neuroalpha 0.0.0-stage → 0.2.0

package/server/index.js

@@ -0,0 +1,92 @@
+import http from 'node:http';
+import os from 'node:os';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import express from 'express';
+import { WebSocketServer } from 'ws';
+import { ROOT, PORT } from './config.js';
+import { activeModelInfo } from './llm/client.js';
+import { markStaleRuns, removeLegacyData, removeOrphanEvents } from './db.js';
+import { createRouter } from './api/routes.js';
+import { authMiddleware, activateLocalLicense } from './auth/index.js';
+import { live } from './model/live.js';
+import { runningResearch, runningStability } from './model/research.js';
+import { startNews } from './news/index.js';
+import { startNotifyPolling } from './notify/index.js';
+import { startBrokerScheduler } from './brokers/index.js';
+import { chatState } from './strategist/index.js';
+import { hub } from './hub.js';
+
+markStaleRuns();
+removeLegacyData();
+removeOrphanEvents();
+
+const app = express();
+app.use(express.json({ limit: '1mb' }));
+app.use(authMiddleware);
+const server = http.createServer(app);
+const wss = new WebSocketServer({ server, path: '/ws' });
+
+hub.setSender((msg) => {
+  const data = JSON.stringify(msg);
+  for (const c of wss.clients) if (c.readyState === 1) c.send(data);
+});
+
+wss.on('connection', (ws) => {
+  ws.send(JSON.stringify({ type: 'hello', live: live.status(), chat: chatState(), running: runningResearch(), stabilityRunning: runningStability(), llm: activeModelInfo() }));
+});
+
+live.resume();
+startNews();
+startNotifyPolling();
+startBrokerScheduler();
+
+if (process.env.NEUROALPHA_API_KEY) {
+  activateLocalLicense(process.env.NEUROALPHA_API_KEY, process.env.CLOUD_URL || '')
+    .then((lic) => console.log(`✓ Активирован API-ключ: тариф «${lic.planName}» (${lic.email})`))
+    .catch((e) => console.warn(`⚠ Проверка API-ключа: ${e.message}`));
+}
+
+app.get('/landing', (req, res) => res.sendFile(path.join(ROOT, 'public', 'landing.html')));
+app.get('/legal', (req, res) => res.sendFile(path.join(ROOT, 'public', 'legal.html')));
+app.get('/', (req, res, next) => {
+  if (process.env.CLOUD_MODE === '1' && !req.user && req.query.terminal !== '1' && !req.query.run) {
+    return res.sendFile(path.join(ROOT, 'public', 'landing.html'));
+  }
+  next();
+});
+app.use('/api', createRouter());
+app.use('/docs', express.static(path.join(ROOT, 'docs')));
+app.use(express.static(path.join(ROOT, 'public')));
+
+function lanUrls() {
+  return Object.values(os.networkInterfaces()).flat()
+    .filter((a) => a && a.family === 'IPv4' && !a.internal)
+    .map((a) => `http://${a.address}:${PORT}`);
+}
+
+wss.on('error', () => {});
+server.on('error', (e) => {
+  if (e.code === 'EADDRINUSE') console.error(`Порт ${PORT} занят: сервер уже запущен? Клиент: http://localhost:${PORT}`);
+  else console.error(e);
+  process.exit(1);
+});
+
+server.listen(PORT, () => {
+  console.log('Консорциум агентов запущен');
+  const llm = activeModelInfo();
+  console.log(`ИИ-стратег: ${llm.enabled ? `${llm.provider} · ${llm.model}` : 'выключен (нет модели или ключа: Настройки → Модели ИИ)'}`);
+  for (const url of lanUrls()) console.log(`  В локальной сети: ${url}`);
+  console.log(`Клиент: http://localhost:${PORT}`);
+  if (process.env.OPEN_BROWSER === '1') openBrowser(`http://localhost:${PORT}`);
+});
+
+function openBrowser(url) {
+  const [cmd, args] = process.platform === 'win32' ? ['cmd', ['/c', 'start', '""', url]]
+    : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
