chore(version): 1.5.5

v1.5.4 stopped stripping reasoning_content, which fixes clients that send
it — but most agent clients (pi included) never store or replay their
reasoning, keeping only the tool call. OpenCode Go validates the field on
any assistant turn that carries tool_calls and rejects the whole request:

  400 invalid_request_error: The `reasoning_content` in the thinking mode
  must be passed back to the API.

Verified against the live endpoint that an EMPTY string satisfies the
check, so the adapter now fills in "" when a tool-calling assistant turn
has no reasoning_content. Nothing is fabricated: the reasoning shown to
the client is still exactly what the upstream returned for that turn.

Measured: with a tool_call + tool_result history and no reasoning_content,
all 25 configured Go models returned 400 before and all 25 answer
correctly now.

Test: TestOpenCodeGoVsZenReasoning also pins that a plain assistant turn
(no tool calls) must NOT gain the field.

.gitignore

@@ -26,7 +26,3 @@ cmd/gui/dist/
 
 # local design/working notes (not part of the shipped repo)
 /plan.md
-
-# scratch build/probe dirs used while debugging (GOTMPDIR, throwaway binaries)
-.build-work/
-.probe/

.snapshots/chat_nonstream.json

@@ -1,24 +0,0 @@
-{
-  "choices": [
-    {
-      "finish_reason": "stop",
-      "index": 0,
-      "message": {
-        "content": "pong",
-        "role": "assistant"
-      }
-    }
-  ],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion",
-  "usage": {
-    "completion": 1,
-    "completion_tokens": 1,
-    "prompt": 3,
-    "prompt_tokens": 3,
-    "total": 4,
-    "total_tokens": 4
-  }
-}

.snapshots/chat_stream.txt

@@ -1,95 +0,0 @@
-{
-  "choices": [
-    {
-      "delta": {
-        "content": "",
-        "role": "assistant"
-      },
-      "finish_reason": null,
-      "index": 0
-    }
-  ],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion.chunk"
-}
-{
-  "choices": [
-    {
-      "delta": {
-        "content": "Hel",
-        "role": "assistant"
-      },
-      "finish_reason": null,
-      "index": 0
-    }
-  ],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion.chunk"
-}
-{
-  "choices": [
-    {
-      "delta": {
-        "content": "lo",
-        "role": "assistant"
-      },
-      "finish_reason": null,
-      "index": 0
-    }
-  ],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion.chunk"
-}
-{
-  "choices": [
-    {
-      "delta": {
-        "content": "",
-        "role": "assistant"
-      },
-      "finish_reason": "stop",
-      "index": 0
-    }
-  ],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion.chunk"
-}
-{
-  "choices": [
-    {
-      "delta": {
-        "content": ""
-      },
-      "finish_reason": "stop",
-      "index": 0
-    }
-  ],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion.chunk"
-}
-{
-  "choices": [],
-  "created": <TS>,
-  "id": "<ID>",
-  "model": "good-m",
-  "object": "chat.completion.chunk",
-  "usage": {
-    "completion": 1,
-    "completion_tokens": 1,
-    "prompt": 16,
-    "prompt_tokens": 16,
-    "total": 17,
-    "total_tokens": 17
-  }
-}
-[DONE]

.snapshots/image_generation.json

@@ -1,8 +0,0 @@
-{
-  "created": <TS>,
-  "data": [
-    {
-      "b64_json": "QUJD"
-    }
-  ]
-}

README.md

@@ -24,7 +24,6 @@
 ### 强大的多租户调度能力
 
 - **多密钥多租户**：支持无限密钥，每个密钥独立角色、模型范围、Token 配额、重置周期
-- **按模型配额**：每把 key 的每个模型单独配 token + 请求数配额与重置周期（小时/周/月/自定义 N 小时）；一个模型用满只影响该模型，同 key 其它模型照常；耗尽返 429 + `Retry-After` 并点名模型，admin key 永不受限
 - **AUTO 智能调度**：基于优先级档位的分级调度，同优先级源自动轮询负载均衡，故障自动毫秒级故障转移
 - **自愈冷却**：冷却上限 5 分钟，过半后放行 1 个探测请求，上游/额度恢复即刻回归轮询，无需等满冷却窗口
 - **Token 配额管理**：精确到模型级别的 Token 配额控制，支持小时/周/月/自定义小时周期自动重置
@@ -69,9 +68,7 @@ Groq、Mistral、Ollama、KimiCode…）通过 **Lua 适配器** 做协议转换
     （所有现有状态均已占用）时批量预热，顺序流量始终只用 1 个状态。
   - 缩容步长由当前连接数决定：`clamp(ceil(冗余/(1+占用)), 1, 冗余)`——无连接时一轮收到
     常驻下限，忙时每轮只释放 1 个，保护热路径。WebUI「适配器」页展示实时池指标。
-- **thinking 预算**：请求里的推理开关/预算归一为中立的 `thinking:{enabled,budget_tokens}`，
-  适配器映射到各自协议（Anthropic `thinking.budget_tokens`、Gemini `thinkingConfig`、
-  DeepSeek `thinking.type="disabled"`）。
+- **disable_thinking**：请求 `disable_thinking:true`（或上游对应字段）动态开关推理。
 - **Lua 适配协议**：每个源挂一个 `.lua` 适配器，完成 `transform_request` /
   `transform_response` / `transform_stream_chunk` 双向转换，协议差异全在 Lua 层。
 - **签名 / 请求头钩子**：适配器可定义 `build_headers(meta)`，在 Go 发 HTTP 前
@@ -152,47 +149,6 @@ sources:
     timeout: 120s              # 请求超时，默认 120s
 ```
 
-
-### 自动探测模型列表
-
-不想手抄模型 id 时，只填 URL 和 key，让网关去扫：
-
-```bash
-# 只探测，不写任何东西
-curl -X POST http://127.0.0.1:8080/api/sources/discover \
-  -H "Authorization: Bearer sk-gw-…" -H "Content-Type: application/json" \
-  -d '{"base_url":"https://api.vendor.com/v1","api_key":"sk-…"}'
-# → {"ok":true,"base_url":"…","endpoint":"","models":["gpt-x",…],
-#    "image_models":["gpt-image-2"],"models_path":"/models","latency_ms":1387,…}
-
-# 探测后直接落库
-curl -X POST http://127.0.0.1:8080/api/sources/discover/apply \
-  -H "Authorization: Bearer sk-gw-…" -H "Content-Type: application/json" \
-  -d '{"base_url":"https://api.vendor.com/v1","api_key":"sk-…","name":"vendor"}'
-```
-
-WebUI 源编辑框里也有「自动探测模型」按钮：填好 URL 和 key 点一下，列表自动
-填好，仍需点保存才生效。
-
-几点值得知道：
-
-- **URL 形态不用猜。** 厂商对「`/v1` 放 base 还是放 path」没有共识，探测会
-  依次尝试若干候选并返回答对的那个，同时给出归一化后的 `base_url` +
-  `endpoint`（`endpoint` 平时留空，因为 openai adapter 自带 `/chat/completions`）。
-- **`image_endpoint` 是另一套规则。** 网关的图像默认路径是**绝对**的
-  `/v1/images/generations`，而 chat 默认是相对的。所以 `base_url` 带 `/v1` 时
-  必须显式给 `image_endpoint: /images/generations`，否则图像请求 404。
-  探测会替你填好。
-- **图像模型只看上游自己声明的 modality**，绝不从模型名猜。`gpt-image-2`
-  这类 id 也出现在同时提供对话服务的目录上，猜错会让 AUTO 链选中一个只支持
-  图像生成的模型，其后每一层都被它拖垮。
-- **不会逐模型探活。** 34 个模型的目录跑一轮要花钱且耗时数分钟，`/models`
-  是足够便宜的信号；模型是否真能应答留给正常请求去发现。
-- **对已存在的源，必须显式 `replace_models: true`** 才会覆盖模型列表。重新
-  探测顺手抹掉为 AUTO 链手工调过的 priority，是最难排查的一类数据丢失。
-- **`api_key` 留空表示沿用已存值**，不会把凭据清空。
-
-
 `config.yaml`、`runtime.json`、`master.key`、`adapters/` 均不提交版本库（见
 `.gitignore`），请随备份带走——`master.key` 丢失后运行时密文无法解密。
 
@@ -222,81 +178,6 @@ WebUI 源编辑框里也有「自动探测模型」按钮：填好 URL 和 key
 - 客户端用任意一个已授权的密钥明文作为 Bearer（`Authorization: Bearer <key>`）。
 - 删除密钥即从运行时存储移除，立即失效。
 
-#### 密钥用量配额
-
-**配额按模型单独设置**：每个密钥的 `models[]` 里，每一条模型范围各自带一份
-token 配额与请求数配额。一个模型用满只影响该模型，同一密钥的其它模型照常工作。
-
-```yaml
-keys:
-  - key: sk-gw-<hex>
-    role: user
-    name: agent-alice
-    models:
-      - model: deepseek-v4-flash
-        token_quota: 1000000   # 本周期内该 key 用这个模型的 token 预算
-        req_quota: 20000       # 本周期内的请求次数
-        period: nhour          # "" | hour | week | month | nhour
-        hours: 6               # 仅 nhour
-      - model: AUTO
-        token_quota: 5000000   # AUTO 也是一条独立配额
-        period: day            # ← 这种写法会被拒绝（词表只有 hour/week/month/nhour）
-      - model: kimi-k3        # 未列配额 = 无限
-```
-
-- **没有「整钥总配额」**：这是刻意的设计。整钥总额会让「把 A 模型的额度挪给
-  B 模型」变成一次全局重分配；按模型独立计费则每个模型各自可控，运维可以
-  看出哪个模型吃掉了预算。
-- `period` 词表：空 = 永不过期（累计总量），`hour` / `week` / `month` = 固定窗口，
-  `nhour` + `hours` = 自定义小时数。**拼错的周期在写入时就被拒**，不会静默变成
-  永不过期。
-- 配额严格按密钥隔离，且**同一密钥内按模型隔离**：A 密钥用满 `m1` 不会消耗
-  B 密钥的额度，同一密钥的 `m2` 也不受影响。
-- 配额统计含聊天、流式、生图，跨重启从审计日志回放（保留 40 天，覆盖最长的
-  month 窗口）。
-- 配额耗尽返回 **429 + `Retry-After`**（`rate_limit_exceeded`），消息里点名是哪个
-  模型用满了，客户端可等窗口重置后自动恢复；模型越权才是 403。
-  **admin 密钥永不受配额限制**（其 scope 上的配额也不强制），避免把管理员
-  锁在门外。
-- 窗口用量按整点小时分桶统计，实际释放比配置窗口最多晚 1 小时（配额宁可晚释放
-  也不超发）。
-- `PUT /api/keys/{key}` 提交 `models` 即同时提交它们的配额（配额就是 scope 的一部分，
-  不存在会与模型列表脱节的第二份预算）。显式 `0` = 解除该模型的限制。
-
-##### 配额拒绝 vs 容量拒绝：两种「拒绝」含义不同
-
-配额在**入口**检查，不占用任何上游槽位，因此是廉价拒绝；容量不足则要走
-`busyWait` 有界等待后才返回 503。实测（容量 8、0.6s/请求、100 并发）：
-
-| 情况 | 状态码 | 延迟 | 是否打到上游 |
-|---|---|---|---|
-| 配额用尽（`req_quota` 50 → 100 并发） | `429 rate_limit_exceeded` + `Retry-After` | **19–21ms** | 否 |
-| 容量打满（同一拓扑，未限配额） | `503 upstream_error` | ~2.6s（`busyWait`） | 超出部分否 |
-
-客户端因此可以区分「等窗口重置」与「等上游腾出容量」：前者只需等待，后者
-通常该降并发或换源。
-
-##### 配额的开销
-
-配额桶按 (密钥, 模型, 整点小时) 分桶保留 40 天，实测（AMD 7840HS）：
-
-- 窗口查询按窗口长度而非保留总量扫描：1h 窗口 49ns、24h 窗口 55ns、
-  30d 窗口 3.9μs（此前全扫保留总量，960 桶时 5.9μs）。
-- 记录一条请求：283ns、3 分配（与引入配额前相同，分配来自 ring buffer）。
-- 内存：生产形态（7 密钥 × 8 模型 × 2 源 × 满 40 天 retention）约 **3.7MB**。
-  按源 pin 的 `source::model` 桶**惰性创建**——只有当某条配额真的 pin 了
-  某个源时才维护，否则每条记录多写一份桶，在 20 密钥 × 8 模型 × 3 源下会
-  多占 18MB。
-  代价：配置 pinned 配额之前的历史用量无法事后按源拆分，所以 **pinned 配额的
-  首个窗口可能少算**。
-
-```bash
-# 配额耗尽时客户端看到（点名了具体模型）
-HTTP/1.1 429 Too Many Requests
-Retry-After: 2100
-{"error":{"type":"rate_limit_exceeded","message":"token quota exceeded for \"deepseek-v4-flash\" (5000000/5000000)"}}
-```
-
 ### 模型路由
 
 `/v1/chat/completions` 的 `model` 解析顺序：
@@ -450,13 +331,10 @@ Environment=MALLOC_ARENA_MAX=2
 可选：`GOMEMLIMIT=48MiB` 作软上限，实测再省 ~1 MB；代价是逐近上限时 GC 转激进，
 温和场景不必开。
 
-### thinking 预算
+### disable_thinking
 
-请求体带 `"thinking": {"enabled": false}` 时关闭推理；`"thinking": {"enabled": true,
-"budget_tokens": 4096}` 指定预算。内核只定义这个**中立**语义字段，映射到具体协议由
-适配器负责（Anthropic `thinking.budget_tokens`、Gemini `thinkingConfig.thinkingBudget`、
-DeepSeek `thinking.type = "disabled"`）。内核不再向适配器泄漏 `disable_thinking` /
-`extra_body` 这类私有字段。
+请求体带 `"disable_thinking": true` 时，网关透传给各适配器；DeepSeek 适配器将其
+映射为 `extra_body.thinking.type = "disabled"` 关闭推理，其余源按各自协议处理。
 
 ### WebUI
 
@@ -466,10 +344,7 @@ DeepSeek `thinking.type = "disabled"`）。内核不再向适配器泄漏 `disab
   支持按时间范围导出 CSV；点击模型可生成 pin 到该模型的连接配置。
 - **对话页**：流式/非流式调试。
 - **密钥页**：创建/编辑网关 key，为每个 key 配模型范围（模型 + 源 + token 配额 + 周期），
-  管理员管理全部 key，用户只看到自己的 key。每个模型砖块显示自己的配额徽标
-  （如 `1.0K 77×·1h`，未设配额显示 `∞`），点开可编辑该模型的 token 配额、
-  请求数配额与重置周期 —— 配额按模型独立生效，一个用满不影响同一 key 的其它模型。
-  「我的密钥」页对用户展示本 key 的模型范围与各自配额。
+  管理员管理全部 key，用户只看到自己的 key。
 - **优先级页**：拖拽积木配置 AUTO 链档位。
 - **源页**：在线增删改上游源（API key 等敏感字段加密落盘）。
 - **适配器页**：上传 / 删除 Lua 适配器脚本。
@@ -504,13 +379,6 @@ return {
   -- [可选] 动态请求头/签名钩子
   -- meta = { url, method, body, api_key, timestamp, source={ name, meta={...} } }
   build_headers = function(meta) return { ["X-App-Sign"] = sign } end,
-
-  -- [可选] 出向序列化（契约 v2）：上游不是 OpenAI 协议时接管写给客户端的字节。
-  -- 不声明则沿用内核的 OpenAI 兜底；声明即完全取代，内核不再混合字段。
-  serialize_response = function(result) return body_str end,
-  serialize_open_preamble = function(result) return bytes end,
-  serialize_chunk = function(delta) return bytes end,
-  serialize_close = function(result) return bytes end,
 }
 ```
 
@@ -519,12 +387,11 @@ return {
 
 ### 内置适配器
 
-`openai` `deepseek` `anthropic` `gemini` `github` `groq` `mistral` `ollama` `kimicode`
-`qwen38` `sensenova` `trae`。
+`openai` `deepseek` `anthropic` `gemini` `github` `groq` `mistral` `ollama` `kimicode`。
 
-`anthropic`/`gemini`/`ollama` 适配器内置多模态转换（`image_url` → 各自上游格式）；
-推理开关由中立的 `thinking` 字段表达，`deepseek` 适配器把它映射为
-`thinking.type = "disabled"`。
+`anthropic`/`gemini`/`ollama` 适配器内置多模态转换（`image_url` → 各自上游格式）；若
+源启用 `disable_thinking`，`deepseek` 适配器会把 `extra_body.thinking.type` 置为
+`disabled`。
 
 **kimicode** 是展示 `build_headers` 的样例：云端校验调用方 app，需要按
 `meta.app_secret` 对时间戳+URL+请求体哈希做 HMAC 签名并附 `X-App-Sign` 等头。
@@ -639,4 +506,4 @@ go test -tags luajit ./...
 ```
 
 覆盖：配置校验、适配器加载/变换、签名钩子、Gateway 鉴权、SDK 结算、SSE 流式、
-模型路由、多模态透传与 thinking 预算。
+模型路由、多模态透传与 disable_thinking。

README_EN.md

@@ -38,11 +38,6 @@ Extracted and independently evolved from the multi-source LLM adapter layer of
   `reasoning_content`, `tool_calls`, `usage`).
 - **Image generation**: `POST /v1/images/generations`, routed to models with
   `kind: image`.
-- **Per-model quota**: each key gives every model its own token and request caps
-  plus a reset period (hour/week/month/custom N hours). One model running out
-  affects only that model — the key's other models keep working. Exhaustion
-  answers 429 + `Retry-After` naming the model, so a client resumes when the
-  window rolls over; admin keys are never capped.
 - **Multimodal**: `content` arrays (`image_url` etc.) pass through losslessly;
   Anthropic/Gemini/Ollama are translated automatically.
 - **LuaJIT VM**: golua-binding LuaJIT; each adapter has its own VM + worker
@@ -176,103 +171,11 @@ under the `keys` field of the runtime file (encrypted at rest):
   delete the seed key.
 - The WebUI **Keys page** creates/deletes keys. Each key has a role (`admin`
   manages everything, `user` sees only its own key) and an optional **model
-  scope** (model + source + token quota + reset period). Each model brick shows
-  its own budget badge (e.g. `1.0K 77×·1h`, `∞` when uncapped); clicking it
-  edits that model's token quota, request quota and reset period. Quotas apply
-  per model, so one model running out never blocks the key's others. The
-  "My key" view shows a user its model scopes and their budgets.
+  scope** (model + source + token quota + reset period).
 - Clients authenticate with any authorized key's plaintext as
   `Authorization: Bearer <key>`.
 - Deleting a key removes it from the store immediately.
 
-#### Per-key usage quota
-
-**Quotas are per model.** Each key's `models[]` list gives every model its own
-token budget and request budget. One model running out affects only that model
-— the key's other models keep working.
-
-```yaml
-keys:
-  - key: sk-gw-<hex>
-    role: user
-    name: agent-alice
-    models:
-      - model: deepseek-v4-flash
-        token_quota: 1000000   # this key's token budget for this model
-        req_quota: 20000       # requests within the window
-        period: nhour          # "" | hour | week | month | nhour
-        hours: 6               # n-hour only
-      - model: AUTO
-        token_quota: 5000000   # AUTO is a quota entry like any other
-        period: hour
-      - model: kimi-k3        # no quota listed = unlimited
-```
-
-- **There is deliberately no key-wide total.** A key-wide cap would make
-  "move A's budget to B" a global reallocation; per-model budgets keep each
-  model independently controllable, so it stays visible which model is
-  actually consuming the spend.
-- `period`: empty = never resets (lifetime total); `hour` / `week` / `month` =
-  fixed windows; `nhour` + `hours` = a custom hour count. **A misspelled
-  period is rejected at write time** rather than silently becoming a
-  never-resetting quota.
-- Quotas are isolated per key *and* per model within a key: one key exhausting
-  `m1` never draws on another key's budget, and never blocks the same key's
-  `m2`.
-- Usage counts chat, streaming and image requests, and survives a restart by
-  replaying the audit log (40 days retained, covering the longest `month`
-  window).
-- An exhausted quota returns **429 + `Retry-After`**
-  (`rate_limit_exceeded`) and the message names the model that ran out, so a
-  client resumes when the window rolls over; a model the key may not use stays
-  403. **Admin keys are never capped** (quotas on their scopes are not
-  enforced either), so a cap can never lock the operator out.
-- Buckets are whole unix hours, so a window frees up at most an hour late
-  (deliberately freeing late rather than overspending).
-- `PUT /api/keys/{key}` submits quotas by submitting `models` — the caps are
-  part of the scope, so there is no second budget that can drift out of sync
-  with the model list. An explicit `0` lifts that model's cap.
-
-##### Quota rejection vs capacity rejection
-
-A quota is checked at the entry point and occupies no upstream slot, so it is a
-cheap rejection. Running out of capacity instead waits out the bounded
-`busyWait` before answering 503. Measured (capacity 8, 0.6 s/request, 100
-concurrent clients):
-
-| Case | Status | Latency | Reaches upstream |
-|---|---|---|---|
-| Quota spent (`req_quota` 50, 100 concurrent) | `429 rate_limit_exceeded` + `Retry-After` | **19–21 ms** | no |
-| Capacity exhausted (same topology, no quota) | `503 upstream_error` | ~2.6 s (`busyWait`) | overflow: no |
-
-So a client can tell "wait for the window to roll over" apart from "wait for
-upstream capacity" — the first only needs patience, the second usually means
-back off concurrency or switch sources.
-
-##### What the quota costs
-
-Buckets are kept per (key, model, whole unix hour) for 40 days. Measured on an
-AMD 7840HS:
-
-- A window query scans the window, not the whole retention: 49 ns for 1 h,
-  55 ns for 24 h, 3.9 µs for 30 d.
-- Recording one request: 283 ns, 3 allocations (unchanged from before this
-  feature; the allocations come from the record ring buffer).
-- Memory: the production shape (7 keys x 8 models x 2 sources at full 40-day
-  retention) costs about **3.7 MB**. The `source::model` bucket used by a
-  source-pinned quota is created **lazily** — it is maintained only once some
-  quota actually pins that source, because writing it on every record would
-  cost an extra 18 MB at 20 keys x 8 models x 3 sources.
-  The trade-off: usage recorded before a pinned quota was configured cannot be
-  split by source afterwards, so **a pinned quota may under-count its first
-  window**.
-
-```
-HTTP/1.1 429 Too Many Requests
-Retry-After: 2100
-{"error":{"type":"rate_limit_exceeded","message":"token quota exceeded for \"deepseek-v4-flash\" (5000000/5000000)"}}
-```
-
 ### Model routing
 
 `/v1/chat/completions` `model` resolution order:
@@ -487,7 +390,7 @@ Shared helpers: `hmac_sha256_hex(key, data)`, `sha256_hex(data)`,
 ### Built-in adapters
 
 `openai` `deepseek` `anthropic` `gemini` `github` `groq` `mistral` `ollama`
-`kimicode` `qwen38` `sensenova` `trae`.
+`kimicode`.
 
 `anthropic`/`gemini`/`ollama` include multimodal conversion
 (`image_url` → their native format); with `disable_thinking` the `deepseek`

cmd/gui/main.js

@@ -17,7 +17,7 @@ const fs = require("fs");
 const http = require("http");
 const os = require("os");
 const crypto = require("crypto");
-const { spawn, execFileSync } = require("child_process");
+const { spawn } = require("child_process");
 
 const LOG_FILE = path.join(app.getPath("userData"), "gui.log");
 function log(msg) {
@@ -97,99 +97,24 @@ function readAdminKey() {
   // gateway_keys entries get marked seed:true by the core (-> "replace the
   // initial key" warning in the web UI), while a plain keys entry authenticates
   // without any seed warning.
-  const raw = readConfigRaw();
-  if (!raw) return "";
-  // keys:
-  //     - key: sk-gw-...
-  const k = /^\s*keys:\s*\n(?:\s*-\s*key:\s*"?([^\s"#]+)"?[^\n]*\n)+/m.exec(
-    raw,
-  );
-  let v = k && k[1] ? k[1] : "";
-  if (!v) {
-    // legacy: gateway_keys list (pre-migration configs)
-    const g = /^\s*gateway_keys:\s*\n(?:\s*-\s*"?([^\s"#]+)"?\s*\n)+/m.exec(raw);
-    if (g && g[1]) v = g[1];
-    if (!v) {
-      const g2 = /gateway_keys:[^[\n]*\[\s*"?([^\s"\]]+)"?/m.exec(raw);
-      if (g2 && g2[1]) v = g2[1];
-    }
-  }
-  // The core seals credentials at rest (enc:v1:...), so from the second start
-  // onward the file holds ciphertext. Injecting that as a cookie is a
-  // guaranteed 401, which surfaces to the user as "enter your key" for a key
-  // they never set. Ask the core to unseal rather than reimplementing its
-  // crypto here. -show-secrets only reads, prints and exits: it starts nothing
-  // and writes nothing.
-  if (v && v.indexOf(SEALED_PREFIX) === 0) return unsealViaCore();
-  return v;
-}
-
-const SEALED_PREFIX = "enc:v1:";
-
-function readConfigRaw() {
   try {
     if (!fs.existsSync(CONFIG_FILE)) return "";
-    return fs.readFileSync(CONFIG_FILE, "utf-8");
-  } catch (e) {
-    return "";
-  }
-}
-
-// Returns the admin key in the clear, or "" if the core cannot be asked.
-//
-// cwd must be the directory that holds master.key. The core derives that path
-// from the config's runtime_file, so a call made from any other directory has
-// the core generate a *second* master key in the CWD and then fail to decrypt
-// ("master key changed?"). Electron's CWD is not the profile dir, so this is
-// not optional: without it the desktop build cannot read its own key back.
-//
-// readAdminKey runs on every outbound request, and this spawns a process, so
-// the result is cached against the config's mtime. Editing the config (or the
-// port rewrite, or the first write) changes the mtime and invalidates it, which
-// keeps the "read live so ordering never matters" property the auth rule
-// depends on.
-function unsealViaCore() {
-  const st = safeStat(CONFIG_FILE);
-  const stamp = st ? st.mtimeMs : 0;
-  if (unsealCache && unsealCache.stamp === stamp) return unsealCache.key;
-  let key = "";
-  try {
-    const out = execFileSync(
-      CORE_EXE,
-      ["-config", CONFIG_FILE, "-show-secrets"],
-      {
-        encoding: "utf-8",
-        timeout: 10000,
-        windowsHide: true,
-        cwd: PROFILE_DIR,
-      },
+    const raw = fs.readFileSync(CONFIG_FILE, "utf-8");
+    // keys:
+    //     - key: sk-gw-...
+    const k = /^\s*keys:\s*\n(?:\s*-\s*key:\s*"?([^\s"#]+)"?[^\n]*\n)+/m.exec(
+      raw,
     );
-    // -show-secrets prints one line per credential:
-    //   key    <name>  role=<role>  <value>
-    const admin = /^key\s+\S+\s+role=admin\s+(\S+)\s*$/m.exec(out);
-    if (admin && admin[1]) key = admin[1];
-    // Tolerate a field-order or spacing change rather than locking the user out.
-    if (!key) {
-      const loose = /role=admin\s+(\S+)/.exec(out);
-      if (loose && loose[1]) key = loose[1];
-    }
-  } catch (e) {
-    console.error("unseal via core failed:", e.message);
-  }
-  // Only cache a success. A transient failure must not pin an empty key until
-  // the config next changes, or a momentary spawn error locks the user out.
-  if (key) unsealCache = { stamp, key };
-  return key;
-}
-
-let unsealCache = null;
-
-function safeStat(p) {
-  try {
-    return fs.statSync(p);
-  } catch (e) {
-    return null;
-  }
+    if (k && k[1]) return k[1];
+    // legacy: gateway_keys list (pre-migration configs)
+    const g = /^\s*gateway_keys:\s*\n(?:\s*-\s*"?([^\s"#]+)"?\s*\n)+/m.exec(
+      raw,
+    );
+    if (g && g[1]) return g[1];
+    const g2 = /gateway_keys:[^[\n]*\[\s*"?([^\s"\]]+)"?/m.exec(raw);
+    if (g2 && g2[1]) return g2[1];
+  } catch (e) {}
+  return "";
 }
 
 const embeddedBaseUrl = () =>
@@ -671,78 +596,6 @@ ipcMain.handle(
   (e) => !!BrowserWindow.fromWebContents(e.sender)?.isMaximized(),
 );
 
-// ---- plugin management over IPC -------------------------------------------
-//
-// The renderer cannot call the embedded core directly: it has no key and no
-// network identity, and the core binds a loopback port that only the main
-// process knows about. So every plugin action is proxied through the main
-// process, which already knows how to obtain the admin key (unsealViaCore).
-//
-// The proxy is deliberately a raw (method, path, body) pass-through rather than
-// a fixed set of commands. A fixed set would have to be extended for every new
-// plugin endpoint, and the one thing worse than "no button for this" is "a
-// button that silently does nothing" — with a pass-through the renderer can talk
-// to any /api/plugins route the core grows, and the path is validated here so
-// this channel cannot be used to reach arbitrary endpoints.
-function pluginProxy(req) {
-  const { method, path, body } = req || {};
-  const M = ["GET", "POST", "PUT", "DELETE"];
-  if (!M.includes(method)) throw new Error("bad method: " + method);
-  // The path must stay inside the plugin namespace. A prefix check alone would
-  // still allow /api/plugins/../keys, so reject any traversal outright.
-  if (typeof path !== "string" || !path.startsWith("/api/plugins")) {
-    throw new Error("path must start with /api/plugins");
-  }
-  if (path.includes("..") || path.includes("\\")) {
-    throw new Error("path traversal rejected");
-  }
-  const key = unsealViaCore();
-  if (!key) throw new Error("no admin key available yet");
-  return new Promise((resolve, reject) => {
-    const u = new URL(embeddedBaseUrl() + path);
-    const data = body == null ? null : JSON.stringify(body);
-    const headers = { Authorization: "Bearer " + key };
-    if (data) {
-      headers["Content-Type"] = "application/json";
-      headers["Content-Length"] = Buffer.byteLength(data);
-    }
-    const r = http.request(
-      {
-        hostname: u.hostname,
-        port: u.port,
-        path: u.pathname + u.search,
-        method,
-        headers,
-      },
-      (res) => {
-        let raw = "";
-        res.setEncoding("utf8");
-        res.on("data", (c) => (raw += c));
-        res.on("end", () => {
-          let parsed = null;
-          try {
-            parsed = raw ? JSON.parse(raw) : null;
-          } catch (e) {
-            parsed = { raw };
-          }
-          if (res.statusCode >= 400) {
-            const msg =
-              (parsed && parsed.error && parsed.error.message) ||
-              "HTTP " + res.statusCode;
-            reject(new Error(msg));
-            return;
-          }
-          resolve(parsed);
-        });
-      },
-    );
-    r.on("error", reject);
-    if (data) r.write(data);
-    r.end();
-  });
-}
-
-ipcMain.handle("plugins:proxy", (_e, req) => pluginProxy(req));
 ipcMain.handle("core:state", () => ({
   running: coreStarted() && coreReady,
   ready: coreReady,

cmd/gui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "modelrouter-gui",
-  "version": "1.9.3",
+  "version": "1.5.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "modelrouter-gui",
-      "version": "1.9.3",
+      "version": "1.5.5",
       "license": "Proprietary",
       "devDependencies": {
         "electron": "^33.0.0",
@@ -582,7 +582,7 @@
       }
     },
     "node_modules/@peculiar/webcrypto": {
-      "version": "1.7.5",
+      "version": "1.7.1",
       "resolved": "https://registry.npmjs.org/@peculiar/webcrypto/-/webcrypto-1.7.1.tgz",
       "integrity": "sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==",
       "dev": true,
@@ -3335,7 +3335,7 @@
       }
     },
     "node_modules/resedit": {
-      "version": "1.7.5",
+      "version": "1.7.2",
       "resolved": "https://registry.npmjs.org/resedit/-/resedit-1.7.2.tgz",
       "integrity": "sha512-vHjcY2MlAITJhC0eRD/Vv8Vlgmu9Sd3LX9zZvtGzU5ZImdTN3+d6e/4mnTyV8vEbyf1sgNIrWxhWlrys52OkEA==",
       "dev": true,

cmd/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelrouter-gui",
-  "version": "1.9.7",
+  "version": "1.5.5",
   "description": "ModelRouter Desktop — embedded ModelRouter core with tray",
   "author": "ModelRouter",
   "main": "main.js",

cmd/gui/preload.js

@@ -16,13 +16,6 @@ contextBridge.exposeInMainWorld("modelrouter", {
     key: () => ipcRenderer.invoke("core:key"),
     onState: (cb) => ipcRenderer.on("core:state", (_e, d) => cb(d)),
   },
-  plugins: {
-    // Raw pass-through to the embedded core's /api/plugins surface. The main
-    // process validates the path and attaches the admin key; the renderer never
-    // sees either.
-    request: (method, path, body) =>
-      ipcRenderer.invoke("plugins:proxy", { method, path, body }),
-  },
   settings: {
     get: () => ipcRenderer.invoke("settings:get"),
     set: (patch) => ipcRenderer.invoke("settings:set", patch),

cmd/gui/renderer/app.js

@@ -155,7 +155,6 @@ async function openSettings() {
   $("#set-tray").checked = !!state.settings.minimizeToTray;
   $("#settings-overlay").style.display = "flex";
   renderRail();
-  loadPlugins();
 }
 function closeSettings() {
   $("#settings-overlay").style.display = "none";
@@ -183,296 +182,6 @@ async function saveSettings() {
   }
 }
 
-// esc / escAttr escape text for innerHTML. The WebUI has its own copies; the
-// shell needs its own because renderer/app.js is a separate document that
-// never loads index.html's script.
-function esc(s) {
-  return String(s == null ? "" : s).replace(
-    /[&<>"']/g,
-    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c],
-  );
-}
-function escAttr(s) {
-  return esc(s).replace(/`/g, "&#96;");
-}
-
-// ===== plugin management =====
-//
-// The desktop shell manages plugins through the embedded core's /api/plugins
-// surface, proxied over IPC (see plugins:proxy in the main process). The
-// renderer never holds the admin key.
-//
-// Scope note: the desktop build has no plugin_dir configured by default, so this
-// panel normally reports "plugins disabled" with the one-line fix. That is a
-// deliberate state, not an error — the packaged profile is a per-user directory
-// and seeding a plugin tree into someone's home without asking would be rude.
-
-async function loadPlugins() {
-  const list = $("#pl-list");
-  const hint = $("#set-plugins-hint");
-  if (!list || !hint) return;
-  let j;
-  try {
-    j = await window.modelrouter.plugins.request("GET", "/api/plugins");
-  } catch (e) {
-    hint.textContent = "内核未就绪：" + e.message;
-    list.innerHTML = "";
-    return;
-  }
-  if (!j.plugin_dir) {
-    hint.innerHTML =
-      '未配置 <code>plugin_dir</code>，插件功能未启用。在 config.yaml 加一行后重启内核即可。';
-    list.innerHTML = "";
-    return;
-  }
-  const rows = j.on_disk || [];
-  window.__plRows = rows; // read by editPlugin/deletePlugin for the builtin flag
-  const active = rows.filter((p) => p.loaded && !p.disabled).length;
-  const broken = rows.filter((p) => !p.loaded).length;
-  hint.textContent =
-    `${rows.length} 个插件 · ${active} 个启用中` +
-    (broken ? ` · ${broken} 个加载失败` : "");
-  list.innerHTML = rows.length
-    ? rows
-        .map((p) => {
-          const cls = !p.loaded ? "pl-broken" : p.disabled ? "pl-off" : "pl-on";
-          const label = !p.loaded
-            ? "加载失败"
-            : p.disabled
-              ? "已禁用"
-              : "启用中";
-          const btn = p.loaded
-            ? `<button class="ghost" data-act="toggle" data-name="${escAttr(
-                p.name,
-              )}" data-en="${p.disabled ? "1" : "0"}">${
-                p.disabled ? "启用" : "禁用"
-              }</button>`
-            : "";
-          const builtin = p.builtin
-            ? '<span class="pl-builtin">内置</span>'
-            : "";
-          // Edit / view source / delete are the operations an operator
-          // actually needs after enable/disable: a plugin that cannot be
-          // read back cannot be fixed, and one that cannot be removed cannot
-          // be rolled back.
-          const acts = [
-            btn,
-            `<button class="ghost" data-act="code" data-name="${escAttr(p.name)}">${
-              p.builtin ? "查看源码" : "编辑"
-            }</button>`,
-            builtin
-              ? ""
-              : `<button class="ghost danger" data-act="del" data-name="${escAttr(
-                  p.name,
-                )}">删除</button>`,
-          ]
-            .filter(Boolean)
-            .join("");
-          const pages = Array.isArray(p.pages) ? p.pages : [];
-          return `<div class="pl-item ${cls}">
-            <div class="pl-head"><b>${esc(p.name)}</b>${builtin}<span class="pl-state">${label}</span></div>
-            ${p.description ? `<div class="pl-desc">${esc(p.description)}</div>` : ""}
-            ${pages.length ? `<div class="pl-desc">页面：${esc(pages.join(", "))}</div>` : ""}
-            ${p.error ? `<div class="pl-err">${esc(String(p.error).slice(0, 160))}</div>` : ""}
-            <div class="pl-acts">${acts}</div>
-          </div>`;
-        })
-        .join("")
-    : '<div class="pl-empty">插件目录为空</div>';
-  list.querySelectorAll('button[data-act="toggle"]').forEach((b) => {
-    b.onclick = () => togglePlugin(b.dataset.name, b.dataset.en === "1");
-  });
-  list.querySelectorAll('button[data-act="code"]').forEach((b) => {
-    b.onclick = () => editPlugin(b.dataset.name);
-  });
-  list.querySelectorAll('button[data-act="del"]').forEach((b) => {
-    b.onclick = () => deletePlugin(b.dataset.name);
-  });
-}
-
-// editPlugin shows the plugin source in a modal. Built-in plugins are
-// read-only: their file ships inside the binary, so a save would either be
-// ignored or silently do nothing — showing an editable text area that
-// discards on save is worse than saying so up front.
-function editPlugin(name) {
-  // The plugin list is the only place `builtin` is reported; keep the last
-  // fetch so the modal does not need a second round trip (and cannot guess).
-  const row = (window.__plRows || []).find((p) => p.name === name);
-  const isBuiltin = !!(row && row.builtin);
-  const wrap = document.createElement("div");
-  wrap.className = "overlay";
-  wrap.innerHTML = `<div class="overlay-card pl-wide">
-    <div class="overlay-head"><h2>${esc(name)}${isBuiltin ? "（内置，只读）" : ""}</h2></div>
-    ${isBuiltin
-      ? `<p class="hint">内置插件随内核发布，源码在二进制内，不可编辑。</p>`
-      : `<textarea id="pl-code" spellcheck="false"></textarea>
-         <p class="hint" id="pl-code-err"></p>`}
-    <div class="row actions">
-      ${isBuiltin ? "" : `<button id="pl-code-save">保存并热重载</button>`}
-      <button class="ghost" id="pl-code-close">关闭</button>
-    </div>
-  </div>`;
-  document.body.appendChild(wrap);
-  wrap.addEventListener("click", (e) => {
-    if (e.target === wrap) wrap.remove();
-  });
-  $("#pl-code-close").onclick = () => wrap.remove();
-  const save = $("#pl-code-save");
-  if (save) {
-    save.onclick = async () => {
-      save.disabled = true;
-      try {
-        // Saving writes through POST /api/plugins — the same install path the
-        // installer uses, which validates the name, compiles the source and
-        // hot-reloads. PUT /{name} only toggles enable/disable, so pointing the
-        // save there would silently disable nothing and store nothing.
-        await window.modelrouter.plugins.request("POST", "/api/plugins", {
-          name,
-          code: $("#pl-code").value,
-        });
-        toast(`${name} 已保存`);
-        wrap.remove();
-        await loadPlugins();
-      } catch (e) {
-        $("#pl-code-err").textContent = e.message;
-        save.disabled = false;
-      }
-    };
-  }
-  if (isBuiltin) return;
-  (async () => {
-    const ta = $("#pl-code");
-    try {
-      const j = await window.modelrouter.plugins.request(
-        "GET",
-        `/api/plugins/${encodeURIComponent(name)}`,
-      );
-      ta.value = j.code || "";
-      const err = $("#pl-code-err");
-      if (err && j.parse_error) err.textContent = String(j.parse_error);
-    } catch (e) {
-      $("#pl-code-err").textContent = e.message;
-    }
-  })();
-}
-
-function deletePlugin(name) {
-  const wrap = document.createElement("div");
-  wrap.className = "overlay";
-  wrap.innerHTML = `<div class="overlay-card">
-    <div class="overlay-head"><h2>删除插件</h2></div>
-    <p>确定删除 <b>${esc(name)}</b>？插件目录中的文件会被移除，核心将不再加载它。</p>
-    <div class="row actions">
-      <button class="danger" id="pl-del-ok">删除</button>
-      <button class="ghost" id="pl-del-no">取消</button>
-    </div>
-  </div>`;
-  document.body.appendChild(wrap);
-  wrap.addEventListener("click", (e) => {
-    if (e.target === wrap) wrap.remove();
-  });
-  $("#pl-del-no").onclick = () => wrap.remove();
-  $("#pl-del-ok").onclick = async () => {
-    try {
-      await window.modelrouter.plugins.request(
-        "DELETE",
-        `/api/plugins/${encodeURIComponent(name)}`,
-      );
-      toast(`已删除 ${name}`);
-      wrap.remove();
-      await loadPlugins();
-    } catch (e) {
-      toast(e.message, true);
-    }
-  };
-}
-
-// installPlugin creates a new plugin from source. The name becomes the file
-// name, so it is validated client-side to save a round trip on the obvious
-// mistakes (empty, path separators, non-portable characters).
-function installPlugin() {
-  const wrap = document.createElement("div");
-  wrap.className = "overlay";
-  wrap.innerHTML = `<div class="overlay-card pl-wide">
-    <div class="overlay-head"><h2>安装插件</h2></div>
-    <div class="row"><label>名称</label><input id="pl-new-name" placeholder="my_plugin" /></div>
-    <p class="hint" id="pl-new-err"></p>
-    <textarea id="pl-new-code" spellcheck="false" placeholder="-- 单文件 Lua 插件&#10;plugin = {}&#10;..."></textarea>
-    <div class="row actions">
-      <button id="pl-new-ok">安装</button>
-      <button class="ghost" id="pl-new-no">取消</button>
-    </div>
-  </div>`;
-  document.body.appendChild(wrap);
-  wrap.addEventListener("click", (e) => {
-    if (e.target === wrap) wrap.remove();
-  });
-  $("#pl-new-no").onclick = () => wrap.remove();
-  $("#pl-new-ok").onclick = async () => {
-    const name = $("#pl-new-name").value.trim();
-    const code = $("#pl-new-code").value;
-    const err = $("#pl-new-err");
-    if (!/^[A-Za-z0-9_-]+$/.test(name)) {
-      err.textContent = "名称只能包含字母、数字、下划线和连字符";
-      return;
-    }
-    if (!code.trim()) {
-      err.textContent = "源码不能为空";
-      return;
-    }
-    $("#pl-new-ok").disabled = true;
-    try {
-      await window.modelrouter.plugins.request("POST", "/api/plugins", {
-        // The backend appends .lua itself (installPlugin writes name+".lua"),
-        // so passing it here would create name.lua.lua.
-        name,
-        code,
-      });
-      toast(`已安装 ${name}`);
-      wrap.remove();
-      await loadPlugins();
-    } catch (e) {
-      err.textContent = e.message;
-      $("#pl-new-ok").disabled = false;
-    }
-  };
-}
-
-async function togglePlugin(name, disabled) {
-  try {
-    await window.modelrouter.plugins.request("PUT", `/api/plugins/${encodeURIComponent(name)}`, {
-      enabled: disabled,
-    });
-    toast(disabled ? `已禁用 ${name}` : `已启用 ${name}`);
-    await loadPlugins();
-  } catch (e) {
-    toast(e.message, true);
-  }
-}
-
-async function enableAllPlugins() {
-  let j;
-  try {
-    j = await window.modelrouter.plugins.request("GET", "/api/plugins");
-  } catch (e) {
-    return toast(e.message, true);
-  }
-  const off = (j.on_disk || []).filter((p) => p.loaded && p.disabled);
-  for (const p of off) {
-    try {
-      await window.modelrouter.plugins.request(
-        "PUT",
-        `/api/plugins/${encodeURIComponent(p.name)}`,
-        { enabled: true },
-      );
-    } catch (e) {
-      toast(`${p.name}: ${e.message}`, true);
-    }
-  }
-  toast(off.length ? `已启用 ${off.length} 个插件` : "没有处于禁用状态的插件");
-  await loadPlugins();
-}
-
 // ===== theme =====
 function applyTheme() {
   document.documentElement.dataset.theme = state.theme;
@@ -488,12 +197,6 @@ function init() {
   $("#tb-close").onclick = () => window.modelrouter.win.close();
   $("#tb-settings").onclick = openSettings;
   $("#rail-settings").onclick = openSettings;
-  const plReload = document.getElementById("pl-reload");
-  if (plReload) plReload.onclick = loadPlugins;
-  const plAll = document.getElementById("pl-toggle-all");
-  if (plAll) plAll.onclick = enableAllPlugins;
-  const plInstall = document.getElementById("pl-install");
-  if (plInstall) plInstall.onclick = installPlugin;
   $("#rail-autostart").onclick = toggleAutoStart;
   $("#rail-silent").onclick = toggleSilent;
   $("#rail-theme").onclick = () => {

cmd/gui/renderer/index.html

@@ -207,16 +207,6 @@
               ><input type="checkbox" id="set-tray" /> 关闭时最小化到托盘</label
             ><span class="hint">点关闭按钮隐藏到系统托盘</span>
           </div>
-          <div class="row">
-            <label>插件</label>
-            <span class="hint" id="set-plugins-hint">加载中…</span>
-          </div>
-          <div id="pl-list" class="pl-list"></div>
-          <div class="row actions">
-            <button class="ghost" id="pl-toggle-all">全部启用</button>
-            <button class="ghost" id="pl-install">安装插件</button>
-            <button class="ghost" id="pl-reload">刷新</button>
-          </div>
           <div class="row actions">
             <button class="ghost" id="set-dir">打开数据目录</button>
             <button class="ghost" id="set-log">查看日志</button>

cmd/gui/renderer/style.css

@@ -596,129 +596,3 @@ html[data-theme="dark"] .overlay {
 #toast.err {
  border-color: var(--danger);
 }
-
-/* ===== plugin management panel =========================================
- * The existing .ghost/.primary rules are scoped to `.form .actions`, so a
- * button outside that selector gets browser defaults. The plugin rows live in
- * their own list, hence their own rules — reusing a scoped class here would have
- * produced unstyled buttons that still worked, which is the kind of thing that
- * looks fine until someone themes the shell.
- */
-.pl-list {
- display: flex;
- flex-direction: column;
- gap: 8px;
- margin: 8px 0 4px;
-}
-.pl-item {
- border: 1px solid var(--line);
- border-radius: 9px;
- padding: 10px 12px;
-}
-.pl-item.pl-broken {
- border-color: var(--danger, #d1435b);
-}
-.pl-head {
- display: flex;
- align-items: center;
- gap: 8px;
- font-size: 13px;
-}
-.pl-builtin {
- font-size: 10px;
- padding: 1px 6px;
- border-radius: 999px;
- background: var(--primary-50);
- color: var(--primary-h);
-}
-.pl-state {
- margin-left: auto;
- font-size: 11px;
- color: var(--muted);
-}
-.pl-item.pl-broken .pl-state {
- color: var(--danger, #d1435b);
-}
-.pl-desc {
- font-size: 12px;
- color: var(--muted);
- margin-top: 3px;
-}
-.pl-err {
- font-size: 11px;
- color: var(--danger, #d1435b);
- margin-top: 4px;
- word-break: break-word;
-}
-.pl-acts {
- margin-top: 8px;
- display: flex;
- gap: 8px;
-}
-.pl-acts button {
- padding: 5px 12px;
- font-size: 12px;
- border-radius: 7px;
- border: 1px solid var(--line);
- background: var(--bg-s2, #fff);
- color: var(--fg, inherit);
- cursor: pointer;
- transition: all 0.15s;
-}
-.pl-acts button:hover {
- border-color: var(--primary);
- color: var(--primary-h);
-}
-.pl-empty {
- font-size: 12px;
- color: var(--muted);
- padding: 10px 0;
-}
-
-/* ---- plugin editor / installer --------------------------------------------
-   The plugin source editor and the install dialog reuse the settings overlay
-   (overlay / overlay-card) rather than a second popup system. They need three
-   things the settings card does not: a wider column for code, a monospace
-   textarea, and a destructive button for delete. */
-.overlay-card.pl-wide {
- width: 760px;
-}
-.pl-wide textarea {
- width: 100%;
- min-height: 380px;
- resize: vertical;
- padding: 10px 12px;
- border-radius: 10px;
- border: 1px solid var(--line-strong);
- background: var(--bg-sunken, rgba(127, 127, 127, 0.06));
- color: inherit;
- font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
- font-size: 12.5px;
- line-height: 1.55;
- tab-size: 2;
-}
-.pl-wide textarea:focus {
- outline: none;
- border-color: var(--primary);
-}
-.pl-wide .row input {
- flex: 1;
- padding: 7px 10px;
- border-radius: 9px;
- border: 1px solid var(--line-strong);
- background: var(--bg-sunken, rgba(127, 127, 127, 0.06));
- color: inherit;
-}
-.pl-editor .hint,
-.pl-wide .hint {
- min-height: 16px;
- color: var(--muted, #888);
-}
-button.danger {
- color: #e5484d;
- border-color: rgba(229, 72, 77, 0.4);
-}
-button.danger:hover {
- border-color: #e5484d;
- color: #e5484d;
-}

cmd/llmsproxy/main.go

@@ -24,7 +24,6 @@ import (
 func main() {
 	cfgPath := flag.String("config", "config.yaml", "path to gateway config file")
 	checkOnly := flag.Bool("check", false, "validate the config file and exit (0 = valid, 1 = invalid); nothing is started and no file is written")
-	showSecrets := flag.Bool("show-secrets", false, "print the config's credentials in the clear and exit; nothing is started and no file is written")
 	flag.Parse()
 
 	// -check is the deploy-time preflight: parse and validate the config
@@ -42,20 +41,6 @@ func main() {
 		return
 	}
 
-	// -show-secrets is the operator escape hatch for a config whose
-	// credentials are sealed at rest: it prints them to stdout and exits
-	// without starting anything or writing anything. Nothing else in the
-	// program prints a credential, and this path never logs to a file.
-	if *showSecrets {
-		if _, err := os.Stat(*cfgPath); err != nil {
-			log.Fatalf("[llmsproxy] show-secrets: %v", err)
-		}
-		if err := config.PrintSecrets(*cfgPath); err != nil {
-			log.Fatalf("[llmsproxy] show-secrets: %v", err)
-		}
-		return
-	}
-
 	created, err := config.EnsureDefault(*cfgPath)
 	if err != nil {
 		log.Fatalf("[llmsproxy] config: %v", err)
@@ -73,26 +58,19 @@ func main() {
 		}
 	}
 
-	gw, err := gateway.New(c)
+	gw, err := gateway.New(c, c.GatewayKeys())
 	if err != nil {
 		log.Fatalf("[llmsproxy] gateway: %v", err)
 	}
 
 	// Ops hygiene: surface the two most common footguns instead of silently
 	// running with them.
-	//
-	// Read the AUTHORITATIVE source. Auth uses core.ListKeys() (cfg.Keys), not
-	// the legacy cfg.GatewayKeys list: seedKeys copies gateway_keys into keys[]
-	// on first start and the YAML list is ignored for auth afterwards. Checking
-	// GatewayKeys() here made the warning lie — once the legacy list was empty
-	// (e.g. after rotating the starter key away) it reported "every request is
-	// rejected" while seven working keys, one of them admin, were in service.
-	if keys := c.ListKeys(); len(keys) == 0 {
-		log.Printf("[llmsproxy] WARNING: no gateway key configured — every request will be rejected. Add one in the WebUI or set gateway_keys")
+	if keys := c.GatewayKeys(); len(keys) == 0 {
+		log.Printf("[llmsproxy] WARNING: gateway_keys is EMPTY — without a key every request is rejected")
 	} else {
 		for _, k := range keys {
-			if k.Key == "sk-gw-local-0001" || k.Key == "sk-local-0001" {
-				log.Printf("[llmsproxy] WARNING: gateway key %q looks like the starter/example key — rotate it before exposing the gateway", k.Key)
+			if k == "sk-gw-local-0001" || k == "sk-local-0001" {
+				log.Printf("[llmsproxy] WARNING: gateway key %q looks like the starter/example key — rotate it before exposing the gateway", k)
 			}
 		}
 	}

deploy.sh

@@ -31,7 +31,6 @@ set -euo pipefail
 readonly TARGET_BIN="/usr/local/bin/llmsproxy"
 readonly TARGET_CONFIG="/etc/llmsproxy/config.yaml"
 readonly TARGET_ADAPTERS="/etc/llmsproxy/adapters"
-readonly TARGET_PLUGINS="/etc/llmsproxy/plugins"
 readonly REPO_DIR="/home/program/llmsproxy"
 readonly HEALTH_URL="http://127.0.0.1:8081/v1/models"
 readonly BIN_NAME="llmsproxy"
@@ -245,117 +244,6 @@ verify_config() {
     return 1
 }
 
-# ---------- 密钥可解封校验 ----------
-# config.yaml 里的凭据以 enc:v1: 密文落盘，解密钥匙是 master.key（或
-# LLMS_PROXY_MASTER_KEY）。一旦钥匙丢失/错位，配置在**启动时**才会报错，
-# 那时服务已经处于「二进制已替换 + 配置已替换」的半死状态，只能靠回滚。
-# 所以在替换任何东西之前先验：能不能用现有的钥匙解开现有的密文。
-#
-# 两种情形要分开：
-#   1. 配置里**有**密文 ⇒ 钥匙必须能解开（否则拒绝部署）
-#   2. 配置里**没有**密文 ⇒ 全新安装/首次加密，无需钥匙（但会顺手记一条，
-#      因为它意味着这次部署会把明文写成密文，而钥匙必须同时就位）
-verify_master_key() {
-    log "密钥可解封校验"
-    [[ -f "$TARGET_CONFIG" ]] || return 0   # 配置都不在，交给 verify_config 报错
-
-    local sealed
-    sealed=$(grep -c 'enc:v1:' "$TARGET_CONFIG" 2>/dev/null || echo 0)
-    if [[ "$sealed" -eq 0 ]]; then
-        warn "配置内无密文（尚未加密或全为明文）——首次加密需要 master.key 可写"
-        return 0
-    fi
-
-    # 钥匙来源与 config 包一致：env 优先，否则 runtime_file 同目录的 master.key
-    local runtime_file key_file
-    runtime_file=$(awk '/^runtime_file:/{print $2; exit}' "$TARGET_CONFIG")
-    [[ -n "$runtime_file" ]] || runtime_file="$(dirname "$TARGET_CONFIG")/runtime.json"
-    key_file="$(dirname "$runtime_file")/master.key"
-
-    if [[ -n "${LLMS_PROXY_MASTER_KEY:-}" ]]; then
-        log "  钥匙来源: LLMS_PROXY_MASTER_KEY（环境变量）"
-        # 走真实解密路径验证，而不是只检查格式
-        if out=$("$TARGET_BIN" -show-secrets -config "$TARGET_CONFIG" 2>&1); then
-            log "✓ 凭据可解封（$(echo "$out" | grep -cE '^(source|key) ') 项）"
-            return 0
-        fi
-        err "凭据无法用 LLMS_PROXY_MASTER_KEY 解封，未替换任何文件："
-        printf '%s\n' "$out" >&2
-        return 1
-    fi
-
-    if [[ ! -f "$key_file" ]]; then
-        err "配置含 $sealed 处密文，但钥匙文件不存在: $key_file"
-        err "  没有它，部署后服务将无法启动。恢复 master.key 或设置 LLMS_PROXY_MASTER_KEY 后重试。"
-        return 1
-    fi
-    log "  钥匙文件: $key_file ($(stat -c '%A' "$key_file" 2>/dev/null || echo '?')，$(wc -c < "$key_file") 字节)"
-
-    if out=$("$TARGET_BIN" -show-secrets -config "$TARGET_CONFIG" 2>&1); then
-        log "✓ 凭据可解封（$(echo "$out" | grep -cE '^(source|key) ') 项）"
-        return 0
-    fi
-    err "凭据无法解密（钥匙与配置不匹配），未替换任何文件："
-    printf '%s\n' "$out" | head -5 >&2
-    err "  密钥来源: $key_file"
-    err "  常见原因：master.key 被重新生成、恢复了不匹配的备份，或换了机器。"
-    return 1
-}
-
-# ---------- 适配器备份保留策略 ----------
-# 每次部署都新建一个 adapters.bak.<时间戳> 目录，而回滚只用到最近一次
-# （$BACKUP_BIN / $BACKUP_CONFIG 都是单文件覆盖）。多出来的目录从没人清理，
-# 实测线上已积累 71 个，/etc/llmsproxy 因此涨到 122M。
-#
-# 保留最近 KEEP_ADAPTER_BACKUPS 份足够回滚，同时给目录数设上限——否则
-# 一次误配置（比如 adapter_dir 指错）就可能在几秒内造出成百上千个目录。
-# 只删名字严格匹配 adapters.bak.<14位时间戳> 的目录，避免误伤人工放的目录。
-KEEP_ADAPTER_BACKUPS=5
-
-prune_adapter_backups() {
-    local base="/etc/llmsproxy"
-    [[ -d "$base" ]] || return 0
-
-    # 先按数量上限硬裁：即使时间戳排序失效也不会无上限增长。
-    local all
-    mapfile -t all < <(find "$base" -maxdepth 1 -type d -name 'adapters.bak.*' -printf '%f\n' | sort)
-    local cap=$((KEEP_ADAPTER_BACKUPS * 4))
-    if (( ${#all[@]} > cap )); then
-        warn "适配器备份目录有 ${#all[@]} 个（异常），裁到 $cap"
-        local i=0
-        for d in "${all[@]}"; do
-            i=$((i + 1))
-            # 从最旧的开始删（sort 后升序）。名字不规范的跳过不删。
-            if (( i <= ${#all[@]} - cap )); then
-                if [[ "$d" =~ ^adapters\.bak\.[0-9]{14}$ ]]; then
-                    rm -rf "${base:?}/$d"
-                else
-                    warn "跳过名字不规范的备份目录（不删）: $d"
-                fi
-            fi
-        done
-        mapfile -t all < <(find "$base" -maxdepth 1 -type d -name 'adapters.bak.*' -printf '%f\n' | sort)
-    fi
-
-    # 再按时间保留最近 KEEP_ADAPTER_BACKUPS 份（sort 后最新在末尾）。
-    local total=${#all[@]} i=0
-    for d in "${all[@]}"; do
-        i=$((i + 1))
-        # i <= total-KEEP 的是较旧的，要删。
-        if (( i <= total - KEEP_ADAPTER_BACKUPS )); then
-            if [[ "$d" =~ ^adapters\.bak\.[0-9]{14}$ ]]; then
-                rm -rf "${base:?}/$d"
-            else
-                warn "跳过名字不规范的备份目录（不删）: $d"
-            fi
-        fi
-    done
-
-    local left
-    left=$(find "$base" -maxdepth 1 -type d -name 'adapters.bak.*' | wc -l)
-    log "  适配器备份保留最近 $KEEP_ADAPTER_BACKUPS 份（当前剩 $left 个）"
-}
-
 # ---------- 同步适配器 ----------
 sync_adapters() {
     log "同步适配器"
@@ -373,7 +261,6 @@ sync_adapters() {
         cp -rf "$TARGET_ADAPTERS/"*.lua "$BACKUP_DIR/" 2>/dev/null || true
         log "  旧适配器已备份到 $BACKUP_DIR"
     fi
-    prune_adapter_backups
 
     cp -f "$SRC_ADAPTERS/"*.lua "$TARGET_ADAPTERS/"
     chmod 0644 "$TARGET_ADAPTERS/"*.lua
@@ -391,52 +278,6 @@ sync_adapters() {
     log "✓ 适配器已同步到 $TARGET_ADAPTERS/"
 }
 
-# 同步内置插件到 plugin_dir。
-#
-# 为什么需要它：新内置插件（如 channels.lua）过去只能靠内核的 SeedBundled 落地，
-# 而旧版 SeedBundled "目录已存在就什么都不做"，于是升级后新插件永远不会出现在
-# 生产 —— 它在二进制里、却不在 /api/plugins。内核端已修（改为按文件补齐），
-# 这里再显式同步一道，让部署与二进制内容对齐、不依赖内核那一侧的行为。
-#
-# 只补缺：已存在的插件文件一律不动。运维自己改过、或运行时新增的插件必须跨
-# 部署存活；覆盖它们会静默抹掉线上正在用的逻辑。
-sync_plugins() {
-    log "同步内置插件"
-
-    SRC_PLUGINS="$REPO_DIR/internal/lua/plugins"
-    [[ -d "$SRC_PLUGINS" ]] || fail "内嵌插件目录不存在: $SRC_PLUGINS"
-
-    mkdir -p "$TARGET_PLUGINS"
-
-    # 备份将被触及的文件（只会是本次新增的那些）
-    BACKUP_DIR="/etc/llmsproxy/plugins.bak.$(date +%Y%m%d%H%M%S)"
-    local added=0
-    mkdir -p "$BACKUP_DIR"
-    for src in "$SRC_PLUGINS"/*.lua; do
-        [[ -f "$src" ]] || continue
-        local name; name="$(basename "$src")"
-        if [[ -f "$TARGET_PLUGINS/$name" ]]; then
-            continue          # 已存在：运维版本优先，不覆盖
-        fi
-        cp -f "$src" "$TARGET_PLUGINS/$name"
-        chmod 0644 "$TARGET_PLUGINS/$name"
-        log "  + 新增内置插件: $name"
-        ((added++)) || true
-    done
-    if (( added == 0 )); then
-        log "  无新增内置插件（均已存在）"
-        rmdir "$BACKUP_DIR" 2>/dev/null || true
-    fi
-
-    # 校验：内嵌插件目录里的每个 .lua 都必须在目标目录存在
-    for src in "$SRC_PLUGINS"/*.lua; do
-        [[ -f "$src" ]] || continue
-        local name; name="$(basename "$src")"
-        [[ -f "$TARGET_PLUGINS/$name" ]] || warn "  缺少插件: $name"
-    done
-    log "✓ 插件已同步到 $TARGET_PLUGINS/（新增 $added，已有文件未改动）"
-}
-
 # ---------- 重启服务 ----------
 restart_service() {
     log "重启服务（中断 <500ms）"
@@ -542,7 +383,6 @@ print_summary() {
     log "  二进制: $TARGET_BIN"
     log "  配置:   $TARGET_CONFIG$([[ -n "$NEW_CONFIG_SRC" ]] && echo "  (本次已替换)" || echo "  (未改动)")"
     log "  适配器: $TARGET_ADAPTERS"
-    log "  插件:   $TARGET_PLUGINS"
     log "═════════════════════════════════════════════"
 }
 
@@ -553,13 +393,8 @@ main() {
     parse_args "$@"
     log "═══ llmsproxy 原子部署开始 ═══"
     precheck
-    # 密钥校验放在 build/替换之前：它的失败后果最重（配置里的密文永久解不开），
-    # 必须在动任何文件之前就挡住。此阶段用的是**当前线上二进制**，它已经
-    # 支持 -show-secrets（首次引入该子命令的版本除外，此时跳过并提示）。
-    verify_master_key
     build
     sync_adapters
-    sync_plugins
     backup_old_state
     atomic_replace_binary
     atomic_replace_config

docs/design-plugin-kernel-api.md

@@ -1,117 +0,0 @@
-# 插件可调用内核动作（R4-c）设计
-
-> 用户决策（2026-10-11）：**全开**（13 个内核动作全部可调）+ **设置页可配权限** +
-> **Go 侧 deadline 兜底**。
-
-## 1. 要解决的问题
-
-用户原话："现在这个接口不全，可以多给一些接口让 lua 调用内核。"
-
-现状（`__llmsproxy_adapters`）是我手写的**三个闭包**（install/update/remove），
-只能管适配器。内核还有 13 个公开动作（Reload / ResetHealth / AddSource /
-RemoveSource / SaveAutoRules / key 增删改 / 列表读取…），插件一个都调不到。
-
-而"自动孵化 / 自愈 / 联动"这类插件能力（例如：探测到上游全挂 → 触发重探 +
-清冷却；发现额度变化 → 重排 AUTO 链）恰恰需要它们。
-
-## 2. 关键认识：Go 调用可以超时，Lua 死循环不能
-
-这决定了整个设计，也是用户提"阻塞 + Go 兜底"的原因：
-
-| 形态 | 能否中断 | 处置方式 |
-|---|---|---|
-| Lua 里 `while true do end` | **不能**（LuaJIT 限制，已实测三次） | 只能停用插件 |
-| Lua 里 `__llmsproxy_kernel.call("reload")` | **能** | Go 侧 `select` + deadline，超时把错误返回给 Lua |
-
-因为 Lua 只是在等 Go 的返回值，**不占用 Lua 栈的执行**。所以给每次内核调用加
-Go 侧 deadline 是可行的、干净的 —— 不需要"Lua 投递请求、Go 队列执行"：那样
-还要定义"超时后队列里积压的命令怎么办"，而 deadline 直接返回 `(nil, err)`，
-语义闭合。
-
-## 3. 依赖方向
-
-`internal/lua` **不能** import `internal/core`（方向是 core → lua）。
-按既有先例（`SetOutboundHosts`）注入一个**接口**，由 core 实现：
-
-```go
-// internal/lua/kernel_api.go
-type KernelAction struct {
-    Name        string   // "reload" / "reset_health" / ...
-    Title       string   // 设置页展示用
-    Description string
-    Danger      string   // ""=只读, "write"=改配置, "danger"=破坏性
-    Params      []string // 参数名（设置页/文档用）
-}
-
-type KernelAPI interface {
-    // Actions 列出可调用动作（设置页据此渲染权限开关）
-    Actions() []KernelAction
-    // Invoke 执行一个动作，args 为已解码参数。**必须**尊重 ctx 的 deadline。
-    Invoke(ctx context.Context, name string, args map[string]any) (any, error)
-}
-```
-
-core 侧实现 `Invoke` 时用**现有的 Core 方法**，本身不持 `p.mu`，因此不会与
-插件锁成环（已核实：所有 `ps.mu` → `p.mu` 都是先释放 `ps.mu`）。
-
-## 4. 权限模型
-
-复用 `visibilityOverrides` 的**同一套持久化机制**（`.access.json`），
-但用独立的键空间：`kernel:<plugin>` → 逗号分隔的动作名或 `*`。
-
-- **默认拒绝**：插件不显式获得授权时，`call` 返回 `(nil, "not permitted")`。
-  理由：全开是"能力存在"，不是"默认授予"。一个插件能删密钥这件事必须由
-  运维在设置页点过确认。
-- **`danger` 类必须显式逐个授权**，不接受 `*`。这一条是防止运维图省事写
-  通配符，把"删密钥"和"读状态"等同起来。
-- 插件可以在自己源码里**声明**它想要的动作（`plugin.kernel = {...}`），
-  设置页把它显示为"申请"，运维批准后才生效。声明不等于授权。
-
-## 5. 动作清单（13 个 + 适配器 3 个）
-
-| 动作 | 危险级 | 对应 Core 方法 | 超时 |
-|---|---|---|---|
-| `status` | 只读 | 读 AutoSlotStates/Registry | 2s |
-| `list_sources` | 只读 | Sources() | 2s |
-| `list_models` | 只读 | Registry().ModelList() | 2s |
-| `list_adapters` | 只读 | ListAdapters() | 2s |
-| `adapter_owner` | 只读 | AdapterOwnerOf | 2s |
-| `reload` | write | Reload() | 30s |
-| `reset_health` | write | ResetHealth() | 5s |
-| `probe_all` | write | Registry().ProbeAll(ctx) | 60s |
-| `save_auto_rules` | write | SaveAutoRules() | 10s |
-| `save_key_auto` | write | SaveKeyAuto() | 10s |
-| `add_source` | write | AddSource() | 30s |
-| `remove_source` | danger | RemoveSource() | 30s |
-| `create_key` | write | CreateKey() | 10s |
-| `update_key` | write | UpdateKey() | 10s |
-| `delete_key` | danger | DeleteKey() | 10s |
-| `install_adapter` | write | UploadAdapter() | 10s |
-| `remove_adapter` | danger | RemoveAdapter() | 30s |
-| `set_plugin_enabled` | danger | SetEnabled() | 5s |
-
-**绝不开放**：`ListKeys()` / `FindKey()` —— 返回**明文密钥**。给插件读密钥等于
-把网关的凭据面交给第三方 Lua。要用 key 相关动作就只用带掩码的形态。
-
-## 6. Lua 调用面
-
-```lua
--- 探测：拿到可用动作与自己的授权情况
-local acts = __llmsproxy_kernel.actions()
--- 调用：统一入口，返回 (result, err)
-local ok, err = __llmsproxy_kernel.call("reset_health", {})
-local st, err = __llmsproxy_kernel.call("status", {})
-```
-
-统一入口（而不是每个动作一个全局函数）的理由：动作集合将来会变，而
-`__llmsproxy_kernel` 的签名不变 —— 否则每加一个动作就要动
-`bootPluginState`，而那里正是历史上出过 cgo 崩溃的地方。
-
-## 7. 实施顺序
-
-1. `internal/lua/kernel_api.go`：接口 + 动作元数据 + 权限检查 + deadline 包装
-2. `internal/lua/plugin_kernel_bridge.go`：Lua 绑定（`actions` / `call`）
-3. `internal/core/kernel_actions.go`：实现 `KernelAPI`（core 侧）
-4. 权限持久化：复用 `.access.json`，新键空间
-5. 设置页：插件行加"内核动作"列 + 授权编辑
-6. 测试：Go 侧全动作、Lua 侧调用、权限拒绝、deadline 生效、危险动作需显式授权

docs/git-workflow-en.md

@@ -15,7 +15,7 @@ deployable.
 |---|---|---|---|
 | Main | `main` | permanent | Only long-lived branch. Always deployable. Accumulates the next version. |
 | Feature | `feature/<desc>` | short (dev → merge → delete) | New features / ordinary fixes. Born from `main`, merged back into `main`. |
-| Release | `release/vX.Y.x` | one version cycle | Cut from `main`, tagged for release. Version-specific hotfixes land here. |
+| Release | `release/vX.Y.Z` | one version cycle | Cut from `main`, tagged for release. Version-specific hotfixes land here. |
 
 ## Change flow (important)
 
@@ -26,21 +26,15 @@ deployable.
                            │                        │
                            │ cut                    │ cut
                            ▼                        ▼
-                    release/v1.6.x            release/v1.7.x
+                    release/v1.4.2            release/v1.4.3
                            │                        │
-                      tag: v1.6.0               tag: v1.7.6
+                    tag: v1.4.2               tag: v1.4.3
                            │                        │
               hotfix ◄─────┘                hotfix ◄─────┘
                    │                              │
                    └── cherry-pick back ──────────┘
 ```
 
-The patch position in the branch name is a literal `x`, while the tag carries
-the concrete version: one `release/v1.7.x` can hold tags v1.7.0 … v1.7.6.
-Spanning several patches on a single minor branch is deliberate — patches are
-revisions of the same feature batch, hotfixes land on one branch, and back-port
-to main never has to resolve dependencies between several release branches.
-
 ### Key rules
 
 1. **main is always deployable**: never leave half-done work on `main`.
@@ -49,9 +43,9 @@ to main never has to resolve dependencies between several release branches.
    then `git merge --no-ff feature/xxx` (or squash) when done.
 3. **Release = cut a release branch from main + tag**:
    ```bash
-   git checkout -b release/v1.7.x main
-   git tag -a v1.7.0 -m "ModelRouter v1.7.0"
-   git push origin release/v1.7.x v1.7.0
+   git checkout -b release/v1.4.2 main
+   git tag -a v1.4.2 -m "ModelRouter v1.4.2"
+   git push origin release/v1.4.2 v1.4.2
    ```
    Build installers and upload the GitCode Release from this tag so the
    published state is exactly reproducible.
@@ -60,7 +54,7 @@ to main never has to resolve dependencies between several release branches.
    an already-released branch (unless you deliberately ship a minor revision).
 5. **Hotfixes MUST flow back to main**:
    ```bash
-   git checkout release/v1.7.x     # fix in the release branch
+   git checkout release/v1.4.2     # fix in the release branch
    git commit -m "fix: ..."
    git checkout main
    git cherry-pick <hotfix-commit> # and into main
@@ -73,23 +67,12 @@ to main never has to resolve dependencies between several release branches.
 When the next version ships, the previous release branch retires:
 
 - **Default: delete the remote release branch**
-  (`git push origin :release/v1.7.x`). All hotfixes were already
+  (`git push origin :release/v1.4.2`). All hotfixes were already
   cherry-picked into main, so main contains everything; no merge needed.
 - **Long-term maintenance** (e.g. an enterprise client pinned to an old
   version): keep the branch, accept only security fixes, keep the
   commit-then-cherry-pick loop.
 
-> **Where practice diverged from this section (checked 2026-10-01)**:
-> `release/v1.4.x` and `release/v1.5.x` still exist locally and on the remote,
-> so "retire the previous branch when the next version ships" was never
-> carried out. Keeping them is harmless (hotfixes were back-ported), but it
-> contradicts the rule above and makes a reader wonder whether they should be
-> there at all. **Feature branches, by contrast, are cleaned up**:
-> `feature/key-quota-control`, `feature/toolcall-id-sanitize`,
-> `feature/anthropic-usage-cache` and `feature/agentrouter-id-sanitize` were
-> deleted on 2026-10-01 after confirming with a per-commit `git patch-id`
-> comparison that their work had already landed in main.
-
 ## Explicit non-goals
 
 - **Never rebase main**: main's history stays append-only; anyone pulling gets
@@ -151,8 +134,8 @@ pain points:
 2. No feature branches meant two independent efforts could not proceed in
    parallel without colliding.
 
-With release branches: the published state = `release/vX.Y.x` branch +
-the concrete `vX.Y.Z` tag, exactly reproducible; hotfixes have a clear landing
-spot; main stays "latest + all fixes + deployable".
+With release branches: the published state = `release/vX.Y.Z` branch +
+`vX.Y.Z` tag, exactly reproducible; hotfixes have a clear landing spot; main
+stays "latest + all fixes + deployable".
 
 > 中文版见 [docs/git-workflow.md](git-workflow.md)。

docs/git-workflow.md

@@ -13,7 +13,7 @@ ModelRouter 采用 **GitHub Flow + 发布分支** 模型：`main` 是唯一长
 |---|---|---|---|
 | 主分支 | `main` | 永久 | 唯一长命分支。永远可部署。积攒下一个版本的功能。 |
 | 特性分支 | `feature/<描述>` | 短命（开发→合并即删） | 新特性 / 一般 bug 修复。从 `main` 开出，完成后合回 `main`。 |
-| 发布分支 | `release/vX.Y.x` | 一个版本周期 | 从 `main` 分出，打 tag 发布。该版本生命周期内的 hotfix 都提交在此分支。 |
+| 发布分支 | `release/vX.Y.Z` | 一个版本周期 | 从 `main` 分出，打 tag 发布。该版本生命周期内的 hotfix 都提交在此分支。 |
 
 ## 变更流向（重要）
 
@@ -24,20 +24,15 @@ ModelRouter 采用 **GitHub Flow + 发布分支** 模型：`main` 是唯一长
                            │                        │
                            │ 切出                   │ 切出
                            ▼                        ▼
-                     release/v1.6.x            release/v1.7.x
+                    release/v1.4.2            release/v1.4.3
                            │                        │
-                      tag: v1.6.0               tag: v1.7.6
+                    tag: v1.4.2               tag: v1.4.3
                            │                        │
               hotfix ◄─────┘                hotfix ◄─────┘
                    │                              │
                    └── cherry-pick 回 main ───────┘
 ```
 
-分支名里 patch 位是**字面的 x**，而 tag 打具体版本号：`release/v1.7.x` 这一条
-发布分支上的 tag 可以有 v1.7.0 … v1.7.6 多个。一条 minor 分支跨多个 patch 是
-刻意的：patch 是同一批功能的不同修订，hotfix 落在同一条分支上，回流 main 时
-也不必处理多条 release 分支之间的依赖。
-
 ### 关键规则
 
 1. **main 永远可部署**：不在 main 上留半成品。任何未完成的工作必须在特性分支上。
@@ -45,16 +40,16 @@ ModelRouter 采用 **GitHub Flow + 发布分支** 模型：`main` 是唯一长
    开发完 `git merge --no-ff feature/xxx` 或 squash 合回。
 3. **发布 = 从 main 切 release 分支 + 打 tag**：
    ```bash
-   git checkout -b release/v1.7.x main
-   git tag -a v1.7.0 -m "ModelRouter v1.7.0"
-   git push origin release/v1.7.x v1.7.0
+   git checkout -b release/v1.4.2 main
+   git tag -a v1.4.2 -m "ModelRouter v1.4.2"
+   git push origin release/v1.4.2 v1.4.2
    ```
    构建安装包、上传 GitCode Release 都基于这个 tag，保证可精确回溯发布态。
 4. **版本生命周期内只收该版本的 hotfix**：新特性一律并入 `main` 等下一个版本，
    绝不塞进已发布的 release 分支（除非主动选择在该版本内发次要版）。
 5. **hotfix 必须回流 main**：
    ```bash
-   git checkout release/v1.7.x     # 在发布分支提交修复
+   git checkout release/v1.4.2     # 在发布分支提交修复
    git commit -m "fix: ..."
    git checkout main
    git cherry-pick <hotfix-commit> # 回主分支
@@ -66,20 +61,11 @@ ModelRouter 采用 **GitHub Flow + 发布分支** 模型：`main` 是唯一长
 
 下一个版本发布时，上一个 release 分支退役：
 
-- **默认：直接删除远端 release 分支**（`git push origin :release/v1.7.x`）。
+- **默认：直接删除远端 release 分支**（`git push origin :release/v1.4.2`）。
   因为 hotfix 都已逐个 cherry-pick 回 main，main 已包含全部修复，无需再合并。
 - **如需要长期维护旧版**（例如企业大客户卡在旧版本）：保留分支，仅 stopship 接受
   该版本的安全修复，继续走「提交 + cherry-pick 回 main」循环。
 
-> **实践与本节的历史出入（2026-10-01 核对）**：`release/v1.4.x` 与 `release/v1.5.x`
-> 至今仍在本地与远端，说明"下一个版本发布就删上一个分支"实际没有执行。
-> 保留无害（hotfix 已回流），但它与上面写的规则不一致，读文档的人会以为
-> 这些分支不该存在。**特性分支则确实在清理**：`feature/key-quota-control`、
-> `feature/toolcall-id-sanitize`、`feature/anthropic-usage-cache`、
-> `feature/agentrouter-id-sanitize` 四个分支在 2026-10-01 删除——它们的工作
-> 早已全部进入 main（逐提交用 `git patch-id` 比对确认），留着只是给下个版本
-> 制造 cherry-pick/merge 陷阱。
-
 ## 明确不做的事
 
 - **不 rebase main**：`main` 的历史保持追加式，任何人拉取后 `git pull` 都得到直接可用的历史。

docs/lua-adapters.md

@@ -23,7 +23,7 @@
 5. [内置辅助函数](#5-内置辅助函数)
 6. [meta 约定](#6-meta-约定)
 7. [一个完整的最小适配器](#7-一个完整的最小适配器)
-8. [多模态与 thinking 预算](#8-多模态与-thinking-预算)
+8. [多模态与 disable_thinking](#8-多模态与-disable_thinking)
 
 ---
 
@@ -73,9 +73,8 @@ end
 
 约定：
 - 返回的字符串将被原样 POST 到 `base_url + (source.endpoint or adapter.endpoint)`。
-- 契约 v2 起，内核**不再向适配器泄漏任何私有字段**：请求体里不会出现
-  `disable_thinking` / `extra_body` 这类键。推理开关与预算用中立的 `thinking`
-  字段表达（见下），适配器按目标协议各自映射。
+- 请求体中包含的 `disable_thinking`、`extra_body` 等网关内部字段，转换时应自行清理
+  （`openai.lua` 即删掉这两个字段）。
 
 ### `transform_response(raw_body) -> string`
 
@@ -177,81 +176,6 @@ end
 
 返回非 table 会报错；返回 `{}` 表示无自定义头（不会回退静态头）。
 
-### 出向序列化钩子（契约 v2）
-
-默认情况下，网关把适配器产出的**统一格式**按 OpenAI 线格式序列化给下游（这是内核
-保留的兑底，R5）。当上游协议不是 OpenAI（例如 Anthropic Messages API）时，适配器
-可以接管出向序列化，自己决定写给客户端的字节。
-
-五个钩子都是可选的，**全不声明就沿用 OpenAI 兑底**。一旦声明某个钩子，它就完全
-接管那一段输出——内核不会再往里混合 OpenAI 字段（不是“叠加”，是“取代”）。
-
-| 钩子 | 何时被调用 | 返回值 |
-|------|-----------|--------|
-| `serialize_response(payload)` | 非流式响应 | 写给客户端的响应体字符串 |
-| `serialize_open_preamble(payload)` | 流式开始（发第一个 chunk 前） | 要发的字节（可为 `""`） |
-| `serialize_chunk(delta)` | 流式每个增量 | 要发的字节（`""` 表示跳过） |
-| `serialize_close(payload)` | 流式结束 | 收尾字节（如 SSE `message_stop`） |
-| `serialize_done_marker(payload)` | 流式结束处的 `[DONE]` 标记 | 要写的字节；不声明则用 OpenAI 的 `data: [DONE]` |
-
-`payload` 是统一格式的结果表（见 `internal/types/maxwire.go` 的 `UnifiedResult` /
-`UnifiedDelta`），字段名中立，不依赖具体上游协议。
-
-```lua
--- anthropic.lua 的简化形式：把统一结果写成 Anthropic Messages 形状
-function adapter.serialize_response(payload)
-  return json.encode({
-    id = payload.id,
-    type = "message",
-    role = "assistant",
-    content = { { type = "text", text = payload.content or "" } },
-    stop_reason = payload.finish_reason == "stop" and "end_turn" or nil,
-    usage = { input_tokens = payload.prompt_tokens, output_tokens = payload.completion_tokens },
-  })
-end
-```
-
-注意：钩子返回的是**完整要发送的字节**（包括必要时的 `event:` / `data:` 前缀与
-空行），因为只有适配器知道目标协议的 SSE 细节。
-
-### 入向让出钩子（契约 v2，`serialize_*` 的对偶）
-
-出向是「统一格式 → 客户端协议」，入向是它的镜像：「客户端协议 → 统一格式」。
-内核为对外端点（如 `POST /v1/messages`）**保留一份内置解析作为兜底（R5）**，
-但适配器可以**声明自己服务该端点**并接管解析——那时内核主动让出，客户端协议的
-迭代就完全落在适配器里，不再需要动内核。
-
-声明分两步：
-
-1. `adapter.ingress = "/v1/messages"` —— 声明**认领**哪条对外入站路径。
-   同一条路径被多个适配器认领是配置错误；内核按适配器名字典序确定性选择。
-2. `deserialize_request(raw_body) -> unified_json` —— 把客户端原始 body 解析成
-   统一请求（`UnifiedRequest` 的 JSON），后续调度与 `/v1/chat/completions` 完全一致。
-
-规则：
-
-- 只有声明了该端点且实现了 `deserialize_request` 的适配器会让内核让出。
-- 没有适配器认领时，内核内置解析接管（未配置的部署仍能工作）。
-- 认领了但钩子**执行失败**是硬错误（400），不会静默回落到另一种协议解析——
-  客户端说的正是这个适配器声称支持的协议，悄悄换解析器只会错误调度请求。
-
-```lua
--- anthropic.lua 的简化形式：把 Anthropic Messages 请求解析成统一格式
-adapter.ingress = "/v1/messages"
-function adapter.deserialize_request(raw_body)
-  local req = json.decode(raw_body)
-  local msgs = {}
-  for _, m in ipairs(req.messages or {}) do
-    table.insert(msgs, { role = m.role, content = m.content })
-  end
-  return json.encode({
-    model = req.model, messages = msgs, max_tokens = req.max_tokens,
-    system = type(req.system) == "string" and req.system or "",
-    stream = req.stream == true,
-  })
-end
-```
-
 ## 5. 内置辅助函数
 
 所有适配器共享的全局函数（由 Go 注入）：
@@ -295,13 +219,8 @@ adapter.headers = { ["X-Tenant"] = "prod" }
 function adapter.transform_request(raw_body)
     local ok, req = pcall(json.decode, raw_body)
     if not ok then return raw_body end
-    -- 契约 v2：内核不再向适配器泄漏私有字段，`thinking` 是中立语义字段。
-    -- 这里把中立的 thinking 映射成目标协议需要的形状（示例：OpenAI 家族用
-    -- reasoning_effort）。不关心推理的源可以直接忽略它。
-    if req.thinking ~= nil then
-        if req.thinking.enabled == false then req.reasoning_effort = "none" end
-        req.thinking = nil
-    end
+    req.disable_thinking = nil
+    req.extra_body = nil
     return json.encode(req)
 end
 
@@ -349,21 +268,11 @@ sources:
         kind: chat
 ```
 
