oh-my-agent-web 0.3.0 → 0.4.0

package/dist/server/providers/probe.js

@@ -0,0 +1,64 @@
+import { testModel } from "./model-test.js";
+import { providerHeaders } from "./request-headers.js";
+export async function probeProvider(options) {
+    let url;
+    try {
+        url = new URL(`${options.baseUrl.replace(/\/+$/, "")}/models`);
+    }
+    catch {
+        return { ok: false, message: "baseUrl 不是合法 URL" };
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return { ok: false, message: "只允许 http(s)" };
+    const doFetch = options.fetchImpl ?? fetch;
+    const started = Date.now();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 8000);
+    try {
+        const response = await doFetch(url.toString(), {
+            method: "GET",
+            headers: providerHeaders(options.api ?? "openai-completions", options.apiKey, options.headers),
+            signal: controller.signal,
+        });
+        const latencyMs = Date.now() - started;
+        if (response.ok)
+            return { ok: true, status: response.status, latencyMs };
+        // 401/403 说明地址通但 key 不对；其余按状态码报
+        return {
+            ok: false,
+            message: `${response.status}${response.status === 401 || response.status === 403 ? "（地址可达，key 可能不对）" : ""}`,
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { ok: false, message: /abort/i.test(message) ? "超时（8 秒内没有响应）" : `请求失败：${url.host}` };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function verifyProviderConfig(options) {
+    const probe = await probeProvider({
+        baseUrl: options.baseUrl,
+        api: options.api,
+        apiKey: options.apiKey,
+        ...(options.headers ? { headers: options.headers } : {}),
+        ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+    });
+    if (!probe.ok)
+        return { ok: false, step: "models", message: probe.message };
+    if (!options.modelId)
+        return { ok: true, status: probe.status ?? 200, latencyMs: probe.latencyMs };
+    const chat = await testModel({
+        baseUrl: options.baseUrl,
+        api: options.api,
+        apiKey: options.apiKey,
+        modelId: options.modelId,
+        ...(options.headers ? { headers: options.headers } : {}),
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+    });
+    if (!chat.ok)
+        return { ok: false, step: "chat", message: chat.message };
+    return { ok: true, status: probe.status ?? 200, latencyMs: probe.latencyMs, modelLatencyMs: chat.latencyMs };
+}

package/dist/server/providers/provider-handlers.js

@@ -0,0 +1,203 @@
+import { validateModelSpec, validateProviderInput } from "./validate.js";
+import { toggleModel, toggleProvider } from "./enabled-models.js";
+/** 返回 null = 不是 provider 相关请求（交回主分发） */
+export async function handleProviderRequest(request, deps) {
+    if (request.type === "list_providers")
+        return { ok: true, result: { providers: await deps.store.list(deps.builtinProviders()) } };
+    if (request.type === "upsert_provider") {
+        const parsed = validateProviderInput(request.payload);
+        if (!parsed.ok) {
+            const message = parsed.errors.join("；");
+            deps.notify(`provider 配置有问题：${message}`, "error");
+            return { ok: false, error: { code: "provider.invalid", message } };
+        }
+        const result = await deps.store.upsert(parsed.value);
+        if (!result.ok) {
+            deps.notify(`provider 保存失败：${result.error}`, "error");
+            return { ok: false, error: { code: "provider.upsert_failed", message: result.error } };
+        }
+        deps.logInfo("provider 已保存", {
+            provider: result.view.provider,
+            hasKey: result.view.hasKey,
+            models: result.view.models.length,
+        });
+        const from = request.payload?.previousProvider;
+        const what = from
+            ? `provider「${from}」已改名为「${result.view.provider}」`
+            : `provider「${result.view.provider}」已保存`;
+        deps.notify(`${what}：${result.view.models.length} 个模型${result.view.hasKey ? `，key ${result.view.keyHint}` : ""}（已热重载）`, "info");