+  spawn(cmd, args, { detached: true, stdio: 'ignore', windowsHide: true, windowsVerbatimArguments: true }).on('error', () => {}).unref();
+}
+
+const shutdown = () => { live.suspend().finally(() => server.close(() => process.exit(0))); setTimeout(() => process.exit(0), 2000); };
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);

package/server/llm/client.js

@@ -0,0 +1,187 @@
+import { llmConfig } from '../config.js';
+import { resolveActive, isReady, providerFetch } from './providers.js';
+
+export const llmStats = { calls: 0, errors: 0, totalMs: 0, lastError: null, lastAt: null };
+
+export function activeModelInfo() {
+  const t = resolveActive();
+  return {
+    enabled: isReady(t),
+    provider: t?.provider.name || '',
+    providerId: t?.provider.id || '',
+    protocol: t?.protocol || '',
+    model: t?.model || '',
+    label: t?.label || '',
+    tools: !!t?.tools,
+  };
+}
+
+export const isLlmEnabled = () => isReady(resolveActive());
+
+// Потоковый запрос к модели. onDelta({ reasoning?, content? }) вызывается по мере генерации.
+// Возвращает { content, reasoning, toolCalls, finishReason }.
+// Таймаут — «нет новых данных idleMs», а не на весь ответ; signal позволяет прервать запрос.
+// target — явно заданная модель (проверка подключения); по умолчанию — выбранная в реестре.
+export async function chatStream(messages, { tools, maxTokens = llmConfig.maxTokens, temperature = 0.2, onDelta = () => {}, signal, idleMs = llmConfig.timeoutMs, target } = {}) {
+  const t = target || resolveActive();
+  if (!isReady(t)) throw new Error('ИИ не настроен: выберите модель в «Настройки → Модели ИИ»');
+  const started = Date.now();
+  if (!target) llmStats.calls++;
+  try {
+    const r = t.protocol === 'anthropic'
+      ? await anthropic(t, messages, maxTokens, temperature, onDelta, signal, idleMs)
+      : await openaiStream(t, messages, { tools, maxTokens, temperature, onDelta, signal, idleMs });
+    if (!target) { llmStats.totalMs += Date.now() - started; llmStats.lastAt = Date.now(); }
+    return r;
+  } catch (e) {
+    if (!target) { llmStats.errors++; llmStats.lastError = e.message; }
+    throw e;
+  }
+}
+
+export async function chat(messages, opts = {}) {
+  const r = await chatStream(messages, opts);
+  if (!r.content) throw new Error(`Пустой ответ ИИ (finish_reason=${r.finishReason})`);
+  return r.content;
+}
+
+// GigaChat (формат functions): один вызов функции на сообщение, результат — сообщением с ролью function
+function gigaMessages(messages) {
+  const results = new Map(messages.filter((m) => m.role === 'tool').map((m) => [m.tool_call_id, m.content]));
+  const out = [];
+  for (const m of messages) {
+    if (m.role === 'tool') continue;
+    if (m.role !== 'assistant' || !m.tool_calls?.length) { out.push({ role: m.role, content: m.content ?? '' }); continue; }
+    for (const c of m.tool_calls) {
+      let args = {};
+      try { args = JSON.parse(c.function.arguments || '{}') || {}; } catch { /* пустые аргументы */ }
+      out.push({ role: 'assistant', content: '', function_call: { name: c.function.name, arguments: args } });
+      out.push({ role: 'function', name: c.function.name, content: results.get(c.id) ?? '{}' });
+    }
+  }
+  return out;
+}
+
+async function openaiStream(t, messages, { tools, maxTokens, temperature, onDelta, signal, idleMs }) {
+  const giga = t.protocol === 'gigachat';
+  const body = { model: t.model, messages: giga ? gigaMessages(messages) : messages, max_tokens: maxTokens, temperature, stream: true };