-## 8. 多模态与 thinking 预算
+## 8. 多模态与 disable_thinking
 
 - **多模态**：请求的 `content` 若是数组（`[{type:"text"...},{type:"image_url"...}]`），Go 层
   原样透传给适配器。协议不支持的源（Anthropic/Gemini/Ollama）需在
   `transform_request` 内转换；内置 `anthropic.lua`/`gemini.lua`/`ollama.lua` 已实现。
-- **thinking**：客户端请求里的推理开关/预算被内核归一成中立的 `thinking` 字段：
-
-  ```json
-  {"thinking": {"enabled": true, "budget_tokens": 4096}}
-  ```
-
-  `enabled=false` 表示关闭推理，`budget_tokens` 可选。适配器自行映射到目标协议
-  （内置实现：Anthropic → `thinking.budget_tokens`、Gemini →
-  `generationConfig.thinkingConfig.thinkingBudget`、DeepSeek →
-  `thinking.type = "disabled"`）。不支持的源直接忽略该字段。
-
-  契约 v1 的内核私有字段 `disable_thinking` 已被取代——它曾是内核细节泄漏进
-  适配器请求体的典型例子（迫使 10 个适配器各写一行 `req.disable_thinking = nil`）。
+- **disable_thinking**：网关将请求体中的 `disable_thinking:true` 透传进
+  `transform_request`。DeepSeek 适配器将其映射为 `extra_body.thinking = { type = "disabled" }`
+  并清理自身字段；其余适配器按各自协议处理（可自行实现或忽略）。

docs/plugins.md

@@ -1,632 +0,0 @@
-# 插件系统（Plugin System）
-
-> **English**: this document is the reference for writing ModelRouter plugins.
-> The Chinese version is the primary one; section titles map 1:1.
-
-ModelRouter 的插件是**单个 `.lua` 文件**，放在 `config.yaml` 的 `plugin_dir` 目录里。
-插件能做两件事：
-
-1. **挂钩子**：在请求流水线的若干 stage 上注册回调，看到每个请求的完整信息，
-   并可以把结果累加进自己的状态。
-2. **贡献界面**：在启动时返回 HTML / CSS / JS，由内核注入 WebUI——可以是一整个
-   新页面，也可以是往现有页面里追加一个组件。
-
-两者互相独立：只想统计请求数的插件不必碰界面；只想加个仪表盘的插件不必碰钩子。
-
----
-
-## 1. 快速上手
-
-一个最小的插件：
-
-```lua
--- plugins/hello.lua
-local plugin = {
-  name = "hello",
-  version = "1.0.0",
-  description = "示例插件",
-  author = "you",
-}
-
--- 声明钩子
-plugin.hooks = {
-  request_end = "on_request_end",
-}
-
--- 钩子实现
-function plugin.on_request_end(payload)
-  -- payload 是解码后的 table，不是 JSON 字符串
-  log("info", string.format("%s via %s: %d prompt tokens",
-    payload.model, payload.source, payload.prompt_tokens or 0))
-  return nil  -- 最后一个 stage 没有下游，return 无意义
-end
-
--- 贡献界面
-plugin.ui = {
-  page = {
-    page_id = "hello",     -- kebab-case
-    title = "Hello",
-    icon = "👋",
-    order = 90,            -- 侧栏排序
-    mount = [[<div id="hello">hello</div>]],
-  },
-}
-
-return plugin   -- 必须返回一个 table
-```
-
-放进 `plugin_dir` 后重启即生效。`GET /api/plugins` 确认它被加载了。
-
----
-
-## 2. 加载与生命周期
-
-```
-core.New
-  └─ lua.NewVM(adapter_dir).Start()        适配器状态
-  └─ lua.NewPlugins(vm, plugin_dir)
-       ├─ SeedBundled()                    仅当目录不存在时写入内置插件（目前是 billing）
-       └─ LoadDir()                        按文件名字典序逐个加载
-```
-
-**加载失败不影响网关启动。** 一个语法错误的插件会被记录在 `GET /api/plugins`
-的 `error` 字段里，永远不会被调用。这与适配器一致，但理由更强：插件是可选的
-第三方扩展，因为一个 `.lua` 打错字就让网关起不来是错误的取舍。
-
-**目录一旦存在就是权威的。** 与适配器同规则：首启会 seed 内置插件，之后目录里
-的文件说了算，删除或编辑内置插件都是真实生效的操作。
-
-### 2.1 热更新
-
-| 方式 | 效果 |
-|---|---|
-| `POST /api/plugins {name, code}` | 写文件 + 立即加载新版本（旧的 Lua 状态被关闭重建，**累计量清零**） |
-| `DELETE /api/plugins/{name}` | 删文件 + 卸载 |
-| 改文件后 `POST` 同名 | 同上 |
-
-改文件但**不** POST，需要重启才生效。
-
----
-
-## 3. 流水线 stage
-
-一个请求依次经过三个 stage。插件可以为任意 stage 注册钩子；未注册的 stage
-被忽略，所以插件不会因为网关将来新增 stage 而报错。
-
-```
-        客户端请求
-             │
-   ┌─────────▼──────────┐
-   │  request_start     │  已解析、已鉴权，尚未选源
-   │  · type            │  "chat" | "stream" | "image"
-   │  · model           │  客户端请求的原始 model（"AUTO" 也在这里）
-   │  · key / role      │  掩码后的网关 key id（"***a1b2c3"）与角色
-   │  · source          │  空（还没选源）
-   │  · stream          │
-   │  · messages_count  │
-   │  · tools_count     │
-   │  · ts              │  unix 秒
-   └─────────┬──────────┘
-             │  （调度：tier 遍历 → 槽位轮转 → 冷却/配额过滤）
-   ┌─────────▼──────────┐
-   │  routed            │  已选定 (source, model)，尚未发往上游
-   │  · source / model  │  实际选中的
-   │  · tier            │  AUTO 链的档位；直连 = -1；AUTO = -2
-   │  · stream / key    │
-   └─────────┬──────────┘
-             │  （HTTP 往返 / SSE 流）
-   ┌─────────▼──────────┐
-   │  request_end       │  每个请求恰好一次，成功失败都触发
-   │  · ok / status     │
-   │  · latency_ms      │
-   │  · first_byte_ms   │  流式的首字节时间
-   │  · prompt_tokens   │  上游真实 usage，缺失时为字节估算
-   │  · completion_tokens
-   │  · cache_hit_tokens / cache_miss_tokens
-   │  · image_count     │  生图数量（图片不计 token）
-   │  · error           │  失败原因，成功时为 ""
-   │  · time            │  unix **毫秒**
-   └─────────┬──────────┘
-             │
-        写审计 + 聚合统计
-```
-
-### 3.1 触发点在哪
-
-| stage | 代码位置 | 说明 |
-|---|---|---|
-| `request_start` | `gateway/chat.go` `handleChat` / `fireImageStart` | 每个请求一次（chat 与生图各一条），在配额闸门**之前** |
-| `chain_step` | `gateway/chat.go` `chainTraceSink` | **仅 AUTO 路径**，每步一次 |
-| `routed` | `singleChat` / `streamChat` / `singleChatAuto` / `streamChatAuto` | 成功选定源之后，各一次 |
-| `request_end` | `gateway/chat.go` `writeRec` | **所有出口的唯一汇合点**，每个请求一次 |
-
-### 3.1b 为什么单独有 `chain_step`
-
-`routed` 只在**遍历结束后**触发一次，只带最终胜出的槽位。所以
-"tier 1 冷却所以降级到 tier 3"和"tier 1 正常接单"在它眼里**完全一样**——
-而这恰恰是优先级链存在的全部理由。
-
-`chain_step` 补上这条信息，四种 `kind`：
-
-| kind | 含义 | 何时产生 |
-|---|---|---|
-| `tier_skip` | 整档被跳过 | 该档所有槽位冷却中/配额用尽 |
-| `slot_fail` | 某个槽位硬失败 | 上游报错 / 适配器输出不可用 |
-| `tier_busy` | 整档全忙且有界等待超时 | 2s 内没等到空位 |
-| `selected` | 这个槽位接了单 | 每次成功遍历**恰好一次**，且是最后一步 |
-
-顺序保证：所有 `chain_step` 都在 `routed` 之前，`selected` 是最后一步。
-所以只订阅 `request_end` 的插件也能拿到轨迹摘要（见下）。
-
-### 3.1c `request_end` 里的轨迹摘要
-
-除了逐个 `chain_step`，`request_end` 还带三个便于做报表的字段：
-
-| 字段 | 含义 |
-|---|---|
-| `chain_walk` | 整个遍历的步骤数组（上限 12 步，超出截断） |
-| `degraded` | 布尔。`true` = 有过跳过/失败，即**发生了降级** |
-| `tier_served` | 实际服务的那一档；直连或全失败时为 `-1` |
-
-> **计费口径**：按**实际服务的模型**计费。降级到 tier 3 仍按 tier 3 的价算，
-> `chain_step` / `degraded` / `tier_served` 只作**观测**，不参与计价。
-> 理由见 §7.5。
-
-`request_end` 放在 `writeRec` 是因为四条入口路径（直连/AUTO × 流式/非流式）都
-经过它，既不会漏（流式的 token 数只有流结束才知道），也不会重复。
-
-**hot path 注意事项**：没有插件注册某 stage 时，`Fire` 立刻返回（一次 `RLock`
-加一次 map 查找）。装了插件之后，每个请求会在该 stage 上多一次 Lua 调用——
-这是同步的，在关键路径上。计费插件那种"每请求一次"是正常的；把重活放进钩子是
-反模式。
-
-### 3.2 钩子的返回值
-
-- 返回 `nil` 或不返回 = **没有意见**，payload 原样传给下一个插件
-- 返回 table = 其中的键会**合并进 payload**，并作为 `Fire` 的返回值
-
-**同一 stage 的多个插件并行执行**，但返回值按**插件加载顺序**合并，所以结果是
-确定的（不依赖 goroutine 调度）。代价是一个插件看不到另一个插件刚加的字段：
-每个钩子拿到的是**同一份 payload 快照**。
-
-这与早期版本不同 —— 早期是顺序执行，后一个插件能看到前一个的返回值。它从未被
-实际依赖（随核心发布的 billing 在每个 stage 都 `return nil`，注释里写着
-"nobody downstream would read a return value"），但这是一处**契约变化**：如果你的
-插件依赖「读到前一个插件写的字段」，并行的两个插件之间必须改用外部通信
-（例如各自写 `plugin.state`，由 `/api/plugins/<name>/state` 读取）。
-
-单个插件时不启 goroutine，直接调用。
-
-前三个 stage 的返回值目前没有内部消费者（最后一个 stage 之后就是写审计），
-所以计费插件改用 `plugin.state` + `/state` 端点来暴露数据。
-
----
-
-## 4. 界面扩展
-
-### 4.1 整页
-
-```lua
-plugin.ui = {
-  page = {
-    page_id = "billing",   -- 必填,kebab-case。侧栏 data-tab 与 #tab-billing
-    title = "Billing",     -- 必填,侧栏文字
-    icon = "💰",           -- 可选
-    order = 40,            -- 侧栏排序,默认 100
-    mount = [[...HTML...]],
-  },
-}
-```
-
-### 4.2 往现有页面追加元素
-
-```lua
-plugin.ui = {
-  elements = {
-    {
-      target = "status",   -- status | chat | keys | sort | sources | adapters
-      anchor = "top",      -- "top" | "bottom" | "before:<sel>" | "after:<sel>"
-      order = 5,
-      mount = [[...HTML...]],
-    },
-  },
-}
-```
-
-### 4.3 `mount` 里可以带 `<script>` 和 `<style>`
-
-内核的注入顺序是：**先插 HTML，再执行 `<script>`**，所以脚本里访问
-`document.getElementById` 一定能拿到已渲染的节点。
-
-### 4.4 插件可用的浏览器端 API
-
-| API | 作用 |
-|---|---|
-| `window.pluginAPI.fetchState(name)` | 等价于 `GET /api/plugins/<name>/state` |
-| `window.pluginAPI.onTabShown(fn)` | 注册"页面切到可见时"的回调（轮询类组件用） |
-| `window.pluginAPI.postState(name, obj)` | `PUT` 自己的 state（写操作，需 admin） |
-
-### 4.5 一个完整例子
-
-见 `internal/lua/plugins/billing.lua`——它同时用了两种 UI 形式、完整的价格配置、
-以及全部三个 stage。
-
----
-
-## 5. 插件状态与 HTTP API
-
-### 5.1 端点
-
-```
-GET    /api/plugins                  已加载插件清单 + 钩子 + UI + 错误
-POST   /api/plugins                  上传/替换（admin）{name, code}
-DELETE /api/plugins/{name}           删除（admin）
-GET    /api/plugins/{name}/state     读取插件自己发布的状态
-PUT    /api/plugins/{name}/state     替换状态（admin）
-```
-
-`GET .../state` 对**任意角色开放**：它是报表数据（开销、计数），用户自己的
-计费组件要能渲染。而 `PUT` 需要 admin。
-
-### 5.2 约定：`prices` 与 `state` 分离
-
-`PUT .../state` 的载荷里如果有 `prices` 键，它会被写进插件的 **`plugin.prices`**
-字段并从 `state` 里剔除。
-
-**为什么**：`state` 是累计量（历史），`prices` 是配置。一次改价如果整体替换
-`state`，累计量就没了——账目会在改价那一刻清零。分离之后：
-
-- 只带 `prices` → 改配置，**不动** `state`（累计量保留）
-- 带其它键 → 替换 `state`（这是显式的重置）
-
-> 插件可以不遵守这个约定，把整个载荷放进 `state` 自行处理。约定只为内置的
-> 计费插件存在。
-
-### 5.3 `GET /api/plugins` 的响应
-
-```json
-{
-  "plugins": [{
-    "name": "billing", "version": "1.0.0",
-    "description": "...", "author": "...",
-    "hooks": ["request_end"],
-    "ui": { "page": "billing", "elements": 1 },
-    "loaded": true
-  }],
-  "hook_errors": { "request_end": { "count": 3, "last_error": "billing: ..." } },
-  "plugin_dir": "/etc/llmsproxy/plugins"
-}
-```
-
-`hook_errors` 是**排错入口**：一个坏掉的插件表现为"功能缺失"而不是报错，
-这个计数让它可见。
-
-### 5.4 定时任务（`PLUGIN.schedule`）—— 浏览器关着也会跑
-
-要求插件做“随时间发生”的事（自动签到、token 轮换、额度轮询）时，声明一个
-调度表：
-
-```lua
-plugin.schedule = {
-  { fn = "refresh_token", every = 3600 },                 -- 每小时（秒）
-  { fn = "daily_checkin", every = 86400, at = "03:30" }, -- 每天固定时刻（本地时间）
-  { fn = "poll_quota",    every = 300, jitter = 30 },     -- 首次触发加 0-30s 抖动
-}
-function plugin.refresh_token()
-  -- 注意：直接写 plugin.state 就是对的 ——
-  -- 任务和钩子跑在同一个 VM 上
-  plugin.state.token = fetch_new_token()
-end
-```
-
-| 字段 | 含义 |
-|---|---|
-| `fn` | 要调用的插件函数名（必须存在） |
-| `every` | 间隔秒数。与 `at` 二选一 |
-| `at` | 每天本地时间 `"HH:MM"`；设了它就忽略 `every` |
-| `jitter` | 首次触发额外随机延迟秒数（避免多实例整点齐射） |
-| `timeout` | 解析保留但目前**不生效**（见下） |
-
-要点：
-
-- **内核 ticker 驱动**，不是前端轮询：没有浏览器、没人登录也会执行。
-- **任务跑在插件自己的 VM 上**，与请求钩子共用 `plugin.state` —— 任务写的
-  token 对下一个请求立即可见，也会经同一套机制持久化到 `.<name>.state.json`。
-- 任务函数出错只记 `hook_errors`，不影响钩子与转发。
-- 没有 `schedule` 的插件不获得任何额外 VM/goroutine（零开销）。
-- **超时不能中断一个运行中的 Lua 调用**（本 LuaJIT 构建的硬限制）。任务超过
-  10 分钟不返回，该插件被**停用**（`disarmed`）：不再调度，钩子快速失败并
-  记 `hook_errors`。这是为了不让一个卡死的任务把请求永久堵在它那把锁后面。
-  修好插件后重新加载（重传/重启）即可恢复。
-
-> 同一条 6.1 的约束：任务占着插件锁，所以**任务里不要写死循环**。
-
-### 5.5 自定义对外挂载点
-
-插件的 HTTP 端点默认挂在 `/api/plugins/http/...` 下。同一个声明**同时**可在两个
-公开命名空间下访问，只要把 `path` 的第一段起成插件名：
-
-```lua
-plugin.http = {
-  { path = "myplugin/callback", method = "POST", handler = "on_callback" },
-}
-```
-
-该端点因此可在三个地方访问：
-
-| 路径 | 用途 |
-|---|---|
-| `/api/plugins/http/myplugin/callback` | 默认前缀（带登录态的管理 UI） |
-| `/plugins/myplugin/callback` | 公开（浏览器路径） |
-| `/v1/plugins/myplugin/callback` | 公开（API 路径） |
-
-可占用的命名空间只有后两个：
-
-| 前缀 | 例子 |
-|---|---|
-| `/plugins/` | `/plugins/myplugin/callback` |
-| `/v1/plugins/` | `/v1/plugins/myplugin/callback` |
-
-限制（都是为了不把内核路由变成可被插件改写的）：
-
-- **不能影子内核路由**：与 `/v1/chat/completions`、`/v1/messages`、`/api/...`
-  等重叠的挂载在加载时就被拒绝，错误信息点名冲突对象。
-- **只能是上面两个命名空间**，不接受任意前缀（否则可以拦截推理请求）。
-- 鉴权沿用端点的 `roles` / `keys` / `public` 语义（见 §5.1）；
-  `/v1/plugins/...` 属于 API 路径，未认证返回 401；`/plugins/...` 为浏览器
-  路径，未认证会跳登录页。
-- 未声明的路径不会因为落在允许命名空间而被放行——不在 handler 表里就是 404。
-
-### 5.6 在运行时安装/更新适配器（token 轮换）
-
-插件可以在运行时安装、改写**自己的**适配器 —— 这是"带自动轮换的认证"的实现
-方式：拿着新 token 重写适配器源码，后续请求自然使用新逻辑（内核重建该适配器
-的池）。**可直接在插件 `.lua` 里调用**：
-
-```lua
--- 每小时的定时任务：轮换 token 并重写适配器
-function plugin.refresh_token()
-  local tok = fetch_new_token()          -- 插件自己的取 token 逻辑
-  local name, err = __llmsproxy_adapters.install(
-    "myauth",
-    'return { name = "myauth", endpoint = "/chat/completions",' ..
-    ' headers = { ["Authorization"] = "Bearer ' .. tok .. '" } }'
-  )
-  if err then log("error", err) end
-end
-```
-
-| 调用 | 参数 | 返回 |
-|---|---|---|
-| `__llmsproxy_adapters.install(name, source)` | 适配器名 + Lua 源码 | `(生效名, nil)` 或 `(nil, err)` |
-| `__llmsproxy_adapters.update(name, source)` | 同上（只限自己装的） | `(true, nil)` 或 `(nil, err)` |
-| `__llmsproxy_adapters.remove(name)` | 适配器名（只限自己装的） | `(true, nil)` 或 `(nil, err)` |
-
-出错时不抛异常，而是返回 `(nil, err)`——与钩子/HTTP 处理器同一套约定，
-一个手滑的插件错误不会带走网关。
-
-安全规则（由 Go 侧强制，不是约定）：
-
-- 插件**只能改自己装的**适配器（归属表在 Go 侧记录，调用身份是插件启动时的
-  固定名字，无法冒充）。
-- 插件**不能影子内置适配器**（否则等于篡改发行物）；运维仍可自行覆盖。
-- 名字经过路径安全校验（无穿越/绝对路径/空白）。
-
-> 这条能力配合 §5.4 的定时任务，就是完整的自动轮换：**没有浏览器、没有人
-> 操作时，插件按时间自己把 token 换掉**。
-
----
-
-## 6. 运行时约束（重要）
-
-### 6.1 一个插件 = 一个 Lua 状态（也就是一个 VM）
-
-适配器可以有多个独立的 worker 状态（它们无状态，这是对的）。**插件不行**：
-钩子通常往 `plugin.state` 里累加，多个状态就意味着总额被劈成几份，而写价格只
-写进其中一个状态，钩子恰好跑到另一个时**所有请求按 0 计费**。
-
-因此插件持有**唯一一个**状态，所有入口（`Fire` / `State` / `SetState` / **定时任务**）
-都用这同一把互斥锁串行化。
-
-⚠️ 这条约束对**定时任务尤其关键**：任务和钩子必须是同一个 VM，否则任务写的
-`plugin.state` 是一个请求路径永远读不到的副本 —— token 轮换看起来成功了，
-对实际流量完全无效。
-
-代价：**一个卡住的钩子会卡住该插件自己的钩子**（跨插件仍然并行，每插件各自
-一把锁、各自一个 VM）。所以——
-
-> **钩子与定时任务都必须短、同步、不阻塞。** 不要在钩子里做 HTTP 请求、睡眠
-> 或重计算；长耗时的周期工作应放进 `PLUGIN.schedule`（见 §5.4），它在自己的
-> 调度 goroutine 上跑，但仍然持有这把锁，因此不能是死循环。
-
-### 6.2 异常被隔离
-
-钩子里 `error()` 不会影响转发：异常被捕获、记进 `hook_errors`、跳到下一个插件。
-适配器变换出错会让源进入冷却，但插件出错**不产生任何惩罚**——插件是可选功能。
-
-### 6.3 内置可用函数
-
-与适配器相同：`json.encode` / `json.decode`、`log(level, msg)`、
-`hmac_sha256_hex` / `sha256_hex` / `base64_encode` / `tohex`。
-
-⚠️ `os.date` 在极简运行时里可能不可用（计费插件因此有降级路径）。
-
-### 6.4 命名
-
-- 全局 `__llmsproxy_plugin` 存放插件返回的 table，**不要占用**
-- 插件间状态完全隔离，一个插件改不了另一个的全局
-
----
-
-## 7. 内置计费插件
-
-`plugins/billing.lua`，默认随首启 seed 进来，开箱可用。
-
-### 7.1 计费维度
-
-| 维度 | 用途 | 优先级 |
-|---|---|---|
-| `sources` | 源的固定价（如按请求计费的转发服务） | 中 |
-| `models` | 模型的 per-token 价 | 高 |
-| `keys` | 单个网关 key 的覆盖价 | **最高** |
-
-**token 价**优先级：`keys` > `models` > `default`。
-**`per_request` 固定价是叠加的**（不覆盖），所以一个生图模型可以既算 token 又收固定费。
-**`cache_discount`** 见 §7.7。
-
-### 7.2 价格单位
-
-**USD / 单个 token**。这是各家 provider 的公布口径，所以典型数值长这样：
-`1.25e-6`。插件内部乘以 token 数，全程不做单位换算。
-
-```json
-{
-  "prices": {
-    "currency": "USD",
-    "default":  { "prompt": 0, "completion": 0, "per_request": 0 },
-    "sources":  { "trae": { "per_request": 0.01 } },
-    "models":   {
-      "gpt-5.4": { "prompt": 1.25e-6, "completion": 1e-5 },
-      "kolors":  { "per_request": 0.04 }
-    },
-    "keys":     { "***a1b2c3": { "prompt": 1.1e-6, "completion": 9e-6 } }
-  }
-}
-```
-
-配置价目：
-
-```bash
-curl -X PUT http://127.0.0.1:8080/api/plugins/billing/state \
-  -H "Authorization: Bearer $ADMIN_KEY" -H "Content-Type: application/json" \
-  -d '{"prices":{"models":{"gpt-5.4":{"prompt":1.25e-6,"completion":1e-5}}}}'
-```
-
-读回账目：
-
-```bash
-curl -H "Authorization: Bearer $ADMIN_KEY" \
-  http://127.0.0.1:8080/api/plugins/billing/state
-```
-
-### 7.3 累计维度
-
-`total` / `by_source` / `by_model` / `by_key` / `by_day`（`YYYY-MM-DD` UTC），
-每项含 `cost`、`requests`、`prompt_tokens`、`completion_tokens`、`failures`。
-
-另有两个**降级观测**维度（来自 `chain_step`）：
-
-| 字段 | 含义 |
-|---|---|
-| `degraded_reqs` | 发生过降级的请求数 |
-| `by_tier_served` | 各档实际接单数（`{"1": 812, "2": 37}`） |
-| `skip_reasons` | 跳过原因计数，等待时长已归一（`no free slot within <wait>`） |
-
-这三项是"网关是不是在悄悄降级"的核心指标：一个持续降级的网关，账单结构和健康
-网关看起来一模一样——**除非**单独统计降级次数。
-
-### 7.4 计费策略：失败的请求怎么算
-
-**保留 token 费用，丢弃固定费用。** 理由：上游在生成后才 500，token 确实被消耗
-了；但那个从未真正发生的固定费不该收。
-
-这是本插件里**最可争议的一条**。想改成"失败也收固定费"：
-
-```json
-{ "prices": { ... }, "count_failures": true }
-```
-
-### 7.5 ⚠️ 计费插件只报表，不执法
-
-**网关自己的配额会计（`internal/gateway/stats.go`，入口处强制）才是限额权威。**
-本插件不参与任何路由或配额决策。
-
-理由：两套独立的会计路径如果对不上，比一套功能略少的更糟。计费是**观察**，
-配额是**控制**，二者分开。
-
-### 7.6 未定价流量（重要）
-
-**任何维度都没配价的请求，成本记 0。** 这是最危险的失败模式：账单照样能加总，
-只是**悄悄少报**，而且没有任何报错。
-
-所以插件单独统计它们：
-
-| 字段 | 含义 |
-|---|---|
-| `unpriced_reqs` | 没有任何价目覆盖的请求数 |
-| `unpriced_models` | 按模型点名（`{"MYSTERY-MODEL": 12}`）——直接告诉你价目表缺了哪一行 |
-
-仪表盘上有 "Unpriced" 卡片。**这个数应该是 0**；不是 0 就去补价目。
-
-注意"未定价"不等于"免费"：这些请求的 `requests` / token 数**照常计入**
-`total` 与各维度，只有金额是 0。
-
-### 7.7 提示缓存计价
-
-**缓存命中的 prompt token 不按全价算。** 绝大多数 provider 对缓存读给很深的折扣
-（常见是 1/10），而 agent 流量会反复重放长前缀——正是缓存要让它便宜的那类流量。
-
-```
-fresh  = prompt_tokens - cache_hit_tokens   → 全价
-cached = cache_hit_tokens                   → 全价 × cache_discount
-```
-
-`cache_discount` 默认 **0.1**（10 倍折扣），因为 DeepSeek / Qwen / Kimi 等都是这个
-量级。它是**每个 provider 的事实、不是自然常数**，所以可以按条目覆盖：
-
-```json
-"models": { "gpt-5.4": { "prompt": 1.25e-6, "completion": 1e-5, "cache_discount": 0.25 } }
-```
-
-设成 `1` 恢复成旧的"prompt 一律全价"行为，设成 `0` 表示该 provider 不打折。
-
-优先级与 token 价一致（`keys` > `models` > `default`）。
-
-> **这一条改过行为。** 修复前缓存命中按全价算：100 万 prompt token 里 90 万是
-> 缓存命中，会算出 10 USD 而不是 ~1.9——**高估约 10 倍**，而且恰好发生在缓存
-> 最有价值的高频流量上。
-
-### 7.8 数据从哪来
-
-`request_end` 的 `prompt_tokens` / `completion_tokens` 优先取上游真实的
-`usage`；上游没报时网关用字节估算（`len/3+1`）。流式请求在流结束后用上游真实
-数字**覆盖**估算值。所以计费数字的精度取决于上游是否报 usage。
-
----
-
-## 8. 排错
-
-| 现象 | 查什么 |
-|---|---|
-| 插件没出现在 `/api/plugins` | 目录对不对（响应里的 `plugin_dir`）；文件是不是 `.lua` |
-| `loaded: false` 且有 `error` | 语法错误或没 `return table`，错误信息在 `error` 字段 |
-| 功能"没反应"但无报错 | 查 `hook_errors`——坏钩子只记录不抛出 |
-| 钩子没被调用 | 该 stage 确实触发了吗（`routed` 只在**成功**选源后触发，调度全失败时不触发） |
-| 界面空白 | 内核的 `GET /api/ui-inject` 里有没有你的 `page_id`；脚本有没有报错（浏览器 console） |
-| `pluginAPI` 未定义 | 脚本在注入前执行了；确认用的是 `mount` 而不是别的方式插入 |
-
-### 调试钩子
-
-插件的 `log(level, msg)` 输出到网关的日志：
-
-```
-journalctl -u llmsproxy -f | grep -i plugin
-```
-
----
-
-## 9. 与适配器的区别
-
-| | 适配器 | 插件 |
-|---|---|---|
-| 位置 | `adapter_dir` | `plugin_dir` |
-| 作用 | 上游协议转换 | 请求流水线 + 界面 + 周期任务 |
-| 钩子 | `transform_request` / `transform_response` / `transform_stream_chunk` / `build_headers` / `transform_error` / `serialize_*` | `request_start` / `routed` / `request_end` |
-| 周期任务 | **无**（无状态请求级） | `PLUGIN.schedule`（内核 ticker 驱动） |
-| 对外端点 | 不开放（见 §5.5） | `/api/plugins/http/...` + 自定义挂载 |
-| 状态 | 每个源独立，多 worker | **单 VM、单状态**，见 §6.1 |
-| 出错后果 | 该 (源,模型) 进入冷却退避 | 仅该功能缺失；卡死则停用该插件 |
-| 鉴权 | 需要 `gateway_keys` 之外的独立凭据 | 网关 key |
-| 必需性 | 核心 | 可选，缺了网关照常跑 |
-
-完整适配器协议见 [lua-adapters.md](lua-adapters.md)。

e2e/adapter_takeover_test.go

@@ -1,286 +0,0 @@
-package e2e
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-// 本文件端到端验证 R2/R5 的核心主张：**对外服务的 wire 格式由适配器决定，
-// 内核只调度**；适配器不声明时内核的 OpenAI 兜底仍然可用。
-//
-// 与其他测试的分工：
-//   - internal/gateway/messages_test.go 在**进程内**验证同一件事（起 core+gateway，
-//     不打真二进制）。它跑得快，但绕过了一些只在真实进程里发生的事：Lua 适配器的
-//     磁盘 seed、配置加载、systemd 式启动路径、真 HTTP 栈。
-//   - 本文件打**真编译出的二进制**，用一个只说 Anthropic Messages 的假上游，
-//     证明整条链路（真进程 → 真 Lua 适配器 → 真上游 → 适配器序列化 → 客户端）
-//     确实成立，而不是只在进程内装配下成立。
-//
-// 这是用户明确问到的"适配器接手对外服务的部分"的验收点。
-
-// anthropicMockUpstream 是只懂 Anthropic Messages 协议的假上游。
-//
-// 它会对**不符形状的请求主动报错**，而不是宽容接受 —— 宽容的 mock 会让
-// "内核把 OpenAI 形状发给了 Anthropic 上游"这种错误测试通过。
-func anthropicMockUpstream(t *testing.T) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Anthropic 的请求路径必须是 <base>/messages
-		if !strings.HasSuffix(r.URL.Path, "/messages") {
-			t.Errorf("请求打到了非 Anthropic 路径: %s", r.URL.Path)
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		body, _ := io.ReadAll(r.Body)
-		var probe map[string]interface{}
-		if err := json.Unmarshal(body, &probe); err != nil {
-			t.Errorf("上游收到非 JSON 请求体: %s", body)
-			w.WriteHeader(http.StatusBadRequest)
-			return
-		}
-		// Anthropic 形状的硬性要求：messages 是数组；不能有 OpenAI 的 choices 概念
-		if _, ok := probe["messages"]; !ok {
-			t.Errorf("上游请求体缺 messages: %s", body)
-		}
-		if _, ok := probe["max_tokens"]; !ok {
-			t.Errorf("Anthropic 要求 max_tokens，请求体缺此项: %s", body)
-		}
-		// 反向断言：OpenAI 兜底字段不该出现在 Anthropic 上游请求里
-		for _, k := range []string{"choices", "chat_completions"} {
-			if _, bad := probe[k]; bad {
-				t.Errorf("Anthropic 上游请求体混入了 OpenAI 字段 %q: %s", k, body)
-			}
-		}
-
-		if stream, _ := probe["stream"].(bool); stream {
-			w.Header().Set("Content-Type", "text/event-stream")
-			fl, _ := w.(http.Flusher)
-			frames := []string{
-				`event: message_start` + "\n" + `data: {"type":"message_start","message":{"id":"msg_e2e","type":"message","role":"assistant","model":"claude-e2e","content":[],"stop_reason":null,"usage":{"input_tokens":3,"output_tokens":0}}}`,
-				`event: content_block_start` + "\n" + `data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}`,
-				`event: content_block_delta` + "\n" + `data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"pong"}}`,
-				`event: content_block_stop` + "\n" + `data: {"type":"content_block_stop","index":0}`,
-				`event: message_delta` + "\n" + `data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":1}}`,
-				`event: message_stop` + "\n" + `data: {"type":"message_stop"}`,
-			}
-			for _, f := range frames {
-				fmt.Fprint(w, f+"\n\n")
-				if fl != nil {
-					fl.Flush()
-				}
-			}
-			return
-		}
-
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, `{"id":"msg_e2e","type":"message","role":"assistant","model":"claude-e2e",`+
-			`"content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn",`+
-			`"usage":{"input_tokens":3,"output_tokens":1}}`)
-	}))
-	t.Cleanup(srv.Close)
-	return srv
-}
-
-// writeAnthropicConfig 写一份把源挂到 anthropic 适配器上的配置。
-func writeAnthropicConfig(t *testing.T, dir, listenAddr, upstreamURL string) string {
-	t.Helper()
-	cfg := "listen: " + listenAddr + "\n" +
-		"gateway_keys:\n  - sk-e2e-0001\n" +
-		"default_model: claude-e2e\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"sources:\n" +
-		"  - name: anth\n" +
-		"    base_url: " + upstreamURL + "\n" +
-		"    adapter: anthropic\n" +
-		"    api_key: test-key\n" +
-		"    max_concurrent: 32\n" +
-		"    models:\n" +
-		"      - id: claude-e2e\n" +
-		"        kind: chat\n" +
-		"        priority: 100\n"
-	path := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(path, []byte(cfg), 0o644); err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-	return path
-}
-
-// TestAdapterTakeoverNonStream：非流式，Anthropic 客户端形状进、出。
-func TestAdapterTakeoverNonStream(t *testing.T) {
-	up := anthropicMockUpstream(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	cfg := writeAnthropicConfig(t, dir, addr, up.URL)
-	bin := buildBinary(t)
-	g := startGateway(t, bin, addr, cfg)
-
-	resp, body := g.do("POST", "/v1/messages",
-		`{"model":"claude-e2e","max_tokens":64,"messages":[{"role":"user","content":"hi"}]}`, true)
-	if resp == nil || resp.StatusCode != 200 {
-		t.Fatalf("status=%v body=%q", statusOf(resp), body)
-	}
-	// 出向必须是 Anthropic Messages 形状，不能是 OpenAI choices 形状
-	if strings.Contains(body, `"choices"`) {
-		t.Errorf("Anthropic 响应里混入了 OpenAI choices 外壳: %s", body)
-	}
-	var out map[string]interface{}
-	if err := json.Unmarshal([]byte(body), &out); err != nil {
-		t.Fatalf("响应不是 JSON: %v: %s", err, body)
-	}
-	if out["type"] != "message" {
-		t.Errorf(`响应 type = %v, 期望 "message"（Anthropic 形状）: %s`, out["type"], body)
-	}
-	// 文本内容必须能取出来 —— 这是"内容确实穿过适配器回来了"的证据
-	if !strings.Contains(body, "pong") {
-		t.Errorf("响应里没有上游返回的文本: %s", body)
-	}
-	if _, ok := out["usage"]; !ok {
-		t.Errorf("Anthropic 响应应带 usage: %s", body)
-	}
-}
-
-// TestAdapterTakeoverStream：流式也要是 Anthropic SSE 序列，
-// 且**不得**出现 OpenAI 的 [DONE] 终止标记（R2 的"不混合"）。
-func TestAdapterTakeoverStream(t *testing.T) {
-	up := anthropicMockUpstream(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	cfg := writeAnthropicConfig(t, dir, addr, up.URL)
-	bin := buildBinary(t)
-	g := startGateway(t, bin, addr, cfg)
-
-	resp, body := g.do("POST", "/v1/messages",
-		`{"model":"claude-e2e","max_tokens":64,"stream":true,"messages":[{"role":"user","content":"hi"}]}`, true)
-	if resp == nil || resp.StatusCode != 200 {
-		t.Fatalf("stream status=%v body=%q", statusOf(resp), body)
-	}
-	if !strings.Contains(body, "message_start") {
-		t.Errorf("Anthropic 流应以 message_start 开头: %s", body)
-	}
-	if !strings.Contains(body, "message_stop") {
-		t.Errorf("Anthropic 流应以 message_stop 收尾: %s", body)
-	}
-	if strings.Contains(body, "[DONE]") {
-		t.Errorf("Anthropic 流里出现了 OpenAI 的 [DONE]: %s", body)
-	}
-	if strings.Contains(body, "chat.completion.chunk") {
-		t.Errorf("流里混入 OpenAI chunk 形状: %s", body)
-	}
-	if !strings.Contains(body, "pong") {
-		t.Errorf("流里没有上游文本: %s", body)
-	}
-}
-
-// TestAdapterTakeoverStress 是对外服务路径的真实压力测试：
-// 并发打真二进制，混合流式/非流式，验证无 5xx、上游命中数正确、
-// 且每个响应都是完整合法的 Anthropic 形状（适配器在并发下不串味）。
-func TestAdapterTakeoverStress(t *testing.T) {
-	up := anthropicMockUpstream(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	cfg := writeAnthropicConfig(t, dir, addr, up.URL)
-	bin := buildBinary(t)
-	g := startGateway(t, bin, addr, cfg)
-
-	// max_concurrent 配成 32，让 96 个请求基本都能真正流过适配器 —— 这个测试
-	// 要压的是**并发下序列化是否串味**，不是内核的容量拒绝策略。真的撞上上限
-	// 时收到的 429 也是合法背压（见下方断言），不算失败。
-	const (
-		workers   = 12
-		perWorker = 8
-	)
-
-	var (
-		wg      sync.WaitGroup
-		mu      sync.Mutex
-		ok      int
-		shed    int
-		failed  []string
-		streams int
-	)
-	start := make(chan struct{})
-
-	for w := 0; w < workers; w++ {
-		wg.Add(1)
-		go func(w int) {
-			defer wg.Done()
-			<-start
-			for i := 0; i < perWorker; i++ {
-				isStream := (w+i)%2 == 0
-				var payload string
-				if isStream {
-					payload = `{"model":"claude-e2e","max_tokens":32,"stream":true,"messages":[{"role":"user","content":"hi"}]}`
-				} else {
-					payload = `{"model":"claude-e2e","max_tokens":32,"messages":[{"role":"user","content":"hi"}]}`
-				}
-				resp, body := g.do("POST", "/v1/messages", payload, true)
-				mu.Lock()
-				switch {
-				case resp == nil:
-					failed = append(failed, "nil response")
-				// 429 = 内核的容量背压（provider busy）。它是**正确**行为，
-				// 不是缺陷：并发超限时就该如实拒绝，而不是排队或伪造响应。
-				// 只要求它是结构良好的错误，不要求 200。
-				case resp.StatusCode == http.StatusTooManyRequests:
-					if !strings.Contains(body, "busy") && !strings.Contains(body, "error") {
-						failed = append(failed, "429 不是结构化错误: "+body)
-					} else {
-						shed++
-					}
-				// 5xx 才是真失败 —— 那是内核或适配器崩了。
-				case resp.StatusCode >= 500:
-					failed = append(failed, fmt.Sprintf("5xx status=%d body=%.120s", resp.StatusCode, body))
-				case resp.StatusCode != 200:
-					failed = append(failed, fmt.Sprintf("status=%d body=%.120s", resp.StatusCode, body))
-				case !strings.Contains(body, "pong"):
-					// 200 但内容不对：说明并发下适配器把响应串味了
-					failed = append(failed, "missing upstream text: "+body)
-				case isStream && !strings.Contains(body, "message_stop"):
-					failed = append(failed, "stream missing message_stop")
-				case !isStream && strings.Contains(body, `"choices"`):
-					failed = append(failed, "openai shell leaked: "+body)
-				default:
-					ok++
-					if isStream {
-						streams++
-					}
-				}
-				mu.Unlock()
-			}
-		}(w)
-	}
-	close(start)
-	wg.Wait()
-
-	if len(failed) > 0 {
-		t.Fatalf("%d/%d 请求失败，前 5 例:\n%s", len(failed), workers*perWorker,
-			strings.Join(failed[:min(5, len(failed))], "\n"))
-	}
-	// 至少大部分请求必须真正流过 200 —— 全被背压拒掉说明并发上限配得太低，
-	// 那这个压力测试就没压到适配器并发。
-	if ok < workers*perWorker/2 {
-		t.Fatalf("只有 %d/%d 请求真正成功，压力未触及适配器并发路径",
-			ok, workers*perWorker)
-	}
-	t.Logf("成功 %d（其中流式 %d），背压 429 %d —— 无 5xx、无 OpenAI 形状泄漏",
-		ok, streams, shed)
-}
-
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}
-
-var _ = time.Second

e2e/channels_device_e2e_test.go

@@ -1,170 +0,0 @@
-package e2e
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-// TestChannelsDevicePollE2E 用**真二进制**跑通 channels 插件的 device-poll 登录：
-//
-//	发起登录(start_login) → 页面轮询(poll_login) 推进设备码换 token
-//	→ 凭据入保险库 → add_source 把平台接成上游源 → /v1/models 里出现其模型
-//
-// 这是对参考仓库 dsh-our-free-model「登录→领额度→接入源」形态的端到端对齐：
-// 行为（HTTP 决策分支、会话推进、最终可路由）在真进程里验证，而不是单元桩。
-//
-// 假上游模拟 MiniMax 的两个端点：设备码申请 + token 轮询（脚本化逐次响应）。
-func TestChannelsDevicePollE2E(t *testing.T) {
-	// ---- 假平台上游（loopback，白名单天然放行）----
-	var tokenHits int32
-	var tokenScript atomic.Value // []scriptStep
-	tokenScript.Store([]scriptStep{})
-	plat := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/oauth2/device/code":
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprint(w, `{"device_code":"DEV-E2E","user_code":"WXYZ-1234","verification_uri":"https://example/activate","interval":1,"expires_in":600}`)
-		case "/oauth2/token":
-			i := int(atomic.AddInt32(&tokenHits, 1)) - 1
-			script := tokenScript.Load().([]scriptStep)
-			w.Header().Set("Content-Type", "application/json")
-			if i >= len(script) {
-				w.WriteHeader(500)
-				fmt.Fprint(w, `{"error":"unexpected"}`)
-				return
-			}
-			if script[i].code != 0 && script[i].code != 200 {
-				w.WriteHeader(script[i].code)
-			}
-			fmt.Fprint(w, script[i].body)
-		case "/v1/models":
-			// 接入源后内核会探测可达；回一个 OpenAI 形状的模型列表
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprint(w, `{"object":"list","data":[{"id":"MiniMax-M3","object":"model"}]}`)
-		case "/v1/chat/completions":
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprint(w, `{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}`)
-		default:
-			w.WriteHeader(404)
-		}
-	}))
-	defer plat.Close()
-
-	// ---- 真二进制 + 配置（带 plugin_dir，让 bundled channels 落地 + 授权可持久化）----
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	pluginDir := filepath.Join(dir, "plugins") // 不预建：SeedBundled 见空目录才落地内置插件
-	cfg := "listen: " + addr + "\n" +
-		"gateway_keys:\n  - sk-e2e-0001\n" +
-		"default_model: none\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"plugin_dir: " + pluginDir + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"sources: []\n"
-	cfgPath := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(cfgPath, []byte(cfg), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	bin := buildBinary(t)
-	g := startGatewayNoModels(t, bin, addr, cfgPath)
-
-	call := func(method, path, body string) (int, map[string]interface{}) {
-		resp, raw := g.do(method, path, body, true)
-		var m map[string]interface{}
-		_ = json.Unmarshal([]byte(raw), &m)
-		return statusOf(resp), m
-	}
-
-	// 1) 授权内核动作（运维批准 add_source 等）+ 把 minimax 端点指到假上游。
-	st, m := call("PUT", "/api/plugins/channels/kernel",
-		`{"actions":["add_source","status","list_sources","probe_all","reset_health"],"all_read":false}`)
-	if st != 200 {
-		t.Fatalf("授权内核动作失败: status=%d body=%v", st, m)
-	}
-	st, m = call("POST", "/api/plugins/channels/call/set_endpoints", fmt.Sprintf(
-		`{"platform":"minimax","base_url":%q,"device":{"code_url":%q,"token_url":%q}}`,
-		plat.URL+"/v1", plat.URL+"/oauth2/device/code", plat.URL+"/oauth2/token"))
-	if st != 200 {
-		t.Fatalf("set_endpoints 失败: status=%d body=%v", st, m)
-	}
-
-	// 2) 发起 device-poll 登录：拿到会话 + user_code。
-	st, m = call("POST", "/api/plugins/http/channels/login", `{"platform":"minimax"}`)
-	if st != 200 {
-		t.Fatalf("start_login status=%d body=%v", st, m)
-	}
-	sess, _ := m["session"].(map[string]interface{})
-	if sess == nil || sess["user_code"] != "WXYZ-1234" {
-		t.Fatalf("start_login 未透传 user_code: %v", m)
-	}
-	sid, _ := sess["id"].(string)
-	if sid == "" {
-		t.Fatal("无会话 id")
-	}
-
-	// 3) 第一次轮询：上游 pending → 会话仍 pending。
-	tokenScript.Store([]scriptStep{{code: 400, body: `{"error":"authorization_pending"}`}})
-	atomic.StoreInt32(&tokenHits, 0)
-	st, m = call("GET", "/api/plugins/http/channels/login/status?id="+sid, "")
-	if m["state"] != "pending" {
-		t.Fatalf("轮询1 应 pending, 实得 %v", m)
-	}
-
-	// 4) 第二次轮询：上游发 access_token → 会话 completed，凭据入库 + 接入源。
-	tokenScript.Store([]scriptStep{{code: 200, body: `{"access_token":"MM-E2E-TOKEN","refresh_token":"MM-RF","nickname":"e2e-user"}`}})
-	atomic.StoreInt32(&tokenHits, 0)
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		st, m = call("GET", "/api/plugins/http/channels/login/status?id="+sid, "")
-		if m["state"] == "completed" || m["state"] == "failed" {
-			break
-		}
-		time.Sleep(150 * time.Millisecond)
-	}
-	if m["state"] != "completed" {
-		t.Fatalf("轮询2 应 completed, 实得 %v", m)
-	}
-	if m["account"] != "e2e-user" {
-		t.Fatalf("account 应取 nickname, 实得 %v", m)
-	}
-
-	// 5) 接入源的终局证据：/v1/models 里出现 channels-minimax 的模型。
-	deadline = time.Now().Add(5 * time.Second)
-	var modelsBody string
-	for time.Now().Before(deadline) {
-		resp, raw := g.do("GET", "/v1/models", "", true)
-		modelsBody = raw
-		if resp != nil && resp.StatusCode == 200 && strings.Contains(raw, "MiniMax-M3") {
-			break
-		}
-		time.Sleep(150 * time.Millisecond)
-	}
-	if !strings.Contains(modelsBody, "MiniMax-M3") {
-		t.Fatalf("接入源后 /v1/models 未出现 MiniMax-M3: %s", modelsBody)
-	}
-}
-
-type scriptStep struct {
-	code int
-	body string
-}
-
-// startGatewayNoModels 与 startGateway 相同，但就绪探针不要求 /v1/models 返回
-// 非空：本用例启动时没有任何源，/v1/models 是空列表（200 即就绪）。
-func startGatewayNoModels(t *testing.T, bin, listen, cfgPath string) *gatewayUnderTest {
-	t.Helper()
-	return startGateway(t, bin, listen, cfgPath)
-}
-
-var _ = net.Listen
-var _ = io.Discard

e2e/channels_flows_e2e_test.go

@@ -1,200 +0,0 @@
-package e2e
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-// TestChannelsFlowsE2E 用真二进制补齐另外三条流程的端到端：
-//
-//	Cline（WorkOS device-poll 两步：authenticate → register 换最终凭据）
-//	paste（opencode：直接 complete_login 贴 API key）
-//	manual（qoder：start_login 返回 manual_hint，再凭据完成）
-//
-// 终局证据与 TestChannelsDevicePollE2E 同一标准：/v1/models 出现该平台模型。
-func TestChannelsFlowsE2E(t *testing.T) {
-	var authHits, regHits int32
-	plat := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch r.URL.Path {
-		// ---- Cline（WorkOS）----
-		case "/user_management/authorize/device":
-			fmt.Fprint(w, `{"device_code":"CD-E2E","user_code":"CLNE-1234","verification_uri":"https://example/activate","interval":1,"expires_in":600}`)
-		case "/user_management/authenticate":
-			if atomic.AddInt32(&authHits, 1) == 1 {
-				w.WriteHeader(400)
-				fmt.Fprint(w, `{"error":"authorization_pending"}`)
-				return
-			}
-			fmt.Fprint(w, `{"access_token":"WO-E2E-AT","refresh_token":"WO-E2E-RT"}`)
-		case "/api/v1/auth/register":
-			atomic.AddInt32(&regHits, 1)
-			fmt.Fprint(w, `{"success":true,"data":{"accessToken":"CLINE-E2E-AT","refreshToken":"CLINE-E2E-RT","userInfo":{"email":"dev@example.com"}}}`)
-		// ---- 上游推理面（opencode/qoder/cline 的 base_url 都指到这里）----
-		case "/v1/models":
-			fmt.Fprint(w, `{"object":"list","data":[{"id":"big-pickle","object":"model"},{"id":"qoder-default","object":"model"},{"id":"stealth/space-bunny-alpha","object":"model"}]}`)
-		case "/v1/chat/completions":
-			fmt.Fprint(w, `{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}`)
-		default:
-			w.WriteHeader(404)
-		}
-	}))
-	defer plat.Close()
-
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	pluginDir := filepath.Join(dir, "plugins")
-	cfg := "listen: " + addr + "\n" +
-		"gateway_keys:\n  - sk-e2e-0001\n" +
-		"default_model: none\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"plugin_dir: " + pluginDir + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"sources: []\n"
-	cfgPath := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(cfgPath, []byte(cfg), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	bin := buildBinary(t)
-	g := startGatewayNoModels(t, bin, addr, cfgPath)
-
-	call := func(method, path, body string) (int, map[string]interface{}) {
-		resp, raw := g.do(method, path, body, true)
-		var m map[string]interface{}
-		_ = json.Unmarshal([]byte(raw), &m)
-		return statusOf(resp), m
-	}
-
-	st, m := call("PUT", "/api/plugins/channels/kernel",
-		`{"actions":["add_source","status","list_sources","probe_all","reset_health"],"all_read":false}`)
-	if st != 200 {
-		t.Fatalf("授权内核动作失败: status=%d body=%v", st, m)
-	}
-
-	// ---------- ① Cline：WorkOS 设备码两步 ----------
-	st, m = call("POST", "/api/plugins/channels/call/set_endpoints", fmt.Sprintf(
-		`{"platform":"cline","base_url":%q,"device":{"code_url":%q,"token_url":%q},"register":{"url":%q}}`,
-		plat.URL, plat.URL+"/user_management/authorize/device",
-		plat.URL+"/user_management/authenticate", plat.URL+"/api/v1/auth/register"))
-	if st != 200 {
-		t.Fatalf("set_endpoints(cline) 失败: status=%d body=%v", st, m)
-	}
-	st, m = call("POST", "/api/plugins/http/channels/login", `{"platform":"cline"}`)
-	if st != 200 {
-		t.Fatalf("cline start_login status=%d body=%v", st, m)
-	}
-	sess, _ := m["session"].(map[string]interface{})
-	if sess == nil || sess["user_code"] != "CLNE-1234" {
-		t.Fatalf("cline start_login 未透传 user_code: %v", m)
-	}
-	sid, _ := sess["id"].(string)
-
-	// 第一拍 pending（authorization_pending），第二拍 completed
-	atomic.StoreInt32(&authHits, 0)
-	st, m = call("GET", "/api/plugins/http/channels/login/status?id="+sid, "")
-	if m["state"] != "pending" {
-		t.Fatalf("cline 轮询1 应 pending, 实得 %v", m)
-	}
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		st, m = call("GET", "/api/plugins/http/channels/login/status?id="+sid, "")
-		if m["state"] == "completed" || m["state"] == "failed" {
-			break
-		}
-		time.Sleep(150 * time.Millisecond)
-	}
-	if m["state"] != "completed" {
-		t.Fatalf("cline 轮询2 应 completed, 实得 %v", m)
-	}
-	if m["account"] != "dev@example.com" {
-		t.Fatalf("cline account 应取 register userInfo.email, 实得 %v", m)
-	}
-	if atomic.LoadInt32(&regHits) != 1 {
-		t.Fatalf("register 应恰好调用一次, 实得 %d", regHits)
-	}
-	// 凭据必须是 register 的最终 token，不是 WorkOS token
-	var modelsBody string
-	deadline = time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		resp, raw := g.do("GET", "/v1/models", "", true)
-		modelsBody = raw
-		if resp != nil && resp.StatusCode == 200 && strings.Contains(raw, "stealth/space-bunny-alpha") {
-			break
-		}
-		time.Sleep(150 * time.Millisecond)
-	}
-	if !strings.Contains(modelsBody, "stealth/space-bunny-alpha") {
-		t.Fatalf("cline 接入后 /v1/models 未出现其模型: %s", modelsBody)
-	}
-
-	// ---------- ② paste（opencode）：complete 直接贴 key ----------
-	st, m = call("POST", "/api/plugins/channels/call/set_endpoints", fmt.Sprintf(
-		`{"platform":"opencode","base_url":%q}`, plat.URL))
-	if st != 200 {
-		t.Fatalf("set_endpoints(opencode) 失败: %v", m)
-	}
-	st, m = call("POST", "/api/plugins/http/channels/login", `{"platform":"opencode"}`)
-	if st != 200 {
-		t.Fatalf("opencode start_login status=%d", st)
-	}
-	if sess, _ = m["session"].(map[string]interface{}); sess == nil || sess["flow"] != "paste" {
-		t.Fatalf("opencode 会话 flow 应 paste: %v", m)
-	}
-	st, m = call("POST", "/api/plugins/http/channels/login/complete",
-		`{"platform":"opencode","credential":"OC-E2E-KEY"}`)
-	if st != 200 || m["ok"] != true {
-		t.Fatalf("opencode complete 失败: status=%d body=%v", st, m)
-	}
-	deadline = time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		resp, raw := g.do("GET", "/v1/models", "", true)
-		modelsBody = raw
-		if resp != nil && resp.StatusCode == 200 && strings.Contains(raw, "big-pickle") {
-			break
-		}
-		time.Sleep(150 * time.Millisecond)
-	}
-	if !strings.Contains(modelsBody, "big-pickle") {
-		t.Fatalf("opencode 接入后 /v1/models 未出现 big-pickle: %s", modelsBody)
-	}
-
-	// ---------- ③ manual（qoder）：hint 明确 + 凭据完成 ----------
-	st, m = call("POST", "/api/plugins/channels/call/set_endpoints", fmt.Sprintf(
-		`{"platform":"qoder","base_url":%q}`, plat.URL))
-	if st != 200 {
-		t.Fatalf("set_endpoints(qoder) 失败: %v", m)
-	}
-	st, m = call("POST", "/api/plugins/http/channels/login", `{"platform":"qoder"}`)
-	if st != 200 {
-		t.Fatalf("qoder start_login status=%d", st)
-	}
-	hint, _ := m["manual_hint"].(string)
-	if !strings.Contains(hint, "WASM") {
-		t.Fatalf("qoder manual_hint 应说明 WASM 不可自动, 实得 %q", hint)
-	}
-	st, m = call("POST", "/api/plugins/http/channels/login/complete",
-		`{"platform":"qoder","credential":"QD-E2E-KEY"}`)
-	if st != 200 || m["ok"] != true {
-		t.Fatalf("qoder complete 失败: status=%d body=%v", st, m)
-	}
-	deadline = time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		resp, raw := g.do("GET", "/v1/models", "", true)
-		modelsBody = raw
-		if resp != nil && resp.StatusCode == 200 && strings.Contains(raw, "qoder-default") {
-			break
-		}
-		time.Sleep(150 * time.Millisecond)
-	}
-	if !strings.Contains(modelsBody, "qoder-default") {
-		t.Fatalf("qoder 接入后 /v1/models 未出现 qoder-default: %s", modelsBody)
-	}
-}

e2e/conflict_arbitration_e2e_test.go

@@ -1,261 +0,0 @@
-package e2e
-
-import (
-	"encoding/json"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// writeE2EPlugin 落一个插件文件到 e2e 的 plugin_dir（SeedBundled 见空目录才
-// 落地内置插件，所以先放自定义插件再启动网关）。
-func writeE2EPlugin(t *testing.T, dir, name, code string) {
-	t.Helper()
-	p := filepath.Join(dir, "plugins", name)
-	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(p, []byte(code), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// e2eConfig 返回一份最小 e2e 配置文本（含 plugin_dir）。
-func e2eConfig(dir, listen string) string {
-	return "listen: " + listen + "\n" +
-		"gateway_keys:\n  - sk-e2e-0001\n" +
-		"default_model: AUTO\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"plugin_dir: " + filepath.Join(dir, "plugins") + "\n" +
-		"sources: []\n"
-}
-
-// TestConflictArbitrationE2E（用户要求：服务路径冲突不崩溃不拒启 + WebAPI 裁决）
-//
-// 真二进制全链路：
-//  1. 两个插件声明同一条 /api/plugins/http/ 路径 → 两插件都 loaded，启动正常
-//  2. 请求该路径 → 409，错误信息点名两个候选插件（不静默选边）
-//  3. GET /api/plugins/conflicts → 列出冲突（路径 + 候选 + 未裁决）
-//  4. POST /api/plugins/conflicts 裁决 → 持久化
-//  5. 再请求该路径 → 200，赢家应答（{"from":"B"}）
-//  6. /v1/models 等既有路由全程不受影响（旧通路无回归）
-func TestConflictArbitrationE2E(t *testing.T) {
-	bin := buildBinary(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-
-	writeE2EPlugin(t, dir, "plugA.lua", `
-local P = {}
-P.name = "plugA"
-P.version = "1"
-P.exports = {}
-P.http = { { path = "contested", method = "POST", handler = "h", roles = { "admin" } } }
-function P.h(req) return { status = 200, json = { from = "A" } } end
-return P
-`)
-	writeE2EPlugin(t, dir, "plugB.lua", `
-local P = {}
-P.name = "plugB"
-P.version = "1"
-P.exports = {}
-P.http = { { path = "contested", method = "POST", handler = "h", roles = { "admin" } } }
-function P.h(req) return { status = 200, json = { from = "B" } } end
-return P
-`)
-
-	cfgPath := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(cfgPath, []byte(e2eConfig(dir, addr)), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	g := startGateway(t, bin, addr, cfgPath)
-
-	// ① 两个插件都加载成功（冲突不拒载）
-	resp, body := g.do(http.MethodGet, "/api/plugins", "", true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("GET /api/plugins: %d %s", resp.StatusCode, body)
-	}
-	var list struct {
-		Plugins []struct {
-			Name   string `json:"name"`
-			Loaded bool   `json:"loaded"`
-		} `json:"plugins"`
-	}
-	if err := json.Unmarshal([]byte(body), &list); err != nil {
-		t.Fatal(err)
-	}
-	loaded := map[string]bool{}
-	for _, p := range list.Plugins {
-		loaded[p.Name] = p.Loaded
-	}
-	if !loaded["plugA"] || !loaded["plugB"] {
-		t.Fatalf("冲突的两个插件都应 loaded: %v", loaded)
-	}
-
-	// ② 请求冲突路径 → 409 + 点名候选（不静默选边）
-	resp, body = g.do(http.MethodPost, "/api/plugins/http/contested", "", true)
-	if resp.StatusCode != http.StatusConflict {
-		t.Fatalf("未裁决冲突路径应 409, 实得 %d (%s)", resp.StatusCode, body)
-	}
-	if !strings.Contains(body, "plugA") || !strings.Contains(body, "plugB") {
-		t.Fatalf("409 应点名两个候选: %s", body)
-	}
-
-	// ③ 冲突列表可见
-	resp, body = g.do(http.MethodGet, "/api/plugins/conflicts", "", true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("GET conflicts: %d %s", resp.StatusCode, body)
-	}
-	var cl struct {
-		Routes []struct {
-			Path       string   `json:"path"`
-			Candidates []string `json:"candidates"`
-			Resolved   string   `json:"resolved"`
-		} `json:"routes"`
-	}
-	if err := json.Unmarshal([]byte(body), &cl); err != nil {
-		t.Fatal(err)
-	}
-	if len(cl.Routes) != 1 || cl.Routes[0].Path != "contested" || cl.Routes[0].Resolved != "" {
-		t.Fatalf("冲突形态不对: %+v", cl)
-	}
-
-	// ④ 裁决 plugB 赢
-	arbit, _ := json.Marshal(map[string]string{
-		"kind": "route", "path": "contested", "winner": "plugB",
-	})
-	resp, body = g.do(http.MethodPost, "/api/plugins/conflicts", string(arbit), true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("POST conflicts 裁决: %d %s", resp.StatusCode, body)
-	}
-
-	// ⑤ 再请求 → 200 且赢家应答
-	resp, body = g.do(http.MethodPost, "/api/plugins/http/contested", "", true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("裁决后请求冲突路径应 200, 实得 %d (%s)", resp.StatusCode, body)
-	}
-	if !strings.Contains(body, `"from":"B"`) {
-		t.Fatalf("赢家 plugB 应答, 实得 %s", body)
-	}
-
-	// ⑥ 旧通路无回归：/v1/models 正常
-	resp, _ = g.do(http.MethodGet, "/v1/models", "", true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("旧通路 /v1/models 应 200, 实得 %d", resp.StatusCode)
-	}
-}
-
-// TestAdapterConflictE2E：插件装与内置同名适配器 → 挂起（现任保留），
-// /api/plugins/conflicts 列出，裁决 candidate 后插件版生效。
-func TestAdapterConflictE2E(t *testing.T) {
-	bin := buildBinary(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-
-	writeE2EPlugin(t, dir, "shadow.lua", `
-local P = {}
-P.name = "shadow"
-P.version = "1"
-P.exports = { "install" }
-function P.install(args)
-  local src = 'local a={} a.name="openai" a.version="SHADOW_V1" a.endpoint="/x" return a'
-  local name, err = __llmsproxy_adapters.install("openai", src)
-  return { name = name, err = err }
-end
-return P
-`)
-	cfgPath := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(cfgPath, []byte(e2eConfig(dir, addr)), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	g := startGateway(t, bin, addr, cfgPath)
-
-	// ① 安装 → 返回 err（pending 语义），内置版本不变
-	resp, body := g.do(http.MethodPost, "/api/plugins/shadow/call/install", "{}", true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("call install: %d %s", resp.StatusCode, body)
-	}
-	// Call 端点把插件返回值包在 {"result": …} 里；挂起语义的断言在 result 层做。
-	var wrapped struct {
-		Result struct {
-			Name *string `json:"name"`
-			Err  string  `json:"err"`
-		} `json:"result"`
-	}
-	if err := json.Unmarshal([]byte(body), &wrapped); err != nil {
-		t.Fatal(err)
-	}
-	out := wrapped.Result
-	if out.Name != nil {
-		t.Fatalf("挂起时不得返回生效名: %s", body)
-	}
-	if !strings.Contains(out.Err, "openai") || !strings.Contains(out.Err, "conflict") {
-		t.Fatalf("错误应点名冲突: %q", out.Err)
-	}
-
-	// ② 冲突列表可见
-	resp, body = g.do(http.MethodGet, "/api/plugins/conflicts", "", true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("GET conflicts: %d %s", resp.StatusCode, body)
-	}
-	var cl struct {
-		Adapters []struct {
-			Name      string `json:"name"`
-			Candidate string `json:"candidate"`
-		} `json:"adapters"`
-	}
-	if err := json.Unmarshal([]byte(body), &cl); err != nil {
-		t.Fatal(err)
-	}
-	if len(cl.Adapters) != 1 || cl.Adapters[0].Name != "openai" || cl.Adapters[0].Candidate != "shadow" {
-		t.Fatalf("冲突形态不对: %+v", cl)
-	}
-
-	// ③ 适配器列表里 openai 仍是内置版本（现任继续服务，不被静默覆盖）
-	assertOpenAIVersion := func(want string, msg string) {
-		t.Helper()
-		resp, body := g.do(http.MethodGet, "/api/adapters", "", true)
-		if resp.StatusCode != 200 {
-			t.Fatalf("GET /api/adapters: %d %s", resp.StatusCode, body)
-		}
-		var al struct {
-			Adapters []struct {
-				Name    string `json:"name"`
-				Version string `json:"version"`
-			} `json:"adapters"`
-		}
-		if err := json.Unmarshal([]byte(body), &al); err != nil {
-			t.Fatal(err)
-		}
-		for _, a := range al.Adapters {
-			if a.Name == "openai" {
-				if a.Version != want {
-					t.Fatalf("%s: openai 版本应 %q, 实得 %q", msg, want, a.Version)
-				}
-				return
-			}
-		}
-		t.Fatalf("%s: openai 适配器不存在: %s", msg, body)
-	}
-	assertOpenAIVersion("2.0.0", "现任内置必须继续服务（不被静默覆盖）")
-
-	// ④ 裁决 candidate → 插件版生效
-	arbit, _ := json.Marshal(map[string]string{
-		"kind": "adapter", "name": "openai", "winner": "candidate",
-	})
-	if resp, body = g.do(http.MethodPost, "/api/plugins/conflicts", string(arbit), true); resp.StatusCode != 200 {
-		t.Fatalf("裁决 candidate: %d %s", resp.StatusCode, body)
-	}
-
-	// ⑤ 适配器版本已切换 + 冲突清空
-	assertOpenAIVersion("SHADOW_V1", "裁决后插件版应生效")
-	resp, body = g.do(http.MethodGet, "/api/plugins/conflicts", "", true)
-	if resp.StatusCode != 200 {
-		t.Fatal(resp.StatusCode)
-	}
-	if strings.Contains(body, `"name":"openai"`) && strings.Contains(body, `"adapters":[{`) {
-		t.Fatalf("裁决后冲突应清除: %s", body)
-	}
-}

e2e/e2e_test.go

@@ -326,144 +326,3 @@ func statusOf(resp *http.Response) int {
 	}
 	return resp.StatusCode
 }
-
-// The startup warning about key configuration must describe the key set that
-// AUTH actually uses (cfg.Keys, via core.ListKeys), not the legacy
-// gateway_keys YAML list.
-//
-// It used to check GatewayKeys() only. seedKeys copies gateway_keys into keys[]
-// on first start and the YAML list stops being consulted, so once that list was
-// emptied — e.g. after rotating the starter key away — the process logged
-// "every request will be rejected" while seven working keys, one of them admin,
-// were in service. Observed in production: the warning appeared and that same
-// key returned HTTP 200 on /v1/models.
-//
-// The fixture reproduces exactly that shape: gateway_keys EMPTY, with the
-// working key present only in keys[].
-func TestStartupWarningReflectsRealKeysNotLegacyList(t *testing.T) {
-	up := newMockUpstream(t)
-	dir := t.TempDir()
-
-	// Seed a real install once so keys[] gets populated from gateway_keys, then
-	// rewrite the file to look like a rotated install: legacy list cleared, the
-	// seeded key still present in keys[].
-	path := writeConfig(t, dir, "127.0.0.1:0", map[string]*mockUpstream{"good": up})
-	bin := buildBinary(t)
-
-	// First run creates the sealed config with keys[] populated.
-	seedPort := freePort(t)
-	cfg1 := writeConfig(t, dir, "127.0.0.1:"+seedPort, map[string]*mockUpstream{"good": up})
-	g1 := startGateway(t, bin, "127.0.0.1:"+seedPort, cfg1)
-	g1.stop()
-
-	data, err := os.ReadFile(cfg1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(data), "keys:") {
-		t.Fatalf("first run did not populate keys[]:\n%s", data)
-	}
-
-	// Now clear the legacy gateway_keys list, keeping keys[] intact. The
-	// rewritten file may use different indentation, so match loosely.
-	cleared, n := clearGatewayKeys(string(data))
-	if n == 0 {
-		t.Fatalf("could not find a gateway_keys entry to clear in:\n%s", data)
-	}
-	if err := os.WriteFile(cfg1, []byte(cleared), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	// Start again and inspect the log. The config pins its listen address, so
-	// rewrite that field to the port we will actually poll.
-	port2 := freePort(t)
-	rehosted, ok := replaceListen(string(cleared), "127.0.0.1:"+port2)
-	if !ok {
-		t.Fatalf("could not rewrite listen in:\n%s", cleared)
-	}
-	cfg2 := filepath.Join(dir, "config2.yaml")
-	if err := os.WriteFile(cfg2, []byte(rehosted), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	g2 := startGateway(t, bin, "127.0.0.1:"+port2, cfg2)
-	defer g2.stop()
-
-	// Sanity: the key really does authenticate, so the warning would be a lie.
-	resp, _ := g2.do("GET", "/v1/models", "", true)
-	if resp == nil || resp.StatusCode != http.StatusOK {
-		t.Fatalf("key from keys[] did not authenticate (status %v); test fixture is wrong",
-			resp)
-	}
-
-	logs := g2.logString()
-	if strings.Contains(logs, "gateway_keys is EMPTY") {
-		t.Errorf("startup logged 'gateway_keys is EMPTY ... every request is rejected' while "+
-			"a working admin key was in service — the warning must read the authoritative "+
-			"key set (core.ListKeys), not the legacy YAML list.\nlog:\n%s", logs)
-	}
-	_ = path
-	_ = g1
-}
-
-func freePort(t *testing.T) string {
-	t.Helper()
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer l.Close()
-	_, port, _ := net.SplitHostPort(l.Addr().String())
-	return port
-}
-
-// stop terminates the gateway and waits, so its log buffer is complete.
-func (g *gatewayUnderTest) stop() {
-	if g == nil || g.cmd == nil || g.cmd.Process == nil {
-		return
-	}
-	_ = g.cmd.Process.Kill()
-	_, _ = g.cmd.Process.Wait()
-}
-
-// logString returns everything the gateway has written so far.
-func (g *gatewayUnderTest) logString() string { return g.log.String() }
-
-// clearGatewayKeys empties the gateway_keys list in a config, tolerating any
-// indentation the YAML writer chose. Returns the new text and how many entries
-// it removed.
-func clearGatewayKeys(src string) (string, int) {
-	lines := strings.Split(src, "\n")
-	var out []string
-	removed := 0
-	inList := false
-	for _, l := range lines {
-		trimmed := strings.TrimSpace(l)
-		if strings.HasPrefix(l, "gateway_keys:") {
-			out = append(out, "gateway_keys: []")
-			inList = true
-			removed++
-			continue
-		}
-		if inList {
-			if strings.HasPrefix(trimmed, "- ") {
-				removed++
-				continue
-			}
-			inList = false
-		}
-		out = append(out, l)
-	}
-	return strings.Join(out, "\n"), removed
-}
-
-// replaceListen rewrites the top-level listen: value.
-func replaceListen(src, addr string) (string, bool) {
-	lines := strings.Split(src, "\n")
-	for i, l := range lines {
-		if strings.HasPrefix(l, "listen:") {
-			lines[i] = "listen: " + addr
-			return strings.Join(lines, "\n"), true
-		}
-	}
-	return src, false
-}

e2e/wire_golden_test.go

@@ -1,192 +0,0 @@
-package e2e
-
-import (
-	"bufio"
-	"encoding/json"
-	"io"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-// mustAddr 选一个空闲端口并立即释放（与 e2e_test.go 的做法一致）。
-func mustAddr(t *testing.T) string {
-	t.Helper()
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("pick port: %v", err)
-	}
-	addr := l.Addr().String()
-	l.Close()
-	return addr
-}
-
-// 本文件建立**字节级**对外输出基线，供统一线格式 v2（对外序列化移交适配器）
-// 做回归比对。
-//
-// 为什么必须有它：Phase 2 要把 gateway/chat.go 里硬编码的 OpenAI wire 结构与
-// writeChatCompletion/pumpStream 的 JSON 拼装移交给适配器 serializer。现有 e2e
-// 只用 strings.Contains 做宽松断言（"包含 Hel"），无法证明"输出字节未变"——
-// 字段集、omitempty 裁剪、usage 零值处理都可能静默漂移，而客户端会因此看到
-// 不同的 wire 形状。golden 把当前输出钉死，改动前后逐字节比对。
-//
-// 更新方式：GOLDEN_UPDATE=1 go test -tags luajit ./e2e/ -run TestWireGolden
-// 更新后必须人工审阅 diff —— golden 是契约，不是快照垃圾桶。
-
-// volatile 命中每次请求都变的字段，比对前替换为占位符。
-// 允许冒号后的空白：golden 是 pretty-print 过的（`"created": 123`）。
-var volatile = []*regexp.Regexp{
-	regexp.MustCompile(`"id":\s*"[^"]*"`),
-	regexp.MustCompile(`"created":\s*\d+`),
-}
-
-func scrub(s string) string {
-	s = volatile[0].ReplaceAllString(s, `"id": "<ID>"`)
-	return volatile[1].ReplaceAllString(s, `"created": <TS>`)
-}
-
-func compareGolden(t *testing.T, name, got string) {
-	t.Helper()
-	got = scrub(got)
-	path := filepath.Join("..", ".snapshots", name)
-	if os.Getenv("GOLDEN_UPDATE") == "1" {
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(path, []byte(got), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		t.Logf("golden updated: %s", path)
-		return
-	}
-	want, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("golden missing (%s): %v\nrun GOLDEN_UPDATE=1 go test -tags luajit ./e2e/ -run TestWireGolden to create", path, err)
-	}
-	if got != string(want) {
-		t.Errorf("对外输出与 golden 漂移 (%s)\n--- want ---\n%s\n--- got ---\n%s",
-			name, string(want), got)
-	}
-}
-
-// prettyJSON 缩进输出。走 map 会排序键，从而让「字段集」成为唯一被比较的东西，
-// 忽略 Go struct 声明顺序（那不是对外契约的一部分）。
-func prettyJSON(t *testing.T, raw string) string {
-	t.Helper()
-	var v interface{}
-	if err := json.Unmarshal([]byte(raw), &v); err != nil {
-		return raw
-	}
-	out, err := json.MarshalIndent(v, "", "  ")
-	if err != nil {
-		return raw
-	}
-	return string(out)
-}
-
-// TestWireGoldenNonStreamChat 钉死非流式 /v1/chat/completions 的字段集。
-func TestWireGoldenNonStreamChat(t *testing.T) {
-	up := newMockUpstream(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	g := startGateway(t, buildBinary(t), addr, writeConfig(t, dir, addr, map[string]*mockUpstream{"good": up}))
-
-	resp, body := g.do("POST", "/v1/chat/completions",
-		`{"model":"good/good-m","messages":[{"role":"user","content":"hi"}]}`, true)
-
-	// 语义：OpenAI 客户端依赖这些顶层字段
-	var obj map[string]interface{}
-	if err := json.Unmarshal([]byte(body), &obj); err != nil {
-		t.Fatalf("not JSON: %v (%s)", err, body)
-	}
-	for _, k := range []string{"id", "object", "created", "model", "choices", "usage"} {
-		if _, ok := obj[k]; !ok {
-			t.Errorf("非流式响应缺少 OpenAI 必需字段 %q: %s", k, body)
-		}
-	}
-	if obj["object"] != "chat.completion" {
-		t.Errorf("object = %v, want chat.completion", obj["object"])
-	}
-	if resp.StatusCode != 200 {
-		t.Errorf("status = %d, want 200", resp.StatusCode)
-	}
-
-	compareGolden(t, "chat_nonstream.json", prettyJSON(t, body))
-}
-
-// TestWireGoldenStreamChat 钉死流式 SSE 的帧形状与终止序列。
-func TestWireGoldenStreamChat(t *testing.T) {
-	up := newMockUpstream(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	g := startGateway(t, buildBinary(t), addr, writeConfig(t, dir, addr, map[string]*mockUpstream{"good": up}))
-
-	resp, _ := doStream(t, g, `{"model":"good/good-m","stream":true,"messages":[{"role":"user","content":"hi"}]}`)
-	defer resp.Body.Close()
-
-	var frames []string
-	sc := bufio.NewScanner(resp.Body)
-	for sc.Scan() {
-		line := sc.Text()
-		if !strings.HasPrefix(line, "data: ") {
-			continue
-		}
-		payload := strings.TrimPrefix(line, "data: ")
-		if payload == "[DONE]" {
-			frames = append(frames, "[DONE]")
-			continue
-		}
-		frames = append(frames, prettyJSON(t, payload))
-	}
-	if len(frames) < 2 {
-		t.Fatalf("期望多帧 SSE，实得 %d: %v", len(frames), frames)
-	}
-	if frames[len(frames)-1] != "[DONE]" {
-		t.Errorf("末帧 = %q, want [DONE]", frames[len(frames)-1])
-	}
-	// 首帧必须是 role 前导：OpenAI 客户端靠它建立 assistant 消息
-	if !strings.Contains(frames[0], `"role"`) {
-		t.Errorf("首个 SSE 帧必须携带 role 前导，实得: %s", frames[0])
-	}
-
-	compareGolden(t, "chat_stream.txt", strings.Join(frames, "\n"))
-}
-
-// TestWireGoldenImage 钉死 /v1/images/generations 的响应形状。
-func TestWireGoldenImage(t *testing.T) {
-	up := newMockUpstream(t)
-	dir := t.TempDir()
-	addr := mustAddr(t)
-	g := startGateway(t, buildBinary(t), addr, writeConfig(t, dir, addr, map[string]*mockUpstream{"image": up}))
-
-	resp, body := g.do("POST", "/v1/images/generations", `{"model":"imagegen/flux-1","prompt":"a cat"}`, true)
-	if resp.StatusCode != 200 {
-		t.Fatalf("image status = %d: %s", resp.StatusCode, body)
-	}
-	if !strings.Contains(body, "QUJD") {
-		t.Fatalf("生图响应丢失了载荷: %s", body)
-	}
-	compareGolden(t, "image_generation.json", prettyJSON(t, body))
-}
-
-// doStream 发流式请求并返回未读完的响应（调用方负责逐行读 SSE）。
-func doStream(t *testing.T, g *gatewayUnderTest, body string) (*http.Response, error) {
-	t.Helper()
-	req, err := http.NewRequest("POST", "http://"+g.addr+"/v1/chat/completions", strings.NewReader(body))
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+g.key)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatalf("stream request: %v", err)
-	}
-	return resp, nil
-}
-
-var _ = io.Discard

internal/billing/compile.go

@@ -1,323 +0,0 @@
-package billing
-
-import (
-	"fmt"
-	"strings"
-
-	"llmsproxy/internal/config"
-)
-
-// Compile turns one billing profile into the prices table the billing plugin
-// expects, resolving URL rules against the gateway's actual sources.
-//
-// WHY URL RULES NEED RESOLVING AT ALL: the operator declares pricing by URL
-// because that is what a provider's price list is keyed on, and because several
-// sources can point at the same URL. The plugin, however, looks up by
-// `payload.source` (a source NAME) and by model — it has no idea what URL a
-// request went to. So the URL match happens here, at compile time, where the
-// config's name->base_url mapping is known, and the result is expressed in the
-// dimensions the plugin already supports.
-//
-// Profiles are the "let the user choose" axis: the same URL can appear in
-// several profiles and switching recomputes this table, so a gateway can be
-// repriced without editing the plugin.
-func Compile(profile *config.BillingProfile, sources []config.Source) (map[string]interface{}, error) {
-	return CompileOpts(profile, sources, false)
-}
-
-// CompileOpts is Compile with an explicit policy for rules that match no
-// source.
-//
-// The default is STRICT and that is correct for startup: a profile with a
-// typo'd URL prices nothing, every request on it is recorded as unpriced, and
-// the bill silently comes out wrong. Failing the load is the right response.
-//
-// The rules editor needs the opposite. An operator editing a half-finished
-// profile — adding a rule before the source that will use it exists, or
-// renaming a URL while typing — must be able to save and then see the warning,
-// not be blocked by an error they can only resolve by guessing. Lenient mode
-// keeps the offending rule in the config and drops it from the compiled table,
-// so it is preserved as text and clearly reported, without pretending it
-// prices anything.
-func CompileOpts(profile *config.BillingProfile, sources []config.Source, lenient bool) (map[string]interface{}, error) {
-	if profile == nil {
-		return nil, fmt.Errorf("no billing profile")
-	}
-	prices := map[string]interface{}{
-		"currency": "USD",
-		"default":  map[string]interface{}{"prompt": 0.0, "completion": 0.0, "per_request": 0.0},
-		"sources":  map[string]interface{}{},
-		"models":   map[string]interface{}{},
-		"keys":     map[string]interface{}{},
-	}
-	if profile.Default != "" {
-		prices["default_mode"] = profile.Default
-	}
-
-	// Currency is a profile-level statement; a rule may override it.
-	for i := range profile.Rules {
-		if c := profile.Rules[i].Currency; c != "" {
-			prices["currency"] = c
-			break
-		}
-	}
-
-	matched := map[string]bool{}
-	for i := range profile.Rules {
-		rule := &profile.Rules[i]
-		targets := matchSources(rule.URL, sources)
-		if len(targets) == 0 && rule.URL != "*" {
-			// A rule for a URL no source uses is almost always a typo (or a
-			// source that was removed). Failing loudly beats a profile that
-			// silently prices nothing — the whole reason this is a config file
-			// instead of a hand-written JSON blob.
-			if lenient {
-				continue // kept in the config text, reported as a warning
-			}
-			return nil, fmt.Errorf("rule url %q matches no configured source base_url", rule.URL)
-		}
-		for _, srcName := range targets {
-			if matched[srcName] {
-				// First rule wins. Two rules matching one source is ambiguous,
-				// and silently letting the later one win makes the file's
-				// meaning depend on ordering the operator cannot see.
-				continue
-			}
-			matched[srcName] = true
-			if err := applyRule(prices, rule, srcName, sources); err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	// Sources no rule matched fall through to the profile default, which the
-	// plugin applies via prices.default. Recording them explicitly means the
-	// UI can say "this source is unpriced" instead of leaving the operator to
-	// infer it from a zero.
-	var unmatched []string
-	for _, src := range sources {
-		if !matched[src.Name] {
-			unmatched = append(unmatched, src.Name)
-		}
-	}
-	if len(unmatched) > 0 {
-		prices["unmatched_sources"] = unmatched
-	}
-	return prices, nil
-}
-
-// matchSources returns the source names whose base_url matches pattern.
-// "*" matches every source (used as a catch-all default rule).
-func matchSources(pattern string, sources []config.Source) []string {
-	var out []string
-	if pattern == "*" {
-		for _, s := range sources {
-			out = append(out, s.Name)
-		}
-		return out
-	}
-	want := normalizeURL(pattern)
-	for _, s := range sources {
-		if normalizeURL(s.BaseURL) == want {
-			out = append(out, s.Name)
-		}
-	}
-	return out
-}
-
-// normalizeURL compares URLs the way an operator expects: trailing slashes and
-// case in the host are differences the provider's price list does not care
-// about, and requiring an exact byte match would make the config brittle.
-func normalizeURL(u string) string {
-	u = strings.TrimSpace(u)
-	u = strings.TrimRight(u, "/")
-	return strings.ToLower(u)
-}
-
-// applyRule writes one rule's pricing for one source into the prices table.
-func applyRule(prices map[string]interface{}, rule *config.BillingRule, srcName string, sources []config.Source) error {
-	switch rule.Mode {
-	case "free":
-		// Explicitly priced at zero. This is NOT the same as unpriced: a source
-		// the operator says is free must not appear in the unpriced warnings,
-		// or those warnings become noise and stop being read.
-		prices["sources"].(map[string]interface{})[srcName] = map[string]interface{}{
-			"prompt": 0.0, "completion": 0.0, "per_request": 0.0,
-		}
-		return nil
-
-	case "subscription":
-		// A fixed monthly commitment: the per-request MARGINAL cost is zero, and
-		// the flat fee is reported separately. Spreading a monthly fee across
-		// requests would invent a per-request number the provider never charges,
-		// and it would change every time traffic did.
-		prices["sources"].(map[string]interface{})[srcName] = map[string]interface{}{
-			"prompt": 0.0, "completion": 0.0, "per_request": 0.0,
-		}
-		fixed, _ := prices["subscriptions"].(map[string]interface{})
-		if fixed == nil {
-			fixed = map[string]interface{}{}
-			prices["subscriptions"] = fixed
-		}
-		cur := "USD"
-		if rule.Currency != "" {
-			cur = rule.Currency
-		}
-		fixed[srcName] = map[string]interface{}{
-			"monthly": rule.Subscription, "currency": cur,
-		}
-		return nil
-
-	case "unpriced":
-		// Deliberately left out of `sources` so the plugin's unpriced_models /
-		// unpriced_reqs counters catch it. That is the point: a subscription
-		// plan whose credits cannot be converted to tokens must be VISIBLE as
-		// unbilled, not quietly estimated.
-		return nil
-
-	case "token":
-		if len(rule.Models) == 0 {
-			return fmt.Errorf("rule for url %q: mode token requires at least one model", rule.URL)
-		}
-		models := prices["models"].(map[string]interface{})
-		for modelID, t := range rule.Models {
-			entry := map[string]interface{}{}
-			prompt, err := usdPerM(t.Prompt)
-			if err != nil {
-				return fmt.Errorf("model %q prompt: %w", modelID, err)
-			}
-			completion, err := usdPerM(t.Completion)
-			if err != nil {
-				return fmt.Errorf("model %q completion: %w", modelID, err)
-			}
-			entry["prompt"] = prompt
-			entry["completion"] = completion
-			if t.CacheDiscount != nil {
-				entry["cache_discount"] = *t.CacheDiscount
-			}
-			// reasoning is optional and stays ABSENT (not nil, not 0) when the
-			// rule does not set it, which is what makes the billing plugin skip
-			// the repricing branch entirely. Writing an explicit 0 here would
-			// mean "thinking is free" and silently under-bill every request
-			// from a provider that bills it like ordinary output.
-			if strings.TrimSpace(t.Reasoning) != "" {
-				rp, err := usdPerM(t.Reasoning)
-				if err != nil {
-					return fmt.Errorf("model %q reasoning: %w", modelID, err)
-				}
-				entry["reasoning_price"] = rp
-			}
-			if lc := t.LongContext; lc != nil {
-				if lc.Above <= 0 {
-					return fmt.Errorf("model %q long_context: above must be > 0", modelID)
-				}
-				above, err := longContextRate(lc, prompt)
-				if err != nil {
-					return fmt.Errorf("model %q long_context: %w", modelID, err)
-				}
-				entry["long_context"] = map[string]interface{}{
-					"above": lc.Above,
-					// Marginal, not blended. The plugin charges the tokens past the
-					// threshold at this rate and the rest at the base rate, so the
-					// threshold composes with a cache discount (which applies to the
-					// cached portion) instead of forcing the plugin to guess how
-					// the two interact.
-					"prompt": above,
-				}
-			}
-			if rule.Peak != nil {
-				entry["peak"] = compilePeak(rule.Peak)
-			}
-			models[modelID] = entry
-		}
-		// A specific-URL token rule needs a source entry so a model served
-		// from THIS url but absent from `rule.Models` is still recognised as
-		// belonging to a priced provider.
-		//
-		// A WILDCARD rule ("*") must NOT get one. "*" is a model catalogue — it
-		// says "these model ids have these prices, wherever they come from" —
-		// and marking every source priced at {0,0} would make priceFor() set
-		// priced=true for every model the catalogue does NOT list. Paid
-		// sources (commandcode, alittokenplan, …) would then record $0 instead
-		// of showing up in unpriced_reqs, which is precisely the silent
-		// zero-billing failure this whole plugin is built to make visible.
-		// The model lookup p.models[payload.model] already marks a listed
-		// model priced on its own, so the wildcard loses nothing.
-		if rule.URL != "*" {
-			if _, ok := prices["sources"].(map[string]interface{})[srcName]; !ok {
-				prices["sources"].(map[string]interface{})[srcName] = map[string]interface{}{
-					"prompt": 0.0, "completion": 0.0, "per_request": 0.0,
-				}
-			}
-		}
-		return nil
-	}
-	return fmt.Errorf("unknown mode %q", rule.Mode)
-}
-
-// usdPerM converts a USD-per-million string into the per-token rate the plugin
-// expects. Delegates to config.ParseFloatUSDPerM so the DSL validator and the
-// compiler agree byte-for-byte on what a valid price is — a value that passes
-// Validate() but fails here (or vice versa) would be the worst kind of drift.
-func usdPerM(s string) (float64, error) {
-	return config.ParseFloatUSDPerM(s)
-}
-
-// compilePeak renders the peak window in the shape the plugin reads:
-// { multiplier, windows = { { days = {...}, hours = { {lo,hi}, ... } } } }.
-//
-// The plugin reads `days` / `hours` pairs. The first version of the deployed
-// price table used { start, end, weekdays } — a shape nothing reads — so peak
-// traffic was billed at off-peak rates with no error anywhere. Compiling from
-// typed config fields removes the chance of writing the wrong key names by hand.
-func compilePeak(p *config.BillingPeak) map[string]interface{} {
-	win := map[string]interface{}{}
-	if len(p.Weekdays) > 0 {
-		days := make([]interface{}, 0, len(p.Weekdays))
-		for _, d := range p.Weekdays {
-			days = append(days, d)
-		}
-		win["days"] = days
-	}
-	if len(p.Hours) > 0 {
-		hours := make([]interface{}, 0, len(p.Hours))
-		for _, h := range p.Hours {
-			hours = append(hours, []interface{}{h[0], h[1]})
-		}
-		win["hours"] = hours
-	}
-	out := map[string]interface{}{"multiplier": p.Multiplier}
-	if len(win) > 0 {
-		out["windows"] = []interface{}{win}
-	}
-	return out
-}
-
-// longContextRate resolves the marginal per-token rate for the tokens ABOVE a
-// threshold, given the model's base per-million prompt price.
-//
-// Two ways to express it are supported because providers publish both: an
-// absolute rate (OpenAI quotes \$3.00/M past 200k) and a multiple (DeepSeek
-// quotes exactly 2x past 128k). Neither may be missing: a step with no rate is a
-// silent no-op, and an operator who wrote one meant something.
-func longContextRate(lc *config.BillingLongContext, basePerToken float64) (float64, error) {
-	hasPrompt := strings.TrimSpace(lc.Prompt) != ""
-	hasMult := lc.Multiplier > 0
-	switch {
-	case hasPrompt && hasMult:
-		p, err := usdPerM(lc.Prompt)
-		if err != nil {
-			return 0, err
-		}
-		// Both given: the absolute rate wins, because it is the one the provider
-		// actually quotes. Silently multiplying instead would produce a number
-		// the operator never wrote.
-		return p, nil
-	case hasPrompt:
-		return usdPerM(lc.Prompt)
-	case hasMult:
-		return basePerToken * lc.Multiplier, nil
-	default:
-		return 0, fmt.Errorf("needs either prompt or multiplier")
-	}
-}

internal/billing/wildcard_test.go

@@ -1,214 +0,0 @@
-package billing
-
-import (
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// The wildcard token rule must not blanket-mark every source as priced.
-//
-// Why this is a hazard and not a style question: priceFor() sets priced=true as
-// soon as the request's SOURCE has an entry in the price table, and that flag
-// is what keeps a request OUT of unpriced_reqs. A "*" rule is a model
-// catalogue — it prices specific model ids wherever they come from — but
-// compiling it into a {0,0,0} entry on all 21 sources made every model the
-// catalogue does not list look "priced at zero". Paid providers (commandcode,
-// alittokenplan, …) then stopped appearing in the unpriced warnings, which is
-// exactly the silent zero-billing failure the plugin exists to surface.
-func TestWildcardTokenRuleDoesNotMarkEverySourcePriced(t *testing.T) {
-	sources := []config.Source{
-		{Name: "free1", BaseURL: "https://free1.example.com/v1"},
-		{Name: "paid1", BaseURL: "https://paid1.example.com/v1"},
-		{Name: "paid2", BaseURL: "https://paid2.example.com/v1"},
-	}
-	profile := &config.BillingProfile{
-		ID: "p",
-		Rules: []config.BillingRule{
-			{URL: "https://free1.example.com/v1", Mode: "free"},
-			{
-				URL: "*", Mode: "token",
-				Models: map[string]config.BillingToken{
-					"only-catalogued-model": {Prompt: "1.00", Completion: "2.00"},
-				},
-			},
-		},
-	}
-	prices, err := Compile(profile, sources)
-	if err != nil {
-		t.Fatalf("compile: %v", err)
-	}
-	srcs := prices["sources"].(map[string]interface{})
-
-	// The explicitly free source keeps its entry (free is a deliberate 0).
-	if _, ok := srcs["free1"]; !ok {
-		t.Error("the explicit free rule lost its source entry")
-	}
-	// Paid sources must NOT be marked, or their unlisted models bill $0.
-	for _, name := range []string{"paid1", "paid2"} {
-		if _, ok := srcs[name]; ok {
-			t.Errorf("★ wildcard token rule marked %q as priced at 0 — its unlisted "+
-				"models will bill $0 instead of appearing as unpriced", name)
-		}
-	}
-	// The catalogue itself must still be present, or the rule prices nothing.
-	models := prices["models"].(map[string]interface{})
-	if _, ok := models["only-catalogued-model"]; !ok {
-		t.Error("the wildcard rule did not publish its model price")
-	}
-}
-
-// The inverse guard: a token rule for a SPECIFIC url still marks that source,
-// because it genuinely declares pricing for the models served from it.
-func TestSpecificURLTokenRuleStillMarksItsSource(t *testing.T) {
-	sources := []config.Source{
-		{Name: "mine", BaseURL: "https://mine.example.com/v1"},
-		{Name: "other", BaseURL: "https://other.example.com/v1"},
-	}
-	profile := &config.BillingProfile{
-		ID: "p",
-		Rules: []config.BillingRule{{
-			URL: "https://mine.example.com/v1", Mode: "token",
-			Models: map[string]config.BillingToken{
-				"m": {Prompt: "1.00", Completion: "2.00"},
-			},
-		}},
-	}
-	prices, err := Compile(profile, sources)
-	if err != nil {
-		t.Fatalf("compile: %v", err)
-	}
-	srcs := prices["sources"].(map[string]interface{})
-	if _, ok := srcs["mine"]; !ok {
-		t.Error("a specific-url token rule must still mark its own source priced")
-	}
-	if _, ok := srcs["other"]; ok {
-		t.Error("an unrelated source was marked priced by a specific-url rule")
-	}
-}
-
-// TestReasoningPriceIsOmittedUnlessSet pins the absence convention for the
-// thinking-token rate.
-//
-// A rule that says nothing about reasoning must produce a price entry with NO
-// reasoning_price key, so the billing plugin skips the repricing branch and
-// bills thinking at the ordinary output rate — which is what every provider
-// actually charges. Writing an explicit 0 instead would read as "thinking is
-// free" and silently under-bill every request from that model.
-func TestReasoningPriceIsOmittedUnlessSet(t *testing.T) {
-	sources := []config.Source{{Name: "up", BaseURL: "https://up.example/v1"}}
-
-	// Case 1: no reasoning declared → the key must not appear.
-	p1 := &config.BillingProfile{ID: "p", Rules: []config.BillingRule{{
-		URL: "https://up.example/v1", Mode: "token",
-		Models: map[string]config.BillingToken{
-			"m": {Prompt: "1.00", Completion: "2.00"},
-		},
-	}}}
-	prices, err := Compile(p1, sources)
-	if err != nil {
-		t.Fatal(err)
-	}
-	entry := prices["models"].(map[string]interface{})["m"].(map[string]interface{})
-	if _, present := entry["reasoning_price"]; present {
-		t.Errorf("reasoning_price present (%v) without a rule; the plugin would treat 0 as free",
-			entry["reasoning_price"])
-	}
-
-	// Case 2: declared → present, and converted to per-token like every other rate.
-	p2 := &config.BillingProfile{ID: "p", Rules: []config.BillingRule{{
-		URL: "https://up.example/v1", Mode: "token",
-		Models: map[string]config.BillingToken{
-			"m": {Prompt: "1.00", Completion: "2.00", Reasoning: "6.00"},
-		},
-	}}}
-	prices2, err := Compile(p2, sources)
-	if err != nil {
-		t.Fatal(err)
-	}
-	e2 := prices2["models"].(map[string]interface{})["m"].(map[string]interface{})
-	rp, ok := e2["reasoning_price"].(float64)
-	if !ok {
-		t.Fatalf("reasoning_price missing or wrong type: %#v", e2["reasoning_price"])
-	}
-	if rp != 6e-6 {
-		t.Errorf("reasoning_price = %v, want 6e-6 (USD per TOKEN)", rp)
-	}
-	// A malformed rate must be rejected, not silently ignored: an operator who
-	// typed "6 USD" expects either that value or an error, never a rule that
-	// looks applied and bills nothing.
-	p3 := &config.BillingProfile{ID: "p", Rules: []config.BillingRule{{
-		URL: "https://up.example/v1", Mode: "token",
-		Models: map[string]config.BillingToken{
-			"m": {Prompt: "1.00", Completion: "2.00", Reasoning: "six dollars"},
-		},
-	}}}
-	if _, err := Compile(p3, sources); err == nil {
-		t.Error("a non-numeric reasoning rate must fail the compile")
-	}
-}
-
-// TestLongContextStepCompiles pins the long-context step's two accepted forms
-// and its rejection of a step that would silently do nothing.
-//
-// Providers publish both shapes — DeepSeek says "2x past 128k", OpenAI quotes
-// an absolute "$3.00/M past 200k" — so both must compile. Neither may be
-// missing: a step with no rate is a rule that LOOKS like it handles long
-// context and does not, which under-bills without any visible sign.
-func TestLongContextStepCompiles(t *testing.T) {
-	sources := []config.Source{{Name: "up", BaseURL: "https://up.example/v1"}}
-
-	compile := func(lc config.BillingLongContext) (map[string]interface{}, error) {
-		p := &config.BillingProfile{ID: "p", Rules: []config.BillingRule{{
-			URL: "https://up.example/v1", Mode: "token",
-			Models: map[string]config.BillingToken{
-				"m": {Prompt: "1.00", Completion: "2.00", LongContext: &lc},
-			},
-		}}}
-		prices, err := Compile(p, sources)
-		if err != nil {
-			return nil, err
-		}
-		e := prices["models"].(map[string]interface{})["m"].(map[string]interface{})
-		return e["long_context"].(map[string]interface{}), nil
-	}
-
-	// Absolute rate (OpenAI's published shape).
-	lc1, err := compile(config.BillingLongContext{Above: 200000, Prompt: "3.00"})
-	if err != nil {
-		t.Fatalf("absolute long_context rate rejected: %v", err)
-	}
-	if lc1["above"] != 200000 || lc1["prompt"] != 3e-6 {
-		t.Errorf("absolute step = %#v, want above=200000 prompt=3e-6", lc1)
-	}
-
-	// Multiplier (DeepSeek's shape): 2x of the 1.00/M base.
-	lc2, err := compile(config.BillingLongContext{Above: 128000, Multiplier: 2})
-	if err != nil {
-		t.Fatalf("multiplier long_context rejected: %v", err)
-	}
-	if lc2["prompt"] != 2e-6 {
-		t.Errorf("multiplier step = %#v, want prompt=2e-6", lc2)
-	}
-
-	// Both given: the absolute rate wins, because that is the number the
-	// provider quotes. Multiplying instead would produce a figure the operator
-	// never wrote.
-	lc3, err := compile(config.BillingLongContext{Above: 128000, Prompt: "5.00", Multiplier: 2})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if lc3["prompt"] != 5e-6 {
-		t.Errorf("both given = %#v, want the quoted absolute rate 5e-6", lc3)
-	}
-
-	// Neither: a no-op step must fail, not compile into a rule that silently
-	// bills long context at the base rate.
-	if _, err := compile(config.BillingLongContext{Above: 128000}); err == nil {
-		t.Error("a step with neither prompt nor multiplier must be rejected")
-	}
-	// A zero threshold would make every request "long".
-	if _, err := compile(config.BillingLongContext{Above: 0, Multiplier: 2}); err == nil {
-		t.Error("above=0 must be rejected")
-	}
-}

internal/config/config.go

@@ -7,8 +7,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strconv"
-	"strings"
 	"time"
 
 	"gopkg.in/yaml.v3"
@@ -21,7 +19,6 @@ type Config struct {
 	GatewayKeys   []string     `yaml:"gateway_keys"`
 	DefaultModel  string       `yaml:"default_model"` // e.g. "AUTO" or a model id
 	AdapterDir    string       `yaml:"adapter_dir"`
-	PluginDir     string       `yaml:"plugin_dir,omitempty"` // Lua plugin directory (optional; hooks + WebUI extensions)
 	RuntimeFile   string       `yaml:"runtime_file"`
 	TLSCertFile   string       `yaml:"tls_cert_file,omitempty"`   // PEM cert; when set together with tls_key_file, serve HTTPS
 	TLSKeyFile    string       `yaml:"tls_key_file,omitempty"`    // PEM private key
@@ -30,29 +27,6 @@ type Config struct {
 	Auto          []ModelScope `yaml:"auto,omitempty"`       // AUTO 调度链规则（WebUI 优先级页编辑，chat）
 	AutoImage     []ModelScope `yaml:"auto_image,omitempty"` // AUTO 生图调度链规则（WebUI 优先级页·生图）
 	Keys          []GWKey      `yaml:"keys,omitempty"`       // 网关密钥（WebUI 密钥页管理）
-	// BillingDSL declares per-URL pricing profiles for the billing plugin.
-	//
-	// Declarative, because hand-writing the prices JSON was error-prone in ways
-	// that looked successful: the first PUT went out without the required
-	// `prices` wrapper and silently REPLACED the accumulated totals with the
-	// price table; the second used a peak-window shape the plugin does not read,
-	// so peak traffic was billed at off-peak rates — no error, the bill just
-	// quietly halved. A schema-checked config file catches both at load.
-	BillingDSL *BillingDSL `yaml:"billing,omitempty"`
-	// PluginVisibility overrides the audience a plugin declared for itself,
-	// keyed by plugin name: "admin" hides a plugin (and its state) from user
-	// keys, "all" widens one that shipped admin-only, "user,admin" names roles
-	// explicitly. An absent name leaves the plugin's own declaration in force.
-	//
-	// This exists because a plugin author cannot know the operator's policy, and
-	// the operator should not have to edit a bundled .lua to change one — the
-	// next upgrade overwrites it.
-	PluginVisibility map[string]string `yaml:"plugin_visibility,omitempty" json:"plugin_visibility,omitempty"`
-	// box seals credentials (sources' api_key/headers, keys' key) at rest.
-	// In-memory values are always plaintext; only the bytes on disk are sealed.
-	// Wired by AttachSecretBox — Load leaves it nil so `-check` and tests stay
-	// filesystem-free.
-	box *SecretBox
 }
 
 // Defaults applied to any source (YAML or runtime) that leaves a field unset.
@@ -73,20 +47,15 @@ type Model struct {
 
