## Development
 ```bash
 npm install
-npm run build:web      # 把 Vue 界面构建到 packages/web/dist
-npm run dev            # 网关,带 watch 热重载
-npm run dev:web        # vite 开发服务器(API 代理到 :7800)
-npm test               # vitest 单测 + 集成
-npm run typecheck      # tsc + vue-tsc
+npm run build:web
+npm run dev
+npm run dev:web
+npm test
+npm run typecheck
 ```
-## 丑话说在前面
-- **不做 OpenAI ↔ Anthropic 翻译。** 入口和模型格式对不上 → `404`。
-- **单用户、无 TLS。** 给你自己的内网用的;要暴露到外网请自己套反代。
-- **网页密码 ≠ API key。** 密码只管 UI/CLI,agent 只认 `sk-myapikey-…`。工具配置泄露了,去设置页轮换 key,其他什么都不用动。