+  if (t.effort && !giga) body.reasoning_effort = t.effort;
+  if (tools?.length && t.tools) {
+    if (giga) { body.functions = tools.map((x) => x.function); body.function_call = 'auto'; }
+    else { body.tools = tools; body.tool_choice = 'auto'; }
+  }
+
+  const ctrl = new AbortController();
+  let idleTimer;
+  let timedOut = false;
+  const resetIdle = () => {
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => { timedOut = true; ctrl.abort(); }, idleMs);
+  };
+  const onAbort = () => ctrl.abort();
+  signal?.addEventListener('abort', onAbort);
+  resetIdle();
+
+  const out = { content: '', reasoning: '', toolCalls: [], finishReason: null };
+  // Часть серверов отдаёт размышления внутри content в тегах <think>…</think>
+  let inThink = false;
+  const pushContent = (text) => {
+    let rest = text;
+    while (rest) {
+      if (inThink) {
+        const end = rest.indexOf('</think>');
+        const part = end < 0 ? rest : rest.slice(0, end);
+        if (part) { out.reasoning += part; onDelta({ reasoning: part }); }
+        if (end < 0) break;
+        inThink = false;
+        rest = rest.slice(end + 8);
+      } else {
+        const start = rest.indexOf('<think>');
+        const part = start < 0 ? rest : rest.slice(0, start);
+        if (part) { out.content += part; onDelta({ content: part }); }
+        if (start < 0) break;
+        inThink = true;
+        rest = rest.slice(start + 7);
+      }
+    }
+  };
+
+  try {
+    const res = await providerFetch(t.provider, t.url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'text/event-stream' },
+      body: JSON.stringify(body),
+      signal: ctrl.signal,
+    });
+    if (!res.ok) throw new Error(`ИИ HTTP ${res.status}: ${(await res.text()).slice(0, 300)}`);
+    const dec = new TextDecoder();
+    let buf = '';
+    for await (const chunk of res.body) {
+      resetIdle();
+      buf += dec.decode(chunk, { stream: true });
+      let nl;
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (!line.startsWith('data:')) continue;
+        const data = line.slice(5).trim();
+        if (!data || data === '[DONE]') continue;
+        let j;
+        try { j = JSON.parse(data); } catch { continue; }
+        if (j.error) throw new Error(`ИИ: ${j.error.message || JSON.stringify(j.error)}`);
+        const c = j.choices?.[0];
+        if (!c) continue;
+        if (c.finish_reason) out.finishReason = c.finish_reason;
+        const d = c.delta || {};
+        const r = d.reasoning ?? d.reasoning_content;
+        if (r) { out.reasoning += r; onDelta({ reasoning: r }); }
+        if (d.content) pushContent(d.content);
+        for (const tc of d.tool_calls || []) {
+          const x = (out.toolCalls[tc.index ?? 0] ||= { id: '', type: 'function', function: { name: '', arguments: '' } });
+          if (tc.id) x.id = tc.id;
+          if (tc.function?.name) x.function.name += tc.function.name;
+          if (tc.function?.arguments) x.function.arguments += tc.function.arguments;
+        }
+        if (d.function_call) {
+          const x = (out.toolCalls[0] ||= { id: '', type: 'function', function: { name: '', arguments: '' } });
+          if (d.function_call.name) x.function.name += d.function_call.name;
+          const a = d.function_call.arguments;
+          if (a) x.function.arguments += typeof a === 'string' ? a : JSON.stringify(a);
+        }
+      }
+    }
+  } catch (e) {
+    if (signal?.aborted) throw new Error('Остановлено пользователем');