+        return { ok: true, result: { provider: result.view } };
+    }
+    if (request.type === "update_model") {
+        const payload = request.payload;
+        const parsed = validateModelSpec(payload.model);
+        if (!parsed.ok) {
+            const message = parsed.errors.join("；");
+            deps.notify(`模型信息有问题：${message}`, "error");
+            return { ok: false, error: { code: "model.invalid", message } };
+        }
+        const view = await deps.store.get(payload.provider, deps.builtinProviders());
+        const seed = view?.source === "builtin"
+            ? { baseUrl: view.baseUrl, api: view.api, models: view.models.map((m) => ({ id: m.id, name: m.name })) }
+            : undefined;
+        const result = await deps.store.updateModel(payload.provider, parsed.value, seed);
+        if (!result.ok) {
+            deps.notify(`保存模型失败：${result.error}`, "error");
+            return { ok: false, error: { code: "model.update_failed", message: result.error } };
+        }
+        deps.notify(`模型「${parsed.value.name}」已保存，模型表已热重载`, "info");
+        return { ok: true };
+    }
+    if (request.type === "set_enabled_models") {
+        const payload = request
+            .payload;
+        // provider === "*"：全开（pi 的语义是「没有白名单 = 不限制」）
+        if (payload.provider === "*") {
+            await deps.enabled.write([]);
+            deps.notify("已启用全部模型（清空 enabledModels 白名单）", "info");
+            return { ok: true, result: { enabledModels: [] } };
+        }
+        const patterns = await deps.enabled.read();
+        const builtins = deps.builtinProviders();
+        // 内置 provider 也在名单里：否则 view 为 null，modelIds 为空，
+        // 「停用其中一个模型」会被展开成 []（= 禁用整个 provider）
+        const view = await deps.store.get(payload.provider, builtins);
+        // 全开状态下停用一个 provider，需要知道「其它 provider 有哪些模型」才能展开成白名单
+        const universe = (await deps.store.list(builtins)).map((item) => ({
+            provider: item.provider,
+            models: item.models.map((model) => model.id),
+        }));
+        const modelIds = (view?.models ?? []).map((model) => model.id);
+        const next = payload.modelId
+            ? toggleModel(patterns, payload.provider, modelIds, payload.modelId, payload.enabled, universe)
+            : toggleProvider(patterns, payload.provider, modelIds, payload.enabled, universe);
+        await deps.enabled.write(next);
+        const what = payload.modelId ? `模型「${payload.modelId}」` : `provider「${payload.provider}」`;
+        deps.notify(`${what}${payload.enabled ? "已启用" : "已停用"}（写进 pi 的 settings.json）`, "info");
+        return { ok: true, result: { enabledModels: next } };
+    }
+    if (request.type === "remove_model") {
+        const payload = request.payload;
+        const view = await deps.store.get(payload.provider, deps.builtinProviders());
+        const seed = view?.source === "builtin"
+            ? { baseUrl: view.baseUrl, api: view.api, models: view.models.map((m) => ({ id: m.id, name: m.name })) }
+            : undefined;
+        const result = await deps.store.removeModel(payload.provider, payload.modelId, seed);
+        if (!result.ok) {
+            deps.notify(`移除模型失败：${result.error}`, "error");
+            return { ok: false, error: { code: "model.remove_failed", message: result.error } };
+        }
+        deps.notify(`已从「${payload.provider}」移除模型：${payload.modelId}`, "info");
+        return { ok: true };
+    }
+    if (request.type === "delete_provider") {
+        const provider = String(request.provider ?? "");
+        const result = await deps.store.remove(provider);
+        if (!result.ok) {
+            deps.notify(`删除失败：${result.error}`, "error");
+            return { ok: false, error: { code: "provider.delete_failed", message: result.error } };
+        }
+        deps.logInfo("provider 已删除", { provider, removed: result.removed });
+        deps.notify(result.removed
+            ? `provider「${provider}」已删除`
+            : `provider「${provider}」不在这两份配置文件里（可能是插件注册的），无法从这里删除`, result.removed ? "info" : "warn");
+        return { ok: true, result: { removed: result.removed } };
+    }