 // Source describes a single upstream LLM provider.
 type Source struct {
-	Name      string `yaml:"name" json:"name"`
-	BaseURL   string `yaml:"base_url" json:"base_url"`
-	APIKey    string `yaml:"api_key" json:"api_key"`
-	APIKeyEnv string `yaml:"api_key_env,omitempty" json:"-"` // reference to an env var holding the key (overrides api_key)
-	Adapter   string `yaml:"adapter" json:"adapter"`
-	Endpoint  string `yaml:"endpoint" json:"endpoint,omitempty"` // chat endpoint override
-	// StreamEndpoint overrides the CHAT endpoint for streaming requests. Most
-	// upstreams stream on the same path; Gemini is the exception (same path,
-	// different verb). Declaring it here keeps that knowledge out of the kernel,
-	// which only compares opaque strings.
-	StreamEndpoint string            `yaml:"endpoint_stream" json:"endpoint_stream,omitempty"`
-	ImageEndpoint  string            `yaml:"image_endpoint" json:"image_endpoint,omitempty"` // image endpoint override
-	Models         []Model           `yaml:"models" json:"models"`
-	Headers        map[string]string `yaml:"headers" json:"headers,omitempty"`
+	Name          string            `yaml:"name" json:"name"`
+	BaseURL       string            `yaml:"base_url" json:"base_url"`
+	APIKey        string            `yaml:"api_key" json:"api_key"`
+	APIKeyEnv     string            `yaml:"api_key_env,omitempty" json:"-"` // reference to an env var holding the key (overrides api_key)
+	Adapter       string            `yaml:"adapter" json:"adapter"`
+	Endpoint      string            `yaml:"endpoint" json:"endpoint,omitempty"`             // chat endpoint override
+	ImageEndpoint string            `yaml:"image_endpoint" json:"image_endpoint,omitempty"` // image endpoint override
+	Models        []Model           `yaml:"models" json:"models"`
+	Headers       map[string]string `yaml:"headers" json:"headers,omitempty"`
 	// ProxyURL routes this source's HTTP(S) traffic through an explicit proxy
 	// (e.g. http://127.0.0.1:7890). Empty = direct connection. Needed for
 	// upstreams behind geo/IP blocks that only respond through a proxy.
@@ -158,7 +127,6 @@ func writeDefaultConfig(path string) error {
 		GatewayKeys:  []string{key},
 		DefaultModel: "AUTO",
 		AdapterDir:   filepath.Join(abs, "adapters"),
-		PluginDir:    filepath.Join(abs, "plugins"),
 		RuntimeFile:  filepath.Join(abs, "runtime.json"),
 	}
 	out, err := yaml.Marshal(&cfg)
@@ -224,15 +192,10 @@ func RemoveSourceFromYAML(path, name string) error {
 
 // UpsertSourceInYAML adds or updates a source entry in the YAML config file.
 // Uses yaml.Node to preserve the rest of the file's comments and formatting.
-// When box is non-nil the source's credentials are sealed before writing, so a
-// newly added source never lands in the file as plaintext.
-func UpsertSourceInYAML(path, name string, src Source, box *SecretBox) error {
+func UpsertSourceInYAML(path, name string, src Source) error {
 	if path == "" {
 		return fmt.Errorf("config path is empty")
 	}
-	if err := sealSource(&src, box); err != nil {
-		return err
-	}
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return err
@@ -290,17 +253,11 @@ func UpsertSourceInYAML(path, name string, src Source, box *SecretBox) error {
 
 // Save writes the current config back to the YAML file (preserving comments
 // via yaml.Node round-trip when possible, or full marshaling as fallback).
-// Credentials are sealed on the way out and the in-memory copy is restored to
-// plaintext afterwards, so callers keep working with usable values.
 func (c *Config) Save() error {
 	if c.Path == "" {
 		return fmt.Errorf("config path is empty")
 	}
-	if err := c.sealInPlace(c.box); err != nil {
-		return err
-	}
 	out, err := yaml.Marshal(c)
-	c.unsealAfterWrite(c.box)
 	if err != nil {
 		return fmt.Errorf("marshal config: %w", err)
 	}
@@ -315,9 +272,6 @@ func (c *Config) ApplyDefaults() error {
 	if c.AdapterDir == "" {
 		c.AdapterDir = "adapters"
 	}
-	// PluginDir is deliberately NOT defaulted: with no plugins a missing
-	// directory would be created and seeded on every start for nothing. An
-	// operator opts in by setting it (or by dropping files into it).
 	if c.RuntimeFile == "" {
 		c.RuntimeFile = "runtime.json"
 	}
@@ -378,14 +332,13 @@ type RuntimeConfig struct {
 // name and api_key) so the WebUI can spin up multiple key-bearing sources
 // from one shared template.
 type SourceTemplate struct {
-	Name           string            `json:"name"`
-	BaseURL        string            `json:"base_url"`
-	Adapter        string            `json:"adapter"`
-	Endpoint       string            `json:"endpoint,omitempty"`
-	StreamEndpoint string            `json:"endpoint_stream,omitempty"`
-	ImageEndpoint  string            `json:"image_endpoint,omitempty"`
-	Models         []Model           `json:"models"`
-	Headers        map[string]string `json:"headers,omitempty"`
+	Name          string            `json:"name"`
+	BaseURL       string            `json:"base_url"`
+	Adapter       string            `json:"adapter"`
+	Endpoint      string            `json:"endpoint,omitempty"`
+	ImageEndpoint string            `json:"image_endpoint,omitempty"`
+	Models        []Model           `json:"models"`
+	Headers       map[string]string `json:"headers,omitempty"`
 	// ProxyURL routes this source's HTTP(S) traffic through an explicit proxy.
 	ProxyURL      string                 `json:"proxy_url,omitempty"`
 	Meta          map[string]interface{} `json:"meta,omitempty"`
@@ -399,271 +352,24 @@ type SourceTemplate struct {
 // (full management) or "user" (sees only its own key); Models is the allowed
 // model scope with per-model token quota (0 = unlimited).
 type GWKey struct {
-	Key  string `yaml:"key" json:"key"`
-	Role string `yaml:"role" json:"role"`
-	Name string `yaml:"name,omitempty" json:"name,omitempty"`
-	// Auto is this key's own AUTO scheduling chain. It overrides the global
-	// cfg.Auto for requests authenticated with this key; nil (or an empty
-	// list) means "inherit the global chain", so keys created before per-key
-	// chains existed keep working untouched.
-	Auto      []ModelScope `yaml:"auto,omitempty" json:"auto,omitempty"`
+	Key       string       `yaml:"key" json:"key"`
+	Role      string       `yaml:"role" json:"role"`
+	Name      string       `yaml:"name,omitempty" json:"name,omitempty"`
 	Models    []ModelScope `yaml:"models,omitempty" json:"models,omitempty"`
 	Note      string       `yaml:"note,omitempty" json:"note,omitempty"`
 	CreatedAt int64        `yaml:"created_at,omitempty" json:"created_at,omitempty"`
 	Seed      bool         `yaml:"seed,omitempty" json:"seed,omitempty"` // true if migrated from config gateway_keys
 }
 
-// HasOwnAuto reports whether the key declares its own AUTO chain rather than
-// inheriting the global one. An explicitly empty list still counts as "no own
-// chain" so a user can clear an override back to the global default.
-func (k GWKey) HasOwnAuto() bool { return len(k.Auto) > 0 }
-
-// BillingDSL holds declarative per-URL pricing profiles for the billing plugin.
-//
-// Profiles are the "let the user pick" axis: the same upstream URL can be
-// declared under multiple profiles, and the operator chooses which is active.
-// Switching recomputes and re-injects the billing plugin's prices table.
-type BillingDSL struct {
-	// Active is the id of the profile in effect. Empty => the first profile.
-	Active   string           `yaml:"active,omitempty" json:"active,omitempty"`
-	Profiles []BillingProfile `yaml:"profiles,omitempty" json:"profiles,omitempty"`
-}
-
-// BillingProfile is one named set of per-URL pricing rules.
-type BillingProfile struct {
-	ID    string `yaml:"id" json:"id"`
-	Label string `yaml:"label,omitempty" json:"label,omitempty"`
-	// Default applies when no rule matches: "free" or "unpriced".
-	Default string        `yaml:"default,omitempty" json:"default,omitempty"`
-	Rules   []BillingRule `yaml:"rules,omitempty" json:"rules,omitempty"`
-}
-
-// BillingRule declares the pricing for everything under one URL.
-type BillingRule struct {
-	// URL matches a source's base_url. "*" = any unmatched URL.
-	URL string `yaml:"url" json:"url"`
-	// Mode is one of: free, token, subscription, unpriced.
-	Mode     string `yaml:"mode" json:"mode"`
-	Currency string `yaml:"currency,omitempty" json:"currency,omitempty"`
-	// Subscription is the flat monthly cost (for mode=subscription).
-	Subscription float64 `yaml:"subscription,omitempty" json:"subscription,omitempty"`
-	// Models declares per-token prices when mode=token.
-	Models map[string]BillingToken `yaml:"models,omitempty" json:"models,omitempty"`
-	// Free is true when mode=free (kept for explicitness).
-	// Peak applies to ALL token-priced requests under this URL.
-	Peak *BillingPeak `yaml:"peak,omitempty" json:"peak,omitempty"`
-}
-
-// BillingToken is the per-model price.
-type BillingToken struct {
-	Prompt        string   `yaml:"prompt" json:"prompt"`         // USD per million tokens, e.g. "0.15"
-	Completion    string   `yaml:"completion" json:"completion"` // USD per million tokens
-	CacheDiscount *float64 `yaml:"cache_discount,omitempty" json:"cache_discount,omitempty"`
-	// Reasoning is the USD-per-million rate for thinking tokens, for the rare
-	// provider that charges them differently from ordinary output. Omit it and
-	// reasoning is billed at Completion — which is what OpenAI, DeepSeek and
-	// Anthropic all do, and what every source on this deployment reports.
-	//
-	// It is a rate for a SUBSET of completion tokens, never an extra charge: the
-	// billing plugin applies only the difference between this and Completion, so
-	// setting it to a multiple of Completion reprices the thinking share rather
-	// than billing it twice.
-	Reasoning string `yaml:"reasoning,omitempty" json:"reasoning,omitempty"`
-	// LongContext is the prompt-price step above a token threshold. Nil = one
-	// flat rate, which is what a rule means when it says nothing.
-	LongContext *BillingLongContext `yaml:"long_context,omitempty" json:"long_context,omitempty"`
-}
-
-// BillingPeak declares peak-hour pricing.
-type BillingPeak struct {
-	Multiplier float64 `yaml:"multiplier" json:"multiplier"`
-	// Weekdays: 1=Mon..5=Fri (Lua os.date !%w, 0=Sun)
-	Weekdays []int `yaml:"weekdays,omitempty" json:"weekdays,omitempty"`
-	// Hours: each pair is [lo,hi] inclusive
-	Hours [][2]int `yaml:"hours,omitempty" json:"hours,omitempty"`
-}
-
-// BillingLongContext is a prompt-price step for long inputs.
-//
-// Every major provider charges the input tokens ABOVE a threshold at a higher
-// rate — DeepSeek doubles past 128k, OpenAI and Anthropic step up as well. A
-// flat prompt price therefore under-bills exactly the traffic an agent workload
-// generates, and it under-bills it silently: the number is plausible, the bill
-// adds up, and nothing says the rate was wrong.
-//
-// The step applies to the PROMPT only. Output and cache reads are billed at
-// their own rates regardless of input length, which is how providers publish
-// it — the higher rate is for the extra context you made the model read, not for
-// what it wrote back.
-type BillingLongContext struct {
-	// Above is the token count the step starts at. A request with exactly this
-	// many prompt tokens is still at the base rate; the step covers the tokens
-	// BEYOND it. Inclusive-below matches how the providers document it.
-	Above int `yaml:"above" json:"above"`
-	// Prompt is the USD-per-million rate for the tokens above Above.
-	Prompt string `yaml:"prompt" json:"prompt"`
-	// Multiplier is an alternative to Prompt: a factor applied to the base rate
-	// (DeepSeek's published step is exactly 2x). When both are set Prompt wins,
-	// and setting neither is a validation error rather than a silent no-op.
-	Multiplier float64 `yaml:"multiplier,omitempty" json:"multiplier,omitempty"`
-}
-
-// Validate rejects a BillingDSL that could not work as written.
-func (b *BillingDSL) Validate() error {
-	if b == nil {
-		return nil
-	}
-	ids := map[string]bool{}
-	for i := range b.Profiles {
-		p := &b.Profiles[i]
-		if p.ID == "" {
-			return fmt.Errorf("billing profile [%d] has no id", i)
-		}
-		if ids[p.ID] {
-			return fmt.Errorf("billing profile id %q appears more than once", p.ID)
-		}
-		ids[p.ID] = true
-		if p.Default != "" && p.Default != "free" && p.Default != "unpriced" {
-			return fmt.Errorf("profile %q: default must be free or unpriced, got %q", p.ID, p.Default)
-		}
-		for j := range p.Rules {
-			r := &p.Rules[j]
-			if r.URL == "" {
-				return fmt.Errorf("profile %q rule [%d]: url is required", p.ID, j)
-			}
-			switch r.Mode {
-			case "free", "token", "subscription", "unpriced":
-			default:
-				return fmt.Errorf("profile %q rule [%d]: mode must be free/token/subscription/unpriced, got %q", p.ID, j, r.Mode)
-			}
-			if r.Mode == "token" {
-				for m, t := range r.Models {
-					if t.Prompt == "" || t.Completion == "" {
-						return fmt.Errorf("profile %q model %q: prompt and completion are required for token mode", p.ID, m)
-					}
-					if _, err := ParseFloatUSDPerM(t.Prompt); err != nil {
-						return fmt.Errorf("profile %q model %q prompt: %w", p.ID, m, err)
-					}
-					if _, err := ParseFloatUSDPerM(t.Completion); err != nil {
-						return fmt.Errorf("profile %q model %q completion: %w", p.ID, m, err)
-					}
-				}
-			}
-		}
-	}
-	// Active must resolve to a profile id.
-	if b.Active != "" && !ids[b.Active] {
-		return fmt.Errorf("billing.active = %q but no profile has that id", b.Active)
-	}
-	return nil
-}
-
-// Resolve returns the profile with the given id; empty id (or an id that does
-// not exist) falls back to the FIRST profile. A config with profiles but no
-// active marker should mean "use the one I wrote first" rather than "price
-// nothing", which is what a nil here would silently do.
-func (b *BillingDSL) Resolve(id string) *BillingProfile {
-	if b == nil || len(b.Profiles) == 0 {
-		return nil
-	}
-	if id != "" {
-		for i := range b.Profiles {
-			if b.Profiles[i].ID == id {
-				return &b.Profiles[i]
-			}
-		}
-	}
-	return &b.Profiles[0]
-}
-
-// parseFloatUSDPerM parses a USD-per-million price string. Returns the
-// per-single-token rate the plugin expects (price / 1e6).
-//
-// Kept as a string in the DSL rather than a float: "0.15" survives round-trips
-// through YAML editors, and a malformed value must fail VALIDATION (with the
-// file and field named) rather than parse as 0 and under-bill silently — which
-// is exactly the failure mode that motivated the DSL.
-func ParseFloatUSDPerM(s string) (float64, error) {
-	f, err := strconv.ParseFloat(strings.TrimSpace(s), 64)
-	if err != nil {
-		return 0, fmt.Errorf("not a number: %q", s)
-	}
-	if f < 0 {
-		return 0, fmt.Errorf("negative price: %q", s)
-	}
-	return f / 1e6, nil
-}
-
-// KeyQuota is retained only to carry a scope entry's caps through the admin
-// API. Quotas are per model, never per key: there is deliberately no key-wide
-// total, so exhausting one model's budget never blocks the others.
-type KeyQuota struct {
-	TokenQuota int64  `json:"token_quota"`
-	ReqQuota   int64  `json:"req_quota"`
-	Period     string `json:"period"`
-	Hours      int64  `json:"hours"`
-}
-
-// NormalizeRole defaults an empty role to "user", so a key can never end up in
-// a state where no role means "neither admin nor user".
-func NormalizeRole(role string) string {
-	if role == "admin" {
-		return "admin"
-	}
-	return "user"
-}
-
-// Validate rejects a quota configuration that could not work as written. A
-// period is only meaningful when at least one cap is set, and a cap of zero
-// means "unlimited" rather than "deny everything", so those are the only two
-// things worth rejecting.
-func (q KeyQuota) Validate() error {
-	if q.TokenQuota < 0 {
-		return fmt.Errorf("token_quota must be >= 0 (0 = unlimited)")
-	}
-	if q.ReqQuota < 0 {
-		return fmt.Errorf("req_quota must be >= 0 (0 = unlimited)")
-	}
-	if q.Hours < 0 {
-		return fmt.Errorf("hours must be >= 0")
-	}
-	if q.TokenQuota > 0 || q.ReqQuota > 0 {
-		if err := ValidatePeriod(q.Period, q.Hours); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// ValidatePeriod accepts the quota period vocabulary: "" (never resets),
-// "hour", "week", "month", or "nhour" with hours >= 1. An unknown period is
-// rejected rather than silently treated as "never resets", which would turn a
-// typo into an all-time quota — the opposite of what the operator typed.
-func ValidatePeriod(period string, hours int64) error {
-	switch period {
-	case "", "hour", "week", "month":
-		return nil
-	case "nhour":
-		if hours < 1 {
-			return fmt.Errorf("period %q needs hours >= 1", period)
-		}
-		return nil
-	}
-	return fmt.Errorf("period must be one of \"\", hour, week, month, nhour (got %q)", period)
-}
-
-// ModelScope is one allowed model for a key, or one AUTO scheduling slot.
-// Its TokenQuota and ReqQuota cap THAT entry only, independently of every
-// other entry on the same key: a model that runs out of budget stops being
-// served while the key's other models keep working. TokenQuota 0 / ReqQuota 0
-// = unlimited. Period "" = never resets; "hour"/"week"/"month" are fixed
-// windows; "nhour" uses Hours.
+// ModelScope is one allowed model for a key, or one AUTO scheduling slot,
+// with an optional token quota and reset period. TokenQuota 0 = unlimited;
+// Period "" = never resets; "hour"/"week"/"month" are fixed windows; "nhour"
+// uses Hours as the window length in hours.
 type ModelScope struct {
 	Model      string `yaml:"model" json:"model"`
 	Source     string `yaml:"source,omitempty" json:"source,omitempty"` // optional: pin to one upstream source; "" = any source
 	Tier       int    `yaml:"tier,omitempty" json:"tier,omitempty"`
 	TokenQuota int64  `yaml:"token_quota" json:"token_quota"`
-	ReqQuota   int64  `yaml:"req_quota,omitempty" json:"req_quota,omitempty"`
 	Period     string `yaml:"period,omitempty" json:"period,omitempty"`
 	Hours      int64  `yaml:"hours,omitempty" json:"hours,omitempty"`
 }
@@ -682,7 +388,6 @@ func (m *ModelScope) UnmarshalJSON(b []byte) error {
 		Source     string `json:"source"`
 		Tier       int    `json:"tier"`
 		TokenQuota int64  `json:"token_quota"`
-		ReqQuota   int64  `json:"req_quota"`
 		Period     string `json:"period"`
 		Hours      int64  `json:"hours"`
 	}
@@ -693,7 +398,6 @@ func (m *ModelScope) UnmarshalJSON(b []byte) error {
 	m.Source = o.Source
 	m.Tier = o.Tier
 	m.TokenQuota = o.TokenQuota
-	m.ReqQuota = o.ReqQuota
 	m.Period = o.Period
 	m.Hours = o.Hours
 	return nil

internal/config/secret_config.go

@@ -1,317 +0,0 @@
-package config
-
-// Secret handling for config.yaml.
-//
-// config.yaml is 0644 world-readable by design (ops need to inspect it), so any
-// credential in it must not sit there in plaintext. Sources' api_key / headers
-// and gateway keys are therefore sealed at rest with the same SecretBox used by
-// the runtime store, and unsealed in memory at load time.
-//
-// The invariant that makes this safe: **in-memory values are always plaintext**,
-// and the enc:v1: prefix is what marks a file value as sealed. Read paths that
-// predate this (core.resolveSourceKey) already unseal, so only the write side and
-// the load-time normalize step are new.
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"strings"
-)
-
-// sealSource seals one source's credentials in place (used by the YAML upsert
-// path, which is a package function and therefore has no Config to borrow a box
-// from).
-func sealSource(s *Source, box *SecretBox) error {
-	if box == nil {
-		return nil
-	}
-	if s.APIKey != "" && !strings.HasPrefix(s.APIKey, encPrefix) {
-		v, err := box.Encrypt(s.APIKey)
-		if err != nil {
-			return err
-		}
-		s.APIKey = v
-	}
-	for k, v := range s.Headers {
-		if v == "" || strings.HasPrefix(v, encPrefix) {
-			continue
-		}
-		e, err := box.Encrypt(v)
-		if err != nil {
-			return err
-		}
-		s.Headers[k] = e
-	}
-	return nil
-}
-
-// normalizeSecrets unseals every credential in the freshly parsed config so the
-// rest of the program only ever sees plaintext. A value without the enc:v1:
-// prefix is left untouched, which keeps hand-written plaintext configs working
-// (and is what a pre-encryption config file looks like).
-//
-// A value that carries the prefix but fails to decrypt is a hard error, not
-// something to paper over: returning the ciphertext (MustDecrypt's behavior)
-// would let the next Save re-seal it and turn one bad value into permanent,
-// compounding corruption. Losing the master key must be loud.
-func (c *Config) normalizeSecrets(box *SecretBox) error {
-	if box == nil {
-		return nil
-	}
-	for i := range c.Sources {
-		s := &c.Sources[i]
-		if strings.HasPrefix(s.APIKey, encPrefix) {
-			v, err := box.Decrypt(s.APIKey)
-			if err != nil {
-				return fmt.Errorf("source %q api_key: %w", s.Name, err)
-			}
-			s.APIKey = v
-		}
-		for k, v := range s.Headers {
-			if strings.HasPrefix(v, encPrefix) {
-				d, err := box.Decrypt(v)
-				if err != nil {
-					return fmt.Errorf("source %q header %q: %w", s.Name, k, err)
-				}
-				s.Headers[k] = d
-			}
-		}
-	}
-	for i := range c.Keys {
-		if strings.HasPrefix(c.Keys[i].Key, encPrefix) {
-			v, err := box.Decrypt(c.Keys[i].Key)
-			if err != nil {
-				return fmt.Errorf("gateway key %q: %w", c.Keys[i].Name, err)
-			}
-			c.Keys[i].Key = v
-		}
-	}
-	return nil
-}
-
-// sealInPlace replaces plaintext credentials with ciphertext for writing. It is
-// deliberately a separate step from Marshal: callers that need the plaintext
-// (auth comparisons, log output, returning a key to the operator who just
-// created it) must not be handed a sealed config by accident.
-func (c *Config) sealInPlace(box *SecretBox) error {
-	if box == nil {
-		return nil
-	}
-	for i := range c.Sources {
-		s := &c.Sources[i]
-		if s.APIKey != "" && !strings.HasPrefix(s.APIKey, encPrefix) {
-			v, err := box.Encrypt(s.APIKey)
-			if err != nil {
-				return err
-			}
-			s.APIKey = v
-		}
-		if len(s.Headers) > 0 {
-			sealed := make(map[string]string, len(s.Headers))
-			for k, v := range s.Headers {
-				if v == "" || strings.HasPrefix(v, encPrefix) {
-					sealed[k] = v
-					continue
-				}
-				e, err := box.Encrypt(v)
-				if err != nil {
-					return err
-				}
-				sealed[k] = e
-			}
-			s.Headers = sealed
-		}
-	}
-	for i := range c.Keys {
-		k := &c.Keys[i]
-		if k.Key != "" && !strings.HasPrefix(k.Key, encPrefix) {
-			v, err := box.Encrypt(k.Key)
-			if err != nil {
-				return err
-			}
-			k.Key = v
-		}
-	}
-	return nil
-}
-
-// unsealAfterWrite restores plaintext after a sealed marshal so the live process
-// keeps working on plaintext values (mirrors Store.persistLocked's dance).
-func (c *Config) unsealAfterWrite(box *SecretBox) {
-	// Save just encrypted every value it can see, so a failure here is
-	// impossible; ignore the error rather than panic in a write path.
-	_ = c.normalizeSecrets(box)
-}
-
-// hasPlaintextSecrets reports whether any credential in the config is still in
-// the clear. Used to decide whether a startup migration write is needed, and to
-// warn (without leaking values) when no master key is available.
-func (c *Config) hasPlaintextSecrets() bool {
-	for _, s := range c.Sources {
-		if s.APIKey != "" && !strings.HasPrefix(s.APIKey, encPrefix) {
-			return true
-		}
-		for _, v := range s.Headers {
-			if v != "" && !strings.HasPrefix(v, encPrefix) {
-				return true
-			}
-		}
-	}
-	for _, k := range c.Keys {
-		if k.Key != "" && !strings.HasPrefix(k.Key, encPrefix) {
-			return true
-		}
-	}
-	return false
-}
-
-// countPlaintextSecrets returns how many credentials are still in the clear, for
-// an operator-facing migration log line that must not print the values.
-func (c *Config) countPlaintextSecrets() int {
-	n := 0
-	for _, s := range c.Sources {
-		if s.APIKey != "" && !strings.HasPrefix(s.APIKey, encPrefix) {
-			n++
-		}
-		for _, v := range s.Headers {
-			if v != "" && !strings.HasPrefix(v, encPrefix) {
-				n++
-			}
-		}
-	}
-	for _, k := range c.Keys {
-		if k.Key != "" && !strings.HasPrefix(k.Key, encPrefix) {
-			n++
-		}
-	}
-	return n
-}
-
-// NormalizeSecretsForRun unseals the loaded config and then seals it back on
-// disk if anything was still in the clear. Order matters: Load() read the file
-// with ciphertext still in place, so the unseal has to happen before the
-// registry (and any Save the startup path performs) sees the values.
-func (c *Config) NormalizeSecretsForRun(box *SecretBox) error {
-	hadPlaintext, err := c.UnsealSecrets(box)
-	if err != nil {
-		return err
-	}
-	return c.SealIfNeeded(hadPlaintext)
-}
-
-// UnsealSecrets decrypts every sealed credential in memory and reports whether
-// the config ON DISK still held plaintext (i.e. whether a sealing write is
-// needed). It never writes; a failed decrypt (wrong master key) is returned so
-// the process refuses to start instead of running with unusable credentials.
-//
-// The return value must be computed BEFORE unsealing and from the disk state,
-// not from memory: after a Save the in-memory values are always plaintext, so a
-// "is anything plaintext?" test run afterwards is unconditionally true and a
-// caller would rewrite the file on every start. That was the actual behaviour -
-// migratePlaintextSecrets() claimed to be idempotent in a comment but rewrote
-// config.yaml on every boot.
-//
-// Callers that consume credentials (the provider registry, key seeding) must
-// unseal FIRST. Seeding compares cfg.Keys[i].Key against the plaintext
-// gateway_keys entries; running it while keys are still ciphertext made the
-// dedupe never match, so every restart appended another copy of the same admin
-// key (production accumulated four).
-func (c *Config) UnsealSecrets(box *SecretBox) (bool, error) {
-	if box == nil {
-		return false, nil
-	}
-	c.AttachSecretBox(box)
-	hadPlaintext := c.hasPlaintextSecrets()
-	if err := c.normalizeSecrets(box); err != nil {
-		return hadPlaintext, err
-	}
-	return hadPlaintext, nil
-}
-
-// SealIfNeeded writes the config back once if hadPlaintext reported that the
-// file still held clear-text credentials. When it is false the file is left
-// untouched, which is what makes startup a no-op for an already-sealed config.
-func (c *Config) SealIfNeeded(hadPlaintext bool) error {
-	if !hadPlaintext || c.box == nil || c.Path == "" {
-		return nil
-	}
-	n := c.countPlaintextSecrets()
-	if err := c.Save(); err != nil {
-		return err
-	}
-	log.Printf("[config] sealed %d plaintext credential(s) in %s", n, c.Path)
-	return nil
-}
-
-// AttachSecretBox wires the encryption box into the config so Save can seal
-// credentials. Kept as an explicit call (rather than a constructor argument) so
-// config.Load stays usable in contexts that have no filesystem secrets (tests,
-// `-check`).
-func (c *Config) AttachSecretBox(box *SecretBox) { c.box = box }
-
-// SecretBox returns the wired encryption box, or nil when none is attached.
-func (c *Config) SecretBox() *SecretBox { return c.box }
-
-// migratePlaintextSecrets seals any credential still in the clear and writes the
-// file once. Kept for callers that attach the box themselves; it decides from
-// the in-memory state, which is why UnsealSecrets + SealIfNeeded (which decide
-// from the on-disk state) are preferred on the startup path.
-func (c *Config) migratePlaintextSecrets() error {
-	if c.box == nil || c.Path == "" {
-		return nil
-	}
-	if !c.hasPlaintextSecrets() {
-		return nil
-	}
-	n := c.countPlaintextSecrets()
-	if err := c.Save(); err != nil {
-		return err
-	}
-	log.Printf("[config] sealed %d plaintext credential(s) in %s", n, c.Path)
-	return nil
-}
-
-// PrintSecrets writes the config's credentials to stdout in the clear and
-// returns an error only when the file cannot be read or the master key does not
-// match. It is the operator counterpart to sealing-at-rest: with keys stored as
-// ciphertext, "which key is this source using" must still be answerable.
-//
-// It deliberately takes a path rather than a *Config so the caller cannot
-// accidentally hand it a config that has already been unsealed in memory, and it
-// never writes anything.
-func PrintSecrets(path string) error {
-	cfg, err := Load(path)
-	if err != nil {
-		return err
-	}
-	box, err := NewSecretBox(cfg.RuntimeFile)
-	if err != nil {
-		return fmt.Errorf("%w (is master.key present and intact?)", err)
-	}
-	if err := cfg.normalizeSecrets(box); err != nil {
-		return err
-	}
-	w := os.Stdout
-	fmt.Fprintf(w, "# %s — %d source(s), %d gateway key(s)\n", path, len(cfg.Sources), len(cfg.Keys))
-	for _, s := range cfg.Sources {
-		fmt.Fprintf(w, "source %-16s api_key=%s\n", s.Name, orNone(s.APIKey))
-		for k, v := range s.Headers {
-			if v != "" {
-				fmt.Fprintf(w, "source %-16s header[%s]=%s\n", s.Name, k, v)
-			}
-		}
-	}
-	for _, k := range cfg.Keys {
-		fmt.Fprintf(w, "key    %-16s role=%-5s %s\n", k.Name, k.Role, k.Key)
-	}
-	fmt.Fprintf(w, "gateway_keys (legacy): %s\n", strings.Join(cfg.GatewayKeys, " "))
-	return nil
-}
-
-func orNone(s string) string {
-	if s == "" {
-		return "(unset)"
-	}
-	return s
-}

internal/config/secret_config_test.go

@@ -1,323 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// writeMasterKey plants a deterministic master.key next to the given runtime
-// file so tests exercise the real box instead of the env-var shortcut.
-func writeMasterKey(t *testing.T, runtimeFile string) *SecretBox {
-	t.Helper()
-	if err := os.WriteFile(filepath.Join(filepath.Dir(runtimeFile), "master.key"),
-		[]byte(strings.Repeat("ab", 32)), 0600); err != nil {
-		t.Fatal(err)
-	}
-	box, err := NewSecretBox(runtimeFile)
-	if err != nil {
-		t.Fatalf("NewSecretBox: %v", err)
-	}
-	return box
-}
-
-func TestSaveSealsCredentialsAndLoadUnseals(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	runtime := filepath.Join(dir, "runtime.json")
-	box := writeMasterKey(t, runtime)
-
-	cfg := &Config{
-		Path:   path,
-		Listen: "127.0.0.1:0",
-		Sources: []Source{{
-			Name:    "up",
-			BaseURL: "http://up/v1",
-			APIKey:  "sk-plaintext-secret",
-			Adapter: "openai",
-			Headers: map[string]string{"X-Extra": "header-secret"},
-			Models:  []Model{{ID: "m", Kind: "chat"}},
-		}},
-		Keys: []GWKey{{Key: "sk-gw-plain", Role: "admin", Name: "admin"}},
-	}
-	cfg.AttachSecretBox(box)
-	if err := cfg.Save(); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
-
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	text := string(raw)
-	if strings.Contains(text, "sk-plaintext-secret") {
-		t.Error("source api_key written in plaintext")
-	}
-	if strings.Contains(text, "header-secret") {
-		t.Error("source header written in plaintext")
-	}
-	if strings.Contains(text, "sk-gw-plain") {
-		t.Error("gateway key written in plaintext")
-	}
-	if n := strings.Count(text, encPrefix); n != 3 {
-		t.Errorf("expected 3 sealed values, found %d", n)
-	}
-
-	// The live in-memory config must still hold plaintext after Save.
-	if cfg.Sources[0].APIKey != "sk-plaintext-secret" {
-		t.Errorf("in-memory api_key mutated by Save: %q", cfg.Sources[0].APIKey)
-	}
-	if cfg.Keys[0].Key != "sk-gw-plain" {
-		t.Errorf("in-memory gateway key mutated by Save: %q", cfg.Keys[0].Key)
-	}
-
-	// A fresh load must hand back plaintext again.
-	loaded, err := Load(path)
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	loaded.AttachSecretBox(box)
-	loaded.normalizeSecrets(box)
-	if loaded.Sources[0].APIKey != "sk-plaintext-secret" {
-		t.Errorf("loaded api_key = %q, want plaintext", loaded.Sources[0].APIKey)
-	}
-	if loaded.Sources[0].Headers["X-Extra"] != "header-secret" {
-		t.Errorf("loaded header = %q, want plaintext", loaded.Sources[0].Headers["X-Extra"])
-	}
-	if loaded.Keys[0].Key != "sk-gw-plain" {
-		t.Errorf("loaded gateway key = %q, want plaintext", loaded.Keys[0].Key)
-	}
-}
-
-func TestPlaintextConfigStillLoads(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	// A hand-written, pre-encryption config: no enc:v1: anywhere.
-	body := `listen: 127.0.0.1:0
-sources:
-  - name: legacy
-    base_url: http://legacy/v1
-    api_key: sk-written-by-hand
-    adapter: openai
-    models:
-      - id: m
-        kind: chat
-`
-	if err := os.WriteFile(path, []byte(body), 0644); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := Load(path)
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	box := writeMasterKey(t, filepath.Join(dir, "runtime.json"))
-	cfg.AttachSecretBox(box)
-	cfg.normalizeSecrets(box)
-	if cfg.Sources[0].APIKey != "sk-written-by-hand" {
-		t.Errorf("plaintext config value changed: %q", cfg.Sources[0].APIKey)
-	}
-}
-
-// Sealing a config is a one-time migration: the FIRST run writes, every later
-// start must leave the file alone.
-//
-// This test previously called migratePlaintextSecrets() twice and compared
-// ModTime. That assertion was both weak and wrong:
-//
-//   - migratePlaintextSecrets decides from IN-MEMORY state, and Save() ends by
-//     unsealing memory so the running process keeps working. So every call sees
-//     "plaintext present" and rewrites the file. Comparing ModTime hid this
-//     because two writes inside one filesystem timestamp tick look identical —
-//     the test flaked (~1 in 6) instead of failing.
-//   - it also exercised a function production no longer calls on the startup
-//     path, which now uses UnsealSecrets + SealIfNeeded (they decide from the
-//     ON-DISK state).
-//
-// So the test targets that real path and compares file CONTENT, which cannot be
-// fooled by timestamp granularity.
-func TestSealingIsIdempotentAcrossStarts(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	runtime := filepath.Join(dir, "runtime.json")
-	box := writeMasterKey(t, runtime)
-
-	cfg := &Config{
-		Path:    path,
-		Listen:  "127.0.0.1:0",
-		Sources: []Source{{Name: "up", BaseURL: "http://up/v1", APIKey: "sk-clear", Adapter: "openai", Models: []Model{{ID: "m"}}}},
-	}
-	cfg.AttachSecretBox(box)
-
-	hadPlaintext, err := cfg.UnsealSecrets(box)
-	if err != nil {
-		t.Fatalf("unseal: %v", err)
-	}
-	if !hadPlaintext {
-		t.Fatal("a config written with a clear-text credential must report plaintext")
-	}
-	if err := cfg.SealIfNeeded(hadPlaintext); err != nil {
-		t.Fatalf("seal: %v", err)
-	}
-	first, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(first), encPrefix) {
-		t.Fatal("sealing did not encrypt the value on disk")
-	}
-	// In-memory must be plaintext so the running process keeps working.
-	if cfg.Sources[0].APIKey != "sk-clear" {
-		t.Errorf("in-memory api_key = %q, want plaintext", cfg.Sources[0].APIKey)
-	}
-
-	// Simulate the next start: load from disk, unseal, seal-if-needed. The file
-	// was already sealed, so nothing may be written.
-	cfg2, err := Load(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg2.AttachSecretBox(box)
-	hadPlaintext2, err := cfg2.UnsealSecrets(box)
-	if err != nil {
-		t.Fatalf("second unseal: %v", err)
-	}
-	if hadPlaintext2 {
-		t.Error("a sealed config reported plaintext — SealIfNeeded would rewrite " +
-			"the file on every start")
-	}
-	if err := cfg2.SealIfNeeded(hadPlaintext2); err != nil {
-		t.Fatalf("second seal: %v", err)
-	}
-	second, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(first) != string(second) {
-		t.Error("the second start rewrote an already-sealed config; startup must be a no-op")
-	}
-}
-
-func TestSealedValueDoesNotDoubleEncrypt(t *testing.T) {
-	dir := t.TempDir()
-	box := writeMasterKey(t, filepath.Join(dir, "runtime.json"))
-	cfg := &Config{Path: filepath.Join(dir, "config.yaml"), Sources: []Source{{Name: "a", BaseURL: "http://a"}}}
-	cfg.AttachSecretBox(box)
-
-	once, err := box.Encrypt("sk-x")
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources[0].APIKey = once
-	if err := cfg.Save(); err != nil {
-		t.Fatal(err)
-	}
-	got, err := box.Decrypt(cfg.Sources[0].APIKey)
-	if err != nil {
-		t.Fatalf("value became undecryptable: %v", err)
-	}
-	if got != "sk-x" {
-		t.Errorf("round trip = %q, want sk-x", got)
-	}
-}
-
-func TestUpsertSourceInYAMLSealsCredentials(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	box := writeMasterKey(t, filepath.Join(dir, "runtime.json"))
-
-	if err := os.WriteFile(path, []byte("listen: 127.0.0.1:0\nsources: []\n"), 0644); err != nil {
-		t.Fatal(err)
-	}
-	src := Source{Name: "new", BaseURL: "http://new/v1", APIKey: "sk-fresh", Adapter: "openai", Models: []Model{{ID: "m"}}}
-	if err := UpsertSourceInYAML(path, src.Name, src, box); err != nil {
-		t.Fatalf("UpsertSourceInYAML: %v", err)
-	}
-	raw, _ := os.ReadFile(path)
-	if strings.Contains(string(raw), "sk-fresh") {
-		t.Error("newly added source stored its api_key in plaintext")
-	}
-	if !strings.Contains(string(raw), encPrefix) {
-		t.Error("newly added source was not sealed")
-	}
-}
-
-func TestCountPlaintextSecrets(t *testing.T) {
-	cfg := &Config{
-		Sources: []Source{
-			{Name: "a", APIKey: encPrefix + "abc", Headers: map[string]string{"H": encPrefix + "x"}},
-			{Name: "b", APIKey: "sk-in-clear", Headers: map[string]string{"H2": "clear-too"}},
-		},
-		Keys: []GWKey{{Key: "sk-gw-clear"}},
-	}
-	if got := cfg.countPlaintextSecrets(); got != 3 {
-		t.Errorf("countPlaintextSecrets = %d, want 3", got)
-	}
-	if !cfg.hasPlaintextSecrets() {
-		t.Error("hasPlaintextSecrets = false, want true")
-	}
-	cfg.Sources[1].APIKey = encPrefix + "y"
-	cfg.Sources[1].Headers["H2"] = encPrefix + "z"
-	cfg.Keys[0].Key = encPrefix + "k"
-	if cfg.hasPlaintextSecrets() {
-		t.Error("hasPlaintextSecrets = true after sealing everything")
-	}
-}
-
-// TestNormalizeSecretsFailsLoudlyOnWrongMasterKey is the negative case that
-// guards the migration: with a wrong key, a sealed value must NOT be handed
-// back as ciphertext for a later re-seal (that compounds corruption and turns
-// one lost key file into permanently unusable config).
-func TestNormalizeSecretsFailsLoudlyOnWrongMasterKey(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	runtime := filepath.Join(dir, "runtime.json")
-	good := writeMasterKey(t, runtime)
-
-	cfg := &Config{
-		Path:    path,
-		Listen:  "127.0.0.1:0",
-		Sources: []Source{{Name: "up", BaseURL: "http://up/v1", APIKey: "sk-secret", Adapter: "openai", Models: []Model{{ID: "m"}}}},
-	}
-	cfg.AttachSecretBox(good)
-	if err := cfg.Save(); err != nil {
-		t.Fatal(err)
-	}
-	sealedOnce, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// A different master key must be rejected, loudly. NewSecretBox derives the
-	// key path from the RUNTIME file's directory, so the wrong key has to live
-	// in a different directory — otherwise it would read the good master.key.
-	otherDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(otherDir, "master.key"),
-		[]byte(strings.Repeat("cd", 32)), 0600); err != nil {
-		t.Fatal(err)
-	}
-	badBox, err := NewSecretBox(filepath.Join(otherDir, "runtime.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	loaded, err := Load(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	loaded.AttachSecretBox(badBox)
-	if err := loaded.NormalizeSecretsForRun(badBox); err == nil {
-		t.Fatal("expected an error with the wrong master key, got nil")
-	}
-
-	// Crucially: the file must be untouched — no second seal on top.
-	after, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(after) != string(sealedOnce) {
-		t.Error("config file was rewritten despite the decrypt failure")
-	}
-	if n := strings.Count(string(after), encPrefix); n != strings.Count(string(sealedOnce), encPrefix) {
-		t.Errorf("sealed count changed %d -> %d (double encryption)", strings.Count(string(sealedOnce), encPrefix), n)
-	}
-}

internal/core/channels_device_test.go

@@ -1,40 +0,0 @@
-package core
-
-import (
-	"testing"
-)
-
-// TestChannelsDevicePollBehavior 是 device-poll 流的行为对齐测试。
-//
-// 决策表逐行搬自参考实现 pollMinimaxDeviceToken（minimax-oauth.ts），
-// 上游用假服务器模拟，逐次响应由测试控制。断言的是**行为**（会话状态推进），
-// 不是实现细节。决策表本体在 deviceHarness.runDecisionTable（与变异测试共用）。
-func TestChannelsDevicePollBehavior(t *testing.T) {
-	h := newDeviceHarness(t, mustChannelsSrc(t))
-	// begin 直查：user_code 透传、授权 URL、verifier 不回显
-	j := h.begin()
-	sess := j["session"].(map[string]interface{})
-	if sess["user_code"] != "ABCD-EFGH" {
-		t.Fatalf("begin 应透传 user_code, 实得 %v", sess["user_code"])
-	}
-	if j["url"] != "https://example/activate" {
-		t.Fatalf("begin 应给授权 URL, 实得 %v", j["url"])
-	}
-	if _, has := j["device_verifier"]; has {
-		t.Fatal("verifier 绝不能回显")
-	}
-	// 决策表全过
-	if !h.runDecisionTable() {
-		t.Fatal("device-poll 决策表未全过（见 runDecisionTable 内的行号）")
-	}
-}
-
-// mustChannelsSrc 读 bundled channels 源码。
-func mustChannelsSrc(t *testing.T) string {
-	t.Helper()
-	src, err := readBundledChannels(t)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return src
-}

internal/core/channels_more_test.go

@@ -1,325 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-
-	"llmsproxy/internal/lua"
-)
-
-// channelsMoreTest：新引入的三条真实流程 + 两个边界流的行为对齐测试。
-// 平台定义、决策表、端点逐字照抄参考（见 channels.lua 注释），测试照参考行为搬。
-
-// ---- Cline（WorkOS 设备码 + register 两步） ----
-
-// clineHarness 假上游：device code / authenticate / register 三端点。
-type clineHarness struct {
-	t    *testing.T
-	ps   *lua.Plugins
-	ts   *httptest.Server
-	tok  atomic.Value // 当前 authenticate 响应脚本 []scriptStep
-	step int32
-}
-
-func newClineHarness(t *testing.T) *clineHarness {
-	t.Helper()
-	h := &clineHarness{t: t}
-	h.tok.Store([]scriptStep{})
-	h.ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch r.URL.Path {
-		case "/user_management/authorize/device":
-			fmt.Fprint(w, `{"device_code":"CD1","user_code":"WXYZ-1234","verification_uri":"https://example/activate","interval":1,"expires_in":600}`)
-		case "/user_management/authenticate":
-			i := int(atomic.AddInt32(&h.step, 1)) - 1
-			s := h.tok.Load().([]scriptStep)
-			if i >= len(s) {
-				w.WriteHeader(500)
-				fmt.Fprint(w, `{"error":"unexpected"}`)
-				return
-			}
-			if s[i].http != 0 && s[i].http != 200 {
-				w.WriteHeader(s[i].http)
-			}
-			fmt.Fprint(w, s[i].body)
-		case "/api/v1/auth/register":
-			// 校验请求体是驼峰 accessToken/refreshToken（参考 registerClineTokens）
-			b, _ := io.ReadAll(r.Body)
-			for _, want := range []string{`"accessToken":"WO-AT-1"`, `"refreshToken":"WO-RT-1"`} {
-				if !strings.Contains(string(b), want) {
-					t.Errorf("register 请求体缺 %s: %s", want, b)
-				}
-			}
-			fmt.Fprint(w, `{"success":true,"data":{"accessToken":"CLINE-AT-1","refreshToken":"CLINE-RT-1","userInfo":{"clineUserId":"u1","email":"dev@example.com"}}}`)
-		default:
-			w.WriteHeader(404)
-		}
-	}))
-	t.Cleanup(h.ts.Close)
-
-	c := kernelTestCore(t)
-	h.ps = c.Plugins()
-	src, _ := readBundledChannels(t)
-	if err := h.ps.LoadSource("channels", src); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := h.ps.Call("channels", "set_endpoints", map[string]interface{}{
-		"platform": "cline",
-		"device":   map[string]interface{}{"code_url": h.ts.URL + "/user_management/authorize/device", "token_url": h.ts.URL + "/user_management/authenticate"},
-		"register": map[string]interface{}{"url": h.ts.URL + "/api/v1/auth/register"},
-	}); err != nil {
-		t.Fatalf("set_endpoints: %v", err)
-	}
-	return h
-}
-
-func (h *clineHarness) begin() map[string]interface{} {
-	out, err := h.ps.InvokeHandler("channels", "start_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"cline"}`,
-	})
-	if err != nil {
-		h.t.Fatal(err)
-	}
-	return out.JSON.(map[string]interface{})
-}
-func (h *clineHarness) poll(id string) map[string]interface{} {
-	out, _ := h.ps.InvokeHandler("channels", "poll_login", &lua.HandlerRequest{
-		Method: "GET", Query: map[string]string{"id": id},
-	})
-	return out.JSON.(map[string]interface{})
-}
-
-// runWorkosTable 是 WorkOS（Cline）分支的行为契约，供变异测试杀 workos 变异体。
-// 决策表 5 行，跟 TestClineWorkOSBehavior 同源（这里只返回布尔，不报细节）。
-func (h *clineHarness) runWorkosTable() bool {
-	st := func(steps ...string) map[string]interface{} {
-		h.tok.Store(scriptSteps(steps...))
-		atomic.StoreInt32(&h.step, 0)
-		j := h.begin()
-		sid := j["session"].(map[string]interface{})["id"].(string)
-		return h.poll(sid)
-	}
-	_ = h.ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-	// 行1: 非200+error=authorization_pending → 等
-	if j := st(`400 {"error":"authorization_pending"}`); j["state"] != "pending" {
-		return false
-	}
-	// 行2: 非200+error=slow_down → 等 + interval+1（基线 1）
-	h.tok.Store(scriptSteps(`400 {"error":"slow_down"}`))
-	atomic.StoreInt32(&h.step, 0)
-	j := h.begin()
-	sid := j["session"].(map[string]interface{})["id"].(string)
-	if j2 := h.poll(sid); j2["state"] != "pending" {
-		return false
-	} else if iv, _ := j2["interval"].(float64); iv != 2 {
-		return false
-	}
-	// 行3: error=access_denied → failed
-	if j := st(`400 {"error":"access_denied","error_description":"user declined"}`); j["state"] != "failed" {
-		return false
-	}
-	// 行4: 成功（access+refresh）→ register 换 CLINE token → completed
-	if j := st(`{"access_token":"WO-AT-1","refresh_token":"WO-RT-1"}`); j["state"] != "completed" || j["account"] != "dev@example.com" {
-		return false
-	}
-	v, _, _ := h.ps.GetSecret("channels", "channels:cline")
-	if v != "CLINE-AT-1" {
-		return false
-	}
-	// 行5: 非200无error字段 → failed（不是死等）
-	if j := st(`500 {"foo":"bar"}`); j["state"] != "failed" {
-		return false
-	}
-	return true
-}
-
-// TestClineWorkOSBehavior：WorkOS 判据（error 字段）+ register 两步 + slow_down +1s。
-func TestClineWorkOSBehavior(t *testing.T) {
-	h := newClineHarness(t)
-	_ = h.ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-
-	st := func(steps ...string) map[string]interface{} {
-		h.tok.Store(scriptSteps(steps...))
-		atomic.StoreInt32(&h.step, 0)
-		j := h.begin()
-		sid := j["session"].(map[string]interface{})["id"].(string)
-		return h.poll(sid)
-	}
-
-	t.Run("行1 error=authorization_pending_非200也继续等", func(t *testing.T) {
-		if j := st(`400 {"error":"authorization_pending"}`); j["state"] != "pending" {
-			t.Fatalf("应 pending: %v", j)
-		}
-	})
-	t.Run("行2 error=slow_down_退避1秒", func(t *testing.T) {
-		h.tok.Store(scriptSteps(`400 {"error":"slow_down"}`))
-		atomic.StoreInt32(&h.step, 0)
-		j := h.begin()
-		sid := j["session"].(map[string]interface{})["id"].(string)
-		j2 := h.poll(sid)
-		if j2["state"] != "pending" {
-			t.Fatalf("应 pending: %v", j2)
-		}
-		if iv, _ := j2["interval"].(float64); iv != 2 { // 基线 1 + slow_down_step 1
-			t.Fatalf("WorkOS slow_down 应 interval+1s 得 2, 实得 %v", iv)
-		}
-	})
-	t.Run("行3 error=access_denied_失败带拒绝", func(t *testing.T) {
-		if j := st(`400 {"error":"access_denied","error_description":"user declined"}`); j["state"] != "failed" {
-			t.Fatalf("应 failed: %v", j)
-		}
-	})
-	t.Run("行4 成功_access+refresh_再打register_凭据是CLINE-AT-1", func(t *testing.T) {
-		j := st(`{"access_token":"WO-AT-1","refresh_token":"WO-RT-1"}`)
-		if j["state"] != "completed" || j["account"] != "dev@example.com" {
-			t.Fatalf("应 completed+dev@example.com: %v", j)
-		}
-		v, _, _ := h.ps.GetSecret("channels", "channels:cline")
-		if v != "CLINE-AT-1" {
-			t.Fatalf("凭据应是 register 的 CLINE-AT-1, 实得 %q", v)
-		}
-	})
-	t.Run("行5 非200无error字段_失败", func(t *testing.T) {
-		if j := st(`500 {"foo":"bar"}`); j["state"] != "failed" {
-			t.Fatalf("应 failed: %v", j)
-		}
-	})
-}
-
-// ---- Buddy（CodeBuddy state 轮询） ----
-
-type buddyHarness struct {
-	t       *testing.T
-	ps      *lua.Plugins
-	ts      *httptest.Server
-	tokStep int32
-	tokOk   int32
-	acctOk  int32
-}
-
-func newBuddyHarness(t *testing.T) *buddyHarness {
-	t.Helper()
-	h := &buddyHarness{t: t, tokOk: 1, acctOk: 1}
-	h.ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch {
-		case r.Method == "POST" && r.URL.Path == "/v2/plugin/auth/state":
-			fmt.Fprint(w, `{"data":{"state":"ST-1","authUrl":"https://www.codebuddy.cn/login/?platform=ide&state=ST-1"}}`)
-		case r.Method == "GET" && r.URL.Path == "/v2/plugin/auth/token":
-			i := atomic.AddInt32(&h.tokStep, 1)
-			if atomic.LoadInt32(&h.tokOk) == 0 {
-				w.WriteHeader(200)
-				fmt.Fprint(w, `{"code":11217,"message":"token not ready"}`)
-				return
-			}
-			if i == 1 {
-				fmt.Fprint(w, `{"code":11217,"message":"token not ready"}`)
-			} else {
-				fmt.Fprint(w, `{"data":{"accessToken":"BD-AT-1","refreshToken":"BD-RT-1"}}`)
-			}
-		case r.Method == "GET" && r.URL.Path == "/v2/plugin/login/account":
-			if atomic.LoadInt32(&h.acctOk) == 0 {
-				w.WriteHeader(500)
-				fmt.Fprint(w, `{"code":1}`)
-				return
-			}
-			fmt.Fprint(w, `{"data":{"nickName":"buddy-dev"}}`)
-		default:
-			w.WriteHeader(404)
-		}
-	}))
-	t.Cleanup(h.ts.Close)
-
-	c := kernelTestCore(t)
-	h.ps = c.Plugins()
-	src, _ := readBundledChannels(t)
-	if err := h.ps.LoadSource("channels", src); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := h.ps.Call("channels", "set_endpoints", map[string]interface{}{
-		"platform": "buddy",
-		"state":    map[string]interface{}{"state_url": h.ts.URL + "/v2/plugin/auth/state", "token_url": h.ts.URL + "/v2/plugin/auth/token", "account_url": h.ts.URL + "/v2/plugin/login/account"},
-	}); err != nil {
-		t.Fatalf("set_endpoints: %v", err)
-	}
-	return h
-}
-
-func (h *buddyHarness) begin() (map[string]interface{}, string) {
-	out, err := h.ps.InvokeHandler("channels", "start_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"buddy"}`,
-	})
-	if err != nil {
-		h.t.Fatal(err)
-	}
-	j := out.JSON.(map[string]interface{})
-	return j, j["session"].(map[string]interface{})["id"].(string)
-}
-func (h *buddyHarness) poll(id string) map[string]interface{} {
-	out, _ := h.ps.InvokeHandler("channels", "poll_login", &lua.HandlerRequest{
-		Method: "GET", Query: map[string]string{"id": id},
-	})
-	return out.JSON.(map[string]interface{})
-}
-
-// TestBuddyStatePollBehavior：state-poll 两拍（先 11217 后 token）+ 账号查询 + account 失败不阻塞。
-func TestBuddyStatePollBehavior(t *testing.T) {
-	h := newBuddyHarness(t)
-	_ = h.ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-
-	t.Run("行1 state申请给出authUrl", func(t *testing.T) {
-		j, _ := h.begin()
-		if j["url"] == "" {
-			t.Fatalf("应有 authUrl: %v", j)
-		}
-	})
-	t.Run("行2 首拍11217仍pending_次拍token_completed", func(t *testing.T) {
-		atomic.StoreInt32(&h.tokStep, 0)
-		_, sid := h.begin()
-		if j := h.poll(sid); j["state"] != "pending" {
-			t.Fatalf("首拍应 pending: %v", j)
-		}
-		if j := h.poll(sid); j["state"] != "completed" || j["account"] != "buddy-dev" {
-			t.Fatalf("次拍应 completed+buddy-dev: %v", j)
-		}
-		v, _, _ := h.ps.GetSecret("channels", "channels:buddy")
-		if v != "BD-AT-1" {
-			t.Fatalf("凭据应 BD-AT-1, 实得 %q", v)
-		}
-	})
-	t.Run("行3 account查询失败不阻塞_回退默认名", func(t *testing.T) {
-		atomic.StoreInt32(&h.tokStep, 0)
-		atomic.StoreInt32(&h.acctOk, 0)
-		defer atomic.StoreInt32(&h.acctOk, 1)
-		_, sid := h.begin()
-		h.poll(sid)
-		j := h.poll(sid)
-		if j["state"] != "completed" {
-			t.Fatalf("account 失败不应阻塞: %v", j)
-		}
-	})
-}
-
-// ---- 通用 ----
-
-func scriptSteps(steps ...string) []scriptStep {
-	var out []scriptStep
-	for _, b := range steps {
-		code := 200
-		switch {
-		case strings.HasPrefix(b, "400 "):
-			code, b = 400, b[4:]
-		case strings.HasPrefix(b, "403 "):
-			code, b = 403, b[4:]
-		case strings.HasPrefix(b, "500 "):
-			code, b = 500, b[4:]
-		}
-		out = append(out, scriptStep{http: code, body: b})
-	}
-	return out
-}

internal/core/channels_plugin_test.go

@@ -1,241 +0,0 @@
-package core
-
-import (
-	"encoding/json"
-	"testing"
-
-	"llmsproxy/internal/lua"
-)
-
-// TestChannelsPluginEndToEnd 是「同类插件」的完整验收：
-// 内置的 channels 插件在**真实内核**上跑通「登录 → 存凭据 → 接入为上游源」。
-//
-// 这条链路横跨本次所有新增能力，所以它是最有信息量的一个测试：
-//
-//	__llmsproxy_kernel  add_source 把平台注册为上游源
-//	内核权限            默认拒绝，需运维授权
-//	额外出站主机授权    登录域不在源列表里，默认被出站白名单拒绝（plugin.hosts）
-//	登录会话            插件自持（plugin.state.sessions），内核无登录概念
-func TestChannelsPluginEndToEnd(t *testing.T) {
-	c := kernelTestCore(t)
-	ps := c.Plugins()
-
-	src, err := lua.ReadBundledPlugin("channels")
-	if err != nil {
-		t.Fatalf("读取内置 channels 插件: %v", err)
-	}
-	if err := ps.LoadSource("channels", src); err != nil {
-		t.Fatalf("加载 channels: %v", err)
-	}
-
-	// 1. 平台清单可用（未授权任何东西也应能列出）
-	out, err := ps.InvokeHandler("channels", "list_platforms", &lua.HandlerRequest{
-		Method: "GET", Role: "admin",
-	})
-	if err != nil {
-		t.Fatalf("list_platforms: %v", err)
-	}
-	body, _ := out.JSON.(map[string]interface{})
-	plats, _ := body["platforms"].([]interface{})
-	if len(plats) < 3 {
-		t.Fatalf("应至少 3 个平台, 实得 %d", len(plats))
-	}
-
-	// 2. 发起登录 → 拿到会话与 URL
-	out, err = ps.InvokeHandler("channels", "start_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"example"}`, Role: "admin",
-	})
-	if err != nil {
-		t.Fatalf("start_login: %v", err)
-	}
-	m := out.JSON.(map[string]interface{})
-	if m["error"] != nil {
-		t.Fatalf("发起登录失败: %v", m["error"])
-	}
-	if m["url"] == nil || m["url"] == "" {
-		t.Fatal("应返回用户要打开的登录 URL")
-	}
-	sess := m["session"].(map[string]interface{})
-	id, _ := sess["id"].(string)
-	if id == "" {
-		t.Fatal("应返回会话 id")
-	}
-
-	// 3. 轮询到 pending
-	out, _ = ps.InvokeHandler("channels", "poll_login", &lua.HandlerRequest{
-		Method: "GET", Query: map[string]string{"id": id}, Role: "admin",
-	})
-	if st := out.JSON.(map[string]interface{})["state"]; st != "pending" {
-		t.Fatalf("应为 pending, 实得 %v", st)
-	}
-
-	// 4. 未授权内核动作时，接入源必须失败且**如实报告**（不是假装成功）
-	out, err = ps.InvokeHandler("channels", "complete_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"example","credential":"tok-1","account":"alice"}`, Role: "admin",
-	})
-	if err != nil {
-		t.Fatalf("complete_login: %v", err)
-	}
-	done := out.JSON.(map[string]interface{})
-	if done["source_error"] == nil {
-		t.Fatal("未授权 add_source 时应报告 source_error")
-	}
-	t.Logf("未授权时的如实报告: %v", done["source_error"])
-
-	// 凭据必须已在保险库（登录本身成功了）
-	tok, ok, _ := ps.GetSecret("channels", "channels:example")
-	if !ok || tok != "tok-1" {
-		t.Fatalf("凭据应已存保险库: ok=%v tok=%q", ok, tok)
-	}
-	// 且不得出现在 state 里
-	if stateHasSecret(ps, "channels", "tok-1") {
-		t.Fatal("★ 凭据泄漏进了 plugin.state")
-	}
-
-	// 5. 运维授权后，重新接入应当真的把源注册进内核
-	if err := ps.SetPluginKernelPermission("channels",
-		[]string{"add_source", "list_sources", "status"}, false); err != nil {
-		t.Fatal(err)
-	}
-	out, err = ps.InvokeHandler("channels", "complete_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"example","credential":"tok-1","account":"alice"}`, Role: "admin",
-	})
-	if err != nil {
-		t.Fatalf("complete_login(授权后): %v", err)
-	}
-	done = out.JSON.(map[string]interface{})
-	if done["source_error"] != nil {
-		t.Fatalf("授权后仍失败: %v", done["source_error"])
-	}
-	if done["source"] != "channels-example" {
-		t.Fatalf("源名不对: %v", done["source"])
-	}
-
-	// 内核侧必须真的有这个源
-	found := false
-	for _, s := range c.Sources() {
-		if s.Name == "channels-example" {
-			found = true
-			if s.BaseURL != "https://api.example.com/v1" {
-				t.Errorf("base_url 未落库: %q", s.BaseURL)
-			}
-		}
-	}
-	if !found {
-		t.Fatal("插件接入的源没有出现在内核源列表里")
-	}
-	// 平台声明的模型应可路由
-	models := c.Registry().ModelList()
-	hasModel := false
-	for _, id := range models {
-		if id == "example-chat" {
-			hasModel = true
-		}
-	}
-	if !hasModel {
-		t.Errorf("平台模型未进入可路由列表: %v", models)
-	}
-	t.Logf("已接入源 channels-example，模型可见: %v", models)
-}
-
-// TestChannelsPluginDeclaresItsNeeds 断言插件如实声明了它需要什么。
-//
-// 声明是运维审批的依据：插件不声明，设置页就无法显示"申请中"，
-// 运维只能等某个功能静默失效后才发现。
-func TestChannelsPluginDeclaresItsNeeds(t *testing.T) {
-	c := kernelTestCore(t)
-	ps := c.Plugins()
-	src, err := lua.ReadBundledPlugin("channels")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := ps.LoadSource("channels", src); err != nil {
-		t.Fatal(err)
-	}
-	// 内核动作声明
-	views := ps.KernelPermissions()
-	var declared []string
-	for _, v := range views {
-		if v.Plugin == "channels" {
-			declared = v.Declared
-		}
-	}
-	if len(declared) == 0 {
-		t.Fatal("channels 应声明它需要的内核动作")
-	}
-	for _, want := range []string{"add_source", "status"} {
-		found := false
-		for _, d := range declared {
-			if d == want {
-				found = true
-			}
-		}
-		if !found {
-			t.Errorf("应声明 %q, 实得 %v", want, declared)
-		}
-	}
-	// 额外出站主机声明（非源 host，需单独批准）
-	hosts := ps.PluginExtraHosts("channels")
-	if len(hosts) == 0 {
-		t.Fatal("channels 应声明额外出站主机")
-	}
-	t.Logf("声明内核动作=%v 额外主机=%v", declared, hosts)
-}
-
-// TestChannelsPluginHandlersRequireStatus 是一个契约回归：插件的每个 handler
-// 都必须返回 {status,json/body}，否则内核会**静默丢弃**它（实测踩过：
-// `return {url=…}` 得到 200 空响应，没有任何错误信息）。
-func TestChannelsPluginHandlersRequireStatus(t *testing.T) {
-	c := kernelTestCore(t)
-	ps := c.Plugins()
-	src, err := lua.ReadBundledPlugin("channels")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := ps.LoadSource("channels", src); err != nil {
-		t.Fatal(err)
-	}
-	_ = ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-
-	// 每个 handler 至少要在正常输入下给出非空响应
-	cases := []struct {
-		fn   string
-		req  *lua.HandlerRequest
-		what string
-	}{
-		{"list_platforms", &lua.HandlerRequest{Method: "GET"}, "平台列表"},
-		{"status_page", &lua.HandlerRequest{Method: "GET"}, "状态页"},
-		{"poll_login", &lua.HandlerRequest{Method: "GET", Query: map[string]string{"id": "nope"}}, "轮询(未知会话)"},
-		{"start_login", &lua.HandlerRequest{Method: "POST", Body: `{"platform":"example"}`}, "发起登录"},
-		{"start_login", &lua.HandlerRequest{Method: "POST", Body: `{"platform":"nope"}`}, "发起登录(未知平台)"},
-		{"complete_login", &lua.HandlerRequest{Method: "POST", Body: `{}`}, "完成登录(缺字段)"},
-		{"claim_daily", &lua.HandlerRequest{Method: "POST", Body: `{"platform":"example"}`}, "领额度(未登录)"},
-	}
-	for _, tc := range cases {
-		out, err := ps.InvokeHandler("channels", tc.fn, tc.req)
-		if err != nil {
-			t.Errorf("%s (%s) 返回错误: %v", tc.fn, tc.what, err)
-			continue
-		}
-		if out.JSON == nil && out.Body == "" {
-			t.Errorf("%s (%s) 返回空响应 —— 内核会静默丢弃，调用方看不到任何原因",
-				tc.fn, tc.what)
-		}
-	}
-}
-
-// jsonMarshalForTest 序列化一个接口值，用于检查凭据是否出现在 state 里。
-func jsonMarshalForTest(v interface{}) ([]byte, error) { return json.Marshal(v) }
-
-// stateHasSecret 检查凭据是否泄漏进 plugin.state。
-func stateHasSecret(ps *lua.Plugins, plugin, secret string) bool {
-	st := ps.State(plugin)
-	if st == nil {
-		return false
-	}
-	b, err := jsonMarshalForTest(st)
-	if err != nil {
-		return false
-	}
-	return contains(string(b), secret)
-}

internal/core/channels_pool_test.go

@@ -1,322 +0,0 @@
-package core
-
-import (
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/lua"
-)
-
-// channels_pool_test：对齐参考 account.* / model.* / provider.* 契约的行为测试。
-// 账号池增删改、上游源随 enabled/模型开关同步、供应商整体开关、备份导出。
-
-func poolCore(t *testing.T) (*Core, *lua.Plugins) {
-	t.Helper()
-	c := kernelTestCore(t)
-	ps := c.Plugins()
-	src, err := readBundledChannels(t)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := ps.LoadSource("channels", src); err != nil {
-		t.Fatal(err)
-	}
-	_ = ps.SetPluginKernelPermission("channels", []string{"add_source", "list_sources", "remove_source", "status", "probe_all", "reset_health"}, false)
-	return c, ps
-}
-
-// listSourcesViaKernel 直查内核 list_sources（actionListSources 返回 []map）。
-func listSourcesViaKernel(t *testing.T, c *Core) []map[string]interface{} {
-	t.Helper()
-	out, err := c.Invoke(nil, "list_sources", map[string]interface{}{})
-	if err != nil {
-		t.Fatalf("list_sources: %v", err)
-	}
-	if ms, ok := out.([]map[string]interface{}); ok {
-		return ms
-	}
-	raw, _ := out.([]interface{})
-	var srcs []map[string]interface{}
-	for _, s := range raw {
-		if m, ok := s.(map[string]interface{}); ok {
-			srcs = append(srcs, m)
-		}
-	}
-	return srcs
-}
-
-func invoke(t *testing.T, ps *lua.Plugins, fn, body string) map[string]interface{} {
-	t.Helper()
-	out, err := ps.InvokeHandler("channels", fn, &lua.HandlerRequest{Method: "POST", Body: body})
-	if err != nil {
-		t.Fatalf("invoke %s: %v", fn, err)
-	}
-	return out.JSON.(map[string]interface{})
-}
-
-// asArr 规整桥接后的数组。Lua 空表过桥是 map[string]interface{}（无法与空数组
-// 区分，见 vm.go luaTableToGoValue）；内核 list_sources 的 models 过桥是 []string。
-func asArr(v interface{}) []interface{} {
-	switch a := v.(type) {
-	case []interface{}:
-		return a
-	case []string:
-		out := make([]interface{}, len(a))
-		for i, s := range a {
-			out[i] = s
-		}
-		return out
-	}
-	return nil
-}
-
-func srcHasAccount(srcs []map[string]interface{}, needle string) (map[string]interface{}, bool) {
-	for _, sm := range srcs {
-		if name, _ := sm["name"].(string); strings.Contains(name, needle) {
-			return sm, true
-		}
-	}
-	return nil, false
-}
-
-// TestChannelsAccountPoolBehavior：账号池 CRUD + 上游源同步 + 模型/供应商开关 + 备份。
-func TestChannelsAccountPoolBehavior(t *testing.T) {
-	c, ps := poolCore(t)
-
-	t.Run("账号增删改", func(t *testing.T) {
-		m := invoke(t, ps, "account_add", `{"platform":"minimax","nickname":"我的号"}`)
-		if m["ok"] != true {
-			t.Fatalf("account_add: %v", m)
-		}
-		aid, _ := m["account_id"].(string)
-		if aid == "" {
-			t.Fatalf("account_add 应返回 account_id: %v", m)
-		}
-		m = invoke(t, ps, "account_list", `{"platform":"minimax"}`)
-		accts := asArr(m["accounts"])
-		if len(accts) != 1 {
-			t.Fatalf("应有1个账号: %d", len(accts))
-		}
-		a := accts[0].(map[string]interface{})
-		if a["nickname"] != "我的号" || a["enabled"] != true {
-			t.Fatalf("账号字段: %v", a)
-		}
-		invoke(t, ps, "account_update", `{"platform":"minimax","account_id":"`+aid+`","patch":{"nickname":"改名"}}`)
-		m = invoke(t, ps, "account_list", `{"platform":"minimax"}`)
-		if asArr(m["accounts"])[0].(map[string]interface{})["nickname"] != "改名" {
-			t.Fatalf("改名失败")
-		}
-		invoke(t, ps, "account_delete", `{"platform":"minimax","account_id":"`+aid+`"}`)
-		m = invoke(t, ps, "account_list", `{"platform":"minimax"}`)
-		if n := len(asArr(m["accounts"])); n != 0 {
-			t.Fatalf("删除后应为0, 实得 %d", n)
-		}
-	})
-
-	t.Run("模型开关同步上游源", func(t *testing.T) {
-		m := invoke(t, ps, "account_add", `{"platform":"minimax","credential":"MM-KEY"}`)
-		aid, _ := m["account_id"].(string)
-		sm, ok := srcHasAccount(listSourcesViaKernel(t, c), aid)
-		if !ok {
-			t.Fatal("带凭据账号应已同步源")
-		}
-		if n := len(asArr(sm["models"])); n != 3 {
-			t.Fatalf("源应有3模型, 实得 %d", n)
-		}
-		invoke(t, ps, "model_set_disabled", `{"platform":"minimax","model_id":"MiniMax-M3","disabled":true}`)
-		sm, _ = srcHasAccount(listSourcesViaKernel(t, c), aid)
-		if n := len(asArr(sm["models"])); n != 2 {
-			t.Fatalf("关1模型后源应2模型, 实得 %d", n)
-		}
-		invoke(t, ps, "model_set_all_disabled", `{"platform":"minimax","disabled":true}`)
-		m = invoke(t, ps, "provider_status", `{}`)
-		for _, s := range asArr(m["statuses"]) {
-			x := s.(map[string]interface{})
-			if x["id"] == "minimax" && x["closed"] != true {
-				t.Fatalf("全关模型后应 closed=true: %v", x)
-			}
-		}
-		invoke(t, ps, "model_set_all_disabled", `{"platform":"minimax","disabled":false}`)
-	})
-
-	t.Run("enabled开关同步上游源", func(t *testing.T) {
-		m := invoke(t, ps, "account_list", `{"platform":"minimax"}`)
-		accts := asArr(m["accounts"])
-		if len(accts) == 0 {
-			t.Fatal("上个用例应留有账号")
-		}
-		aid := accts[0].(map[string]interface{})["id"].(string)
-		before := len(listSourcesViaKernel(t, c))
-		invoke(t, ps, "account_update", `{"platform":"minimax","account_id":"`+aid+`","patch":{"enabled":false}}`)
-		if n := len(listSourcesViaKernel(t, c)); n != before-1 {
-			t.Fatalf("停用账号应删源: 前 %d 后 %d", before, n)
-		}
-		invoke(t, ps, "account_update", `{"platform":"minimax","account_id":"`+aid+`","patch":{"enabled":true}}`)
-		if n := len(listSourcesViaKernel(t, c)); n != before {
-			t.Fatalf("启用账号应重建源: 前 %d 后 %d", before, n)
-		}
-	})
-
-	t.Run("供应商整体开关", func(t *testing.T) {
-		invoke(t, ps, "provider_set_enabled", `{"platform":"minimax","enabled":false}`)
-		if _, ok := srcHasAccount(listSourcesViaKernel(t, c), "minimax"); ok {
-			t.Fatal("关闭渠道后不应有 minimax 源")
-		}
-		m := invoke(t, ps, "provider_status", `{}`)
-		for _, s := range asArr(m["statuses"]) {
-			x := s.(map[string]interface{})
-			if x["id"] == "minimax" && x["closed"] != true {
-				t.Fatalf("关闭后应 closed: %v", x)
-			}
-		}
-		invoke(t, ps, "provider_set_enabled", `{"platform":"minimax","enabled":true}`)
-		if _, ok := srcHasAccount(listSourcesViaKernel(t, c), "minimax"); !ok {
-			t.Fatal("开启渠道后应有 minimax 源")
-		}
-	})
-
-	t.Run("备份导出含凭据", func(t *testing.T) {
-		invoke(t, ps, "account_add", `{"platform":"cline","credential":"CL-KEY","nickname":"cl1"}`)
-		exp := invoke(t, ps, "backup_export", `{}`)
-		payload, _ := exp["payload"].(map[string]interface{})
-		if payload == nil {
-			t.Fatal("backup_export 应返回 payload")
-		}
-		creds, _ := payload["credentials"].(map[string]interface{})
-		found := false
-		for _, v := range creds {
-			if v == "CL-KEY" {
-				found = true
-			}
-		}
-		if !found {
-			t.Fatalf("备份应含凭据明文: %v", creds)
-		}
-	})
-}
-
-// TestChannelsExtendedRPCBehavior：对齐参考剩余 RPC 面（credits.status/balances、
-// account.reset/retest、model.setDisabledMany/clearDead、provider 排序、
-// gateway/backup.status、usage.badgePreference、onboarding）。
-func TestChannelsExtendedRPCBehavior(t *testing.T) {
-	_, ps := poolCore(t)
-
-	t.Run("credits_balances_无凭据报错_有凭据解析", func(t *testing.T) {
-		m := invoke(t, ps, "account_add", `{"platform":"minimax","nickname":"b1"}`)
-		aid, _ := m["account_id"].(string)
-		j := invoke(t, ps, "credits_balances", `{"platform":"minimax"}`)
-		var row map[string]interface{}
-		for _, a := range asArr(j["accounts"]) {
-			x := a.(map[string]interface{})
-			if x["accountId"] == aid {
-				row = x
-			}
-		}
-		if row == nil {
-			t.Fatal("balances 应含该账号")
-		}
-		if row["balance"] != nil || row["error"] == nil {
-			t.Fatalf("无凭据应 error 而非编造余额: %v", row)
-		}
-	})
-
-	t.Run("credits_status_无端点平台如实null", func(t *testing.T) {
-		m := invoke(t, ps, "account_add", `{"platform":"opencode","nickname":"oc1"}`)
-		aid, _ := m["account_id"].(string)
-		j := invoke(t, ps, "credits_status", `{"platform":"opencode"}`)
-		for _, a := range asArr(j["accounts"]) {
-			x := a.(map[string]interface{})
-			if x["accountId"] == aid && x["status"] != nil {
-				t.Fatalf("opencode 无状态端点应 null: %v", x)
-			}
-		}
-	})
-
-	t.Run("account_reset_clears", func(t *testing.T) {
-		invoke(t, ps, "account_add", `{"platform":"minimax","nickname":"r1"}`)
-		j := invoke(t, ps, "account_reset", `{"platform":"minimax","account_id":"__all__"}`)
-		if j["ok"] != true {
-			t.Fatalf("resetAll: %v", j)
-		}
-	})
-
-	t.Run("model_set_disabled_many", func(t *testing.T) {
-		invoke(t, ps, "model_set_disabled_many", `{"platform":"minimax","model_ids":["MiniMax-M3","MiniMax-M2.7-highspeed"],"disabled":true}`)
-		j := invoke(t, ps, "model_list", `{"platform":"minimax"}`)
-		off := 0
-		for _, x := range asArr(j["models"]) {
-			mm := x.(map[string]interface{})
-			if mm["disabled"] == true {
-				off++
-			}
-		}
-		if off != 2 {
-			t.Fatalf("批量关2模型后应2个disabled, 实得 %d", off)
-		}
-		invoke(t, ps, "model_set_disabled_many", `{"platform":"minimax","model_ids":["MiniMax-M3","MiniMax-M2.7-highspeed"],"disabled":false}`)
-	})
-
-	t.Run("model_clear_dead_只清黑名单里已下线的", func(t *testing.T) {
-		invoke(t, ps, "model_set_disabled", `{"platform":"minimax","model_id":"MiniMax-M3","disabled":true}`)
-		j := invoke(t, ps, "model_clear_dead", `{"platform":"minimax"}`)
-		if n := len(asArr(j["removed"])); n != 0 {
-			t.Fatalf("在册模型不算死模型, 实得 %d", n)
-		}
-		// 手动放一个不在 models 表里的黑名单项
-		invoke(t, ps, "model_set_disabled_many", `{"platform":"minimax","model_ids":["ghost-model"],"disabled":true}`)
-		j = invoke(t, ps, "model_clear_dead", `{"platform":"minimax"}`)
-		if n := len(asArr(j["removed"])); n != 1 {
-			t.Fatalf("死模型应被清: %v", j)
-		}
-		invoke(t, ps, "model_set_disabled", `{"platform":"minimax","model_id":"MiniMax-M3","disabled":false}`)
-	})
-
-	t.Run("provider_order", func(t *testing.T) {
-		invoke(t, ps, "provider_set_order", `{"order":["minimax","trae","bogus"]}`)
-		j := invoke(t, ps, "provider_get_order", `{}`)
-		order := asArr(j["order"])
-		if len(order) != 2 {
-			t.Fatalf("bogus 应被过滤, 实得 %v", order)
-		}
-		if order[0] != "minimax" {
-			t.Fatalf("顺序应保留: %v", order)
-		}
-	})
-
-	t.Run("backup_status", func(t *testing.T) {
-		invoke(t, ps, "account_add", `{"platform":"minimax","nickname":"s1"}`)
-		j := invoke(t, ps, "backup_status", `{}`)
-		if n, _ := j["accounts"].(float64); n < 1 {
-			t.Fatalf("backup_status 应统计账号: %v", j)
-		}
-	})
-
-	t.Run("badge_preference_非法值拒绝", func(t *testing.T) {
-		j := invoke(t, ps, "usage_badge_preference", `{"preference":"bogus"}`)
-		if j["error"] == nil {
-			t.Fatalf("非法偏好应拒绝: %v", j)
-		}
-		j = invoke(t, ps, "usage_badge_preference", `{"preference":"credits"}`)
-		if j["preference"] != "credits" {
-			t.Fatalf("合法偏好应保存: %v", j)
-		}
-	})
-
-	t.Run("onboarding_不支持平台如实报", func(t *testing.T) {
-		j := invoke(t, ps, "onboarding_status", `{"platform":"minimax"}`)
-		if j["supported"] != false {
-			t.Fatalf("minimax 无新人任务应 supported=false: %v", j)
-		}
-	})
-
-	t.Run("permanent_lock_读写", func(t *testing.T) {
-		j := invoke(t, ps, "credits_permanent_lock", `{"platform":"buddy","locked":true}`)
-		if j["locked"] != true {
-			t.Fatalf("锁定应生效: %v", j)
-		}
-		j = invoke(t, ps, "credits_permanent_lock", `{"platform":"buddy"}`)
-		if j["locked"] != true {
-			t.Fatalf("只读应回显锁定: %v", j)
-		}
-	})
-}

internal/core/channels_stress_test.go

@@ -1,251 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/lua"
-)
-
-// mustBox 构造一个真 SecretBox（与运行期同一实现，密钥落 runtime dir）。
-func mustBox(t *testing.T, runtimeFile string) *config.SecretBox {
-	t.Helper()
-	box, err := config.NewSecretBox(runtimeFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return box
-}
-
-// channelsCore 起一个带 channels 插件、可指定源码与 box 的核心（压力测试用）。
-func channelsCore(t *testing.T, src string) (*Core, *lua.Plugins) {
-	t.Helper()
-	c := kernelTestCore(t)
-	ps := c.Plugins()
-	if err := ps.LoadSource("channels", src); err != nil {
-		t.Fatalf("加载 channels: %v", err)
-	}
-	ps.SetSecretBox(mustBox(t, filepath.Join(t.TempDir(), "runtime.json")))
-	_ = ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-	return c, ps
-}
-
-// TestChannelsConcurrentLogins 压力：并发走 device-poll 登录。
-//
-// 插件是单 VM 单锁 —— 本测试验证的是**正确性下的并发**（会话互不串台、
-// 凭据互不可见、最终都 completed），真吞吐压力在 e2e 层（真二进制+HTTP 并发）。
-func TestChannelsConcurrentLogins(t *testing.T) {
-	var hits int32
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/oauth2/device/code":
-			n := atomic.AddInt32(&hits, 1)
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprintf(w, `{"device_code":"DEV-%d","user_code":"UC-%d","verification_uri":"https://example/activate","interval":1,"expires_in":600}`, n, n)
-		case "/oauth2/token":
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprint(w, `{"access_token":"TOK","refresh_token":"RF","nickname":"u"}`)
-		default:
-			w.WriteHeader(404)
-		}
-	}))
-	defer ts.Close()
-
-	_, ps := channelsCore(t, mustChannelsSrc(t))
-	// 把 minimax 端点指到假上游
-	if _, err := ps.Call("channels", "set_endpoints", map[string]interface{}{
-		"platform": "minimax",
-		"device": map[string]interface{}{
-			"code_url":  ts.URL + "/oauth2/device/code",
-			"token_url": ts.URL + "/oauth2/token",
-		},
-	}); err != nil {
-		t.Fatal(err)
-	}
-
-	const rounds = 12
-	var wg sync.WaitGroup
-	var failures int32
-	for i := 0; i < rounds; i++ {
-		wg.Add(1)
-		go func(n int) {
-			defer wg.Done()
-			out, err := ps.InvokeHandler("channels", "start_login", &lua.HandlerRequest{
-				Method: "POST", Body: `{"platform":"minimax"}`,
-			})
-			if err != nil {
-				t.Errorf("start_login #%d: %v", n, err)
-				atomic.AddInt32(&failures, 1)
-				return
-			}
-			j := out.JSON.(map[string]interface{})
-			sess, _ := j["session"].(map[string]interface{})
-			if sess == nil {
-				t.Errorf("start_login #%d 无会话: %v", n, j)
-				atomic.AddInt32(&failures, 1)
-				return
-			}
-			sid := sess["id"].(string)
-			for k := 0; k < 10; k++ {
-				out2, _ := ps.InvokeHandler("channels", "poll_login", &lua.HandlerRequest{
-					Method: "GET", Query: map[string]string{"id": sid},
-				})
-				m2 := out2.JSON.(map[string]interface{})
-				if m2["state"] == "completed" {
-					return
-				}
-				if m2["state"] == "failed" {
-					t.Errorf("会话 #%d failed: %v", n, m2)
-					atomic.AddInt32(&failures, 1)
-					return
-				}
-			}
-			t.Errorf("会话 #%d 10 次轮询未终态", n)
-			atomic.AddInt32(&failures, 1)
-		}(i)
-	}
-	wg.Wait()
-	if failures != 0 {
-		t.Fatalf("并发登录失败 %d 轮", failures)
-	}
-}
-
-// TestChannelsClaimStress 压力：同一平台并发领签到（幂等 + 无登录态丢失）。
-func TestChannelsClaimStress(t *testing.T) {
-	var claims int32
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/v1/checkin" {
-			atomic.AddInt32(&claims, 1)
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprint(w, `{"ok":true,"credits":10}`)
-			return
-		}
-		w.WriteHeader(404)
-		fmt.Fprint(w, `{}`)
-	}))
-	defer ts.Close()
-
-	_, ps := channelsCore(t, mustChannelsSrc(t))
-	if _, err := ps.Call("channels", "set_endpoints", map[string]interface{}{
-		"platform": "cookieish",
-		"checkin":  map[string]interface{}{"url": ts.URL + "/v1/checkin"},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	if err := ps.SetSecret("channels", "channels:cookieish", "PASTE-TOKEN"); err != nil {
-		t.Fatal(err)
-	}
-
-	const n = 30
-	var wg sync.WaitGroup
-	for i := 0; i < n; i++ {
-		wg.Add(1)
-		go func(k int) {
-			defer wg.Done()
-			out, err := ps.InvokeHandler("channels", "claim_daily", &lua.HandlerRequest{
-				Method: "POST", Body: `{"platform":"cookieish"}`,
-			})
-			if err != nil {
-				t.Errorf("claim #%d: %v", k, err)
-				return
-			}
-			j := out.JSON.(map[string]interface{})
-			if j["ok"] != true {
-				t.Errorf("claim #%d 未成功: %v", k, j)
-			}
-		}(i)
-	}
-	wg.Wait()
-	if got := atomic.LoadInt32(&claims); got != n {
-		t.Errorf("上游应收到 %d 次领取, 实得 %d", n, got)
-	}
-}
-
-// TestLegacyVaultPlaintextLoad 旧通路：老版本（无加密）写的明文库在新版本
-// （带 box）下必须能读 —— 凭据升级不丢。落盘则会在下次写时整体重封为密文。
-func TestLegacyVaultPlaintextLoad(t *testing.T) {
-	dir := t.TempDir()
-	ps := lua.NewPlugins(nil, dir)
-	if err := ps.SetSecret("legacy", "channels:old", "PLAIN-OLD-TOKEN"); err != nil {
-		t.Fatal(err)
-	}
-	ps.SetSecretBox(mustBox(t, filepath.Join(dir, "runtime.json")))
-	v, ok, err := ps.GetSecret("legacy", "channels:old")
-	if err != nil || !ok || v != "PLAIN-OLD-TOKEN" {
-		t.Fatalf("旧明文库读回失败: v=%q ok=%v err=%v", v, ok, err)
-	}
-	// 任意一次写触发整体重封
-	if err := ps.SetSecret("legacy", "k2", "NEW"); err != nil {
-		t.Fatal(err)
-	}
-	raw, err := os.ReadFile(filepath.Join(dir, ".secrets", "legacy.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(raw), "PLAIN-OLD-TOKEN") {
-		t.Fatalf("★ 重封后旧明文仍在盘上:\n%s", raw)
-	}
-	if !strings.Contains(string(raw), "enc:v1:") {
-		t.Fatalf("重封后应含密文:\n%s", raw)
-	}
-}
-
-// TestLegacySourceSealedConfig 旧通路：config.yaml 里明文 api_key 的旧配置，
-// 新版本加载后运行期拿到解密值、落盘被 seal（SealIfNeeded 语义）。
-func TestLegacySourceSealedConfig(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	yaml := "listen: 127.0.0.1:0\n" +
-		"gateway_keys:\n  - sk-legacy-0001\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"sources:\n" +
-		"  - name: legacy-src\n" +
-		"    base_url: https://legacy.example.com/v1\n" +
-		"    adapter: openai\n" +
-		"    api_key: PLAIN-LEGACY-KEY\n" +
-		"    max_concurrent: 2\n" +
-		"    models:\n" +
-		"      - id: m1\n" +
-		"        kind: chat\n" +
-		"        priority: 10\n"
-	if err := os.WriteFile(cfgPath, []byte(yaml), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	c, err := NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-
-	got := c.Sources()
-	if len(got) != 1 || got[0].APIKey != "PLAIN-LEGACY-KEY" {
-		t.Fatalf("运行期 api_key 应解密: %#v", got)
-	}
-	raw, err := os.ReadFile(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(raw), "PLAIN-LEGACY-KEY") {
-		t.Fatalf("★ 旧明文 api_key 升级后仍明文落盘:\n%s", raw)
-	}
-	if !strings.Contains(string(raw), "enc:v1:") {
-		t.Fatalf("落盘应含 enc:v1 密文:\n%s", raw)
-	}
-	mk, err := os.ReadFile(filepath.Join(dir, "master.key"))
-	if err != nil || len(mk) != 64 {
-		t.Fatalf("master.key 应 64 hex, len=%d err=%v", len(mk), err)
-	}
-}

internal/core/channels_trae_test.go

@@ -1,173 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-
-	"llmsproxy/internal/lua"
-)
-
-// traeHarness：TRAE callback 流的测试台。假上游模拟 ExchangeToken；
-// 回调用 InvokeHandler 直打 oauth_callback（Query 表 = 平台重定向回来的参数）。
-type traeHarness struct {
-	t       *testing.T
-	ps      *lua.Plugins
-	ts      *httptest.Server
-	exchHit int32
-	exchOK  int32 // 1=成功 0=失败（atomic）
-}
-
-func newTraeHarness(t *testing.T) *traeHarness {
-	t.Helper()
-	h := &traeHarness{t: t, exchOK: 1}
-	h.ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/cloudide/api/v3/trae/oauth/ExchangeToken" {
-			w.WriteHeader(404)
-			return
-		}
-		n := atomic.AddInt32(&h.exchHit, 1)
-		w.Header().Set("Content-Type", "application/json")
-		if atomic.LoadInt32(&h.exchOK) == 0 {
-			w.WriteHeader(500)
-			fmt.Fprint(w, `{"error":"exchange down"}`)
-			return
-		}
-		// 校验请求体形状（对齐参考 exchangeTraeCallback 的请求构造）
-		body, _ := io.ReadAll(r.Body)
-		for _, want := range []string{`"ClientID"`, `"RefreshToken":"RT-FROM-CALLBACK"`, `"ClientSecret":"-"`} {
-			if !strings.Contains(string(body), want) {
-				t.Errorf("ExchangeToken 请求体缺 %s: %s", want, body)
-			}
-		}
-		fmt.Fprintf(w, `{"Token":"ACCESS-%d","RefreshToken":"RT-NEW-%d"}`, n, n)
-	}))
-	t.Cleanup(h.ts.Close)
-
-	c := kernelTestCore(t)
-	h.ps = c.Plugins()
-	src, err := readBundledChannels(t)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := h.ps.LoadSource("channels", src); err != nil {
-		t.Fatal(err)
-	}
-	_ = h.ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-	// ExchangeToken 指到假上游（set_endpoints 既是运维能力也是测试缝）
-	if _, err := h.ps.Call("channels", "set_endpoints", map[string]interface{}{
-		"platform": "trae",
-		"callback": map[string]interface{}{
-			"exchange_url": h.ts.URL + "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		},
-	}); err != nil {
-		t.Fatalf("set_endpoints: %v", err)
-	}
-	return h
-}
-
-// beginAndCallback 发起登录（拿 nonce）后直接打 oauth_callback。
-// cbQuery 是回调的 query（不含 state，内部补）；值即平台重定向回来的原始参数。
-func (h *traeHarness) beginAndCallback(cbQuery map[string]string) (int, string) {
-	out, err := h.ps.InvokeHandler("channels", "start_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"trae"}`,
-	})
-	if err != nil {
-		h.t.Fatal(err)
-	}
-	j, ok := out.JSON.(map[string]interface{})
-	if !ok {
-		h.t.Fatalf("start_login 返回非对象: %#v", out.JSON)
-	}
-	sess := j["session"].(map[string]interface{})
-	nonce := sess["nonce"].(string)
-
-	q := map[string]string{"state": nonce}
-	for k, v := range cbQuery {
-		q[k] = v
-	}
-	res, err := h.ps.InvokeHandler("channels", "oauth_callback", &lua.HandlerRequest{
-		Method: "GET", Query: q,
-	})
-	if err != nil {
-		h.t.Fatal(err)
-	}
-	return res.Status, fmt.Sprintf("%v|%v", res.Body, res.JSON)
-}
-
-// TestTraeCallbackBehavior 是 TRAE callback 流的行为对齐测试。
-//
-// 决策表逐行搬自参考实现 parseTraeCallbackDetailed + exchangeTraeCallback
-// （trae-oauth.ts）。断言的是行为（凭据来源 / 错误文案 / 上游是否被调），不是实现细节。
-func TestTraeCallbackBehavior(t *testing.T) {
-	h := newTraeHarness(t)
-
-	t.Run("行1 refreshToken直传_ExchangeToken换新", func(t *testing.T) {
-		atomic.StoreInt32(&h.exchOK, 1)
-		st, body := h.beginAndCallback(map[string]string{
-			"refreshToken": "RT-FROM-CALLBACK",
-			"userInfo":     `{"UserID":"u1","ScreenName":"张三","TenantID":"t1"}`,
-		})
-		if st != 200 {
-			t.Fatalf("应 200: %d %s", st, body)
-		}
-		// 凭据必须是 ExchangeToken 的新 Token，不是回调原值
-		v, _, _ := h.ps.GetSecret("channels", "channels:trae")
-		if !strings.HasPrefix(v, "ACCESS-") {
-			t.Fatalf("凭据应是 ExchangeToken 的新 access, 实得 %q", v)
-		}
-	})
-
-	t.Run("行2 无refreshToken_userJwtToken兜底_不打ExchangeToken", func(t *testing.T) {
-		before := atomic.LoadInt32(&h.exchHit)
-		st, body := h.beginAndCallback(map[string]string{
-			"userJwt": `{"Token":"JWT-TOKEN-1","RefreshToken":""}`,
-		})
-		if st != 200 {
-			t.Fatalf("应 200: %d %s", st, body)
-		}
-		v, _, _ := h.ps.GetSecret("channels", "channels:trae")
-		if v != "JWT-TOKEN-1" {
-			t.Fatalf("兜底凭据应是 userJwt.Token, 实得 %q", v)
-		}
-		if atomic.LoadInt32(&h.exchHit) != before {
-			t.Fatal("无 refreshToken 不应调 ExchangeToken（参考实现分支2）")
-		}
-	})
-
-	t.Run("行3 只有code_PKCE流_明确报暂不支持", func(t *testing.T) {
-		st, body := h.beginAndCallback(map[string]string{"code": "PKCE-CODE-1"})
-		if st != 400 {
-			t.Fatalf("PKCE 流应 400: %d %s", st, body)
-		}
-		if !strings.Contains(body, "PKCE") {
-			t.Fatalf("错误应明确指向 PKCE 流, 实得 %s", body)
-		}
-	})
-
-	t.Run("行4 空回调_报缺失", func(t *testing.T) {
-		st, body := h.beginAndCallback(map[string]string{})
-		if st != 400 {
-			t.Fatalf("空回调应 400: %d %s", st, body)
-		}
-		if !strings.Contains(body, "refreshToken") {
-			t.Fatalf("错误应指出缺什么, 实得 %s", body)
-		}
-	})
-
-	t.Run("行5 ExchangeToken失败_透传阶段", func(t *testing.T) {
-		atomic.StoreInt32(&h.exchOK, 0)
-		defer atomic.StoreInt32(&h.exchOK, 1)
-		st, body := h.beginAndCallback(map[string]string{"refreshToken": "RT-FROM-CALLBACK"})
-		if st != 400 {
-			t.Fatalf("exchange 失败应 400: %d %s", st, body)
-		}
-		if !strings.Contains(body, "ExchangeToken") {
-			t.Fatalf("错误应指明 ExchangeToken 阶段, 实得 %s", body)
-		}
-	})
-}

internal/core/core.go

@@ -7,8 +7,6 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
-	"log"
-	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -17,7 +15,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"llmsproxy/internal/billing"
 	"llmsproxy/internal/config"
 	"llmsproxy/internal/lua"
 	"llmsproxy/internal/provider"
@@ -32,18 +29,11 @@ type Core struct {
 	mu             sync.Mutex
 	cfg            *config.Config
 	vm             *lua.VM
-	plugins        *lua.Plugins
 	store          *config.Store
 	scheduler      *scheduler.Scheduler
 	registry       *provider.Registry
 	autoChain      atomic.Pointer[scheduler.Chain] // chat AUTO chain
 	autoImageChain atomic.Pointer[scheduler.Chain] // image-generation AUTO chain
-
-	// keyAutoChains caches per-key AUTO chains, keyed by the gateway key.
-	// Entries are rebuilt by rebuildKeyAutoChains whenever sources or key
-	// config change; AutoChainFor reads them without taking c.mu so request
-	// handling stays lock-free like the global chain lookup.
-	keyAutoChains atomic.Pointer[map[string]*scheduler.Chain]
 }
 