+    if (timedOut) throw new Error(`ИИ не присылал данных ${Math.round(idleMs / 1000)} сек`);
+    throw e;
+  } finally {
+    clearTimeout(idleTimer);
+    signal?.removeEventListener('abort', onAbort);
+  }
+  out.toolCalls = out.toolCalls.filter(Boolean).map((x, i) => ({ ...x, id: x.id || `call_${Date.now()}_${i}` }));
+  return out;
+}
+
+async function anthropic(t, messages, maxTokens, temperature, onDelta, signal, idleMs) {
+  const system = messages.filter((m) => m.role === 'system').map((m) => m.content).join('\n\n');
+  const body = { model: t.model, system, max_tokens: maxTokens, temperature, messages: messages.filter((m) => m.role !== 'system' && m.role !== 'tool') };
+  const res = await providerFetch(t.provider, t.url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(idleMs)]) : AbortSignal.timeout(idleMs),
+  });
+  const text = await res.text();
+  if (!res.ok) throw new Error(`ИИ HTTP ${res.status}: ${text.slice(0, 300)}`);
+  const j = JSON.parse(text);
+  const content = (j.content || []).filter((c) => c.type === 'text').map((c) => c.text).join('');
+  onDelta({ content });
+  return { content, reasoning: '', toolCalls: [], finishReason: j.stop_reason };
+}
+
+export function extractJson(text) {
+  const cleaned = text.replace(/<think>[\s\S]*?<\/think>/g, '').replace(/```(?:json)?/g, '');
+  const a = cleaned.indexOf('{'), b = cleaned.lastIndexOf('}');
+  if (a < 0 || b <= a) throw new Error('В ответе ИИ нет JSON');
+  return JSON.parse(cleaned.slice(a, b + 1));
+}

package/server/llm/providers.js

@@ -0,0 +1,355 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import https from 'node:https';
+import tls from 'node:tls';
+import crypto from 'node:crypto';
+import { Readable } from 'node:stream';
+import { ROOT, llmConfig } from '../config.js';
+import { kvGet, kvSet } from '../db.js';
+import { encryptSecret, decryptSecret } from '../auth/index.js';
+import { chatStream } from './client.js';
+
+const PROTOCOLS = ['openai', 'anthropic', 'gigachat', 'ollama'];
+const DEFAULT_URL = {
+  openai: '',
+  anthropic: 'https://api.anthropic.com/v1/messages',
+  gigachat: 'https://gigachat.devices.sberbank.ru/api/v1/chat/completions',
+  ollama: 'http://localhost:11434/v1/chat/completions',
+};
+const GIGA_AUTH = 'https://ngw.devices.sberbank.ru:9443/api/v2/oauth';
+const GIGA_SCOPE = 'GIGACHAT_API_PERS';
+const CERT_CODES = new Set(['UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'SELF_SIGNED_CERT_IN_CHAIN', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'UNABLE_TO_GET_ISSUER_CERT', 'CERT_UNTRUSTED', 'CERT_HAS_EXPIRED']);
+
+// ---------- ключи ----------
+function readSecret(ref) {
+  if (!ref) return '';
+  if (ref === 'env:LLM') return llmConfig.apiKey;
+  if (ref.startsWith('env:')) return (process.env[ref.slice(4)] || '').trim();
+  try {
+    const raw = fs.readFileSync(path.resolve(ROOT, ref), 'utf8').replace(/^\uFEFF/, '').trim();
+    if (!raw.startsWith('{')) return raw;
+    const j = JSON.parse(raw);
+    return String(j.apiKey || j.api_key || j.token || j.key || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+export function getKey(p) {
+  let key = decryptSecret(p.apiKey || '') || readSecret(p.keyFile);
+  if (!key && p.protocol === 'gigachat') key = (process.env.GIGACHAT_KEY || '').trim();
+  return key;
+}
+
+// ---------- адреса ----------
+export function chatUrl(p) {
+  const base = String(p.baseUrl || DEFAULT_URL[p.protocol] || '').trim().replace(/\/+$/, '');
+  if (!base) return '';