+    if (request.type === "test_provider") {
+        const provider = String(request.provider ?? "");
+        // 内置 provider 也要能测：以前查不到直接报「没有这个 provider」
+        const view = await deps.store.get(provider, deps.builtinProviders());
+        if (!view) {
+            deps.notify(`没有这个 provider：${provider}`, "warn");
+            return { ok: false, error: { code: "provider.not_found", message: "没有这个 provider" } };
+        }
+        const apiKey = await deps.readKey(provider);
+        if (!apiKey) {
+            deps.notify(`provider「${provider}」还没有 api key，无法测试`, "warn");
+            return { ok: false, error: { code: "provider.no_key", message: "没有 api key" } };
+        }
+        const result = await deps.probe({
+            baseUrl: view.baseUrl,
+            api: view.api,
+            apiKey,
+            headers: await deps.store.readHeaders(provider),
+        });
+        deps.notify(result.ok
+            ? `provider「${provider}」连通正常（HTTP ${result.status}，${result.latencyMs}ms）`
+            : `provider「${provider}」连不通：${result.message}`, result.ok ? "info" : "error");
+        return { ok: true, result };
+    }
+    return null;
+}
+/** 组装依赖：把「读 key / 发探测 / 日志 / 提示」这些副作用集中在一处，index 里只留一行 */
+export function createProviderDeps(options) {
+    return {
+        store: options.store,
+        notify: options.notify,
+        logInfo: (message, meta) => options.logger.info(message, meta),
+        readKey: (provider) => options.store.readKey(provider),
+        builtinProviders: options.builtinProviders,
+        enabled: options.enabled ?? {
+            read: async () => [],
+            write: async () => { },
+        },
+        probe: options.probe,
+    };
+}
+/**
+ * 把「处理 → 刷新快照 → 回包」串起来（index.ts 里只留一行，见 400 行护栏）。
+ * 回包用回调传入，这样这里不需要认识 WebSocket。
+ */
+export function createProviderRunner(options) {
+    const deps = createProviderDeps(options);
+    return async (request, reply) => {
+        const handled = await handleProviderRequest(request, deps);
+        await options.refresh();
+        if (handled)
+            reply(handled);
+    };
+}
+/** 引擎报上来的模型按 provider 前缀分组（`provider/modelId`）→「内置 provider」列表 */
+export function builtinProviderGroups(models) {
+    const groups = new Map();
+    const endpoint = new Map();
+    for (const model of models) {
+        const slash = model.id.indexOf("/");
+        if (slash <= 0)
+            continue;
+        const provider = model.id.slice(0, slash);
+        groups.set(provider, [...(groups.get(provider) ?? []), { id: model.id.slice(slash + 1), name: model.label }]);
+        // 引擎知道内置 provider 的真实端点；没有它，「测试」按钮对内 provider 就是死的
+        if (!endpoint.has(provider) && (model.baseUrl || model.api)) {
+            endpoint.set(provider, {
+                ...(model.baseUrl ? { baseUrl: model.baseUrl } : {}),
+                ...(model.api ? { api: model.api } : {}),
+            });
+        }
+    }
+    return [...groups].map(([provider, list]) => ({ provider, models: list, ...endpoint.get(provider) }));
+}
+/**
+ * 把 provider 的「请求处理 + 快照刷新」接线整体封装（放在这里是为了 index.ts 的 400 行护栏）。
+ * `getRuntime` 用 getter 传进来：runtime 在 index 里晚于本模块构造，只有调用时才需要它。
+ */
+export function createProviderWiring(options) {
+    const runtime = () => options.getRuntime();
+    return createProviderRunner({
+        store: options.store,
+        logger: options.logger,
+        probe: options.probe,
+        ...(options.enabled ? { enabled: options.enabled } : {}),
+        notify: (text, level) => runtime().notify(text, level),
+        builtinProviders: () => builtinProviderGroups(runtime().state().models),
+        refresh: async () => {
+            const live = runtime().state();
+            live.providers = await options.store.list(builtinProviderGroups(live.models));
+            // 启用白名单也一起刷：否则界面的开关会停在旧状态（点了像没生效）
+            if (options.enabled)
+                live.enabledModels = await options.enabled.read();
+            await runtime().reloadModels();
+            runtime().pushSnapshot();
+        },
+    });
+}

package/dist/server/providers/provider-store.js

@@ -0,0 +1,327 @@