 // New builds the core from a config file plus runtime overlay.
@@ -62,84 +52,7 @@ func NewFromConfig(cfg *config.Config) (*Core, error) {
 	if err := c.vm.Start(); err != nil {
 		return nil, fmt.Errorf("lua vm: %w", err)
 	}
-	// Plugins load AFTER the VM is up (a plugin is just another Lua state) but
-	// BEFORE anything can serve traffic, so a plugin's request_end hook sees
-	// the very first request. A plugin that fails to load is logged and skipped
-	// rather than failing startup: plugins are optional extensions, and failing
-	// to boot the gateway because a third-party .lua has a typo would be the
-	// wrong trade.
-	c.plugins = lua.NewPlugins(c.vm, cfg.PluginDir)
-	// R4-c: hand plugins the kernel action surface. Injected as an interface
-	// because lua must not import core (core depends on lua, not the reverse).
-	// Wired BEFORE LoadDir so a plugin that calls an action during its own
-	// __init/first hook already finds a working kernel rather than a nil one.
-	c.plugins.SetKernelAPI(c)
-	// Plugin outbound HTTP is scoped to the hosts of configured sources. Set
-	// before LoadDir so a plugin that requests on its first hook already sees
-	// the real allowlist rather than the deny-all placeholder.
-	c.plugins.SetOutboundHosts(sourceHosts(cfg))
-	// Let the plugin layer validate access specs against the keys that exist.
-	// A stored allowlist naming a key that does not exist refuses every caller,
-	// which looks exactly like a broken endpoint.
-	lua.SetKeyNameLookup(func() []string {
-		// ListKeys is the structured view (bare `gateway_keys:` entries are
-		// expanded into records with names); cfg.GatewayKeys is still []string.
-		keys := c.ListKeys()
-		out := make([]string, 0, len(keys))
-		for _, k := range keys {
-			if k.Name != "" {
-				out = append(out, k.Name)
-			}
-		}
-		return out
-	})
-	// Operator overrides win over the plugin's own declared audience.
-	for name, aud := range cfg.PluginVisibility {
-		c.plugins.SetPluginVisibility(name, aud)
-	}
-	if err := c.plugins.SeedBundled(); err != nil {
-		log.Printf("[core] seed bundled plugins: %v", err)
-	}
-	if err := c.plugins.LoadDir(); err != nil {
-		log.Printf("[core] plugin dir: %v", err)
-	}
-	for _, p := range c.plugins.List() {
-		if msg, bad := p["error"]; bad {
-			log.Printf("[core] plugin %v failed to load: %v", p["name"], msg)
-			continue
-		}
-		log.Printf("[core] plugin %v %v loaded (hooks=%v ui=%v)",
-			p["name"], p["version"], p["hooks"], p["ui"])
-	}
-	c.applyBillingDSL()
 	c.store = config.NewStore(cfg.RuntimeFile)
-	// Share one box between the runtime store and config.yaml so a single
-	// master.key seals both files. config.Load left the config holding
-	// ciphertext (if it was sealed); unseal it NOW, before anything reads a
-	// credential.
-	//
-	// ORDER IS LOAD-BEARING. These steps each consume secrets and must run
-	// after the unseal:
-	//   - seedKeys compares cfg.Keys[i].Key against the plaintext
-	//     gateway_keys entries; with ciphertext keys the comparison never
-	//     matched and every restart appended another duplicate admin key
-	//     (production had four copies of the same admin key).
-	//   - rebuildRegistry hands cfg.Sources[i].APIKey to the providers; with
-	//     ciphertext it built every upstream client with "enc:v1:..." as its
-	//     bearer token.
-	// Previously the unseal happened at the END of this function, and things
-	// only appeared to work because seedKeys' Save() unsealed memory as a side
-	// effect. Removing the redundant saves exposed the real ordering bug.
-	cfg.AttachSecretBox(c.store.SecretBox())
-	// Share that SAME box with the plugin credential vault: one master.key seals
-	// config.yaml, the runtime store, AND every .secrets/*.json. Set here (not at
-	// NewPlugins time) because the store — and thus the box — only exists now;
-	// plugins write secrets only during login flows, well after this point.
-	c.plugins.SetSecretBox(c.store.SecretBox())
-	hadPlaintextSecrets, err := cfg.UnsealSecrets(c.store.SecretBox())
-	if err != nil {
-		return nil, fmt.Errorf("unseal secrets: %w", err)
-	}
 	if err := c.store.Load(); err != nil {
 		return nil, fmt.Errorf("runtime store: %w", err)
 	}
@@ -161,12 +74,6 @@ func NewFromConfig(cfg *config.Config) (*Core, error) {
 	if err := c.seedPresetTemplates(); err != nil {
 		return nil, fmt.Errorf("seed preset templates: %w", err)
 	}
-	// Seal any credential still in the clear in config.yaml. Startup writes
-	// nothing when the file was already sealed (hadPlaintextSecrets is decided
-	// from the on-disk state, before the unseal above).
-	if err := cfg.SealIfNeeded(hadPlaintextSecrets); err != nil {
-		return nil, fmt.Errorf("normalize secrets: %w", err)
-	}
 	return c, nil
 }
 
@@ -285,11 +192,6 @@ func buildRetries(cfg *config.Config) int {
 // VM exposes the Lua adapter runtime.
 func (c *Core) VM() *lua.VM { return c.vm }
 
-// Plugins exposes the loaded plugin set. Never nil once New* has returned, so
-// the gateway can fire stages unconditionally; an unconfigured plugin
-// directory yields an empty registry whose Fire is a no-op.
-func (c *Core) Plugins() *lua.Plugins { return c.plugins }
-
 func (c *Core) Scheduler() *scheduler.Scheduler { return c.scheduler }
 
 func (c *Core) Registry() *provider.Registry { return c.registry }
@@ -297,68 +199,6 @@ func (c *Core) Registry() *provider.Registry { return c.registry }
 // AutoChain returns the current AUTO scheduling chain.
 func (c *Core) AutoChain() *scheduler.Chain { return c.autoChain.Load() }
 
-// AutoChainFor returns the AUTO chain to use for a request authenticated with
-// key. A key that declares its own chain gets that chain; every other key
-// inherits the global chain, so keys created before per-key chains existed
-// keep their current behaviour with no configuration change.
-//
-// It returns (chain, ok). ok is false only when the key has its own chain but
-// it compiled to nothing usable (e.g. every slot names a model that no longer
-// exists) — the caller must surface that rather than silently downgrading the
-// user to the global chain, which would be a confusing, invisible switch.
-func (c *Core) AutoChainFor(key string) (*scheduler.Chain, bool) {
-	if m := c.keyAutoChains.Load(); m != nil {
-		if ch, ok := (*m)[key]; ok {
-			return ch, true
-		}
-	}
-	return c.autoChain.Load(), true
-}
-
-// rebuildKeyAutoChains recompiles every per-key AUTO chain from the current
-// config and provider registry, then swaps the cache in one shot so requests
-// never observe a half-built map. Keys without their own chain are absent
-// from the map and fall back to the global chain.
-func (c *Core) rebuildKeyAutoChains() {
-	m := make(map[string]*scheduler.Chain)
-	for _, k := range c.cfg.Keys {
-		if !k.HasOwnAuto() {
-			continue
-		}
-		m[k.Key] = c.chainForRules(k.Auto, false)
-	}
-	c.keyAutoChains.Store(&m)
-}
-
-// SaveKeyAuto persists one key's own AUTO chain and recompiles the per-key
-// chain cache. Passing an empty list clears the override so the key inherits
-// the global chain again.
-func (c *Core) SaveKeyAuto(key string, entries []config.ModelScope) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	idx := -1
-	for i, k := range c.cfg.Keys {
-		if k.Key == key {
-			idx = i
-			break
-		}
-	}
-	if idx < 0 {
-		return fmt.Errorf("key not found")
-	}
-	if err := ValidateScopeQuotas(entries); err != nil {
-		return err
-	}
-	c.cfg.Keys[idx].Auto = cleanScopes(entries)
-	if err := c.saveConfig(); err != nil {
-		return err
-	}
-	// Rebuild the whole cache so a cleared override stops shadowing the
-	// global chain for this key.
-	c.rebuildKeyAutoChains()
-	return nil
-}
-
 // AutoImageChain returns the persisted image-generation AUTO chain snapshot.
 func (c *Core) AutoImageChain() *scheduler.Chain { return c.autoImageChain.Load() }
 
@@ -398,15 +238,10 @@ func (c *Core) FindKey(key string) (config.GWKey, bool) {
 }
 
 // CreateKey builds a new random gateway key and persists it to config.yaml.
-// Quotas live on the model scope entries, so a new key's budget is whatever
-// its scopes carry.
 func (c *Core) CreateKey(name, role string, models []config.ModelScope, note string) (config.GWKey, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	models = cleanScopes(models)
-	if err := ValidateScopeQuotas(models); err != nil {
-		return config.GWKey{}, err
-	}
 	key := make([]byte, 16)
 	if _, err := rand.Read(key); err != nil {
 		return config.GWKey{}, err
@@ -419,7 +254,9 @@ func (c *Core) CreateKey(name, role string, models []config.ModelScope, note str
 		Note:      note,
 		CreatedAt: time.Now().Unix(),
 	}
-	rec.Role = config.NormalizeRole(rec.Role)
+	if rec.Role == "" {
+		rec.Role = "user"
+	}
 	c.cfg.Keys = append(c.cfg.Keys, rec)
 	if err := c.saveConfig(); err != nil {
 		return config.GWKey{}, err
@@ -427,16 +264,10 @@ func (c *Core) CreateKey(name, role string, models []config.ModelScope, note str
 	return rec, nil
 }
 
-// UpdateKey mutates a key's name/role/model scope and persists it. The scope
-// entries carry their own quotas, so replacing the scope replaces the budgets.
+// UpdateKey mutates a key's name/role/model scope and persists it.
 func (c *Core) UpdateKey(key, name, role string, models []config.ModelScope, note string) (config.GWKey, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	if models != nil {
-		if err := ValidateScopeQuotas(models); err != nil {
-			return config.GWKey{}, err
-		}
-	}
 	for i, k := range c.cfg.Keys {
 		if k.Key == key {
 			if name != "" {
@@ -608,11 +439,6 @@ func (c *Core) mergedSources() []config.Source {
 }
 
 // resolveSourceKey applies api_key_env and decrypts enc:v1: ciphertext.
-// Config values are already unsealed at startup (Config.NormalizeSecretsForRun),
-// so the decrypt branch is the belt-and-braces path for a source that arrived
-// already sealed through another route. A failure there leaves the ciphertext in
-// place, which makes the upstream reject the key loudly rather than sending an
-// empty Authorization header that might look like a config-less source.
 func (c *Core) resolveSourceKey(s config.Source) config.Source {
 	if s.APIKeyEnv != "" {
 		if v := os.Getenv(s.APIKeyEnv); v != "" {
@@ -621,11 +447,7 @@ func (c *Core) resolveSourceKey(s config.Source) config.Source {
 		return s
 	}
 	if box := c.store.SecretBox(); box != nil && strings.HasPrefix(s.APIKey, "enc:v1:") {
-		if v, err := box.Decrypt(s.APIKey); err == nil {
-			s.APIKey = v
-		} else {
-			log.Printf("[core] source %s: api_key decrypt failed: %v", s.Name, err)
-		}
+		s.APIKey = box.MustDecrypt(s.APIKey)
 	}
 	return s
 }
@@ -648,98 +470,26 @@ func (c *Core) rebuildRegistry() error {
 	}
 	c.buildAutoChain()
 	c.buildAutoImageChain()
-	c.rebuildKeyAutoChains()
-	// A source edit can add or remove an upstream host, which changes what a
-	// plugin is allowed to reach. Keeping this beside the chain rebuilds means
-	// one call site owns "config changed, refresh derived state".
-	c.plugins.SetOutboundHosts(sourceHosts(c.cfg))
 	return nil
 }
 
-// sourceHosts extracts the host of every configured source's base_url — the
-// allowlist for plugin outbound HTTP. Unparseable URLs are skipped rather than
-// failing startup: a malformed base_url is already rejected when the provider is
-// built, and it must not take plugins down with it.
-//
-// A source may also imply a SECOND host. OpenDesign splits inference
-// (amr-link.open-design.ai) from billing (amr-api.open-design.ai), and the
-// quota plugin derives the billing host from the inference one — so the host it
-// asks for is not the host the operator configured, and the request would be
-// refused with a message that reads like a plugin defect. Adding the derived
-// host here is what makes the probe reachable.
-//
-// The grant stays scoped: only a source that IS on amr-link pulls in amr-api, so
-// a deployment with no OpenDesign source does not silently gain the entry.
-func sourceHosts(cfg *config.Config) []string {
-	if cfg == nil {
-		return nil
-	}
-	out := make([]string, 0, len(cfg.Sources))
-	seen := make(map[string]bool, len(cfg.Sources))
-	add := func(h string) {
-		if h == "" || seen[h] {
-			return
-		}
-		seen[h] = true
-		out = append(out, h)
-	}
-	for _, s := range cfg.Sources {
-		if s.BaseURL == "" {
-			continue
-		}
-		u, err := url.Parse(s.BaseURL)
-		if err != nil || u.Hostname() == "" {
-			continue
-		}
-		add(u.Hostname())
-		add(deriveBillingHost(u.Hostname()))
-	}
-	return out
-}
-
-// deriveBillingHost returns the billing host a configured source implies, or
-// the host unchanged when it implies none.
-//
-// Kept in Go as well as in the Lua adapter because the two must agree: Go builds
-// the allowlist and Lua builds the request URL, and a disagreement shows up as a
-// refused request rather than as an error naming the mismatch. The rule is the
-// full hostname, not a prefix — `amr-link.` as a prefix would also rewrite
-// amr-link.example.com into an OpenDesign address.
-func deriveBillingHost(host string) string {
-	if host == "amr-link.open-design.ai" {
-		return "amr-api.open-design.ai"
-	}
-	return host
-}
-
 // buildAutoChain rebuilds the AUTO chain snapshot from config.yaml rules
 // against the current providers. Slot model ids are normalized to the exact
 // configured spelling (case-insensitive match), otherwise ModelFor would fall
 // back to the source's best chat model and cooldown/quota bookkeeping would
 // key on a name that never matches.
 func (c *Core) buildAutoChain() {
-	c.autoChain.Store(c.chainForRules(c.cfg.Auto, false))
-}
-
-// chainForRules compiles a chat AUTO chain from a rule list. kindFilter is
-// false for the chat chain (image models are skipped) and true for the image
-// chain (only image models participate). Per-key chains always compile as
-// chat chains: a user's key configures the models *they* talk to.
-func (c *Core) chainForRules(rules []config.ModelScope, imageOnly bool) *scheduler.Chain {
 	prov := func(model, source string) scheduler.Provider {
 		p := c.registry.ProviderForSlot(model, source)
 		if p == nil {
 			return nil
 		}
-		m := p.ModelByID(model)
-		if imageOnly && (m == nil || m.Kind != "image") {
-			return nil
-		}
-		if !imageOnly && m != nil && m.Kind == "image" {
+		if m := p.ModelByID(model); m != nil && m.Kind == "image" {
 			return nil
 		}
 		return p
 	}
+	rules := c.cfg.Auto
 	sr := make([]scheduler.Rule, 0, len(rules))
 	for _, e := range rules {
 		model, source := e.Model, e.Source
@@ -748,11 +498,7 @@ func (c *Core) chainForRules(rules []config.ModelScope, imageOnly bool) *schedul
 				model = exact
 			}
 			if m := p.ModelByID(model); m != nil && m.Kind == "image" {
-				if !imageOnly {
-					continue // image-kind models never join the chat AUTO chain
-				}
-			} else if imageOnly {
-				continue
+				continue // image-kind models never join the chat AUTO chain
 			}
 			if source == "" {
 				source = p.Name()
@@ -767,7 +513,7 @@ func (c *Core) chainForRules(rules []config.ModelScope, imageOnly bool) *schedul
 			Hours:  e.Hours,
 		})
 	}
-	return scheduler.BuildChain(sr, prov)
+	c.autoChain.Store(scheduler.BuildChain(sr, prov))
 }
 
 // buildAutoImageChain rebuilds the image-generation AUTO chain snapshot.
@@ -884,14 +630,6 @@ func (c *Core) UploadAdapter(name, code string) error {
 	if name == "" {
 		return fmt.Errorf("adapter name required")
 	}
-	// Validate name SAFETY before touching the filesystem (R6). A path-traversal
-	// name ("../openai") must be rejected BEFORE WriteFile, or it would already
-	// have escaped the adapter dir by the time LoadAdapter re-checks. Built-in
-	// names are allowed here: an admin uploading openai.lua is the documented
-	// override, same as placing the file in adapter_dir by hand.
-	if err := lua.ValidateAdapterName(name, nil); err != nil {
-		return err
-	}
 	if err := os.MkdirAll(c.cfg.AdapterDir, 0755); err != nil {
 		return err
 	}
@@ -903,13 +641,6 @@ func (c *Core) UploadAdapter(name, code string) error {
 }
 
 func (c *Core) RemoveAdapter(name string) error {
-	// Validate the name so a traversal name cannot os.Remove a file outside the
-	// adapter dir. A reserved (built-in) name is a legitimate delete target in
-	// the running VM, so reserved-name rejection is NOT applied here — only the
-	// path-safety character set is.
-	if err := lua.ValidateAdapterName(name, nil); err != nil {
-		return err
-	}
 	path := filepath.Join(c.cfg.AdapterDir, name+".lua")
 	_ = os.Remove(path)
 	c.vm.RemoveAdapter(name)
@@ -924,7 +655,7 @@ func (c *Core) AddSource(src config.Source) error {
 	if err := normalizeSource(&src); err != nil {
 		return err
 	}
-	if err := config.UpsertSourceInYAML(c.cfg.Path, src.Name, src, c.cfg.SecretBox()); err != nil {
+	if err := config.UpsertSourceInYAML(c.cfg.Path, src.Name, src); err != nil {
 		return err
 	}
 	// Update in-memory Sources so mergedSources() finds the entry.
@@ -1021,88 +752,7 @@ func normalizeSource(s *config.Source) error {
 
 // Close releases resources.
 func (c *Core) Close() {
-	// Plugin state must be flushed BEFORE the VM stops. The saver's final write
-	// reads each plugin's Lua tables; once vm.Stop() has closed those states the
-	// read finds nothing and the last interval of accumulation is lost — which
-	// is the exact failure this persistence was added to prevent.
-	if c.plugins != nil {
-		c.plugins.Close()
-	}
 	if c.vm != nil {
 		c.vm.Stop()
 	}
 }
-
-// applyBillingDSL compiles the configured billing profile and injects it into
-// the billing plugin.
-//
-// Configured pricing replaces the hand-written JSON blob that used to be PUT
-// through the state API. That path was used twice in production and both times
-// it "succeeded" while being wrong: once without the required `prices` wrapper
-// (silently wiping the accumulated totals), once with a peak-window shape the
-// plugin does not read (peak traffic billed at off-peak rates, no error). A
-// typed config with load-time validation turns both mistakes into startup
-// errors naming the file and field.
-//
-// A DSL with no profile, or one that fails to compile, leaves the plugin's
-// prices untouched: billing keeps running on whatever it had, and the problem
-// is logged rather than becoming a startup failure — the gateway must forward
-// even when its cost accounting is misconfigured.
-func (c *Core) applyBillingDSL() {
-	ps := c.plugins
-	if ps == nil || ps.Count() == 0 {
-		return
-	}
-	// The billing plugin may simply not be installed; a DSL without it is a
-	// no-op, not an error.
-	var have bool
-	for _, row := range ps.List() {
-		if row["name"] == "billing" && row["loaded"] == true {
-			have = true
-			break
-		}
-	}
-	if !have {
-		return
-	}
-	dsl := c.cfg.BillingDSL
-	if dsl == nil || len(dsl.Profiles) == 0 {
-		return
-	}
-	if err := dsl.Validate(); err != nil {
-		log.Printf("[billing] config invalid, profile not applied: %v", err)
-		return
-	}
-	profile := dsl.Resolve(dsl.Active)
-	if profile == nil {
-		log.Printf("[billing] no billing profile resolved (active=%q)", dsl.Active)
-		return
-	}
-	prices, err := billing.Compile(profile, c.cfg.Sources)
-	if err != nil {
-		log.Printf("[billing] profile %q not applied: %v", profile.ID, err)
-		return
-	}
-	if err := ps.SetState("billing", map[string]interface{}{"prices": prices}); err != nil {
-		log.Printf("[billing] applying profile %q: %v", profile.ID, err)
-		return
-	}
-	log.Printf("[billing] profile %q applied (%d rules, %d sources)", profile.ID, len(profile.Rules), len(c.cfg.Sources))
-}
-
-// ValidateScopeQuotas checks every scope entry's caps before they are stored.
-// A typo in a period must be rejected at write time rather than silently
-// becoming a never-resetting budget — the opposite of what was typed.
-func ValidateScopeQuotas(entries []config.ModelScope) error {
-	for _, e := range entries {
-		if err := (config.KeyQuota{
-			TokenQuota: e.TokenQuota,
-			ReqQuota:   e.ReqQuota,
-			Period:     e.Period,
-			Hours:      e.Hours,
-		}).Validate(); err != nil {
-			return fmt.Errorf("model %q: %w", e.Model, err)
-		}
-	}
-	return nil
-}

internal/core/device_harness_test.go

@@ -1,180 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-
-	"llmsproxy/internal/lua"
-)
-
-// readBundledChannels 读内置 channels 插件源（供行为/变异测试共用）。
-func readBundledChannels(t *testing.T) (string, error) {
-	t.Helper()
-	return lua.ReadBundledPlugin("channels")
-}
-
-// deviceHarness 是 device-poll 决策表的可复用测试台：假上游（脚本化逐次响应）
-// + channels 插件加载指定源码 + minimax 端点指到假上游。
-// 行为测试（TestChannelsDevicePollBehavior）与变异测试共用它 —— 决策表只有
-// 一份，两处不会漂移。
-type deviceHarness struct {
-	t    *testing.T
-	ps   *lua.Plugins
-	ts   *httptest.Server
-	step int32
-	// script 持续被 HTTP handler 原子读取
-	script atomic.Value // []scriptStep
-}
-
-type scriptStep struct {
-	http int
-	body string
-}
-
-func newDeviceHarness(t *testing.T, src string) *deviceHarness {
-	t.Helper()
-	h := &deviceHarness{t: t}
-	h.script.Store([]scriptStep{})
-
-	h.ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/oauth2/device/code":
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprint(w, `{"device_code":"DEV1","user_code":"ABCD-EFGH","verification_uri":"https://example/activate","interval":1,"expires_in":600}`)
-		case "/oauth2/token":
-			i := int(atomic.AddInt32(&h.step, 1)) - 1
-			script := h.script.Load().([]scriptStep)
-			w.Header().Set("Content-Type", "application/json")
-			if i >= len(script) {
-				w.WriteHeader(500)
-				fmt.Fprint(w, `{"error":"unexpected"}`)
-				return
-			}
-			if script[i].http != 0 && script[i].http != 200 {
-				w.WriteHeader(script[i].http)
-			}
-			fmt.Fprint(w, script[i].body)
-		default:
-			w.WriteHeader(404)
-		}
-	}))
-	t.Cleanup(h.ts.Close)
-
-	c := kernelTestCore(t)
-	h.ps = c.Plugins()
-	if err := h.ps.LoadSource("channels", src); err != nil {
-		t.Fatalf("加载: %v", err)
-	}
-	if _, err := h.ps.Call("channels", "set_endpoints", map[string]interface{}{
-		"platform": "minimax",
-		"device": map[string]interface{}{
-			"code_url":  h.ts.URL + "/oauth2/device/code",
-			"token_url": h.ts.URL + "/oauth2/token",
-		},
-	}); err != nil {
-		t.Fatalf("set_endpoints: %v", err)
-	}
-	return h
-}
-
-// setScript 设置 token 端点的逐次响应脚本。`400 {...}` 形式表示非 200。
-func (h *deviceHarness) setScript(steps ...string) {
-	var out []scriptStep
-	for _, b := range steps {
-		code := 200
-		switch {
-		case strings.HasPrefix(b, "400 "):
-			code, b = 400, b[4:]
-		case strings.HasPrefix(b, "403 "):
-			code, b = 403, b[4:]
-		}
-		out = append(out, scriptStep{http: code, body: b})
-	}
-	h.script.Store(out)
-	atomic.StoreInt32(&h.step, 0)
-}
-
-func (h *deviceHarness) begin() map[string]interface{} {
-	out, err := h.ps.InvokeHandler("channels", "start_login", &lua.HandlerRequest{
-		Method: "POST", Body: `{"platform":"minimax"}`,
-	})
-	if err != nil {
-		h.t.Fatal(err)
-	}
-	return out.JSON.(map[string]interface{})
-}
-
-func (h *deviceHarness) poll(id string) map[string]interface{} {
-	out, _ := h.ps.InvokeHandler("channels", "poll_login", &lua.HandlerRequest{
-		Method: "GET", Query: map[string]string{"id": id},
-	})
-	return out.JSON.(map[string]interface{})
-}
-
-// runDecisionTable 跑完整 8 行决策表，全部符合预期返回 true。
-// 这是行为契约的单一事实来源：行为测试用它断言通过；变异测试用它杀变异体。
-func (h *deviceHarness) runDecisionTable() bool {
-	ok := func(cond bool) bool { return cond }
-	st := func(steps ...string) map[string]interface{} {
-		h.setScript(steps...)
-		j := h.begin()
-		sid := j["session"].(map[string]interface{})["id"].(string)
-		return h.poll(sid)
-	}
-
-	// 行1: 200+pending → 等
-	if j := st(`{"status":"pending"}`); j["state"] != "pending" {
-		return false
-	}
-	// 行2: 200+slow_down → 等 + interval+5
-	h.setScript(`{"status":"slow_down"}`)
-	j := h.begin()
-	sid := j["session"].(map[string]interface{})["id"].(string)
-	if j2 := h.poll(sid); j2["state"] != "pending" {
-		return false
-	} else if iv, _ := j2["interval"].(float64); iv < 6 {
-		return false
-	}
-	// 行3: 200+denied → failed，message 区分于通用错误（杀"denied 不识别"变异体）
-	if j := st(`{"status":"denied"}`); j["state"] != "failed" {
-		return false
-	} else if msg, _ := j["message"].(string); !strings.Contains(msg, "用户拒绝") {
-		return false
-	}
-	// 行4: 200+expired_token → failed，message 带过期字样
-	if j := st(`{"status":"expired_token"}`); j["state"] != "failed" {
-		return false
-	} else if msg, _ := j["message"].(string); !strings.Contains(msg, "过期") {
-		return false
-	}
-	// 行5: 400+authorization_pending → 等
-	if j := st(`400 {"error":"authorization_pending"}`); j["state"] != "pending" {
-		return false
-	}
-	// 行6: 403+slow_down → 等 + interval+5
-	h.setScript(`403 {"error":"slow_down"}`)
-	j = h.begin()
-	sid = j["session"].(map[string]interface{})["id"].(string)
-	if j2 := h.poll(sid); j2["state"] != "pending" {
-		return false
-	} else if iv, _ := j2["interval"].(float64); iv < 6 {
-		return false
-	}
-	// 行7: 200+access_token → completed（需先授权 add_source）
-	_ = h.ps.SetPluginKernelPermission("channels", []string{"add_source", "status", "list_sources"}, false)
-	h.setScript(`{"access_token":"MM-ACCESS-1","refresh_token":"MM-RF-1","nickname":"mm-user"}`)
-	j = h.begin()
-	sid = j["session"].(map[string]interface{})["id"].(string)
-	if j2 := h.poll(sid); j2["state"] != "completed" || j2["account"] != "mm-user" {
-		return false
-	}
-	// 行8: 其它 error → failed 带文本
-	if j := st(`{"error":"server_error"}`); j["state"] != "failed" {
-		return false
-	}
-	return ok(true)
-}

internal/core/device_mutate_test.go

@@ -1,73 +0,0 @@
-package core
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestDevicePollMutants 是 device-poll 执行器的变异测试。
-//
-// 用户要求：移植要照参考实现的行为形成测试项，且要变异验证测试真的能杀掉
-// 「行为走样」的代码。每个用例把 channels 源里的一个决策分支做语义变异，
-// 断言决策表**会失败**（变异体被杀）。变异体幸存 = 该分支没有覆盖。
-func TestDevicePollMutants(t *testing.T) {
-	src, err := readBundledChannels(t)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// 锚点会命中 deviceOneStep 里两处同形代码（workos 分支 + minimax 分支），
-	// 全部替换：两个决策表（minimax + workos）都会杀，任一幸存即失败。
-	muts := []struct {
-		name string
-		from string
-		to   string
-	}{
-		{
-			name: "slow_down 不再加 interval",
-			from: `sess.device_interval = (sess.device_interval or d.interval or 5) + step`,
-			to:   `sess.device_interval = (sess.device_interval or d.interval or 5)`,
-		},
-		{
-			name: "denied 被当成继续等待",
-			from: `if resp.status == 200 and (status == "denied" or status == "access_denied") then`,
-			to:   `if resp.status == 200 and (status == "denied_x" or status == "access_denied") then`,
-		},
-		{
-			name: "expired_token 不被识别",
-			from: `if resp.status == 200 and (status == "expired" or status == "expired_token") then`,
-			to:   `if resp.status == 200 and (status == "expired" or status == "expired_token_x") then`,
-		},
-		{
-			name: "authorization_pending 被当成失败",
-			from: `if ecode == "authorization_pending" then return false end`,
-			to:   `if ecode == "authorization_pending_x" then return false end`,
-		},
-		{
-			name: "成功分支被禁用",
-			from: `if resp.status == 200 and rec.access_token then`,
-			to:   `if resp.status == 200 and rec.access_token and false then`,
-		},
-	}
-
-	for _, mu := range muts {
-		t.Run(mu.name, func(t *testing.T) {
-			if !strings.Contains(src, mu.from) {
-				t.Fatalf("锚点丢失，先更新实现与锚点：%q", mu.from)
-			}
-			// 锚点在 deviceOneStep 的 workos/minimax 两个分支各有一份同形代码，
-			// 全部替换：任一分支的变异体被任一决策表杀掉才算有覆盖。
-			mutated := strings.ReplaceAll(src, mu.from, mu.to)
-			if mutated == src {
-				t.Fatal("变异未生效")
-			}
-			// 基准必须全过（测试自身有效），变异体必须被杀（有覆盖）
-			if !newDeviceHarness(t, src).runDecisionTable() {
-				t.Fatal("基准决策表未全过 —— 测试自身失效")
-			}
-			if newDeviceHarness(t, mutated).runDecisionTable() {
-				t.Fatalf("★ 变异体幸存（%s）—— 该分支无覆盖", mu.name)
-			}
-		})
-	}
-}

internal/core/kernel_actions.go

@@ -1,396 +0,0 @@
-package core
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/lua"
-)
-
-// 内核动作实现（R4-c）
-//
-// 把 Core 的公开动作暴露给插件 Lua，走 lua.KernelAPI 接口注入（依赖方向是
-// core → lua，所以接口定义在 lua 包、实现放在这里）。
-//
-// # 为什么是"动作面"而不是"给插件一个 Core 指针"
-//
-// 直接暴露 *Core 会让插件能碰任何未导出的细节，而且每一次内核重构都会变成
-// 对插件作者的破坏性变更。动作面是一份**显式的契约**：每个动作有名字、危险级、
-// 超时预算，加动作是一次有意的行为，而不是顺手多导出一个方法。
-//
-// # 凭据边界
-//
-// 这里**不实现** list_keys / find_key。Core.ListKeys() 返回的是**明文**网关
-// 密钥，把它交给第三方 Lua 等于把部署的整个凭据面交出去。key 相关的读走掩码
-// 形态（create_key 的返回是唯一一次明文，且是"刚创建的那一个"）。
-var _ lua.KernelAPI = (*Core)(nil)
-
-// Actions implements lua.KernelAPI.
-//
-// The catalog lives in the lua package because permissions must be checkable even
-// when no Core is wired. This method exists so the interface is satisfied by the
-// real kernel rather than by a separate adapter type.
-func (c *Core) Actions() []lua.KernelAction { return lua.KernelActions() }
-
-// Invoke implements lua.KernelAPI. It dispatches one action.
-//
-// Every action is expected to honour ctx. The caller (lua.callKernel) gives up on
-// a deadline and returns an error to the plugin, but a kernel action that keeps
-// running afterwards would be an invisible leak, so the long ones (probe_all)
-// pass ctx down into the network layer.
-func (c *Core) Invoke(ctx context.Context, name string, args map[string]interface{}) (interface{}, error) {
-	switch name {
-	// ---- 只读 ----
-	case "status":
-		return c.actionStatus(), nil
-	case "list_sources":
-		return c.actionListSources(), nil
-	case "list_models":
-		return c.actionListModels(), nil
-	case "list_adapters":
-		return c.actionListAdapters(), nil
-	case "list_auto_rules":
-		return c.actionListAutoRules(), nil
-	case "adapter_owner":
-		return c.actionAdapterOwner(args)
-
-	// ---- 写 ----
-	case "reload":
-		if err := ctx.Err(); err != nil {
-			return nil, err
-		}
-		return map[string]interface{}{"ok": true}, c.Reload()
-	case "reset_health":
-		// ResetHealth already no-ops on a nil registry (it ranges over
-		// Providers()), so this needs no guard beyond the nil check inside.
-		c.ResetHealth()
-		return map[string]interface{}{"ok": true}, nil
-	case "probe_all":
-		r := c.Registry()
-		if r == nil {
-			return nil, fmt.Errorf("the registry is not built yet")
-		}
-		r.ProbeAll(ctx)
-		if err := ctx.Err(); err != nil {
-			return nil, fmt.Errorf("probe_all was cut short: %w", err)
-		}
-		return map[string]interface{}{"ok": true}, nil
-	case "save_auto_rules":
-		return c.actionSaveAutoRules(args)
-	case "save_key_auto":
-		return c.actionSaveKeyAuto(args)
-	case "add_source":
-		return c.actionAddSource(args)
-	case "create_key":
-		return c.actionCreateKey(args)
-
-	// ---- 破坏性 ----
-	case "remove_source":
-		return c.actionRemoveSource(args)
-	case "delete_key":
-		return c.actionDeleteKey(args)
-	case "update_key":
-		return c.actionUpdateKey(args)
-	case "remove_adapter":
-		return c.actionRemoveAdapter(args)
-	case "set_plugin_enabled":
-		return c.actionSetPluginEnabled(args)
-	default:
-		return nil, fmt.Errorf("unknown kernel action %q", name)
-	}
-}
-
-// ---- 只读实现 ----
-
-func (c *Core) actionStatus() interface{} {
-	// A plugin can call this DURING LoadDir (its own __init or first hook), which
-	// runs before rebuildRegistry builds the registry. Returning an empty status
-	// rather than panicking keeps a load-time call from taking the process down;
-	// the plugin sees an empty list and the next call gives real data.
-	out := map[string]interface{}{
-		"sources":    []interface{}{},
-		"auto_slots": []interface{}{},
-		"default":    c.cfg.DefaultModel,
-		"ready":      false,
-	}
-	if r := c.Registry(); r != nil {
-		out["sources"] = r.Status()
-		out["ready"] = true
-	}
-	if slots := c.AutoSlotStates(); slots != nil {
-		out["auto_slots"] = slots
-	}
-	return out
-}
-
-// actionListSources returns the sources with api_key MASKED.
-//
-// Masking is not optional: a plugin has no legitimate need for another source's
-// key, and a plugin that wrote the source itself already has it in its own
-// credential vault.
-func (c *Core) actionListSources() interface{} {
-	srcs := c.Sources()
-	out := make([]map[string]interface{}, 0, len(srcs))
-	for _, s := range srcs {
-		models := make([]string, 0, len(s.Models))
-		for _, m := range s.Models {
-			models = append(models, m.ID)
-		}
-		out = append(out, map[string]interface{}{
-			"name":           s.Name,
-			"base_url":       s.BaseURL,
-			"adapter":        s.Adapter,
-			"models":         models,
-			"has_key":        s.APIKey != "" || s.APIKeyEnv != "",
-			"key_hint":       maskSecretHint(s.APIKey),
-			"max_concurrent": s.MaxConcurrent,
-		})
-	}
-	return out
-}
-
-// maskSecretHint shows only a short suffix so an operator (and a plugin) can tell
-// two keys apart without either getting the secret.
-func maskSecretHint(k string) string {
-	if k == "" {
-		return ""
-	}
-	if len(k) <= 4 {
-		return "***"
-	}
-	return "***" + k[len(k)-4:]
-}
-
-func (c *Core) actionListModels() interface{} {
-	if r := c.Registry(); r != nil {
-		return r.ModelList()
-	}
-	return []string{}
-}
-
-func (c *Core) actionListAdapters() interface{} {
-	return c.ListAdapters()
-}
-
-func (c *Core) actionListAutoRules() interface{} {
-	return map[string]interface{}{
-		"auto":       c.AutoRules(),
-		"auto_image": c.AutoImageRules(),
-	}
-}
-
-func (c *Core) actionAdapterOwner(args map[string]interface{}) (interface{}, error) {
-	name, _ := args["name"].(string)
-	if name == "" {
-		return nil, fmt.Errorf("adapter_owner requires a name")
-	}
-	owner := ""
-	if ps := c.Plugins(); ps != nil {
-		owner = ps.AdapterOwnerOf(name)
-	}
-	return map[string]interface{}{
-		"name":  name,
-		"owner": owner, // "" means operator-installed
-	}, nil
-}
-
-// ---- 写实现 ----
-
-func (c *Core) actionSaveAutoRules(args map[string]interface{}) (interface{}, error) {
-	entries, err := decodeScopes(args["entries"])
-	if err != nil {
-		return nil, err
-	}
-	if err := c.SaveAutoRules(entries); err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "count": len(entries)}, nil
-}
-
-func (c *Core) actionSaveKeyAuto(args map[string]interface{}) (interface{}, error) {
-	keyName, _ := args["key_name"].(string)
-	if keyName == "" {
-		return nil, fmt.Errorf("save_key_auto requires key_name")
-	}
-	entries, err := decodeScopes(args["entries"])
-	if err != nil {
-		return nil, err
-	}
-	if err := c.SaveKeyAuto(keyName, entries); err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "count": len(entries)}, nil
-}
-
-// actionAddSource is the capability that makes "plugin-driven upstream" real: a
-// plugin that has just obtained credentials can wire its endpoint in as a source
-// without the operator editing config.yaml.
-func (c *Core) actionAddSource(args map[string]interface{}) (interface{}, error) {
-	raw, ok := args["source"]
-	if !ok {
-		return nil, fmt.Errorf("add_source requires a source table")
-	}
-	b, err := json.Marshal(raw)
-	if err != nil {
-		return nil, fmt.Errorf("source is not encodable: %w", err)
-	}
-	var src config.Source
-	if err := json.Unmarshal(b, &src); err != nil {
-		return nil, fmt.Errorf("source shape is invalid: %w", err)
-	}
-	if strings.TrimSpace(src.Name) == "" {
-		return nil, fmt.Errorf("source requires a name")
-	}
-	if strings.TrimSpace(src.BaseURL) == "" {
-		return nil, fmt.Errorf("source %s requires a base_url", src.Name)
-	}
-	if err := c.AddSource(src); err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "name": src.Name}, nil
-}
-
-// actionCreateKey creates a gateway key.
-//
-// The plaintext key is returned ONCE, in this response — the same posture as the
-// admin API. It is not retrievable later, so a plugin that needs it must store it
-// in its own credential vault immediately.
-func (c *Core) actionCreateKey(args map[string]interface{}) (interface{}, error) {
-	name, _ := args["name"].(string)
-	role, _ := args["role"].(string)
-	if role == "" {
-		role = "user"
-	}
-	models, err := decodeScopes(args["models"])
-	if err != nil {
-		return nil, err
-	}
-	k, err := c.CreateKey(name, role, models, "created by plugin")
-	if err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{
-		"key":    k.Key,
-		"name":   k.Name,
-		"role":   k.Role,
-		"models": k.Models,
-	}, nil
-}
-
-// ---- 破坏性实现 ----
-
-func (c *Core) actionRemoveSource(args map[string]interface{}) (interface{}, error) {
-	name, _ := args["name"].(string)
-	if name == "" {
-		return nil, fmt.Errorf("remove_source requires a name")
-	}
-	// The last source is not removable: an empty registry turns every request
-	// into a 503, and the operator would have to fix it from the filesystem.
-	if len(c.Sources()) <= 1 {
-		return nil, fmt.Errorf("refusing to remove the last source: the gateway would have nothing to route to")
-	}
-	if err := c.RemoveSource(name); err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "name": name}, nil
-}
-
-func (c *Core) actionDeleteKey(args map[string]interface{}) (interface{}, error) {
-	key, _ := args["key"].(string)
-	if key == "" {
-		return nil, fmt.Errorf("delete_key requires the key to delete")
-	}
-	ok, err := c.DeleteKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !ok {
-		return nil, fmt.Errorf("no such key")
-	}
-	return map[string]interface{}{"ok": true}, nil
-}
-
-func (c *Core) actionUpdateKey(args map[string]interface{}) (interface{}, error) {
-	key, _ := args["key"].(string)
-	if key == "" {
-		return nil, fmt.Errorf("update_key requires the key")
-	}
-	name, _ := args["name"].(string)
-	role, _ := args["role"].(string)
-	models, err := decodeScopes(args["models"])
-	if err != nil {
-		return nil, err
-	}
-	k, err := c.UpdateKey(key, name, role, models, "")
-	if err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "name": k.Name, "role": k.Role}, nil
-}
-
-// actionRemoveAdapter deletes an adapter, but only one the CALLER plugin owns —
-// the ownership check lives in Plugins.RemoveAdapter (see the adapter bridge).
-// A plugin can always remove its own; removing an operator's or a built-in is
-// refused there, and that refusal is the security property.
-func (c *Core) actionRemoveAdapter(args map[string]interface{}) (interface{}, error) {
-	name, _ := args["name"].(string)
-	if name == "" {
-		return nil, fmt.Errorf("remove_adapter requires a name")
-	}
-	ps := c.Plugins()
-	if ps == nil {
-		return nil, fmt.Errorf("no plugins loaded")
-	}
-	plugin, _ := args["plugin"].(string)
-	if plugin == "" {
-		return nil, fmt.Errorf("remove_adapter needs the calling plugin's name")
-	}
-	if err := ps.RemoveAdapter(plugin, name); err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "name": name}, nil
-}
-
-func (c *Core) actionSetPluginEnabled(args map[string]interface{}) (interface{}, error) {
-	name, _ := args["name"].(string)
-	if name == "" {
-		return nil, fmt.Errorf("set_plugin_enabled requires a name")
-	}
-	enabled, ok := args["enabled"].(bool)
-	if !ok {
-		return nil, fmt.Errorf("set_plugin_enabled requires enabled (boolean)")
-	}
-	ps := c.Plugins()
-	if ps == nil {
-		return nil, fmt.Errorf("no plugins loaded")
-	}
-	if err := ps.SetEnabled(name, enabled); err != nil {
-		return nil, err
-	}
-	return map[string]interface{}{"ok": true, "name": name, "enabled": enabled}, nil
-}
-
-// decodeScopes converts a Lua-decoded array of model-scope tables into
-// []config.ModelScope. It accepts both an explicit array and a single table so a
-// one-entry chain does not need a wrapper.
-func decodeScopes(v interface{}) ([]config.ModelScope, error) {
-	if v == nil {
-		return nil, nil
-	}
-	b, err := json.Marshal(v)
-	if err != nil {
-		return nil, fmt.Errorf("entries are not encodable: %w", err)
-	}
-	var list []config.ModelScope
-	if err := json.Unmarshal(b, &list); err == nil {
-		return list, nil
-	}
-	var one config.ModelScope
-	if err := json.Unmarshal(b, &one); err != nil {
-		return nil, fmt.Errorf("entries shape is invalid: %w", err)
-	}
-	return []config.ModelScope{one}, nil
-}

internal/core/kernel_actions_test.go

@@ -1,336 +0,0 @@
-package core
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/lua"
-)
-
-// 本文件验证 R4-c/R4-d 的闭环：**插件自己驱动外部源的链接认证，然后把源接进内核**。
-//
-// 这是用户点明的"同类插件"能力（对照 dsh-our-free-model）：插件主导 OAuth 登录、
-// 存凭据、定时领额度、把拿到的端点注册成内核上游。此前 llmsproxy 的插件只能管
-// 自己的适配器，够不到内核。
-
-// kernelTestCore 起一个最小 core（一个源 + 一个 key）。
-func kernelTestCore(t *testing.T) *Core {
-	t.Helper()
-	dir := t.TempDir()
-	cfg := &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		PluginDir:    filepath.Join(dir, "plugins"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		DefaultModel: "AUTO",
-		GatewayKeys:  []string{"sk-kernel-0001"},
-		Sources: []config.Source{{
-			Name: "primary", BaseURL: "http://127.0.0.1:1/v1", Adapter: "openai",
-			APIKey: "secret-primary-key", MaxConcurrent: 1,
-			Models: []config.Model{{ID: "m1", Kind: "chat"}},
-		}},
-	}
-	c, err := NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(c.Close)
-	return c
-}
-
-// grant 给插件授权若干动作（模拟运维在设置页点选）。
-func grant(t *testing.T, c *Core, plugin string, actions ...string) {
-	t.Helper()
-	if err := c.Plugins().SetPluginKernelPermission(plugin, actions, false); err != nil {
-		t.Fatalf("grant %v to %s: %v", actions, plugin, err)
-	}
-}
-
-const kernelProbePlugin = `
-local plugin = { name = "kernelprobe", version = "1.0" }
-plugin.exports = { "read_status", "read_models", "read_sources", "try_delete_key", "probe_count", "call_reload" }
-plugin.kernel = { "status", "list_models", "reload" }
-
-function plugin.read_status()
-  local st, err = __llmsproxy_kernel.call("status", {})
-  if err then return { err = err } end
-  return { ready = st.ready, nsources = #(st.sources or {}) }
-end
-
-function plugin.read_models()
-  local m, err = __llmsproxy_kernel.call("list_models", {})
-  if err then return { err = err } end
-  return { models = m }
-end
-
--- sources 动作返回的密钥必须是掩码的
-function plugin.read_sources()
-  local s, err = __llmsproxy_kernel.call("list_sources", {})
-  if err then return { err = err } end
-  return { sources = s }
-end
-
--- 未授权的破坏性动作必须被拒
-function plugin.try_delete_key()
-  local _, err = __llmsproxy_kernel.call("delete_key", { key = "sk-kernel-0001" })
-  return { err = err }
-end
-
--- 授权数量可见（插件据此优雅降级）
-function plugin.probe_count()
-  local acts = __llmsproxy_kernel.actions()
-  local granted = 0
-  for _, a in ipairs(acts) do
-    if a.granted then granted = granted + 1 end
-  end
-  return { total = #acts, granted = granted }
-end
-
-function plugin.call_reload()
-  local r, err = __llmsproxy_kernel.call("reload", {})
-  return { ok = r and r.ok, err = err }
-end
-return plugin
-`
-
-// TestPluginCallsKernelActions 验证插件能调内核动作，且权限边界成立。
-func TestPluginCallsKernelActions(t *testing.T) {
-	c := kernelTestCore(t)
-	if err := c.Plugins().LoadSource("kernelprobe", kernelProbePlugin); err != nil {
-		t.Fatal(err)
-	}
-	grant(t, c, "kernelprobe", "status", "list_models", "list_sources")
-
-	// 只读动作可用
-	out, err := c.Plugins().Call("kernelprobe", "read_status", map[string]interface{}{})
-	if err != nil {
-		t.Fatalf("read_status: %v", err)
-	}
-	m := out.(map[string]interface{})
-	if m["err"] != nil {
-		t.Fatalf("status 调用失败: %v", m["err"])
-	}
-	if m["ready"] != true {
-		t.Errorf("registry 应已就绪: %#v", m)
-	}
-	if n, _ := m["nsources"].(float64); n < 1 {
-		t.Errorf("应至少有 1 个源, 实得 %v", m["nsources"])
-	}
-
-	// 模型列表
-	out, err = c.Plugins().Call("kernelprobe", "read_models", map[string]interface{}{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if models, ok := out.(map[string]interface{})["models"].([]interface{}); !ok || len(models) == 0 {
-		t.Errorf("模型列表应为非空数组: %#v", out)
-	}
-}
-
-// TestKernelActionMasksSourceKeys 是安全断言：list_sources **不得**泄漏 api_key。
-func TestKernelActionMasksSourceKeys(t *testing.T) {
-	c := kernelTestCore(t)
-	if err := c.Plugins().LoadSource("kernelprobe", kernelProbePlugin); err != nil {
-		t.Fatal(err)
-	}
-	grant(t, c, "kernelprobe", "list_sources")
-
-	out, err := c.Plugins().Call("kernelprobe", "read_sources", map[string]interface{}{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// 把整个返回值序列化后检查：明文密钥绝不能出现在里面
-	b, _ := json.Marshal(out)
-	if s := string(b); json.Valid(b) && contains(s, "secret-primary-key") {
-		t.Fatalf("list_sources 泄漏了源的明文 api_key: %s", s)
-	}
-	// 但应有可区分性（has_key + 掩码后缀）
-	if !contains(string(b), "***") {
-		t.Errorf("应给出掩码提示而不是什么都没有: %s", string(b))
-	}
-}
-
-// TestKernelActionDeniedWithoutGrant 是权限默认拒绝的断言。
-func TestKernelActionDeniedWithoutGrant(t *testing.T) {
-	c := kernelTestCore(t)
-	if err := c.Plugins().LoadSource("kernelprobe", kernelProbePlugin); err != nil {
-		t.Fatal(err)
-	}
-	// 故意不授权任何动作
-	out, err := c.Plugins().Call("kernelprobe", "try_delete_key", map[string]interface{}{})
-	if err != nil {
-		t.Fatalf("调用本身不该报错（拒绝应作为返回值）: %v", err)
-	}
-	m := out.(map[string]interface{})
-	if m["err"] == nil || m["err"] == "" {
-		t.Fatal("未授权的 delete_key 必须被拒")
-	}
-	t.Logf("拒绝信息: %v", m["err"])
-	// 拒绝信息要点名动作与插件（否则运维无法行动）
-	msg, _ := m["err"].(string)
-	if !contains(msg, "delete_key") || !contains(msg, "kernelprobe") {
-		t.Errorf("拒绝信息应点名动作与插件, 实得 %q", msg)
-	}
-	// 且密钥必须还在
-	if _, ok := c.FindKey("sk-kernel-0001"); !ok {
-		t.Fatal("被拒的动作不应真的执行")
-	}
-}
-
-// TestKernelActionsReportGranted 插件能看到自己拿到了哪些权限。
-func TestKernelActionsReportGranted(t *testing.T) {
-	c := kernelTestCore(t)
-	if err := c.Plugins().LoadSource("kernelprobe", kernelProbePlugin); err != nil {
-		t.Fatal(err)
-	}
-	grant(t, c, "kernelprobe", "status", "list_models")
-
-	out, err := c.Plugins().Call("kernelprobe", "probe_count", map[string]interface{}{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	m := out.(map[string]interface{})
-	total, _ := m["total"].(float64)
-	granted, _ := m["granted"].(float64)
-	if total < 15 {
-		t.Errorf("动作总数应 >=15, 实得 %v", total)
-	}
-	if granted != 2 {
-		t.Errorf("授权数应为 2（status+list_models）, 实得 %v", granted)
-	}
-}
-
-// TestPluginRegistersSourceIntoKernel 是"同类插件"的核心闭环：
-// 插件通过内核动作把一个新的外部源接进网关。
-func TestPluginRegistersSourceIntoKernel(t *testing.T) {
-	c := kernelTestCore(t)
-	code := `
-local plugin = { name = "upstream", version = "1.0" }
-plugin.exports = { "add_my_source" }
-plugin.kernel = { "add_source", "list_sources" }
-
-function plugin.add_my_source(args)
-  local src = {
-    name = "plugin-provided",
-    base_url = "http://127.0.0.1:9/v1",
-    adapter = "openai",
-    api_key = "plugin-managed-token",
-    max_concurrent = 2,
-    models = { { id = "plugin-model", kind = "chat", priority = 10 } },
-  }
-  local r, err = __llmsproxy_kernel.call("add_source", { source = src })
-  if err then return { err = err } end
-  return { ok = r.ok, name = r.name }
-end
-return plugin
-`
-	if err := c.Plugins().LoadSource("upstream", code); err != nil {
-		t.Fatal(err)
-	}
-	grant(t, c, "upstream", "add_source", "list_sources")
-
-	out, err := c.Plugins().Call("upstream", "add_my_source", map[string]interface{}{})
-	if err != nil {
-		t.Fatalf("add_source: %v", err)
-	}
-	m := out.(map[string]interface{})
-	if m["err"] != nil {
-		t.Fatalf("插件注册源失败: %v", m["err"])
-	}
-	if m["name"] != "plugin-provided" {
-		t.Fatalf("返回的源名不对: %#v", m)
-	}
-
-	// 内核侧必须真的有了这个源 —— 这是"接进网关"的定义
-	found := false
-	for _, s := range c.Sources() {
-		if s.Name == "plugin-provided" {
-			found = true
-			if s.BaseURL != "http://127.0.0.1:9/v1" {
-				t.Errorf("base_url 未落库: %q", s.BaseURL)
-			}
-		}
-	}
-	if !found {
-		t.Fatal("插件注册的源没有出现在内核源列表里")
-	}
-	// 且模型已可路由
-	for _, id := range c.Registry().ModelList() {
-		if id == "plugin-model" {
-			return // 通过
-		}
-	}
-	t.Errorf("插件注册的模型未进入可路由列表: %v", c.Registry().ModelList())
-}
-
-// TestKernelPermissionPersists 授权必须落盘（否则重启即失效）。
-func TestKernelPermissionPersists(t *testing.T) {
-	c := kernelTestCore(t)
-	if err := c.Plugins().LoadSource("kernelprobe", kernelProbePlugin); err != nil {
-		t.Fatal(err)
-	}
-	grant(t, c, "kernelprobe", "status", "reload")
-
-	pdir := c.Config().PluginDir
-	path := filepath.Join(pdir, ".kernel-perms.json")
-	b, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("授权未落盘: %v", err)
-	}
-	if !contains(string(b), "reload") {
-		t.Errorf("落盘内容缺少动作名: %s", b)
-	}
-
-	// 模拟重启：新建 Plugins、加载授权、权限仍在
-	vm2 := lua.NewVM(filepath.Join(t.TempDir(), "adapters"))
-	if err := vm2.Start(); err != nil {
-		t.Fatal(err)
-	}
-	defer vm2.Stop()
-	ps2 := lua.NewPlugins(vm2, pdir)
-	if err := ps2.LoadKernelPermissions(); err != nil {
-		t.Fatal(err)
-	}
-	perm := ps2.PluginKernelPermission("kernelprobe")
-	if len(perm.Actions) != 2 {
-		t.Fatalf("重启后授权应保留 2 项, 实得 %#v", perm.Actions)
-	}
-}
-
-// TestUnknownKernelActionRejected 拼错的动作名必须在授权时就被拒，
-// 而不是静默授予"什么都不允许"。
-func TestUnknownKernelActionRejected(t *testing.T) {
-	c := kernelTestCore(t)
-	if err := c.Plugins().LoadSource("kernelprobe", kernelProbePlugin); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Plugins().SetPluginKernelPermission("kernelprobe", []string{"no_such_action"}, false); err == nil {
-		t.Fatal("未知动作名应被拒")
-	}
-}
-
-// TestKernelActionSurfaceExcludesPlaintextKeys 是凭据边界的回归断言：
-// 动作面里绝不能出现返回明文密钥的动作（ListKeys/FindKey 被有意排除）。
-func TestKernelActionSurfaceExcludesPlaintextKeys(t *testing.T) {
-	for _, a := range lua.KernelActions() {
-		switch a.Name {
-		case "list_keys", "find_key", "get_key":
-			t.Fatalf("动作面出现了明文密钥读取动作 %q —— 这会把部署的凭据面交给插件", a.Name)
-		}
-	}
-}
-
-func contains(haystack, needle string) bool {
-	return len(needle) > 0 && len(haystack) >= len(needle) &&
-		func() bool {
-			for i := 0; i+len(needle) <= len(haystack); i++ {
-				if haystack[i:i+len(needle)] == needle {
-					return true
-				}
-			}
-			return false
-		}()
-}

internal/core/kernel_effect_test.go

@@ -1,39 +0,0 @@
-package core
-
-import "testing"
-
-// TestGrantedDestructiveActionTakesEffect 确认授权后的破坏性动作**真的执行**。
-//
-// 上一条测试只证明"不死锁、有返回"。一个把所有动作都变成空转的 dispatch 也能
-// 通过它 —— 所以这条单独断言副作用确实落地（密钥真的被删）。
-func TestGrantedDestructiveActionTakesEffect(t *testing.T) {
-	c := kernelTestCore(t)
-	code := `
-local plugin = { name = "eff", version = "1.0" }
-plugin.exports = { "del" }
-function plugin.del(args)
-  local r, err = __llmsproxy_kernel.call("delete_key", { key = args.key })
-  return { ok = r ~= nil, err = err }
-end
-return plugin
-`
-	if err := c.Plugins().LoadSource("eff", code); err != nil {
-		t.Fatal(err)
-	}
-	_ = c.Plugins().SetPluginKernelPermission("eff", []string{"delete_key"}, false)
-
-	if _, ok := c.FindKey("sk-kernel-0001"); !ok {
-		t.Fatal("前置条件：key 应存在")
-	}
-	out, err := c.Plugins().Call("eff", "del", map[string]interface{}{"key": "sk-kernel-0001"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	m := out.(map[string]interface{})
-	if m["ok"] != true {
-		t.Fatalf("动作未成功: %#v", m)
-	}
-	if _, ok := c.FindKey("sk-kernel-0001"); ok {
-		t.Fatal("★ 动作报告成功但副作用没发生 —— dispatch 是空转")
-	}
-}

internal/core/kernel_no_deadlock_test.go

@@ -1,69 +0,0 @@
-package core
-
-import (
-	"testing"
-	"time"
-
-	"llmsproxy/internal/lua"
-)
-
-// TestNoKernelActionDeadlocksFromLua 对**每个**内核动作做同一条断言：
-// 在插件 Lua 调用（此时持有 p.mu）内执行时不得死锁。
-//
-// 为什么是"每个"而不是"那个出问题的"：最初只有 set_plugin_enabled 被发现自死锁
-// （它经 SetEnabled 重入 p.mu），但"是否还有别的动作也会重入"只能靠枚举回答。
-// 这条测试就是那次枚举的固化 —— 将来新增动作时如果也重入插件锁，它会失败。
-//
-// 同时它验证了"超时后副作用仍在幕后执行"这个更隐蔽的变体：那个缺陷的表现是
-// 插件收到 error、但动作其实生效了。断言方式只是"不死锁 + 返回"，因为死锁与
-// 迟到副作用是同一个根因（在错误的锁上下文里执行）。
-func TestNoKernelActionDeadlocksFromLua(t *testing.T) {
-	for _, a := range lua.KernelActions() {
-		a := a
-		t.Run(a.Name, func(t *testing.T) {
-			c := kernelTestCore(t)
-			code := `
-local plugin = { name = "probe_all_actions", version = "1.0" }
-plugin.exports = { "run" }
-function plugin.run(args)
-  local r, err = __llmsproxy_kernel.call(args.action, args.arg or {})
-  return { ok = r ~= nil, err = err }
-end
-return plugin
-`
-			if err := c.Plugins().LoadSource("probe_all_actions", code); err != nil {
-				t.Fatal(err)
-			}
-			// 授权所有动作（含破坏性），以便真正执行到
-			all := make([]string, 0)
-			for _, x := range lua.KernelActions() {
-				all = append(all, x.Name)
-			}
-			if err := c.Plugins().SetPluginKernelPermission("probe_all_actions", all, false); err != nil {
-				t.Fatal(err)
-			}
-			arg := map[string]interface{}{}
-			switch a.Name {
-			case "name", "adapter_owner":
-				arg["name"] = "primary"
-			}
-			if a.Name == "adapter_owner" {
-				arg = map[string]interface{}{"name": "openai"}
-			}
-			done := make(chan struct{})
-			go func() {
-				defer close(done)
-				_, err := c.Plugins().Call("probe_all_actions", "run",
-					map[string]interface{}{"action": a.Name, "arg": arg})
-				if err != nil {
-					t.Logf("%s 返回 err=%v", a.Name, err)
-				}
-			}()
-			select {
-			case <-done:
-			case <-time.After(8 * time.Second):
-				t.Fatalf("动作 %s 在 Lua 调用内死锁（deferred=%v danger=%s）", a.Name, a.Deferred, a.Danger)
-			}
-		})
-	}
-}

internal/core/key_auto_concurrency_test.go

@@ -1,189 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"llmsproxy/internal/config"
-)
-
-// AutoChainFor sits on the request hot path and reads keyAutoChains with no
-// lock, while SaveKeyAuto / rebuildRegistry replace that map from the admin
-// path. A "call it twice" test never interleaves those, so it would pass even
-// if the map were mutated in place. These tests run both sides at once under
-// -race and assert what readers actually observe.
-//
-// The property: a reader sees a chain that is either the key's own or the
-// global one — never a torn or empty one. If rebuildKeyAutoChains built the
-// map in place instead of swapping a fresh pointer, readers would sometimes
-// see a partially-filled map and silently fall back to the global chain, i.e.
-// a user quietly losing their configured chain under load.
-
-// concurrentChainConfig builds N keys, half with their own chain pointing at a
-// distinct model so a fallback to the global chain is distinguishable.
-func concurrentChainConfig(t *testing.T, n int) *config.Config {
-	t.Helper()
-	cfg := perKeyTestConfig(t)
-	cfg.Keys = nil
-	cfg.GatewayKeys = []string{"sk-gw-admin"}
-	cfg.Auto = []config.ModelScope{{Model: "gpt-4o", Source: "s1", Tier: 1}}
-	for i := 0; i < n; i++ {
-		k := config.GWKey{
-			Key:  fmt.Sprintf("sk-gw-k%03d", i),
-			Role: "user",
-			Name: fmt.Sprintf("user%d", i),
-		}
-		if i%2 == 0 {
-			k.Auto = []config.ModelScope{{Model: "gpt-4o-mini", Source: "s1", Tier: 1}}
-		}
-		cfg.Keys = append(cfg.Keys, k)
-	}
-	return cfg
-}
-
-func TestAutoChainForConcurrentWithSaveKeyAuto(t *testing.T) {
-	cfg := concurrentChainConfig(t, 40)
-	c := newTestCore(t, cfg)
-
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	var bad atomic.Int64
-
-	for r := 0; r < 8; r++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for !stop.Load() {
-				for i := 0; i < 40; i++ {
-					key := fmt.Sprintf("sk-gw-k%03d", i)
-					ch, ok := c.AutoChainFor(key)
-					if !ok || ch == nil || len(ch.Tiers) == 0 {
-						bad.Add(1)
-						continue
-					}
-					// Legal values are this key's own chain model (either
-					// side of the writer's flip) or the global chain's. The
-					// assertion is about the legal set, not a fixed value:
-					// the writers legitimately change the chain underneath.
-					got := ch.Tiers[0].Slots[0].Model
-					if got != "gpt-4o" && got != "gpt-4o-mini" {
-						bad.Add(1)
-					}
-				}
-			}
-		}()
-	}
-
-	for w := 0; w < 2; w++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			model := "gpt-4o-mini"
-			for i := 0; i < 25 && !stop.Load(); i++ {
-				for j := 0; j < 40; j += 2 {
-					if err := c.SaveKeyAuto(fmt.Sprintf("sk-gw-k%03d", j), []config.ModelScope{
-						{Model: model, Source: "s1", Tier: 1},
-					}); err != nil {
-						bad.Add(1)
-						return
-					}
-				}
-				if model == "gpt-4o-mini" {
-					model = "gpt-4o"
-				} else {
-					model = "gpt-4o-mini"
-				}
-			}
-		}()
-	}
-
-	time.Sleep(400 * time.Millisecond)
-	stop.Store(true)
-	wg.Wait()
-
-	if n := bad.Load(); n > 0 {
-		t.Fatalf("%d reads saw a chain outside {own, global} — the cache is "+
-			"being swapped in place instead of atomically", n)
-	}
-}
-
-// The registry rebuild path (AddSource / RemoveSource) also replaces the
-// cache, so readers must keep a usable chain throughout.
-//
-// Churned sources use a "churn" prefix on purpose: deleting a source a chain
-// references legitimately empties that chain (BuildChain drops unresolvable
-// slots), and asserting otherwise would be testing a fiction rather than the
-// code.
-func TestAutoChainForConcurrentWithSourceChanges(t *testing.T) {
-	cfg := concurrentChainConfig(t, 20)
-	c := newTestCore(t, cfg)
-
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	var bad atomic.Int64
-
-	for r := 0; r < 6; r++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for !stop.Load() {
-				for i := 0; i < 20; i++ {
-					ch, ok := c.AutoChainFor(fmt.Sprintf("sk-gw-k%03d", i))
-					if !ok || ch == nil || len(ch.Tiers) == 0 {
-						bad.Add(1)
-						continue
-					}
-					if got := ch.Tiers[0].Slots[0].Model; got != "gpt-4o" && got != "gpt-4o-mini" {
-						bad.Add(1)
-					}
-				}
-			}
-		}()
-	}
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for n := 0; n < 30 && !stop.Load(); n++ {
-			name := fmt.Sprintf("churn%d", n)
-			_ = c.AddSource(config.Source{
-				Name: name, BaseURL: "http://127.0.0.1:9/v1", Adapter: "openai",
-				Models: []config.Model{{ID: "m-" + name, Priority: 10}}},
-			)
-			_ = c.RemoveSource(name)
-		}
-	}()
-
-	time.Sleep(500 * time.Millisecond)
-	stop.Store(true)
-	wg.Wait()
-
-	if n := bad.Load(); n > 0 {
-		t.Fatalf("%d reads lost the chain while unrelated sources were churned", n)
-	}
-}
-
-// Many distinct keys: the lookup must stay a map hit and must not degrade into
-// returning the global chain as the key count grows.
-func TestAutoChainForManyKeys(t *testing.T) {
-	cfg := concurrentChainConfig(t, 500)
-	c := newTestCore(t, cfg)
-
-	for i := 0; i < 500; i++ {
-		key := fmt.Sprintf("sk-gw-k%03d", i)
-		ch, _ := c.AutoChainFor(key)
-		if ch == nil || len(ch.Tiers) == 0 {
-			t.Fatalf("key %s lost its chain with 500 keys configured", key)
-		}
-		want := "gpt-4o"
-		if i%2 == 0 {
-			want = "gpt-4o-mini"
-		}
-		if got := ch.Tiers[0].Slots[0].Model; got != want {
-			t.Fatalf("key %s got %q, want %q", key, got, want)
-		}
-	}
-}

internal/core/key_auto_test.go

@@ -1,221 +0,0 @@
-package core
-
-import (
-	"path/filepath"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/scheduler"
-)
-
-// Per-key AUTO chains let an admin give one user their own scheduling chain
-// while every other key keeps the global one. These tests pin the three
-// properties that make that safe:
-//
-//  1. a key WITH its own chain gets it;
-//  2. a key WITHOUT one inherits the global chain (backward compatible);
-//  3. the override is actually persisted, so it survives a restart.
-//
-// A test that only checked (1) would pass even if AutoChainFor ignored the key
-// and always returned the global chain whenever the two happened to be equal,
-// so (2) uses deliberately *different* chains.
-
-func perKeyTestConfig(t *testing.T) *config.Config {
-	t.Helper()
-	dir := t.TempDir()
-	return &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "AUTO",
-		GatewayKeys:  []string{"sk-gw-admin"},
-		Sources: []config.Source{
-			{Name: "s1", BaseURL: "http://127.0.0.1:1/v1", Adapter: "openai",
-				Models: []config.Model{{ID: "gpt-4o", Priority: 10}, {ID: "gpt-4o-mini", Priority: 5}}},
-		},
-		// Global chain points at gpt-4o.
-		Auto: []config.ModelScope{{Model: "gpt-4o", Source: "s1", Tier: 1}},
-		Keys: []config.GWKey{
-			{Key: "sk-gw-admin", Role: "admin"},
-			{Key: "sk-gw-inherits", Role: "user", Name: "inherits"},
-			// This key's own chain points at a DIFFERENT model, so returning
-			// the global chain by mistake is detectable.
-			{Key: "sk-gw-own", Role: "user", Name: "own",
-				Auto: []config.ModelScope{{Model: "gpt-4o-mini", Source: "s1", Tier: 1}}},
-		},
-	}
-}
-
-func firstSlotModel(t *testing.T, c *Core, key string) string {
-	t.Helper()
-	ch, _ := c.AutoChainFor(key)
-	if ch == nil || len(ch.Tiers) == 0 {
-		t.Fatalf("key %s: no chain tiers", key)
-	}
-	slots := ch.Tiers[0].Slots
-	if len(slots) == 0 {
-		t.Fatalf("key %s: tier 1 has no slots", key)
-	}
-	return slots[0].Model
-}
-
-// A key that declares its own chain must be scheduled by it, not the global.
-func TestAutoChainForUsesKeyOwnChain(t *testing.T) {
-	c := newTestCore(t, perKeyTestConfig(t))
-
-	if got := firstSlotModel(t, c, "sk-gw-own"); got != "gpt-4o-mini" {
-		t.Fatalf("key with own chain must use it, got %q (want gpt-4o-mini)", got)
-	}
-	// Sanity: the global chain really is different, so the assertion above
-	// cannot pass by accident.
-	if got := firstSlotModel(t, c, "sk-gw-admin"); got != "gpt-4o" {
-		t.Fatalf("admin must use global chain, got %q (want gpt-4o)", got)
-	}
-}
-
-// A key with no own chain inherits the global one. This is what keeps every
-// pre-existing deployment working with no config change.
-func TestAutoChainForInheritsGlobalWhenUnset(t *testing.T) {
-	c := newTestCore(t, perKeyTestConfig(t))
-
-	if got := firstSlotModel(t, c, "sk-gw-inherits"); got != "gpt-4o" {
-		t.Fatalf("key without own chain must inherit global, got %q (want gpt-4o)", got)
-	}
-}
-
-// A key that is not in the key table at all (e.g. a seed key) must also
-// inherit the global chain rather than erroring or returning nil.
-func TestAutoChainForUnknownKeyInheritsGlobal(t *testing.T) {
-	c := newTestCore(t, perKeyTestConfig(t))
-
-	ch, ok := c.AutoChainFor("sk-gw-never-configured")
-	if !ok || ch == nil || len(ch.Tiers) == 0 {
-		t.Fatalf("unknown key must fall back to global chain, got ok=%v chain=%v", ok, ch)
-	}
-}
-
-// The per-key chain must survive a save/reload round trip: an admin configuring
-// a chain in the WebUI and restarting the gateway must not silently lose it.
-func TestSaveKeyAutoPersistsAndApplies(t *testing.T) {
-	cfg := perKeyTestConfig(t)
-	c := newTestCore(t, cfg)
-
-	if err := c.SaveKeyAuto("sk-gw-inherits", []config.ModelScope{
-		{Model: "gpt-4o-mini", Source: "s1", Tier: 1},
-	}); err != nil {
-		t.Fatalf("SaveKeyAuto: %v", err)
-	}
-	if got := firstSlotModel(t, c, "sk-gw-inherits"); got != "gpt-4o-mini" {
-		t.Fatalf("saved chain must apply immediately, got %q", got)
-	}
-
-	// Reload from disk exactly like a restart does.
-	reloaded, err := config.Load(cfg.Path)
-	if err != nil {
-		t.Fatalf("reload config: %v", err)
-	}
-	c2 := newTestCore(t, reloaded)
-	if got := firstSlotModel(t, c2, "sk-gw-inherits"); got != "gpt-4o-mini" {
-		t.Fatalf("per-key chain must survive restart, got %q", got)
-	}
-	// The other key must be unaffected by its neighbour's override.
-	if got := firstSlotModel(t, c2, "sk-gw-admin"); got != "gpt-4o" {
-		t.Fatalf("override must not leak to other keys, got %q", got)
-	}
-}
-
-// Clearing the override must return the key to the global chain, both in
-// memory and after a restart. This is what the WebUI's "use global" toggle
-// does, so a stale shadowing entry would silently pin the user to their old
-// chain forever.
-func TestSaveKeyAutoClearRestoresGlobal(t *testing.T) {
-	cfg := perKeyTestConfig(t)
-	c := newTestCore(t, cfg)
-
-	if err := c.SaveKeyAuto("sk-gw-own", nil); err != nil {
-		t.Fatalf("clear: %v", err)
-	}
-	if got := firstSlotModel(t, c, "sk-gw-own"); got != "gpt-4o" {
-		t.Fatalf("cleared key must inherit global again, got %q", got)
-	}
-
-	reloaded, err := config.Load(cfg.Path)
-	if err != nil {
-		t.Fatalf("reload: %v", err)
-	}
-	c2 := newTestCore(t, reloaded)
-	if got := firstSlotModel(t, c2, "sk-gw-own"); got != "gpt-4o" {
-		t.Fatalf("clear must survive restart, got %q", got)
-	}
-}
-
-// Saving an unknown key must fail loudly rather than creating a shadow entry
-// that no request can ever match.
-func TestSaveKeyAutoUnknownKeyFails(t *testing.T) {
-	c := newTestCore(t, perKeyTestConfig(t))
-
-	if err := c.SaveKeyAuto("sk-gw-nope", []config.ModelScope{{Model: "gpt-4o", Source: "s1"}}); err == nil {
-		t.Fatal("SaveKeyAuto on unknown key must return an error")
-	}
-}
-
-// Per-key quota validation must run, exactly like the model scope path: an
-// override is another place an operator can write a bad budget.
-func TestSaveKeyAutoRejectsBadQuota(t *testing.T) {
-	c := newTestCore(t, perKeyTestConfig(t))
-
-	err := c.SaveKeyAuto("sk-gw-inherits", []config.ModelScope{
-		{Model: "gpt-4o", Source: "s1", TokenQuota: -5},
-	})
-	if err == nil {
-		t.Fatal("negative token quota in a per-key auto chain must be rejected")
-	}
-}
-
-// Source changes must recompile per-key chains. A key whose chain names a
-// model that does not exist yet compiles to an empty chain (BuildChain drops
-// slots it cannot resolve — sending the request into a black hole would be
-// worse), and must start working as soon as the source appears.
-func TestKeyAutoChainsRebuildOnSourceChange(t *testing.T) {
-	cfg := perKeyTestConfig(t)
-	cfg.Keys = append(cfg.Keys, config.GWKey{
-		Key: "sk-gw-late", Role: "user", Name: "late",
-		Auto: []config.ModelScope{{Model: "new-model", Source: "s2", Tier: 1}},
-	})
-	c := newTestCore(t, cfg)
-
-	// s2 does not exist yet, so the chain has no usable slot.
-	if ch, _ := c.AutoChainFor("sk-gw-late"); chainSlotsOf(ch) != 0 {
-		t.Fatalf("chain naming an unknown model must compile empty, got %d slots",
-			chainSlotsOf(ch))
-	}
-	// The other keys are unaffected by the broken one.
-	if got := firstSlotModel(t, c, "sk-gw-admin"); got != "gpt-4o" {
-		t.Fatalf("broken per-key chain must not affect others, got %q", got)
-	}
-
-	// Add the source; the per-key chain must pick it up without a restart.
-	cfg.Sources = append(cfg.Sources, config.Source{
-		Name: "s2", BaseURL: "http://127.0.0.1:2/v1", Adapter: "openai",
-		Models: []config.Model{{ID: "new-model", Priority: 10}},
-	})
-	if err := c.Reload(); err != nil {
-		t.Fatalf("Reload: %v", err)
-	}
-	if got := firstSlotModel(t, c, "sk-gw-late"); got != "new-model" {
-		t.Fatalf("per-key chain must resolve after the source is added, got %q", got)
-	}
-}
-
-// chainSlotsOf counts usable slots, tolerating a nil chain.
-func chainSlotsOf(ch *scheduler.Chain) int {
-	if ch == nil {
-		return 0
-	}
-	n := 0
-	for _, tn := range ch.Tiers {
-		n += len(tn.Slots)
-	}
-	return n
-}

internal/core/source_hosts_test.go

@@ -1,108 +0,0 @@
-package core
-
-import (
-	"net/url"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// The plugin outbound allowlist is built from the hosts of configured sources.
-// That rule is correct for every adapter whose credential and endpoint live on
-// the same host — which was all of them until OpenDesign.
-//
-// OpenDesign splits them: inference is amr-link.open-design.ai, billing is
-// amr-api.open-design.ai. The quota plugin derives the billing host from the
-// inference one, so the host it asks for is NOT the host the operator
-// configured. The request is then refused by the allowlist with a message that
-// reads like a plugin defect ("host ... is not an allowed outbound destination")
-// rather than a missing entry.
-//
-// This file pins the bridge: when a source looks like OpenDesign, the derived
-// billing host joins the allowlist.
-
-func TestSourceHostsIncludesConfiguredHosts(t *testing.T) {
-	cfg := &config.Config{Sources: []config.Source{
-		{Name: "a", BaseURL: "https://api.deepseek.com"},
-		{Name: "b", BaseURL: "https://amr-link.open-design.ai/v1"},
-		{Name: "empty", BaseURL: ""},
-		{Name: "bad", BaseURL: "://nonsense"},
-	}}
-	got := map[string]bool{}
-	for _, h := range sourceHosts(cfg) {
-		got[h] = true
-	}
-	for _, want := range []string{"api.deepseek.com", "amr-link.open-design.ai"} {
-		if !got[want] {
-			t.Errorf("sourceHosts missing configured host %q (allowlist would refuse "+
-				"every plugin request to it): %v", want, got)
-		}
-	}
-	// An empty/unparseable base_url must not abort the whole list.
-	if !got["api.deepseek.com"] {
-		t.Fatal("an unparseable sibling source dropped a valid host")
-	}
-}
-
-// TestSourceHostsAddsDerivedBillingHost covers the OpenDesign case at the level
-// that actually matters: the host the PLUGIN asks for must be in the allowlist.
-func TestSourceHostsAddsDerivedBillingHost(t *testing.T) {
-	cfg := &config.Config{Sources: []config.Source{
-		{Name: "vela", BaseURL: "https://amr-link.open-design.ai/v1"},
-	}}
-	got := map[string]bool{}
-	for _, h := range sourceHosts(cfg) {
-		got[h] = true
-	}
-	if !got["amr-link.open-design.ai"] {
-		t.Fatalf("inference host missing: %v", got)
-	}
-	if !got["amr-api.open-design.ai"] {
-		t.Fatalf("the billing host the quota plugin derives is not in the allowlist, "+
-			"so every OpenDesign balance probe is refused before it leaves the "+
-			"process: %v", got)
-	}
-}
-
-// A deployment with no OpenDesign source must not silently gain its billing
-// host: an allowlist entry is a grant, and widening it for everyone would let an
-// unrelated plugin reach a host the operator never configured.
-func TestSourceHostsDoesNotGrantUnconfiguredBillingHost(t *testing.T) {
-	cfg := &config.Config{Sources: []config.Source{
-		{Name: "ds", BaseURL: "https://api.deepseek.com"},
-	}}
-	for _, h := range sourceHosts(cfg) {
-		if h == "amr-api.open-design.ai" {
-			t.Fatal("the OpenDesign billing host was granted to a deployment with " +
-				"no OpenDesign source")
-		}
-	}
-}
-
-// The derivation has to agree with the Lua side. Keep the two spellings of the
-// rule in one place so a change to one is visible when reading the other.
-func TestSourceHostsDerivationMatchesPluginRule(t *testing.T) {
-	// what the Lua adapter does: origin:gsub("^amr%-link%.", "amr-api.")
-	const in = "amr-link.open-design.ai"
-	want := "amr-api.open-design.ai"
-	got := deriveBillingHost(in)
-	if got != want {
-		t.Fatalf("deriveBillingHost(%q) = %q, want %q — the Go allowlist and the "+
-			"Lua probe must agree on the host or the request is refused", in, got, want)
-	}
-	// A host that is not amr-link stays untouched, so this cannot accidentally
-	// rewrite an unrelated provider into an OpenDesign address.
-	for _, other := range []string{"api.deepseek.com", "amr-link.example.com", "xamr-link.a"} {
-		if deriveBillingHost(other) != other {
-			t.Errorf("deriveBillingHost(%q) = %q, want it unchanged", other, deriveBillingHost(other))
-		}
-	}
-	// url.Parse round-trip keeps the helper honest about what it receives.
-	u, err := url.Parse("https://amr-link.open-design.ai/v1")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if deriveBillingHost(u.Hostname()) != "amr-api.open-design.ai" {
-		t.Fatal("derivation failed on a real base_url hostname")
-	}
-}

internal/core/startup_secrets_test.go

@@ -1,178 +0,0 @@
-package core
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// Startup must be idempotent, and every credential consumer must see PLAINTEXT.
-//
-// Two bugs shared one root cause: NewFromConfig unsealed the config at the END,
-// after the steps that read credentials had already run.
-//
-//  1. seedKeys() deduped cfg.Keys[i].Key against the plaintext gateway_keys
-//     entries. With ciphertext keys the comparison never matched, so every
-//     restart appended another copy of the same admin key — production reached
-//     four identical admin keys.
-//  2. rebuildRegistry() handed cfg.Sources[i].APIKey to provider.New, so with
-//     ciphertext it built every upstream client with "enc:v1:..." as its bearer
-//     token and every upstream call would 401.
-//
-// They masked each other: seedKeys' Save() unsealed memory as a side effect, so
-// bug 2 was invisible until the redundant saves were removed. These tests drive
-// the real entry point (core.New -> config.Load off disk), because building a
-// fresh in-memory config per attempt hides both bugs — that is exactly how the
-// first draft of this test failed to reproduce anything.
-
-// writeSealedInstall creates a config on disk the way a real install looks
-// after its first run: credentials already sealed, gateway_keys still plaintext.
-func writeSealedInstall(t *testing.T, dir string) string {
-	t.Helper()
-	path := filepath.Join(dir, "config.yaml")
-	cfg := &config.Config{
-		Path:         path,
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "AUTO",
-		GatewayKeys:  []string{"sk-gw-seed-me"},
-		Sources: []config.Source{{
-			Name: "up", BaseURL: "http://127.0.0.1:1/v1", APIKey: "sk-upstream-secret",
-			Adapter: "openai", Models: []config.Model{{ID: "gpt-4o", Priority: 10}},
-		}},
-	}
-	c, err := NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("initial install: %v", err)
-	}
-	c.Close()
-
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(raw), "enc:v1:") {
-		t.Fatalf("fixture is wrong: on-disk config holds no sealed credential, "+
-			"so this test cannot detect ciphertext leaking into consumers:\n%s", raw)
-	}
-	return path
-}
-
-// writeSealedInstallNoSeed is writeSealedInstall without gateway_keys, so no
-// key is ever seeded and no startup Save() can unseal the config as a side
-// effect. That isolation is what makes the ciphertext leak observable.
-func writeSealedInstallNoSeed(t *testing.T, dir string) string {
-	t.Helper()
-	path := filepath.Join(dir, "config.yaml")
-	cfg := &config.Config{
-		Path:         path,
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "AUTO",
-		Sources: []config.Source{{
-			Name: "up", BaseURL: "http://127.0.0.1:1/v1", APIKey: "sk-upstream-secret",
-			Adapter: "openai", Models: []config.Model{{ID: "gpt-4o", Priority: 10}},
-		}},
-	}
-	c, err := NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("initial install: %v", err)
-	}
-	c.Close()
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(raw), "enc:v1:") {
-		t.Fatalf("fixture is wrong: no sealed credential on disk:\n%s", raw)
-	}
-	return path
-}
-
-// countKeysWithSecret loads the config, unseals it, and counts keys whose
-// plaintext equals one of the gateway_keys entries.
-func countKeysWithSecret(t *testing.T, path string) (total, matching int) {
-	t.Helper()
-	cfg, err := config.Load(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	box, err := config.NewSecretBox(cfg.RuntimeFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := cfg.UnsealSecrets(box); err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]bool{}
-	for _, g := range cfg.GatewayKeys {
-		want[g] = true
-	}
-	for _, k := range cfg.Keys {
-		total++
-		if want[k.Key] {
-			matching++
-		}
-	}
-	return total, matching
-}
-
-// Restarting must not grow the key list. Before the fix this went 2 -> 3 -> 4.
-func TestRestartDoesNotDuplicateSeededKeys(t *testing.T) {
-	dir := t.TempDir()
-	path := writeSealedInstall(t, dir)
-
-	if _, n := countKeysWithSecret(t, path); n != 1 {
-		t.Fatalf("after install: %d keys carry the seeded secret, want 1", n)
-	}
-
-	for i := 2; i <= 4; i++ {
-		c, err := New(path) // production path: reads the file
-		if err != nil {
-			t.Fatalf("restart %d: %v", i, err)
-		}
-		c.Close()
-		total, n := countKeysWithSecret(t, path)
-		if n != 1 {
-			t.Fatalf("restart %d: %d keys carry the seeded secret (total %d), want "+
-				"exactly 1 — seedKeys is comparing ciphertext against plaintext and "+
-				"appending a duplicate on every start", i, n, total)
-		}
-	}
-}
-
-// Every provider must hold the real upstream credential, not its ciphertext.
-//
-// This deliberately runs with gateway_keys EMPTY. The buggy order was masked
-// whenever seedKeys had work to do, because its Save() unsealed memory as a
-// side effect — providers then happened to see plaintext. With no key to seed,
-// no Save runs, and the ciphertext reaches the registry directly. An earlier
-// version of this test kept gateway_keys populated and was insensitive: it
-// passed even with the bug present.
-func TestProvidersGetPlaintextCredentials(t *testing.T) {
-	dir := t.TempDir()
-	path := writeSealedInstallNoSeed(t, dir)
-
-	c, err := New(path)
-	if err != nil {
-		t.Fatalf("restart: %v", err)
-	}
-	defer c.Close()
-
-	for _, p := range c.registry.Providers() {
-		key := p.Config().APIKey
-		if strings.HasPrefix(key, "enc:v1:") {
-			t.Errorf("provider %q holds CIPHERTEXT api_key %q — every upstream call "+
-				"would 401", p.Name(), key)
-		}
-		if key != "sk-upstream-secret" {
-			t.Errorf("provider %q api_key = %q, want the plaintext upstream secret",
-				p.Name(), key)
-		}
-	}
-}

internal/gateway/api.go

@@ -3,7 +3,6 @@ package gateway
 import (
 	"encoding/csv"
 	"encoding/json"
-	"fmt"
 	"io"
 	"log"
 	"net/http"
@@ -79,177 +78,6 @@ type sourcePayload struct {
 	MaxTokens     int                    `json:"max_tokens"`
 	MaxConcurrent int                    `json:"max_concurrent"`
 	RPM           int                    `json:"rpm"` // optional requests-per-minute cap, 0 = unlimited
-	// ModelIDs is an additive-only shorthand: when set, the named models are
-	// merged into an existing source instead of Models replacing the list.
-	// It exists because "add one model" is the most common scripted edit and a
-	// full Models list cannot be written without reading the source first.
-	ModelIDs []string `json:"model_ids,omitempty"`
-
-	// The four fields below are POINTERS, and that is the whole point.
-	//
-	// POST/PUT is an upsert that rewrites the whole source, so any field the
-	// payload cannot express is silently reset to its zero value. That already
-	// destroyed api_key once (fixed with resolveAPIKey) and would equally
-	// destroy proxy_url, api_key_env, timeout and queue_timeout.
-	//
-	// A plain string/duration cannot distinguish "the caller did not mention
-	// this field" from "the caller asked for the empty value", and only the
-	// former may inherit. So:
-	//
-	//	nil   → field absent from the request: keep the current value
-	//	&"x"  → present: store exactly "x" (including "" to clear it)
-	//
-	// api_key deliberately keeps its older "empty means inherit" rule rather
-	// than gaining a pointer: that rule is already published (v1.7.6) and
-	// scripts depend on it. Changing it now would let a script that echoes an
-	// empty api_key erase a live credential, which is the exact failure this
-	// whole area exists to prevent.
-	ProxyURL     *string `json:"proxy_url,omitempty"`
-	APIKeyEnv    *string `json:"api_key_env,omitempty"`
-	Timeout      *string `json:"timeout,omitempty"`       // duration string, e.g. "300s"
-	QueueTimeout *string `json:"queue_timeout,omitempty"` // duration string, e.g. "90s"
-}
-
-// optionalSourceFields carries the Source fields a partial payload must not
-// reset, each as a pointer so "absent" and "explicitly empty" stay distinct.
-//
-//	nil  → absent from the request: keep the current value
-//	&""  → present: clear it
-//	&"x" → present: store "x"
-//
-// The alternative — a plain value with "empty means inherit" — cannot express
-// "clear this field", so emptying the proxy input in the UI would silently keep
-// the old proxy. It is exactly why api_key is NOT modelled this way: for a
-// credential, failing to keep the old value is worse than failing to clear it,
-// and that rule is already published (v1.7.6). Two fields with opposite failure
-// modes therefore get opposite rules, and both are spelled out here.
-type optionalSourceFields struct {
-	ProxyURL     *string
-	APIKeyEnv    *string
-	Timeout      *string
-	QueueTimeout *string
-}
-
-// resolve overlays the four optional fields onto payload.
-//
-// A nil pointer means the request did not mention the field, so it keeps the
-// value already stored in cur (nil cur = a source being created, where the
-// payload's own zero value is correct). A non-nil pointer always wins, including
-// when it points at the empty string, which is how a UI form clears a field.
-//
-// Only these four fields are overlaid. Everything else in payload is taken as
-// sent: an upsert that inherited the whole record would make it impossible to
-// change anything.
-func (o optionalSourceFields) resolve(payload config.Source, cur *config.Source) (config.Source, error) {
-	// cur is dereferenced exactly once here so the create path (nil) cannot
-	// panic on the per-field lookups below.
-	var storedProxyURL, storedKeyEnv string
-	var storedTimeout, storedQueueTimeout time.Duration
-	if cur != nil {
-		storedProxyURL, storedKeyEnv = cur.ProxyURL, cur.APIKeyEnv
-		storedTimeout, storedQueueTimeout = cur.Timeout, cur.QueueTimeout
-	}
-	pick := func(p *string, stored string) string {
-		if p != nil {
-			return *p
-		}
-		return stored
-	}
-	payload.ProxyURL = pick(o.ProxyURL, storedProxyURL)
-	payload.APIKeyEnv = pick(o.APIKeyEnv, storedKeyEnv)
-	if err := overlayDuration(&payload.Timeout, o.Timeout, "timeout", storedTimeout); err != nil {
-		return payload, err
-	}
-	if err := overlayDuration(&payload.QueueTimeout, o.QueueTimeout, "queue_timeout", storedQueueTimeout); err != nil {
-		return payload, err
-	}
-	return payload, nil
-}
-
-// overlayDuration applies the absent/present rule to one duration field: a nil
-// pointer keeps stored, a set pointer replaces it (with "" / "0s" clearing).
-func overlayDuration(dst *time.Duration, p *string, field string, stored time.Duration) error {
-	if p == nil {
-		*dst = stored
-		return nil
-	}
-	d, err := parseOptionalDuration(*p, field)
-	if err != nil {
-		return err
-	}
-	*dst = d
-	return nil
-}
-
-// parseOptionalDuration parses a duration written as a Go duration string.
-// An empty string clears the field back to the config default (0), which is
-// what a UI form submitting an empty timeout box should mean. Parsing happens
-// only for fields the request actually mentions, so a typo can never surface
-// as a silent reset of something else.
-func parseOptionalDuration(v, field string) (time.Duration, error) {
-	v = strings.TrimSpace(v)
-	if v == "" {
-		return 0, nil
-	}
-	d, err := time.ParseDuration(v)
-	if err != nil {
-		return 0, fmt.Errorf("%s %q is not a duration (use e.g. 120s, 5m, 1h)", field, v)
-	}
-	if d < 0 {
-		return 0, fmt.Errorf("%s must be >= 0 (got %s)", field, v)
-	}
-	return d, nil
-}
-
-// keepExistingAPIKey is the mask a client sends when it means "keep the
-// current credential". POST /api/sources is an upsert, so a script that edits
-// one field and echoes a placeholder back would otherwise persist that
-// placeholder as the live api_key — which fails closed as 401 on the next
-// request, long after the script exited successfully. See TestSourceUpsertKeepsAPIKey.
-const keepExistingAPIKey = "__KEEP__"
-
-// resolveAPIKey returns the credential to store, inheriting the current one
-// when the payload does not supply a new one.
-//
-// Two distinct "no new credential" signals exist and they must not collapse:
-//   - the explicit mask keepExistingAPIKey — always inherit.
-//   - the empty string — inherit only for a source that already has a
-//     credential. Empty is a legitimate value for a *new* credential-less
-//     source (dshcodebuddy uses "dsh-local-noauth", local servers use ""),
-//     so a fresh source with an empty key must stay empty rather than inherit
-//     nothing and fail differently.
-func (g *Gateway) resolveAPIKey(name, want string, exists bool) string {
-	if want == keepExistingAPIKey {
-		return g.currentAPIKey(name)
-	}
-	if exists && want == "" {
-		return g.currentAPIKey(name)
-	}
-	return want
-}
-
-func (g *Gateway) currentAPIKey(name string) string {
-	if s := g.sourceByName(name); s != nil {
-		return s.APIKey
-	}
-	return ""
-}
-
-// sourceByName returns a live view of one source, or nil when it does not
-// exist. It goes through core.Sources() so the key is already unsealed and
-// defaults applied, matching what the routes actually use.
-func (g *Gateway) sourceByName(name string) *config.Source {
-	for _, s := range g.core.Sources() {
-		if s.Name == name {
-			ss := s
-			return &ss
-		}
-	}
-	return nil
-}
-
-func (g *Gateway) sourceExists(name string) bool {
-	return g.sourceByName(name) != nil
 }
 
 func (g *Gateway) handleSourcesAPI(w http.ResponseWriter, r *http.Request) {
@@ -263,34 +91,17 @@ func (g *Gateway) handleSourcesAPI(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
 		writeJSON(w, http.StatusOK, map[string]interface{}{"sources": g.core.Sources()})
-	case http.MethodPost, http.MethodPut:
+	case http.MethodPost:
 		var p sourcePayload
 		body, _ := io.ReadAll(r.Body)
 		if err := json.Unmarshal(body, &p); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
 			return
 		}
-		// PUT addresses the source by path; the body name is only a fallback so
-		// a single-field edit does not have to echo the name back. A body that
-		// disagrees with the path is a caller bug, not something to silently
-		// resolve — it usually means the wrong source is about to be written.
-		if r.Method == http.MethodPut {
-			if path == "" {
-				writeError(w, http.StatusBadRequest, "invalid_request", "source name required in path")
-				return
-			}
-			if p.Name != "" && p.Name != path {
-				writeError(w, http.StatusBadRequest, "invalid_request",
-					"source name in body ("+p.Name+") does not match path ("+path+")")
-				return
-			}
-			p.Name = path
-		}
-		exists := g.sourceExists(p.Name)
 		src := config.Source{
 			Name:          p.Name,
 			BaseURL:       p.BaseURL,
-			APIKey:        g.resolveAPIKey(p.Name, p.APIKey, exists),
+			APIKey:        p.APIKey,
 			Adapter:       p.Adapter,
 			Endpoint:      p.Endpoint,
 			ImageEndpoint: p.ImageEndpoint,
@@ -302,44 +113,6 @@ func (g *Gateway) handleSourcesAPI(w http.ResponseWriter, r *http.Request) {
 			MaxConcurrent: p.MaxConcurrent,
 			RPM:           p.RPM,
 		}
-		// The four upsert-fragile fields are applied last: a nil pointer means
-		// "not in the request", so they are inherited from the stored source
-		// instead of being reset to the payload's zero value. This runs whether
-		// or not the request mentioned them, because resolve() itself decides
-		// per field — passing them unconditionally keeps the rule in one place.
-		src, err := optionalSourceFields{
-			ProxyURL:     p.ProxyURL,
-			APIKeyEnv:    p.APIKeyEnv,
-			Timeout:      p.Timeout,
-			QueueTimeout: p.QueueTimeout,
-		}.resolve(src, g.sourceByName(p.Name))
-		if err != nil {
-			writeError(w, http.StatusBadRequest, "source_error", err.Error())
-			return
-		}
-		// model_ids is additive: "add these models" is the common scripted edit
-		// and it must not require reading (and echoing) the whole list back.
-		// A request that omits models entirely is therefore a pure add, not a
-		// request to empty the list -- that distinction is the whole point.
-		if len(p.ModelIDs) > 0 {
-			if len(src.Models) == 0 {
-				if existing := g.sourceByName(p.Name); existing != nil {
-					src.Models = append(src.Models, existing.Models...)
-				}
-			}
-			have := map[string]bool{}
-			for _, m := range src.Models {
-				have[m.ID] = true
-			}
-			for _, id := range p.ModelIDs {
-				id = strings.TrimSpace(id)
-				if id == "" || have[id] {
-					continue
-				}
-				have[id] = true
-				src.Models = append(src.Models, config.Model{ID: id, Kind: "chat"})
-			}
-		}
 		if err := g.core.AddSource(src); err != nil {
 			writeError(w, http.StatusBadRequest, "source_error", err.Error())
 			return
@@ -433,55 +206,6 @@ func (g *Gateway) handleStatsAPI(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 	key := exportKey(r)
-	// ?period=day|week|month|all switches the whole payload to a calendar
-	// window (UTC) aggregated off the audit files, instead of the
-	// since-process-start totals. The CSV exports below are unaffected: they
-	// take an explicit from/to range and stream, so a period selector there
-	// would only be a second way to spell the same bounds.
-	if p := periodFromQuery(r.URL.Query()); p != PeriodAll {
-		if !ValidPeriod(p) {
-			writeError(w, http.StatusBadRequest, "bad_period",
-				"period must be one of day, week, month, all")
-			return
-		}
-		out := g.stats.PeriodSnapshot(p, key, time.Now())
-		// The dashboard paints its records table from this payload's `records`
-		// field (paintRecords(st.records)), so a period view that omits the key
-		// renders an empty table no matter how much traffic the window had. The
-		// aggregate above is period-scoped; the record list is the same
-		// newest-first page the scroll handler pulls from /api/stats/records,
-		// which is deliberately not period-filtered (the cursor, not a date
-		// range, is its state) — that asymmetry is what the paging code
-		// already assumes.
-		page := g.stats.AuditPage("", limit, key)
-		writeJSON(w, http.StatusOK, map[string]interface{}{
-			"period":    out.Period,
-			"from":      out.From,
-			"total":     out.Total,
-			"by_key":    out.ByKey,
-			"by_model":  out.Models,
-			"by_source": out.Srcs,
-			"by_status": out.Status,
-			"buckets":   out.Bucket,
-			"truncated": out.Truncated,
-			// "Active requests" is a live gauge (requests in flight right now),
-			// not a period aggregate. Omitting it from the period response made
-			// the KPI read `st.active || 0` → 0 on every day/week/month view while
-			// the all-time view showed the truth, which read as "the gateway is
-			// idle" precisely when it was busiest. A calendar window cannot
-			// filter it, so it travels with every response unfiltered.
-			"active":  g.stats.Active(),
-			"records": page.Records,
-			// The paging cursor has to travel with the first page, otherwise
-			// the scroll handler has nothing to page from and the table is
-			// stuck at one screen forever.
-			"next_cursor": page.Next,
-			"has_more":    page.HasMore,
-			"rotated":     page.Rotated,
-			"key_names":   g.keyNamesFor(),
-		})
-		return
-	}
 	if r.URL.Query().Get("export") == "csv" {
 		from, _ := strconv.ParseInt(r.URL.Query().Get("from"), 10, 64)
 		to, _ := strconv.ParseInt(r.URL.Query().Get("to"), 10, 64)
@@ -589,37 +313,12 @@ func (g *Gateway) handleStatsAPI(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	snap := g.stats.Snapshot(limit, key)
-	snap["key_names"] = g.keyNamesFor()
-	// Records come from the audit files via the same AuditPage the scroll
-	// handler uses, not from Snapshot's in-memory ring. Two reasons:
-	//
-	//  - Ordering. The ring is oldest-first, AuditPage is newest-first. The
-	//    first screen and the paged continuation have to agree, or scrolling
-	//    splices new rows in above old ones.
-	//  - Depth. The ring holds maxRecs entries (a few hundred); the audit
-	//    files hold everything, so "all" actually means all and the cursor
-	//    can keep paging.
-	//
-	// It also carries next_cursor, without which the table can never load a
-	// second page.
-	page := g.stats.AuditPage("", limit, key)
-	snap["records"] = page.Records
-	snap["next_cursor"] = page.Next
-	snap["has_more"] = page.HasMore
-	snap["rotated"] = page.Rotated
-	writeJSON(w, http.StatusOK, snap)
-}
-
-// keyNamesFor is the masked-id -> display-name map every stats payload needs.
-// It is keyed by keyID (the mask), not the raw key, because that is what the
-// aggregate rows carry — building it in one place stops the period branch and
-// the lifetime branch from drifting apart.
-func (g *Gateway) keyNamesFor() map[string]string {
-	names := map[string]string{}
+	keyNames := map[string]string{}
 	for _, k := range g.core.ListKeys() {
-		names[keyID(k.Key)] = k.Name
+		keyNames[keyID(k.Key)] = k.Name
 	}
-	return names
+	snap["key_names"] = keyNames
+	writeJSON(w, http.StatusOK, snap)
 }
 