+  const tail = p.protocol === 'anthropic' ? '/messages' : '/chat/completions';
+  if (base.endsWith(tail)) return base;
+  let u;
+  try { u = new URL(base); } catch { return base; }
+  if (u.pathname === '/' || u.pathname === '') return `${base}/v1${tail}`;
+  if (u.pathname.endsWith('/v1')) return base + tail;
+  return base;
+}
+
+function modelsUrls(p) {
+  const url = chatUrl(p);
+  let origin;
+  try { origin = new URL(url).origin; } catch { return []; }
+  if (p.protocol === 'ollama') return [`${origin}/api/tags`, `${origin}/v1/models`];
+  const list = [];
+  if (url.endsWith('/chat/completions')) list.push(`${url.slice(0, -'/chat/completions'.length)}/models`);
+  else if (url.endsWith('/messages')) list.push(`${url.slice(0, -'/messages'.length)}/models`);
+  list.push(`${origin}/v1/models`);
+  return [...new Set(list)];
+}
+
+// ---------- сеть ----------
+// Сертификат НУЦ Минцифры для GigaChat: путь задаётся у подключения или в GIGACHAT_CA_FILE
+const caCache = new Map();
+function caList(p) {
+  const file = String(p.caFile || process.env.GIGACHAT_CA_FILE || '').trim();
+  if (!file) return null;
+  if (!caCache.has(file)) {
+    try { caCache.set(file, [...tls.rootCertificates, fs.readFileSync(path.resolve(ROOT, file), 'utf8')]); } catch { caCache.set(file, null); }
+  }
+  return caCache.get(file);
+}
+
+function certError(e) {
+  const msg = String(e?.message || e);
+  if (CERT_CODES.has(e?.code) || /certificate|self.signed/i.test(msg)) {
+    const err = new Error('GigaChat: нужен сертификат НУЦ Минцифры — укажите путь к russian_trusted_root_ca.pem в настройках подключения (поле «Сертификат») или в переменной GIGACHAT_CA_FILE');
+    err.fatal = true;
+    return err;
+  }
+  return null;
+}
+
+// Запрос с проверкой TLS по корню НУЦ Минцифры — только для GigaChat, остальные соединения не затрагиваются
+function nodeFetch(url, { method = 'GET', headers = {}, body, signal, ca } = {}) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : Buffer.from(body);
+    const req = https.request(new URL(url), { method, ca: ca || undefined, headers: { ...headers, ...(data ? { 'Content-Length': data.length } : {}) } }, (res) => {
+      const h = new Headers();
+      for (const [k, v] of Object.entries(res.headers)) for (const x of [].concat(v)) h.append(k, x);
+      resolve(new Response(Readable.toWeb(res), { status: res.statusCode, headers: h }));
+    });
+    req.on('error', reject);
+    const onAbort = () => req.destroy(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+    if (signal?.aborted) return onAbort();
+    signal?.addEventListener('abort', onAbort, { once: true });
+    req.on('close', () => signal?.removeEventListener('abort', onAbort));
+    req.end(data);
+  });
+}
+
+async function rawFetch(p, url, init) {
+  try {
+    return p.protocol === 'gigachat' ? await nodeFetch(url, { ...init, ca: caList(p) || undefined }) : await fetch(url, init);
+  } catch (e) {
+    if (e.name === 'AbortError') throw e;
+    const ce = p.protocol === 'gigachat' ? certError(e) : null;
+    if (ce) throw ce;
+    let host = url;
+    try { host = new URL(url).host; } catch { /* как есть */ }
+    const code = e.cause?.code || e.code;
+    const why = code === 'ECONNREFUSED' ? 'отказано в соединении (сервер не запущен?)' : code === 'ENOTFOUND' ? 'адрес не найден' : code || e.cause?.message || e.message;
+    const err = new Error(`нет связи с ${host}: ${why}`);
+    err.fatal = e.cause?.code === 'ECONNREFUSED';
+    throw err;
+  }
+}
+
+const tokens = new Map();