+/**
+ * provider 配置的读写（ADR-0025 §1）：**复用 pi 自己的两个文件**，不另存一份 key。
+ *
+ *
+ * 纪律：原子写 + 0600；**key 不出服务端**（只给 hasKey + 尾 4 位）。
+ * models.json 里的 provider 也在这里读写 —— 改它就等于改 pi 的配置。
+ */
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { maskKey } from "./validate.js";
+import { addCatalogModels, removeFromCatalog, adoptRename, writeCatalogModelPatch, writeCatalogUpsert, } from "./catalog-writes.js";
+import { MODELS_FILE, readCatalog, specView } from "./catalog-store.js";
+export const MODELS_STORE_FILE = "models-store.json";
+export const AUTH_FILE = "auth.json";
+async function readJson(path, fallback) {
+    try {
+        const text = await readFile(path, "utf8");
+        const parsed = JSON.parse(text);
+        return typeof parsed === "object" && parsed !== null ? parsed : fallback;
+    }
+    catch {
+        // 文件不存在 / 坏文件都不致命：按空表处理（与 ADR-0005 的「可重建」一致）
+        return fallback;
+    }
+}
+/** 原子写 + 0600：凭证文件不能出现「半写」也不能是 world-readable */
+async function writeJsonPrivate(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    await rename(temporary, path);
+    await chmod(path, 0o600);
+}
+/** 内置 provider → 可写条目（整表照抄，避免覆盖时丢掉别的模型） */
+function materialize(provider, seed) {
+    if (!seed || seed.models.length === 0)
+        return null;
+    return {
+        models: seed.models.map((model) => ({
+            id: model.id,
+            name: model.name,
+            // api / baseUrl 可能拿不到（引擎只报了模型名）：空字符串不能写进去，
+            // 否则这个 provider 会因为「没有可用端点」被当成坏配置（模型表里也不推）
+            ...(seed.api ? { api: seed.api } : {}),
+            ...(seed.baseUrl ? { baseUrl: seed.baseUrl } : {}),
+            provider,
+        })),
+    };
+}
+export function createProviderStore(options) {
+    const modelsPath = join(options.agentDir, MODELS_STORE_FILE);
+    const authPath = join(options.agentDir, AUTH_FILE);
+    const catalogPath = join(options.agentDir, MODELS_FILE);
+    const inCatalog = async (provider) => Boolean((await readCatalog(options.agentDir)).providers?.[provider]);
+    return {
+        async list(builtin = []) {
+            const [models, auth] = await Promise.all([
+                readJson(modelsPath, {}),
+                readJson(authPath, {}),
+            ]);
+            const custom = Object.entries(models).map(([provider, entry]) => {
+                const list = Array.isArray(entry.models) ? entry.models : [];
+                const key = auth[provider]?.key;
+                const headers = list.find((model) => model.headers)?.headers;
+                return {
+                    provider,
+                    source: "custom",
+                    baseUrl: list.find((model) => typeof model.baseUrl === "string")?.baseUrl ?? "",
+                    api: list.find((model) => typeof model.api === "string")?.api ?? "",
+                    hasKey: typeof key === "string" && key !== "",
+                    keyHint: maskKey(typeof key === "string" ? key : undefined),
+                    ...(headers ? { headerNames: Object.keys(headers) } : {}),
+                    models: list.map(specView),
+                };
+            });
+            // pi 的 provider 目录（models.json）：nexita / nexita-anthropic 这类就写在这里。
+            // 之前只从 models-store.json 读，于是它们在界面上「查无此 provider」。
+            const catalog = await readJson(catalogPath, {});
+            const fromCatalog = Object.entries(catalog.providers ?? {})
+                .filter(([provider]) => !models[provider])
+                .map(([provider, entry]) => {
+                const key = auth[provider]?.key ?? entry.apiKey;
+                const headers = entry.headers ?? entry.models?.find((model) => model.headers)?.headers;
+                return {
+                    provider,
+                    source: "builtin",
+                    baseUrl: entry.baseUrl ?? "",
+                    api: entry.api ?? "",
+                    hasKey: typeof key === "string" && key !== "",
+                    keyHint: maskKey(typeof key === "string" ? key : undefined),
+                    ...(headers ? { headerNames: Object.keys(headers) } : {}),