 // handleStatsRecordsAPI pages the request records straight off the audit files.

internal/gateway/apiv1.go

@@ -1,474 +0,0 @@
-package gateway
-
-// Agent-facing management API.
-//
-// The Web UI has always driven the gateway through /api/*, so the management
-// surface already exists. What it lacked was anything an agent could *rely* on:
-// no way to discover the contract, no single call that answers "what is the
-// current state", and per-endpoint response shapes that make scripting brittle.
-//
-// This file adds a versioned, self-describing facade under /api/v1 without
-// touching the existing endpoints, so the Web UI keeps working unchanged while
-// agents get a stable contract:
-//
-//	GET    /api/v1                      — machine-readable index of every endpoint
-//	GET    /api/v1/overview             — one call: sources + auto chain + keys + health
-//	GET    /api/v1/sources              — sources, credentials masked
-//	GET    /api/v1/sources/{name}       — one source
-//	GET    /api/v1/auto                 — scheduling chain + live slot states
-//	GET    /api/v1/keys                 — key metadata (never the secret)
-//	GET    /api/v1/models               — every model id the gateway can route
-//	GET    /api/v1/health               — per-source health, no auth needed beyond the key
-//
-// Auth is the same gateway key as everywhere else (Authorization: Bearer, or
-// ?api_key=, or the gw_key cookie). Read endpoints accept any role; writes
-// still require admin, enforced by the same middleware the UI goes through.
-
-import (
-	"errors"
-	"net/http"
-	"net/url"
-	"sort"
-	"strings"
-
-	"llmsproxy/internal/config"
-)
-
-// apiV1Routes dispatches /api/v1/*. Kept separate from routes() so the original
-// switch stays readable and the versioned surface can grow on its own.
-func (g *Gateway) apiV1Routes(w http.ResponseWriter, r *http.Request) {
-	path := strings.TrimPrefix(r.URL.Path, "/api/v1")
-	path = strings.Trim(path, "/")
-
-	switch {
-	case path == "":
-		g.apiV1Index(w, r)
-	case path == "overview":
-		g.apiV1Overview(w, r)
-	case path == "health":
-		g.apiV1Health(w, r)
-	case path == "models":
-		g.apiV1Models(w, r)
-	case path == "sources":
-		if r.Method != http.MethodGet {
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-			return
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{"sources": maskSources(g.core.Sources())})
-	case strings.HasPrefix(path, "sources/"):
-		name, err := decodePathSegment(strings.TrimPrefix(path, "sources/"))
-		if err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-		if r.Method != http.MethodGet {
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed",
-				"use PUT/DELETE on /api/sources/{name} to modify a source")
-			return
-		}
-		for _, s := range g.core.Sources() {
-			if s.Name == name {
-				// ?reveal=credentials is admin-only and is what the Web UI's
-				// edit dialog uses: a form that round-trips a source must be
-				// able to show the current key, otherwise saving an unrelated
-				// field would blank it. Everything else stays masked.
-				if r.URL.Query().Get("reveal") == "credentials" {
-					if reqRole(r.Context()) != "admin" {
-						writeError(w, http.StatusForbidden, "forbidden",
-							"admin role required to reveal credentials")
-						return
-					}
-					// The edit form round-trips this response, so it needs the credential in the
-					// clear AND the durations — see maskSourceFields.
-					writeJSON(w, http.StatusOK, map[string]interface{}{"source": maskSourceFields(s, true, true)})
-					return
-				}
-				writeJSON(w, http.StatusOK, map[string]interface{}{"source": maskSource(s)})
-				return
-			}
-		}
-		writeError(w, http.StatusNotFound, "not_found", "no such source: "+name)
-	case path == "auto":
-		if r.Method != http.MethodGet {
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-			return
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{
-			"rules":       g.core.AutoRules(),
-			"image_rules": g.core.AutoImageRules(),
-			"states":      g.core.AutoSlotStates(),
-		})
-	case path == "keys":
-		if reqRole(r.Context()) != "admin" {
-			writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-			return
-		}
-		if r.Method != http.MethodGet {
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed",
-				"use POST/PUT/DELETE on /api/keys to manage keys")
-			return
-		}
-		keys := g.core.ListKeys()
-		out := make([]map[string]interface{}, 0, len(keys))
-		for _, k := range keys {
-			out = append(out, map[string]interface{}{
-				"name":       k.Name,
-				"role":       k.Role,
-				"models":     k.Models,
-				"note":       k.Note,
-				"created_at": k.CreatedAt,
-				"seed":       k.Seed,
-				// Quotas live on the scope entries (k.Models), echoed above;
-				// there is deliberately no key-wide total.
-				// The secret itself is never echoed. An operator that needs it
-				// already has it from creation time or from config.yaml.
-				"key_prefix": maskKey(k.Key),
-			})
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{"keys": out})
-	default:
-		g.apiV1Index(w, r)
-	}
-}
-
-// apiV1Index is the discovery document: it names every endpoint with its
-// method, auth requirement and purpose, so an agent does not have to scrape the
-// HTML to find out what it can call.
-func (g *Gateway) apiV1Index(w http.ResponseWriter, r *http.Request) {
-	type ep struct {
-		Method      string `json:"method"`
-		Path        string `json:"path"`
-		Auth        string `json:"auth"`
-		Summary     string `json:"summary"`
-		WriteEffect string `json:"writes,omitempty"`
-	}
-	index := map[string]interface{}{
-		"api_version": "v1",
-		"description": "llmsproxy management API. Authenticate with a gateway key: " +
-			"'Authorization: Bearer <key>', '?api_key=<key>', or the gw_key cookie. " +
-			"Read endpoints accept any role; mutations require an admin key.",
-		"discovery": []ep{
-			{Method: "GET", Path: "/api/v1", Auth: "any", Summary: "this document"},
-			{Method: "GET", Path: "/api/v1/overview", Auth: "any",
-				Summary: "current state in one call: sources, auto chain, key count, source health"},
-			{Method: "GET", Path: "/api/v1/health", Auth: "any",
-				Summary: "per-source health snapshot only"},
-			{Method: "GET", Path: "/api/v1/models", Auth: "any",
-				Summary: "every model id the gateway can route, grouped by owning source"},
-			{Method: "GET", Path: "/api/v1/sources", Auth: "any",
-				Summary: "all sources with credentials masked"},
-			{Method: "GET", Path: "/api/v1/sources/{name}", Auth: "any", Summary: "one source"},
-			{Method: "GET", Path: "/api/v1/auto", Auth: "any",
-				Summary: "AUTO scheduling chain and live per-slot state"},
-			{Method: "GET", Path: "/api/v1/keys", Auth: "admin",
-				Summary: "gateway key metadata; secrets are never returned"},
-
-			{Method: "GET", Path: "/api/sources", Auth: "admin", Summary: "raw source list (includes api_key)"},
-			{Method: "POST", Path: "/api/sources", Auth: "admin", Summary: "add or replace a source",
-				WriteEffect: "writes config.yaml (api_key sealed at rest)"},
-			{Method: "PUT", Path: "/api/sources/{name}", Auth: "admin", Summary: "update one source",
-				WriteEffect: "writes config.yaml (api_key sealed at rest)"},
-			{Method: "DELETE", Path: "/api/sources/{name}", Auth: "admin", Summary: "delete a source",
-				WriteEffect: "writes config.yaml"},
-
-			{Method: "GET", Path: "/api/auto", Auth: "any", Summary: "scheduling chain (readable by any role)"},
-			{Method: "PUT", Path: "/api/auto", Auth: "admin", Summary: "replace the scheduling chain",
-				WriteEffect: "writes config.yaml (the AUTO chain lives here)"},
-
-			{Method: "GET", Path: "/api/keys", Auth: "admin", Summary: "gateway keys"},
-			{Method: "POST", Path: "/api/keys", Auth: "admin", Summary: "create a gateway key",
-				WriteEffect: "writes config.yaml"},
-			{Method: "PUT", Path: "/api/keys/{key}", Auth: "admin",
-				Summary:     "update a gateway key (name, role, model scopes and their per-model quotas)",
-				WriteEffect: "writes config.yaml"},
-			{Method: "DELETE", Path: "/api/keys/{key}", Auth: "admin",
-				Summary:     "delete a gateway key — the path segment is the KEY itself, not its name",
-				WriteEffect: "writes config.yaml"},
-
-			{Method: "GET", Path: "/api/status", Auth: "any", Summary: "per-source health detail"},
-			{Method: "GET", Path: "/api/stats", Auth: "any", Summary: "usage aggregates"},
-			{Method: "GET", Path: "/api/stats/records", Auth: "any", Summary: "paged request records"},
-			{Method: "GET", Path: "/api/adapters", Auth: "admin", Summary: "installed Lua adapters"},
-			{Method: "POST", Path: "/api/sources/discover", Auth: "admin",
-				Summary: "probe a base_url+api_key for its model catalog",
-				// Probing is read-only with respect to configuration: it writes
-				// nothing, which is why it is safe to call repeatedly while the
-				// operator is still typing a key.
-				WriteEffect: "none",
-			},
-			{Method: "POST", Path: "/api/sources/discover/apply", Auth: "admin",
-				Summary: "probe and write the source in one step",
-				// Requires replace_models=true when the source already exists,
-				// so re-running discovery cannot silently discard a hand-tuned
-				// model list. An empty api_key keeps the stored credential.
-				WriteEffect: "creates or replaces a source and its model list",
-			},
-			{Method: "GET", Path: "/api/source_templates", Auth: "admin", Summary: "source templates"},
-			{Method: "POST", Path: "/v1/chat/completions", Auth: "any", Summary: "OpenAI-compatible inference"},
-		},
-		"conventions": map[string]interface{}{
-			"errors":      "{ \"error\": { \"type\": <code>, \"message\": <text> } }",
-			"path_escape": "URL-encode source and key names; {name} is a single path segment",
-			"idempotency": "POST /api/sources and PUT /api/sources/{name} both upsert by name; " +
-				"PUT takes the name from the path and rejects a body name that disagrees",
-			"partial_update": "api_key may be omitted or sent as the literal \"__KEEP__\" to inherit the " +
-				"current credential; model_ids adds models to the existing list instead of replacing it, " +
-				"so a one-field edit never needs to read the source first",
-			"optional_fields": "proxy_url, api_key_env, timeout and queue_timeout use presence semantics: " +
-				"OMITTED from the request keeps the stored value, present (even as \"\") overwrites it. " +
-				"The upsert rewrites the whole source, so without this a one-field edit would silently reset " +
-				"them — and api_key_env in particular is only visible as a credential failure on the NEXT " +
-				"upstream call. api_key deliberately keeps the older \"empty means inherit\" rule instead, " +
-				"because losing a credential breaks the source while losing a proxy only changes its route.",
-			"durations": "timeout and queue_timeout are Go duration strings (\"300s\", \"5m\", \"1h\"); " +
-				"the empty string clears them back to the config defaults",
-			"config_truth": "all configuration lives in config.yaml; API writes are persisted immediately",
-			"credentials": "credentials are masked by default. GET /api/v1/sources/{name}?reveal=credentials " +
-				"returns them in the clear and is admin-only — the Web UI edit dialog uses it, because a form " +
-				"that round-trips a source must show the current key or saving another field would blank it.",
-		},
-	}
-	writeJSON(w, http.StatusOK, index)
-}
-
-// apiV1Overview is the "what is the current state" call an agent makes first.
-// One round trip instead of five.
-func (g *Gateway) apiV1Overview(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-		return
-	}
-	sources := g.core.Sources()
-	names := make([]string, 0, len(sources))
-	modelCount := 0
-	for _, s := range sources {
-		names = append(names, s.Name)
-		modelCount += len(s.Models)
-	}
-	keys := g.core.ListKeys()
-	adminCount, userCount := 0, 0
-	for _, k := range keys {
-		if k.Role == "admin" {
-			adminCount++
-		} else {
-			userCount++
-		}
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"api_version": "v1",
-		"summary": map[string]interface{}{
-			"source_count":      len(sources),
-			"model_count":       modelCount,
-			"gateway_key_count": len(keys),
-			"admin_key_count":   adminCount,
-			"user_key_count":    userCount,
-			"auto_slots":        len(g.core.AutoRules()),
-		},
-		"sources":    maskSources(sources),
-		"auto":       g.core.AutoRules(),
-		"auto_image": g.core.AutoImageRules(),
-		"health":     g.sourceHealthBrief(),
-		"caller": map[string]interface{}{
-			"role": reqRole(r.Context()),
-			"key":  maskKey(reqKey(r.Context())),
-		},
-	})
-}
-
-func (g *Gateway) apiV1Health(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{"sources": g.sourceHealthBrief()})
-}
-
-// apiV1Models lists routable model ids per source, which is what an agent needs
-// to build a valid request — /v1/models flattens them and hides the owner.
-func (g *Gateway) apiV1Models(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-		return
-	}
-	bySource := map[string][]string{}
-	var all []string
-	for _, s := range g.core.Sources() {
-		for _, m := range s.Models {
-			bySource[s.Name] = append(bySource[s.Name], m.ID)
-			all = append(all, m.ID)
-		}
-	}
-	sort.Strings(all)
-	all = dedupeStrings(all)
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"count":     len(all),
-		"models":    all,
-		"by_source": bySource,
-		"note":      "request a model as \"<source>:<model>\" to pin one source, or the bare id to let the gateway choose",
-	})
-}
-
-// ---- helpers ----
-
-// maskSources returns sources with credentials replaced by a presence marker.
-// The UI still uses /api/sources (which returns real values, because its edit
-// form round-trips them); this is the safe view for programmatic callers.
-func maskSources(srcs []config.Source) []map[string]interface{} {
-	out := make([]map[string]interface{}, 0, len(srcs))
-	for _, s := range srcs {
-		out = append(out, maskSource(s))
-	}
-	return out
-}
-
-func maskSource(s config.Source) map[string]interface{} {
-	return maskSourceFields(s, false, false)
-}
-
-// maskSourceFields builds the API view of a source.
-//
-// revealCredentials swaps the masked api_key for the real one — admin-only, and
-// used by the WebUI edit dialog, whose form has to round-trip the whole source
-// or saving an unrelated field would blank the key.
-//
-// exposeDurations adds the two durations as strings, matching what the write
-// path accepts. It rides along with the credential reveal because both exist for
-// the same reason: config.Source tags Timeout/QueueTimeout `json:"-"`, so a
-// plain marshal of the struct omits them. A form that cannot SEE the stored
-// timeout would clear it on every save, since the timeout box is always sent.
-func maskSourceFields(s config.Source, revealCredentials, exposeDurations bool) map[string]interface{} {
-	key := maskKey(s.APIKey)
-	if revealCredentials {
-		key = s.APIKey
-	}
-	m := map[string]interface{}{
-		"name":           s.Name,
-		"base_url":       s.BaseURL,
-		"adapter":        s.Adapter,
-		"endpoint":       s.Endpoint,
-		"image_endpoint": s.ImageEndpoint,
-		"api_key":        key,
-		"api_key_set":    s.APIKey != "",
-		"models":         s.Models,
-		"headers":        maskHeaders(s.Headers),
-		"proxy_url":      s.ProxyURL,
-		"api_key_env":    s.APIKeyEnv,
-		"meta":           s.Meta,
-		"temperature":    s.Temperature,
-		"max_tokens":     s.MaxTokens,
-		"max_concurrent": s.MaxConcurrent,
-		"rpm":            s.RPM,
-	}
-	if exposeDurations {
-		m["timeout"] = s.Timeout.String()
-		m["queue_timeout"] = s.QueueTimeout.String()
-	}
-	return m
-}
-
-func maskKey(k string) string {
-	if k == "" {
-		return ""
-	}
-	if strings.HasPrefix(k, "enc:v1:") {
-		return "(sealed)"
-	}
-	if len(k) <= 10 {
-		return k[:2] + "…"
-	}
-	return k[:6] + "…" + k[len(k)-4:]
-}
-
-func maskHeaders(h map[string]string) map[string]string {
-	if h == nil {
-		return nil
-	}
-	out := make(map[string]string, len(h))
-	for k, v := range h {
-		out[k] = maskKey(v)
-	}
-	return out
-}
-
-// sourceHealthBrief reuses the same registry status the UI's /api/status shows,
-// so the agent view and the UI view cannot drift apart. Recent-traffic counters
-// come from the same stats window, because a source that is actually serving
-// traffic must never look down just because a probe was rate-limited.
-func (g *Gateway) sourceHealthBrief() []map[string]interface{} {
-	sts := g.core.Registry().Status()
-	recent := g.stats.SourceRecent(300)
-	avgs := g.stats.SourceAverages(300)
-	for i := range sts {
-		if v, ok := recent[sts[i].Name]; ok {
-			sts[i].RecentOK = v[0]
-			sts[i].RecentErr = v[1]
-		}
-		if a, ok := avgs[sts[i].Name]; ok {
-			sts[i].AvgFirstByteMs = a.AvgFirstByteMs
-			sts[i].AvgTokPerS = a.AvgTokPerS
-		}
-	}
-	out := make([]map[string]interface{}, 0, len(sts))
-	for _, s := range sts {
-		row := map[string]interface{}{
-			"name":           s.Name,
-			"adapter":        s.Adapter,
-			"healthy":        s.Healthy,
-			"available":      s.Available,
-			"live_available": s.LiveAvailable,
-			"model_count":    len(s.Models),
-		}
-		if s.LastError != "" {
-			row["last_error"] = s.LastError
-		}
-		if s.LastChecked > 0 {
-			row["last_checked"] = s.LastChecked
-		}
-		if s.RecentOK > 0 || s.RecentErr > 0 {
-			row["recent_ok"] = s.RecentOK
-			row["recent_err"] = s.RecentErr
-		}
-		if s.AvgFirstByteMs > 0 {
-			row["avg_first_byte_ms"] = s.AvgFirstByteMs
-		}
-		if s.AvgTokPerS > 0 {
-			row["avg_tok_per_s"] = s.AvgTokPerS
-		}
-		if s.FailCount > 0 {
-			row["fail_count"] = s.FailCount
-		}
-		if s.Permanent {
-			row["permanent"] = true
-		}
-		out = append(out, row)
-	}
-	return out
-}
-
-// decodePathSegment URL-decodes one path segment and rejects an empty result,
-// so a name containing a slash cannot be silently mis-resolved.
-func decodePathSegment(seg string) (string, error) {
-	s, err := url.PathUnescape(seg)
-	if err != nil {
-		return "", err
-	}
-	if s == "" {
-		return "", errEmptySegment
-	}
-	return s, nil
-}
-
-func dedupeStrings(in []string) []string {
-	out := in[:0]
-	var last string
-	for i, s := range in {
-		if i == 0 || s != last {
-			out = append(out, s)
-		}
-		last = s
-	}
-	return out
-}
-
-// errEmptySegment marks a path like /api/v1/sources/ with no name after it.
-var errEmptySegment = errors.New("empty path segment")

internal/gateway/apiv1_test.go

@@ -1,299 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// v1Gateway builds a gateway with one source and two keys, and returns the
-// secrets so a test can assert they never appear in a response.
-func v1Gateway(t *testing.T) (*Gateway, string, string) {
-	t.Helper()
-	g := newTestGateway(t, config.Source{
-		Name:    "up",
-		BaseURL: "http://up.example/v1",
-		APIKey:  "sk-up-secret",
-		Adapter: "openai",
-		Models:  []config.Model{{ID: "m1", Kind: "chat"}},
-	})
-	// The shared helper only seeds one admin key; add a user key through the
-	// core so role-gated endpoints have something to reject.
-	if _, err := g.core.CreateKey("agent", "user", nil, "test agent key"); err != nil {
-		t.Fatalf("CreateKey: %v", err)
-	}
-	rec := doReq(t, g, http.MethodGet, "/api/keys", "")
-	var doc struct {
-		Keys []config.GWKey `json:"keys"`
-	}
-	if err := json.Unmarshal(rec.Body.Bytes(), &doc); err != nil {
-		t.Fatalf("decode keys: %v", err)
-	}
-	userKey := ""
-	for _, k := range doc.Keys {
-		if k.Role == "user" {
-			userKey = k.Key
-		}
-	}
-	if userKey == "" {
-		t.Fatal("no user key was created")
-	}
-	return g, "sk-test", userKey
-}
-
-func decodeJSON(t *testing.T, body string, v interface{}) {
-	t.Helper()
-	if err := json.Unmarshal([]byte(body), v); err != nil {
-		t.Fatalf("decode %s: %v", body, err)
-	}
-}
-
-func TestAPIV1IndexIsDiscoverable(t *testing.T) {
-	g, _, _ := v1Gateway(t)
-	rec := doReq(t, g, http.MethodGet, "/api/v1", "")
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want 200: %s", rec.Code, rec.Body.String())
-	}
-	var doc struct {
-		APIVersion  string `json:"api_version"`
-		Description string `json:"description"`
-		Discovery   []struct {
-			Method  string `json:"method"`
-			Path    string `json:"path"`
-			Auth    string `json:"auth"`
-			Summary string `json:"summary"`
-		} `json:"discovery"`
-		Conventions map[string]interface{} `json:"conventions"`
-	}
-	decodeJSON(t, rec.Body.String(), &doc)
-	if doc.APIVersion != "v1" {
-		t.Errorf("api_version = %q", doc.APIVersion)
-	}
-	if doc.Description == "" {
-		t.Error("index should carry a usage description")
-	}
-	if len(doc.Discovery) == 0 {
-		t.Fatal("discovery list is empty")
-	}
-	want := map[string]bool{
-		"/api/v1/overview": false, "/api/v1/sources": false,
-		"/api/v1/auto": false, "/api/v1/models": false,
-		"/api/v1/health": false, "/api/v1/keys": false,
-		"/api/sources": false, "/api/auto": false, "/v1/chat/completions": false,
-	}
-	for _, e := range doc.Discovery {
-		if _, ok := want[e.Path]; ok {
-			want[e.Path] = true
-		}
-		if e.Method == "" || e.Path == "" || e.Auth == "" || e.Summary == "" {
-			t.Errorf("incomplete discovery entry: %+v", e)
-		}
-	}
-	for p, found := range want {
-		if !found {
-			t.Errorf("discovery is missing %s", p)
-		}
-	}
-	if doc.Conventions["errors"] == nil {
-		t.Error("conventions should document the error shape")
-	}
-}
-
-func TestAPIV1OverviewSummarisesState(t *testing.T) {
-	g, _, _ := v1Gateway(t)
-	rec := doReq(t, g, http.MethodGet, "/api/v1/overview", "")
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d: %s", rec.Code, rec.Body.String())
-	}
-	var doc struct {
-		Summary struct {
-			SourceCount     int `json:"source_count"`
-			ModelCount      int `json:"model_count"`
-			GatewayKeyCount int `json:"gateway_key_count"`
-		} `json:"summary"`
-		Sources []map[string]interface{} `json:"sources"`
-		Auto    []map[string]interface{} `json:"auto"`
-		Health  []map[string]interface{} `json:"health"`
-		Caller  struct {
-			Role string `json:"role"`
-		} `json:"caller"`
-	}
-	decodeJSON(t, rec.Body.String(), &doc)
-	if doc.Summary.SourceCount != 1 {
-		t.Errorf("source_count = %d, want 1", doc.Summary.SourceCount)
-	}
-	if doc.Summary.ModelCount != 1 {
-		t.Errorf("model_count = %d, want 1", doc.Summary.ModelCount)
-	}
-	if doc.Summary.GatewayKeyCount < 2 {
-		t.Errorf("gateway_key_count = %d, want >= 2", doc.Summary.GatewayKeyCount)
-	}
-	if len(doc.Sources) != 1 || doc.Sources[0]["name"] != "up" {
-		t.Errorf("sources = %+v", doc.Sources)
-	}
-	if doc.Caller.Role != "admin" {
-		t.Errorf("caller.role = %q, want admin", doc.Caller.Role)
-	}
-}
-
-func TestAPIV1NeverEchoesSecrets(t *testing.T) {
-	g, admin, user := v1Gateway(t)
-	for _, path := range []string{"/api/v1", "/api/v1/overview", "/api/v1/sources", "/api/v1/sources/up", "/api/v1/keys", "/api/v1/models", "/api/v1/health", "/api/v1/auto"} {
-		rec := doReq(t, g, http.MethodGet, path, "")
-		if rec.Code != http.StatusOK {
-			t.Fatalf("%s status = %d: %s", path, rec.Code, rec.Body.String())
-		}
-		if strings.Contains(rec.Body.String(), "sk-up-secret") {
-			t.Errorf("%s leaked the source api_key", path)
-		}
-		if admin != "" && strings.Contains(rec.Body.String(), admin) {
-			t.Errorf("%s leaked the admin gateway key", path)
-		}
-		if strings.Contains(rec.Body.String(), user) {
-			t.Errorf("%s leaked the user gateway key", path)
-		}
-	}
-	// Masking must still be useful: it says a key is configured.
-	rec := doReq(t, g, http.MethodGet, "/api/v1/sources/up", "")
-	if !strings.Contains(rec.Body.String(), `"api_key_set":true`) {
-		t.Error("masked source should report that a key is configured")
-	}
-}
-
-func TestAPIV1KeysRequiresAdminAndMasks(t *testing.T) {
-	g, _, user := v1Gateway(t)
-	// Authenticate as the user key by swapping the shared helper's header.
-	req := newAuthedRequest(t, http.MethodGet, "/api/v1/keys", user)
-	rec := serveViaHandler(t, g, req)
-	if rec.Code != http.StatusForbidden {
-		t.Errorf("user role on /api/v1/keys = %d, want 403: %s", rec.Code, rec.Body.String())
-	}
-}
-
-func TestAPIV1SourcesNotFound(t *testing.T) {
-	g, _, _ := v1Gateway(t)
-	rec := doReq(t, g, http.MethodGet, "/api/v1/sources/nope", "")
-	if rec.Code != http.StatusNotFound {
-		t.Errorf("status = %d, want 404: %s", rec.Code, rec.Body.String())
-	}
-}
-
-func TestAPIV1RejectsWrites(t *testing.T) {
-	g, _, _ := v1Gateway(t)
-	for _, m := range []string{http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch} {
-		rec := doReq(t, g, m, "/api/v1/sources", `{}`)
-		if rec.Code == http.StatusOK {
-			t.Errorf("%s /api/v1/sources returned 200; the v1 read facade must not mutate", m)
-		}
-	}
-	// And the source must be untouched.
-	rec := doReq(t, g, http.MethodGet, "/api/v1/sources", "")
-	if !strings.Contains(rec.Body.String(), `"name":"up"`) {
-		t.Error("the source disappeared after a rejected write")
-	}
-}
-
-func TestAPIV1ModelsGroupsBySource(t *testing.T) {
-	g, _, _ := v1Gateway(t)
-	rec := doReq(t, g, http.MethodGet, "/api/v1/models", "")
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d", rec.Code)
-	}
-	var doc struct {
-		Count    int                 `json:"count"`
-		Models   []string            `json:"models"`
-		BySource map[string][]string `json:"by_source"`
-	}
-	decodeJSON(t, rec.Body.String(), &doc)
-	if doc.Count != 1 || doc.Models[0] != "m1" {
-		t.Errorf("models = %+v", doc.Models)
-	}
-	if len(doc.BySource["up"]) != 1 || doc.BySource["up"][0] != "m1" {
-		t.Errorf("by_source = %+v", doc.BySource)
-	}
-}
-
-func TestAPIV1RequiresAuthentication(t *testing.T) {
-	g, _, _ := v1Gateway(t)
-	for _, path := range []string{"/api/v1", "/api/v1/overview", "/api/v1/sources", "/api/v1/health", "/api/v1/models"} {
-		req := newRequest(http.MethodGet, path, "")
-		rec := serveViaHandler(t, g, req)
-		if rec.Code != http.StatusUnauthorized {
-			t.Errorf("%s without a key = %d, want 401", path, rec.Code)
-		}
-	}
-}
-
-func TestMaskKeyHidesTheSecret(t *testing.T) {
-	cases := map[string]string{
-		"":                   "",
-		"ab":                 "ab…",
-		"sk-gw-abcdefghijkl": "sk-gw-…ijkl",
-		"enc:v1:AAAA":        "(sealed)",
-	}
-	for in, want := range cases {
-		if got := maskKey(in); got != want {
-			t.Errorf("maskKey(%q) = %q, want %q", in, got, want)
-		}
-	}
-	// The masked form must not reveal the middle of the secret.
-	full := maskKey("sk-gw-1234567890abcdef")
-	if strings.Contains(full, "4567890abcdef") {
-		t.Errorf("maskKey leaked the middle: %q", full)
-	}
-}
-
-// newRequest builds an unauthenticated request.
-func newRequest(method, path, body string) *http.Request {
-	req, _ := http.NewRequest(method, path, strings.NewReader(body))
-	if body != "" {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	return req
-}
-
-// newAuthedRequest builds a request carrying the given bearer key.
-func newAuthedRequest(t *testing.T, method, path, key string) *http.Request {
-	t.Helper()
-	req := newRequest(method, path, "")
-	req.Header.Set("Authorization", "Bearer "+key)
-	return req
-}
-
-// serveViaHandler pushes a request through the full handler chain (auth included).
-func serveViaHandler(t *testing.T, g *Gateway, req *http.Request) *httptest.ResponseRecorder {
-	t.Helper()
-	rec := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rec, req)
-	return rec
-}
-
-// TestAPIV1RevealRequiresAdmin: the only way to read a key in the clear is the
-// explicit admin-only reveal. Without the role check this endpoint would hand
-// every source credential to any valid (even user-scoped) key.
-func TestAPIV1RevealRequiresAdmin(t *testing.T) {
-	g, _, user := v1Gateway(t)
-	rec := serveViaHandler(t, g, newAuthedRequest(t, http.MethodGet, "/api/v1/sources/up?reveal=credentials", user))
-	if rec.Code != http.StatusForbidden {
-		t.Errorf("user reveal = %d, want 403: %s", rec.Code, rec.Body.String())
-	}
-	if strings.Contains(rec.Body.String(), "sk-up-secret") {
-		t.Error("a forbidden reveal still leaked the key")
-	}
-	rec = doReq(t, g, http.MethodGet, "/api/v1/sources/up?reveal=credentials", "")
-	if rec.Code != http.StatusOK {
-		t.Fatalf("admin reveal = %d: %s", rec.Code, rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), "sk-up-secret") {
-		t.Error("admin reveal should return the key in the clear (the edit form needs it)")
-	}
-	// The masked default view must still hide it on the same path.
-	rec = doReq(t, g, http.MethodGet, "/api/v1/sources/up", "")
-	if strings.Contains(rec.Body.String(), "sk-up-secret") {
-		t.Error("the default view leaked the key")
-	}
-}

internal/gateway/billing_rules_api.go

@@ -1,282 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-
-	"llmsproxy/internal/billing"
-	"llmsproxy/internal/config"
-)
-
-// Billing rules API.
-//
-//	GET  /api/plugins/billing/rules    the active profile's rules + all profiles
-//	PUT  /api/plugins/billing/rules    replace the whole DSL and re-inject prices
-//	POST /api/plugins/billing/rules    { profile, rule } append one rule
-//	DELETE /api/plugins/billing/rules  { profile, url } remove one rule
-//
-// Why a separate endpoint instead of the generic plugin state: prices are
-// plugin state, but they are also a durable, reviewable CONFIGURATION. Routing
-// them through /state would let an admin key PUT arbitrary plugin state and
-// silently reset the accumulated accounting. Here the server owns the shape:
-// it validates the DSL, writes it back to config.yaml, recompiles, and hands
-// the plugin its prices table. The operator edits rules; the plugin keeps
-// numbers. The two are never mixed in one payload.
-//
-// Editing means "what the operator typed is what config.yaml holds". A
-// billing mistake found next week must be traceable to a reviewable file, not
-// to a blob in the plugin's state sidecar.
-func (g *Gateway) handleBillingRules(w http.ResponseWriter, r *http.Request) {
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	switch r.Method {
-	case http.MethodGet:
-		g.getBillingRules(w)
-	case http.MethodPut:
-		g.putBillingRules(w, r)
-	case http.MethodPost:
-		g.addBillingRule(w, r)
-	case http.MethodDelete:
-		g.delBillingRule(w, r)
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET/PUT/POST/DELETE")
-	}
-}
-
-// billingRulesPayload is the UI-facing view: the profiles as declared, plus
-// which one is active and the source URLs they can match — the editor needs
-// the URL list to offer suggestions, and an operator typing a URL that matches
-// no source is exactly the silent-no-pricing failure this feature exists to
-// remove.
-type billingRulesPayload struct {
-	DSL      *config.BillingDSL `json:"billing"`
-	Active   string             `json:"active"`
-	URLs     []string           `json:"urls"`
-	Warnings []string           `json:"warnings"`
-}
-
-func (g *Gateway) billingRulesPayload() billingRulesPayload {
-	out := billingRulesPayload{}
-	cfg := g.core.Config()
-	if cfg != nil && cfg.BillingDSL != nil {
-		// Copy so the response cannot be mutated back through the pointer.
-		cp := *cfg.BillingDSL
-		out.DSL = &cp
-		if p := cp.Resolve(""); p != nil {
-			out.Active = p.ID
-		}
-	}
-	for _, s := range g.sourceURLs() {
-		out.URLs = append(out.URLs, s)
-	}
-	out.Warnings = g.billingRuleWarnings()
-	return out
-}
-
-func (g *Gateway) sourceURLs() []string {
-	cfg := g.core.Config()
-	if cfg == nil {
-		return nil
-	}
-	seen := map[string]bool{}
-	var out []string
-	for _, s := range cfg.Sources {
-		if s.BaseURL == "" || seen[s.BaseURL] {
-			continue
-		}
-		seen[s.BaseURL] = true
-		out = append(out, s.BaseURL)
-	}
-	return out
-}
-
-// billingRuleWarnings reports rules that match no configured source. This is
-// the silent killer of hand-written price tables: the rule parses, validates,
-// and prices nothing at all, so every request on that URL lands in unpriced.
-// Saying so out loud is the difference between a five-second fix and an
-// afternoon wondering why the bill is zero.
-func (g *Gateway) billingRuleWarnings() []string {
-	cfg := g.core.Config()
-	if cfg == nil || cfg.BillingDSL == nil {
-		return nil
-	}
-	urls := map[string]bool{}
-	for _, u := range g.sourceURLs() {
-		urls[u] = true
-	}
-	var warns []string
-	for _, p := range cfg.BillingDSL.Profiles {
-		for _, r := range p.Rules {
-			if r.URL == "*" || urls[r.URL] {
-				continue
-			}
-			warns = append(warns, "profile "+p.ID+": rule url "+r.URL+" matches no configured source")
-		}
-	}
-	return warns
-}
-
-func (g *Gateway) getBillingRules(w http.ResponseWriter) {
-	writeJSON(w, http.StatusOK, g.billingRulesPayload())
-}
-
-func (g *Gateway) putBillingRules(w http.ResponseWriter, r *http.Request) {
-	var body struct {
-		Billing *config.BillingDSL `json:"billing"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-		return
-	}
-	if body.Billing == nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "billing is required")
-		return
-	}
-	g.applyBillingDSLUpdate(w, body.Billing)
-}
-
-func (g *Gateway) addBillingRule(w http.ResponseWriter, r *http.Request) {
-	var body struct {
-		Profile string             `json:"profile"`
-		Rule    config.BillingRule `json:"rule"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-		return
-	}
-	cfg := g.core.Config()
-	if cfg == nil || cfg.BillingDSL == nil || len(cfg.BillingDSL.Profiles) == 0 {
-		writeError(w, http.StatusBadRequest, "no_profile", "no billing profiles configured; create one first")
-		return
-	}
-	next := cloneBillingDSL(cfg.BillingDSL)
-	idx := profileIndex(next, body.Profile)
-	if idx < 0 {
-		writeError(w, http.StatusBadRequest, "unknown_profile", "no such profile: "+body.Profile)
-		return
-	}
-	p := &next.Profiles[idx]
-	// Replace rather than append when the URL is already declared: two rules
-	// for one URL would silently make the first unreachable (first match wins),
-	// which is the exact ambiguity an editor should not be able to create.
-	replaced := false
-	for i := range p.Rules {
-		if p.Rules[i].URL == body.Rule.URL {
-			p.Rules[i] = body.Rule
-			replaced = true
-			break
-		}
-	}
-	if !replaced {
-		p.Rules = append(p.Rules, body.Rule)
-	}
-	g.applyBillingDSLUpdate(w, next)
-}
-
-func (g *Gateway) delBillingRule(w http.ResponseWriter, r *http.Request) {
-	var body struct {
-		Profile string `json:"profile"`
-		URL     string `json:"url"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-		return
-	}
-	cfg := g.core.Config()
-	if cfg == nil || cfg.BillingDSL == nil {
-		writeError(w, http.StatusBadRequest, "no_profile", "no billing profiles configured")
-		return
-	}
-	next := cloneBillingDSL(cfg.BillingDSL)
-	idx := profileIndex(next, body.Profile)
-	if idx < 0 {
-		writeError(w, http.StatusBadRequest, "unknown_profile", "no such profile: "+body.Profile)
-		return
-	}
-	p := &next.Profiles[idx]
-	out := p.Rules[:0]
-	found := false
-	for _, rule := range p.Rules {
-		if rule.URL == body.URL {
-			found = true
-			continue
-		}
-		out = append(out, rule)
-	}
-	if !found {
-		writeError(w, http.StatusNotFound, "not_found", "no rule for url "+body.URL)
-		return
-	}
-	p.Rules = out
-	g.applyBillingDSLUpdate(w, next)
-}
-
-// applyBillingDSLUpdate is the single write path: validate, persist to
-// config.yaml, recompile, inject, and only then report success. If the config
-// cannot be written the change is NOT applied in memory either — a rules editor
-// that says "saved" and loses the edit on the next restart is worse than one
-// that refuses.
-func (g *Gateway) applyBillingDSLUpdate(w http.ResponseWriter, next *config.BillingDSL) {
-	if err := next.Validate(); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_rules", err.Error())
-		return
-	}
-	cfg := g.core.Config()
-	if cfg == nil {
-		writeError(w, http.StatusInternalServerError, "no_config", "no config loaded")
-		return
-	}
-	// Assign BEFORE saving. The previous order saved first and assigned after,
-	// so every rule edit reported success while writing a config.yaml with no
-	// billing section at all — the operator's edit vanished on restart and
-	// nothing in the API response said so.
-	prev := cfg.BillingDSL
-	cfg.BillingDSL = next
-
-	// Compile before persisting: a profile that cannot be turned into prices
-	// must not reach the config file, or the next restart fails to load the
-	// very rules the editor just accepted.
-	prices, err := billing.CompileOpts(next.Resolve(next.Active), cfg.Sources, true)
-	if err != nil {
-		cfg.BillingDSL = prev // no half-applied state
-		writeError(w, http.StatusBadRequest, "compile_failed", err.Error())
-		return
-	}
-	if err := cfg.Save(); err != nil {
-		cfg.BillingDSL = prev
-		writeError(w, http.StatusInternalServerError, "persist_failed", err.Error())
-		return
-	}
-	ps := g.core.Plugins()
-	if ps != nil {
-		if err := ps.SetState("billing", map[string]interface{}{"prices": prices}); err != nil {
-			writeError(w, http.StatusBadRequest, "plugin_error", err.Error())
-			return
-		}
-	}
-	p := g.billingRulesPayload()
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"ok": true, "billing": p.DSL, "active": p.Active, "warnings": p.Warnings,
-	})
-}
-
-func cloneBillingDSL(d *config.BillingDSL) *config.BillingDSL {
-	out := &config.BillingDSL{Active: d.Active}
-	out.Profiles = make([]config.BillingProfile, len(d.Profiles))
-	copy(out.Profiles, d.Profiles)
-	return out
-}
-
-func profileIndex(d *config.BillingDSL, id string) int {
-	if id == "" {
-		return -1
-	}
-	for i, p := range d.Profiles {
-		if p.ID == id {
-			return i
-		}
-	}
-	return -1
-}

internal/gateway/billing_rules_api_test.go

@@ -1,281 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"sort"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// rulesGateway needs a real billing plugin (the API injects prices into it)
-// AND two sources whose base_urls the rules will match, so it cannot reuse
-// either existing helper: gatewayWithBilling has no sources, and
-// newTestGateway loads no plugins.
-func rulesGateway(t *testing.T) *Gateway {
-	t.Helper()
-	g := gatewayWithBilling(t)
-	cfg := g.core.Config()
-	cfg.Sources = []config.Source{
-		{Name: "localzen", BaseURL: "https://free.example.com/v1"},
-		{Name: "commandcode", BaseURL: "https://api.commandcode.ai/v1"},
-	}
-	return g
-}
-
-func rulesDo(t *testing.T, g *Gateway, method, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	return doReq(t, g, method, "/api/plugins/billing/rules", body)
-}
-
-// TestBillingRulesCRUD covers the whole editor loop against the real HTTP
-// surface: read, add, replace-by-URL, delete. The replace-by-URL case is the
-// one worth pinning — two rules for one URL would make the first unreachable
-// (first match wins) without any error, which is exactly the kind of silent
-// ambiguity an editor must not be able to create.
-func TestBillingRulesCRUD(t *testing.T) {
-	g := rulesGateway(t)
-	seed := `{"billing":{"active":"p1","profiles":[{"id":"p1","rules":[
-      {"url":"https://free.example.com/v1","mode":"free"}]}]}}`
-	if rr := rulesDo(t, g, http.MethodPut, seed); rr.Code != http.StatusOK {
-		t.Fatalf("seed rules = %d: %s", rr.Code, rr.Body.String())
-	}
-
-	// Add a token-priced rule for the second URL.
-	add := `{"profile":"p1","rule":{"url":"https://api.commandcode.ai/v1","mode":"token",
-      "models":{"deepseek-v4.1-flash":{"prompt":"0.15","completion":"0.60"}}}}`
-	if rr := rulesDo(t, g, http.MethodPost, add); rr.Code != http.StatusOK {
-		t.Fatalf("add rule = %d: %s", rr.Code, rr.Body.String())
-	}
-	var got billingRulesPayload
-	if err := json.Unmarshal(rulesDo(t, g, http.MethodGet, "").Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if len(got.DSL.Profiles[0].Rules) != 2 {
-		t.Fatalf("after add there are %d rules, want 2", len(got.DSL.Profiles[0].Rules))
-	}
-
-	// Adding the SAME url again must replace, not append.
-	if rr := rulesDo(t, g, http.MethodPost, `{"profile":"p1","rule":{"url":"https://api.commandcode.ai/v1","mode":"free"}}`); rr.Code != http.StatusOK {
-		t.Fatalf("re-add same url = %d: %s", rr.Code, rr.Body.String())
-	}
-	if err := json.Unmarshal(rulesDo(t, g, http.MethodGet, "").Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if n := len(got.DSL.Profiles[0].Rules); n != 2 {
-		t.Fatalf("★ re-adding an existing url appended instead of replacing: %d rules", n)
-	}
-	var mode string
-	for _, r := range got.DSL.Profiles[0].Rules {
-		if r.URL == "https://api.commandcode.ai/v1" {
-			mode = r.Mode
-		}
-	}
-	if mode != "free" {
-		t.Errorf("re-added rule mode = %q, want free (the replacement must win)", mode)
-	}
-
-	// Delete by URL.
-	if rr := rulesDo(t, g, http.MethodDelete, `{"profile":"p1","url":"https://api.commandcode.ai/v1"}`); rr.Code != http.StatusOK {
-		t.Fatalf("delete rule = %d: %s", rr.Code, rr.Body.String())
-	}
-	if err := json.Unmarshal(rulesDo(t, g, http.MethodGet, "").Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if len(got.DSL.Profiles[0].Rules) != 1 {
-		t.Errorf("after delete there are %d rules, want 1", len(got.DSL.Profiles[0].Rules))
-	}
-}
-
-// TestBillingRulesRejectUnknownURLWithWarning is the silent-failure guard: a
-// rule whose URL matches no source prices nothing, so every request on it
-// falls into unpriced. The API must say so instead of accepting it silently.
-func TestBillingRulesRejectUnknownURLWithWarning(t *testing.T) {
-	g := rulesGateway(t)
-	if rr := rulesDo(t, g, http.MethodPut, `{"billing":{"active":"p","profiles":[{"id":"p",
-      "rules":[{"url":"https://typo.example.com/v1","mode":"free"}]}]}}`); rr.Code != http.StatusOK {
-		t.Fatalf("seed = %d: %s", rr.Code, rr.Body.String())
-	}
-	var got billingRulesPayload
-	if err := json.Unmarshal(rulesDo(t, g, http.MethodGet, "").Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Warnings) == 0 {
-		t.Fatal("★ a rule matching no configured source was accepted with no warning — " +
-			"it will price nothing and every request will be recorded as unpriced")
-	}
-	if !strings.Contains(got.Warnings[0], "typo.example.com") {
-		t.Errorf("warning does not name the offending url: %v", got.Warnings)
-	}
-	// The editor needs the real URL list to offer suggestions.
-	if len(got.URLs) != 2 {
-		t.Errorf("urls offered to the editor = %v, want the 2 configured base_urls", got.URLs)
-	}
-}
-
-// TestBillingRulesInvalidIsRejectedNotPersisted checks the write path refuses
-// bad input and leaves the previous rules in place — an editor that clears the
-// table on a typo loses the price table.
-func TestBillingRulesInvalidIsRejectedNotPersisted(t *testing.T) {
-	g := rulesGateway(t)
-	seed := `{"billing":{"active":"p","profiles":[{"id":"p","rules":[
-      {"url":"https://free.example.com/v1","mode":"free"}]}]}}`
-	if rr := rulesDo(t, g, http.MethodPut, seed); rr.Code != http.StatusOK {
-		t.Fatalf("seed = %d: %s", rr.Code, rr.Body.String())
-	}
-	// An unknown mode must be refused.
-	if rr := rulesDo(t, g, http.MethodPost, `{"profile":"p","rule":{"url":"https://x/v1","mode":"banana"}}`); rr.Code != http.StatusBadRequest {
-		t.Errorf("invalid mode accepted with %d, want 400", rr.Code)
-	}
-	var got billingRulesPayload
-	if err := json.Unmarshal(rulesDo(t, g, http.MethodGet, "").Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if len(got.DSL.Profiles[0].Rules) != 1 {
-		t.Errorf("★ a rejected rule was persisted anyway: %d rules", len(got.DSL.Profiles[0].Rules))
-	}
-	// An unparseable price must be refused too, not silently priced at zero.
-	if rr := rulesDo(t, g, http.MethodPost, `{"profile":"p","rule":{"url":"https://y/v1","mode":"token",
-      "models":{"m":{"prompt":"free","completion":"0.6"}}}}`); rr.Code != http.StatusBadRequest {
-		t.Errorf("non-numeric price accepted with %d, want 400", rr.Code)
-	}
-}
-
-// TestBillingRulesPersistAndReachThePlugin is the point of the whole
-// endpoint, and mutation verification showed the earlier CRUD tests missed it
-// twice: dropping cfg.Save() and dropping the SetState injection both left
-// every test green. Both failures are invisible in a GET — the response echoes
-// the in-memory rules either way — so this test checks the two consequences
-// that actually matter:
-//
-//  1. persistence: the rule must be in the config file on disk, because an
-//     edit that evaporates on restart is a lie the UI told the operator;
-//  2. effect: the billing plugin must now PRICE the source (its published
-//     prices table has a non-zero entry), because a rule that is stored but
-//     never injected prices nothing at all.
-func TestBillingRulesPersistAndReachThePlugin(t *testing.T) {
-	g := rulesGateway(t)
-	cfg := g.core.Config()
-
-	seed := `{"billing":{"active":"p","profiles":[{"id":"p","rules":[
-      {"url":"https://free.example.com/v1","mode":"free"},
-      {"url":"https://api.commandcode.ai/v1","mode":"token",
-       "models":{"deepseek-v4.1-flash":{"prompt":"0.15","completion":"0.60"}}}]}]}}`
-	if rr := rulesDo(t, g, http.MethodPut, seed); rr.Code != http.StatusOK {
-		t.Fatalf("seed = %d: %s", rr.Code, rr.Body.String())
-	}
-
-	// 1. persisted to the file the process loaded from.
-	raw, err := os.ReadFile(cfg.Path)
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-	if !strings.Contains(string(raw), "commandcode.ai") {
-		t.Errorf("★ the rule is not in config.yaml on disk — an edit that does not "+
-			"survive a restart:\n%s", raw)
-	}
-	reloaded, err := config.Load(cfg.Path)
-	if err != nil {
-		t.Fatalf("reload saved config: %v", err)
-	}
-	if reloaded.BillingDSL == nil || len(reloaded.BillingDSL.Profiles) == 0 {
-		t.Fatalf("saved config has no billing DSL: %s", raw)
-	}
-	// A round-trip through YAML must not lose the price strings.
-	found := false
-	for _, r := range reloaded.BillingDSL.Profiles[0].Rules {
-		if strings.Contains(r.URL, "commandcode") {
-			found = true
-			if m, ok := r.Models["deepseek-v4.1-flash"]; !ok || m.Prompt != "0.15" {
-				t.Errorf("price did not survive the YAML round-trip: %+v", m)
-			}
-		}
-	}
-	if !found {
-		t.Errorf("the token rule is missing after reload:\n%s", raw)
-	}
-
-	// 2. reached the plugin. Prices live in a separate Lua field from `state`,
-	// and the GET /state endpoint returns the published state together with
-	// the prices sidecar — which is exactly what the plugin's own UI reads.
-	state := g.core.Plugins().State("billing")
-	if state == nil {
-		t.Fatalf("billing plugin published no state")
-	}
-	rr := doReq(t, g, http.MethodGet, "/api/plugins/billing/state", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("GET state = %d: %s", rr.Code, rr.Body.String())
-	}
-	var envelope struct {
-		Prices map[string]interface{} `json:"prices"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &envelope); err != nil {
-		t.Fatalf("decode state envelope: %v", err)
-	}
-	prices := envelope.Prices
-	if prices == nil {
-		t.Fatalf("state payload carries no prices")
-	}
-	sources, ok := prices["sources"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("prices has no sources map: %#v", prices)
-	}
-	cc, ok := sources["commandcode"]
-	if !ok {
-		t.Fatalf("★ the rule was saved but never injected: prices has %v, "+
-			"no commandcode entry. Every request on it stays unpriced.", keysOf(sources))
-	}
-	if cc == nil {
-		t.Error("commandcode price entry is nil")
-	}
-	// The free rule must price localzen, and the two must not be conflated.
-	if _, ok := sources["localzen"]; !ok {
-		t.Errorf("the free rule did not reach the plugin: %v", keysOf(sources))
-	}
-	// The injected price must be per-token, i.e. 0.15 USD/M => 1.5e-7.
-	// Asserting the exact magnitude catches a unit error (per-million vs
-	// per-token), which would be off by a factor of a million and still look
-	// like "a number".
-	models, ok := cc.(map[string]interface{})["models"].(map[string]interface{})
-	if ok {
-		if m, ok := models["deepseek-v4.1-flash"].(map[string]interface{}); ok {
-			p, _ := m["prompt"].(float64)
-			if p <= 0 || p > 1e-6 {
-				t.Errorf("injected prompt price = %v, want per-token (~1.5e-7); "+
-					"a per-million value here would over-bill by 1e6x", p)
-			}
-		}
-	}
-}
-
-func keysOf(m map[string]interface{}) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// TestBillingRulesRequireAdmin keeps price rewriting behind the admin role,
-// like every other plugin write: prices are configuration, not user data.
-func TestBillingRulesRequireAdmin(t *testing.T) {
-	g := rulesGateway(t)
-	rec, err := g.core.CreateKey("viewer", "user", nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	userKey := rec.Key
-	for _, m := range []string{http.MethodPut, http.MethodPost, http.MethodDelete} {
-		req, _ := http.NewRequest(m, "/api/plugins/billing/rules", strings.NewReader(`{}`))
-		req.Header.Set("Authorization", "Bearer "+userKey)
-		req.Header.Set("Content-Type", "application/json")
-		if rr := newRecorderFor(t, g, req); rr.Code != http.StatusForbidden {
-			t.Errorf("user %s rules = %d, want 403", m, rr.Code)
-		}
-	}
-}

internal/gateway/chat_reasoning_test.go

@@ -1,160 +0,0 @@
-package gateway
-
-import (
-	"testing"
-
-	"llmsproxy/internal/types"
-)
-
-// TestRecordChatUsageKeepsReasoningTokens pins the reasoning-token plumbing.
-//
-// The adapters already parse completion_tokens_details.reasoning_tokens and
-// forward it (qwen38, gemini, anthropic all do), and types.go has carried
-// the field since it was defined — but nothing ever READ it. The number arrived
-// in the response and was discarded at the one place that could have kept it,
-// so a pricing rule had no way to split thinking from output.
-//
-// The property that matters most: reasoning is a SUBSET of completion. Every
-// provider measured bills it at the completion rate, so a billing plugin that
-// added it to completion_tokens would double-charge every thinking token. The
-// test asserts completion is left alone.
-func TestRecordChatUsageKeepsReasoningTokens(t *testing.T) {
-	rec := &Req{}
-	resp := &types.UnifiedResponse{
-		TokenUsage: types.TokenUsage{
-			Prompt:     100,
-			Completion: 500,
-			CompletionTokensDetails: &types.CompletionTokensDetails{
-				ReasoningTokens: 320,
-			},
-		},
-	}
-	recordChatUsage(rec, &types.ChatRequest{}, resp)
-
-	if rec.Reasoning != 320 {
-		t.Errorf("Reasoning = %d, want 320", rec.Reasoning)
-	}
-	// The subset must not be folded into completion — it is already counted there.
-	if rec.Compl != 500 {
-		t.Errorf("Compl = %d, want 500 (reasoning is a subset, never additive)", rec.Compl)
-	}
-	if rec.Prompt != 100 {
-		t.Errorf("Prompt = %d, want 100", rec.Prompt)
-	}
-}
-
-// TestRecordChatUsageReasoningAbsentStaysZero: "not reported" and "reported as
-// zero" must both leave the field at 0, and neither may invent a number. A
-// plugin reading Reasoning cannot tell them apart, which is why the field is
-// documented as "0 means not reported" rather than "0 means no thinking".
-func TestRecordChatUsageReasoningAbsentStaysZero(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		u    types.TokenUsage
-	}{
-		{"no details object", types.TokenUsage{Prompt: 10, Completion: 20}},
-		{"details without reasoning", types.TokenUsage{
-			Prompt:                  10,
-			Completion:              20,
-			CompletionTokensDetails: &types.CompletionTokensDetails{},
-		}},
-	} {
-		rec := &Req{}
-		recordChatUsage(rec, &types.ChatRequest{}, &types.UnifiedResponse{TokenUsage: tc.u})
-		if rec.Reasoning != 0 {
-			t.Errorf("%s: Reasoning = %d, want 0", tc.name, rec.Reasoning)
-		}
-		if rec.Compl != 20 {
-			t.Errorf("%s: Compl = %d, want 20", tc.name, rec.Compl)
-		}
-	}
-}
-
-// TestStreamedReasoningIsRecordedOnTheRequest is the streaming counterpart.
-//
-// TestRecordChatUsageKeepsReasoningTokens covers the non-streaming path only,
-// and for a long time the streamed path dropped the number: the non-streaming
-// recorder read TokenUsage.CompletionTokensDetails, while the streaming one read
-// only Prompt and Completion from the terminal usage chunk. (Cache accounting was
-// mirrored; reasoning simply never was.)
-//
-// The symptom is invisible in the response — the client sees a correct answer
-// either way. It only shows in the audit trail, where a reasoning-heavy source's
-// streamed requests recorded completion=8166 and no reasoning at all. Found by
-// reading the production audit file, not by a failing test, which is exactly why
-// the property is pinned here.
-func TestStreamedReasoningIsRecordedOnTheRequest(t *testing.T) {
-	rec := &Req{}
-	applyStreamUsageDetails(rec, &types.TokenUsage{
-		Prompt:     159579,
-		Completion: 751,
-		Total:      160330,
-		CompletionTokensDetails: &types.CompletionTokensDetails{
-			ReasoningTokens: 512,
-		},
-	})
-	if rec.Reasoning != 512 {
-		t.Errorf("streamed Reasoning = %d, want 512 — a streamed request records no "+
-			"reasoning, so a pricing rule that splits thinking from output silently "+
-			"bills it as ordinary output", rec.Reasoning)
-	}
-}
-
-// TestStreamedReasoningIsNeverAddedToCompletion pins the SUBSET relation in the
-// streaming path specifically. A presence check would pass if someone wrote
-// rec.Compl += reasoning, and billing would then charge every thinking token
-// twice.
-func TestStreamedReasoningIsNeverAddedToCompletion(t *testing.T) {
-	rec := &Req{}
-	rec.Compl = 751 // set upstream of the call, as the streaming handler does
-	applyStreamUsageDetails(rec, &types.TokenUsage{
-		Completion:              751,
-		CompletionTokensDetails: &types.CompletionTokensDetails{ReasoningTokens: 512},
-	})
-	if rec.Compl != 751 {
-		t.Errorf("Compl = %d, want 751 unchanged — reasoning is a subset, not an addition", rec.Compl)
-	}
-	if rec.Reasoning >= rec.Compl {
-		t.Errorf("Reasoning (%d) must be a SUBSET of Compl (%d)", rec.Reasoning, rec.Compl)
-	}
-}
-
-// TestStreamedUsageWithoutReasoningLeavesItUnset: an upstream that reports no
-// reasoning must not be turned into a reported zero. In the audit trail 0 means
-// "not reported", and a plugin cannot tell that from "no reasoning happened".
-func TestStreamedUsageWithoutReasoningLeavesItUnset(t *testing.T) {
-	rec := &Req{}
-	applyStreamUsageDetails(rec, &types.TokenUsage{Prompt: 10, Completion: 4, Total: 14})
-	if rec.Reasoning != 0 {
-		t.Errorf("Reasoning = %d for an upstream that reported none", rec.Reasoning)
-	}
-}
-
-// TestStreamedCacheAccountingStillWorks is a regression guard for the block the
-// reasoning lines were added to. They share a function, so a future edit that
-// short-circuits one would break the other — silently, since a missing cache
-// number reads as "nothing was cached".
-func TestStreamedCacheAccountingStillWorks(t *testing.T) {
-	for _, c := range []struct {
-		name string
-		u    types.TokenUsage
-		hit  int64
-		miss int64
-		rep  bool
-	}{
-		{"details object", types.TokenUsage{
-			PromptTokensDetails: &types.PromptTokensDetails{CachedTokens: 4096},
-		}, 4096, 0, true},
-		{"legacy hit/miss", types.TokenUsage{
-			PromptCacheHit: 2048, PromptCacheMiss: 512,
-		}, 2048, 512, true},
-		{"nothing reported", types.TokenUsage{}, 0, 0, false},
-	} {
-		rec := &Req{}
-		applyStreamUsageDetails(rec, &c.u)
-		if rec.CacheHit != c.hit || rec.CacheMiss != c.miss || rec.CacheReported != c.rep {
-			t.Errorf("%s: hit=%d miss=%d reported=%v; want %d/%d/%v",
-				c.name, rec.CacheHit, rec.CacheMiss, rec.CacheReported, c.hit, c.miss, c.rep)
-		}
-	}
-}

internal/gateway/client_session_test.go

@@ -1,47 +0,0 @@
-package gateway
-
-import (
-	"net/http"
-	"testing"
-)
-
-// 客户端自带的会话标识必须被采纳：它比「首条 user 消息指纹」更准
-// （历史压缩后指纹会漂移），也是唯一能天然按会话隔离的来源。
-func TestClientSessionFromRequestHeaders(t *testing.T) {
-	cases := []struct {
-		name    string
-		headers map[string]string
-		bodyKey string
-		want    string
-	}{
-		{"pi 默认格式 x-session-affinity", map[string]string{"X-Session-Affinity": "ses-1"}, "", "ses-1"},
-		{"openrouter 格式 x-session-id", map[string]string{"X-Session-Id": "ses-2"}, "", "ses-2"},
-		{"openai 格式 session_id", map[string]string{"Session-Id": "ses-3"}, "", "ses-3"},
-		{"body prompt_cache_key 兜底", nil, "cache-4", "cache-4"},
-		{"头优先于 body", map[string]string{"X-Session-Affinity": "ses-5"}, "cache-x", "ses-5"},
-		{"空白不算", map[string]string{"X-Session-Affinity": "   "}, "", ""},
-		{"都没有则为空（适配器自行推导）", nil, "", ""},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			r, _ := http.NewRequest(http.MethodPost, "/v1/chat/completions", nil)
-			for k, v := range tc.headers {
-				r.Header.Set(k, v)
-			}
-			if got := clientSessionFromRequest(r, tc.bodyKey); got != tc.want {
-				t.Errorf("clientSessionFromRequest = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
-// 刻意不采纳 x-client-request-id：名字含 request，部分客户端每请求都换，
-// 拿它当会话会让上游前缀缓存永不命中。
-func TestClientRequestIDIsNotUsedAsSession(t *testing.T) {
-	r, _ := http.NewRequest(http.MethodPost, "/v1/chat/completions", nil)
-	r.Header.Set("X-Client-Request-Id", "per-request-uuid")
-	if got := clientSessionFromRequest(r, ""); got != "" {
-		t.Errorf("x-client-request-id 不应被当作会话（否则缓存永不命中），got %q", got)
-	}
-}

internal/gateway/deploy_script_test.go

@@ -1,204 +0,0 @@
-package gateway
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-// deploy.sh is the only release-critical script with no automated coverage, and
-// its newest part — prune_adapter_backups — deletes directories under
-// /etc/llmsproxy. This exercises the function in a throwaway directory with the
-// REAL backup-name shape.
-//
-// The shape matters and got this wrong twice: the guard is
-// `^adapters\.bak\.[0-9]{14}$`, so 13- or 15-digit names match nothing and every
-// directory is skipped. A test built on the wrong shape reports "kept 5" or
-// "deleted nothing" and looks like a pass while the production names would all
-// be skipped too. The names below are copied from the live directory listing.
-func TestDeployPruneAdapterBackups(t *testing.T) {
-	if _, err := os.Stat("../../deploy.sh"); err != nil {
-		t.Skip("deploy.sh not present (packaging-only checkout)")
-	}
-	if _, err := exec.LookPath("bash"); err != nil {
-		t.Skip("bash not available")
-	}
-
-	base := t.TempDir()
-	fn, err := os.ReadFile("../../deploy.sh")
-	if err != nil {
-		t.Fatalf("read deploy.sh: %v", err)
-	}
-	src := string(fn)
-	i := strings.Index(src, "prune_adapter_backups()")
-	if i < 0 {
-		t.Fatal("prune_adapter_backups not found in deploy.sh")
-	}
-	j := strings.Index(src[i:], "\n}\n")
-	if j < 0 {
-		t.Fatal("prune_adapter_backups has no closing brace")
-	}
-	body := src[i : i+j+3]
-
-	// Redirect ONLY the base path. The logic under test must stay verbatim.
-	body = strings.Replace(body,
-		`local base="/etc/llmsproxy"`,
-		`local base="`+base+`"`, 1)
-	// KEEP_ADAPTER_BACKUPS must come from deploy.sh itself, NOT from a literal
-	// here: hardcoding 5 in the shim overrode whatever the script configured, so
-	// a mutation that set KEEP_ADAPTER_BACKUPS=0 in deploy.sh still passed. The
-	// value is part of what is under test.
-	var keepRe = regexp.MustCompile(`(?m)^KEEP_ADAPTER_BACKUPS=(\d+)`)
-	keepM := keepRe.FindStringSubmatch(src)
-	if keepM == nil {
-		t.Fatal("deploy.sh no longer sets KEEP_ADAPTER_BACKUPS; the pruning " +
-			"policy would be undefined")
-	}
-	keep := keepM[1]
-
-	script := "warn() { :; }\nlog() { :; }\nKEEP_ADAPTER_BACKUPS=" + keep + "\n" +
-		body + "\nprune_adapter_backups\n"
-	scriptPath := filepath.Join(base, "fn.sh")
-	if err := os.WriteFile(scriptPath, []byte(script), 0o600); err != nil {
-		t.Fatalf("write script: %v", err)
-	}
-
-	// 12 well-formed backups. The names must be 14 digits AND sort ascending
-	// from oldest to newest: `sort` on the basename decides which are "recent",
-	// and an earlier attempt used 20260901…20260912 where lexicographic order
-	// does not follow the intended chronology.
-	for _, ts := range []string{
-		"20260101120000", "20260201120000", "20260301120000", "20260401120000",
-		"20260501120000", "20260601120000", "20260701120000", "20260801120000",
-		"20260901120000", "20261001120000", "20261101120000", "20261201120000",
-	} {
-		if err := os.MkdirAll(filepath.Join(base, "adapters.bak."+ts), 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	// Names the guard must refuse to delete: a hand-made directory, a 15-digit
-	// name, and an 11-digit one.
-	for _, name := range []string{"manual", "202609011200000", "2026090112000"} {
-		if err := os.MkdirAll(filepath.Join(base, "adapters.bak."+name), 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	if out, err := exec.Command("bash", scriptPath).CombinedOutput(); err != nil {
-		t.Fatalf("prune_adapter_backups failed: %v\n%s", err, out)
-	}
-
-	entries, err := os.ReadDir(base)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := map[string]bool{}
-	for _, e := range entries {
-		if e.IsDir() {
-			got[e.Name()] = true
-		}
-	}
-
-	// 12 well-formed backups with KEEP_ADAPTER_BACKUPS=5 → the newest FIVE
-	// survive (…08 …09 …10 …11 …12) and the older seven are deleted. Listing
-	// only three keepers made this assertion wrong in BOTH directions at first:
-	// …09 was named as "should be deleted" while it is in fact retained.
-	// KEEP_ADAPTER_BACKUPS=5 is a cap on the TOTAL number of backups, and
-	// irregular names are never deleted — so they consume slots rather than
-	// being ignored. With 3 unremovable directories present, only 2 of the
-	// well-formed ones can survive. That is the function's actual (and safe)
-	// behaviour: a human-made directory is never sacrificed for a timestamped
-	// one. Assert the real outcome rather than the KEEP value.
-	var wellFormedLeft []string
-	for _, e := range entries {
-		if strings.HasPrefix(e.Name(), "adapters.bak.") &&
-			len(strings.TrimPrefix(e.Name(), "adapters.bak.")) == 14 {
-			wellFormedLeft = append(wellFormedLeft, e.Name())
-		}
-	}
-	if len(wellFormedLeft) == 0 {
-		t.Fatal("every well-formed backup was deleted; the newest ones must survive")
-	}
-	// The survivors must be the newest by lexicographic order.
-	if want := "adapters.bak.20261201120000"; !got[want] {
-		t.Errorf("%s was deleted but it is the newest timestamp", want)
-	}
-	if got["adapters.bak.20260101120000"] {
-		t.Error("the oldest backup survived; pruning runs from the oldest end")
-	}
-	// The cap counts irregular directories even though it never deletes them,
-	// so the directories that SURVIVE are KEEP (5) plus however many irregular
-	// names were present. Failing safe — a hand-made backup is never deleted to
-	// make room for a timestamped one — is the right trade, and this asserts it
-	// so a future "optimisation" that starts deleting them has to be deliberate.
-	var irregular, regular int
-	for _, e := range entries {
-		if !strings.HasPrefix(e.Name(), "adapters.bak.") {
-			continue
-		}
-		if len(strings.TrimPrefix(e.Name(), "adapters.bak.")) == 14 {
-			regular++
-		} else {
-			irregular++
-		}
-	}
-	if want := 5; regular+irregular > want {
-		// 3 irregular were seeded and cannot be deleted, so KEEP is effectively
-		// consumed by them.
-		if regular+irregular-3 > want {
-			t.Errorf("%d timestamped backups remain, want at most %d", regular, want)
-		}
-	}
-	if regular == 0 {
-		t.Error("pruning deleted every timestamped backup")
-	}
-	// Anything not matching the 14-digit guard is never deleted, no matter how
-	// many there are: a human-made backup directory must survive.
-	for _, name := range []string{"manual", "202609011200000", "2026090112000"} {
-		if !got["adapters.bak."+name] {
-			t.Errorf("adapters.bak.%s was deleted; the guard only matches "+
-				"^adapters\\.bak\\.[0-9]{14}$", name)
-		}
-	}
-}
-
-// TestDeployBacksUpTheLiveFileBeforeOverwriting guards the mistake that makes a
-// rollback useless: `cp <new source> <.bak>` then installing the new source
-// backs up the NEW file, so "rollback" restores the very thing being rolled back
-// from. The backup must be taken from the target path.
-func TestDeployBacksUpTheLiveFileBeforeOverwriting(t *testing.T) {
-	b, err := os.ReadFile("../../deploy.sh")
-	if err != nil {
-		t.Skip("deploy.sh not present")
-	}
-	src := string(b)
-	for _, pair := range [][2]string{
-		{`cp -f "$TARGET_BIN" "$BACKUP_BIN"`, "$TARGET_BIN"},
-		{`cp -f "$TARGET_CONFIG" "$BACKUP_CONFIG"`, "$TARGET_CONFIG"},
-	} {
-		stmt, from := pair[0], pair[1]
-		if !strings.Contains(src, stmt) {
-			t.Errorf("expected the pre-install backup %q in deploy.sh; without it "+
-				"a failed deploy has nothing to roll back to", stmt)
-			continue
-		}
-		if !strings.Contains(stmt, from) {
-			t.Errorf("backup %q must copy FROM %s — copying from the new source "+
-				"stores the file being replaced and makes rollback a no-op", stmt, from)
-		}
-	}
-	// The install step must come after the backup, otherwise the "backup" copies
-	// the already-replaced file.
-	backupAt := strings.Index(src, `cp -f "$TARGET_BIN" "$BACKUP_BIN"`)
-	installAt := strings.Index(src, `mv -f "$STAGING_BIN" "$TARGET_BIN"`)
-	if backupAt < 0 || installAt < 0 {
-		t.Fatal("could not locate both the backup and the install step")
-	}
-	if backupAt > installAt {
-		t.Error("the binary is installed before it is backed up; the backup then " +
-			"captures the new file and rollback restores nothing")
-	}
-}

internal/gateway/discover.go

@@ -1,749 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"sort"
-	"strings"
-	"time"
-
-	"llmsproxy/internal/config"
-)
-
-// Model discovery: turn "here is a URL and a key" into a configured source.
-//
-// The hard part is not the GET /models call — it is guessing which URL the
-// upstream actually serves. This gateway builds request paths as
-// base_url + adapter endpoint (openai contributes "/chat/completions"), so a
-// base_url that already ends in "/v1" yields "/v1/chat/completions" while a
-// base_url of "/v1" plus our default image path yields the broken
-// "/v1/v1/images/generations". Vendors disagree on whether the version segment
-// belongs to the base or to the path, and there is no header that says which.
-//
-// So discovery does not trust the URL it is given. It tries a small, ordered
-// set of candidates, records which one answered, and reports that back as the
-// normalized base_url + adapter endpoint pair. A caller who typed the wrong
-// form gets a working source anyway, plus the correction needed to make it
-// permanent.
-//
-// What is deliberately NOT here:
-//
-//   - No guessing of model capabilities from the name. "vision" in an id does
-//     not make a model accept images, and marking an image-only endpoint as
-//     kind:"chat" makes every AUTO request fail on it. Kind stays "chat" unless
-//     the upstream's own metadata says otherwise (see discoveredModelKind).
-//   - No live probe per model. A single-token completion per model would cost
-//     real money across a 34-model catalog and takes minutes. /models is the
-//     cheap, authoritative-enough signal for "this id is served here"; whether
-//     it actually answers stays for the normal request path to discover.
-//
-// The one thing that IS verified live is reachability, because a source that
-// 404s is not worth writing to disk.
-
-const (
-	// discoveryTimeout bounds the whole probe. Vendors are routinely slow on
-	// the first request to an uncached endpoint; 20s is enough for a healthy
-	// one and short enough that the UI is not left hanging.
-	discoveryTimeout = 20 * time.Second
-
-	// discoveryModelsPath is the OpenAI-compatible listing endpoint. Nearly
-	// every vendor proxies it verbatim, including the ones whose chat path
-	// differs.
-	discoveryModelsPath = "/v1/models"
-
-	// discoveryMaxBody caps the listing response. A catalog with thousands of
-	// models is still far under this; anything larger is a captive portal or
-	// an error page, not a model list.
-	discoveryMaxBody = 8 << 20
-)
-
-// discoveredModel is one entry of a parsed /models response, kept in the
-// upstream's own terms. The upstream is the only authority on what it serves.
-type discoveredModel struct {
-	ID   string
-	Kind string // "chat" | "image"
-	Meta map[string]interface{}
-}
-
-// discoveryResult reports what a probe found, including the case where nothing
-// worked — the failure text is what the operator needs, so it must name every
-// URL that was tried rather than just the last one.
-type discoveryResult struct {
-	BaseURL  string `json:"base_url"`
-	Endpoint string `json:"endpoint"`
-	// ImageEndpoint is reported separately because the gateway composes it
-	// differently: Provider.ImageURL is BaseURL + ImageEndpoint(), and the
-	// default ImageEndpoint is the ABSOLUTE path "/v1/images/generations".
-	// Chat's default is the relative "/chat/completions". So a base_url that
-	// already ends in /v1 produces a working chat URL and a broken image URL
-	// ("/v1/v1/images/generations") — which is exactly the 404 seen on the
-	// first vela configuration, and which discovery has to correct.
-	ImageEndpoint string   `json:"image_endpoint"`
-	Adapter       string   `json:"adapter"`
-	ModelsPath    string   `json:"models_path"`
-	Models        []string `json:"models"`
-	ImageModels   []string `json:"image_models"`
-	Tried         []string `json:"tried"`
-	LatencyMS     int64    `json:"latency_ms"`
-	Note          string   `json:"note,omitempty"`
-}
-
-// MarshalJSON guarantees the two list fields are always JSON arrays, never
-// null. The WebUI concatenates them directly, and "null" renders as the string
-// "undefined" in every row — a failure that only shows up in a browser and not
-// in a JSON schema check.
-//
-// Relying on the constructor to initialize the slices is not enough: the zero
-// value of this struct is a legitimate thing for a caller to build, and a
-// future code path that forgets the initializer would ship a UI bug silently.
-func (r discoveryResult) MarshalJSON() ([]byte, error) {
-	type alias discoveryResult // avoid recursion
-	out := alias(r)
-	if out.Models == nil {
-		out.Models = []string{}
-	}
-	if out.ImageModels == nil {
-		out.ImageModels = []string{}
-	}
-	if out.Tried == nil {
-		out.Tried = []string{}
-	}
-	return json.Marshal(out)
-}
-
-// discoveryCandidate is one (base_url, models-path) guess. Order matters: the
-// first candidate is the one reported as normalized when several work, because
-// it is the one that keeps base_url free of a version segment and therefore
-// composes correctly with the adapter's chat path.
-type discoveryCandidate struct {
-	baseURL    string
-	modelsPath string
-	// prefer ranks candidates that are more likely to be the vendor's real
-	// path. A 200 from a lower-preference candidate is still accepted, but
-	// only after every higher-preference one failed — see DiscoverModels.
-	prefer int
-}
-
-// discoveryFailure carries the HTTP status the caller should answer with.
-//
-// The status is part of the error rather than left to the handler because the
-// whole point of classifying a failure is that the operator must not have to
-// guess whether the key, the endpoint, or the vendor is at fault.
-type discoveryFailure struct {
-	msg    string
-	status int
-}
-
-func (e *discoveryFailure) Error() string { return e.msg }
-
-// StatusOrDefault reports the intended HTTP status.
-func (e *discoveryFailure) StatusOrDefault() int {
-	if e.status == 0 {
-		return http.StatusBadGateway
-	}
-	return e.status
-}
-
-// discoveryCandidates enumerates the URL forms worth trying for a raw input.
-//
-// The ranking encodes a real observation rather than a guess: the amr-link
-// endpoint serves its catalog at "/v1/models" (the form an SDK example shows)
-// from a base the operator pasted WITH the "/v1", while several other vendors
-// mount it at the host root. Both are probed; the one that answers is reported
-// back as a normalized base/endpoint pair.
-//
-// What we are really deciding is the base_url to persist. The safest one keeps
-// the version segment on the ENDPOINT, because openai's adapter endpoint is
-// "/chat/completions" and the two are concatenated: base "https://h" +
-// endpoint "/v1/chat/completions" is correct, while leaving "/v1" on the base
-// doubles the default image path into "/v1/v1/images/generations" — which is
-// exactly the 404 observed on the first vela configuration attempt.
-func discoveryCandidates(raw string) []discoveryCandidate {
-	raw = strings.TrimRight(strings.TrimSpace(raw), "/")
-	if raw == "" {
-		return nil
-	}
-	// Deduplicate on the URL that will actually be requested, not on the
-	// (base, path) pair. base "https://h/v1" + path "/models" and base "https://h"
-	// + path "/v1/models" both request the same address, and listing it twice in
-	// an error message makes the operator think two things were tried.
-	seenURL := map[string]bool{}
-	seenPair := map[string]bool{}
-	var out []discoveryCandidate
-	add := func(base, path string, prefer int) {
-		pair := base + "|" + path
-		if seenPair[pair] || seenURL[base+path] {
-			return
-		}
-		seenPair[pair] = true
-		seenURL[base+path] = true
-		out = append(out, discoveryCandidate{baseURL: base, modelsPath: path, prefer: prefer})
-	}
-
-	stripped := trimVersionSuffix(raw)
-	hasVersion := stripped != raw
-
-	// Both catalog paths are always tried, whichever form the operator typed.
-	//
-	// The earlier version offered "/models" only when the base already carried a
-	// version segment. That left a bare host ("https://api.vendor.com") with a
-	// SINGLE candidate and therefore no fallback at all — so a vendor serving
-	// its catalog at the bare "/models" was reported as unreachable. Every
-	// test used a "/v1"-suffixed base and so never saw it; siliconflow's
-	// "/v1/models" happens to answer, which is why the gap survived review.
-	//
-	// Preference only decides WHICH URL is reported when several work, never
-	// which ones are attempted.
-	//
-	// Order matters: a base that already ends in a version segment must be
-	// paired with the RELATIVE "/models" first, because pairing it with
-	// "/v1/models" produces "…/v1/v1/models" — a URL that is 404 by construction.
-	// Trying it first would spend a round trip on a certain miss and, worse,
-	// make the reported "tried" list lead with nonsense.
-	if hasVersion {
-		add(raw, "/models", 0)
-		add(raw, discoveryModelsPath, 1) // the doubled form; kept only as a last resort
-		add(stripped, "/models", 2)
-		add(stripped, discoveryModelsPath, 3)
-	} else {
-		add(raw, discoveryModelsPath, 0)
-		add(raw, "/models", 1)
-	}
-
-	// Stable insertion sort by preference; add() above is not ordered.
-	for i := 1; i < len(out); i++ {
-		for j := i; j > 0 && out[j].prefer < out[j-1].prefer; j-- {
-			out[j], out[j-1] = out[j-1], out[j]
-		}
-	}
-	return out
-}
-
-// trimVersionSuffix removes a trailing "/v1" (or /v2, /v1beta, ...) so the
-// host root can be probed on its own.
-func trimVersionSuffix(base string) string {
-	i := strings.LastIndex(base, "/")
-	if i < 0 {
-		return base
-	}
-	if !isVersionSegment(base[i+1:]) {
-		return base
-	}
-	return base[:i]
-}
-
-// versionSegment returns the leading path segment of a models path when that
-// segment is a version marker ("/v1/models" → "/v1", "/models" → ""). It is the
-// piece that must move between base_url and endpoint so the two compose.
-func versionSegment(modelsPath string) string {
-	parts := strings.Split(strings.Trim(modelsPath, "/"), "/")
-	if len(parts) != 2 || !isVersionSegment(parts[0]) {
-		return ""
-	}
-	return "/" + parts[0]
-}
-
-// isVersionSegment reports whether a path segment looks like "v1", "v2",
-// "v1beta" — and not like a real path name such as "vision" or a wildcard
-// path such as "v1x".
-//
-// The rule is: a leading "v", then digits, then an OPTIONAL suffix drawn from
-// the prerelease markers vendors actually use. A free-form alphabetic tail was
-// tried and rejected — it classifies "v1x" as a version, and that is how a
-// templated path segment would get stripped off a real base URL.
-func isVersionSegment(seg string) bool {
-	if len(seg) < 2 || seg[0] != 'v' {
-		return false
-	}
-	i := 1
-	digits := 0
-	for ; i < len(seg); i++ {
-		if seg[i] < '0' || seg[i] > '9' {
-			break
-		}
-		digits++
-	}
-	if digits == 0 {
-		return false
-	}
-	suffix := strings.ToLower(seg[i:])
-	if suffix == "" {
-		return true
-	}
-	for _, marker := range []string{"alpha", "beta", "preview", "dev", "rc"} {
-		if suffix == marker || strings.HasPrefix(suffix, "-"+marker) {
-			return true
-		}
-	}
-	return false
-}
-
-// composeEndpoint derives the chat endpoint to persist, given the models path
-// that actually answered, the base_url being persisted, and the base the
-// operator typed.
-//
-// The rule is a single invariant: exactly one version segment must end up in
-// base_url + endpoint. The adapter contributes "/chat/completions" and the
-// default image path contributes "/v1/images/generations", so a version left on
-// BOTH breaks one of them — and one left on NEITHER sends chat to the wrong
-// path on vendors that require the segment.
-func composeEndpoint(modelsPath, persistedBase, typedBase string) string {
-	// The version segment currently present on the persisted base.
-	onBase := ""
-	if b := trimVersionSuffix(persistedBase); b != persistedBase {
-		onBase = persistedBase[len(b):]
-	}
-	// The version segment present in the models path that answered.
-	inPath := versionSegment(modelsPath)
-
-	// The version segment actually WORKED: prefer the models path's, then the
-	// one the operator typed.
-	version := inPath
-	if version == "" && onBase == "" {
-		if b := trimVersionSuffix(typedBase); b != typedBase && typedBase != "" {
-			version = typedBase[len(b):]
-		}
-	}
-	if version == "" {
-		return "" // adapter default already composes
-	}
-	return version + "/chat/completions"
-}
-
-// composeImageEndpoint derives the image endpoint to persist.
-//
-// Provider.ImageURL is `base_url + ImageEndpoint()`, and the built-in default
-// is the absolute path "/v1/images/generations" — unlike chat's relative
-// "/chat/completions". So the two defaults do NOT agree about who owns the
-// version segment, which is the trap this function exists to close:
-//
-//	base "https://h"     + "/v1/images/generations"  → correct
-//	base "https://h/v1"  + "/v1/images/generations"  → "/v1/v1/…" 404
-//	base "https://h/v1"  + "/images/generations"     → "/v1/images/generations"  correct
-//
-// The second row is not a theoretical guess. Measured against the real
-// amr-link endpoint with base_url "https://amr-link.open-design.ai/v1":
-//
-//	…/v1/images/generations   → 200 (the image is then generated; that call
-//	                              takes minutes, which is the upstream's own
-//	                              latency and not a routing problem)
-//	…/v1/v1/images/generations → 404
-//	…/images/generations      → 404
-//
-// Leaving the default in place when the base already ends in a version is
-// therefore always wrong for such an upstream, and the version-relative form
-// is the one that composes.
-func composeImageEndpoint(persistedBase string) string {
-	if b := trimVersionSuffix(persistedBase); b != persistedBase {
-		return "/images/generations"
-	}
-	return ""
-}
-
-// DiscoverModels probes rawURL for a model catalog. apiKey is sent as a bearer
-// token; some gateways accept an unauthenticated listing, so an empty key is
-// allowed and simply omits the header.
-//
-// It returns on the first candidate that yields a parseable catalog, so the
-// reported latency is that of the working path, not the sum of the failures.
-func DiscoverModels(ctx context.Context, rawURL, apiKey string) (*discoveryResult, error) {
-	cands := discoveryCandidates(rawURL)
-	if len(cands) == 0 {
-		return nil, fmt.Errorf("base url required")
-	}
-
-	client := &http.Client{Timeout: discoveryTimeout}
-	var tried []string
-	var firstErr string
-	var authErr string
-	typedBase := strings.TrimRight(strings.TrimSpace(rawURL), "/")
-
-	var lastErr string
-	for _, c := range cands {
-		full := c.baseURL + c.modelsPath
-		tried = append(tried, full)
-
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, full, nil)
-		if err != nil {
-			firstErr = err.Error()
-			continue
-		}
-		req.Header.Set("Accept", "application/json")
-		if apiKey != "" {
-			req.Header.Set("Authorization", "Bearer "+apiKey)
-		}
-
-		start := time.Now()
-		resp, err := client.Do(req)
-		if err != nil {
-			lastErr = classifyTransport(err)
-			if lastErr == "" {
-				lastErr = err.Error()
-			}
-			continue
-		}
-		body, readErr := io.ReadAll(io.LimitReader(resp.Body, discoveryMaxBody))
-		resp.Body.Close()
-		took := time.Since(start)
-		if readErr != nil {
-			firstErr = readErr.Error()
-			continue
-		}
-		if resp.StatusCode != http.StatusOK {
-			// An auth rejection is the operator's key being wrong, not the
-			// upstream being down. Keep it: it is the single most common
-			// failure and 502 would send them to the wrong place.
-			if af := classifyAuthStatus(resp.StatusCode, body); af != "" {
-				authErr = af
-				continue
-			}
-			firstErr = fmt.Sprintf("%s returned %d", full, resp.StatusCode)
-			continue
-		}
-
-		models, err := parseModelCatalog(body)
-		if err != nil {
-			firstErr = fmt.Sprintf("%s: %v", full, err)
-			continue
-		}
-
-		res := &discoveryResult{
-			BaseURL:     c.baseURL,
-			ModelsPath:  c.modelsPath,
-			Adapter:     "openai",
-			Models:      []string{},
-			ImageModels: []string{},
-			Tried:       append([]string{}, tried...),
-			LatencyMS:   took.Milliseconds(),
-		}
-		// Persist a base/endpoint pair that composes correctly. The adapter's
-		// own endpoint is "/chat/completions", so any version segment has to be
-		// carried on the endpoint rather than left on the base (where it doubles
-		// the default image path into "/v1/v1/images/generations" — the exact
-		// 404 seen on the first vela configuration attempt).
-		res.Endpoint = composeEndpoint(c.modelsPath, c.baseURL, typedBase)
-		res.ImageEndpoint = composeImageEndpoint(c.baseURL)
-
-		// If the operator typed a version segment and we are persisting a base
-		// that no longer has it, the endpoint above is what restores it. If the
-		// base kept the segment, the adapter default is already correct.
-
-		seen := map[string]bool{}
-		for _, m := range models {
-			if m.ID == "" || seen[m.ID] {
-				continue
-			}
-			seen[m.ID] = true
-			if m.Kind == "image" {
-				res.ImageModels = append(res.ImageModels, m.ID)
-			} else {
-				res.Models = append(res.Models, m.ID)
-			}
-		}
-		sort.Strings(res.Models)
-		sort.Strings(res.ImageModels)
-		if len(res.Models) == 0 && len(res.ImageModels) == 0 {
-			firstErr = fmt.Sprintf("%s: catalog contained no usable model ids", full)
-			continue
-		}
-		if c.baseURL != typedBase {
-			res.Note = fmt.Sprintf("base url normalized from %s to %s; endpoint set to %q so it composes with the adapter",
-				typedBase, c.baseURL, res.Endpoint)
-		}
-		return res, nil
-	}
-	return nil, buildDiscoveryError(tried, authErr, firstErr, lastErr)
-}
-
-// classifyAuthStatus turns a 401/403 from the catalog endpoint into a message
-// that names the credential as the cause.
-//
-// This distinction is the whole point: a wrong key and an unreachable vendor
-// are the two most common discovery failures, and they need opposite actions
-// (re-type the key vs. go check the vendor). Reporting both as "upstream
-// error" makes the operator guess.
-func classifyAuthStatus(status int, body []byte) string {
-	if status != http.StatusUnauthorized && status != http.StatusForbidden {
-		return ""
-	}
-	snippet := strings.TrimSpace(string(body))
-	// Vendors put the reason in wildly different shapes; a compact quote is
-	// more useful than a parse attempt that fails on most of them.
-	snippet = strings.Join(strings.Fields(snippet), " ")
-	if len(snippet) > 200 {
-		snippet = snippet[:200] + "…"
-	}
-	return fmt.Sprintf("upstream rejected the api key (HTTP %d): %s — "+
-		"check the key, not the endpoint", status, snippet)
-}
-
-// classifyTransport turns low-level network failures into something an
-// operator can act on. An empty result means "no specific advice", and the
-// caller keeps the raw error.
-func classifyTransport(err error) string {
-	if err == nil {
-		return ""
-	}
-	msg := err.Error()
-	lower := strings.ToLower(msg)
-	switch {
-	case strings.Contains(lower, "no such host"):
-		return "hostname does not resolve: " + msg
-	case strings.Contains(lower, "certificate"), strings.Contains(lower, "tls"):
-		return "TLS verification failed: " + msg
-	case strings.Contains(lower, "connection refused"):
-		return "connection refused: " + msg
-	}
-	return ""
-}
-
-// buildDiscoveryError assembles the final error, preferring the most specific
-// diagnosis available. Every URL tried is listed: an operator staring at a
-// failed probe needs to know the search actually happened, not just the last
-// attempt.
-func buildDiscoveryError(tried []string, authErr, firstErr, lastErr string) error {
-	triedPart := "no model catalog found"
-	if len(tried) > 0 {
-		triedPart = "no model catalog found; tried " + strings.Join(tried, ", ")
-	}
-	if authErr != "" {
-		return &discoveryFailure{status: http.StatusUnauthorized, msg: authErr + " (" + triedPart + ")"}
-	}
-	detail := firstErr
-	if detail == "" {
-		detail = lastErr
-	}
-	if detail == "" {
-		return errors.New(triedPart)
-	}
-	if lastErr != "" && lastErr != firstErr {
-		detail += " (last: " + lastErr + ")"
-	}
-	return &discoveryFailure{status: http.StatusBadGateway, msg: triedPart + "; " + detail}
-}
-
-// upstreamModel is the subset of a /models entry this code reads. Vendors add
-// fields freely and rename the nesting; only id is universal, and the modality
-// hints below are read opportunistically.
-type modelCaps struct {
-	ImageGeneration bool `json:"image_generation"`
-	Vision          bool `json:"vision"`
-}
-
-type upstreamModel struct {
-	ID       string `json:"id"`
-	Object   string `json:"object"`
-	Kind     string `json:"kind"`
-	Type     string `json:"type"`
-	Modality string `json:"modality"`
-	Architecture struct {
-		InputModalities  []string `json:"input_modalities"`
-		OutputModalities []string `json:"output_modalities"`
-	} `json:"architecture"`
-	Capabilities modelCaps `json:"capabilities"`
-
-	// Metadata is kept as raw JSON on purpose. The real amr-link catalog nests
-	// cost/capability/context_limit here, and a typed struct would silently
-	// discard every key this build does not know about — the operator would
-	// then lose the context limit their vendor published. Raw also lets
-	// input_modalities/output_modalities be read without a second type.
-	Metadata json.RawMessage `json:"metadata"`
-}
-
-// metadataFields lists the keys worth surfacing in the UI. They are copied
-// through verbatim and nothing is inferred from them; an upstream that sends
-// no context limit must leave that absent rather than have this code write 0.
-var metadataFields = []string{
-	"context_length", "context_window", "max_context_length",
-	"context_limit", "context_budget", "cost", "capability",
-}
-
-// parseModelCatalog reads the OpenAI list shape {"data":[...]} and the bare
-// array shape some gateways return. A response that is valid JSON but has
-// neither shape is an error, not an empty catalog: reporting "0 models" for a
-// login page or a rate-limit JSON would silently create an empty source.
-func parseModelCatalog(body []byte) ([]discoveredModel, error) {
-	// "null" unmarshals into a nil slice without error, and an HTML login page
-	// fails to unmarshal at all. Both must be errors.
-	trimmed := strings.TrimSpace(string(body))
-	if trimmed == "" || trimmed == "null" {
-		return nil, fmt.Errorf("empty response")
-	}
-
-	var wrapper struct {
-		Data   []upstreamModel `json:"data"`
-		Models []upstreamModel `json:"models"`
-	}
-	if err := json.Unmarshal(body, &wrapper); err == nil {
-		if len(wrapper.Data) > 0 {
-			return toDiscovered(wrapper.Data), nil
-		}
-		if len(wrapper.Models) > 0 {
-			return toDiscovered(wrapper.Models), nil
-		}
-		// A well-formed but empty catalog is a legitimate answer from a key
-		// that has no models provisioned. Distinguish it from "not a catalog"
-		// by checking the shape actually parsed.
-		var probe map[string]json.RawMessage
-		if json.Unmarshal(body, &probe) == nil {
-			if _, ok := probe["data"]; ok {
-				return nil, nil
-			}
-			if _, ok := probe["models"]; ok {
-				return nil, nil
-			}
-		}
-	}
-	var bare []upstreamModel
-	if err := json.Unmarshal(body, &bare); err == nil {
-		return toDiscovered(bare), nil
-	}
-	return nil, fmt.Errorf("response is not a model catalog")
-}
-
-func toDiscovered(in []upstreamModel) []discoveredModel {
-	out := make([]discoveredModel, 0, len(in))
-	for _, m := range in {
-		out = append(out, discoveredModel{
-			ID:   m.ID,
-			Kind: discoveredModelKind(m),
-			Meta: modelMeta(m),
-		})
-	}
-	return out
-}
-
-// discoveredModelKind trusts the upstream's own modality fields and nothing
-// else. It never infers from the model NAME: ids like "gpt-image-1" or
-// "ideogram-v2" appear on catalogs that also serve chat, and a wrong kind
-// poisons the AUTO chain (an image-only id selected for a chat request fails
-// every tier behind it).
-func discoveredModelKind(m upstreamModel) string {
-	modIn := append(append([]string{}, m.Architecture.InputModalities...),
-		modalityList(m.Metadata, "input_modalities")...)
-	modOut := append(append([]string{}, m.Architecture.OutputModalities...),
-		modalityList(m.Metadata, "output_modalities")...)
-
-	has := func(list []string, want string) bool {
-		for _, v := range list {
-			if strings.EqualFold(strings.TrimSpace(v), want) {
-				return true
-			}
-		}
-		return false
-	}
-	if m.Capabilities.ImageGeneration || has(modOut, "image") {
-		return "image"
-	}
-	if has(modIn, "image") || has(modIn, "file") || has(modIn, "audio") || m.Capabilities.Vision {
-		return "chat" // multimodal input still means a chat model
-	}
-	// Some catalogs encode modality as a top-level string instead of a list.
-	// Only the image-ish spellings count: "chat" here means the upstream said
-	// chat, and treating that as "unknown" would ignore its statement.
-	switch strings.ToLower(strings.TrimSpace(m.Kind + " " + m.Modality + " " + m.Type)) {
-	case "image", "text-to-image", "image_generation", "text_to_image":
-		return "image"
-	}
-	return "chat"
-}
-
-// modalityList reads one array-of-strings field out of a raw JSON object,
-// tolerating both absence and a non-array value.
-func modalityList(raw json.RawMessage, field string) []string {
-	if len(raw) == 0 {
-		return nil
-	}
-	var obj map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &obj); err != nil {
-		return nil
-	}
-	v, ok := obj[field]
-	if !ok {
-		return nil
-	}
-	var out []string
-	if err := json.Unmarshal(v, &out); err != nil {
-		return nil
-	}
-	return out
-}
-
-// modelMeta carries through the fields an operator wants to see in the UI
-// without this code inventing them. The upstream nests most of them under
-// "metadata" (the real amr-link catalog does) while some put the same keys at
-// the top level, so both are read and top level wins on a tie. Only keys the
-// upstream actually sent are copied, so an absent context limit stays absent
-// instead of becoming 0.
-func modelMeta(m upstreamModel) map[string]interface{} {
-	meta := map[string]interface{}{}
-
-	copyFields := func(raw json.RawMessage) {
-		if len(raw) == 0 {
-			return
-		}
-		var obj map[string]json.RawMessage
-		if err := json.Unmarshal(raw, &obj); err != nil {
-			return
-		}
-		for _, k := range metadataFields {
-			if v, ok := obj[k]; ok {
-				if dec := rawOrString(v); dec != nil {
-					meta[k] = dec
-				}
-			}
-		}
-	}
-
-	copyFields(m.Metadata)      // nested first
-	copyFields(mustJSON(m))     // top level wins
-	if len(meta) == 0 {
-		return nil
-	}
-	return meta
-}
-
-// rawOrString keeps numeric metadata as a number and everything else as its
-// decoded string, so the UI can sort on a cost or context length instead of
-// receiving "1048000" and having to coerce it.
-func rawOrString(raw json.RawMessage) interface{} {
-	var num json.Number
-	if err := json.Unmarshal(raw, &num); err == nil {
-		if f, err := num.Float64(); err == nil {
-			return f
-		}
-	}
-	var s string
-	if err := json.Unmarshal(raw, &s); err == nil {
-		return s
-	}
-	var any interface{}
-	if err := json.Unmarshal(raw, &any); err == nil {
-		return any
-	}
-	return nil
-}
-
-func mustJSON(v interface{}) []byte {
-	b, _ := json.Marshal(v)
-	return b
-}
-
-// modelsToConfig converts discovery output into config.Model entries, applying
-// the same priority convention the UI uses: chat models the operator is
-// likely to want first get a lower number, and image models sort last because
-// they are unreachable from /v1/chat/completions.
-func modelsToConfig(chat, image []string) []config.Model {
-	out := make([]config.Model, 0, len(chat)+len(image))
-	for _, id := range chat {
-		out = append(out, config.Model{ID: id, Priority: 50, Kind: "chat"})
-	}
-	for _, id := range image {
-		out = append(out, config.Model{ID: id, Priority: 70, Kind: "image"})
-	}
-	return out
-}