+async function gigaToken(p) {
+  const c = tokens.get(p.id);
+  if (c && c.exp - 60000 > Date.now()) return c.token;
+  const key = getKey(p).replace(/^Basic\s+/i, '');
+  if (!key) throw Object.assign(new Error('GigaChat: не указан ключ авторизации'), { fatal: true });
+  const res = await rawFetch(p, p.authUrl || GIGA_AUTH, {
+    method: 'POST',
+    headers: { Authorization: `Basic ${key}`, RqUID: crypto.randomUUID(), 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body: `scope=${encodeURIComponent(p.scope || GIGA_SCOPE)}`,
+    signal: AbortSignal.timeout(20000),
+  });
+  const text = await res.text();
+  if (!res.ok) throw Object.assign(new Error(`GigaChat: авторизация не удалась (HTTP ${res.status}): ${text.slice(0, 200)}`), { fatal: res.status < 500 });
+  const j = JSON.parse(text);
+  if (!j.access_token) throw new Error('GigaChat: сервер не вернул токен доступа');
+  tokens.set(p.id, { token: j.access_token, exp: Number(j.expires_at) || Date.now() + 29 * 60000 });
+  return j.access_token;
+}
+
+async function authHeaders(p) {
+  if (p.protocol === 'gigachat') return { Authorization: `Bearer ${await gigaToken(p)}` };
+  const key = getKey(p);
+  if (!key) return {};
+  if (p.protocol === 'anthropic') return { 'x-api-key': key, 'anthropic-version': '2023-06-01' };
+  return { Authorization: `Bearer ${key}` };
+}
+
+export async function providerFetch(p, url, init = {}) {
+  const go = async () => rawFetch(p, url, { ...init, headers: { ...init.headers, ...(await authHeaders(p)) } });
+  let res = await go();
+  if (res.status === 401 && p.protocol === 'gigachat' && tokens.delete(p.id)) res = await go();
+  return res;
+}
+
+// ---------- хранилище ----------
+// Подключения живут только в нашей базе. Единственная отправная точка — .env этого проекта
+// (если задан) — чтобы после первого запуска уже чем-то отвечать. Дальше всё настраивается в интерфейсе.
+let ready = false;
+function init() {
+  if (ready) return;
+  ready = true;
+  if (kvGet('llmProviders') === null) kvSet('llmProviders', []);
+  ensureEnv();
+  // разовая миграция: подключения, созданные до настройки сертификата в интерфейсе, получают прежний путь к сертификату НУЦ (только как данные — можно изменить или удалить)
+  if (!kvGet('gigaCaMigrated')) {
+    const list = kvGet('llmProviders', []);
+    const cert = path.resolve(ROOT, '../work/#system/certs/russian_trusted_root_ca.pem');
+    if (fs.existsSync(cert)) for (const p of list) if (p.protocol === 'gigachat' && !p.caFile) p.caFile = cert;
+    kvSet('llmProviders', list);
+    kvSet('gigaCaMigrated', true);
+  }
+  ensureEnv();
+  const list = kvGet('llmProviders', []);
+  if (!kvGet('llmSelected') && list.length) {
+    const hit = findEnv(list) || list.flatMap((p) => p.models.map((m) => ({ p, m }))).find(({ p }) => getKey(p) || p.protocol === 'ollama');
+    if (hit) kvSet('llmSelected', { providerId: hit.p.id, model: hit.m.id });
+  }
+}
+
+const load = () => { init(); return kvGet('llmProviders', []); };
+const save = (list) => kvSet('llmProviders', list.map((p) => (p.apiKey ? { ...p, apiKey: encryptSecret(p.apiKey) } : p)));
+const find = (id) => load().find((p) => p.id === id);
+const sameOrigin = (a, b) => { try { return new URL(a).origin === new URL(b).origin; } catch { return false; } };
+
+function findEnv(list) {
+  if (!llmConfig.model) return null;
+  for (const p of list) {
+    if (llmConfig.baseUrl && !sameOrigin(chatUrl(p), llmConfig.baseUrl)) continue;
+    const m = p.models.find((x) => x.id === llmConfig.model);