+                    models: (entry.models ?? []).map((model) => specView(model)),
+                };
+            });
+            // 引擎报上来的内置 provider：补上目录里没有的（例如插件注册的）
+            const known = new Set([...custom, ...fromCatalog].map((view) => view.provider));
+            const builtinViews = builtin
+                .filter((item) => !known.has(item.provider))
+                .map((item) => {
+                const key = auth[item.provider]?.key;
+                return {
+                    provider: item.provider,
+                    source: "builtin",
+                    baseUrl: item.baseUrl ?? "",
+                    api: item.api ?? "",
+                    hasKey: typeof key === "string" && key !== "",
+                    keyHint: maskKey(typeof key === "string" ? key : undefined),
+                    models: (item.models ?? []).map((model) => specView({ id: model.id, name: model.name })),
+                };
+            });
+            return [...custom, ...fromCatalog, ...builtinViews];
+        },
+        async readKey(provider) {
+            const auth = await readJson(authPath, {});
+            const key = auth[provider]?.key ?? (await readJson(catalogPath, {})).providers?.[provider]?.apiKey;
+            return typeof key === "string" && key !== "" ? key : null;
+        },
+        async removeModel(provider, modelId, seed) {
+            const models = await readJson(modelsPath, {});
+            if (!models[provider] && (await inCatalog(provider))) {
+                await writeCatalogModelPatch(options.agentDir, provider, modelId, null);
+                return { ok: true };
+            }
+            const entry = models[provider] ?? materialize(provider, seed);
+            if (!entry)
+                return { ok: false, error: `没有这个 provider：${provider}` };
+            const list = Array.isArray(entry.models) ? entry.models : [];
+            const next = list.filter((model) => model.id !== modelId);
+            if (next.length === list.length)
+                return { ok: false, error: `这个 provider 下没有模型：${modelId}` };
+            models[provider] = { ...entry, models: next, lastModified: options.now() };
+            await writeJsonPrivate(modelsPath, models);
+            return { ok: true };
+        },
+        async readHeaders(provider) {
+            const models = await readJson(modelsPath, {});
+            const own = models[provider]?.models?.find((model) => model.headers)?.headers;
+            if (own)
+                return { ...own };
+            const entry = (await readJson(catalogPath, {})).providers?.[provider];
+            const fromCatalog = entry?.headers ?? entry?.models?.find((model) => model.headers)?.headers;
+            return fromCatalog ? { ...fromCatalog } : {};
+        },
+        async get(provider, builtin = []) {
+            // 内置 provider（引擎报上来的那一批）也要能查到：否则改模型 / 停用单个模型时
+            // view 为 null，模型列表被当成空 → 停一个模型会把整个 provider 关掉
+            const all = await this.list(builtin);
+            return all.find((view) => view.provider === provider) ?? null;
+        },
+        async updateModel(provider, spec, seed) {
+            const models = await readJson(modelsPath, {});
+            // 目录里的 provider（nexita 之类）：直接改 pi 的 models.json，不另建覆盖条目
+            if (!models[provider] && (await inCatalog(provider))) {
+                await writeCatalogModelPatch(options.agentDir, provider, spec.id, spec);
+                return { ok: true };
+            }
+            const entry = models[provider] ?? materialize(provider, seed);
+            if (!entry)
+                return { ok: false, error: `没有这个 provider：${provider}` };
+            const list = Array.isArray(entry.models) ? entry.models : [];
+            const index = list.findIndex((model) => model.id === spec.id);
+            if (index < 0)
+                return { ok: false, error: `这个 provider 下没有模型：${spec.id}` };
+            const current = list[index] ?? { id: spec.id };
+            const next = {
+                ...current,
+                id: spec.id,
+                name: spec.name,