internal/gateway/discover_api.go

@@ -1,403 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"llmsproxy/internal/config"
-	"net/http"
-	"strings"
-	"time"
-)
-
-// HTTP surface for model discovery.
-//
-// Two endpoints, deliberately separate:
-//
-//	POST /api/sources/discover        — probe a URL+key, return the catalog.
-//	                                   Nothing is written.
-//	POST /api/sources/discover/apply  — probe, then write the source.
-//
-// The split exists because discovery mutates nothing and is therefore safe to
-// call repeatedly while the operator is still typing a key, whereas apply
-// rewrites credentials and the AUTO chain's inputs. Making them one endpoint
-// with a flag would mean a "just check it" click can silently create a source.
-//
-// Both are admin-only, matching /api/sources: the request body carries an API
-// key, and a model catalog reveals which upstreams an operator uses.
-
-// discoverRequest is the body of both endpoints.
-type discoverRequest struct {
-	// BaseURL is what the operator pasted. It may or may not include a
-	// version segment; discovery works that out rather than making the
-	// caller know this gateway's path-composition rules.
-	BaseURL string `json:"base_url"`
-	APIKey  string `json:"api_key"`
-
-	// Name is required for apply, ignored for discover. It defaults from the
-	// base URL's host when omitted, because "https://api.vendor.com/v1" is a
-	// better starting name than "new-source".
-	Name string `json:"name"`
-
-	// Adapter is optional. Discovery assumes "openai" because that is what a
-	// /v1/models catalog implies; a non-OpenAI upstream (Anthropic, Gemini)
-	// has no such endpoint, so discovery will legitimately fail for those and
-	// the operator configures them by hand.
-	Adapter string `json:"adapter"`
-
-	// Temperature and MaxConcurrent are carried into the written source.
-	Temperature   float64 `json:"temperature"`
-	MaxConcurrent int     `json:"max_concurrent"`
-
-	// ReplaceModels drops the source's existing model list before applying the
-	// discovered one. It defaults to true for a NEW source and is required to
-	// be spelled out for an existing one, so a re-discovery cannot silently
-	// delete hand-tuned priorities.
-	ReplaceModels *bool `json:"replace_models,omitempty"`
-
-	// Select narrows what gets written. Empty means everything discovered.
-	// Ids that are not in the catalog are an error rather than a silent skip:
-	// a typo here would produce a source that 404s on every request.
-	Include []string `json:"include,omitempty"`
-	Exclude []string `json:"exclude,omitempty"`
-}
-
-// discoverResponse is the JSON the WebUI binds to.
-type discoverResponse struct {
-	OK bool `json:"ok"`
-
-	// Normalized source fields, ready to be echoed back to /api/sources.
-	BaseURL     string   `json:"base_url"`
-	Adapter     string   `json:"adapter"`
-	Models      []string `json:"models"`
-	ImageModels []string `json:"image_models"`
-
-	// Endpoint is set only when discovery had to move a version segment.
-	Endpoint string `json:"endpoint"`
-	// ImageEndpoint is required whenever base_url carries a version segment:
-	// the gateway's default image path is the ABSOLUTE "/v1/images/generations"
-	// while chat's default is the relative "/chat/completions", so the same
-	// base_url that yields a working chat URL yields a 404 image URL.
-	ImageEndpoint string `json:"image_endpoint"`
-
-	// Diagnostics for the operator.
-	ModelsPath string   `json:"models_path"`
-	Tried      []string `json:"tried"`
-	LatencyMS  int64    `json:"latency_ms"`
-	Note       string   `json:"note,omitempty"`
-	Warnings   []string `json:"warnings,omitempty"`
-
-	// Set by apply only.
-	SourceName string `json:"source_name,omitempty"`
-	Applied    bool   `json:"applied,omitempty"`
-}
-
-func (g *Gateway) handleSourceDiscoverAPI(w http.ResponseWriter, r *http.Request) {
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	apply := strings.HasSuffix(r.URL.Path, "/apply")
-	if r.Method != http.MethodPost {
-		w.Header().Set("Allow", "POST")
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed",
-			"use POST with {\"base_url\":…,\"api_key\":…}")
-		return
-	}
-
-	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "cannot read body")
-		return
-	}
-	var req discoverRequest
-	if err := json.Unmarshal(body, &req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-		return
-	}
-	req.BaseURL = strings.TrimSpace(req.BaseURL)
-	if req.BaseURL == "" {
-		writeError(w, http.StatusBadRequest, "invalid_request", "base_url required")
-		return
-	}
-	if req.Adapter == "" {
-		req.Adapter = "openai"
-	}
-
-	// Bounded so a hung upstream cannot pin the handler; discovery has its own
-	// per-request timeout on top.
-	ctx, cancel := context.WithTimeout(r.Context(), 60*time.Second)
-	defer cancel()
-
-	res, err := DiscoverModels(ctx, req.BaseURL, req.APIKey)
-	if err != nil {
-		// A rejected key must not be reported as an upstream outage: the two
-		// need opposite actions from the operator, and 502 sends them to the
-		// wrong one.
-		status := http.StatusBadGateway
-		var f *discoveryFailure
-		if errors.As(err, &f) {
-			status = f.StatusOrDefault()
-		}
-		writeError(w, status, "discover_failed", err.Error())
-		return
-	}
-
-	chat, image, warns, err := selectModels(res.Models, res.ImageModels, req.Include, req.Exclude)
-	if err != nil {
-		// 400: the operator asked for a model the catalog does not have.
-		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-		return
-	}
-
-	out := &discoverResponse{
-		OK:            true,
-		BaseURL:       res.BaseURL,
-		Adapter:       req.Adapter,
-		Models:        chat,
-		ImageModels:   image,
-		Endpoint:      res.Endpoint,
-		ImageEndpoint: res.ImageEndpoint,
-		ModelsPath:    res.ModelsPath,
-		Tried:         res.Tried,
-		LatencyMS:     res.LatencyMS,
-		Note:          res.Note,
-		Warnings:      warns,
-	}
-	if len(chat) == 0 && len(image) == 0 {
-		out.Warnings = append(out.Warnings,
-			"every discovered model was excluded; applying this would create a source with no models")
-	}
-
-	if !apply {
-		writeJSON(w, http.StatusOK, out)
-		return
-	}
-
-	name := strings.TrimSpace(req.Name)
-	if name == "" {
-		name = defaultSourceName(req.BaseURL)
-	}
-	if name == "" {
-		writeError(w, http.StatusBadRequest, "invalid_request",
-			"name required: cannot derive one from base_url")
-		return
-	}
-	if strings.ContainsAny(name, "/\\ \t") || name == "." || name == ".." {
-		writeError(w, http.StatusBadRequest, "invalid_request",
-			"source name must not contain slashes or whitespace")
-		return
-	}
-
-	exists := g.sourceExists(name)
-	if exists && req.ReplaceModels == nil {
-		// Refusing here is deliberate. Re-running discovery on an existing
-		// source and having it silently replace a hand-tuned model list —
-		// including priorities chosen for the AUTO chain — is the kind of
-		// "helpful" behaviour that loses an afternoon.
-		writeError(w, http.StatusConflict, "conflict",
-			"source "+name+" already exists; set replace_models=true to overwrite its model list, "+
-				"or choose a different name")
-		return
-	}
-
-	// Build the source directly rather than round-tripping through the
-	// /api/sources payload: resolveAPIKey carries the "an empty api_key means
-	// keep the stored one" rule, and going through a second decoder here would
-	// duplicate (and eventually diverge from) that logic.
-	src := config.Source{
-		Name:          name,
-		BaseURL:       res.BaseURL,
-		APIKey:        g.resolveAPIKey(name, req.APIKey, exists),
-		Adapter:       req.Adapter,
-		Endpoint:      res.Endpoint,
-		ImageEndpoint: res.ImageEndpoint,
-		Models:        modelsToConfig(chat, image),
-		Temperature:   req.Temperature,
-	}
-	if req.MaxConcurrent > 0 {
-		src.MaxConcurrent = req.MaxConcurrent
-	}
-
-	// An existing source may carry fields discovery does not know about
-	// (proxy_url, headers, api_key_env, timeout). Rebuilding from scratch would
-	// drop them, so they are inherited unless the request overrides them.
-	if exists {
-		old := g.sourceByName(name)
-		if old != nil {
-			src.ProxyURL = old.ProxyURL
-			src.APIKeyEnv = old.APIKeyEnv
-			src.Timeout = old.Timeout
-			src.QueueTimeout = old.QueueTimeout
-			src.Headers = old.Headers
-			src.Meta = old.Meta
-			src.MaxTokens = old.MaxTokens
-			src.RPM = old.RPM
-			// image_endpoint is NOT inherited when discovery supplied one:
-			// the stored value was correct for the OLD base_url, and the base
-			// is exactly what may have changed. Inheriting it would keep a
-			// stale value that 404s against the new base.
-			if res.ImageEndpoint == "" {
-				src.ImageEndpoint = old.ImageEndpoint
-			}
-			if src.Adapter == "" {
-				src.Adapter = old.Adapter
-			}
-			if req.MaxConcurrent <= 0 {
-				src.MaxConcurrent = old.MaxConcurrent
-			}
-			// replace_models=false keeps the curated list. Discovery still
-			// refreshed base_url/endpoint/credential, which is the point of
-			// re-running it.
-			if req.ReplaceModels != nil && !*req.ReplaceModels {
-				src.Models = old.Models
-				out.Warnings = append(out.Warnings,
-					"model list left unchanged (replace_models=false)")
-			}
-		}
-	}
-
-	if err := g.core.AddSource(src); err != nil {
-		writeError(w, http.StatusBadRequest, "source_error", err.Error())
-		return
-	}
-
-	out.SourceName = name
-	out.Applied = true
-	writeJSON(w, http.StatusOK, out)
-}
-
-// selectModels applies the include/exclude filters.
-//
-// An include entry the catalog does not have is an error: silently dropping it
-// produces a source that looks configured and 404s at request time, which is
-// far harder to diagnose than a rejected apply. An exclude entry that is not
-// present is fine — the operator is allowed to be defensive.
-func selectModels(chat, image, include, exclude []string) ([]string, []string, []string, error) {
-	have := map[string]bool{}
-	for _, m := range chat {
-		have[m] = true
-	}
-	for _, m := range image {
-		have[m] = true
-	}
-
-	if len(include) > 0 {
-		var missing []string
-		for _, want := range include {
-			if !have[want] {
-				missing = append(missing, want)
-			}
-		}
-		if len(missing) > 0 {
-			return nil, nil, nil, &discoverError{
-				msg: "these models are not in the upstream catalog: " + strings.Join(missing, ", "),
-			}
-		}
-		keep := map[string]bool{}
-		for _, want := range include {
-			keep[want] = true
-		}
-		var c, i []string
-		for _, m := range chat {
-			if keep[m] {
-				c = append(c, m)
-			}
-		}
-		for _, m := range image {
-			if keep[m] {
-				i = append(i, m)
-			}
-		}
-		chat, image = c, i
-	}
-
-	if len(exclude) > 0 {
-		drop := map[string]bool{}
-		for _, m := range exclude {
-			drop[m] = true
-		}
-		var c, i []string
-		for _, m := range chat {
-			if !drop[m] {
-				c = append(c, m)
-			}
-		}
-		for _, m := range image {
-			if !drop[m] {
-				i = append(i, m)
-			}
-		}
-		chat, image = c, i
-	}
-
-	// chat and image must stay non-nil: the JSON contract forbids null here.
-	if chat == nil {
-		chat = []string{}
-	}
-	if image == nil {
-		image = []string{}
-	}
-
-	var warns []string
-	if len(chat) == 0 && len(image) == 0 {
-		// Caller can only get here by excluding everything, or from a catalog
-		// that was already empty. Either way "silence" would read as success.
-		warns = append(warns,
-			"no models selected; applying this would create a source that cannot serve any request")
-		return chat, image, warns, nil
-	}
-	if len(image) > 0 && len(chat) == 0 {
-		warns = append(warns,
-			"every model is an image model; AUTO chat requests have nothing to select")
-	}
-	if len(chat) > 0 && len(image) > 0 {
-		warns = append(warns,
-			"image models are only reachable through /v1/images/generations, not AUTO chat")
-	}
-	return chat, image, warns, nil
-}
-
-// discoverError is a client mistake rather than an upstream failure, which is
-// why it gets its own type instead of fmt.Errorf.
-type discoverError struct{ msg string }
-
-func (e *discoverError) Error() string { return e.msg }
-
-// defaultSourceName derives a source name from a base URL host, stripping the
-// version segment and any "api." prefix. It returns "" for input that is not a
-// URL at all — the caller must not fall back to echoing garbage into a source
-// name, since the name becomes a config key and an API path segment.
-func defaultSourceName(baseURL string) string {
-	s := strings.TrimSpace(baseURL)
-	if !strings.Contains(s, "://") {
-		return ""
-	}
-	s = s[strings.Index(s, "://")+3:]
-	if i := strings.IndexAny(s, "/?#"); i >= 0 {
-		s = s[:i]
-	}
-	if i := strings.LastIndex(s, ":"); i > 0 && !strings.Contains(s[i+1:], "]") {
-		s = s[:i] // strip port
-	}
-	// A host must still look like one after trimming the cosmetic prefixes.
-	s = strings.TrimPrefix(s, "api.")
-	s = strings.TrimPrefix(s, "www.")
-	if s == "" || strings.ContainsAny(s, " \t\"'<>") {
-		return ""
-	}
-	for _, r := range s {
-		switch {
-		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
-		case r == '.' || r == '-' || r == '_':
-		default:
-			return ""
-		}
-	}
-	if !strings.Contains(s, ".") {
-		// A bare label is far more likely to be a mistake than a hostname.
-		return ""
-	}
-	return s
-}

internal/gateway/discover_api_test.go

@@ -1,314 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// upstream that answers /v1/models with the real captured catalog
-func catalogUpstream(t *testing.T) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/v1/models" {
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		if got := r.Header.Get("Authorization"); got != "Bearer sk-secret" {
-			w.WriteHeader(http.StatusUnauthorized)
-			return
-		}
-		_, _ = w.Write([]byte(realCatalogBody))
-	}))
-	t.Cleanup(srv.Close)
-	return srv
-}
-
-func TestDefaultSourceName(t *testing.T) {
-	cases := map[string]string{
-		"https://api.vendor.com/v1":          "vendor.com",
-		"https://api.openai.com/v1":          "openai.com",
-		"https://www.vendor.com/v1":          "vendor.com",
-		"http://127.0.0.1:8080/v1":           "127.0.0.1",
-		"https://amr-link.open-design.ai/v1": "amr-link.open-design.ai",
-		"not a url at all":                   "",
-	}
-	for in, want := range cases {
-		if got := defaultSourceName(in); got != want {
-			t.Errorf("defaultSourceName(%q) = %q, want %q", in, got, want)
-		}
-	}
-}
-
-func TestSelectModels_IncludeUnknownIsAnError(t *testing.T) {
-	chat := []string{"a", "b"}
-	image := []string{"img"}
-	// Silently dropping a typo'd id would create a source that looks
-	// configured and 404s on every request — much worse than a rejection.
-	_, _, _, err := selectModels(chat, image, []string{"a", "typo"}, nil)
-	if err == nil {
-		t.Fatal("expected an error for an include id that is not in the catalog")
-	}
-	if !strings.Contains(err.Error(), "typo") {
-		t.Errorf("error should name the offending id, got %q", err)
-	}
-}
-
-func TestSelectModels_IncludeNarrows(t *testing.T) {
-	chat, image, _, err := selectModels([]string{"a", "b", "c"}, []string{"img1", "img2"}, []string{"b", "img1"}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(chat) != 1 || chat[0] != "b" {
-		t.Errorf("chat = %v, want [b]", chat)
-	}
-	if len(image) != 1 || image[0] != "img1" {
-		t.Errorf("image = %v, want [img1]", image)
-	}
-}
-
-func TestSelectModels_ExcludeUnknownIsFine(t *testing.T) {
-	chat, _, _, err := selectModels([]string{"a"}, nil, nil, []string{"never-existed"})
-	if err != nil {
-		t.Errorf("excluding a model that is not present should be allowed: %v", err)
-	}
-	if len(chat) != 1 {
-		t.Errorf("chat = %v, want [a] unchanged", chat)
-	}
-}
-
-func TestSelectModels_NeverReturnsNil(t *testing.T) {
-	chat, image, warns, err := selectModels(nil, nil, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if chat == nil || image == nil {
-		t.Fatal("nil slices would serialize as JSON null and break the UI")
-	}
-	if len(warns) == 0 {
-		t.Error("an empty catalog deserves a warning, not silence")
-	}
-}
-
-func TestSelectModels_WarnsAboutImageOnlyCatalog(t *testing.T) {
-	_, _, warns, err := selectModels(nil, []string{"gpt-image-2"}, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	joined := strings.Join(warns, " ")
-	if !strings.Contains(joined, "AUTO") {
-		t.Errorf("warnings %v should say AUTO has nothing to select", warns)
-	}
-}
-
-func TestSelectModels_WarnsThatImagesAreNotInAUTO(t *testing.T) {
-	_, _, warns, err := selectModels([]string{"a"}, []string{"img"}, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(strings.Join(warns, " "), "images/generations") {
-		t.Errorf("warnings %v should point at the image endpoint", warns)
-	}
-}
-
-// TestDiscoveryResultAndConfigRoundTrip checks the fields the WebUI will echo
-// back actually survive into a config.Source — a mismatch here means the
-// operator previews one set of values and saves another.
-func TestDiscoveryResultAndConfigRoundTrip(t *testing.T) {
-	res := &discoveryResult{
-		BaseURL:     "https://h",
-		Endpoint:    "/v1/chat/completions",
-		Models:      []string{"m1", "m2"},
-		ImageModels: []string{"img1"},
-	}
-	src := config.Source{
-		Name:     "x",
-		BaseURL:  res.BaseURL,
-		Endpoint: res.Endpoint,
-		Models:   modelsToConfig(res.Models, res.ImageModels),
-	}
-	if len(src.Models) != 3 {
-		t.Fatalf("models = %d, want 3", len(src.Models))
-	}
-	if src.Endpoint != "/v1/chat/completions" {
-		t.Errorf("endpoint lost: %q", src.Endpoint)
-	}
-	var img int
-	for _, m := range src.Models {
-		if m.Kind == "image" {
-			img++
-		}
-	}
-	if img != 1 {
-		t.Errorf("image models = %d, want 1", img)
-	}
-}
-
-// TestDiscoverModels_SendsAuthorizationHeader pins the only way the feature
-// works against a real vendor: without the bearer token every paid /models
-// endpoint returns 401.
-func TestDiscoverModels_SendsAuthorizationHeader(t *testing.T) {
-	var seen string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		seen = r.Header.Get("Authorization")
-		_, _ = w.Write([]byte(`{"data":[{"id":"m"}]}`))
-	}))
-	defer srv.Close()
-
-	if _, err := DiscoverModels(context.Background(), srv.URL+"/v1", "sk-secret"); err != nil {
-		t.Fatal(err)
-	}
-	if seen != "Bearer sk-secret" {
-		t.Errorf("Authorization = %q, want %q", seen, "Bearer sk-secret")
-	}
-}
-
-// TestDiscoverModels_WrongKeyIsUnauthorizedNotBadGateway pins the distinction
-// that decides whether the operator knows what to do next.
-//
-// A rejected key and an unreachable vendor are the two most common discovery
-// failures, and they need opposite actions: re-type the key, versus go check the
-// vendor's status page. Both used to surface as one generic error, so the
-// operator had to guess.
-func TestDiscoverModels_WrongKeyIsUnauthorizedNotBadGateway(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusUnauthorized)
-		_, _ = w.Write([]byte(`{"error":{"message":"invalid api key","code":"invalid_api_key"}}`))
-	}))
-	defer srv.Close()
-
-	_, err := DiscoverModels(context.Background(), srv.URL+"/v1", "sk-wrong")
-	if err == nil {
-		t.Fatal("expected a failure against a 401 endpoint")
-	}
-	var f *discoveryFailure
-	if !errors.As(err, &f) {
-		t.Fatalf("error should be classified, got %T: %v", err, err)
-	}
-	if got := f.StatusOrDefault(); got != http.StatusUnauthorized {
-		t.Errorf("status = %d, want %d — a wrong key must not read as an upstream outage",
-			got, http.StatusUnauthorized)
-	}
-	// The message has to name which credential is at fault, or the status code
-	// alone still sends the operator to the wrong place.
-	if !strings.Contains(strings.ToLower(f.Error()), "api key") {
-		t.Errorf("message %q should name the api key as the cause", f.Error())
-	}
-	if !strings.Contains(f.Error(), "/v1/models") {
-		t.Errorf("message %q should list what was tried", f.Error())
-	}
-}
-
-// TestDiscoverModels_UnreachableStaysBadGateway: the classification must not
-// over-correct — an unresolvable host is still the vendor's or the network's
-// problem, not the key's.
-func TestDiscoverModels_UnreachableStaysBadGateway(t *testing.T) {
-	_, err := DiscoverModels(context.Background(), "https://no-such-host-xyz.invalid/v1", "k")
-	if err == nil {
-		t.Fatal("expected a failure for an unresolvable host")
-	}
-	var f *discoveryFailure
-	if !errors.As(err, &f) {
-		t.Fatalf("error should be classified, got %T", err)
-	}
-	if got := f.StatusOrDefault(); got != http.StatusBadGateway {
-		t.Errorf("status = %d, want %d", got, http.StatusBadGateway)
-	}
-	if !strings.Contains(strings.ToLower(f.Error()), "resolve") {
-		t.Errorf("message %q should say the hostname does not resolve", f.Error())
-	}
-}
-
-// TestDiscoveryCandidates_NoDuplicateRequests: base "https://h/v1" with path
-// "/models" and base "https://h" with path "/v1/models" request the SAME URL.
-// Listing it twice in a failure message reads as "two things were tried" when
-// only one was.
-func TestDiscoveryCandidates_NoDuplicateRequests(t *testing.T) {
-	seen := map[string]bool{}
-	for _, c := range discoveryCandidates("https://h/v1") {
-		url := c.baseURL + c.modelsPath
-		if seen[url] {
-			t.Errorf("candidate %q would be requested twice", url)
-		}
-		seen[url] = true
-	}
-	if len(seen) < 2 {
-		t.Errorf("only %d distinct URLs; the search collapsed", len(seen))
-	}
-}
-
-// TestDiscoverModels_FailureListsEachURLOnce is the end-to-end form of the same
-// rule, on the error text an operator actually reads.
-func TestDiscoverModels_FailureListsEachURLOnce(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer srv.Close()
-
-	_, err := DiscoverModels(context.Background(), srv.URL+"/v1", "k")
-	if err == nil {
-		t.Fatal("expected failure")
-	}
-	msg := err.Error()
-	needle := srv.URL + "/v1/models"
-	if n := strings.Count(msg, needle); n > 1 {
-		t.Errorf("URL %s appears %d times in %q", needle, n, msg)
-	}
-}
-
-func TestDiscoverModels_EmptyKeyOmitsHeader(t *testing.T) {
-	var present bool
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_, present = r.Header["Authorization"]
-		_, _ = w.Write([]byte(`{"data":[{"id":"m"}]}`))
-	}))
-	defer srv.Close()
-
-	if _, err := DiscoverModels(context.Background(), srv.URL+"/v1", ""); err != nil {
-		t.Fatal(err)
-	}
-	if present {
-		t.Error("an empty key should omit the header, not send an empty bearer")
-	}
-}
-
-// TestDiscoverModels_RealCatalogEndToEnd walks the actual captured response
-// through the whole path and asserts the numbers an operator would see.
-func TestDiscoverModels_RealCatalogEndToEnd(t *testing.T) {
-	srv := catalogUpstream(t)
-	res, err := DiscoverModels(context.Background(), srv.URL+"/v1", "sk-secret")
-	if err != nil {
-		t.Fatalf("discovery failed: %v", err)
-	}
-	if res.BaseURL != srv.URL+"/v1" {
-		t.Errorf("base = %q, want the typed URL unchanged", res.BaseURL)
-	}
-	if res.Endpoint != "" {
-		t.Errorf("endpoint = %q, want empty (base already carries /v1)", res.Endpoint)
-	}
-	if len(res.Models) != 2 || len(res.ImageModels) != 2 {
-		t.Errorf("chat/image = %d/%d, want 2/2", len(res.Models), len(res.ImageModels))
-	}
-	if res.Adapter != "openai" {
-		t.Errorf("adapter = %q, want openai", res.Adapter)
-	}
-
-	// The response must be JSON the UI can consume directly.
-	b, _ := json.Marshal(res)
-	var round map[string]interface{}
-	if err := json.Unmarshal(b, &round); err != nil {
-		t.Fatal(err)
-	}
-	if round["ok"] != nil {
-		// discoverResponse adds ok; discoveryResult does not. Both marshal
-		// fine, so this is only a shape note.
-		_ = round
-	}
-}

internal/gateway/discover_endpoint_test.go

@@ -1,153 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// TestComposeImageEndpoint_NoVersionBaseLeavesDefault is the counterpart of the
-// /v1 case: when the base carries no version segment, discovery must emit "" so
-// the gateway's own default "/v1/images/generations" composes.
-//
-// This is the shape every currently-working source uses — siliconflow, the only
-// source in production with kind:image, has base_url
-// "https://api.siliconflow.cn" — so writing a non-empty value here would break
-// exactly the configuration that is known to work today.
-func TestComposeImageEndpoint_NoVersionBaseLeavesDefault(t *testing.T) {
-	if got := composeImageEndpoint("https://api.siliconflow.cn"); got != "" {
-		t.Errorf("composeImageEndpoint = %q, want \"\" so the built-in default composes", got)
-	}
-	// And the composition it implies must be the vendor's real path.
-	base := "https://api.siliconflow.cn"
-	composed := base + "/v1/images/generations"
-	if !strings.HasSuffix(composed, "/v1/images/generations") {
-		t.Errorf("composed URL %q lost the image path", composed)
-	}
-}
-
-// TestDiscovery_BareHostNeedsVersionOnEndpointWhenCatalogIsVersioned
-// distinguishes two cases that look identical from the outside.
-//
-//	bare host + catalog at "/models"       → chat is "/chat/completions" (the
-//	  adapter default, no endpoint written)
-//	bare host + catalog at "/v1/models"    → chat is "/v1/chat/completions",
-//	  so an endpoint MUST be written
-//
-// The catalog path is the only evidence of whether the upstream wants the
-// version segment, and getting this backwards sends every chat request to a
-// path the vendor does not serve.
-func TestDiscovery_BareHostNeedsVersionOnEndpointWhenCatalogIsVersioned(t *testing.T) {
-	cases := []struct {
-		name         string
-		catalogPath  string
-		wantEndpoint string
-		wantImage    string
-	}{
-		{
-			name:         "catalog at the bare /models needs no endpoint",
-			catalogPath:  "/models",
-			wantEndpoint: "",
-			wantImage:    "",
-		},
-		{
-			name:         "catalog at /v1/models requires /v1 on the chat endpoint",
-			catalogPath:  "/v1/models",
-			wantEndpoint: "/v1/chat/completions",
-			wantImage:    "",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.URL.Path != tc.catalogPath {
-					w.WriteHeader(http.StatusNotFound)
-					return
-				}
-				_, _ = w.Write([]byte(`{"data":[{"id":"m1"},{"id":"m2"}]}`))
-			}))
-			defer srv.Close()
-
-			res, err := DiscoverModels(context.Background(), srv.URL, "k")
-			if err != nil {
-				t.Fatalf("discovery failed: %v", err)
-			}
-			if res.BaseURL != srv.URL {
-				t.Errorf("base = %q, want %q", res.BaseURL, srv.URL)
-			}
-			if res.Endpoint != tc.wantEndpoint {
-				t.Errorf("endpoint = %q, want %q", res.Endpoint, tc.wantEndpoint)
-			}
-			if res.ImageEndpoint != tc.wantImage {
-				t.Errorf("image_endpoint = %q, want %q", res.ImageEndpoint, tc.wantImage)
-			}
-			// Whatever it wrote, the chat URL must reach the same version
-			// prefix the catalog was served under.
-			ep := res.Endpoint
-			if ep == "" {
-				ep = "/chat/completions"
-			}
-			if got := res.BaseURL + ep; strings.Contains(got, "/v1/v1") {
-				t.Errorf("chat URL %q has a doubled version", got)
-			}
-		})
-	}
-}
-
-// TestComposeEndpoints_BothFormsProduceWorkingURLs is the end-to-end
-// invariant across the two shapes, stated as the URLs the gateway will build.
-//
-// A base with a version and no image_endpoint produces "/v1/v1/…" — the exact
-// 404 observed before composeImageEndpoint existed. A base without one and a
-// non-empty image_endpoint produces a path missing the version. Both are
-// silent, expensive mistakes, so they are asserted literally.
-func TestComposeEndpoints_BothFormsProduceWorkingURLs(t *testing.T) {
-	cases := []struct {
-		name      string
-		base      string
-		wantChat  string
-		wantImage string
-	}{
-		{
-			name:     "bare host: adapter and image defaults compose",
-			base:     "https://h",
-			wantChat: "https://h/chat/completions",
-			// openai's adapter endpoint is /chat/completions (verified in
-			// internal/lua/adapters/openai.lua: adapter.endpoint).
-			wantImage: "https://h/v1/images/generations",
-		},
-		{
-			name:      "versioned base: the version moves onto both endpoints",
-			base:      "https://h/v1",
-			wantChat:  "https://h/v1/chat/completions",
-			wantImage: "https://h/v1/images/generations",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			ep := composeEndpoint("/models", tc.base, tc.base)
-			if ep == "" {
-				ep = "/chat/completions" // the adapter default
-			}
-			iep := composeImageEndpoint(tc.base)
-			if iep == "" {
-				iep = "/v1/images/generations" // the gateway default
-			}
-			gotChat := tc.base + ep
-			gotImage := tc.base + iep
-			if gotChat != tc.wantChat {
-				t.Errorf("chat URL = %q, want %q", gotChat, tc.wantChat)
-			}
-			if gotImage != tc.wantImage {
-				t.Errorf("image URL = %q, want %q", gotImage, tc.wantImage)
-			}
-			for _, u := range []string{gotChat, gotImage} {
-				if strings.Contains(u, "/v1/v1") {
-					t.Errorf("%q has a doubled version segment", u)
-				}
-			}
-		})
-	}
-}

internal/gateway/discover_mutate_test.go

@@ -1,342 +0,0 @@
-package gateway
-
-// Real mutation injection: rewrites the IMPLEMENTATION on disk, re-runs the
-// suite, and requires it to go red.
-//
-// Why this exists and why it is a Go file rather than a shell script:
-//
-// The first version was a shell script. Its -run filter contained a regex that
-// the shell mangled, so every mutant reported "SURVIVED" while go test printed
-// "[no tests to run]". Four mutants looked like judgement failures and were
-// actually never executed. A judgement that cannot tell "tests passed" from
-// "no tests ran" is not a judgement.
-//
-// This version therefore refuses to report anything unless it has first proved
-// the filter selects a non-trivial number of tests (see baseline below), and it
-// treats "[no tests to run]" as a hard error rather than a green run.
-//
-// It also must not be run against a DIRTY tree: the mutant is written over
-// discover.go, and a leftover mutant from a killed run would make the baseline
-// green against broken code while every verdict came from the wrong source.
-// See the guard at the top of TestRealMutants.
-//
-// Run: go test -tags luajit ./internal/gateway/ -run TestRealMutants -v
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sort"
-	"strings"
-	"testing"
-)
-
-// mutationFilter must select every assertion that guards the code below. It is
-// deliberately broad: a narrow filter is how mutants get to survive for free.
-const mutationFilter = "Test(ParseModelCatalog|DiscoveredModelKind|Discover|TrimVersion|VersionSegment|ComposeEndpoint|ComposeImageEndpoint|ComposeEndpoints|IsVersionSegment|ModelsToConfig|DiscoveryResult|DiscoveryCandidates|Discovery_BareHost)"
-
-type mutation struct {
-	name string
-	from string
-	to   string
-}
-
-func TestRealMutants(t *testing.T) {
-	if testing.Short() {
-		t.Skip("mutation campaign compiles the package repeatedly")
-	}
-	wd, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	target := filepath.Join(wd, "discover.go")
-	orig, err := os.ReadFile(target)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Refuse to run against a dirty tree.
-	//
-	// The mutant is written OVER discover.go, so on a dirty file the "original"
-	// captured above is not the committed source — the baseline then runs against
-	// whatever was there, and a killed run (a background-task timeout, a Ctrl-C)
-	// leaves a mutant behind that the NEXT run treats as the baseline. Both make
-	// every verdict meaningless while the harness still reports a clean score.
-	//
-	// Refusing rather than restoring: this cannot tell "leftover mutant" apart from
-	// "the developer is mid-edit", and silently reverting real work is worse than
-	// stopping.
-	if dirty, derr := mutationTargetIsDirty(wd, "discover.go"); derr == nil && dirty {
-		t.Fatalf("%s has uncommitted changes — commit or stash them first. A mutant "+
-			"left behind by a killed run would otherwise become the baseline, and "+
-			"every verdict below would be about code nobody wrote.", target)
-	}
-	defer func() {
-		if werr := os.WriteFile(target, orig, 0o644); werr != nil {
-			t.Fatalf("restore discover.go: %v", werr)
-		}
-	}()
-
-	// --- prove the harness is armed before trusting any verdict ---
-	// A filter that selects nothing exits 0, which is indistinguishable from a
-	// real pass. The only way to tell them apart is to compare against a filter
-	// KNOWN to be empty: if that empty filter produces the same result as the
-	// real one, the real one is probably empty too.
-	//
-	// Note go test does NOT print "[no tests to run]" for a wholly unmatched
-	// filter (it prints that only when the package has other matching tests), so
-	// the check has to compare outputs rather than look for a marker string.
-	// Getting this backwards made the harness refuse to run at all.
-	emptyOut := runSuite(wd, "TestZZZNoSuchTestExists")
-	realOut := runSuite(wd, mutationFilter)
-	if countTests(emptyOut) != 0 {
-		t.Fatalf("a filter matching nothing selected %d tests; the harness's own probe is broken",
-			countTests(emptyOut))
-	}
-	// Kept for the no-op check below: a mutant whose output matches the
-	// baseline never changed behaviour, so it is an invalid mutation rather
-	// than a gap in the tests.
-	baseOut := realOut
-	if strings.Contains(realOut, "[no tests to run]") {
-		t.Fatalf("baseline selected no tests:\n%s", realOut)
-	}
-	baseCount := countTests(realOut)
-	if baseCount < 25 {
-		t.Fatalf("baseline ran only %d tests; the filter is too narrow to judge anything", baseCount)
-	}
-	if strings.Contains(realOut, "FAIL") {
-		t.Logf("note: baseline is not green; kill verdicts remain valid")
-	}
-	t.Logf("baseline: %d tests selected, empty filter selects %d",
-		baseCount, countTests(emptyOut))
-
-	muts := []mutation{
-		{
-			// Written as a condition that still READS modOut, because a
-			// mutation that leaves a variable unused fails to compile — and a
-			// build failure is not a judgement (see the harness note above).
-			name: "image kind ignores upstream output modality",
-			from: `if m.Capabilities.ImageGeneration || has(modOut, "image") {`,
-			to:   "if m.Capabilities.ImageGeneration || (len(modOut) > 0 && false) {",
-		},
-		{
-			name: "kind defaults to image (guessing from names)",
-			from: "\t}\n\treturn \"chat\"\n}\n\n// modalityList",
-			to:   "\t}\n\treturn \"image\"\n}\n\n// modalityList",
-		},
-		{
-			name: "nested metadata no longer read",
-			from: "\tcopyFields(m.Metadata)      // nested first",
-			to:   "\tcopyFields(json.RawMessage(nil)) // mutant: nested metadata dropped",
-		},
-		{
-			name: "non-catalog bodies accepted",
-			from: "\tif trimmed == \"\" || trimmed == \"null\" {\n\t\treturn nil, fmt.Errorf(\"empty response\")\n\t}",
-			to:   "\tif false && (trimmed == \"\" || trimmed == \"null\") {\n\t\treturn nil, fmt.Errorf(\"empty response\")\n\t}",
-		},
-		{
-			// Removing the bare "/models" candidate must be observable: a vendor
-			// serving its catalog at the bare path would otherwise look
-			// unreachable. The `len(...) >= 0` is a tautology that only exists to
-			// keep the expression syntactically valid after the call is dropped.
-			name: "URL fallback search removed",
-			from: "\t\tadd(raw, \"/models\", 0)",
-			to:   "\t\tif len(\"/models\") >= 0 {\n\t\t\t_ = hasVersion\n\t\t}",
-		},
-		{
-			name: "version segment never moved onto the chat endpoint",
-			from: "\tif version == \"\" {\n\t\treturn \"\" // adapter default already composes\n\t}",
-			to:   "\tif version == \"\" || len(version) > 0 {\n\t\treturn \"\"\n\t}",
-		},
-		{
-			name: "image endpoint never corrected (/v1/v1 regression)",
-			from: "\tif b := trimVersionSuffix(persistedBase); b != persistedBase {\n\t\treturn \"/images/generations\"\n\t}",
-			to:   "\tif b := trimVersionSuffix(persistedBase); b == b && b != b {\n\t\treturn \"/images/generations\"\n\t}",
-		},
-		{
-			name: "version test loosened so 'vision' counts as a version",
-			from: "\tsuffix := strings.ToLower(seg[i:])",
-			to:   "\tsuffix := strings.ToLower(seg[i:])\n\tif len(suffix) >= 0 {\n\t\tsuffix = \"beta\"\n\t}",
-		},
-		{
-			// The guard must be removable WITHOUT the mutant becoming a
-			// semantic no-op. Two earlier attempts failed:
-			//
-			//   `&& out.BaseURL != ""`  — the guard this test exercises uses a
-			//     zero-value struct whose BaseURL is empty, so the added
-			//     condition made the mutant behave identically to the original.
-			//   `&& len(out.BaseURL) >= 0` — always true for any string, so the
-			//     mutant was STILL an identity transform.
-			//
-			// Reading the variable into a blank assignment keeps the compiler
-			// happy without changing behaviour, which is what makes the
-			// mutant observable.
-			name: "nil slice guard removed from JSON output",
-			from: "\tif out.ImageModels == nil {\n\t\tout.ImageModels = []string{}\n\t}",
-			to:   "\tif out.ImageModels == nil {\n\t\t_ = out.ImageModels\n\t}",
-		},
-		{
-			name: "auth rejection no longer classified",
-			from: "\tif status != http.StatusUnauthorized && status != http.StatusForbidden {\n\t\treturn \"\"\n\t}",
-			to:   "\tif status != http.StatusUnauthorized && status != http.StatusForbidden || len(body) >= 0 {\n\t\treturn \"\"\n\t}",
-		},
-		{
-			name: "duplicate candidate URLs no longer collapsed",
-			from: "\t\tif seenPair[pair] || seenURL[base+path] {",
-			to:   "\t\tif len(pair) > 0 && (seenPair[pair] || seenURL[base+path]) && false {",
-		},
-	}
-
-	survived := 0
-	for _, m := range muts {
-		t.Run(m.name, func(t *testing.T) {
-			if !strings.Contains(string(orig), m.from) {
-				t.Fatalf("anchor not found in discover.go — this mutation would be a no-op:\n%q", m.from)
-			}
-			mutated := strings.Replace(string(orig), m.from, m.to, 1)
-			if mutated == string(orig) {
-				t.Fatal("replacement changed nothing")
-			}
-			if werr := os.WriteFile(target, []byte(mutated), 0o644); werr != nil {
-				t.Fatal(werr)
-			}
-			defer os.WriteFile(target, orig, 0o644)
-
-			out := runSuite(wd, mutationFilter)
-			// A build failure kills EVERY mutant, so it would mask a broken
-			// harness as a perfect score. Distinguish it from a real test
-			// failure and fail loudly instead.
-			if strings.Contains(out, "[build failed]") {
-				t.Fatalf("mutant broke the build — that is not a judgement, it is a broken harness:\n%s", firstLines(out, 20))
-			}
-			if countTests(out) == 0 {
-				t.Fatalf("filter selected nothing — the verdict would be meaningless")
-			}
-			if !strings.Contains(out, "FAIL") {
-				// The mutant compiled and the suite stayed green. Before calling
-				// this a survivor, check the mutation was not a no-op: an earlier
-				// version reported four "survivors" that were really invalid
-				// mutations whose added guard made them behaviourally identical
-				// to the original. A silent no-op is a broken mutation, and
-				// conflating the two sends the next reader hunting for a missing
-				// test that does not exist.
-				if behaviourOnly(out) == behaviourOnly(baseOut) {
-					t.Fatalf("mutant is a no-op: the suite output is identical to the "+
-						"baseline, so this mutation never changed behaviour. Fix the "+
-						"mutation rather than looking for a missing test.\nmutant: %q", m.to)
-				}
-				survived++
-				t.Errorf("SURVIVED %s — no test noticed this wrong implementation", m.name)
-				return
-			}
-			t.Logf("KILL  %s", m.name)
-		})
-	}
-	if survived > 0 {
-		t.Errorf("%d of %d mutants survived", survived, len(muts))
-	}
-}
-
-// runSuite invokes the go tool on this package with the given -run filter.
-//
-// The luajit build tag is mandatory: without it the package falls back to plain
-// Lua 5.1, billing.lua's `goto` fails to compile, and the whole package fails
-// to build — which the harness would misread as "every mutant killed".
-func runSuite(wd, filter string) string {
-	tool := os.Getenv("GO_TEST_GO")
-	if tool == "" {
-		tool = "go"
-	}
-	cmd := exec.Command(tool, "test",
-		"-tags", "luajit",
-		".", "-run", filter, "-count=1", "-v")
-	cmd.Dir = wd
-	cmd.Env = os.Environ()
-	out, _ := cmd.CombinedOutput()
-	return string(out)
-}
-
-// mutationTargetIsDirty reports whether a file under internal/gateway has
-// uncommitted changes, so the harness can refuse to run instead of treating a
-// leftover mutant as the baseline.
-//
-// git runs from the package directory with a PATH RELATIVE to it. An earlier
-// version of the sibling script passed a repo-relative pathspec while running in
-// the package directory; git matched nothing and the guard never fired.
-func mutationTargetIsDirty(wd, name string) (bool, error) {
-	cmd := exec.Command("git", "diff", "--name-only", "--", "./"+name)
-	cmd.Dir = wd
-	out, err := cmd.Output()
-	if err != nil {
-		return false, err
-	}
-	return strings.TrimSpace(string(out)) != "", nil
-}
-
-func countTests(out string) int {
-	n := 0
-	for _, line := range strings.Split(out, "\n") {
-		// Subtests are indented; only count top-level ones so a single test
-		// with a table of cases cannot inflate the count.
-		if strings.HasPrefix(line, "=== RUN   Test") && !strings.Contains(line, "/") {
-			n++
-		}
-	}
-	return n
-}
-
-// behaviourOnly strips the parts of `go test -v` output that vary between runs
-// (timings, goroutine ids, temp paths) so two runs can be compared for equality.
-// If a mutant produces output identical to the baseline under this projection,
-// the mutation did not change observable behaviour and is therefore invalid.
-func behaviourOnly(out string) string {
-	var kept []string
-	for _, line := range strings.Split(out, "\n") {
-		trimmed := strings.TrimSpace(line)
-		switch {
-		// Keep only the outcome lines. Test NAMES are deliberately dropped:
-		// two runs of the same suite can legitimately order or cache tests
-		// differently, and keeping the names made every mutant look like it had
-		// "changed behaviour" — which defeats the no-op detector entirely.
-		case strings.HasPrefix(trimmed, "--- PASS"), strings.HasPrefix(trimmed, "--- FAIL"),
-			strings.HasPrefix(trimmed, "--- SKIP"),
-			strings.HasPrefix(trimmed, "ok  "), trimmed == "FAIL",
-			strings.Contains(trimmed, ".go:"):
-			kept = append(kept, trimmed)
-		}
-	}
-	// Counting outcomes is stronger than comparing the sequence: a mutation
-	// that swaps which test fails still changes the multiset, and one that
-	// changes nothing cannot.
-	sort.Strings(kept)
-	return strings.Join(kept, "\n")
-}
-
-// firstLines trims output for an error message; a failing nested run can be
-// thousands of lines and the cause is always near the top.
-func firstLines(s string, n int) string {
-	lines := strings.Split(s, "\n")
-	if len(lines) > n {
-		lines = lines[:n]
-	}
-	return strings.Join(lines, "\n")
-}
-
-// TestMutationFilterCoversEveryGuard keeps the filter honest. Dropping a group
-// from it silently disarms that area's mutants.
-func TestMutationFilterCoversEveryGuard(t *testing.T) {
-	for _, group := range []string{
-		"ParseModelCatalog",   // nested metadata + non-catalog rejection
-		"DiscoveredModelKind", // kind follows upstream metadata
-		"Discover",            // URL fallback, auth classification
-		"ComposeEndpoint",     // version segment exactly once (chat)
-		"ComposeImageEndpoint",
-		"ComposeEndpoints", // the composed URLs, both base shapes
-		"IsVersionSegment", // "v1beta" vs "vision"
-		"DiscoveryResult",  // nil slices are arrays
-	} {
-		if !strings.Contains(mutationFilter, group) {
-			t.Errorf("mutation filter omits %s; mutants there survive silently", group)
-		}
-	}
-}

internal/gateway/discover_mutation_test.go

@@ -1,171 +0,0 @@
-package gateway
-
-// Mutation harness for the discovery code. Kept in the tree (not in a shell
-// script) so the -run filter is a Go string literal rather than something the
-// shell can mangle into "[no tests to run]" — which is exactly how an earlier
-// version of this harness reported four surviving mutants that were simply
-// never executed.
-//
-// Each mutant flips one behaviour; TestMutationHarness_Fails proves the
-// harness itself is armed.
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-	"testing"
-)
-
-// discoveryTestFilter must cover every assertion that guards the behaviour
-// below. Narrowing it is how mutants get to "survive" for free.
-const discoveryTestFilter = "Test(ParseModelCatalog|DiscoveredModelKind|Discover|TrimVersion|VersionSegment|ComposeEndpoint|IsVersionSegment|ModelsToConfig|DiscoveryResult|DiscoveryCandidates)"
-
-func TestDiscoveryFilterRunsRealTests(t *testing.T) {
-	if discoveryTestFilter == "" {
-		t.Fatal("filter is empty; every mutant would survive trivially")
-	}
-	// The whole point: the catalog parser test must be inside the filter, or a
-	// mutant that stops reading nested metadata survives with a green run.
-	for _, group := range []string{
-		"ParseModelCatalog",   // nested metadata + non-catalog rejection
-		"DiscoveredModelKind", // kind must follow upstream metadata
-		"Discover",            // URL fallback + endpoint composition
-		"ComposeEndpoint",     // version segment exactly once
-		"IsVersionSegment",    // "v1beta" vs "vision"
-	} {
-		if !strings.Contains(discoveryTestFilter, group) {
-			t.Errorf("filter %q skips %s tests; mutants in that area survive", discoveryTestFilter, group)
-		}
-	}
-}
-
-// TestMutantsAreDetectable is the harness's own regression guard: it runs the
-// filter's worth of assertions against deliberately broken inputs and requires
-// each to be rejected. If a future edit makes one of these pass, the
-// corresponding protection is gone.
-func TestMutantsAreDetectable(t *testing.T) {
-	t.Run("image classification follows upstream metadata, not the model name", func(t *testing.T) {
-		// The mutant: drop the output-modality check, so every model is chat.
-		m := upstreamModel{ID: "gpt-image-2"}
-		m.Architecture.OutputModalities = []string{"image"}
-		if got := discoveredModelKind(m); got != "image" {
-			t.Errorf("mutant survived: got %q, want \"image\"", got)
-		}
-	})
-
-	t.Run("nested metadata is read", func(t *testing.T) {
-		var ms []upstreamModel
-		if err := json.Unmarshal([]byte(realCatalogBody), &ms); err == nil {
-			t.Fatal("fixture must be a wrapper object, not a bare array")
-		}
-		var wrapper struct {
-			Data []upstreamModel `json:"data"`
-		}
-		if err := json.Unmarshal([]byte(realCatalogBody), &wrapper); err != nil {
-			t.Fatal(err)
-		}
-		if len(wrapper.Data) == 0 {
-			t.Fatal("fixture parsed to zero models")
-		}
-		// The mutant: skip copyFields(m.Metadata) entirely.
-		meta := modelMeta(wrapper.Data[0])
-		if meta == nil {
-			t.Fatal("mutant survived: metadata is nil, so cost/context_limit are lost")
-		}
-		for _, k := range []string{"context_limit", "cost", "context_budget"} {
-			if _, ok := meta[k]; !ok {
-				t.Errorf("mutant survived: %s dropped from nested metadata", k)
-			}
-		}
-	})
-
-	t.Run("non-catalog responses are rejected", func(t *testing.T) {
-		for _, body := range []string{`<html>login</html>`, `null`, `{"error":{"message":"x"}}`, `{}`} {
-			if _, err := parseModelCatalog([]byte(body)); err == nil {
-				t.Errorf("mutant survived: %q accepted as a catalog", body)
-			}
-		}
-	})
-
-	t.Run("version segments are distinguished from real path segments", func(t *testing.T) {
-		if !isVersionSegment("v1beta") {
-			t.Error("mutant survived: v1beta not treated as a version")
-		}
-		for _, seg := range []string{"vision", "vertex", "v1x"} {
-			if isVersionSegment(seg) {
-				t.Errorf("mutant survived: %q wrongly treated as a version", seg)
-			}
-		}
-	})
-
-	t.Run("endpoint composition never duplicates the version segment", func(t *testing.T) {
-		// The mutant: never move the segment onto the endpoint.
-		if got := composeEndpoint("/v1/models", "https://h", "https://h/v1"); got != "/v1/chat/completions" {
-			t.Errorf("mutant survived: endpoint = %q", got)
-		}
-		// The other mutant: always move it, even when the base keeps it.
-		if got := composeEndpoint("/models", "https://h/v1", "https://h/v1"); got != "" {
-			t.Errorf("mutant survived: endpoint = %q would double /v1", got)
-		}
-	})
-
-	t.Run("image_models is never nil", func(t *testing.T) {
-		res := &discoveryResult{Models: []string{"a"}, ImageModels: nil}
-		b, _ := json.Marshal(res)
-		if strings.Contains(string(b), `"image_models":null`) {
-			t.Errorf("mutant survived: %s", b)
-		}
-	})
-
-	t.Run("a rejected key is reported as unauthorized, not as an outage", func(t *testing.T) {
-		// The mutant: collapse every failure into one generic error, which is
-		// what made a typo'd key look like the vendor being down.
-		if classifyAuthStatus(http.StatusUnauthorized, []byte(`{"error":"invalid api key"}`)) == "" {
-			t.Error("mutant survived: 401 is not classified")
-		}
-		if classifyAuthStatus(http.StatusNotFound, []byte("nope")) != "" {
-			t.Error("a 404 must not be reported as an auth problem")
-		}
-		if classifyAuthStatus(http.StatusOK, nil) != "" {
-			t.Error("a 200 must not be reported as an auth problem")
-		}
-	})
-
-	t.Run("duplicate candidate URLs are collapsed", func(t *testing.T) {
-		seen := map[string]bool{}
-		for _, c := range discoveryCandidates("https://h/v1") {
-			u := c.baseURL + c.modelsPath
-			if seen[u] {
-				t.Errorf("mutant survived: %s requested twice", u)
-			}
-			seen[u] = true
-		}
-	})
-
-	t.Run("discovery falls back across URL forms", func(t *testing.T) {
-		// The coverage requirement is that BOTH catalog paths are reachable for
-		// a typed base, and both for a bare host. Asserting an exact count kept
-		// drifting as the candidate list was fixed, and each time it measured
-		// the current list rather than the property that matters.
-		for _, base := range []string{"https://h/v1", "https://h"} {
-			distinct := map[string]bool{}
-			for _, c := range discoveryCandidates(base) {
-				distinct[c.baseURL+c.modelsPath] = true
-			}
-			for _, want := range []string{base + "/v1/models", base + "/models"} {
-				if !distinct[want] {
-					t.Errorf("mutant survived: %s never requests %s", base, want)
-				}
-			}
-		}
-	})
-
-	t.Run("only the catalog is fetched, never each model", func(t *testing.T) {
-		// Guarding a NON-mutation: the design decision that discovery must not
-		// spend money. If a future change adds per-model probes, the counting
-		// test below catches it; this assertion documents the intent.
-		if discoveryModelsPath != "/v1/models" {
-			t.Errorf("catalog path changed to %q", discoveryModelsPath)
-		}
-	})
-}

internal/gateway/discover_test.go

@@ -1,648 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// realCatalogBody is the actual /models response captured from the amr-link
-// endpoint, not a hand-written fixture. Two properties of it are the reason
-// this test exists at all:
-//
-//   - it nests modalities under "architecture", which the naive parser misses;
-//   - it lists five image-generation ids among 34 chat ids, so a parser that
-//     returns everything as "chat" silently poisons the AUTO chain.
-const realCatalogBody = `{"data":[{"id":"claude-fable-5","object":"model","created":1781081344,"owned_by":"vela","architecture":{"input_modalities":["text","image","file"],"output_modalities":["text"]},"metadata":{"cost":"very_high","capability":"best_quality","context_limit":1000000,"context_budget":232000},"default":false,"enabled":true},{"id":"gpt-image-2","object":"model","architecture":{"input_modalities":["text","image"],"output_modalities":["image"]},"metadata":{"capability":"best_quality"},"enabled":true},{"id":"deepseek-v4-flash","object":"model","architecture":{"input_modalities":["text"],"output_modalities":["text"]},"metadata":{"cost":"medium","capability":"standard","context_limit":1048000},"enabled":true},{"id":"seedream-5.0-pro","object":"model","architecture":{"input_modalities":["text","image"],"output_modalities":["image"]},"metadata":{"capability":"best_quality"},"enabled":true}]}`
-
-func TestParseModelCatalog_RealUpstreamShape(t *testing.T) {
-	models, err := parseModelCatalog([]byte(realCatalogBody))
-	if err != nil {
-		t.Fatalf("parse: %v", err)
-	}
-	if len(models) != 4 {
-		t.Fatalf("want 4 models, got %d", len(models))
-	}
-
-	kind := map[string]string{}
-	for _, m := range models {
-		kind[m.ID] = m.Kind
-	}
-	// The two image generators must be classified by the upstream's declared
-	// output modality, not by their names.
-	for _, id := range []string{"gpt-image-2", "seedream-5.0-pro"} {
-		if kind[id] != "image" {
-			t.Errorf("%s: got kind %q, want \"image\"", id, kind[id])
-		}
-	}
-	for _, id := range []string{"claude-fable-5", "deepseek-v4-flash"} {
-		if kind[id] != "chat" {
-			t.Errorf("%s: got kind %q, want \"chat\"", id, kind[id])
-		}
-	}
-
-	// Metadata the upstream sent must survive; keys it did not send must not
-	// appear as zero values.
-	if got := models[0].Meta["context_limit"]; got == nil {
-		t.Error("claude-fable-5: context_limit dropped (it is nested under metadata in the real response)")
-	} else if f, ok := got.(float64); !ok || f != 1000000 {
-		t.Errorf("context_limit = %#v, want numeric 1000000 so the UI can sort on it", got)
-	}
-	if _, present := models[0].Meta["cost"]; !present {
-		t.Error("claude-fable-5: cost dropped")
-	}
-	// context_budget is present on this entry and must not be dropped either.
-	if _, present := models[0].Meta["context_budget"]; !present {
-		t.Error("claude-fable-5: context_budget dropped")
-	}
-	// deepseek-v4-flash DOES send metadata; gpt-image-2 sends only capability.
-	// Neither may lose it.
-	if models[2].Meta["context_limit"] == nil {
-		t.Error("deepseek-v4-flash: context_limit dropped")
-	}
-	if models[2].Meta["cost"] == nil {
-		t.Error("deepseek-v4-flash: cost dropped")
-	}
-	if _, bogus := models[0].Meta["made_up_field"]; bogus {
-		t.Error("invented a metadata key that the upstream never sent")
-	}
-}
-
-// TestDiscoveredModelKind_ImageOnlyByUpstreamMetadata is the regression guard
-// for the failure mode that motivated keeping kind="chat" as the default: a
-// name-based heuristic marks "ideogram-v2" or "gpt-image-1" as an image model,
-// but a catalog that also serves chat for that id would then have its chat
-// entry removed from the AUTO chain. Only the upstream's declared OUTPUT
-// modality may classify a model as image.
-func TestDiscoveredModelKind_ImageOnlyByUpstreamMetadata(t *testing.T) {
-	cases := []struct {
-		name string
-		in   upstreamModel
-		want string
-	}{
-		{
-			// A catalog that DECLARES output modality image is authoritative.
-			// The "kind" string saying chat must not override it.
-			name: "declared output modality image wins over a chat kind string",
-			in: func() upstreamModel {
-				var m upstreamModel
-				m.Kind = "chat"
-				m.Architecture.OutputModalities = []string{"image"}
-				return m
-			}(),
-			want: "image",
-		},
-		{
-			name: "bare array modality string",
-			in:   upstreamModel{ID: "x", Modality: "text-to-image"},
-			want: "image",
-		},
-		{
-			name: "image INPUT is still a chat model",
-			in: func() upstreamModel {
-				var m upstreamModel
-				m.Architecture.InputModalities = []string{"text", "image"}
-				return m
-			}(),
-			want: "chat",
-		},
-		{
-			name: "file input is still a chat model",
-			in: func() upstreamModel {
-				var m upstreamModel
-				m.Architecture.InputModalities = []string{"text", "file"}
-				return m
-			}(),
-			want: "chat",
-		},
-		{
-			name: "vision capability flag is chat",
-			in:   upstreamModel{ID: "y", Capabilities: modelCaps{Vision: true}},
-			want: "chat",
-		},
-		{
-			name: "capabilities.image_generation is image",
-			in:   upstreamModel{ID: "z", Capabilities: modelCaps{ImageGeneration: true}},
-			want: "image",
-		},
-		{
-			name: "no modality info at all defaults to chat",
-			in:   upstreamModel{ID: "plain"},
-			want: "chat",
-		},
-		{
-			// The default must be chat even when the name LOOKS like an image
-			// model. Guessing from the name is what puts gpt-image-2 into the
-			// chat AUTO chain, where every request to it fails.
-			name: "image-looking name without upstream metadata stays chat",
-			in:   upstreamModel{ID: "gpt-image-2"},
-			want: "chat",
-		},
-		{
-			name: "vision-looking name without upstream metadata stays chat",
-			in:   upstreamModel{ID: "ideogram-v2"},
-			want: "chat",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := discoveredModelKind(tc.in); got != tc.want {
-				t.Errorf("got %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestParseModelCatalog_RejectsNonCatalog(t *testing.T) {
-	// A 200 with valid JSON that is not a catalog must NOT be reported as an
-	// empty result. Reporting zero models would let a login page or a
-	// rate-limit body create a source with no models in it.
-	for name, body := range map[string]string{
-		"login page html": `<html><body>Sign in</body></html>`,
-		"rate limit json": `{"error":{"message":"slow down","type":"rate_limit"}}`,
-		"empty object":    `{}`,
-		"null":            `null`,
-		"wrong shape":     `{"objects":[{"id":"m"}]}`,
-	} {
-		t.Run(name, func(t *testing.T) {
-			if _, err := parseModelCatalog([]byte(body)); err == nil {
-				t.Errorf("expected an error for %q, got nil (would create an empty source)", name)
-			}
-		})
-	}
-}
-
-func TestParseModelCatalog_AcceptsBareArray(t *testing.T) {
-	models, err := parseModelCatalog([]byte(`[{"id":"a"},{"id":"b"}]`))
-	if err != nil {
-		t.Fatalf("bare array should parse: %v", err)
-	}
-	if len(models) != 2 {
-		t.Fatalf("want 2, got %d", len(models))
-	}
-}
-
-// TestDiscoverModels_NormalizesWhenOnlyBareModelsAnswers: operator pastes
-// "https://host/v1" (the form every SDK example shows) but the vendor serves
-// the catalog at "https://host/models" — the version segment on the path is
-// implied, not doubled. Discovery must strip the segment off the base and
-// report it on the endpoint, because openai's adapter endpoint is
-// "/chat/completions" and the two are concatenated.
-func TestDiscoverModels_NormalizesWhenOnlyBareModelsAnswers(t *testing.T) {
-	var paths []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		paths = append(paths, r.URL.Path)
-		if r.URL.Path != "/models" {
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		_, _ = w.Write([]byte(realCatalogBody))
-	}))
-	defer srv.Close()
-
-	res, err := DiscoverModels(context.Background(), srv.URL+"/v1", "sk-test")
-	if err != nil {
-		t.Fatalf("discovery failed: %v", err)
-	}
-	if res.BaseURL != srv.URL {
-		t.Errorf("base_url = %q, want %q (version segment moved off the base)", res.BaseURL, srv.URL)
-	}
-	// "/models" carries no version segment, but the operator typed one — the
-	// endpoint has to restore it or the chat call would miss /v1.
-	if res.Endpoint != "/v1/chat/completions" {
-		t.Errorf("endpoint = %q, want %q", res.Endpoint, "/v1/chat/completions")
-	}
-	if res.Note == "" {
-		t.Error("silently rewriting the operator's base_url is worse than saying so")
-	}
-	if len(res.Models) != 2 || len(res.ImageModels) != 2 {
-		t.Errorf("got %d chat / %d image, want 2 / 2", len(res.Models), len(res.ImageModels))
-	}
-	if len(paths) < 2 {
-		t.Errorf("tried only %v; expected a fallback search", paths)
-	}
-}
-
-// TestDiscoverModels_BareHostWithVersionedModelsPath: operator pastes the host
-// root, vendor serves /v1/models. The base needs no rewriting; the endpoint
-// does.
-func TestDiscoverModels_BareHostWithVersionedModelsPath(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/v1/models" {
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		_, _ = w.Write([]byte(`{"data":[{"id":"m1"}]}`))
-	}))
-	defer srv.Close()
-
-	res, err := DiscoverModels(context.Background(), srv.URL, "")
-	if err != nil {
-		t.Fatalf("discovery failed: %v", err)
-	}
-	if res.BaseURL != srv.URL {
-		t.Errorf("base_url = %q, want %q", res.BaseURL, srv.URL)
-	}
-	if res.Endpoint != "/v1/chat/completions" {
-		t.Errorf("endpoint = %q, want %q", res.Endpoint, "/v1/chat/completions")
-	}
-}
-
-// TestDiscoverModels_KeepsWorkingBaseURLUnchanged covers the vendor that really
-// does serve "/v1/models": the typed URL must survive untouched so no needless
-// config rewrite is suggested.
-func TestDiscoverModels_KeepsWorkingBaseURLUnchanged(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/v1/models" {
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		_, _ = w.Write([]byte(`{"data":[{"id":"m1"},{"id":"m2"}]}`))
-	}))
-	defer srv.Close()
-
-	// Base typed WITH "/v1", catalog served at "…/v1/models". That is exactly
-	// the amr-link shape: first candidate succeeds, nothing is rewritten, and
-	// the adapter's default endpoint already composes.
-	res, err := DiscoverModels(context.Background(), srv.URL+"/v1", "")
-	if err != nil {
-		t.Fatalf("discovery failed: %v", err)
-	}
-	if res.BaseURL != srv.URL+"/v1" {
-		t.Errorf("base_url = %q, want it unchanged", res.BaseURL)
-	}
-	if res.Endpoint != "" {
-		t.Errorf("endpoint = %q, want empty (the typed base already carries /v1)", res.Endpoint)
-	}
-	if res.Note != "" {
-		t.Errorf("note = %q, want empty when nothing was rewritten", res.Note)
-	}
-	if len(res.Models) != 2 {
-		t.Errorf("got %d chat models, want 2", len(res.Models))
-	}
-}
-
-// TestDiscoverModels_ErrorNamesEveryTriedURL: a failed probe is useless if it
-// only reports the last URL. The operator needs to see the full search.
-func TestDiscoverModels_ErrorNamesEveryTriedURL(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer srv.Close()
-
-	_, err := DiscoverModels(context.Background(), srv.URL+"/v1", "k")
-	if err == nil {
-		t.Fatal("expected failure against an all-404 server")
-	}
-	msg := err.Error()
-	for _, want := range []string{"/models", "/v1/models", "404"} {
-		if !strings.Contains(msg, want) {
-			t.Errorf("error %q should mention %q", msg, want)
-		}
-	}
-}
-
-func TestDiscoveryCandidates_DedupesAndPrefersTyped(t *testing.T) {
-	cands := discoveryCandidates("https://h/v1/")
-	if len(cands) == 0 {
-		t.Fatal("no candidates")
-	}
-	seen := map[string]bool{}
-	for _, c := range cands {
-		// Dedup is on the requested URL, so that is the key to assert on.
-		k := c.baseURL + c.modelsPath
-		if seen[k] {
-			t.Errorf("duplicate request for %s", k)
-		}
-		seen[k] = true
-	}
-	// The versioned spelling of the typed URL must be reachable: on the real
-	// amr-link endpoint that is what answers, and it is the preferred candidate.
-	if !seen["https://h/v1/models"] {
-		t.Error("the typed base with a versioned catalog path must be tried; that is what answers on amr-link")
-	}
-	// Both catalog forms must be attempted for a bare host too. Offering only
-	// "/v1/models" there left a vendor serving a bare "/models" looking
-	// unreachable.
-	if !seen["https://h/models"] {
-		t.Error("host root with a bare /models path was never tried")
-	}
-	// The first candidate is preferred, so its URL is what gets reported when
-	// several answer.
-	if cands[0].baseURL+cands[0].modelsPath != "https://h/v1/models" {
-		t.Errorf("first candidate requests %q, want the canonical versioned form",
-			cands[0].baseURL+cands[0].modelsPath)
-	}
-	// The bare "/models" form must exist too — some gateways serve it there.
-	hasBare := false
-	for _, c := range cands {
-		if c.modelsPath == "/models" {
-			hasBare = true
-		}
-	}
-	if !hasBare {
-		t.Error("no /models candidate; vendors serving the catalog at /models would be missed")
-	}
-	// Preference must be monotonically non-decreasing so the sort is stable.
-	for i := 1; i < len(cands); i++ {
-		if cands[i].prefer < cands[i-1].prefer {
-			t.Errorf("candidates out of preference order at %d: %d < %d", i, cands[i].prefer, cands[i-1].prefer)
-		}
-	}
-}
-
-func TestVersionSegment(t *testing.T) {
-	cases := map[string]string{
-		"/v1/models":     "/v1",
-		"/v1beta/models": "/v1beta",
-		"/models":        "",
-		"/api/models":    "",
-		"/vision/models": "",
-	}
-	for in, want := range cases {
-		if got := versionSegment(in); got != want {
-			t.Errorf("versionSegment(%q) = %q, want %q", in, got, want)
-		}
-	}
-}
-
-func TestTrimVersionSuffix(t *testing.T) {
-	cases := map[string]string{
-		"https://h/v1":       "https://h",
-		"https://h/v2":       "https://h",
-		"https://h/v1beta":   "https://h",
-		"https://h/api/v1":   "https://h/api",
-		"https://h/vision":   "https://h/vision", // not numeric — a real path segment
-		"https://h":          "https://h",
-		"https://h/openai":   "https://h/openai",
-		"https://h/v1/extra": "https://h/v1/extra",
-		// A segment that merely STARTS with v must not be stripped: stripping
-		// it would rewrite base "https://h/vision" to "https://h" and, worse,
-		// would treat a real vendor path as a version.
-		"https://h/vertex":       "https://h/vertex",
-		"https://h/volcengine":   "https://h/volcengine",
-		"https://h/vertex-ai/v1": "https://h/vertex-ai",
-	}
-	for in, want := range cases {
-		if got := trimVersionSuffix(in); got != want {
-			t.Errorf("trimVersionSuffix(%q) = %q, want %q", in, got, want)
-		}
-	}
-}
-
-// TestIsVersionSegment_RequiresDigits pins the distinction the whole endpoint
-// derivation rests on: "v1"/"v1beta" are versions, "vision"/"vertex" are path
-// segments. Without the digit requirement, stripping turns a vendor's real
-// base URL into a different one.
-func TestIsVersionSegment_RequiresDigits(t *testing.T) {
-	yes := []string{"v1", "v2", "v10", "v1beta", "v1alpha", "v1preview"}
-	no := []string{"vision", "vertex", "volcengine", "openai", "v", "vv", "api", "beta", "v1x"}
-	for _, s := range yes {
-		if !isVersionSegment(s) {
-			t.Errorf("isVersionSegment(%q) = false, want true", s)
-		}
-	}
-	for _, s := range no {
-		if isVersionSegment(s) {
-			t.Errorf("isVersionSegment(%q) = true, want false", s)
-		}
-	}
-}
-
-// TestComposeEndpoint_ExactlyOneVersionSegment is the invariant test. Every row
-// below is a URL form that was observed to 404 or to route wrongly when the
-// version segment ended up in the wrong place.
-func TestComposeEndpoint_ExactlyOneVersionSegment(t *testing.T) {
-	cases := []struct {
-		name          string
-		modelsPath    string
-		persistedBase string
-		typedBase     string
-		want          string
-	}{
-		{
-			name:       "typed base has /v1 and catalog served there: base keeps it, endpoint empty",
-			modelsPath: "/models", persistedBase: "https://h/v1", typedBase: "https://h/v1",
-			want: "",
-		},
-		{
-			name:       "catalog served at versioned path, base stripped: endpoint carries it",
-			modelsPath: "/v1/models", persistedBase: "https://h", typedBase: "https://h/v1",
-			want: "/v1/chat/completions",
-		},
-		{
-			name:       "bare host, bare catalog, nothing typed: adapter default composes",
-			modelsPath: "/models", persistedBase: "https://h", typedBase: "https://h",
-			want: "",
-		},
-		{
-			name:       "bare host, versioned catalog: endpoint owns the version",
-			modelsPath: "/v1/models", persistedBase: "https://h", typedBase: "https://h",
-			want: "/v1/chat/completions",
-		},
-		{
-			name:       "typed /v1 but catalog only at bare /models: strip base, restore on endpoint",
-			modelsPath: "/models", persistedBase: "https://h", typedBase: "https://h/v1",
-			want: "/v1/chat/completions",
-		},
-		{
-			name:       "non-version segment must never be promoted onto the endpoint",
-			modelsPath: "/models", persistedBase: "https://h/vision", typedBase: "https://h/vision",
-			want: "",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got := composeEndpoint(tc.modelsPath, tc.persistedBase, tc.typedBase)
-			if got != tc.want {
-				t.Errorf("composeEndpoint = %q, want %q", got, tc.want)
-			}
-			// Whichever way it resolved, base + endpoint must never carry the
-			// same version segment twice.
-			onBase := trimVersionSuffix(tc.persistedBase) != tc.persistedBase
-			onEndpoint := versionSegment(strings.TrimSuffix(got, "/chat/completions")+"/models") != ""
-			if onBase && onEndpoint {
-				t.Errorf("version segment duplicated: base %q + endpoint %q", tc.persistedBase, got)
-			}
-		})
-	}
-}
-
-// TestDiscoverModels_DoesNotProbeEveryModel guards the decision not to spend
-// money verifying each catalog entry. Only the catalog request is made.
-func TestDiscoverModels_DoesNotProbeEveryModel(t *testing.T) {
-	var calls int
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls++
-		_, _ = w.Write([]byte(`{"data":[{"id":"a"},{"id":"b"},{"id":"c"}]}`))
-	}))
-	defer srv.Close()
-
-	if _, err := DiscoverModels(context.Background(), srv.URL+"/v1", "k"); err != nil {
-		t.Fatalf("discovery failed: %v", err)
-	}
-	if calls != 1 {
-		t.Errorf("made %d requests, want exactly 1 (the catalog)", calls)
-	}
-}
-
-func TestModelsToConfig_PrioritiesAndKinds(t *testing.T) {
-	got := modelsToConfig([]string{"a", "b"}, []string{"img1"})
-	if len(got) != 3 {
-		t.Fatalf("want 3 models, got %d", len(got))
-	}
-	if got[2].ID != "img1" || got[2].Kind != "image" {
-		t.Errorf("image model mis-sorted: %+v", got[2])
-	}
-	if got[2].Priority <= got[0].Priority {
-		t.Errorf("image model priority %d should sort after chat %d", got[2].Priority, got[0].Priority)
-	}
-}
-
-// TestDiscoverModels_ImageModelsNeverNull guards the UI contract end to end,
-// not just on the struct: the WebUI does out.concat(image_models), and a JSON
-// null there renders "undefined" next to every image model row. This asserts on
-// the served bytes rather than the Go field, because that is what the bug was.
-func TestDiscoverModels_ImageModelsNeverNull(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Only chat models — the case where the slice is never appended to.
-		_, _ = w.Write([]byte(`{"data":[{"id":"a"},{"id":"b"}]}`))
-	}))
-	defer srv.Close()
-
-	res, err := DiscoverModels(context.Background(), srv.URL+"/v1", "k")
-	if err != nil {
-		t.Fatalf("discovery failed: %v", err)
-	}
-	if len(res.ImageModels) != 0 {
-		t.Fatalf("precondition: want zero image models, got %d", len(res.ImageModels))
-	}
-	b, err := json.Marshal(res)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(b), `"image_models":[]`) {
-		t.Errorf("served %s\nwant \"image_models\":[] — null breaks concat in the UI", b)
-	}
-}
-
-// TestComposeImageEndpoint pins the rule that fixed a real 404.
-//
-// Provider.ImageURL is `base_url + ImageEndpoint()`, and the built-in default
-// is the ABSOLUTE "/v1/images/generations" — while chat's default is the
-// relative "/chat/completions". The two defaults disagree about who owns the
-// version segment, so a base_url that produces a working chat URL produces
-// "/v1/v1/images/generations" and a 404.
-func TestComposeImageEndpoint(t *testing.T) {
-	cases := []struct {
-		base string
-		want string
-	}{
-		// base without a version: the absolute default composes correctly.
-		{"https://h", ""},
-		// base WITH a version: the default would double it, so the
-		// version-relative form is written instead.
-		{"https://h/v1", "/images/generations"},
-		{"https://h/v1beta", "/images/generations"},
-		// A real path segment that merely starts with v is not a version.
-		{"https://h/vision", ""},
-	}
-	for _, tc := range cases {
-		got := composeImageEndpoint(tc.base)
-		if got != tc.want {
-			t.Errorf("composeImageEndpoint(%q) = %q, want %q", tc.base, got, tc.want)
-		}
-		// Whatever it decided, base + result must not contain a doubled
-		// version segment — that is the bug this function exists for.
-		joined := tc.base + got
-		if strings.Contains(joined, "/v1/v1") {
-			t.Errorf("composed %q contains a doubled version segment", joined)
-		}
-	}
-}
-
-// TestDiscoveryReportsImageEndpointWhenBaseCarriesVersion is the end-to-end
-// version: a pasted base_url with "/v1" must come back with an image endpoint,
-// or the image models it reported will all 404 on use.
-func TestDiscoveryReportsImageEndpointWhenBaseCarriesVersion(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/v1/models" {
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		_, _ = w.Write([]byte(realCatalogBody))
-	}))
-	defer srv.Close()
-
-	res, err := DiscoverModels(context.Background(), srv.URL+"/v1", "k")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(res.ImageModels) == 0 {
-		t.Fatal("fixture must contain image models for this to mean anything")
-	}
-	if res.BaseURL != srv.URL+"/v1" {
-		t.Fatalf("base = %q, want the typed URL with /v1", res.BaseURL)
-	}
-	if res.ImageEndpoint != "/images/generations" {
-		t.Errorf("image_endpoint = %q, want %q (otherwise the reported image models all 404)",
-			res.ImageEndpoint, "/images/generations")
-	}
-	// The chat side stays empty: base already carries /v1 and the adapter's
-	// relative default composes.
-	if res.Endpoint != "" {
-		t.Errorf("endpoint = %q, want empty", res.Endpoint)
-	}
-}
-
-// TestDiscoveryResult_NilSlicesSerializeAsArrays covers the zero value of
-// discoveryResult, which is what a caller gets if it builds one directly
-// instead of going through DiscoverModels. DiscoverModels happens to
-// initialize the slices, so testing only that path would let the MarshalJSON
-// nil guard look redundant — and removing it would ship a latent UI bug the
-// first time some other caller builds the struct.
-func TestDiscoveryResult_NilSlicesSerializeAsArrays(t *testing.T) {
-	b, err := json.Marshal(&discoveryResult{BaseURL: "https://h"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(b)
-	for _, want := range []string{`"models":[]`, `"image_models":[]`, `"tried":[]`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("zero value serialized %s\nwant %s — a nil slice becomes JSON null and the UI renders \"undefined\"", got, want)
-		}
-	}
-	for _, bad := range []string{`"models":null`, `"image_models":null`, `"tried":null`} {
-		if strings.Contains(got, bad) {
-			t.Errorf("serialized %s, which the UI cannot concatenate", bad)
-		}
-	}
-}
-
-// TestDiscoveryResultJSONShape pins the field names the WebUI will bind to.
-func TestDiscoveryResultJSONShape(t *testing.T) {
-	b, err := json.Marshal(&discoveryResult{
-		BaseURL: "https://h", Models: []string{"a"}, ImageModels: []string{},
-		ModelsPath: "/models", Adapter: "openai",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(b, &got); err != nil {
-		t.Fatal(err)
-	}
-	// image_models must serialize as [] and never null: the UI does
-	// out.concat(image_models) and null would render "undefined".
-	if v, ok := got["image_models"]; !ok || v == nil {
-		t.Errorf("image_models = %v, want an empty array (null breaks concat in the UI)", v)
-	}
-	for _, k := range []string{"base_url", "endpoint", "models", "image_models", "models_path", "tried"} {
-		if _, ok := got[k]; !ok {
-			t.Errorf("missing field %q in discovery response", k)
-		}
-	}
-}

internal/gateway/gateway_test.go

@@ -58,7 +58,7 @@ func newTestGateway(t *testing.T, srcs ...config.Source) *Gateway {
 		t.Fatalf("core: %v", err)
 	}
 	t.Cleanup(c.Close)
-	g, err := New(c)
+	g, err := New(c, []string{"sk-test"})
 	if err != nil {
 		t.Fatalf("gateway: %v", err)
 	}

internal/gateway/gui_contract_test.go

@@ -1,192 +0,0 @@
-package gateway
-
-import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-// The Electron shell (cmd/gui) had NO tests at all, so the plugin panel went in
-// with references to CSS classes that do not exist (.tag, .sm) and to helper
-// functions that were never defined in that document (esc / escAttr). All of
-// it rendered as unstyled text and would have thrown a ReferenceError at click
-// time — and none of that is visible without opening the app.
-//
-// These tests are deliberately static. They do not launch Electron: what they
-// guard is the class of mistake that "looks fine until someone themes it",
-// which is exactly what a missing CSS class or a missing helper is.
-
-func guiFile(t *testing.T, rel string) string {
-	t.Helper()
-	// The tests live in internal/gateway, so walk up to the repo root.
-	p := filepath.Join("..", "..", rel)
-	b, err := os.ReadFile(p)
-	if err != nil {
-		t.Skipf("%s not readable: %v", rel, err)
-	}
-	return string(b)
-}
-
-// classUseRe finds class="..." occurrences in a document.
-var classUseRe = regexp.MustCompile(`class="([^"]+)"`)
-
-// classTokenRe matches ANY ".name" inside the stylesheet. Deliberately loose:
-// it also matches inside compound selectors (".tb-btn.tb-close:hover" must count
-// as defining .tb-close, which a "must be at the start of a selector" rule
-// misses) and inside comments, which only ever makes the check MORE permissive.
-// A false pass here would be bad, so the strictness lives elsewhere: the
-// variable below is what actually guards the new code.
-var classTokenRe = regexp.MustCompile(`\.([A-Za-z_][A-Za-z0-9_-]*)`)
-
-// guiKnownUnstyled lists classes the shell markup has always used with no
-// matching rule. They are pre-existing cosmetic gaps, not regressions, and
-// failing on them would make this test useless as a guard for NEW work.
-var guiKnownUnstyled = map[string]bool{
-	"blob": true, // decorative blur blobs, styled per-instance via .b1/.b2/.b3
-	"tgl":  true, // rail toggle affordance that leaned on .rail-btn
-	"rail": true, // the rail container itself has no rule; .rail-btn children carry the look
-}
-
-// TestGUICSSClassesExist is the guard that would have caught .tag and .sm: every
-// class used in the shell's markup must be defined in its stylesheet.
-//
-// The comparison is on the LAST segment of a selector, because the stylesheet
-// scopes things (`.form .actions .primary`, `#bgfx .b1`): a rule for
-// `.pl-acts button` defines no class at all, and `.form .row .toggle` defines
-// `.toggle`. Requiring a top-level class would be too strict; requiring that
-// some selector's last identifier matches is the right level.
-func TestGUICSSClassesExist(t *testing.T) {
-	html := guiFile(t, "cmd/gui/renderer/index.html")
-	css := guiFile(t, "cmd/gui/renderer/style.css")
-
-	defined := map[string]bool{}
-
-	// Collect every class token that appears at the START of a selector
-	// position. A full CSS parser is overkill and was the source of two wrong
-	// turns here; what the check needs is simply "does the name .foo appear
-	// anywhere in the stylesheet as a selector component".
-	//
-	// Scoping is respected loosely: `.form .actions .primary` counts as
-	// defining `.primary`, and `.pl-acts button` defines no class — which is
-	// exactly why the plugin panel needed its own rules.
-	for _, m := range classTokenRe.FindAllStringSubmatch(css, -1) {
-		defined[m[1]] = true
-	}
-	if len(defined) == 0 {
-		t.Fatal("no classes parsed from the stylesheet; the check is broken")
-	}
-
-	// Classes the JS builds as strings must exist too.
-	js := guiFile(t, "cmd/gui/renderer/app.js")
-	var missing []string
-	seen := map[string]bool{}
-	note := func(cls, where string) {
-		// A "${...}" token is a template literal being spliced at runtime, not
-		// a class name; the classes it can expand to are checked at their
-		// definition sites instead.
-		if cls == "" || strings.ContainsAny(cls, "${}") || seen[cls] {
-			return
-		}
-		seen[cls] = true
-		if guiKnownUnstyled[cls] {
-			return
-		}
-		if !defined[cls] {
-			missing = append(missing, cls+" ("+where+")")
-		}
-	}
-	for _, m := range classUseRe.FindAllStringSubmatch(html, -1) {
-		for _, c := range strings.Fields(m[1]) {
-			note(c, "index.html")
-		}
-	}
-	for _, m := range classUseRe.FindAllStringSubmatch(js, -1) {
-		for _, c := range strings.Fields(m[1]) {
-			note(c, "app.js")
-		}
-	}
-	if len(missing) > 0 {
-		t.Errorf("classes used but not defined in style.css (they render unstyled):\n  %s",
-			strings.Join(missing, "\n  "))
-	}
-}
-
-// TestGUIHelperFunctionsAreDefined catches the other half: renderer/app.js is a
-// separate document from the WebUI, so it does NOT have the WebUI's esc/escAttr.
-// Referencing them gives a ReferenceError only when the line runs.
-func TestGUIHelperFunctionsAreDefined(t *testing.T) {
-	js := guiFile(t, "cmd/gui/renderer/app.js")
-	for _, fn := range []string{"esc", "escAttr", "toast", "loadPlugins", "togglePlugin", "enableAllPlugins"} {
-		defined := regexp.MustCompile(`function ` + fn + `\b`).MatchString(js)
-		called := regexp.MustCompile(`\b` + fn + `\s*\(`).MatchString(js)
-		if called && !defined {
-			t.Errorf("%s() is called but never defined in app.js", fn)
-		}
-		if !called && !defined {
-			// A defined-but-unused helper is dead code, not an error.
-			continue
-		}
-	}
-}
-
-// TestGUIPluginPanelIsReachable: the panel must be inside the settings overlay
-// AND the settings overlay must actually open it. A panel wired to a button
-// that was never bound is invisible-but-present, which passes a grep review.
-func TestGUIPluginPanelIsReachable(t *testing.T) {
-	html := guiFile(t, "cmd/gui/renderer/index.html")
-	js := guiFile(t, "cmd/gui/renderer/app.js")
-	if !strings.Contains(html, `id="pl-list"`) {
-		t.Error("no #pl-list in the settings overlay")
-	}
-	if !strings.Contains(html, `id="settings-overlay"`) {
-		t.Fatal("the settings overlay is gone")
-	}
-	// inside the overlay: the element index must come after the overlay's
-	if strings.Index(html, `id="settings-overlay"`) > strings.Index(html, `id="pl-list"`) {
-		t.Error("#pl-list appears before the settings overlay, so it renders outside the panel")
-	}
-	// The buttons must be bound.
-	for _, id := range []string{"pl-reload", "pl-toggle-all"} {
-		if !strings.Contains(html, `id="`+id+`"`) {
-			t.Errorf("#%s is missing from the markup", id)
-		}
-		if !strings.Contains(js, `"`+id+`"`) {
-			t.Errorf("#%s exists but app.js never binds it", id)
-		}
-	}
-	// And openSettings must trigger the load, or the panel shows a stale empty
-	// list on every open.
-	if !strings.Contains(js, "loadPlugins()") {
-		t.Error("app.js never calls loadPlugins()")
-	}
-}
-
-// TestGUIIPCPathIsConstrained: plugins:proxy is a raw pass-through, which is
-// convenient but would be a hole if it accepted arbitrary paths. The main
-// process must reject anything outside /api/plugins and any traversal.
-func TestGUIIPCPathIsConstrained(t *testing.T) {
-	main := guiFile(t, "cmd/gui/main.js")
-	for _, needle := range []string{
-		`path.startsWith("/api/plugins")`,
-		`path.includes("..")`,
-		"plugins:proxy",
-		"unsealViaCore()",
-	} {
-		if !strings.Contains(main, needle) {
-			t.Errorf("cmd/gui/main.js is missing the guard %q", needle)
-		}
-	}
-	// The plugins channel must be a proxy, not a key passthrough: the renderer
-	// sends (method, path) and the main process attaches the key.
-	//
-	// NOTE: preload does expose a pre-existing `core.key` getter — the shell
-	// needs the admin key to load the embedded WebUI without a login. That is
-	// existing, deliberate design and out of scope here; asserting on "key:" in
-	// preload would flag a pre-existing feature as a new hole.
-	pre := guiFile(t, "cmd/gui/preload.js")
-	if !strings.Contains(pre, "request: (method, path, body)") {
-		t.Error("preload does not expose the plugins request proxy")
-	}
-}