+    if (m) return { p, m };
+  }
+  return null;
+}
+
+function ensureEnv() {
+  if (llmConfig.provider === 'none' || !llmConfig.baseUrl || !llmConfig.model || !llmConfig.apiKey) return;
+  const list = kvGet('llmProviders', []);
+  const hit = findEnv(list);
+  if (hit) {
+    if (!hit.m.effort && llmConfig.reasoningEffort) hit.m.effort = llmConfig.reasoningEffort;
+  } else {
+    list.push({
+      id: 'env', name: 'Из .env', protocol: llmConfig.provider === 'anthropic' ? 'anthropic' : 'openai', baseUrl: llmConfig.baseUrl,
+      keyFile: 'env:LLM', models: [{ id: llmConfig.model, label: llmConfig.model, tools: llmConfig.provider !== 'anthropic', effort: llmConfig.reasoningEffort || '' }], source: 'env',
+    });
+  }
+  save(list);
+}
+
+const cleanModels = (models) => {
+  const seen = new Set();
+  const out = [];
+  for (const m of Array.isArray(models) ? models : []) {
+    const id = String(m?.id ?? '').trim();
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    out.push({ id, label: String(m.label || id).trim(), tools: m.tools !== false && m.tools !== 'false', ...(m.effort ? { effort: String(m.effort) } : {}) });
+  }
+  return out;
+};
+
+const view = (p) => {
+  const key = getKey(p);
+  return {
+    id: p.id, name: p.name, protocol: p.protocol, baseUrl: p.baseUrl || DEFAULT_URL[p.protocol] || '', authUrl: p.authUrl || '', scope: p.scope || '',
+    caFile: p.caFile || '', models: p.models, source: p.source, hasKey: !!key, needsKey: p.protocol !== 'ollama',
+    keySource: p.apiKey ? 'введён вручную' : p.keyFile ? (p.keyFile.startsWith('env:') ? '.env' : 'файл') : '',
+    editable: true,
+  };
+};
+
+export const listProviders = () => load().map(view);
+export const getSelected = () => { init(); return kvGet('llmSelected'); };
+
+// ---------- управление ----------
+const fieldsOf = (b, p = {}) => {
+  const protocol = b.protocol ?? p.protocol;
+  if (!PROTOCOLS.includes(protocol)) throw new Error('Неизвестный протокол');
+  const name = String(b.name ?? p.name ?? '').trim();
+  if (!name) throw new Error('Укажите название');
+  const baseUrl = String(b.baseUrl ?? p.baseUrl ?? '').trim() || DEFAULT_URL[protocol];
+  if (!baseUrl) throw new Error('Укажите адрес');
+  if (!/^https?:\/\//i.test(baseUrl)) throw new Error('Адрес должен начинаться с http:// или https://');
+  const out = { ...p, name, protocol, baseUrl };
+  if (protocol === 'gigachat') {
+    out.authUrl = String(b.authUrl ?? p.authUrl ?? '').trim() || GIGA_AUTH;
+    out.scope = String(b.scope ?? p.scope ?? '').trim() || GIGA_SCOPE;
+    out.caFile = String(b.caFile ?? p.caFile ?? '').trim();
+    if (!out.caFile) delete out.caFile;
+  } else {
+    delete out.authUrl;
+    delete out.scope;
+    delete out.caFile;
+  }
+  if (typeof b.apiKey === 'string' && b.apiKey.trim()) out.apiKey = b.apiKey.trim();
+  if (b.clearKey) { delete out.apiKey; delete out.keyFile; }
+  if (b.models !== undefined) out.models = cleanModels(b.models);
+  return out;
+};
+
+export function addProvider(body = {}) {
+  const list = load();
+  const p = { ...fieldsOf(body), id: `p_${Date.now().toString(36)}${crypto.randomBytes(2).toString('hex')}`, source: 'manual' };
+  p.models ||= [];
+  list.push(p);
+  save(list);
+  return view(p);
+}
+
+export function updateProvider(id, body = {}) {
+  const list = load();
+  const i = list.findIndex((p) => p.id === id);
+  if (i < 0) throw new Error('Подключение не найдено');
+  list[i] = fieldsOf(body, list[i]);
+  save(list);