+                ...(spec.reasoning ? { reasoning: true } : { reasoning: false }),
+                input: spec.imageInput ? ["text", "image"] : ["text"],
+                ...(spec.contextWindow !== null ? { contextWindow: spec.contextWindow } : {}),
+                ...(spec.maxTokens !== null ? { maxTokens: spec.maxTokens } : {}),
+                ...(spec.cost ? { cost: spec.cost } : {}),
+                ...(spec.costSchedule && spec.costSchedule.length > 0 ? { costSchedule: spec.costSchedule } : {}),
+            };
+            if (spec.contextWindow === null)
+                delete next.contextWindow;
+            if (spec.maxTokens === null)
+                delete next.maxTokens;
+            if (!spec.cost)
+                delete next.cost;
+            // 分时价格清空了也要真删（否则界面上删掉的时段表下次保存又回来了）
+            if (!spec.costSchedule || spec.costSchedule.length === 0)
+                delete next.costSchedule;
+            const models2 = [...list];
+            models2[index] = next;
+            models[provider] = { ...entry, models: models2, lastModified: options.now() };
+            await writeJsonPrivate(modelsPath, models);
+            return { ok: true };
+        },
+        async addModels(provider, ids) {
+            const models = await readJson(modelsPath, {});
+            if (!models[provider] && (await inCatalog(provider)))
+                return addCatalogModels(options.agentDir, provider, ids);
+            const entry = models[provider];
+            if (!entry)
+                return { ok: false, error: `没有这个 provider：${provider}` };
+            const list = Array.isArray(entry.models) ? entry.models : [];
+            const template = list.find((model) => typeof model.api === "string" && typeof model.baseUrl === "string");
+            if (!template)
+                return { ok: false, error: "这个 provider 还没有可参考的 api / baseUrl（先保存一次 provider 配置）" };
+            const existing = new Set(list.map((model) => model.id));
+            const added = [];
+            const skipped = [];
+            const nextList = [...list];
+            for (const id of ids) {
+                if (existing.has(id)) {
+                    skipped.push(id);
+                    continue;
+                }
+                existing.add(id);
+                added.push(id);
+                nextList.push({
+                    id,
+                    name: id,
+                    api: template.api,
+                    baseUrl: template.baseUrl,
+                    provider,
+                    ...(template.headers ? { headers: template.headers } : {}),
+                });
+            }
+            if (added.length === 0)
+                return { ok: true, added, skipped };
+            models[provider] = { ...entry, models: nextList, lastModified: options.now() };
+            await writeJsonPrivate(modelsPath, models);
+            return { ok: true, added, skipped };
+        },
+        async remove(provider) {
+            if (!/^[a-z0-9][a-z0-9-]{1,30}$/.test(provider))
+                return { ok: false, error: "provider 名字不合法" };
+            const models = await readJson(modelsPath, {});
+            const auth = await readJson(authPath, {});
+            let removed = false;
+            if (provider in models) {
+                delete models[provider];
+                removed = true;
+            }
+            if (removed)
+                await writeJsonPrivate(modelsPath, models);
+            if (await inCatalog(provider))
+                removed = (await removeFromCatalog(options.agentDir, provider)) || removed;
+            if (provider in auth) {
+                delete auth[provider];
+                await writeJsonPrivate(authPath, auth);
+                removed = true;
+            }
+            return { ok: true, removed };
+        },
+        async upsert(input) {
+            // 改名：把旧条目搬到新名字（否则会变成「新建一个、旧的还在」），并带上旧 key
+            if (input.previousProvider && input.previousProvider !== input.provider) {
+                const oldKey = await adoptRename(options.agentDir, input.previousProvider, input.provider);