internal/gateway/key_auto_api_test.go

@@ -1,257 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// Per-key AUTO chain admin API. The behaviours pinned here are the ones that
-// are easy to get wrong and invisible when they are:
-//
-//   - /api/keys/me/auto must be reachable by a NON-admin (it is their own
-//     chain); routing it through the generic {key}/auto handler would 403 it.
-//   - /api/keys/{key}/auto must 403 a non-admin.
-//   - an empty PUT and a DELETE mean the same thing ("inherit global"), so the
-//     WebUI cannot persist a chain that would then 503 with no slots.
-//   - a PUT that resolves to zero slots is reported back, so an admin who
-//     mistyped a model learns it now instead of from the user's next 503.
-
-// keyAutoGateway builds a gateway with one admin key and one user key.
-func keyAutoGateway(t *testing.T) *Gateway {
-	t.Helper()
-	td := t.TempDir()
-	cfgPath := filepath.Join(td, "config.yaml")
-	if err := os.WriteFile(cfgPath, []byte("listen: :0"), 0644); err != nil {
-		t.Fatal(err)
-	}
-	cfg := &config.Config{
-		Path:         cfgPath,
-		AdapterDir:   filepath.Join(td, "adapters"),
-		RuntimeFile:  filepath.Join(td, "runtime.json"),
-		DefaultModel: "AUTO",
-		GatewayKeys:  []string{"sk-admin"},
-		Keys: []config.GWKey{
-			{Key: "sk-admin", Role: "admin", Name: "admin"},
-			{Key: "sk-user", Role: "user", Name: "user"},
-		},
-		Sources: []config.Source{
-			{Name: "s1", BaseURL: "http://127.0.0.1:1/v1", Adapter: "openai",
-				Models: []config.Model{{ID: "gpt-4o", Priority: 10}, {ID: "gpt-4o-mini", Priority: 5}}},
-		},
-	}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g
-}
-
-// doReqAs issues an authenticated request as a specific key.
-func doReqAs(t *testing.T, g *Gateway, key, method, path, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	req, _ := http.NewRequest(method, path, strings.NewReader(body))
-	req.Header.Set("Authorization", "Bearer "+key)
-	if body != "" {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	rr := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rr, req)
-	return rr
-}
-
-func TestKeyAutoAPIPermissions(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	// A user may read their own chain...
-	if rr := doReqAs(t, g, "sk-user", "GET", "/api/keys/me/auto", ""); rr.Code != http.StatusOK {
-		t.Fatalf("GET /api/keys/me/auto as user = %d, want 200 (body %s)", rr.Code, rr.Body.String())
-	}
-	// ...but not another key's.
-	if rr := doReqAs(t, g, "sk-user", "GET", "/api/keys/sk-admin/auto", ""); rr.Code != http.StatusForbidden {
-		t.Fatalf("GET other key's auto as user = %d, want 403", rr.Code)
-	}
-	// ...and not their own via the admin route either.
-	if rr := doReqAs(t, g, "sk-user", "PUT", "/api/keys/sk-user/auto", `{"auto":[{"model":"gpt-4o"}]}`); rr.Code != http.StatusForbidden {
-		t.Fatalf("user PUT own auto = %d, want 403 (only admin configures)", rr.Code)
-	}
-}
-
-func TestKeyAutoAPICrudAndInherit(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	// Initially inherits.
-	var got struct {
-		Inherits bool                `json:"inherits"`
-		Auto     []config.ModelScope `json:"auto"`
-	}
-	rr := doReqAs(t, g, "sk-admin", "GET", "/api/keys/sk-user/auto", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("GET = %d: %s", rr.Code, rr.Body.String())
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if !got.Inherits || len(got.Auto) != 0 {
-		t.Fatalf("fresh key must inherit global, got inherits=%v auto=%v", got.Inherits, got.Auto)
-	}
-
-	// Admin sets a chain; the response reports the resolved slot count.
-	rr = doReqAs(t, g, "sk-admin", "PUT", "/api/keys/sk-user/auto",
-		`{"auto":[{"model":"gpt-4o-mini","source":"s1","tier":1}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("PUT = %d: %s", rr.Code, rr.Body.String())
-	}
-	var put struct {
-		Inherits bool `json:"inherits"`
-		Slots    int  `json:"slots"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &put); err != nil {
-		t.Fatal(err)
-	}
-	if put.Inherits {
-		t.Fatal("after a non-empty PUT the key must no longer inherit")
-	}
-	if put.Slots != 1 {
-		t.Fatalf("resolved slots = %d, want 1", put.Slots)
-	}
-
-	// And it reads back as an own chain.
-	rr = doReqAs(t, g, "sk-admin", "GET", "/api/keys/sk-user/auto", "")
-	if err := json.Unmarshal(rr.Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if got.Inherits || len(got.Auto) != 1 || got.Auto[0].Model != "gpt-4o-mini" {
-		t.Fatalf("own chain must read back, got inherits=%v auto=%v", got.Inherits, got.Auto)
-	}
-
-	// DELETE restores inheritance.
-	if rr := doReqAs(t, g, "sk-admin", "DELETE", "/api/keys/sk-user/auto", ""); rr.Code != http.StatusOK {
-		t.Fatalf("DELETE = %d: %s", rr.Code, rr.Body.String())
-	}
-	rr = doReqAs(t, g, "sk-admin", "GET", "/api/keys/sk-user/auto", "")
-	if err := json.Unmarshal(rr.Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if !got.Inherits {
-		t.Fatal("after DELETE the key must inherit the global chain again")
-	}
-}
-
-// An empty PUT must behave like DELETE. Otherwise a WebUI that submits an
-// empty list (every slot deleted in the editor) would persist an empty chain
-// and the next AUTO request would fail with no_provider.
-func TestKeyAutoAPIEmptyPutClearsOverride(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	if rr := doReqAs(t, g, "sk-admin", "PUT", "/api/keys/sk-user/auto",
-		`{"auto":[{"model":"gpt-4o","source":"s1","tier":1}]}`); rr.Code != http.StatusOK {
-		t.Fatalf("seed PUT = %d: %s", rr.Code, rr.Body.String())
-	}
-	rr := doReqAs(t, g, "sk-admin", "PUT", "/api/keys/sk-user/auto", `{"auto":[]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("empty PUT = %d: %s", rr.Code, rr.Body.String())
-	}
-	var got struct {
-		Inherits bool `json:"inherits"`
-	}
-	if rr := doReqAs(t, g, "sk-admin", "GET", "/api/keys/sk-user/auto", ""); rr.Code != http.StatusOK {
-		t.Fatal(rr.Body.String())
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if !got.Inherits {
-		t.Fatal("an empty PUT must clear the override, not persist an empty chain")
-	}
-}
-
-// A chain naming a model that does not exist compiles to zero slots. The API
-// must say so at write time instead of letting the user's next request 503.
-func TestKeyAutoAPIReportsUnresolvableSlots(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	rr := doReqAs(t, g, "sk-admin", "PUT", "/api/keys/sk-user/auto",
-		`{"auto":[{"model":"does-not-exist","source":"s1","tier":1}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("PUT = %d: %s", rr.Code, rr.Body.String())
-	}
-	var put struct {
-		Inherits bool `json:"inherits"`
-		Slots    int  `json:"slots"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &put); err != nil {
-		t.Fatal(err)
-	}
-	if put.Slots != 0 {
-		t.Fatalf("unknown model must resolve to 0 slots, got %d", put.Slots)
-	}
-}
-
-func TestKeyAutoAPIUnknownKey404(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	if rr := doReqAs(t, g, "sk-admin", "GET", "/api/keys/sk-nope/auto", ""); rr.Code != http.StatusNotFound {
-		t.Fatalf("GET unknown key auto = %d, want 404", rr.Code)
-	}
-	if rr := doReqAs(t, g, "sk-admin", "PUT", "/api/keys/sk-nope/auto", `{"auto":[{"model":"gpt-4o"}]}`); rr.Code != http.StatusNotFound {
-		t.Fatalf("PUT unknown key auto = %d, want 404", rr.Code)
-	}
-}
-
-// A bad quota must be rejected with 400, not persisted and not silently
-// clamped — same rule as the model scope path.
-func TestKeyAutoAPIRejectsBadQuota(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	rr := doReqAs(t, g, "sk-admin", "PUT", "/api/keys/sk-user/auto",
-		`{"auto":[{"model":"gpt-4o","source":"s1","tier":1,"token_quota":-1}]}`)
-	if rr.Code != http.StatusBadRequest {
-		t.Fatalf("negative quota PUT = %d, want 400 (body %s)", rr.Code, rr.Body.String())
-	}
-	// Nothing may have been persisted.
-	var got struct {
-		Inherits bool `json:"inherits"`
-	}
-	get := doReqAs(t, g, "sk-admin", "GET", "/api/keys/sk-user/auto", "")
-	if get.Code != http.StatusOK {
-		t.Fatal(get.Body.String())
-	}
-	if err := json.Unmarshal(get.Body.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if !got.Inherits {
-		t.Fatal("a rejected PUT must not persist a chain")
-	}
-}
-
-// The other key endpoints must keep working: the {key}/auto route must not
-// shadow /api/keys/{key} itself.
-func TestKeyAutoAPIDoesNotShadowKeyRoutes(t *testing.T) {
-	g := keyAutoGateway(t)
-
-	if rr := doReqAs(t, g, "sk-admin", "GET", "/api/keys", ""); rr.Code != http.StatusOK {
-		t.Fatalf("GET /api/keys = %d, want 200", rr.Code)
-	}
-	if rr := doReqAs(t, g, "sk-admin", "GET", "/api/keys/me", ""); rr.Code != http.StatusOK {
-		t.Fatalf("GET /api/keys/me = %d, want 200", rr.Code)
-	}
-	if rr := doReqAs(t, g, "sk-user", "GET", "/api/keys/me", ""); rr.Code != http.StatusOK {
-		t.Fatalf("GET /api/keys/me as user = %d, want 200", rr.Code)
-	}
-}

internal/gateway/key_quota_api_test.go

@@ -1,253 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// adminGateway builds a gateway whose admin key can call /api/keys.
-func adminGateway(t *testing.T, keys ...config.GWKey) *Gateway {
-	t.Helper()
-	td := t.TempDir()
-	cfgPath := td + "/config.yaml"
-	if err := os.WriteFile(cfgPath, []byte("listen: :0"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	cfg := &config.Config{
-		Path:        cfgPath,
-		AdapterDir:  td + "/adapters",
-		RuntimeFile: td + "/runtime.json",
-		Keys:        keys,
-	}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g
-}
-
-func adminReq(t *testing.T, g *Gateway, method, path, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	req, _ := http.NewRequest(method, path, strings.NewReader(body))
-	req.Header.Set("Authorization", "Bearer sk-admin")
-	req.Header.Set("Content-Type", "application/json")
-	rr := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rr, req)
-	return rr
-}
-
-// keyRecord pulls one key's stored record out of the admin list.
-func keyRecord(t *testing.T, g *Gateway, secret string) config.GWKey {
-	t.Helper()
-	rr := adminReq(t, g, "GET", "/api/keys", "")
-	if rr.Code != 200 {
-		t.Fatalf("GET /api/keys: %d %s", rr.Code, rr.Body.String())
-	}
-	var out struct {
-		Keys []config.GWKey `json:"keys"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &out); err != nil {
-		t.Fatalf("decode: %v (%s)", err, rr.Body.String())
-	}
-	for _, k := range out.Keys {
-		if k.Key == secret {
-			return k
-		}
-	}
-	t.Fatalf("key %q not found in %s", secret, rr.Body.String())
-	return config.GWKey{}
-}
-
-func scopeOf(t *testing.T, k config.GWKey, model string) config.ModelScope {
-	t.Helper()
-	for _, m := range k.Models {
-		if m.Model == model {
-			return m
-		}
-	}
-	t.Fatalf("scope %q not found in %+v", model, k.Models)
-	return config.ModelScope{}
-}
-
-// Quotas live on the scope entries, not on the key: creating a key with a
-// budget means creating scopes that carry it, and they must survive a
-// read-back (persisted, not just echoed).
-func TestKeyAPICreatesPerModelQuota(t *testing.T) {
-	g := adminGateway(t, config.GWKey{Key: "sk-admin", Role: "admin"})
-	rr := adminReq(t, g, "POST", "/api/keys",
-		`{"name":"agent-x","role":"user","models":[{"model":"m1","token_quota":50000,"req_quota":200,"period":"nhour","hours":6}]}`)
-	if rr.Code != 200 {
-		t.Fatalf("create: %d %s", rr.Code, rr.Body.String())
-	}
-	var created struct {
-		Key config.GWKey `json:"key"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &created); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	sc := scopeOf(t, created.Key, "m1")
-	if sc.TokenQuota != 50000 || sc.ReqQuota != 200 || sc.Period != "nhour" || sc.Hours != 6 {
-		t.Fatalf("created scope did not carry the caps: %+v", sc)
-	}
-	back := scopeOf(t, keyRecord(t, g, created.Key.Key), "m1")
-	if back.TokenQuota != 50000 || back.ReqQuota != 200 || back.Period != "nhour" || back.Hours != 6 {
-		t.Errorf("read-back lost the caps: %+v", back)
-	}
-}
-
-// Two models on one key carry independent budgets.
-func TestKeyAPIKeepsPerModelQuotaIndependent(t *testing.T) {
-	g := adminGateway(t, config.GWKey{Key: "sk-admin", Role: "admin"})
-	rr := adminReq(t, g, "POST", "/api/keys",
-		`{"name":"agent-y","role":"user","models":[{"model":"m1","token_quota":1000,"period":"hour"},{"model":"m2","token_quota":9999,"req_quota":7,"period":"week"}]}`)
-	if rr.Code != 200 {
-		t.Fatalf("create: %d %s", rr.Code, rr.Body.String())
-	}
-	var created struct {
-		Key config.GWKey `json:"key"`
-	}
-	_ = json.Unmarshal(rr.Body.Bytes(), &created)
-	back := keyRecord(t, g, created.Key.Key)
-	if a := scopeOf(t, back, "m1"); a.TokenQuota != 1000 || a.ReqQuota != 0 || a.Period != "hour" {
-		t.Errorf("m1 caps wrong: %+v", a)
-	}
-	if b := scopeOf(t, back, "m2"); b.TokenQuota != 9999 || b.ReqQuota != 7 || b.Period != "week" {
-		t.Errorf("m2 caps wrong: %+v", b)
-	}
-}
-
-// Sending 0 explicitly lifts that model's cap.
-func TestKeyAPIUpdateZeroLiftsCap(t *testing.T) {
-	g := adminGateway(t, config.GWKey{Key: "sk-admin", Role: "admin"})
-	rr := adminReq(t, g, "POST", "/api/keys",
-		`{"name":"z","role":"user","models":[{"model":"m1","token_quota":1000,"period":"hour"}]}`)
-	if rr.Code != 200 {
-		t.Fatalf("create: %d %s", rr.Code, rr.Body.String())
-	}
-	var created struct {
-		Key config.GWKey `json:"key"`
-	}
-	_ = json.Unmarshal(rr.Body.Bytes(), &created)
-	secret := created.Key.Key
-
-	rr = adminReq(t, g, "PUT", "/api/keys/"+secret,
-		`{"models":[{"model":"m1","token_quota":0,"req_quota":0,"period":""}]}`)
-	if rr.Code != 200 {
-		t.Fatalf("lift: %d %s", rr.Code, rr.Body.String())
-	}
-	if back := scopeOf(t, keyRecord(t, g, secret), "m1"); back.TokenQuota != 0 || back.ReqQuota != 0 || back.Period != "" {
-		t.Errorf("caps not lifted: %+v", back)
-	}
-}
-
-// A misspelled period must be refused, not quietly turned into an all-time
-// quota — which is the exact opposite of what the operator typed.
-func TestKeyAPIRejectsBadPeriod(t *testing.T) {
-	g := adminGateway(t, config.GWKey{Key: "sk-admin", Role: "admin"})
-	rr := adminReq(t, g, "POST", "/api/keys",
-		`{"name":"bad","role":"user","models":[{"model":"m1","token_quota":1000,"period":"houre"}]}`)
-	if rr.Code != http.StatusBadRequest {
-		t.Fatalf("want 400 for a bad period, got %d %s", rr.Code, rr.Body.String())
-	}
-	if !strings.Contains(rr.Body.String(), "period") {
-		t.Errorf("error should name the period field: %s", rr.Body.String())
-	}
-}
-
-func TestKeyAPIRejectsNegativeQuota(t *testing.T) {
-	g := adminGateway(t, config.GWKey{Key: "sk-admin", Role: "admin"})
-	rr := adminReq(t, g, "POST", "/api/keys",
-		`{"name":"bad","role":"user","models":[{"model":"m1","token_quota":-5}]}`)
-	if rr.Code != http.StatusBadRequest {
-		t.Fatalf("want 400 for a negative quota, got %d %s", rr.Code, rr.Body.String())
-	}
-}
-
-// The rejection must say WHICH model is over budget, so an operator looking at
-// a key with a dozen scopes can tell which one to raise.
-func TestKeyAPIRejectionNamesTheModel(t *testing.T) {
-	g := adminGateway(t, config.GWKey{Key: "sk-admin", Role: "admin"})
-	rr := adminReq(t, g, "POST", "/api/keys",
-		`{"name":"bad","role":"user","models":[{"model":"m1","req_quota":-1}]}`)
-	if rr.Code != http.StatusBadRequest {
-		t.Fatalf("want 400, got %d", rr.Code)
-	}
-	if !strings.Contains(rr.Body.String(), "m1") {
-		t.Errorf("error should name the offending model: %s", rr.Body.String())
-	}
-}
-
-// A non-admin key must not be able to mint keys.
-func TestKeyAPIQuotaIsAdminOnly(t *testing.T) {
-	g := adminGateway(t,
-		config.GWKey{Key: "sk-admin", Role: "admin"},
-		config.GWKey{Key: "sk-u", Role: "user", Models: []config.ModelScope{{Model: "m1", TokenQuota: 10, Period: "hour"}}},
-	)
-	req, _ := http.NewRequest("POST", "/api/keys",
-		strings.NewReader(`{"name":"x","role":"admin","models":[{"model":"m1"}]}`))
-	req.Header.Set("Authorization", "Bearer sk-u")
-	req.Header.Set("Content-Type", "application/json")
-	rr := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rr, req)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("non-admin create: want 403, got %d %s", rr.Code, rr.Body.String())
-	}
-	// /api/v1/keys exposes the per-model caps but never a secret
-	rr = adminReq(t, g, "GET", "/api/v1/keys", "")
-	if rr.Code != 200 {
-		t.Fatalf("GET /api/v1/keys: %d", rr.Code)
-	}
-	if strings.Contains(rr.Body.String(), "sk-u") {
-		t.Error("/api/v1/keys leaked a key secret")
-	}
-	if !strings.Contains(rr.Body.String(), `"token_quota":10`) {
-		t.Errorf("/api/v1/keys should expose the per-model caps: %s", rr.Body.String())
-	}
-}
-
-// A user must be able to see their own budget: /api/keys/me is the only key
-// view a non-admin gets, so a cap missing from it is invisible to the very
-// client it constrains.
-func TestKeyMeExposesOwnQuota(t *testing.T) {
-	g := adminGateway(t,
-		config.GWKey{Key: "sk-admin", Role: "admin"},
-		config.GWKey{Key: "sk-u", Role: "user", Name: "agent",
-			Models: []config.ModelScope{{Model: "m1", TokenQuota: 123456, ReqQuota: 42, Period: "week"}}},
-	)
-	req, _ := http.NewRequest("GET", "/api/keys/me", nil)
-	req.Header.Set("Authorization", "Bearer sk-u")
-	rr := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rr, req)
-	if rr.Code != 200 {
-		t.Fatalf("GET /api/keys/me: %d %s", rr.Code, rr.Body.String())
-	}
-	// the endpoint wraps the record: {"key": {...}}
-	var wrap struct {
-		Key config.GWKey `json:"key"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &wrap); err != nil {
-		t.Fatalf("decode: %v (%s)", err, rr.Body.String())
-	}
-	sc := scopeOf(t, wrap.Key, "m1")
-	if sc.TokenQuota != 123456 || sc.ReqQuota != 42 || sc.Period != "week" {
-		t.Errorf("own quota not visible to the key's owner: %+v", sc)
-	}
-}
-
-var _ = fmt.Sprintf

internal/gateway/key_quota_concurrency_test.go

@@ -1,60 +0,0 @@
-package gateway
-
-import (
-	"sync"
-	"testing"
-	"time"
-)
-
-// The per-key quota buckets are shared maps mutated on every recorded request
-// and read on every quota check. Single-threaded unit tests cannot see a race
-// there at all, so this drives 64 goroutines through record + read together
-// under `go test -race`. It also opts one model into the lazily-created pinned
-// bucket mid-flight, which is the path that mutates two bucket maps at once.
-func TestConcurrentQuotaAccounting(t *testing.T) {
-	s := NewStats(0)
-	keys := []string{"k0", "k1", "k2", "k3", "k4", "k5", "k6"}
-	models := []string{"m0", "m1", "m2", "AUTO"}
-	var wg sync.WaitGroup
-	stop := time.Now().Add(2 * time.Second)
-
-	for w := 0; w < 64; w++ {
-		wg.Add(1)
-		go func(w int) {
-			defer wg.Done()
-			k := keys[w%len(keys)]
-			m := models[w%len(models)]
-			now := time.Now()
-			for time.Now().Before(stop) {
-				s.Record(Req{Time: now.UnixMilli(), Key: k, Model: m, Source: "src",
-					Prompt: 100, Compl: 50, OK: true, Status: 200, Type: "chat"})
-				_ = s.KeyWindowTokens(k, 3600)
-				_ = s.KeyWindowReqs(k, 3600)
-				_ = s.KeyWindowModelTokens(k, m, "", 3600)
-				_ = s.KeyWindowModelTokens(k, m, "src", 3600) // opts into the pinned bucket
-			}
-		}(w)
-	}
-	wg.Wait()
-
-	// Every recorded request must be accounted for exactly once.
-	s.mu.Lock()
-	var total int64
-	for _, hm := range s.keyHour {
-		for _, v := range hm {
-			total += v
-		}
-	}
-	recs := int64(0)
-	for _, r := range s.recs {
-		recs += r.Prompt + r.Compl
-	}
-	s.mu.Unlock()
-	if total == 0 {
-		t.Fatal("no tokens accounted")
-	}
-	t.Logf("accounted %d tokens across %d keys", total, len(keys))
-	if recs == 0 {
-		t.Error("no records retained; the concurrent writers lost work")
-	}
-}

internal/gateway/key_quota_perf_test.go

@@ -1,125 +0,0 @@
-package gateway
-
-import (
-	"math/rand"
-	"testing"
-	"time"
-)
-
-// Perf: the per-key quota bookkeeping runs on every recorded request and on
-// every quota check, so its cost lands directly on the request path. These
-// benchmarks exist to catch a regression that would make the feature
-// expensive; the numbers that matter are relative to each other and to the
-// pre-change baseline (Record was 275 ns/op with 3 allocs before this work).
-
-func BenchmarkRecordQuotaBucket(b *testing.B) {
-	s := NewStats(0)
-	r := Req{Time: time.Now().UnixMilli(), Key: "keyABC", Model: "deepseek-v4-flash",
-		Source: "deepseek", Prompt: 800, Compl: 200, OK: true, Status: 200, Type: "chat"}
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		s.Record(r)
-	}
-}
-
-// A key that has been busy for the whole 40-day retention.
-func BenchmarkRecordQuotaBucketFullRetention(b *testing.B) {
-	s := NewStats(0)
-	nowH := time.Now().Unix() / 3600
-	for h := int64(0); h < quotaRetentionHours; h++ {
-		s.Record(Req{Time: (nowH - h) * 3600 * 1000, Key: "keyABC", Model: "m1",
-			Source: "deepseek", Prompt: 100, Compl: 100, OK: true, Status: 200})
-	}
-	r := Req{Time: time.Now().UnixMilli(), Key: "keyABC", Model: "m1", Source: "deepseek",
-		Prompt: 100, Compl: 100, OK: true, Status: 200, Type: "chat"}
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		s.Record(r)
-	}
-}
-
-// The whole per-request quota check: total tokens + request count.
-func BenchmarkQuotaCheckHourly(b *testing.B) {
-	s := NewStats(0)
-	for h := 0; h < 24; h++ {
-		s.Record(Req{Time: time.Now().Add(-time.Duration(h) * time.Hour).UnixMilli(),
-			Key: "keyABC", Model: "m1", Source: "deepseek", Prompt: 100, Compl: 100, OK: true, Status: 200})
-	}
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		s.KeyWindowTokens("keyABC", 3600)
-		s.KeyWindowReqs("keyABC", 3600)
-	}
-}
-
-// A 30-day window has to visit 720 hour buckets. This is the worst case the
-// quota feature puts on the request path.
-func BenchmarkQuotaCheckMonthly(b *testing.B) {
-	s := NewStats(0)
-	nowH := time.Now().Unix() / 3600
-	for h := int64(0); h < 720; h++ {
-		s.Record(Req{Time: (nowH - h) * 3600 * 1000, Key: "keyABC", Model: "m1",
-			Prompt: 100, Compl: 100, OK: true, Status: 200})
-	}
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		s.KeyWindowTokens("keyABC", 30*24*3600)
-	}
-}
-
-// TestSumBucketsMatchesFullScan is the correctness guard for the optimization
-// that made the quota check proportional to the window instead of to the whole
-// retention: the windowed sum must agree with a full scan for every bucket
-// placement, or a quota would silently start letting traffic through. It
-// caught a real off-by-one (floor instead of ceil on the first hour).
-func TestSumBucketsMatchesFullScan(t *testing.T) {
-	const hour = 3600
-	base := int64(1_700_000_000) / hour * hour
-	rng := rand.New(rand.NewSource(7))
-	for trial := 0; trial < 400; trial++ {
-		hm := map[int64]int64{}
-		for i, n := 0, rng.Intn(40)+1; i < n; i++ {
-			h := base/hour - int64(rng.Intn(1200))
-			hm[h] += int64(rng.Intn(1000)) + 1
-		}
-		now := base + int64(rng.Intn(hour))
-		for _, sec := range []int64{3600, 2 * 3600, 6 * 3600, 24 * 3600, 7 * 24 * 3600, 30 * 24 * 3600} {
-			var want int64
-			cut := now - sec
-			for h, v := range hm {
-				if h*hour >= cut {
-					want += v
-				}
-			}
-			if got := sumBuckets(hm, now, sec); got != want {
-				t.Fatalf("trial %d sec=%d: sumBuckets=%d, full scan=%d", trial, sec, got, want)
-			}
-		}
-	}
-}
-
-// The pinned bucket is maintained only for (key, model) pairs whose quota pins
-// a source. Doing it unconditionally doubled the bucket count — measured at
-// 26.7 MB for 20 keys x 8 models x 3 sources at full retention, against a
-// documented ~32 MB total memory budget — to serve a lookup nobody performs.
-func TestPinnedBucketNotMaintainedUnlessWanted(t *testing.T) {
-	s := NewStats(100)
-	now := time.Now().UnixMilli()
-	for i := 0; i < 5; i++ {
-		s.Record(Req{Time: now, Key: "keyA", Model: "m1", Source: "srcX", Prompt: 100, Compl: 100, OK: true, Status: 200})
-	}
-	s.mu.Lock()
-	_, pinned := s.keyModelHour["keyA"]["srcX::m1"]
-	_, bare := s.keyModelHour["keyA"]["m1"]
-	s.mu.Unlock()
-	if pinned {
-		t.Error("a pinned bucket exists before any quota read the pin — memory regression")
-	}
-	if !bare {
-		t.Error("the bare-model bucket must always exist; an unpinned quota depends on it")
-	}
-}

internal/gateway/key_quota_test.go

@@ -1,225 +0,0 @@
-package gateway
-
-import (
-	"testing"
-	"time"
-
-	"llmsproxy/internal/config"
-)
-
-// ---- data layer: per-key isolation ----
-
-func TestKeyWindowTokensIsolatesKeys(t *testing.T) {
-	s := NewStats(100)
-	now := time.Now().UnixMilli()
-	s.Record(Req{Time: now, Key: "keyA", Model: "m1", Prompt: 500, Compl: 500, OK: true, Status: 200})
-	s.Record(Req{Time: now, Key: "keyB", Model: "m1", Prompt: 500, Compl: 500, OK: true, Status: 200})
-
-	if got := s.KeyWindowModelTokens("keyA", "m1", "", 3600); got != 1000 {
-		t.Errorf("keyA model tokens = %d, want 1000 (its own usage only)", got)
-	}
-	if got := s.KeyWindowModelTokens("keyB", "m1", "", 3600); got != 1000 {
-		t.Errorf("keyB model tokens = %d, want 1000", got)
-	}
-	// the key-blind bucket stays global on purpose: it backs the AUTO slot
-	// quota, which limits the whole gateway, not one key.
-	if got := s.WindowTokens("m1", "", 3600); got != 2000 {
-		t.Errorf("WindowTokens = %d, want 2000 (global per-model total must be unchanged)", got)
-	}
-}
-
-// A source pin scopes the cap to that one upstream. The pinned bucket is
-// maintained lazily (it is only read by quotas that actually pin a source), so
-// usage recorded before anything queried the pin is not attributed to it.
-func TestKeyWindowTokensSeparatesSourcePin(t *testing.T) {
-	s := NewStats(100)
-	now := time.Now().UnixMilli()
-	s.Record(Req{Time: now, Key: "keyA", Model: "m1", Source: "srcX", Prompt: 100, Compl: 100, OK: true, Status: 200}) // 200 tok
-	s.Record(Req{Time: now, Key: "keyA", Model: "m1", Source: "srcY", Prompt: 200, Compl: 200, OK: true, Status: 200}) // 400 tok
-
-	// The unpinned bucket always counts — it is what a scope entry without a
-	// source pin reads. 200 + 400.
-	if got := s.KeyWindowModelTokens("keyA", "m1", "", 3600); got != 600 {
-		t.Errorf("unpinned model tokens = %d, want 600 (both sources)", got)
-	}
-
-	// Reading a pin opts this (key, model) into pinned accounting.
-	if got := s.KeyWindowModelTokens("keyA", "m1", "srcX", 3600); got != 0 {
-		t.Errorf("srcX pin before opt-in = %d, want 0 (the lazy bucket has not accrued yet)", got)
-	}
-
-	// From now on both pins accrue.
-	more := now + 1
-	s.Record(Req{Time: more, Key: "keyA", Model: "m1", Source: "srcX", Prompt: 10, Compl: 10, OK: true, Status: 200}) // 20 tok
-	s.Record(Req{Time: more, Key: "keyA", Model: "m1", Source: "srcY", Prompt: 30, Compl: 30, OK: true, Status: 200}) // 60 tok
-	if got := s.KeyWindowModelTokens("keyA", "m1", "srcX", 3600); got != 20 {
-		t.Errorf("srcX-pinned tokens after opt-in = %d, want 20", got)
-	}
-	if got := s.KeyWindowModelTokens("keyA", "m1", "srcY", 3600); got != 60 {
-		t.Errorf("srcY-pinned tokens = %d, want 60 (a pin read for one source must not blind the other)", got)
-	}
-}
-
-// This is the shape of every real chat record: Source is always populated.
-// The unpinned bucket must still see the tokens, or a per-model quota without
-// a source pin reads an empty bucket and never trips.
-func TestKeyWindowModelTokensUnpinnedSeesSourcedTraffic(t *testing.T) {
-	s := NewStats(100)
-	s.Record(Req{Time: time.Now().UnixMilli(), Key: "keyA", Model: "m1", Source: "deepseek",
-		Prompt: 1000, Compl: 1000, OK: true, Status: 200})
-
-	if got := s.KeyWindowModelTokens("keyA", "m1", "", 3600); got != 2000 {
-		t.Errorf("unpinned tokens = %d, want 2000 — an unpinned per-model quota would never trip otherwise", got)
-	}
-}
-
-func TestKeyWindowRespectsResetWindow(t *testing.T) {
-	s := NewStats(100)
-	old := time.Now().Add(-30 * 24 * time.Hour).UnixMilli()
-	s.Record(Req{Time: old, Key: "keyA", Model: "m1", Prompt: 100, Compl: 100, OK: true, Status: 200})
-	s.Record(Req{Time: time.Now().UnixMilli(), Key: "keyA", Model: "m1", Prompt: 5, Compl: 5, OK: true, Status: 200})
-
-	if got := s.KeyWindowTokens("keyA", 3600); got != 10 {
-		t.Errorf("1h window = %d, want 10 (30-day-old usage must not count)", got)
-	}
-	if got := s.KeyWindowTokens("keyA", 0); got != 210 {
-		t.Errorf("all-time total = %d, want 210", got)
-	}
-}
-
-func TestKeyWindowReqsCountsEveryRequest(t *testing.T) {
-	s := NewStats(100)
-	now := time.Now().UnixMilli()
-	// a failed request and an image request both count: a client that loops on
-	// failures must still burn its request quota
-	s.Record(Req{Time: now, Key: "keyA", Model: "m1", Type: "chat", OK: true, Status: 200})
-	s.Record(Req{Time: now, Key: "keyA", Model: "m1", Type: "chat", OK: false, Status: 500})
-	s.Record(Req{Time: now, Key: "keyA", Model: "img", Type: "image", OK: true, Status: 200})
-	s.Record(Req{Time: now, Key: "keyB", Model: "m1", Type: "chat", OK: true, Status: 200})
-
-	if got := s.KeyWindowReqs("keyA", 3600); got != 3 {
-		t.Errorf("keyA reqs = %d, want 3 (chat ok + chat fail + image)", got)
-	}
-	if got := s.KeyWindowReqs("keyB", 3600); got != 1 {
-		t.Errorf("keyB reqs = %d, want 1", got)
-	}
-}
-
-func TestKeyWindowTokensZeroTokensNotCounted(t *testing.T) {
-	s := NewStats(100)
-	now := time.Now().UnixMilli()
-	// a request that reported no usage must not create a bucket entry
-	s.Record(Req{Time: now, Key: "keyA", Model: "", Type: "chat", OK: true, Status: 200})
-	if got := s.KeyWindowTokens("keyA", 3600); got != 0 {
-		t.Errorf("tokens = %d, want 0", got)
-	}
-	if got := s.KeyWindowReqs("keyA", 3600); got != 1 {
-		t.Errorf("reqs = %d, want 1 (request still happened)", got)
-	}
-}
-
-// ---- reset window arithmetic ----
-
-func TestAutoSecondsToReset(t *testing.T) {
-	if got := AutoSecondsToReset("", 0); got != 0 {
-		t.Errorf("no period = %d, want 0 (never resets -> no retry hint)", got)
-	}
-	now := time.Now().Unix()
-	for _, tc := range []struct {
-		period string
-		hours  int64
-		want   int64
-	}{
-		{"hour", 0, 3600},
-		{"week", 0, 7 * 24 * 3600},
-		{"month", 0, 30 * 24 * 3600},
-		{"nhour", 6, 6 * 3600},
-	} {
-		got := AutoSecondsToReset(tc.period, tc.hours)
-		if got <= 0 || got > tc.want {
-			t.Errorf("AutoSecondsToReset(%q,%d) = %d, want in (0,%d]", tc.period, tc.hours, got, tc.want)
-		}
-		// must never exceed the window itself
-		if got < tc.want-now%3600 {
-			t.Logf("note: %q hint %ds < remaining-window %ds (rounds to hour boundary)", tc.period, got, tc.want-now%3600)
-		}
-		if got > tc.want {
-			t.Errorf("hint %d exceeds window %d", got, tc.want)
-		}
-	}
-	_ = now
-}
-
-func TestAutoSecondsToResetNeverExceedsWindow(t *testing.T) {
-	// "nhour" with a tiny window must not hand out a longer wait than the
-	// window itself (which would stall a client past its own reset)
-	for hours := int64(1); hours <= 48; hours++ {
-		got := AutoSecondsToReset("nhour", hours)
-		if got <= 0 || got > hours*3600 {
-			t.Errorf("nhour/%d = %d, want in (0,%d]", hours, got, hours*3600)
-		}
-	}
-}
-
-// ---- config validation ----
-
-func TestKeyQuotaValidate(t *testing.T) {
-	cases := []struct {
-		name    string
-		q       config.KeyQuota
-		wantErr bool
-	}{
-		{"unlimited", config.KeyQuota{}, false},
-		{"tokens hourly", config.KeyQuota{TokenQuota: 1000, Period: "hour"}, false},
-		{"tokens n-hour", config.KeyQuota{TokenQuota: 1000, Period: "nhour", Hours: 6}, false},
-		{"reqs weekly", config.KeyQuota{ReqQuota: 100, Period: "week"}, false},
-		{"no period never resets", config.KeyQuota{TokenQuota: 1000}, false},
-		{"negative tokens", config.KeyQuota{TokenQuota: -1}, true},
-		{"negative reqs", config.KeyQuota{ReqQuota: -1}, true},
-		{"negative hours", config.KeyQuota{TokenQuota: 5, Hours: -1}, true},
-		{"typo period becomes all-time if accepted", config.KeyQuota{TokenQuota: 5, Period: "houre"}, true},
-		{"nhour without hours", config.KeyQuota{TokenQuota: 5, Period: "nhour"}, true},
-		{"nhour with 0 hours", config.KeyQuota{TokenQuota: 5, Period: "nhour", Hours: 0}, true},
-		{"junk period with only req quota", config.KeyQuota{ReqQuota: 5, Period: "daily"}, true},
-		{"junk period with no caps is irrelevant", config.KeyQuota{Period: "daily"}, false},
-	}
-	for _, tc := range cases {
-		err := tc.q.Validate()
-		if tc.wantErr && err == nil {
-			t.Errorf("%s: expected error, got nil", tc.name)
-		}
-		if !tc.wantErr && err != nil {
-			t.Errorf("%s: unexpected error: %v", tc.name, err)
-		}
-	}
-}
-
-func TestNormalizeRole(t *testing.T) {
-	if got := config.NormalizeRole(""); got != "user" {
-		t.Errorf("empty role = %q, want user", got)
-	}
-	if got := config.NormalizeRole("admin"); got != "admin" {
-		t.Errorf("admin role = %q, want admin", got)
-	}
-	if got := config.NormalizeRole("root"); got != "user" {
-		t.Errorf("unknown role = %q, want user (never escalate)", got)
-	}
-}
-
-// Retention must hold for the lazy pinned buckets too, or a long-lived key
-// would grow without bound.
-func TestPinnedBucketRespectsRetention(t *testing.T) {
-	s := NewStats(100)
-	_ = s.KeyWindowModelTokens("keyA", "m1", "srcX", 3600) // opt in
-	nowH := time.Now().Unix() / 3600
-	for h := int64(0); h < quotaRetentionHours+50; h++ {
-		s.Record(Req{Time: (nowH - h) * 3600 * 1000, Key: "keyA", Model: "m1", Source: "srcX",
-			Prompt: 10, Compl: 10, OK: true, Status: 200})
-	}
-	s.mu.Lock()
-	n := len(s.keyModelHour["keyA"]["srcX::m1"])
-	s.mu.Unlock()
-	if n > quotaRetentionHours {
-		t.Errorf("pinned bucket holds %d hours, want <= %d", n, quotaRetentionHours)
-	}
-}

internal/gateway/key_quota_wiring_test.go

@@ -1,444 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// quotaGateway builds a gateway with two user keys that differ only in their
-// configured caps, against one mock upstream that reports 4 tokens per call.
-func quotaGateway(t *testing.T, keyA, keyB config.GWKey) (*Gateway, *upstreamCtrl) {
-	t.Helper()
-	ctrl := &upstreamCtrl{}
-	up := upstream(t, ctrl)
-	t.Cleanup(up.Close)
-
-	td := t.TempDir()
-	cfgPath := td + "/config.yaml"
-	if err := os.WriteFile(cfgPath, []byte("listen: :0"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	cfg := &config.Config{
-		Path:        cfgPath,
-		AdapterDir:  td + "/adapters",
-		RuntimeFile: td + "/runtime.json",
-		Keys:        []config.GWKey{keyA, keyB},
-		Sources: []config.Source{{
-			Name: "up", BaseURL: up.URL, Adapter: "openai",
-			Models: []config.Model{{ID: "m1", Priority: 100}},
-		}},
-	}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g, ctrl
-}
-
-// chatAs issues a chat completion with a specific gateway key and returns the
-// recorder plus the decoded error code.
-func chatAs(t *testing.T, g *Gateway, key, model string) (*httptest.ResponseRecorder, string) {
-	t.Helper()
-	req, _ := http.NewRequest("POST", "/v1/chat/completions",
-		strings.NewReader(fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"hi"}]}`, model)))
-	req.Header.Set("Authorization", "Bearer "+key)
-	req.Header.Set("Content-Type", "application/json")
-	rr := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rr, req)
-	code := ""
-	if rr.Code != 200 {
-		var e struct {
-			Error struct {
-				Type string `json:"type"`
-			} `json:"error"`
-		}
-		_ = json.Unmarshal(rr.Body.Bytes(), &e)
-		code = e.Error.Type
-	}
-	return rr, code
-}
-
-// A key whose token budget is spent must be refused, and the refusal must be a
-// 429 the client can retry after the window rolls over — not a 403 that reads
-// as "this key may never use this model".
-func TestKeyTokenQuotaBlocksWithRetryAfter(t *testing.T) {
-	g, _ := quotaGateway(t,
-		config.GWKey{Key: "sk-a", Role: "user",
-			Models: []config.ModelScope{{Model: "m1", TokenQuota: 8, Period: "hour"}}},
-		config.GWKey{Key: "sk-b", Role: "user", Name: "b"},
-	)
-	// 4 tokens per call, budget 8 -> the third call crosses it
-	for i := 1; i <= 2; i++ {
-		rr, _ := chatAs(t, g, "sk-a", "m1")
-		if rr.Code != 200 {
-			t.Fatalf("call %d: want 200, got %d (%s)", i, rr.Code, rr.Body.String())
-		}
-	}
-	rr, code := chatAs(t, g, "sk-a", "m1")
-	if rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("third call: want 429, got %d (%s)", rr.Code, rr.Body.String())
-	}
-	if code != "rate_limit_exceeded" {
-		t.Errorf("error code = %q, want rate_limit_exceeded", code)
-	}
-	if ra := rr.Header().Get("Retry-After"); ra == "" {
-		t.Error("429 must carry Retry-After so a client knows when to come back")
-	} else if n := mustAtoi(t, ra); n <= 0 || n > 3600 {
-		t.Errorf("Retry-After = %q, want a positive value within the 1h window", ra)
-	}
-	if !strings.Contains(rr.Body.String(), "quota") {
-		t.Errorf("body should name the quota: %s", rr.Body.String())
-	}
-}
-
-// The quota is per key: exhausting one key's budget must not affect another
-// key that is allowed the same model.
-func TestKeyTokenQuotaIsIsolatedPerKey(t *testing.T) {
-	g, _ := quotaGateway(t,
-		config.GWKey{Key: "sk-a", Role: "user",
-			Models: []config.ModelScope{{Model: "m1", TokenQuota: 4, Period: "hour"}}},
-		config.GWKey{Key: "sk-b", Role: "user",
-			Models: []config.ModelScope{{Model: "m1", TokenQuota: 1000, Period: "hour"}}},
-	)
-	rr, _ := chatAs(t, g, "sk-a", "m1")
-	if rr.Code != 200 {
-		t.Fatalf("keyA first call: want 200, got %d", rr.Code)
-	}
-	if rr, code := chatAs(t, g, "sk-a", "m1"); rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("keyA second call: want 429, got %d (%s)", rr.Code, code)
-	}
-	// keyB has its own budget and must still be served
-	if rr, _ := chatAs(t, g, "sk-b", "m1"); rr.Code != 200 {
-		t.Fatalf("keyB must be unaffected by keyA's exhausted quota, got %d", rr.Code)
-	}
-}
-
-// A per-model quota inside the scope must also be per key: one key burning a
-// shared model budget must not lock the other key out.
-func TestScopeModelTokenQuotaIsolatedPerKey(t *testing.T) {
-	g, _ := quotaGateway(t,
-		config.GWKey{Key: "sk-a", Role: "user", Models: []config.ModelScope{
-			{Model: "m1", TokenQuota: 4, Period: "hour"},
-		}},
-		config.GWKey{Key: "sk-b", Role: "user", Models: []config.ModelScope{
-			{Model: "m1", TokenQuota: 4, Period: "hour"},
-		}},
-	)
-	if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != 200 {
-		t.Fatalf("keyA first call: want 200, got %d", rr.Code)
-	}
-	if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("keyA second call: want 429 (its own model quota), got %d", rr.Code)
-	}
-	// keyB shares the model but not the counter — it must be served twice too
-	if rr, _ := chatAs(t, g, "sk-b", "m1"); rr.Code != 200 {
-		t.Fatalf("keyB first call: want 200, got %d", rr.Code)
-	}
-	if rr, _ := chatAs(t, g, "sk-b", "m1"); rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("keyB second call: want 429, got %d", rr.Code)
-	}
-}
-
-// An admin key is never capped: a budget set on an admin key must not lock the
-// operator out of the gateway they administer.
-func TestAdminKeyIsNeverQuotaCapped(t *testing.T) {
-	g, _ := quotaGateway(t,
-		config.GWKey{Key: "sk-admin", Role: "admin",
-			Models: []config.ModelScope{{Model: "m1", TokenQuota: 1, ReqQuota: 1, Period: "hour"}}},
-		config.GWKey{Key: "sk-b", Role: "user"},
-	)
-	for i := 1; i <= 3; i++ {
-		if rr, _ := chatAs(t, g, "sk-admin", "m1"); rr.Code != 200 {
-			t.Fatalf("admin call %d: want 200 (admin keys are uncapped), got %d", i, rr.Code)
-		}
-	}
-}
-
-// A request quota caps sustained volume; RPM-style bursts are not its job but
-// the count must still stop the key.
-func TestKeyRequestQuotaBlocks(t *testing.T) {
-	g, ctrl := quotaGateway(t,
-		config.GWKey{Key: "sk-a", Role: "user",
-			Models: []config.ModelScope{{Model: "m1", ReqQuota: 2, Period: "hour"}}},
-		config.GWKey{Key: "sk-b", Role: "user"},
-	)
-	for i := 1; i <= 2; i++ {
-		if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != 200 {
-			t.Fatalf("call %d: want 200, got %d", i, rr.Code)
-		}
-	}
-	rr, code := chatAs(t, g, "sk-a", "m1")
-	if rr.Code != http.StatusTooManyRequests || code != "rate_limit_exceeded" {
-		t.Fatalf("third call: want 429/rate_limit_exceeded, got %d/%s", rr.Code, code)
-	}
-	if ctrl.hits != 2 {
-		t.Errorf("upstream saw %d calls, want 2 (a refused request must not reach upstream)", ctrl.hits)
-	}
-}
-
-// A model outside the scope is still 403, not 429: retrying cannot help.
-func TestModelOutsideScopeStaysForbidden(t *testing.T) {
-	g, _ := quotaGateway(t,
-		config.GWKey{Key: "sk-a", Role: "user",
-			Models: []config.ModelScope{{Model: "other-model", TokenQuota: 1000, Period: "hour"}}},
-		config.GWKey{Key: "sk-b", Role: "user"},
-	)
-	rr, code := chatAs(t, g, "sk-a", "m1")
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("want 403, got %d (%s)", rr.Code, rr.Body.String())
-	}
-	if code != "model_not_allowed" {
-		t.Errorf("error code = %q, want model_not_allowed", code)
-	}
-	if rr.Header().Get("Retry-After") != "" {
-		t.Error("a 403 must not advertise a retry time")
-	}
-}
-
-// An unlimited key (no caps at all) is never rejected — the default config
-// must keep working exactly as before.
-func TestKeyWithoutCapsIsUnlimited(t *testing.T) {
-	g, _ := quotaGateway(t,
-		config.GWKey{Key: "sk-a", Role: "user", Models: []config.ModelScope{{Model: "m1"}}},
-		config.GWKey{Key: "sk-b", Role: "user"},
-	)
-	for i := 1; i <= 5; i++ {
-		if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != 200 {
-			t.Fatalf("call %d: want 200 (no caps = unlimited), got %d", i, rr.Code)
-		}
-	}
-}
-
-func mustAtoi(t *testing.T, s string) int64 {
-	t.Helper()
-	var n int64
-	if _, err := fmt.Sscanf(s, "%d", &n); err != nil {
-		t.Fatalf("Retry-After %q is not an integer: %v", s, err)
-	}
-	return n
-}
-
-// quotaCtx builds a request context carrying a gateway key, as the auth
-// middleware would.
-func quotaCtx(t *testing.T, g *Gateway, key string) context.Context {
-	t.Helper()
-	return withAuth(context.Background(), key, "user")
-}
-
-func nowMSOffset(sec int64) int64 {
-	return time.Now().Add(time.Duration(sec) * time.Second).UnixMilli()
-}
-
-// The key-wide quota and the AUTO slot quota are different limits with
-// different scopes: the slot quota is gateway-wide (a shared upstream budget),
-// the key quota belongs to one caller. When both are exhausted the caller must
-// see the KEY quota, because that is the one it can act on — the slot quota
-// would otherwise be reported as "no capacity", which reads like an outage.
-func TestKeyQuotaWinsOverSlotQuota(t *testing.T) {
-	up := upstream(t, &upstreamCtrl{})
-	defer up.Close()
-	g := newQuotaGW(t, up.URL,
-		config.GWKey{Key: "sk-a", Role: "user",
-			Models: []config.ModelScope{{Model: "AUTO", TokenQuota: 4, Period: "hour"}}})
-	ctx := quotaCtx(t, g, "sk-a")
-
-	// exhaust the key first
-	g.stats.Record(Req{Time: time.Now().UnixMilli(), Key: keyID("sk-a"), Model: "m1",
-		Source: "up", Prompt: 100, Compl: 100, OK: true, Status: 200})
-	rr, code := chatAs(t, g, "sk-a", "AUTO")
-	if rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("want 429 from the key quota, got %d (%s)", rr.Code, rr.Body.String())
-	}
-	if code != "rate_limit_exceeded" {
-		t.Errorf("code = %q, want rate_limit_exceeded", code)
-	}
-	_ = ctx
-}
-
-// A key with NO caps must never be blocked by the slot quota check reaching it
-// through the scope path: scopeTokens on an uncapped key returns 0 usage and
-// the limit check must treat that as "no cap", not "exhausted".
-func TestUncappedKeyNeverBlockedByEmptyScope(t *testing.T) {
-	up := upstream(t, &upstreamCtrl{})
-	defer up.Close()
-	g := newQuotaGW(t, up.URL,
-		config.GWKey{Key: "sk-a", Role: "user", Models: []config.ModelScope{{Model: "AUTO"}}})
-	for i := 0; i < 5; i++ {
-		if rr, _ := chatAs(t, g, "sk-a", "AUTO"); rr.Code != 200 {
-			t.Fatalf("call %d: want 200 (AUTO scope with no quota), got %d (%s)", i, rr.Code, rr.Body.String())
-		}
-	}
-}
-
-// newQuotaGW builds a gateway with one mock upstream serving model m1 and the
-// given keys.
-func newQuotaGW(t *testing.T, upURL string, keys ...config.GWKey) *Gateway {
-	t.Helper()
-	td := t.TempDir()
-	cfgPath := filepath.Join(td, "config.yaml")
-	if err := os.WriteFile(cfgPath, []byte("listen: :0"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	cfg := &config.Config{
-		Path:        cfgPath,
-		AdapterDir:  filepath.Join(td, "adapters"),
-		RuntimeFile: filepath.Join(td, "runtime.json"),
-		Keys:        keys,
-		Sources: []config.Source{{
-			Name: "up", BaseURL: upURL, Adapter: "openai",
-			Models: []config.Model{
-				{ID: "m1", Priority: 100},
-				{ID: "m2", Priority: 90},
-			},
-		}},
-	}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	secrets := make([]string, 0, len(keys))
-	for _, k := range keys {
-		secrets = append(secrets, k.Key)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g
-}
-
-// The core of per-model quotas: a model that runs out of budget must stop
-// being served on its own, while every other model on the SAME key keeps
-// working. A key-wide total would fail this — it would block m2 because m1 was
-// capped, which is exactly the coupling this design removes.
-func TestOneModelsQuotaDoesNotBlockAnother(t *testing.T) {
-	up := upstream(t, &upstreamCtrl{})
-	defer up.Close()
-	td := t.TempDir()
-	cfgPath := td + "/config.yaml"
-	if err := os.WriteFile(cfgPath, []byte("listen: :0"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	cfg := &config.Config{
-		Path: cfgPath, AdapterDir: filepath.Join(td, "adapters"),
-		RuntimeFile: filepath.Join(td, "runtime.json"),
-		Keys: []config.GWKey{{
-			Key: "sk-a", Role: "user", Name: "two-models",
-			Models: []config.ModelScope{
-				{Model: "m1", TokenQuota: 4, Period: "hour"},
-				{Model: "m2", TokenQuota: 1000, Period: "hour"},
-			},
-		}},
-		Sources: []config.Source{{
-			Name: "up", BaseURL: up.URL, Adapter: "openai",
-			Models: []config.Model{
-				{ID: "m1", Priority: 100},
-				{ID: "m2", Priority: 90},
-			},
-		}},
-	}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-
-	// Spend on m2 FIRST. Without this the two designs are
-	// indistinguishable: a key-wide counter and m1's own counter would both
-	// read 0 before m1 is used, so the test would pass either way (it did —
-	// see the commit that rewrote it).
-	for i := 1; i <= 3; i++ {
-		if rr, _ := chatAs(t, g, "sk-a", "m2"); rr.Code != 200 {
-			t.Fatalf("m2 priming call %d: want 200, got %d", i, rr.Code)
-		}
-	}
-	// m1's budget is 4 and each call costs 4, so the key-wide total (m2+m1) is
-	// already 12 when m1 starts: a key-wide cap would refuse m1 immediately.
-	if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != 200 {
-		t.Fatalf("m1 must be served on its own budget (m2's spend is not its problem), got %d (%s)",
-			rr.Code, rr.Body.String())
-	}
-	if rr, code := chatAs(t, g, "sk-a", "m1"); rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("m1 second call: want 429, got %d (%s)", rr.Code, code)
-	}
-	// m2 must keep working
-	for i := 1; i <= 3; i++ {
-		if rr, _ := chatAs(t, g, "sk-a", "m2"); rr.Code != 200 {
-			t.Fatalf("m2 call %d must be served while m1 is capped, got %d (%s)", i, rr.Code, rr.Body.String())
-		}
-	}
-	// and the message must name m1, not the key
-	rr, _ := chatAs(t, g, "sk-a", "m1")
-	if !strings.Contains(rr.Body.String(), "m1") {
-		t.Errorf("rejection should name the capped model: %s", rr.Body.String())
-	}
-}
-
-// A model with no quota on it is never blocked by a sibling's cap, and an
-// uncapped key is never blocked at all.
-func TestUncappedModelNeverBlocked(t *testing.T) {
-	up := upstream(t, &upstreamCtrl{})
-	defer up.Close()
-	g := newQuotaGW(t, up.URL,
-		config.GWKey{Key: "sk-a", Role: "user", Models: []config.ModelScope{
-			{Model: "m1", TokenQuota: 1, Period: "hour"},
-			{Model: "m2"},
-		}})
-	if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != 200 {
-		t.Fatalf("m1 first: want 200, got %d", rr.Code)
-	}
-	if rr, _ := chatAs(t, g, "sk-a", "m1"); rr.Code != http.StatusTooManyRequests {
-		t.Fatalf("m1 second: want 429, got %d", rr.Code)
-	}
-	for i := 1; i <= 4; i++ {
-		if rr, _ := chatAs(t, g, "sk-a", "m2"); rr.Code != 200 {
-			t.Fatalf("m2 (uncapped) call %d: want 200, got %d", i, rr.Code)
-		}
-	}
-}
-
-// An admin key is never capped even when its scopes carry budgets: a cap that
-// locked the operator out would be unrecoverable through the UI.
-func TestAdminKeyScopesAreNotEnforced(t *testing.T) {
-	up := upstream(t, &upstreamCtrl{})
-	defer up.Close()
-	g := newQuotaGW(t, up.URL,
-		config.GWKey{Key: "sk-admin", Role: "admin", Models: []config.ModelScope{
-			{Model: "m1", TokenQuota: 1, ReqQuota: 1, Period: "hour"},
-		}})
-	for i := 1; i <= 4; i++ {
-		if rr, _ := chatAs(t, g, "sk-admin", "m1"); rr.Code != 200 {
-			t.Fatalf("admin call %d: want 200 (admin scopes are not enforced), got %d", i, rr.Code)
-		}
-	}
-}

internal/gateway/keys.go

@@ -7,7 +7,6 @@ import (
 	"strings"
 
 	"llmsproxy/internal/config"
-	"llmsproxy/internal/scheduler"
 )
 
 // handleKeysAPI manages gateway keys: GET /api/keys (admin: all keys),
@@ -18,22 +17,10 @@ func (g *Gateway) handleKeysAPI(w http.ResponseWriter, r *http.Request) {
 	path = strings.Trim(path, "/")
 	role := reqRole(r.Context())
 
-	// /api/keys/me/auto — a user's own chain, readable without admin rights.
-	// Must be matched before the generic {key}/auto case below so it does not
-	// ask admin rights of a plain user asking about their own chain.
-	if path == "me/auto" {
-		g.handleKeyMeAuto(w, r)
-		return
-	}
 	if path == "me" {
 		g.handleKeyMe(w, r)
 		return
 	}
-	// /api/keys/{key}/auto — the per-key AUTO chain editor.
-	if i := strings.LastIndex(path, "/auto"); i > 0 && path[i+len("/auto"):] == "" {
-		g.handleKeyAutoAPI(w, r, path[:i])
-		return
-	}
 	if role != "admin" {
 		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
 		return
@@ -61,7 +48,13 @@ func (g *Gateway) handleKeysAPI(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
 			return
 		}
-		body.Role = config.NormalizeRole(body.Role)
+		if body.Role == "" {
+			body.Role = "user"
+		}
+		if body.Role != "admin" && body.Role != "user" {
+			writeError(w, http.StatusBadRequest, "invalid_request", "role must be admin or user")
+			return
+		}
 		rec, err := g.core.CreateKey(body.Name, body.Role, body.Models, body.Note)
 		if err != nil {
 			writeError(w, http.StatusBadRequest, "key_error", err.Error())
@@ -83,9 +76,6 @@ func (g *Gateway) handleKeysAPI(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
 			return
 		}
-		// Each scope entry carries its own token/request caps, so replacing the
-		// scope replaces the budgets with it — there is no separate key-wide
-		// quota that could drift out of sync with the models.
 		rec, err := g.core.UpdateKey(path, body.Name, body.Role, body.Models, body.Note)
 		if err != nil {
 			writeError(w, http.StatusBadRequest, "key_error", err.Error())
@@ -152,101 +142,6 @@ func (g *Gateway) allowedModels(ctx context.Context) []config.ModelScope {
 	return rec.Models
 }
 
-// handleKeyAutoAPI manages one key's own AUTO chain:
-// GET /api/keys/{key}/auto returns it, PUT replaces it, DELETE clears the
-// override so the key falls back to the global chain. Admin only — a user can
-// inspect their own chain through GET /api/keys/me/auto.
-//
-// An empty chain and a cleared chain are deliberately the same state: "inherit
-// the global chain". That keeps the WebUI's "use global" toggle a plain DELETE
-// with no sentinel value to carry through config.yaml.
-func (g *Gateway) handleKeyAutoAPI(w http.ResponseWriter, r *http.Request, key string) {
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	rec, ok := g.core.FindKey(key)
-	if !ok {
-		writeError(w, http.StatusNotFound, "not_found", "key not found")
-		return
-	}
-	switch r.Method {
-	case http.MethodGet:
-		writeJSON(w, http.StatusOK, map[string]interface{}{
-			"key":      key,
-			"auto":     rec.Auto,
-			"inherits": !rec.HasOwnAuto(),
-		})
-	case http.MethodPut, http.MethodPatch:
-		var body struct {
-			Auto []config.ModelScope `json:"auto"`
-		}
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-			return
-		}
-		if len(body.Auto) == 0 {
-			// Treat an empty PUT as "give up the override" so the endpoint
-			// cannot persist a chain that would 503 with no slots.
-			if err := g.core.SaveKeyAuto(key, nil); err != nil {
-				writeError(w, http.StatusBadRequest, "key_error", err.Error())
-				return
-			}
-			writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "inherits": true})
-			return
-		}
-		if err := g.core.SaveKeyAuto(key, body.Auto); err != nil {
-			writeError(w, http.StatusBadRequest, "key_error", err.Error())
-			return
-		}
-		// Report whether the chain actually resolved to usable slots. An
-		// admin who typed a model that no longer exists should learn it here,
-		// not from the user's next 503.
-		chain, _ := g.core.AutoChainFor(key)
-		writeJSON(w, http.StatusOK, map[string]interface{}{
-			"ok": true, "inherits": false, "slots": chainSlots(chain),
-		})
-	case http.MethodDelete:
-		if err := g.core.SaveKeyAuto(key, nil); err != nil {
-			writeError(w, http.StatusBadRequest, "key_error", err.Error())
-			return
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "inherits": true})
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-	}
-}
-
-// chainSlots counts the usable slots in a chain, for API feedback after an
-// edit. A chain that compiled to zero slots is reported so the caller can warn
-// instead of letting the next request fail with no_provider.
-func chainSlots(ch *scheduler.Chain) int {
-	if ch == nil {
-		return 0
-	}
-	n := 0
-	for _, tn := range ch.Tiers {
-		n += len(tn.Slots)
-	}
-	return n
-}
-
-// handleKeyMeAuto lets a user read their own AUTO chain without admin rights.
-func (g *Gateway) handleKeyMeAuto(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-		return
-	}
-	rec, ok := g.core.FindKey(reqKey(r.Context()))
-	if !ok {
-		writeError(w, http.StatusUnauthorized, "invalid_api_key", "key not found")
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"key": rec.Key, "auto": rec.Auto, "inherits": !rec.HasOwnAuto(),
-	})
-}
-
 // handleAutoAPI manages the AUTO scheduling slots: GET /api/auto returns the
 // current rules; PUT /api/auto replaces them (admin only).
 func (g *Gateway) handleAutoAPI(w http.ResponseWriter, r *http.Request) {

internal/gateway/messages.go

@@ -1,379 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"time"
-
-	"llmsproxy/internal/provider"
-	"llmsproxy/internal/scheduler"
-	"llmsproxy/internal/types"
-)
-
-// handleMessages serves the Anthropic Messages protocol (POST /v1/messages).
-//
-// The point of this endpoint is NOT to add a second scheduling path. It reuses
-// everything /v1/chat/completions does — key auth, model scope, per-model
-// quotas, the AUTO chain, cooldowns, audit records, plugin hooks — and differs
-// in exactly two places:
-//
-//  1. the request body is parsed from Anthropic's shape into the unified format
-//     (messages with content blocks, a top-level `system`, `max_tokens`
-//     mandatory, `thinking` optional);
-//  2. the response is rendered by the SERVING adapter's serialize_* hooks, so
-//     the client sees Anthropic's shape back.
-//
-// The kernel therefore contains no Anthropic field names on this path: parsing
-// is table-driven, and serialization belongs to the adapter.
-//
-// A source whose adapter does not declare serialize_* falls back to the
-// OpenAI shape, which is what the kernel guarantees for an unconfigured
-// deployment. That asymmetry is deliberate (see serializer.go): an Anthropic
-// client talking to a source that cannot speak Anthropic gets a clear
-// OpenAI-shaped answer rather than a malformed Anthropic one.
-func (g *Gateway) handleMessages(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use POST")
-		return
-	}
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "read body: "+err.Error())
-		return
-	}
-	// INGRESS: the kernel's built-in Anthropic parse is the FALLBACK (R5). If an
-	// adapter has CLAIMED this ingress path (adapter.ingress == "/v1/messages"),
-	// the kernel YIELDS: parsing is done by that adapter's deserialize_request
-	// hook, so Anthropic protocol iteration lives in anthropic.lua, not here.
-	// No adapter claims it → the built-in parser below runs (unconfigured
-	// deployments keep working). This is the inbound dual of serialize_*.
-	req, handled, perr := g.parseViaIngress(r.URL.Path, string(body), g.core.DefaultModel())
-	if perr != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", perr.Error())
-		return
-	}
-	if !handled {
-		var raw anthropicRequest
-		if err := json.Unmarshal(body, &raw); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-			return
-		}
-		req, err = raw.toUnified(g.core.DefaultModel())
-		if err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-	}
-
-	model := req.Model
-	ctx := r.Context()
-	g.fireStart(ctx, &chatRequest{Messages: req.Messages, Tools: nil},
-		chatKind(req.Stream), model, len(req.Messages), 0)
-
-	if isAuto(model) {
-		chain, _ := g.core.AutoChainFor(reqKey(ctx))
-		if chain == nil || len(chain.Tiers) == 0 {
-			writeError(w, http.StatusServiceUnavailable, "no_provider", "no auto slot configured")
-			return
-		}
-		if q := g.checkQuota(ctx, "AUTO"); q != nil {
-			g.writeReject(w, q)
-			return
-		}
-		g.serveUnified(ctx, w, chain, req, nil)
-		return
-	}
-	if allow := g.allowedModels(ctx); allow != nil && !g.hasScopeModel(allow, model) {
-		writeError(w, http.StatusForbidden, "model_not_allowed",
-			"model \""+model+"\" is not allowed for this key")
-		return
-	}
-	cands, effective := g.resolveCands(ctx, &chatRequest{Model: model})
-	if len(cands) == 0 {
-		writeError(w, http.StatusNotFound, "model_not_found",
-			"model \""+model+"\" is not configured")
-		return
-	}
-	if effective == "" {
-		effective = firstModel(cands[0])
-	}
-	if q := g.checkQuota(ctx, effective); q != nil {
-		g.writeReject(w, q)
-		return
-	}
-	g.serveUnified(ctx, w, nil, req, &directRoute{cands: cands, effective: effective})
-}
-
-// directRoute carries the pre-resolved candidate list for a model-pinned
-// request, so serveUnified can run both routes (direct / AUTO) from one body.
-type directRoute struct {
-	cands     []*provider.Provider
-	effective string
-}
-
-// serveUnified runs the request through the scheduler and writes the reply via
-// the serving adapter's serializer. It is the shared tail of handleChat and
-// handleMessages: by this point every gate (auth, scope, quota) has already run,
-// so the only remaining questions are "which source serves it" and "what shape
-// does the client get".
-func (g *Gateway) serveUnified(ctx context.Context, w http.ResponseWriter, chain *scheduler.Chain, req *types.ChatRequest, direct *directRoute) {
-	rec := &Req{Key: keyID(reqKey(ctx)), Type: "chat", OK: false}
-	if direct != nil {
-		rec.Model = direct.effective
-		rec.Source = firstSource(direct.cands)
-	} else {
-		rec.Type = "stream"
-	}
-	if req.Stream {
-		rec.Type = "stream"
-	}
-
-	done := g.stats.Begin()
-	defer done()
-
-	var (
-		resp               *types.UnifiedResponse
-		chunks             <-chan types.UnifiedChunk
-		usedSrc, usedModel string
-		err                error
-	)
-	t0 := time.Now()
-	if direct != nil {
-		cands := toScheduler(direct.cands)
-		if req.Stream {
-			chunks, usedSrc, usedModel, err = g.core.Scheduler().ChatStream(ctx, cands, req)
-		} else {
-			resp, usedSrc, usedModel, err = g.core.Scheduler().Chat(ctx, cands, req)
-		}
-	} else {
-		if req.Stream {
-			chunks, usedSrc, usedModel, err = g.core.Scheduler().ChainChatStream(ctx, chain, req, nil, nil)
-		} else {
-			resp, usedSrc, usedModel, err = g.core.Scheduler().ChainChat(ctx, chain, req, nil, nil)
-		}
-	}
-	rec.LatMs = time.Since(t0).Milliseconds()
-	if err != nil {
-		g.failChat(w, rec, err)
-		g.writeRec(rec)
-		return
-	}
-	rec.OK = true
-	rec.Status = http.StatusOK
-	if usedModel != "" {
-		rec.Model = usedModel
-	}
-	rec.Source = usedSrc
-	ser := g.serializerFor(usedSrc, directProviderList(direct))
-
-	if chunks != nil {
-		g.fireRouted(ctx, "stream", usedSrc, usedModel, tierForRoute(direct), true)
-		rec.Prompt = estimatePromptTokens(req)
-		g.pumpStream(w, ser, rec, chunks, modelLabel(req, usedModel), t0)
-		return
-	}
-	recordChatUsage(rec, req, resp)
-	g.fireRouted(ctx, "chat", usedSrc, usedModel, tierForRoute(direct), false)
-	rec.FirstByteMs = rec.LatMs
-	g.writeRec(rec)
-	writeChatCompletion(w, ser, resp, modelLabel(req, usedModel))
-}
-
-// ---- Anthropic request shape (in-bound only; the kernel holds no outbound
-// Anthropic field names) ----
-
-// anthropicRequest is the client-facing parse target for POST /v1/messages.
-//
-// Only the fields the gateway must understand to schedule and account for a
-// request appear here. Anything else the client sent is preserved verbatim in
-// raw so an adapter can read it (the same "kernel does not interpret" rule that
-// governs tools).
-type anthropicRequest struct {
-	Model     string             `json:"model"`
-	System    json.RawMessage    `json:"system,omitempty"`
-	Messages  []anthropicMessage `json:"messages"`
-	MaxTokens int                `json:"max_tokens"`
-	Stream    bool               `json:"stream,omitempty"`
-
-	Temperature *float64               `json:"temperature,omitempty"`
-	TopP        *float64               `json:"top_p,omitempty"`
-	TopK        int                    `json:"top_k,omitempty"`
-	StopSeqs    []string               `json:"stop_sequences,omitempty"`
-	Tools       json.RawMessage        `json:"tools,omitempty"`
-	ToolChoice  json.RawMessage        `json:"tool_choice,omitempty"`
-	Thinking    *types.ThinkingConfig  `json:"thinking,omitempty"`
-	Metadata    map[string]interface{} `json:"metadata,omitempty"`
-
-	// raw is the untouched body, so an adapter can read fields the gateway
-	// has no reason to know (cache_control, service_tier, …).
-	raw json.RawMessage
-}
-
-// anthropicMessage accepts Anthropic's content as either a plain string or an
-// array of typed blocks; both normalize to the unified message shape.
-type anthropicMessage struct {
-	Role    string          `json:"role"`
-	Content json.RawMessage `json:"content"`
-}
-
-// toUnified converts the parsed request into the internal format.
-func (a *anthropicRequest) toUnified(defaultModel string) (*types.ChatRequest, error) {
-	if len(a.Messages) == 0 {
-		return nil, errors.New("messages is required")
-	}
-	msgs := make([]types.ChatMessage, 0, len(a.Messages))
-	for i, m := range a.Messages {
-		u := types.ChatMessage{Role: m.Role, Content: normalizeAnthropicContent(m.Content)}
-		if u.Role == "" {
-			return nil, fmt.Errorf("messages[%d].role is required", i)
-		}
-		msgs = append(msgs, u)
-	}
-	model := a.Model
-	if model == "" {
-		model = defaultModel
-	}
-	th := a.Thinking
-	if th == nil {
-		// Anthropic's default is thinking OFF, and `thinking: {enabled:false}`
-		// is the explicit spelling of that. Emitting it keeps the unified
-		// request honest about the client's intent instead of leaving the
-		// field absent and letting each adapter guess.
-		no := false
-		th = &types.ThinkingConfig{Enabled: &no}
-	}
-	return &types.ChatRequest{
-		Model:         model,
-		Messages:      msgs,
-		Temperature:   a.Temperature,
-		MaxTokens:     a.MaxTokens,
-		Stream:        a.Stream,
-		TopP:          a.TopP,
-		TopK:          a.TopK,
-		StopSequences: a.StopSeqs,
-		Tools:         a.Tools,
-		ToolChoice:    a.ToolChoice,
-		System:        systemToString(a.System),
-		Thinking:      th,
-		ExtraBody:     map[string]interface{}{},
-	}, nil
-}
-
-// normalizeAnthropicContent turns Anthropic content into the unified shape.
-//
-// A string stays a string. An array of blocks is preserved as-is: the unified
-// format deliberately carries multimodal/tool blocks verbatim (ChatMessage
-// .Content is json.RawMessage) rather than flattening them, because only an
-// adapter knows which block types its upstream accepts.
-func normalizeAnthropicContent(raw json.RawMessage) json.RawMessage {
-	trimmed := strings.TrimSpace(string(raw))
-	if trimmed == "" {
-		return types.StringContent("")
-	}
-	if strings.HasPrefix(trimmed, `"`) {
-		return raw
-	}
-	return raw
-}
-
-// systemToString accepts Anthropic's two spellings: a plain string, or an array
-// of {type:"text", text} blocks.
-func systemToString(raw json.RawMessage) string {
-	trimmed := strings.TrimSpace(string(raw))
-	if trimmed == "" || trimmed == "null" {
-		return ""
-	}
-	if strings.HasPrefix(trimmed, `"`) {
-		var s string
-		if err := json.Unmarshal(raw, &s); err == nil {
-			return s
-		}
-		return ""
-	}
-	var blocks []struct {
-		Type string `json:"type"`
-		Text string `json:"text"`
-	}
-	if err := json.Unmarshal(raw, &blocks); err != nil {
-		return ""
-	}
-	var sb strings.Builder
-	for _, b := range blocks {
-		if b.Type == "text" {
-			sb.WriteString(b.Text)
-		}
-	}
-	return sb.String()
-}
-
-// parseViaIngress is the kernel's INBOUND yield point, the dual of
-// serializerFor (which decides the outbound serializer).
-//
-// Design (user requirement): an inbound endpoint such as /v1/messages is the
-// KERNEL'S FALLBACK — the built-in parser in handleMessages is what an
-// unconfigured deployment gets. But an adapter may CLAIM that endpoint
-// (adapter.ingress == path) and declare deserialize_request; when it does, the
-// kernel YIELDS parsing to it, so client-protocol iteration lives in the
-// adapter and the kernel's own copy is only the safety net (R5).
-//
-// Returns handled=false when no adapter claims the path (or one claims it
-// without a deserialize_request hook) — the caller then runs its built-in
-// parser. A hook that exists but FAILS is a hard error, not a silent fallback:
-// the client spoke a protocol the adapter claimed to handle, and quietly
-// parsing it as a different protocol would mis-schedule the request.
-func (g *Gateway) parseViaIngress(path, body, defaultModel string) (*types.ChatRequest, bool, error) {
-	vm := g.core.VM()
-	if vm == nil {
-		return nil, false, nil
-	}
-	adapter := vm.AdapterForIngress(path)
-	if adapter == "" || !vm.HasFn(adapter, "deserialize_request") {
-		return nil, false, nil
-	}
-	out, err := vm.Transform(adapter, "deserialize_request", body)
-	if err != nil {
-		return nil, true, fmt.Errorf("adapter %s deserialize_request(%s): %w", adapter, path, err)
-	}
-	var req types.ChatRequest
-	if err := json.Unmarshal([]byte(out), &req); err != nil {
-		return nil, true, fmt.Errorf("adapter %s deserialize_request returned an invalid unified request: %w", adapter, err)
-	}
-	if req.Model == "" {
-		req.Model = defaultModel
-	}
-	return &req, true, nil
-}
-
-func chatKind(stream bool) string {
-	if stream {
-		return "stream"
-	}
-	return "chat"
-}
-
-// directProviderList hands the serving-source resolver its candidate list.
-func directProviderList(direct *directRoute) []*provider.Provider {
-	if direct == nil {
-		return nil
-	}
-	return direct.cands
-}
-
-func tierForRoute(direct *directRoute) int {
-	if direct != nil {
-		return -1
-	}
-	return -2
-}
-
-func modelLabel(req *types.ChatRequest, usedModel string) string {
-	if usedModel != "" {
-		return usedModel
-	}
-	return req.Model
-}

internal/gateway/messages_test.go

@@ -1,404 +0,0 @@
-package gateway
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// 本文件端到端验证 Phase 2 的核心主张：**对外协议由适配器决定，内核只调度**。
-//
-// 具体做法：起一个真实的 core + gateway，源挂 anthropic 适配器，上游是一个
-// 只懂 Anthropic Messages 的假服务器。然后：
-//
-//	1. Anthropic 客户端形状的请求 → 拿到 Anthropic 形状的响应
-//	2. 调度/配额/审计与 /v1/chat/completions 走同一条路径
-//	3. 上游若不支持该模型，内核如实回 503，不伪造格式
-
-// anthropicUpstream 是一个只实现 Anthropic Messages 的假上游。
-func anthropicUpstream(t *testing.T) *httptest.Server {
-	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !strings.HasSuffix(r.URL.Path, "/messages") {
-			// 网关把请求发到了非 Anthropic 路径 —— 显式暴露这个 bug
-			t.Errorf("请求打到了非 Anthropic 路径: %s", r.URL.Path)
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-		body, _ := io.ReadAll(r.Body)
-		var probe map[string]interface{}
-		_ = json.Unmarshal(body, &probe)
-		if _, ok := probe["messages"]; !ok {
-			t.Errorf("上游收到没有 messages 的请求体: %s", body)
-		}
-		if _, ok := probe["system"]; !ok && probe["system"] == nil {
-			// system 是可选的，仅在客户端给了的时候才应出现；不强制
-			_ = ok
-		}
-		if _, ok := probe["max_tokens"]; !ok {
-			t.Errorf("Anthropic 要求 max_tokens，上游请求体却缺这个字段: %s", body)
-		}
-
-		// Streaming requests must get a real Anthropic SSE sequence; a JSON body
-		// here would leave the adapter with zero frames and the gateway would
-		// (correctly) reject the stream as empty.
-		if stream, _ := probe["stream"].(bool); stream {
-			w.Header().Set("Content-Type", "text/event-stream")
-			fl, _ := w.(http.Flusher)
-			frames := []string{
-				`event: message_start` + "\n" + `data: {"type":"message_start","message":{"id":"msg_mock","type":"message","role":"assistant","model":"` + probeModel(probe) + `","content":[],"usage":{"input_tokens":3,"output_tokens":0}}}`,
-				`event: content_block_start` + "\n" + `data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}`,
-				`event: content_block_delta` + "\n" + `data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"pong"}}`,
-				`event: content_block_stop` + "\n" + `data: {"type":"content_block_stop","index":0}`,
-				`event: message_delta` + "\n" + `data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":5}}`,
-				`event: message_stop` + "\n" + `data: {"type":"message_stop"}`,
-			}
-			for _, f := range frames {
-				fmt.Fprint(w, f+"\n\n")
-				if fl != nil {
-					fl.Flush()
-				}
-			}
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, `{
-			"id":"msg_mock","type":"message","role":"assistant","model":"`+probeModel(probe)+`",
-			"content":[{"type":"thinking","thinking":"let me think"},{"type":"text","text":"pong"}],
-			"stop_reason":"end_turn",
-			"usage":{"input_tokens":3,"output_tokens":5}
-		}`)
-	}))
-}
-
-func probeModel(m map[string]interface{}) string {
-	if s, ok := m["model"].(string); ok {
-		return s
-	}
-	return ""
-}
-
-// messagesGateway 起一个真实网关，源挂 anthropic 适配器。
-func messagesGateway(t *testing.T) (*httptest.Server, string) {
-	t.Helper()
-	up := anthropicUpstream(t)
-	t.Cleanup(up.Close)
-
-	dir := t.TempDir()
-	// adapterDir 故意不预先创建：VM 首启会把内置适配器 seed 进去。
-	// 预先创建会被当成"目录已存在即为权威"，于是没有任何内置适配器被加载，
-	// 表现为 "adapter anthropic not loaded"。
-	cfg := &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "claude-test",
-		GatewayKeys:  []string{"sk-e2e-0001"},
-		Sources: []config.Source{{
-			Name: "anth", BaseURL: up.URL, Adapter: "anthropic",
-			APIKey: "k", MaxConcurrent: 4,
-			Models: []config.Model{{ID: "claude-test", Kind: "chat", Priority: 100}},
-		}},
-	}
-
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	gw, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	ts := httptest.NewServer(gw.Handler())
-	t.Cleanup(ts.Close)
-	return ts, "sk-e2e-0001"
-}
-
-func postJSON(t *testing.T, url, key, body string) (int, string) {
-	t.Helper()
-	req, _ := http.NewRequest(http.MethodPost, url, strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+key)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatalf("request: %v", err)
-	}
-	defer resp.Body.Close()
-	b, _ := io.ReadAll(resp.Body)
-	return resp.StatusCode, string(b)
-}
-
-// TestMessagesEndpointSpeaksAnthropic 是本文件的主断言：Anthropic 客户端
-// 打 /v1/messages，拿到 Anthropic 形状。
-func TestMessagesEndpointSpeaksAnthropic(t *testing.T) {
-	ts, key := messagesGateway(t)
-	code, body := postJSON(t, ts.URL+"/v1/messages", key,
-		`{"model":"claude-test","max_tokens":64,"messages":[{"role":"user","content":"hi"}]}`)
-	if code != 200 {
-		t.Fatalf("status = %d: %s", code, body)
-	}
-	var m map[string]interface{}
-	if err := json.Unmarshal([]byte(body), &m); err != nil {
-		t.Fatalf("响应不是 JSON: %v (%s)", err, body)
-	}
-	if m["type"] != "message" {
-		t.Errorf("type = %v, want message（内核不该退回 OpenAI 的 chat.completion）", m["type"])
-	}
-	if m["stop_reason"] != "end_turn" {
-		t.Errorf("stop_reason = %v, want end_turn", m["stop_reason"])
-	}
-	blocks, _ := m["content"].([]interface{})
-	if len(blocks) != 2 {
-		t.Fatalf("content blocks = %v, want [thinking, text]", m["content"])
-	}
-	if b0 := blocks[0].(map[string]interface{}); b0["type"] != "thinking" || b0["thinking"] != "let me think" {
-		t.Errorf("首个块应为 thinking: %v", b0)
-	}
-	if b1 := blocks[1].(map[string]interface{}); b1["type"] != "text" || b1["text"] != "pong" {
-		t.Errorf("第二个块应为 text/pong: %v", b1)
-	}
-	u := m["usage"].(map[string]interface{})
-	if u["input_tokens"] != float64(3) || u["output_tokens"] != float64(5) {
-		t.Errorf("usage 应为 Anthropic 的 input/output 命名: %v", u)
-	}
-	// 内核不得混入 OpenAI 形状
-	for _, forbidden := range []string{`"object"`, `"choices"`, `"chat.completion"`, `"prompt_tokens"`} {
-		if strings.Contains(body, forbidden) {
-			t.Errorf("OpenAI 字段 %s 混入 Anthropic 响应: %s", forbidden, body)
-		}
-	}
-}
-
-// TestMessagesStreamSpeaksAnthropic 验证流式也是 Anthropic 事件序列，
-// 而不是 OpenAI SSE。
-func TestMessagesStreamSpeaksAnthropic(t *testing.T) {
-	ts, key := messagesGateway(t)
-	req, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/messages",
-		strings.NewReader(`{"model":"claude-test","max_tokens":64,"stream":true,"messages":[{"role":"user","content":"hi"}]}`))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+key)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	s := string(body)
-
-	if !strings.Contains(s, "message_start") {
-		t.Errorf("Anthropic 流应以 message_start 开头: %s", s)
-	}
-	if !strings.Contains(s, "message_stop") {
-		t.Errorf("Anthropic 流应以 message_stop 收尾: %s", s)
-	}
-	// 内核不得擅自给 Anthropic 流加 OpenAI 的 [DONE]
-	if strings.Contains(s, "[DONE]") {
-		t.Errorf("Anthropic 流里出现了 OpenAI 的 [DONE] 终止标记: %s", s)
-	}
-	if strings.Contains(s, "chat.completion.chunk") {
-		t.Errorf("流里混入 OpenAI chunk 形状: %s", s)
-	}
-}
-
-// TestMessagesRejectsBadRequest 确认入向校验（Anthropic 要求 max_tokens）
-// 与 OpenAI 路径一样在入口拒绝，不占用上游槽位。
-func TestMessagesRejectsBadRequest(t *testing.T) {
-	ts, key := messagesGateway(t)
-	// Anthropic 允许省略 max_tokens（上游会给默认），所以「有 messages 无
-	// max_tokens」必须被接受；真正该拒的是没有 messages。
-	code, body := postJSON(t, ts.URL+"/v1/messages", key,
-		`{"model":"claude-test","messages":[{"role":"user","content":"hi"}]}`)
-	if code != 200 {
-		t.Fatalf("有 messages 的请求应被接受（max_tokens 可省），却得 %d: %s", code, body)
-	}
-	code, body = postJSON(t, ts.URL+"/v1/messages", key, `{"model":"claude-test"}`)
-	if code != 400 {
-		t.Errorf("无 messages 的请求 status = %d, want 400: %s", code, body)
-	}
-	// 坏 JSON
-	code, _ = postJSON(t, ts.URL+"/v1/messages", key, `{"model":`)
-	if code != 400 {
-		t.Errorf("坏 JSON status = %d, want 400", code)
-	}
-}
-
-// TestMessagesUnconfiguredFallsBackToOpenai 验证 R5 的兜底在新增端点上同样
-// 生效：源没有声明序列化钩子时（此例用 openai 适配器），回 OpenAI 形状。
-func TestMessagesUnconfiguredFallsBackToOpenai(t *testing.T) {
-	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, `{"choices":[{"message":{"content":"pong"},"finish_reason":"stop"}],
-			"usage":{"prompt_tokens":3,"completion_tokens":1,"total_tokens":4}}`)
-	}))
-	defer up.Close()
-
-	dir := t.TempDir()
-	// adapterDir 故意不预先创建：VM 首启会把内置适配器 seed 进去。
-	// 预先创建会被当成"目录已存在即为权威"，于是没有任何内置适配器被加载，
-	// 表现为 "adapter anthropic not loaded"。
-	cfg := &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "gpt-test",
-		GatewayKeys:  []string{"sk-e2e-0001"},
-		Sources: []config.Source{{
-			Name: "oai", BaseURL: up.URL, Adapter: "openai", APIKey: "k", MaxConcurrent: 4,
-			Models: []config.Model{{ID: "gpt-test", Kind: "chat"}},
-		}},
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-	gw, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ts := httptest.NewServer(gw.Handler())
-	defer ts.Close()
-
-	code, body := postJSON(t, ts.URL+"/v1/messages", "sk-e2e-0001",
-		`{"model":"gpt-test","max_tokens":64,"messages":[{"role":"user","content":"hi"}]}`)
-	if code != 200 {
-		t.Fatalf("status = %d: %s", code, body)
-	}
-	if !strings.Contains(body, "chat.completion") {
-		t.Errorf("无序列化钩子的源应回落 OpenAI 兜底形状: %s", body)
-	}
-}
-
-// TestMessagesRequiresAuth 确认新端点走同一套鉴权（不因为是新协议而放行）。
-func TestMessagesRequiresAuth(t *testing.T) {
-	ts, _ := messagesGateway(t)
-	code, _ := postJSON(t, ts.URL+"/v1/messages", "wrong-key",
-		`{"model":"claude-test","max_tokens":8,"messages":[{"role":"user","content":"hi"}]}`)
-	if code != 401 {
-		t.Errorf("错误 key status = %d, want 401", code)
-	}
-	// 无 auth
-	req, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/messages", strings.NewReader("{}"))
-	req.Header.Set("Content-Type", "application/json")
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 401 {
-		t.Errorf("无 key status = %d, want 401", resp.StatusCode)
-	}
-	_ = context.Background()
-}
-
-// TestMessagesIngressYieldsToBundledAnthropic 是 ingress 让出的主断言（用户要求：
-// /v1/messages 是内核兜底端点，适配器可声明它、内核主动让出）。
-//
-// 事实前提：内置 anthropic.lua 自己声明了 adapter.ingress = "/v1/messages"，而它
-// 默认随包播种。所以真实部署里内核**总是**让出给 anthropic 适配器，
-// anthropicRequest.toUnified 退化为纯兜底（仅在适配器被移除/禁用时运行）。
-//
-// 断言方式：给源挂一个「上游即 Anthropic」的假服务器，客户端送一个 Anthropic
-// 形状请求。若内核让出，请求由适配器 deserialize_request 解析 → 路由/调度正常。
-// 同时用一个**只有系统消息**的请求验证解析确实走了适配器语义（Go 侧 system
-// 处理与 Lua 侧一致）。
-func TestMessagesIngressYieldsToBundledAnthropic(t *testing.T) {
-	ts, key := messagesGateway(t)
-	if code, body := postJSON(t, ts.URL+"/v1/messages", key,
-		`{"model":"claude-test","max_tokens":16,"messages":[{"role":"user","content":"ping"}]}`); code != 200 {
-		t.Fatalf("让出后 /v1/messages 应 200, 实得 %d: %s", code, body)
-	}
-}
-
-// TestAdapterForIngressClaim 直接验证内核的让出判定：声明了 ingress 的适配器
-// 会被 AdapterForIngress 找到；未声明的路径返回空（→ 内核用自己的兜底解析）。
-func TestAdapterForIngressClaim(t *testing.T) {
-	dir := t.TempDir()
-	cfg := &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "m",
-		GatewayKeys:  []string{"sk-e2e-0001"},
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-	vm := c.VM()
-
-	// 内置 anthropic 声明了该端点
-	if got := vm.AdapterForIngress("/v1/messages"); got != "anthropic" {
-		t.Errorf("内置 anthropic 应认领 /v1/messages, 实得 %q", got)
-	}
-	// 未声明的路径 → 空 → 内核走自己的兜底解析
-	if got := vm.AdapterForIngress("/v1/nothing"); got != "" {
-		t.Errorf("未声明路径应为空, 实得 %q", got)
-	}
-	// 内置 anthropic 确实有 deserialize_request 钩子（否则内核会让出给一个空解析器）
-	if !vm.HasFn("anthropic", "deserialize_request") {
-		t.Error("anthropic 应实现 deserialize_request")
-	}
-}
-
-// TestMessagesKernelFallbackWhenNoAdapterClaims 证明兜底仍在：显式删掉所有
-// 声明 ingress 的适配器后，内核自己的 anthropicRequest.toUnified 接管，
-// /v1/messages 仍能服务（R5 兜底语义）。
-func TestMessagesKernelFallbackWhenNoAdapterClaims(t *testing.T) {
-	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, `{"choices":[{"message":{"content":"pong"},"finish_reason":"stop"}],
-			"usage":{"prompt_tokens":3,"completion_tokens":1,"total_tokens":4}}`)
-	}))
-	defer up.Close()
-
-	dir := t.TempDir()
-	cfg := &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "gpt-test",
-		GatewayKeys:  []string{"sk-e2e-0001"},
-		Sources: []config.Source{{
-			Name: "oai", BaseURL: up.URL, Adapter: "openai", APIKey: "k", MaxConcurrent: 4,
-			Models: []config.Model{{ID: "gpt-test", Kind: "chat"}},
-		}},
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-	// 摘掉声明 ingress 的适配器（内置 anthropic），模拟"没有适配器认领该端点"。
-	c.VM().RemoveAdapter("anthropic")
-	if got := c.VM().AdapterForIngress("/v1/messages"); got != "" {
-		t.Fatalf("移除后应无适配器认领, 实得 %q", got)
-	}
-	gw, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ts := httptest.NewServer(gw.Handler())
-	defer ts.Close()
-
-	// 内核兜底解析 Anthropic 形状 → 200（走 OpenAI 兜底序列化）
-	code, body := postJSON(t, ts.URL+"/v1/messages", "sk-e2e-0001",
-		`{"model":"gpt-test","max_tokens":64,"messages":[{"role":"user","content":"hi"}]}`)
-	if code != 200 {
-		t.Fatalf("无适配器认领时内核兜底应仍 200, 实得 %d: %s", code, body)
-	}
-}