+  tokens.delete(id);
+  return view(list[i]);
+}
+
+export function deleteProvider(id) {
+  const list = load();
+  if (!list.some((p) => p.id === id)) throw new Error('Подключение не найдено');
+  save(list.filter((p) => p.id !== id));
+  tokens.delete(id);
+  if (getSelected()?.providerId === id) kvSet('llmSelected', null);
+}
+
+export function selectModel(providerId, model) {
+  const p = find(providerId);
+  if (!p) throw new Error('Подключение не найдено');
+  if (!p.models.some((m) => m.id === model)) throw new Error('У подключения нет такой модели — добавьте её в список');
+  kvSet('llmSelected', { providerId, model });
+}
+
+export async function fetchRemoteModels(id) {
+  const p = find(id);
+  if (!p) throw new Error('Подключение не найдено');
+  let lastErr = 'адрес не задан';
+  for (const url of modelsUrls(p)) {
+    try {
+      const res = await providerFetch(p, url, { headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(15000) });
+      const text = await res.text();
+      if (!res.ok) { lastErr = `HTTP ${res.status}: ${text.slice(0, 150)}`; continue; }
+      const j = JSON.parse(text);
+      const ids = (Array.isArray(j.data) ? j.data : Array.isArray(j.models) ? j.models : []).map((m) => String(m?.id || m?.name || m?.model || m || '').trim()).filter(Boolean);
+      return [...new Set(ids)].map((mid) => ({ id: mid, added: p.models.some((m) => m.id === mid) }));
+    } catch (e) {
+      lastErr = e.message;
+      if (e.fatal) break;
+    }
+  }
+  throw new Error(`Не удалось получить список моделей: ${lastErr}`);
+}
+
+// ---------- активная модель ----------
+const toTarget = (p, m) => ({ provider: p, protocol: p.protocol, url: chatUrl(p), model: m.id, label: m.label || m.id, tools: !!m.tools && p.protocol !== 'anthropic', effort: m.effort || '' });
+
+export function resolveActive() {
+  const sel = getSelected();
+  const p = sel && find(sel.providerId);
+  const m = p?.models.find((x) => x.id === sel.model);
+  if (p && m) return toTarget(p, m);
+  if (llmConfig.provider !== 'none' && llmConfig.baseUrl && llmConfig.model) {
+    const protocol = llmConfig.provider === 'anthropic' ? 'anthropic' : 'openai';
+    return toTarget({ id: 'env', name: '.env', protocol, baseUrl: llmConfig.baseUrl, keyFile: 'env:LLM' }, { id: llmConfig.model, label: llmConfig.model, tools: true, effort: llmConfig.reasoningEffort });
+  }
+  return null;
+}
+
+export const isReady = (t) => !!t && !!t.url && !!t.model && (t.protocol === 'ollama' || !!getKey(t.provider));
+
+export async function testProvider(id, model) {
+  const p = find(id);
+  if (!p) return { ok: false, ms: 0, error: 'Подключение не найдено' };
+  const m = p.models.find((x) => x.id === model) || (model ? { id: model } : p.models[0]);
+  if (!m) return { ok: false, ms: 0, error: 'Не выбрана модель' };
+  const target = toTarget(p, m);
+  if (!isReady(target)) return { ok: false, ms: 0, error: p.protocol === 'gigachat' ? 'Не указан ключ авторизации' : 'Не указан ключ или адрес' };
+  const started = Date.now();
+  try {
+    const r = await chatStream([{ role: 'user', content: 'Ответь одним словом: «готов».' }], { target, maxTokens: 600, temperature: 0, idleMs: 30000 });
+    const ms = Date.now() - started;
+    const text = r.content.trim();
+    if (!text) return { ok: false, ms, error: `пустой ответ (finish_reason=${r.finishReason})` };
+    return { ok: true, ms, text: text.slice(0, 200) };
+  } catch (e) {
+    return { ok: false, ms: Date.now() - started, error: e.message };
+  }
+}