+                if (input.apiKey === undefined && oldKey)
+                    input = { ...input, apiKey: oldKey };
+            }
+            const [models, auth] = await Promise.all([
+                readJson(modelsPath, {}),
+                readJson(authPath, {}),
+            ]);
+            // 新 provider 一律写 pi 的目录（models.json）—— 只有写这里，pi 的 CLI 才看得到；
+            // models-store.json 是历史遗留位置，仅对已存在的条目继续沿用
+            if (!models[input.provider]) {
+                // 新增必须能拿到 key（目录里已有 key 的允许留空不改）
+                const existingKey = auth[input.provider]?.key ?? (await readCatalog(options.agentDir)).providers?.[input.provider]?.apiKey;
+                if (input.apiKey === undefined && !existingKey) {
+                    return { ok: false, error: "新增 provider 必须填 api key（否则模型调不通）" };
+                }
+                const { models: written } = await writeCatalogUpsert(options.agentDir, input);
+                const key = input.apiKey ?? existingKey;
+                return {
+                    ok: true,
+                    view: {
+                        provider: input.provider,
+                        source: "builtin",
+                        baseUrl: input.baseUrl,
+                        api: input.api,
+                        hasKey: typeof key === "string" && key !== "",
+                        keyHint: maskKey(key),
+                        ...(input.headers ? { headerNames: Object.keys(input.headers) } : {}),
+                        models: written.map((model) => specView(model)),
+                    },
+                };
+            }
+            const existing = models[input.provider];
+            const previous = new Map((existing?.models ?? []).map((model) => [model.id, model]));
+            const nextModels = input.models.map((model) => {
+                const base = previous.get(model.id) ?? { id: model.id };
+                return {
+                    ...base,
+                    id: model.id,
+                    name: model.name ?? base.name ?? model.id,
+                    api: input.api,
+                    baseUrl: input.baseUrl,
+                    provider: input.provider,
+                    ...(input.headers ? { headers: input.headers } : base.headers ? { headers: base.headers } : {}),
+                    ...(model.contextWindow ? { contextWindow: model.contextWindow } : {}),
+                };
+            });
+            // 表单里的清单是**权威**的：没勾的模型就是要去掉（之前这里会悄悄保留，
+            // 于是"取消勾选 + 保存"看起来毫无效果）
+            models[input.provider] = { ...existing, models: nextModels, lastModified: options.now() };
+            await writeJsonPrivate(modelsPath, models);
+            if (input.apiKey !== undefined) {
+                auth[input.provider] = {
+                    ...auth[input.provider],
+                    type: auth[input.provider]?.type ?? "api_key",
+                    key: input.apiKey,
+                };
+                await writeJsonPrivate(authPath, auth);
+            }
+            const key = auth[input.provider]?.key;
+            return {
+                ok: true,
+                view: {
+                    provider: input.provider,
+                    source: "custom",
+                    baseUrl: input.baseUrl,
+                    api: input.api,
+                    hasKey: typeof key === "string" && key !== "",
+                    keyHint: maskKey(typeof key === "string" ? key : undefined),
+                    ...(input.headers ? { headerNames: Object.keys(input.headers) } : {}),
+                    models: nextModels.map((model) => ({ id: model.id, name: model.name ?? model.id })),
+                },
+            };
+        },
+    };
+}

package/dist/server/providers/request-headers.js

@@ -0,0 +1,7 @@
+/** 统一 provider 请求头：协议决定鉴权头，自定义 headers 最后覆盖同名项。 */
+export function providerHeaders(api, apiKey, custom = {}) {
+    const headers = api === "anthropic-messages"
+        ? { "x-api-key": apiKey, "anthropic-version": "2023-06-01" }
+        : { authorization: `Bearer ${apiKey}` };
+    return { ...headers, ...custom };
+}