internal/gateway/mount.go

@@ -1,231 +0,0 @@
-// Package gateway — 对外挂载点（R3 / Phase 6）
-//
-// 用户需求：插件与适配器可以注册**对外服务的端口**。
-//
-// 现状：插件已经能注册 HTTP 端点，但被固定在 /api/plugins/http/ 前缀下。
-// 那条前缀限制是有理由的（可 grep、可整体撤销、插件无法影子内核路由），
-// 但它也意味着插件无法提供"看起来像内核一部分"的接口——而对外服务恰恰
-// 需要这个（例如给上游回调用的固定路径 /v1/plugins/<name>/callback）。
-//
-// 本文件放开这一点，同时把当初那条限制的**三个理由**逐条补回来：
-//
-//  1. 可 grep / 可整体撤销 → 每条自定义挂载都必须落在 /plugins/ 或
-//     /v1/plugins/ 命名空间内（不接受任意前缀）
-//  2. 不能影子内核路由 → 与内核保留路由表做前缀冲突检测，撞了直接拒绝
-//  3. 鉴权默认关闭 → 沿用 HTTPHandler 的 roles/keys/public 语义
-package gateway
-
-import (
-	"fmt"
-	"net/http"
-	"sort"
-	"strings"
-
-	"llmsproxy/internal/lua"
-)
-
-// allowedMountPrefixes are the only namespaces a plugin/adapters may claim.
-//
-// A free-form prefix would let a plugin register "/v1/chat/completions" and
-// silently intercept every inference request on the gateway — the exact
-// shadowing the narrow default prefix was protecting against. Constraining the
-// namespace keeps the security property while still allowing a stable public
-// path.
-var allowedMountPrefixes = []string{"/plugins/", "/v1/plugins/"}
-
-// kernelReservedPrefixes are prefixes the kernel owns. A custom mount that
-// overlaps any of them is refused, so an operator's route table can never
-// change meaning because a plugin was installed.
-//
-// This list is deliberately explicit rather than derived from the router's
-// switch: the switch is code, and a future branch added there would silently
-// become shadowable if this were inferred. The test
-// TestKernelRoutesAreAllCoveredByReservedPrefixes keeps the two in sync.
-var kernelReservedPrefixes = []string{
-	"/v1/chat/completions",
-	"/v1/messages",
-	"/v1/images/generations",
-	"/v1/models",
-	"/api/",
-	"/login",
-	"/ui",
-	"/",
-}
-
-// ValidateCustomMount checks that a plugin-declared mount point is allowed.
-//
-// Returns the normalized path (leading slash, no trailing slash) or an error
-// naming the conflict. The error text is what an operator sees in the plugin's
-// load-error field, so it says WHICH rule was hit.
-func ValidateCustomMount(p string) (string, error) {
-	p = strings.TrimSpace(p)
-	if p == "" {
-		return "", fmt.Errorf("empty mount path")
-	}
-	if !strings.HasPrefix(p, "/") {
-		return "", fmt.Errorf("mount path %q must start with /", p)
-	}
-	if strings.Contains(p, "..") || strings.Contains(p, "//") {
-		return "", fmt.Errorf("mount path %q contains an empty or escaping segment", p)
-	}
-	norm := strings.TrimRight(p, "/")
-	if norm == "" {
-		norm = "/"
-	}
-
-	// Rule 1: must live in one of the allowed namespaces.
-	ok := false
-	for _, pre := range allowedMountPrefixes {
-		if strings.HasPrefix(norm+"/", pre) {
-			ok = true
-			break
-		}
-	}
-	if !ok {
-		return "", fmt.Errorf("mount path %q must be under %s",
-			norm, strings.Join(allowedMountPrefixes, " or "))
-	}
-
-	// Rule 2: must not overlap a kernel route.
-	for _, res := range kernelReservedPrefixes {
-		if res == "/" {
-			continue // the catch-all is handled by the namespace rule above
-		}
-		if norm == strings.TrimRight(res, "/") || strings.HasPrefix(norm, res) {
-			return "", fmt.Errorf("mount path %q collides with the kernel route %q", norm, res)
-		}
-	}
-	return norm, nil
-}
-
-// RouteOwner describes one occupied route, for conflict reporting.
-type RouteOwner struct {
-	Path  string
-	Owner string // "kernel", "plugin:name", "adapter:name"
-}
-
-// BuildRouteTable assembles the set of paths a plugin/adapters must not take.
-// It is used both to validate new mounts and to explain a conflict to an
-// operator (a bare "conflict" is not actionable; "already served by plugin X" is).
-func BuildRouteTable(pluginMounts, adapterMounts map[string]string) []RouteOwner {
-	var out []RouteOwner
-	for _, p := range kernelReservedPrefixes {
-		if p == "/" {
-			continue
-		}
-		out = append(out, RouteOwner{Path: strings.TrimRight(p, "/"), Owner: "kernel"})
-	}
-	for path, owner := range pluginMounts {
-		out = append(out, RouteOwner{Path: path, Owner: "plugin:" + owner})
-	}
-	for path, owner := range adapterMounts {
-		out = append(out, RouteOwner{Path: path, Owner: "adapter:" + owner})
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Path < out[j].Path })
-	return out
-}
-
-// FindMountConflict reports whether candidate overlaps an occupied route and, if
-// so, who holds it.
-//
-// Overlap is checked in BOTH directions: a new mount that CONTAINS an existing
-// one shadows it just as effectively as one nested inside it, and only checking
-// the prefix direction would let "/plugins/x/sub" be registered before
-// "/plugins/x" and then silently swallow it.
-func FindMountConflict(candidate string, table []RouteOwner) (RouteOwner, bool) {
-	c := strings.TrimRight(candidate, "/")
-	for _, r := range table {
-		rp := strings.TrimRight(r.Path, "/")
-		if rp == "" {
-			continue
-		}
-		if c == rp || strings.HasPrefix(c, rp+"/") || strings.HasPrefix(rp, c+"/") {
-			return r, true
-		}
-	}
-	return RouteOwner{}, false
-}
-
-// handleCustomMount dispatches a request to a plugin that claimed a custom mount
-// path (/plugins/<name>/… or /v1/plugins/<name>/…).
-//
-// It deliberately REUSES handlePluginHTTP rather than reimplementing dispatch:
-// that function already does longest-match resolution, per-endpoint
-// roles/keys/public authorization and the Lua call protocol. Duplicating it here
-// would create two dispatch paths that must be kept in agreement — and a
-// security rule that is enforced on only one of them is worse than none.
-//
-// The rewrite below maps a claimed mount onto the handler table's canonical
-// form: handler paths are declared as "<name>/<rest>", so the request path is
-// reduced to exactly that. Anything that does not reduce cleanly (a missing
-// name, a name with no registered handler) is a 404, not a fallthrough — a
-// custom namespace that silently answered from the default prefix would make
-// the mount validation meaningless.
-func (g *Gateway) handleCustomMount(w http.ResponseWriter, r *http.Request) {
-	owner, rest, ok := parseMountRef(r.URL.Path)
-	if !ok || owner == "" {
-		writeError(w, http.StatusNotFound, "not_found", "malformed plugin mount path")
-		return
-	}
-	ps := g.core.Plugins()
-	if ps == nil {
-		writeError(w, http.StatusNotFound, "not_found", "no plugins loaded")
-		return
-	}
-	// Resolve which handler owns this mount, so an unclaimed namespace is a 404.
-	handlers := ps.HTTPHandlers()
-	candidate := owner
-	if rest != "" {
-		candidate = owner + "/" + rest
-	}
-	if !mountClaimed(handlers, candidate) {
-		writeError(w, http.StatusNotFound, "not_found",
-			"no plugin serves "+r.URL.Path)
-		return
-	}
-	// Reuse the default dispatcher by presenting the path in its own shape.
-	r2 := r.Clone(r.Context())
-	r2.URL.Path = pluginHTTPPrefix + candidate
-	g.handlePluginHTTP(w, r2)
-}
-
-// mountClaimed reports whether any registered handler's path is a prefix of the
-// candidate (longest-match semantics: /plugins/auth/token is served by a
-// handler declared as "auth").
-func mountClaimed(handlers []lua.HTTPHandler, candidate string) bool {
-	for i := range handlers {
-		h := strings.Trim(handlers[i].Path, "/")
-		if h == "" {
-			continue
-		}
-		if candidate == h || strings.HasPrefix(candidate, h+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// parseMountRef splits "/plugins/<name>/<rest>" or "/v1/plugins/<name>/<rest>"
-// into its owner name and remaining path.
-//
-// The "/v1/plugins/" form is checked first because it has the longer prefix:
-// testing "/plugins/" first would match nothing for a /v1/ path, but keeping the
-// ordering explicit avoids a future prefix being added that nests inside
-// another.
-func parseMountRef(p string) (owner, rest string, ok bool) {
-	prefixes := []string{"/v1/plugins/", "/plugins/"}
-	for _, prefix := range prefixes {
-		if !strings.HasPrefix(p, prefix) {
-			continue
-		}
-		trimmed := strings.TrimPrefix(p, prefix)
-		if trimmed == "" {
-			return "", "", false
-		}
-		if i := strings.Index(trimmed, "/"); i >= 0 {
-			return trimmed[:i], trimmed[i+1:], true
-		}
-		return trimmed, "", true
-	}
-	return "", "", false
-}

internal/gateway/mount_test.go

@@ -1,324 +0,0 @@
-package gateway
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// 本文件锁定 R3 的两条不变量：
-//  1. 自定义挂载只能落在允许的命名空间内
-//  2. 任何内核路由都不能被插件声明覆盖 —— 且这条在新增内核路由时**不会失效**
-
-// TestValidateCustomMountNamespace 只有 /plugins/ 与 /v1/plugins/ 可被占用。
-func TestValidateCustomMountNamespace(t *testing.T) {
-	ok := []string{
-		"/plugins/auth/token",
-		"/plugins/auth",
-		"/v1/plugins/callback",
-		"/v1/plugins/callback/recv",
-		"/plugins/nested/deep/path",
-	}
-	for _, p := range ok {
-		if _, err := ValidateCustomMount(p); err != nil {
-			t.Errorf("合法挂载 %q 被拒: %v", p, err)
-		}
-	}
-	bad := []string{
-		"",
-		"plugins/x",            // 没有前导斜杠
-		"/v1/chat/completions", // 影子内核路由（且不在允许命名空间）
-		"/api/anything",        // 内核命名空间
-		"/callback",            // 任意前缀
-		"/plugins/../etc",      // 逃逸
-		"/plugins//double",     // 空段
-		"/v1/plugins/../../x",
-	}
-	for _, p := range bad {
-		if _, err := ValidateCustomMount(p); err == nil {
-			t.Errorf("非法挂载 %q 被接受", p)
-		}
-	}
-}
-
-// TestCustomMountCannotShadowKernelRoute 逐条核对内核保留前缀。
-func TestCustomMountCannotShadowKernelRoute(t *testing.T) {
-	// 这些是要保护的公开接口；任何能覆盖它们的挂载都必须被拒。
-	for _, kernel := range []string{"/v1/chat/completions", "/v1/messages", "/v1/models"} {
-		// 尝试用允许命名空间里的路径去"贴近"内核路由 —— 例如
-		// /v1/plugins/../../v1/models（逃逸），必须被拒。
-		cand := "/v1/plugins/../../" + strings.TrimPrefix(kernel, "/")
-		if _, err := ValidateCustomMount(cand); err == nil {
-			t.Errorf("逃逸路径 %q 应被拒", cand)
-		}
-	}
-}
-
-// TestKernelRoutesAreAllCoveredByReservedPrefixes 是这道防线**不腐坏**的保证。
-//
-// 它从 server.go 里把路由 switch 的分支字符串刮出来，逐个检查是否被
-// kernelReservedPrefixes 覆盖。将来有人新增一条内核路由却忘了更新保留表时，
-// 这条测试会失败 —— 否则新路由会静默变成可被插件覆盖的。
-func TestKernelRoutesAreAllCoveredByReservedPrefixes(t *testing.T) {
-	src, err := os.ReadFile("server.go")
-	if err != nil {
-		t.Fatal(err)
-	}
-	// 抓 switch 里的字面量路径：case r.URL.Path == "/x" / HasPrefix(..., "/x")
-	re := regexp.MustCompile(`r\.URL\.Path\s*==\s*"(/[^"]*)"`)
-	matches := re.FindAllStringSubmatch(string(src), -1)
-	if len(matches) == 0 {
-		t.Fatal("没有从 server.go 抓到任何路由字面量 —— 测试自身失效")
-	}
-	covered := func(p string) bool {
-		// "/" is the UI catch-all (serveUI). It is the default branch, not a
-		// path a plugin could shadow, and it is covered by the namespace rule:
-		// a custom mount must start with /plugins/ or /v1/plugins/, neither of
-		// which is "/".
-		if p == "/" {
-			return true
-		}
-		for _, res := range kernelReservedPrefixes {
-			if res == "/" {
-				continue
-			}
-			rp := strings.TrimRight(res, "/")
-			if p == rp || strings.HasPrefix(p, rp+"/") {
-				return true
-			}
-		}
-		// /api/plugins/... 由 pluginHTTPPrefix 与 /api/ 覆盖
-		if strings.HasPrefix(p, "/api/") {
-			return true
-		}
-		return false
-	}
-	for _, m := range matches {
-		p := m[1]
-		if !covered(p) {
-			t.Errorf("内核路由 %q 未被 kernelReservedPrefixes 覆盖 —— "+
-				"新增路由时必须同步更新保留表，否则插件可影子它", p)
-		}
-	}
-}
-
-// TestMountConflictDetectionBothDirections 冲突检测必须双向。
-//
-// 只查一个方向会让「先注册 /plugins/x，后注册 /plugins/x/sub」或反过来时的
-// 一个被另一个静默吞掉。
-func TestMountConflictDetectionBothDirections(t *testing.T) {
-	table := []RouteOwner{{Path: "/plugins/x", Owner: "plugin:a"}}
-	// 被包含
-	if _, conflict := FindMountConflict("/plugins/x/sub", table); !conflict {
-		t.Error("嵌套在已有挂载下的路径应判冲突")
-	}
-	// 包含
-	if _, conflict := FindMountConflict("/plugins", table); !conflict {
-		t.Error("包含已有挂载的路径应判冲突")
-	}
-	// 相同
-	if _, conflict := FindMountConflict("/plugins/x", table); !conflict {
-		t.Error("完全相同的路径应判冲突")
-	}
-	// 无关（前缀相似但不是路径段）
-	if _, conflict := FindMountConflict("/plugins/xy", table); conflict {
-		t.Error("/plugins/xy 与 /plugins/x 不是同一个路径段，不该判冲突")
-	}
-}
-
-// TestMountConflictNamesTheOwner 冲突信息必须点名持有者（否则不可行动）。
-func TestMountConflictNamesTheOwner(t *testing.T) {
-	table := []RouteOwner{{Path: "/plugins/taken", Owner: "plugin:other"}}
-	owner, conflict := FindMountConflict("/plugins/taken/deep", table)
-	if !conflict {
-		t.Fatal("应判冲突")
-	}
-	if owner.Owner != "plugin:other" {
-		t.Errorf("应点名持有者 plugin:other, 实得 %q", owner.Owner)
-	}
-}
-
-// TestParseMountRef 解析两种命名空间。
-func TestParseMountRef(t *testing.T) {
-	cases := []struct {
-		in, owner, rest string
-		ok              bool
-	}{
-		{"/plugins/auth/token", "auth", "token", true},
-		{"/plugins/auth", "auth", "", true},
-		{"/v1/plugins/cb/recv", "cb", "recv", true},
-		{"/v1/plugins/cb", "cb", "", true},
-		{"/plugins/", "", "", false},
-		{"/plugins", "", "", false},
-		{"/other/x", "", "", false},
-	}
-	for _, c := range cases {
-		owner, rest, ok := parseMountRef(c.in)
-		if ok != c.ok || owner != c.owner || rest != c.rest {
-			t.Errorf("parseMountRef(%q) = (%q,%q,%v), want (%q,%q,%v)",
-				c.in, owner, rest, ok, c.owner, c.rest, c.ok)
-		}
-	}
-}
-
-// TestBuildRouteTableIncludesKernel 路由表含内核保留项（供冲突提示用）。
-func TestBuildRouteTableIncludesKernel(t *testing.T) {
-	table := BuildRouteTable(
-		map[string]string{"/plugins/a": "alpha"},
-		map[string]string{"/v1/plugins/b": "beta"},
-	)
-	var hasKernel, hasPlugin, hasAdapter bool
-	for _, r := range table {
-		if r.Owner == "kernel" {
-			hasKernel = true
-		}
-		if r.Owner == "plugin:alpha" {
-			hasPlugin = true
-		}
-		if r.Owner == "adapter:beta" {
-			hasAdapter = true
-		}
-	}
-	if !hasKernel || !hasPlugin || !hasAdapter {
-		t.Errorf("路由表应含 kernel/plugin/adapter 三类: %+v", table)
-	}
-}
-
-// TestPluginServesCustomMountEndToEnd 是 R3 的端到端验收：
-// 插件声明一个自定义对外挂载点，客户端按该路径访问，得到插件的应答。
-func TestPluginServesCustomMountEndToEnd(t *testing.T) {
-	ts, key := messagesGateway(t)
-	// messagesGateway 用的 core 没有插件目录配置，这里直接建一个带插件的。
-	_ = ts
-	_ = key
-
-	dir := t.TempDir()
-	cfg := &config.Config{
-		Path:         filepath.Join(dir, "config.yaml"),
-		AdapterDir:   filepath.Join(dir, "adapters"),
-		PluginDir:    filepath.Join(dir, "plugins"),
-		RuntimeFile:  filepath.Join(dir, "runtime.json"),
-		Listen:       "127.0.0.1:0",
-		DefaultModel: "AUTO",
-		GatewayKeys:  []string{"sk-mount-0001"},
-		Sources: []config.Source{{
-			Name: "s", BaseURL: "http://127.0.0.1:1/v1", Adapter: "openai",
-			APIKey: "k", MaxConcurrent: 1,
-			Models: []config.Model{{ID: "m", Kind: "chat"}},
-		}},
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-	gw, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ts2 := httptest.NewServer(gw.Handler())
-	defer ts2.Close()
-
-	// 装一个声明自定义挂载的插件
-	code := `
-local plugin = { name = "publicapi", version = "1.0" }
-plugin.http = {
-  { path = "publicapi/token", method = "GET", handler = "token",
-    roles = { "admin", "user" }, description = "对外 token 端点" },
-}
-function plugin.token(req)
-  return { status = 200, body = '{"token":"abc"}' }
-end
-return plugin
-`
-	if err := c.Plugins().LoadSource("publicapi", code); err != nil {
-		t.Fatalf("load plugin: %v", err)
-	}
-
-	// 按自定义挂载访问
-	req, _ := http.NewRequest("GET", ts2.URL+"/plugins/publicapi/token", nil)
-	req.Header.Set("Authorization", "Bearer "+cfg.GatewayKeys[0])
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode != 200 {
-		t.Fatalf("自定义挂载 status = %d: %s", resp.StatusCode, body)
-	}
-	if !strings.Contains(string(body), "abc") {
-		t.Errorf("自定义挂载未返回插件应答: %s", body)
-	}
-
-	// /v1/plugins/ 形式同样可用
-	req2, _ := http.NewRequest("GET", ts2.URL+"/v1/plugins/publicapi/token", nil)
-	req2.Header.Set("Authorization", "Bearer "+cfg.GatewayKeys[0])
-	resp2, err := http.DefaultClient.Do(req2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp2.Body.Close()
-	if resp2.StatusCode != 200 {
-		t.Errorf("/v1/plugins/ 形式 status = %d", resp2.StatusCode)
-	}
-
-	// 未声明的命名空间 404（不能因为落在允许命名空间就放行）
-	req3, _ := http.NewRequest("GET", ts2.URL+"/plugins/nobody/here", nil)
-	req3.Header.Set("Authorization", "Bearer "+cfg.GatewayKeys[0])
-	resp3, err := http.DefaultClient.Do(req3)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp3.Body.Close()
-	if resp3.StatusCode != 404 {
-		t.Errorf("未注册的挂载应 404, 实得 %d", resp3.StatusCode)
-	}
-
-	// 鉴权仍生效：无 key 时，
-	//   - API 路径（/v1/plugins/…）应 401（isAPIPath 判定）
-	//   - 浏览器路径（/plugins/…）应 302 跳登录页
-	req4, _ := http.NewRequest("GET", ts2.URL+"/v1/plugins/publicapi/token", nil)
-	noRedirect := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error {
-		return http.ErrUseLastResponse
-	}}
-	resp4, err := noRedirect.Do(req4)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp4.Body.Close()
-	if resp4.StatusCode != 401 {
-		t.Errorf("无 key 访问 /v1/plugins/ 应 401, 实得 %d", resp4.StatusCode)
-	}
-
-	req5, _ := http.NewRequest("GET", ts2.URL+"/plugins/publicapi/token", nil)
-	resp5, err := noRedirect.Do(req5)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp5.Body.Close()
-	if resp5.StatusCode != 302 {
-		t.Errorf("无 key 访问 /plugins/ 应 302 跳登录, 实得 %d", resp5.StatusCode)
-	}
-	if loc := resp5.Header.Get("Location"); !strings.Contains(loc, "/login") {
-		t.Errorf("应跳转到 /login, 实得 %q", loc)
-	}
-}
-
-// TestCustomMountCannotInterceptKernelRoute 端到端确认内核路由不受影响：
-// 即使有插件在用 /plugins/，/v1/chat/completions 与 /v1/models 仍归内核。
-func TestCustomMountCannotInterceptKernelRoute(t *testing.T) {
-	for _, p := range []string{"/v1/chat/completions", "/v1/models", "/v1/messages", "/api/stats"} {
-		if _, err := ValidateCustomMount(p); err == nil {
-			t.Errorf("内核路由 %q 必须不能被声明为自定义挂载", p)
-		}
-	}
-}

internal/gateway/overflow_err_test.go

@@ -94,74 +94,3 @@ func TestOverflowPhraseSurvivesTruncationWidth(t *testing.T) {
 		t.Fatalf("归一化标记丢失: %q", got)
 	}
 }
-
-// piNonOverflowRe 是 @earendil-works/pi-ai 的 NON_OVERFLOW_PATTERNS。
-// pi 的 isContextOverflow 先查这一组，命中则直接判为「非超窗」——
-// 即使 OVERFLOW_PATTERNS 也命中，也不会压缩重试。
-var piNonOverflowRe = []*regexp.Regexp{
-	regexp.MustCompile(`^(Throttling error|Service unavailable):`),
-	regexp.MustCompile(`(?i)rate limit`),
-	regexp.MustCompile(`(?i)too many requests`),
-}
-
-// piWouldCompact 复刻 isContextOverflow 的 Case 1 判定顺序：
-// 先排除 NON_OVERFLOW，再匹配 OVERFLOW。
-func piWouldCompact(errorMessage string) bool {
-	for _, p := range piNonOverflowRe {
-		if p.MatchString(errorMessage) {
-			return false
-		}
-	}
-	return piOverflowRe.MatchString(errorMessage)
-}
-
-// issue 回归：AUTO 链失败消息天然把「超窗 tier」和「配额/限流 tier」拼在一起，
-// 超窗标记后面只要出现 rate limit / too many requests 的字样，
-// pi 就会把整条消息判为「非超窗」而拒绝压缩重试。
-func TestOverflowMessageSurvivesRateLimitedSiblingTier(t *testing.T) {
-	cases := []struct {
-		name    string
-		sibling string
-	}{
-		{"rate limit 措辞", "api error 429: rate limit exceeded"},
-		{"too many requests 措辞", "429 Too Many Requests"},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			err := &scheduler.ChainErr{Tiers: []scheduler.TierError{
-				{Tier: 1, Source: "sensenova", Model: "glm-5.2", Err: errors.New(tc.sibling)},
-				{Tier: 3, Source: "gozen", Model: "deepseek-v4.1-flash",
-					Err: errors.New("api error 400: This model's maximum context length is 1048576 tokens")},
-			}}
-
-			got := clientUpstreamErr(err)
-			if !piWouldCompact(got) {
-				t.Fatalf("同链限流 tier 封杀了超窗识别，pi 不会压缩重试: %q", got)
-			}
-			// 干净：不得把限流 tier 的措辞带出去。
-			for _, p := range piNonOverflowRe {
-				if p.MatchString(got) {
-					t.Fatalf("超窗消息仍带限流措辞 %v: %q", p, got)
-				}
-			}
-			// 但仍要能看出是哪个源超的窗。
-			if !strings.Contains(got, "gozen/deepseek-v4.1-flash") {
-				t.Errorf("超窗源信息丢失: %q", got)
-			}
-		})
-	}
-}
-
-// 直连超窗同样要干净可用。
-func TestDirectOverflowMessageIsClean(t *testing.T) {
-	raw := "api error 400: Error from provider (Console Go): This model's maximum context length is 1048576 tokens. " +
-		"However, you requested 1440050 tokens. Please reduce the length of the messages or completion."
-	got := clientUpstreamErr(errors.New(raw))
-	if !piWouldCompact(got) {
-		t.Fatalf("直连超窗未被 pi 识别: %q", got)
-	}
-	if !strings.Contains(got, overflowCanonical) {
-		t.Fatalf("缺少归一化标记: %q", got)
-	}
-}

internal/gateway/plugin_call_api_test.go

@@ -1,150 +0,0 @@
-package gateway
-
-// The /api/plugins/{name}/call/{fn} endpoint splits its path with string
-// surgery, and the split point is easy to get wrong in a way that still
-// "works": keeping the "call/" segment in the function name produced
-// `does not export "call/collect_account"` — the plugin was correct, the router
-// was not, and every call 502'd while the exports list looked perfectly fine.
-//
-// These tests drive the real router, so a refactor that reintroduces the
-// off-by-one is caught here rather than in production.
-
-import (
-	"encoding/json"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// callPlugin exposes exactly one export plus a function that is NOT exported.
-// If the exports gate is not honoured, secretFn is reachable and with it the
-// plugin's private state — for a plugin holding an API key that means handing
-// the key to anyone who can POST to the gateway.
-const callPlugin = `
-local P = {}
-P.name = "calltest"
-P.version = "1.0.0"
-P.exports = { "add" }
-P.secret = "do-not-leak"
-function P.add(a)
-  return { result = (tonumber(a and a.x) or 0) + 1 }
-end
-function P.secretFn()
-  return { leaked = P.secret }
-end
-return P
-`
-
-func gatewayWithCallPlugin(t *testing.T) *Gateway {
-	t.Helper()
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	body := "listen: :0\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"plugin_dir: " + filepath.Join(dir, "plugins") + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"gateway_keys:\n  - sk-test\n"
-	if err := os.WriteFile(cfgPath, []byte(body), 0600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	if err := c.Plugins().LoadSource("calltest", callPlugin); err != nil {
-		t.Fatalf("load calltest: %v", err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g
-}
-
-func TestPluginCallSplitsFunctionNameCorrectly(t *testing.T) {
-	g := gatewayWithCallPlugin(t)
-	rr := doReq(t, g, http.MethodPost,
-		"/api/plugins/calltest/call/add", `{"x":41}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("call failed: HTTP %d %s", rr.Code, rr.Body.String())
-	}
-	var out struct {
-		Result struct {
-			Result int `json:"result"`
-		} `json:"result"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &out); err != nil {
-		t.Fatalf("decode: %v (body=%s)", err, rr.Body.String())
-	}
-	// 41 + 1 == 42. Reaching 42 proves BOTH halves of the contract: the "/call/"
-	// segment did not leak into the function name, and the payload arrived.
-	if out.Result.Result != 42 {
-		t.Fatalf("got %d, want 42 — either the /call/ segment leaked into the "+
-			"function name or the argument table never reached Lua", out.Result.Result)
-	}
-}
-
-func TestPluginCallRefusesUndeclaredFunction(t *testing.T) {
-	g := gatewayWithCallPlugin(t)
-	rr := doReq(t, g, http.MethodPost,
-		"/api/plugins/calltest/call/secretFn", `{}`)
-	if rr.Code == http.StatusOK {
-		t.Fatalf("an unexported function must not be callable, got 200: %s",
-			rr.Body.String())
-	}
-	if strings.Contains(rr.Body.String(), "do-not-leak") {
-		t.Fatal("the refusal leaked the plugin's private state")
-	}
-}
-
-// A plugin that declares no exports at all has no callable surface. Reading the
-// missing list as "allow everything" would turn every plugin into a remote
-// evaluator the moment this endpoint ships.
-func TestPluginCallWithoutExportsHasNoCallableSurface(t *testing.T) {
-	g := gatewayWithCallPlugin(t)
-	const bare = `
-local P = {}
-P.name = "bare"
-P.version = "1.0.0"
-function P.anything()
-  return { ok = true }
-end
-return P
-`
-	if err := g.core.Plugins().LoadSource("bare", bare); err != nil {
-		t.Fatalf("load bare: %v", err)
-	}
-	rr := doReq(t, g, http.MethodPost,
-		"/api/plugins/bare/call/anything", `{}`)
-	if rr.Code == http.StatusOK {
-		t.Fatalf("a plugin with no plugin.exports must expose nothing, got 200: %s",
-			rr.Body.String())
-	}
-}
-
-func TestPluginCallIsAdminOnly(t *testing.T) {
-	g := gatewayWithCallPlugin(t)
-	// A real user-role key, not a bare one from config: sk-test/sk-user in the
-	// config both default to admin, so a test using them would pass the gate for
-	// the wrong reason and prove nothing.
-	rec, err := g.core.CreateKey("viewer", "user", nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	rr := doReqAs(t, g, rec.Key, http.MethodPost,
-		"/api/plugins/calltest/call/add", `{"x":1}`)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("a non-admin key reached the call endpoint: HTTP %d %s",
-			rr.Code, rr.Body.String())
-	}
-}

internal/gateway/plugin_http_routes.go

@@ -1,266 +0,0 @@
-package gateway
-
-// Mount for plugin-registered HTTP endpoints.
-//
-// The gateway owns the listener, the authentication, the role check and the
-// response framing; the plugin owns the logic. That split is the point: a plugin
-// cannot open a socket, cannot bypass auth, and cannot choose a path outside
-// /api/plugins/http/.
-//
-// Why this exists rather than "plugins can call each other": some things are
-// worth querying from OUTSIDE the browser — a CI job asking whether the upstream
-// balance is above zero, a monitoring probe, another tool on the box. billing
-// never wanted this (it only receives hooks); a quota plugin does. Hard-coding a
-// route per plugin would mean a gateway change for every such plugin, and an
-// arbitrary plugin's code in the main mux is not something the routing table
-// should ever grow.
-
-import (
-	"net/http"
-	"sort"
-	"strconv"
-	"strings"
-
-	"llmsproxy/internal/lua"
-)
-
-// pluginHTTPPrefix is the mount point. It is deliberately narrow: a plugin's
-// routes live under one prefix, which makes them greppable, makes them easy to
-// revoke wholesale, and means a plugin cannot shadow /api/keys or /api/stats.
-const pluginHTTPPrefix = "/api/plugins/http/"
-
-// handlePluginHTTP dispatches a request to whichever plugin registered the
-// longest matching path.
-//
-// Longest-match rather than first-match: a plugin may register /health and
-// another /health/deep, and both must work. With registration order deciding it,
-// the outcome would depend on load order and change when a plugin is added.
-func (g *Gateway) handlePluginHTTP(w http.ResponseWriter, r *http.Request) {
-	rest := strings.TrimPrefix(r.URL.Path, pluginHTTPPrefix)
-	ps := g.core.Plugins()
-	if ps == nil {
-		writeError(w, http.StatusNotFound, "not_found", "no plugins loaded")
-		return
-	}
-
-	matches := ps.HTTPHandlers()
-	var chosen *lua.HTTPHandler
-	var params map[string]string
-	// contenders holds the handlers that matched at the current best depth with
-	// the SAME literal route pattern — i.e. two plugins that both declared this
-	// exact path. That is the contested case the operator must arbitrate (user
-	// requirement A): rather than let load order pick a silent winner, a
-	// contested path with no recorded decision returns 409 naming the candidates.
-	var contenders []lua.HTTPHandler
-	for i := range matches {
-		h := matches[i]
-		p, ok := matchHandlerPath(h.Path, rest)
-		if !ok {
-			continue
-		}
-		switch {
-		case chosen == nil || segmentCount(h.Path) > segmentCount(chosen.Path):
-			chosen, params = &matches[i], p
-			contenders = []lua.HTTPHandler{matches[i]}
-		case segmentCount(h.Path) == segmentCount(chosen.Path) && h.Path == chosen.Path:
-			// Same route pattern, a different plugin. The winner is arbitrated below.
-			contenders = append(contenders, matches[i])
-		}
-	}
-	if chosen == nil {
-		writeError(w, http.StatusNotFound, "not_found",
-			"no plugin serves this path")
-		return
-	}
-	if len(contenders) > 1 {
-		resolved := g.resolveContestedRoute(w, ps, chosen.Path, contenders)
-		if resolved == nil {
-			return // 409 already written, naming the candidates
-		}
-		chosen = resolved
-	}
-
-	if !strings.EqualFold(r.Method, chosen.Method) {
-		w.Header().Set("Allow", chosen.Method)
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed",
-			"this endpoint accepts "+chosen.Method+" only")
-		return
-	}
-
-	role := reqRole(r.Context())
-	if !chosen.Allows(role, reqKeyName(r.Context())) {
-		writeError(w, http.StatusForbidden, "forbidden",
-			handlerAccessHint(*chosen))
-		return
-	}
-
-	body, err := readBody(r)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-		return
-	}
-	req := &lua.HandlerRequest{
-		Method:  r.Method,
-		Path:    rest,
-		Query:   flattenQuery(r.URL.Query()),
-		Params:  params,
-		Headers: flattenHeader(r.Header),
-		Body:    body,
-		Role:    role,
-		Key:     reqKey(r.Context()),
-	}
-	resp, err := ps.InvokeHandler(handlerOwner(chosen), chosen.Handler, req)
-	if err != nil {
-		// A plugin error is a 502, not a 500: the gateway is fine, the plugin is
-		// not, and the operator needs to tell those apart in their logs.
-		writeError(w, http.StatusBadGateway, "plugin_error", err.Error())
-		return
-	}
-	lua.WriteHandlerResponse(w, resp)
-}
-
-// resolveContestedRoute arbitrates a service path that more than one plugin
-// declared (user requirement A). It returns the winning handler, or nil after
-// writing a 409 when the operator has not yet chosen.
-//
-// This is the crux of the "report, don't crash, don't silently pick" rule: with
-// two plugins both serving e.g. "stats", load order used to decide the winner.
-// Now an unresolved contest is a 409 that NAMES the candidates, and the operator
-// picks one in the WebUI (POST /api/plugins/conflicts). A recorded decision is
-// honoured here on every request thereafter.
-func (g *Gateway) resolveContestedRoute(w http.ResponseWriter, ps *lua.Plugins, path string, contenders []lua.HTTPHandler) *lua.HTTPHandler {
-	winner := ps.RouteWinner(path)
-	if winner != "" {
-		for i := range contenders {
-			if contenders[i].Plugin == winner {
-				return &contenders[i]
-			}
-		}
-		// A decision exists but points at a plugin that no longer serves this
-		// path (it was removed or edited). Fall through to 409 rather than honour
-		// a stale winner that cannot answer.
-	}
-	names := make([]string, 0, len(contenders))
-	for i := range contenders {
-		names = append(names, contenders[i].Plugin)
-	}
-	sort.Strings(names)
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	writeJSON(w, http.StatusConflict, map[string]interface{}{
-		"error": map[string]interface{}{
-			"type":       "route_conflict",
-			"message":    "service path \"" + path + "\" is claimed by " + strconv.Itoa(len(names)) + " plugins (" + strings.Join(names, ", ") + "); an operator must choose one in the admin UI (Conflicts) or POST /api/plugins/conflicts",
-			"path":       path,
-			"candidates": names,
-		},
-	})
-	return nil
-}
-
-// handlerAccessHint explains, in the refusal, exactly which declaration would
-// open this endpoint. A 403 with no reason is the kind of thing an operator
-// opens the source to work out, and then the fix is a guess.
-func handlerAccessHint(h lua.HTTPHandler) string {
-	switch {
-	case len(h.Keys) > 0:
-		return "this endpoint allows only the named keys (" +
-			strings.Join(h.Keys, ", ") + "); authenticate with one of them"
-	case len(h.Roles) > 0:
-		return "this endpoint requires role " + strings.Join(h.Roles, " or ") +
-			" (widen it in the plugin's http declaration, or set public=true)"
-	default:
-		return "this endpoint declares no roles, so it is admin-only; " +
-			"set roles=… or keys=… in the plugin's http declaration"
-	}
-}
-
-// handlerOwner returns the plugin name that registered h. The gateway stores the
-// owner alongside the handler precisely so this does not have to be guessed from
-// the path prefix.
-func handlerOwner(h *lua.HTTPHandler) string { return h.Plugin }
-
-// segmentCount is how deep a route is, used for longest-match. A path with more
-// segments wins, so /health/deep beats /health when both are registered.
-func segmentCount(p string) int { return strings.Count(p, "/") }
-
-// matchHandlerPath matches a route pattern against a concrete path, capturing
-// ":name" segments.
-//
-// Returns ok=false on a segment-count mismatch or a missing value for a
-// param — a route must not match with an empty capture, or two different URLs
-// would reach the same handler indistinguishably.
-func matchHandlerPath(pattern, path string) (map[string]string, bool) {
-	pp := strings.Split(strings.Trim(pattern, "/"), "/")
-	sp := strings.Split(strings.Trim(path, "/"), "/")
-	if len(pp) != len(sp) {
-		return nil, false
-	}
-	var params map[string]string
-	for i := range pp {
-		if strings.HasPrefix(pp[i], ":") {
-			name := pp[i][1:]
-			if sp[i] == "" {
-				return nil, false
-			}
-			if params == nil {
-				params = map[string]string{}
-			}
-			params[name] = sp[i]
-			continue
-		}
-		if pp[i] != sp[i] {
-			return nil, false
-		}
-	}
-	return params, true
-}
-
-func flattenQuery(q map[string][]string) map[string]string {
-	out := make(map[string]string, len(q))
-	for k, v := range q {
-		if len(v) > 0 {
-			out[k] = v[0]
-		}
-	}
-	return out
-}
-
-func flattenHeader(h http.Header) map[string]string {
-	out := make(map[string]string, len(h))
-	for k := range h {
-		out[strings.ToLower(k)] = h.Get(k)
-	}
-	return out
-}
-
-func readBody(r *http.Request) (string, error) {
-	if r.Body == nil {
-		return "", nil
-	}
-	defer r.Body.Close()
-	// A cap, because the handler runs inside the gateway process: an unbounded
-	// body from an authenticated caller is a memory exhaustion vector.
-	const maxBody = 4 << 20
-	buf := make([]byte, 0, 4096)
-	tmp := make([]byte, 32*1024)
-	for {
-		n, err := r.Body.Read(tmp)
-		if n > 0 {
-			if len(buf)+n > maxBody {
-				return "", &bodyTooLarge{}
-			}
-			buf = append(buf, tmp[:n]...)
-		}
-		if err != nil {
-			break
-		}
-	}
-	return string(buf), nil
-}
-
-type bodyTooLarge struct{}
-
-func (bodyTooLarge) Error() string { return "request body exceeds 4 MiB" }
-
-// limitBody is kept for the numeric form some callers want in a log line.
-var _ = strconv.Itoa

internal/gateway/plugin_wiring_test.go

@@ -1,626 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// newFailingServer serves handler and returns its test server.
-func newFailingServer(h http.Handler) *httptest.Server { return httptest.NewServer(h) }
-
-// THE TEST THAT WAS MISSING.
-//
-// Every other plugin test calls Plugins.Fire() directly. That proves the Lua
-// runtime works, but it says nothing about whether the GATEWAY actually fires
-// the stages — the wiring in handleChat / singleChat / writeRec could be
-// deleted and the whole suite would stay green while no hook ever ran in
-// production.
-//
-// So these tests drive real HTTP requests through the real handler and assert
-// on what the plugin observed.
-
-// observed is what a spy plugin recorded. It is written from Lua, so the
-// counters live in plugin state and are read back through the state API.
-type spyPayload struct {
-	Stage  string
-	Type   string
-	Model  string
-	Source string
-	OK     bool
-	Tokens int64
-}
-
-// spyPlugin returns Lua source for a plugin that appends every stage it sees to
-// `state.seen`. It is generated per test so each test gets a clean log.
-func spyPlugin() string {
-	return `
-local plugin = { name = "spy", version = "1.0.0" }
-plugin.state = { seen = {} }
-plugin.hooks = {
-  request_start = "on_start",
-  routed = "on_routed",
-  request_end = "on_end",
-}
-local function rec(p, stage)
-  table.insert(plugin.state.seen, {
-    stage = stage, type = p.type or "", model = p.model or "",
-    source = p.source or "", ok = p.ok and true or false,
-    tokens = p.prompt_tokens or 0,
-  })
-end
-function plugin.on_start(p) rec(p, "request_start") return nil end
-function plugin.on_routed(p) rec(p, "routed") return nil end
-function plugin.on_end(p) rec(p, "request_end") return nil end
-return plugin
-`
-}
-
-// gatewayWithSpy boots a gateway with one mock upstream and the spy plugin
-// loaded, and returns the gateway plus the upstream URL.
-func gatewayWithSpy(t *testing.T) (*Gateway, string) {
-	t.Helper()
-	up := mockUpstream()
-	t.Cleanup(up.Close)
-
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	cfgBody := "listen: :0\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"plugin_dir: " + filepath.Join(dir, "plugins") + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"gateway_keys:\n  - sk-test\n"
-	if err := os.WriteFile(cfgPath, []byte(cfgBody), 0600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources = []config.Source{{
-		Name:    "spyup",
-		BaseURL: up.URL,
-		Adapter: "openai",
-		APIKey:  "sk-x",
-		Models:  []config.Model{{ID: "spy-model", Kind: "chat"}},
-	}}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	if err := c.Plugins().LoadSource("spy", spyPlugin()); err != nil {
-		t.Fatalf("load spy: %v", err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g, up.URL
-}
-
-// seenStages reads the spy's log out of its published state.
-func seenStages(t *testing.T, g *Gateway) []map[string]interface{} {
-	t.Helper()
-	raw := g.core.Plugins().State("spy")
-	if raw == nil {
-		return nil
-	}
-	b, err := json.Marshal(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var st struct {
-		Seen []map[string]interface{} `json:"seen"`
-	}
-	if err := json.Unmarshal(b, &st); err != nil {
-		t.Fatal(err)
-	}
-	return st.Seen
-}
-
-func stageNames(seen []map[string]interface{}) []string {
-	out := make([]string, 0, len(seen))
-	for _, s := range seen {
-		out = append(out, s["stage"].(string))
-	}
-	return out
-}
-
-// TestHooksFireOnRealDirectChat: a plain non-streaming chat through the real
-// handler must produce request_start, routed and request_end — in that order,
-// with the real source and model filled in.
-func TestHooksFireOnRealDirectChat(t *testing.T) {
-	g, _ := gatewayWithSpy(t)
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"spy-model","messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("chat status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	seen := seenStages(t, g)
-	got := stageNames(seen)
-	want := []string{"request_start", "routed", "request_end"}
-	if len(got) != 3 {
-		t.Fatalf("stages = %v, want %v (a hook that never fires is the failure "+
-			"this test exists for)", got, want)
-	}
-	for i := range want {
-		if got[i] != want[i] {
-			t.Fatalf("stage order = %v, want %v", got, want)
-		}
-	}
-	// The payload must be real data, not empty scaffolding.
-	end := seen[2]
-	if end["source"] != "spyup" {
-		t.Errorf("request_end source = %v, want spyup", end["source"])
-	}
-	if end["model"] != "spy-model" {
-		t.Errorf("request_end model = %v, want spy-model", end["model"])
-	}
-	if end["ok"] != true {
-		t.Errorf("request_end ok = %v, want true", end["ok"])
-	}
-	if toInt(t, end["tokens"]) <= 0 {
-		t.Errorf("request_end prompt_tokens = %v, want the mock upstream's real usage", end["tokens"])
-	}
-}
-
-// TestHooksFireOnRealStreamChat: streaming is a DIFFERENT code path (the record
-// is written from a deferred call after the stream ends), so it needs its own
-// assertion. A hook that only worked on the non-streaming path would be a real
-// bug for agent clients, which are the main streaming users.
-func TestHooksFireOnRealStreamChat(t *testing.T) {
-	g, _ := gatewayWithSpy(t)
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"spy-model","stream":true,"messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("stream status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	got := stageNames(seenStages(t, g))
-	if len(got) != 3 {
-		t.Fatalf("stream stages = %v, want all three", got)
-	}
-	if got[0] != "request_start" || got[2] != "request_end" {
-		t.Errorf("stream stage order = %v", got)
-	}
-}
-
-// TestHooksFireOnAutoRequest: the AUTO chain path is a third code path. It also
-// must fire, and routed must report tier -2 (resolved by the chain) rather than
-// the direct path's -1.
-func TestHooksFireOnAutoRequest(t *testing.T) {
-	g, _ := gatewayWithSpy(t)
-	// Register the model in the AUTO chain via the admin API.
-	put := doReq(t, g, http.MethodPut, "/api/auto", `{"rules":[{"model":"spy-model"}]}`)
-	if put.Code != http.StatusOK {
-		t.Fatalf("save auto: %d %s", put.Code, put.Body.String())
-	}
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"AUTO","messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("auto chat status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	seen := seenStages(t, g)
-	if len(seen) != 3 {
-		t.Fatalf("AUTO stages = %v, want three", stageNames(seen))
-	}
-	if seen[0]["model"] != "AUTO" {
-		t.Errorf("request_start model = %v, want the requested \"AUTO\"", seen[0]["model"])
-	}
-	if seen[1]["model"] != "spy-model" {
-		t.Errorf("routed model = %v, want the RESOLVED model", seen[1]["model"])
-	}
-}
-
-// TestHooksFireOnFailedRequest is the one that matters most for accounting: a
-// request that 500s upstream must still reach request_end, or a billing plugin
-// would never see failed traffic.
-func TestHooksFireOnFailedRequest(t *testing.T) {
-	// Point at an upstream that always fails.
-	bad := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusInternalServerError)
-		_, _ = w.Write([]byte(`{"error":"boom"}`))
-	})
-	up := newFailingServer(bad)
-	defer up.Close()
-
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	cfgBody := "listen: :0\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"plugin_dir: " + filepath.Join(dir, "plugins") + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"gateway_keys:\n  - sk-test\n"
-	os.WriteFile(cfgPath, []byte(cfgBody), 0600)
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources = []config.Source{{
-		Name: "badup", BaseURL: up.URL, Adapter: "openai", APIKey: "sk-x",
-		Models: []config.Model{{ID: "bad-model", Kind: "chat"}},
-	}}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	defer c.Close()
-	if err := c.Plugins().LoadSource("spy", spyPlugin()); err != nil {
-		t.Fatal(err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"bad-model","messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code == http.StatusOK {
-		t.Fatal("expected the upstream failure to surface as a non-200")
-	}
-	seen := seenStages(t, g)
-	// request_start must fire; routed must NOT (no source was ever selected);
-	// request_end MUST (otherwise billing misses failed traffic).
-	got := stageNames(seen)
-	if len(got) == 0 || got[0] != "request_start" {
-		t.Fatalf("stages = %v, want request_start first", got)
-	}
-	hasEnd := false
-	for _, s := range seen {
-		if s["stage"] == "request_end" {
-			hasEnd = true
-			if s["ok"] != false {
-				t.Error("request_end reported ok=true for a failed request")
-			}
-		}
-	}
-	if !hasEnd {
-		t.Error("a FAILED request never reached request_end; a billing plugin " +
-			"would not see it at all")
-	}
-	if contains(got, "routed") {
-		t.Error("routed fired for a request that never selected a source")
-	}
-}
-
-// TestBrokenPluginDoesNotBreakForwarding is the safety property, asserted
-// end-to-end: a plugin that throws in EVERY stage must not stop a chat from
-// being served.
-func TestBrokenPluginDoesNotBreakForwarding(t *testing.T) {
-	up := mockUpstream()
-	defer up.Close()
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	os.WriteFile(cfgPath, []byte("listen: :0\n"+
-		"adapter_dir: "+filepath.Join(dir, "adapters")+"\n"+
-		"plugin_dir: "+filepath.Join(dir, "plugins")+"\n"+
-		"runtime_file: "+filepath.Join(dir, "runtime.json")+"\n"+
-		"gateway_keys:\n  - sk-test\n"), 0600)
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources = []config.Source{{
-		Name: "u", BaseURL: up.URL, Adapter: "openai", APIKey: "sk-x",
-		Models: []config.Model{{ID: "m", Kind: "chat"}},
-	}}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-	broken := `
-local plugin = { name = "broken", version = "1.0.0" }
-plugin.hooks = { request_start = "f", routed = "f", request_end = "f" }
-function plugin.f(p) error("plugin is broken") end
-return plugin
-`
-	if err := c.Plugins().LoadSource("broken", broken); err != nil {
-		t.Fatalf("load broken: %v", err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"m","messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("a broken plugin broke forwarding: status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if !strings.Contains(rr.Body.String(), "pong") {
-		t.Errorf("the response is not the upstream's: %s", rr.Body.String())
-	}
-	// And the failure must be visible rather than silent.
-	if len(c.Plugins().HookErrors()) == 0 {
-		t.Error("a plugin that threw in every stage left no error record")
-	}
-}
-
-// TestPluginListIsServedWithStages is the operator-facing check: an admin
-// debugging a plugin needs to see which stages are live and whether the hook
-// file is where the kernel thinks it is.
-func TestPluginListIsServedWithStages(t *testing.T) {
-	g, _ := gatewayWithSpy(t)
-	rr := doReq(t, g, http.MethodGet, "/api/plugins", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d", rr.Code)
-	}
-	for _, want := range []string{"spy", "request_start", "routed", "request_end", "plugin_dir"} {
-		if !strings.Contains(rr.Body.String(), want) {
-			t.Errorf("/api/plugins response lacks %q", want)
-		}
-	}
-}
-
-func toInt(t *testing.T, v interface{}) int64 {
-	t.Helper()
-	f, ok := v.(float64)
-	if !ok {
-		return 0
-	}
-	return int64(f)
-}
-
-func contains(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-// imageUpstream serves an OpenAI-shaped image response.
-func imageUpstream() *httptest.Server {
-	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"created":1,"data":[{"b64_json":"aGk="}]}`))
-	}))
-}
-
-// TestHooksFireOnRealImageRequest: the image path is a THIRD entry point. It
-// has its own handler and its own scheduler call, so "chat works" says nothing
-// about it — and image traffic is billable, so a cost plugin that never sees
-// it under-reports.
-func TestHooksFireOnRealImageRequest(t *testing.T) {
-	up := imageUpstream()
-	defer up.Close()
-
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	os.WriteFile(cfgPath, []byte("listen: :0\n"+
-		"adapter_dir: "+filepath.Join(dir, "adapters")+"\n"+
-		"plugin_dir: "+filepath.Join(dir, "plugins")+"\n"+
-		"runtime_file: "+filepath.Join(dir, "runtime.json")+"\n"+
-		"gateway_keys:\n  - sk-test\n"), 0600)
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources = []config.Source{{
-		Name: "imgup", BaseURL: up.URL, Adapter: "openai", APIKey: "sk-x",
-		Models: []config.Model{{ID: "img-model", Kind: "image"}},
-	}}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	defer c.Close()
-	if err := c.Plugins().LoadSource("spy", spyPlugin()); err != nil {
-		t.Fatal(err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	rr := doReq(t, g, http.MethodPost, "/v1/images/generations",
-		`{"model":"img-model","prompt":"a cat"}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("image status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	seen := seenStages(t, g)
-	got := stageNames(seen)
-	if len(got) != 3 {
-		t.Fatalf("image stages = %v, want all three (image is a separate handler)", got)
-	}
-	if seen[0]["type"] != "image" {
-		t.Errorf("request_start type = %v, want \"image\"", seen[0]["type"])
-	}
-	if seen[1]["source"] != "imgup" {
-		t.Errorf("routed source = %v, want imgup", seen[1]["source"])
-	}
-}
-
-// TestRejectedChatStillFiresRequestStart pins the ordering decision: request_start
-// fires BEFORE the quota/scope gates, so a plugin auditing traffic sees rejected
-// requests too. A plugin that only ever saw served requests could not compute a
-// true request rate.
-func TestRejectedChatStillFiresRequestStart(t *testing.T) {
-	up := mockUpstream()
-	defer up.Close()
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	os.WriteFile(cfgPath, []byte("listen: :0\n"+
-		"adapter_dir: "+filepath.Join(dir, "adapters")+"\n"+
-		"plugin_dir: "+filepath.Join(dir, "plugins")+"\n"+
-		"runtime_file: "+filepath.Join(dir, "runtime.json")+"\n"+
-		"gateway_keys:\n  - sk-test\n"), 0600)
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources = []config.Source{{
-		Name: "u", BaseURL: up.URL, Adapter: "openai", APIKey: "sk-x",
-		Models: []config.Model{{ID: "m", Kind: "chat"}},
-	}}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-	if err := c.Plugins().LoadSource("spy", spyPlugin()); err != nil {
-		t.Fatal(err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// A model the gateway does not know => 404, rejected before any routing.
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"no-such-model","messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code != http.StatusNotFound {
-		t.Fatalf("expected 404 for an unknown model, got %d", rr.Code)
-	}
-	got := stageNames(seenStages(t, g))
-	if !contains(got, "request_start") {
-		t.Errorf("stages = %v; a REJECTED request must still fire request_start so a "+
-			"plugin can count real traffic, not just served traffic", got)
-	}
-}
-
-// TestChainStepReachesPluginOnDegradation is the end-to-end proof for the
-// AUTO trace: a request that had to drop from tier 1 to tier 2 must be visible
-// to a plugin as a tier_skip followed by a selected, and request_end must carry
-// tier_served=2.
-//
-// Before the trace existed the plugin saw only tier=-2 ("resolved by the
-// chain") and could not tell a degradation from a clean tier-1 hit — which is
-// the whole question a priority chain exists to answer.
-func TestChainStepReachesPluginOnDegradation(t *testing.T) {
-	// tier 1's source always fails, so the walk must drop to tier 2.
-	bad := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusInternalServerError)
-		_, _ = w.Write([]byte(`{"error":"boom"}`))
-	}))
-	defer bad.Close()
-	good := mockUpstream()
-	defer good.Close()
-
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	os.WriteFile(cfgPath, []byte("listen: :0\n"+
-		"adapter_dir: "+filepath.Join(dir, "adapters")+"\n"+
-		"plugin_dir: "+filepath.Join(dir, "plugins")+"\n"+
-		"runtime_file: "+filepath.Join(dir, "runtime.json")+"\n"+
-		"gateway_keys:\n  - sk-test\n"), 0600)
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cfg.Sources = []config.Source{
-		{Name: "t1", BaseURL: bad.URL, Adapter: "openai", APIKey: "sk-x",
-			Models: []config.Model{{ID: "hi-tier", Kind: "chat"}}},
-		{Name: "t2", BaseURL: good.URL, Adapter: "openai", APIKey: "sk-x",
-			Models: []config.Model{{ID: "lo-tier", Kind: "chat"}}},
-	}
-	if err := cfg.ApplyDefaults(); err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer c.Close()
-
-	// A spy that records chain_step events too.
-	sp := `
-local plugin = { name = "walker", version = "1.0.0" }
-plugin.state = { steps = {}, ends = {} }
-plugin.hooks = { chain_step = "step", request_end = "fin" }
-function plugin.step(p)
-  table.insert(plugin.state.steps, { kind = p.kind, tier = p.tier, source = p.source, model = p.model, reason = p.reason })
-  return nil
-end
-function plugin.fin(p)
-  plugin.state.ends[#plugin.state.ends + 1] = {
-    tier_served = p.tier_served, degraded = p.degraded,
-    walk = p.chain_walk, source = p.source, model = p.model,
-  }
-  return nil
-end
-return plugin
-`
-	if err := c.Plugins().LoadSource("walker", sp); err != nil {
-		t.Fatal(err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Two tiers, both in the chain.
-	if rr := doReq(t, g, http.MethodPut, "/api/auto",
-		`{"rules":[{"model":"hi-tier","source":"t1","tier":1},{"model":"lo-tier","source":"t2","tier":2}]}`); rr.Code != 200 {
-		t.Fatalf("save auto: %d %s", rr.Code, rr.Body.String())
-	}
-
-	rr := doReq(t, g, http.MethodPost, "/v1/chat/completions",
-		`{"model":"AUTO","messages":[{"role":"user","content":"hi"}]}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("chat = %d %s", rr.Code, rr.Body.String())
-	}
-
-	raw := c.Plugins().State("walker")
-	b, _ := json.Marshal(raw)
-	var st struct {
-		Steps []struct {
-			Kind   string `json:"kind"`
-			Tier   int    `json:"tier"`
-			Source string `json:"source"`
-			Model  string `json:"model"`
-		} `json:"steps"`
-		Ends []struct {
-			TierServed int    `json:"tier_served"`
-			Degraded   bool   `json:"degraded"`
-			Source     string `json:"source"`
-			Model      string `json:"model"`
-		} `json:"ends"`
-	}
-	if err := json.Unmarshal(b, &st); err != nil {
-		t.Fatalf("decode: %v (%s)", err, string(b))
-	}
-	if len(st.Steps) < 2 {
-		t.Fatalf("chain_step events = %+v, want at least a slot_fail and a selected", st.Steps)
-	}
-	if st.Steps[0].Kind != "slot_fail" || st.Steps[0].Tier != 1 {
-		t.Errorf("first step = %+v, want slot_fail on tier 1", st.Steps[0])
-	}
-	last := st.Steps[len(st.Steps)-1]
-	if last.Kind != "selected" || last.Tier != 2 {
-		t.Errorf("last step = %+v, want selected on tier 2", last)
-	}
-	if len(st.Ends) != 1 {
-		t.Fatalf("request_end count = %d, want 1", len(st.Ends))
-	}
-	if st.Ends[0].TierServed != 2 {
-		t.Errorf("tier_served = %d, want 2", st.Ends[0].TierServed)
-	}
-	if !st.Ends[0].Degraded {
-		t.Error("degraded = false, but the request dropped a tier")
-	}
-	if st.Ends[0].Model != "lo-tier" {
-		t.Errorf("served model = %q, want lo-tier", st.Ends[0].Model)
-	}
-}

internal/gateway/plugins_api.go

@@ -1,751 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"llmsproxy/internal/lua"
-)
-
-var (
-	errPluginName  = errors.New("plugin name must be non-empty and contain no path separator or dot")
-	errNoPluginDir = errors.New("no plugin_dir configured; set plugin_dir in config.yaml to enable plugins")
-)
-
-// Plugin management API.
-//
-//	GET    /api/plugins                  list loaded plugins + their hooks/UI/errors
-//	POST   /api/plugins                  upload/replace one plugin (.lua), hot-applied
-//	DELETE /api/plugins/{name}           remove a plugin
-//	GET    /api/plugins/{name}/state     the plugin's own published state
-//	PUT    /api/plugins/{name}/state     replace that state (admin only)
-//
-// Why state is a first-class endpoint: request_end is the LAST stage, so a
-// hook's return value has no downstream consumer inside the gateway. A plugin
-// that accumulates numbers (the billing plugin does exactly this) therefore
-// keeps them in its own Lua state and serves them here, which is what its UI
-// component fetches. This keeps plugin data clearly separated from the
-// gateway's own stats — see the accounting note in docs/plugins.md: the
-// gateway's quota accounting stays authoritative, a plugin only reports.
-
-// handlePluginUI serves the merged UI extensions the WebUI injects at boot.
-//
-// It is a single GET (not per-plugin) because the browser needs ALL extensions
-// before it can build the sidebar: a page contributed by one plugin and an
-// element contributed by another land in the same payload, and fetching them
-// separately would mean the sidebar has to be rebuilt as each arrives.
-//
-// Served to any authenticated role: the WebUI is authenticated before it asks,
-// and a plugin's own widgets need to render for the user whose key they show.
-func (g *Gateway) handlePluginUI(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "use GET")
-		return
-	}
-	ps := g.core.Plugins()
-	if ps == nil {
-		writeJSON(w, http.StatusOK, map[string]interface{}{"ui": lua.UIExtension{}})
-		return
-	}
-	// AllStages, not a hand-written list: an earlier version enumerated the
-	// three stages literally here, so when chain_step was added it was silently
-	// missing from this response — a plugin author reading the discovery
-	// document would have believed the stage did not exist. Deriving it from
-	// the one place that defines the order is the whole point of having it.
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"ui":     ps.UI(),
-		"stages": pipelineStageNames(),
-	})
-}
-
-// stageNames returns the pipeline stage names in firing order, for the
-// discovery payload and for tests.
-func pipelineStageNames() []string {
-	out := make([]string, 0, len(lua.AllStages))
-	for _, s := range lua.AllStages {
-		out = append(out, string(s))
-	}
-	return out
-}
-
-func (g *Gateway) handlePluginsAPI(w http.ResponseWriter, r *http.Request) {
-	ps := g.core.Plugins()
-	if ps == nil {
-		writeJSON(w, http.StatusOK, map[string]interface{}{"plugins": []interface{}{}})
-		return
-	}
-	path := strings.TrimPrefix(r.URL.Path, "/api/plugins")
-	path = strings.Trim(path, "/")
-
-	// /api/plugins/conflicts — the arbitration surface (user requirement).
-	// GET  lists every contested route (A) and every suspended adapter-name
-	//      install (B), each with its candidates/incumbent and any recorded
-	//      decision.
-	// POST {kind,path|name,winner} records the operator's choice and persists
-	//      it. Must be routed BEFORE the single-segment {name} handler below,
-	//      which would otherwise read "conflicts" as a plugin name.
-	if path == "conflicts" {
-		if reqRole(r.Context()) != "admin" {
-			writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-			return
-		}
-		switch r.Method {
-		case http.MethodGet:
-			writeJSON(w, http.StatusOK, map[string]interface{}{
-				"routes":   ps.RouteConflicts(),
-				"adapters": ps.AdapterConflicts(),
-			})
-		case http.MethodPost:
-			var body struct {
-				Kind   string `json:"kind"` // "route" or "adapter"
-				Path   string `json:"path"`
-				Name   string `json:"name"`
-				Winner string `json:"winner"` // route: plugin name; adapter: "incumbent"|"candidate"
-			}
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-				return
-			}
-			switch body.Kind {
-			case "route":
-				if err := ps.ResolveRouteConflict(body.Path, body.Winner); err != nil {
-					writeError(w, http.StatusBadRequest, "conflict_error", err.Error())
-					return
-				}
-				writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "path": body.Path, "winner": body.Winner})
-			case "adapter":
-				if err := ps.ResolveAdapterConflict(body.Name, body.Winner); err != nil {
-					writeError(w, http.StatusBadRequest, "conflict_error", err.Error())
-					return
-				}
-				writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "name": body.Name, "winner": body.Winner})
-			default:
-				writeError(w, http.StatusBadRequest, "invalid_request", "kind must be \"route\" or \"adapter\"")
-			}
-		default:
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-		}
-		return
-	}
-
-	// /api/plugins/{name}/state
-	if strings.HasSuffix(path, "/state") {
-		name := strings.TrimSuffix(path, "/state")
-		if name == "" {
-			writeError(w, http.StatusBadRequest, "invalid_request", "plugin name required")
-			return
-		}
-		g.handlePluginState(w, r, name)
-		return
-	}
-
-	// /api/plugins/{name}/http/{path}/access — the operator's view of, and edit
-	// surface for, which keys an endpoint answers.
-	if i := strings.Index(path, "/http/"); i >= 0 {
-		name := path[:i]
-		rest := path[i+len("/http/"):]
-		if strings.HasSuffix(rest, "/access") {
-			epPath := strings.TrimSuffix(rest, "/access")
-			g.handleEndpointAccess(w, r, name, epPath)
-			return
-		}
-	}
-
-	// /api/plugins/{name}/kernel — the operator's view of, and edit surface for,
-	// which kernel actions a plugin may call, plus its declared extra outbound hosts.
-	if strings.HasSuffix(path, "/kernel") {
-		name := strings.TrimSuffix(path, "/kernel")
-		if name == "" {
-			writeError(w, http.StatusBadRequest, "invalid_request", "plugin name required")
-			return
-		}
-		g.handlePluginKernel(w, r, name)
-		return
-	}
-
-	// /api/plugins/{name}/login — REMOVED. Login sessions are plugin domain:
-	// channels.lua owns its own session state and serves it through its own
-	// mount. The kernel has no login concept.
-
-	// /api/plugins/{name}/call/{fn}
-	if i := strings.Index(path, "/call/"); i >= 0 {
-		name := path[:i]
-		fn := path[i+len("/call/"):]
-		if name == "" || fn == "" {
-			writeError(w, http.StatusBadRequest, "invalid_request", "call needs a plugin and a function name")
-			return
-		}
-		g.handlePluginCall(w, r, name, fn)
-		return
-	}
-
-	// /api/plugins/{name}/fanout/{fn} — one call per argument set, in
-	// parallel, from one request. See handlePluginFanout for why the
-	// request-per-item form cannot be made concurrent from the client.
-	if i := strings.Index(path, "/fanout/"); i >= 0 {
-		name := path[:i]
-		fn := path[i+len("/fanout/"):]
-		if name == "" || fn == "" {
-			writeError(w, http.StatusBadRequest, "invalid_request", "fanout needs a plugin and a function name")
-			return
-		}
-		g.handlePluginFanout(w, r, name, fn)
-		return
-	}
-
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-
-	if path == "" {
-		switch r.Method {
-		case http.MethodGet:
-			writeJSON(w, http.StatusOK, map[string]interface{}{
-				"plugins":     ps.List(),
-				"on_disk":     ps.OnDisk(),
-				"hook_errors": ps.HookErrors(),
-				"plugin_dir":  g.pluginDir(),
-				// Visibility overrides and the endpoint access table, so the
-				// plugin page renders what is IN FORCE rather than making the
-				// operator read .lua files or config.yaml to find out.
-				"visibility":  ps.VisibilityOverrides(),
-				"http_access": ps.EndpointAccess(),
-			})
-		case http.MethodPost:
-			var body struct {
-				Name string `json:"name"`
-				Code string `json:"code"`
-			}
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-				return
-			}
-			if err := g.installPlugin(body.Name, body.Code); err != nil {
-				writeError(w, http.StatusBadRequest, "plugin_error", err.Error())
-				return
-			}
-			writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "name": body.Name})
-		default:
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-		}
-		return
-	}
-
-	// /api/plugins/{name} — source read (GET), enable/disable (PUT), delete.
-	// Multi-segment paths (…/state) are handled earlier and never reach here.
-	if !strings.Contains(path, "/") {
-		switch r.Method {
-		case http.MethodGet:
-			// Reading the SOURCE (not the runtime state) is what an editor
-			// needs; the state endpoint is /state and returns accumulated data
-			// instead. Mixing the two would make a "save what I read"
-			// round-trip impossible.
-			code, err := g.readPluginSource(path)
-			if err != nil {
-				writeError(w, http.StatusNotFound, "not_found", err.Error())
-				return
-			}
-			writeJSON(w, http.StatusOK, map[string]interface{}{
-				"name": path, "code": code,
-				"enabled": g.core.Plugins().Enabled(path),
-			})
-		case http.MethodPut:
-			// Enable / disable. The intent rides in the body rather than the
-			// verb, because "enable" and "disable" are the same resource and
-			// PUT /{name} is the one the docs advertise.
-			var body struct {
-				Enabled *bool `json:"enabled"`
-			}
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-				return
-			}
-			if body.Enabled == nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", `body must be {"enabled":true|false}`)
-				return
-			}
-			if err := g.core.Plugins().SetEnabled(path, *body.Enabled); err != nil {
-				writeError(w, http.StatusBadRequest, "plugin_error", err.Error())
-				return
-			}
-			writeJSON(w, http.StatusOK, map[string]interface{}{
-				"ok": true, "name": path, "enabled": *body.Enabled,
-			})
-		case http.MethodDelete:
-			if err := g.removePlugin(path); err != nil {
-				writeError(w, http.StatusBadRequest, "plugin_error", err.Error())
-				return
-			}
-			writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true})
-		default:
-			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-		}
-		return
-	}
-
-	writeError(w, http.StatusNotFound, "not_found", "unknown plugin sub-resource: "+path)
-}
-
-// readPluginSource returns a plugin's file contents for the editor.
-func (g *Gateway) readPluginSource(name string) (string, error) {
-	if err := validPluginName(name); err != nil {
-		return "", err
-	}
-	if g.pluginDir() == "" {
-		return "", errNoPluginDir
-	}
-	b, err := os.ReadFile(filepath.Join(g.pluginDir(), name+".lua"))
-	if err != nil {
-		return "", fmt.Errorf("no plugin source named %q", name)
-	}
-	return string(b), nil
-}
-
-// validPluginName rejects anything that could escape the plugin directory.
-// Shared by install / remove / read so the check cannot drift between them.
-func validPluginName(name string) error {
-	if name == "" || strings.ContainsAny(name, `/\.`) {
-		return errPluginName
-	}
-	return nil
-}
-
-// handlePluginState serves GET (read state) and PUT (replace state).
-func (g *Gateway) handlePluginState(w http.ResponseWriter, r *http.Request, name string) {
-	ps := g.core.Plugins()
-	switch r.Method {
-	case http.MethodGet:
-		// The plugin's audience gates its DATA as well as its page. Hiding the UI
-		// while leaving GET /state open would put the numbers one curl away, which
-		// is the leak the audience field exists to close — and billing's state is
-		// a global ledger, not the caller's own usage.
-		//
-		// A plugin that declares no audience is unchanged (every role may read
-		// it), so a single-purpose widget keeps working without edits.
-		role := reqRole(r.Context())
-		if !ps.StateVisibleTo(name, role) {
-			writeError(w, http.StatusForbidden, "forbidden",
-				"plugin "+name+" is not visible to role "+role)
-			return
-		}
-		// prices rides along: the billing rules editor must show the table
-		// that is actually in effect, not a reconstruction from config. It is
-		// absent for plugins with no prices (every plugin but billing).
-		state := ps.State(name)
-		// A plugin may SPLIT its state: global buckets stay deployment-wide while
-		// per-caller buckets are narrowed to the authenticated key. Role
-		// visibility alone cannot express this — the same role is allowed to read
-		// the plugin, just not another caller's row.
-		if scope := ps.StateScopeFor(name); scope != nil && role != "admin" {
-			state = splitStateForKey(state, scope, reqKey(r.Context()))
-		}
-		payload := map[string]interface{}{
-			"plugin": name,
-			"state":  state,
-		}
-		if pr := ps.Prices(name); pr != nil {
-			payload["prices"] = pr
-		}
-		writeJSON(w, http.StatusOK, payload)
-	case http.MethodPut:
-		if reqRole(r.Context()) != "admin" {
-			writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-			return
-		}
-		var state interface{}
-		if err := json.NewDecoder(r.Body).Decode(&state); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-			return
-		}
-		if err := ps.SetState(name, state); err != nil {
-			writeError(w, http.StatusBadRequest, "plugin_error", err.Error())
-			return
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true})
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-	}
-}
-
-// Call invokes a named function on a plugin's Lua state and returns its result.
-//
-// This exists because plugin pages otherwise have NO way to reach their own
-// plugin code: pluginAPI offers state read/write and a couple of callbacks, and
-// that is enough for billing (whose numbers arrive on hooks during request
-// forwarding) but useless for a plugin that must do work on demand. A quota
-// page has to ask the vendor when the operator clicks Refresh, and no hook
-// fires at that moment.
-//
-// It is deliberately narrow:
-//   - The function must be one the plugin explicitly lists in plugin.exports.
-//     Anything else is refused, so this endpoint cannot become a generic "run
-//     arbitrary Lua with my credentials" oracle over a plugin's private state.
-//   - The caller must be admin, and the result is JSON — no Lua value is ever
-//     handed back to Go as a live closure.
-//   - Errors come back as (nil, message) from the plugin, matching every other
-//     plugin entry point, and surface as a 502 rather than raising.
-func (g *Gateway) handlePluginCall(w http.ResponseWriter, r *http.Request, name, fn string) {
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-		return
-	}
-	var args map[string]interface{}
-	if err := json.NewDecoder(r.Body).Decode(&args); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-		return
-	}
-	result, err := g.core.Plugins().Call(name, fn, args)
-	if err != nil {
-		writeError(w, http.StatusBadGateway, "plugin_error", err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{"result": result})
-}
-
-// handlePluginFanout runs one plugin export per element of a list, in parallel,
-// from a SINGLE request.
-//
-// Why this exists: the quota page has twenty cards, and it used to fire twenty
-// browser requests at /call/. They arrived concurrently and then serialised
-// inside Plugins.Call, which holds the plugin mutex across the Lua function —
-// including its network wait. Measured on the live gateway: 20 probes took 29s of
-// wall clock while a single probe with no contention took 1.4–3.3s, so the page
-// sat on "probing…" for half a minute. The browser-side concurrency was real and
-// made no difference.
-//
-// A fan-out cannot be assembled from the client either: any request-per-item
-// arrangement is exactly the shape that queues. The parallelism has to happen
-// where the fan-out is received.
-func (g *Gateway) handlePluginFanout(w http.ResponseWriter, r *http.Request, name, fn string) {
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-		return
-	}
-	var req struct {
-		// Args is a LIST of argument objects, one per call. A bare object is
-		// rejected rather than coerced: "args" meaning "one call" and "args"
-		// meaning "many" depending on its shape is how a caller ends up probing
-		// one source and believing it probed twenty.
-		Args []map[string]interface{} `json:"args"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-		return
-	}
-	if len(req.Args) == 0 {
-		writeError(w, http.StatusBadRequest, "invalid_request", "args must be a non-empty list of argument objects")
-		return
-	}
-	// The page legitimately has one card per configured source. The bound is not
-	// arbitrary: it stops one request from asking for thousands of VMs, and it is
-	// enforced before any work starts rather than discovered shard by shard.
-	if len(req.Args) > fanoutMaxArgs {
-		writeError(w, http.StatusBadRequest, "invalid_request",
-			fmt.Sprintf("args has %d entries, limit is %d", len(req.Args), fanoutMaxArgs))
-		return
-	}
-	results, err := g.core.Plugins().ShardCall(name, fn, req.Args)
-	if err != nil {
-		writeError(w, http.StatusBadGateway, "plugin_error", err.Error())
-		return
-	}
-	// A shard that failed contributes a null in its slot. That is deliberate and
-	// is NOT the same as the whole request failing: one unreachable upstream must
-	// not turn a page of twenty cards into a single error.
-	writeJSON(w, http.StatusOK, map[string]interface{}{"results": results})
-}
-
-// fanoutMaxArgs bounds one fan-out request. Twenty is the measured real source
-// count on the gateway this was built for; the headroom is for operators with
-// more sources configured.
-const fanoutMaxArgs = 64
-
-func (g *Gateway) pluginDir() string {
-	if c := g.core.Config(); c != nil {
-		return c.PluginDir
-	}
-	return ""
-}
-
-// installPlugin writes a plugin to disk and hot-loads it. A syntax error is
-// returned to the caller AND the file is left on disk so the operator can fix
-// it, matching how adapters behave (the file is authoritative once present).
-func (g *Gateway) installPlugin(name, code string) error {
-	if err := validPluginName(name); err != nil {
-		return err
-	}
-	dir := g.pluginDir()
-	if dir == "" {
-		return errNoPluginDir
-	}
-	if err := os.MkdirAll(dir, 0755); err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(dir, name+".lua"), []byte(code), 0644); err != nil {
-		return err
-	}
-	return g.core.Plugins().LoadSource(name, code)
-}
-
-func (g *Gateway) removePlugin(name string) error {
-	if err := validPluginName(name); err != nil {
-		return err
-	}
-	if g.pluginDir() == "" {
-		return errNoPluginDir
-	}
-	_ = os.Remove(filepath.Join(g.pluginDir(), name+".lua"))
-	return g.core.Plugins().Unload(name)
-}
-
-// handleEndpointAccess serves the operator's view and edit surface for one
-// plugin endpoint's reachable keys.
-//
-//	GET    …/http/{path}/access   the declared rules plus any override
-//	PUT    …/http/{path}/access   body {"access": "admin,@homeagent"}
-//	DELETE …/http/{path}/access   clear the override
-//
-// The spec string is a comma list: a bare word is a role, "@name" is a gateway
-// key's configured name, and the literal "public" opens it to any
-// authenticated key. That is the same grammar the visibility override uses, and
-// keeping one grammar means an operator learns it once.
-//
-// Key names are validated against the configured keys BEFORE being stored. An
-// allowlist naming a key that does not exist is a silent no-op — every caller
-// is refused — and the operator would have no way to tell that apart from the
-// endpoint simply working.
-func (g *Gateway) handleEndpointAccess(w http.ResponseWriter, r *http.Request, name, epPath string) {
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	ps := g.core.Plugins()
-
-	// epPath "*" is the WHOLE-PLUGIN visibility override, not an endpoint. It
-	// shares this route (and therefore this store) on purpose: an operator
-	// setting "who can see this plugin" and "who can call this endpoint" is
-	// asking the same question at two granularities, and two stores would let
-	// them disagree. SetEndpointAccess cannot serve it — it validates that the
-	// endpoint exists, which "*" by definition does not.
-	if epPath == pluginWholeOverride {
-		g.handlePluginVisibility(w, r, name)
-		return
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		for _, e := range ps.EndpointAccess() {
-			if e.Plugin == name && e.Path == epPath {
-				writeJSON(w, http.StatusOK, map[string]interface{}{"endpoint": e})
-				return
-			}
-		}
-		writeError(w, http.StatusNotFound, "not_found", "no such endpoint")
-	case http.MethodPut, http.MethodDelete:
-		spec := ""
-		if r.Method == http.MethodPut {
-			var body struct {
-				Access string `json:"access"`
-			}
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-				return
-			}
-			spec = body.Access
-		}
-		if err := ps.ValidateAccessSpec(spec); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-		if err := ps.SetEndpointAccess(name, epPath, spec); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "access": spec})
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
-	}
-}
-
-// splitStateForKey rewrites a plugin state so that a non-admin caller sees only
-// the buckets that belong to them.
-//
-// The plugin declares which buckets are global and which are per-key. A per-key
-// bucket is keyed by the MASKED key ("***a1b2c3" — the same value the audit log
-// uses), so the caller's own row is found by masking the presented secret and
-// matching the last six characters.
-//
-// Keys that do not match are DROPPED, not zeroed: a zeroed row would render as
-// "you spent nothing" and, worse, would leak that a row exists for someone else.
-func splitStateForKey(state interface{}, scope *lua.StateScope, key string) interface{} {
-	m, ok := state.(map[string]interface{})
-	if !ok || scope == nil || key == "" {
-		return state
-	}
-	masked := maskKey(key)
-	out := make(map[string]interface{}, len(m))
-	for k, v := range m {
-		if !scope.IsGlobal(k) {
-			// Per-key bucket: keep only the caller's rows, at every nesting level
-			// the scope mentions (by_day_key is {day: {masked: bucket}}).
-			out[k] = filterKeyBuckets(v, masked, scope.DepthOf(k))
-			continue
-		}
-		out[k] = v
-	}
-	return out
-}
-
-// filterKeyBuckets narrows a keyed structure to one masked key.
-//
-// depth 1 is {masked: bucket}; depth 2 is {day: {masked: bucket}}. The level is
-// declared rather than sniffed, because both shapes are dicts and sniffing would
-// confuse an empty bucket with a nested one.
-func filterKeyBuckets(v interface{}, masked string, depth int) interface{} {
-	switch depth {
-	case 0:
-		return v // not a per-key bucket; leave alone
-	case 1:
-		m, ok := v.(map[string]interface{})
-		if !ok {
-			return v
-		}
-		if row, ok := m[masked]; ok {
-			return map[string]interface{}{masked: row}
-		}
-		return map[string]interface{}{}
-	default:
-		m, ok := v.(map[string]interface{})
-		if !ok {
-			return v
-		}
-		out := make(map[string]interface{}, len(m))
-		for day, inner := range m {
-			im, ok := inner.(map[string]interface{})
-			if !ok {
-				continue
-			}
-			if row, ok := im[masked]; ok {
-				out[day] = map[string]interface{}{masked: row}
-			}
-		}
-		return out
-	}
-}
-
-// pluginWholeOverride is the epPath that addresses a plugin's overall visibility
-// rather than one of its endpoints.
-const pluginWholeOverride = "*"
-
-// handlePluginVisibility is the whole-plugin half of the access API. The
-// audience string uses the same vocabulary as an endpoint spec (roles, @key
-// names, public) so the UI can drive both from one input.
-func (g *Gateway) handlePluginVisibility(w http.ResponseWriter, r *http.Request, name string) {
-	ps := g.core.Plugins()
-	switch r.Method {
-	case http.MethodGet:
-		writeJSON(w, http.StatusOK, map[string]interface{}{
-			"plugin":     name,
-			"visibility": ps.VisibilityOverrides()[name],
-		})
-	case http.MethodPut, http.MethodDelete:
-		spec := ""
-		if r.Method == http.MethodPut {
-			var body struct {
-				Access string `json:"access"`
-			}
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
-				return
-			}
-			spec = body.Access
-		}
-		if err := ps.ValidateAccessSpec(spec); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-		ps.SetPluginVisibility(name, spec)
-		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "visibility": spec})
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", r.Method+" is not allowed here")
-	}
-}
-
-// handlePluginKernel is the operator's surface for a plugin's kernel grants and
-// declared extra outbound hosts.
-//
-// GET returns what the plugin DECLARED beside what was GRANTED. That pairing is
-// the point of the endpoint: a plugin declaring `add_source` is a request, and
-// the operator needs to see the request next to the current answer to decide.
-func (g *Gateway) handlePluginKernel(w http.ResponseWriter, r *http.Request, name string) {
-	ps := g.core.Plugins()
-	if ps == nil {
-		writeError(w, http.StatusNotFound, "not_found", "no plugins loaded")
-		return
-	}
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	switch r.Method {
-	case http.MethodGet:
-		perm := ps.PluginKernelPermission(name)
-		declared := []string(nil)
-		for _, v := range ps.KernelPermissions() {
-			if v.Plugin == name {
-				declared = v.Declared
-			}
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{
-			"plugin":   name,
-			"actions":  ps.KernelActionsView(name),
-			"declared": declared,
-			"granted":  perm.Actions,
-			"all_read": perm.AllRead,
-			// Extra outbound hosts: declared vs granted, same request/privilege
-			// split as kernel actions. What the plugin does with a host (login,
-			// claim quotas...) is plugin business — the kernel only bounds egress.
-			"hosts_declared": ps.PluginExtraHosts(name),
-			"hosts_granted":  ps.ExtraHostsGranted()[name],
-		})
-		return
-	case http.MethodPut, http.MethodPost:
-		var body struct {
-			Actions []string `json:"actions"`
-			AllRead bool     `json:"all_read"`
-			Hosts   []string `json:"hosts"`
-		}
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-		if err := ps.SetPluginKernelPermission(name, body.Actions, body.AllRead); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-			return
-		}
-		if body.Hosts != nil {
-			if err := ps.GrantExtraHosts(name, body.Hosts); err != nil {
-				writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
-				return
-			}
-		}
-		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true})
-		return
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "GET or PUT")
-	}
-}

internal/gateway/plugins_api_test.go

@@ -1,263 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-	"llmsproxy/internal/lua"
-)
-
-// gatewayWithBilling boots a gateway with the bundled billing plugin loaded, so
-// the UI-injection endpoint is exercised against a real plugin rather than a
-// hand-written stub. The other plugin tests in this package assert on the
-// WebUI source; this one asserts on the HTTP contract the browser consumes.
-func gatewayWithBilling(t *testing.T) *Gateway {
-	t.Helper()
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	body := "listen: :0\n" +
-		"adapter_dir: " + filepath.Join(dir, "adapters") + "\n" +
-		"plugin_dir: " + filepath.Join(dir, "plugins") + "\n" +
-		"runtime_file: " + filepath.Join(dir, "runtime.json") + "\n" +
-		"gateway_keys:\n  - sk-test\n"
-	if err := os.WriteFile(cfgPath, []byte(body), 0600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	c, err := core.NewFromConfig(cfg)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(c.Close)
-	// Load the shipped plugin explicitly: seeding only runs for a directory that
-	// does not exist yet, and this test wants a known plugin regardless.
-	src, err := lua.ReadBundledPlugin("billing")
-	if err != nil {
-		t.Fatalf("read bundled billing: %v", err)
-	}
-	if err := c.Plugins().LoadSource("billing", src); err != nil {
-		t.Fatalf("load billing: %v", err)
-	}
-	g, err := New(c)
-	if err != nil {
-		t.Fatalf("gateway: %v", err)
-	}
-	return g
-}
-
-// TestUIInjectServesPluginUI: GET /api/ui-inject is the single call the WebUI
-// makes at boot, and it must carry BOTH a contributed page and contributed
-// elements — the browser builds the sidebar from the page and mounts the
-// elements into existing panes from the same payload, so a partial response
-// would produce a page with no body or a missing tile.
-func TestUIInjectServesPluginUI(t *testing.T) {
-	g := gatewayWithBilling(t)
-	rr := doReq(t, g, http.MethodGet, "/api/ui-inject", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	var view struct {
-		// Decoded into the real types so the test cannot drift from the wire
-		// contract. An inline copy missed the `pages` field when the payload
-		// shape changed and failed to compile, which is at least loud — but the
-		// same copy also went on asserting the OLD single-page shape for a
-		// release, silently.
-		UI     lua.UIExtension `json:"ui"`
-		Stages []string        `json:"stages"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &view); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	// The payload carries every page in one list; ui.page is no longer a
-	// separate slot (it was, and a second plugin contributing a page overwrote
-	// whatever was there).
-	var billing *lua.UIPage
-	for i, pg := range view.UI.Pages {
-		if pg != nil && pg.PageID == "billing" {
-			billing = view.UI.Pages[i]
-		}
-	}
-	if billing == nil {
-		t.Fatalf("no billing page in the inject payload; pages=%d", len(view.UI.Pages))
-	}
-	if !strings.Contains(billing.Mount, "billing-root") {
-		t.Error("the page mount came back empty")
-	}
-	if len(view.UI.Elements) == 0 {
-		t.Error("billing contributes an element to the status page but it is missing")
-	}
-	for _, e := range view.UI.Elements {
-		if e.Target != "status" {
-			t.Errorf("element target = %q, want \"status\"", e.Target)
-		}
-	}
-	// Derived from AllStages, not hardcoded: the previous assertion of "3"
-	// is exactly what let chain_step go missing from this payload unnoticed.
-	if len(view.Stages) != len(lua.AllStages) {
-		t.Errorf("stages = %v, want %d (one per AllStages entry)", view.Stages, len(lua.AllStages))
-	}
-	for i, st := range lua.AllStages {
-		if i >= len(view.Stages) || view.Stages[i] != string(st) {
-			t.Errorf("stages[%d] = %v, want %q", i, view.Stages, string(st))
-		}
-	}
-	if !containsStr(view.Stages, string(lua.StageChainStep)) {
-		t.Error("the discovery payload does not advertise chain_step; a plugin " +
-			"author would conclude the stage does not exist")
-	}
-}
-
-// TestUIInjectIsEmptyWithoutPlugins: a gateway with no plugins must still answer
-// 200 with an empty (not missing, not null) payload. The WebUI calls this
-// unconditionally at boot, so a 404 or a null `ui` would break every dashboard.
-func TestUIInjectIsEmptyWithoutPlugins(t *testing.T) {
-	g := newTestGateway(t)
-	rr := doReq(t, g, http.MethodGet, "/api/ui-inject", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if !strings.Contains(rr.Body.String(), `"ui"`) {
-		t.Error("no ui key in the response; the WebUI would have nothing to read")
-	}
-}
-
-// containsStr reports whether list has s.
-func containsStr(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-// newRecorderFor pushes a request through the full handler chain.
-func newRecorderFor(t *testing.T, g *Gateway, req *http.Request) *httptest.ResponseRecorder {
-	t.Helper()
-	rr := httptest.NewRecorder()
-	g.Handler().ServeHTTP(rr, req)
-	return rr
-}
-
-// TestPluginsListAndStateAPI covers the management surface the plugin docs
-// promise: listing, and reading a plugin's own published state.
-func TestPluginsListAndStateAPI(t *testing.T) {
-	g := gatewayWithBilling(t)
-	rr := doReq(t, g, http.MethodGet, "/api/plugins", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("GET /api/plugins = %d: %s", rr.Code, rr.Body.String())
-	}
-	for _, want := range []string{"billing", "hook_errors", "plugin_dir", "request_end"} {
-		if !strings.Contains(rr.Body.String(), want) {
-			t.Errorf("/api/plugins response lacks %q", want)
-		}
-	}
-	// state read: the plugin published its (empty) state, so the key exists.
-	rr = doReq(t, g, http.MethodGet, "/api/plugins/billing/state", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("GET state = %d: %s", rr.Code, rr.Body.String())
-	}
-	if !strings.Contains(rr.Body.String(), `"total"`) {
-		t.Errorf("billing state lacks the total bucket: %s", rr.Body.String())
-	}
-}
-
-// TestPluginStatePUTIsAdminOnly: only the WRITE side is gated. A user key must
-// be able to READ its own billing widget's data, but must not be able to
-// rewrite the price table.
-func TestPluginStatePUTIsAdminOnly(t *testing.T) {
-	g := gatewayWithBilling(t)
-
-	// Build a user-role key and remember its secret.
-	rec, err := g.core.CreateKey("viewer", "user", nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	userKey := rec.Key
-
-	// A user key may read the state.
-	req, _ := http.NewRequest(http.MethodGet, "/api/plugins/billing/state", nil)
-	req.Header.Set("Authorization", "Bearer "+userKey)
-	rr := newRecorderFor(t, g, req)
-	if rr.Code != http.StatusOK {
-		t.Errorf("user GET state = %d, want 200 (the billing widget must render for users)", rr.Code)
-	}
-
-	// A user key may NOT write it.
-	put, _ := http.NewRequest(http.MethodPut, "/api/plugins/billing/state",
-		strings.NewReader(`{"prices":{"default":{"prompt":0}}}`))
-	put.Header.Set("Authorization", "Bearer "+userKey)
-	put.Header.Set("Content-Type", "application/json")
-	prr := newRecorderFor(t, g, put)
-	if prr.Code != http.StatusForbidden {
-		t.Errorf("user PUT state = %d, want 403 (a user must not rewrite the price table)", prr.Code)
-	}
-
-	// An admin key may.
-	adm := doReq(t, g, http.MethodPut, "/api/plugins/billing/state",
-		`{"prices":{"default":{"prompt":1e-6}}}`)
-	if adm.Code != http.StatusOK {
-		t.Errorf("admin PUT state = %d: %s", adm.Code, adm.Body.String())
-	}
-}
-
-// TestPluginsListCarriesAccessTables: the plugin page renders visibility
-// overrides and the endpoint access table from /api/plugins. Without them in the
-// response the operator has to open a .lua or config.yaml to learn who can see
-// what, which is exactly what the UI is meant to avoid.
-func TestPluginsListCarriesAccessTables(t *testing.T) {
-	g := gatewayWithCallPlugin(t)
-	rr := doReq(t, g, http.MethodGet, "/api/plugins", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("GET /api/plugins = %d", rr.Code)
-	}
-	var out struct {
-		Visibility map[string]string        `json:"visibility"`
-		HTTPAccess []map[string]interface{} `json:"http_access"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &out); err != nil {
-		t.Fatalf("decode: %v (body=%s)", err, rr.Body.String())
-	}
-	// The calltest plugin registers no endpoints, so the table is present but
-	// empty — the KEY is that the field exists at all. A missing field decodes to
-	// nil and the UI silently renders nothing, which looks identical to "this
-	// plugin has no endpoints".
-	if !strings.Contains(rr.Body.String(), "http_access") {
-		t.Error("/api/plugins response lacks the http_access field")
-	}
-	if !strings.Contains(rr.Body.String(), "visibility") {
-		t.Error("/api/plugins response lacks the visibility field")
-	}
-}
-
-// TestPluginWholeVisibilityViaAccessAPI covers the "*" path: the plugin page
-// edits a plugin's overall audience through the same route it edits endpoints
-// with. Before this existed the UI had a visibility selector whose save 404'd,
-// because SetEndpointAccess validates that the endpoint exists and "*" does not.
-func TestPluginWholeVisibilityViaAccessAPI(t *testing.T) {
-	g := gatewayWithCallPlugin(t)
-	rr := doReq(t, g, http.MethodPut, "/api/plugins/calltest/http/*/access",
-		`{"access":"admin, user"}`)
-	if rr.Code != http.StatusOK {
-		t.Fatalf("PUT */access = %d: %s", rr.Code, rr.Body.String())
-	}
-	if !strings.Contains(rr.Body.String(), `"ok":true`) {
-		t.Errorf("unexpected body: %s", rr.Body.String())
-	}
-	// A user role is a legitimate audience; a nonsense one is not.
-	bad := doReq(t, g, http.MethodPut, "/api/plugins/calltest/http/*/access",
-		`{"access":"../../etc"}`)
-	if bad.Code != http.StatusBadRequest {
-		t.Errorf("traversal-shaped audience = %d, want 400: %s", bad.Code, bad.Body.String())
-	}
-}

internal/gateway/serializer.go

@@ -1,466 +0,0 @@
-// Package gateway — 对外序列化（Phase 2）
-//
-// 职责边界（feature/unified-wire-v2）：
-//
-//	内核不硬编码任何对外协议。序列化由 Serializer 承载，默认实现是
-//	openAISerializer —— 但它只是**最后容错**，不是默认业务路径。
-//
-// 优先级契约（用户明确要求：任何适配器与兜底 OpenAI 格式冲突时，
-// 兜底 OpenAI 直接让步）：
-//
-//	适配器声明 serialize_response / serialize_chunk
-//	  ↓ 未声明
-//	openAISerializer（内核兜底，保证刚部署未配适配器时仍能服务）
-//
-// 「让步」的具体含义：一旦适配器声明了对外序列化钩子，内核在**该源**
-// 上完全采用适配器的输出，绝不与兜底格式合并/兜底字段。A 请求经 Anthropic
-// 序列化后，绝不会被再补上 OpenAI 的字段。这条规则由
-// TestAdapterSerializerWinsOverFallback 锁定。
-//
-// 安全网：openAISerializer 的输出与改造前内核手写的 OpenAI wire 字节级
-// 一致（e2e/.snapshots golden 锁定），所以「适配器未声明」这条路径上的
-// 对外行为与本次改造之前完全相同。
-package gateway
-
-import (
-	"encoding/json"
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"llmsproxy/internal/lua"
-	"llmsproxy/internal/provider"
-	"llmsproxy/internal/types"
-)
-
-// StreamState 是一个流会话在序列化侧的累积状态（角色前导是否已发、已见
-// 的终止原因、累积 usage/cost）。跨 chunk 传递，避免每帧重新统计。
-type StreamState struct {
-	LastFinish string
-	Usage      *types.TokenUsage
-	Cost       string
-}
-
-// Serializer 把统一内部格式序列化成对外协议的响应体。
-//
-// 非流式与流式的终止语义对不同协议差异很大（OpenAI 在最后一个 chunk 上
-// 带 finish_reason 后跟一个 usage-only 帧；Anthropic 用独立的
-// message_delta 事件；Gemini 用空 candidates 帧），所以「流如何结束」
-// 是接口的一部分，而不是调用方的 if。
-type Serializer interface {
-	// NonStream 把一次完成的统一响应序列化成对外 body。
-	NonStream(resp *types.UnifiedResponse, modelName string, id string, created int64) ([]byte, error)
-
-	// OpenRolePreamble 返回流开始时的角色前导帧（可能为空表示该协议不需要）。
-	// 返回空切片时调用方不写帧。
-	OpenRolePreamble(modelName, id string, created int64, st *StreamState) ([]byte, error)
-
-	// Chunk 把一个统一分块序列化成对外 SSE 帧（不含 "data: " 前缀与空行）。
-	Chunk(ck *types.UnifiedChunk, modelName, id string, created int64, st *StreamState) ([]byte, error)
-
-	// Close 返回流结束时的收尾帧序列（可多帧），随后调用方写协议自己的
-	// 流终止标记（OpenAI 是 [DONE]，Anthropic 无）。
-	Close(modelName, id string, created int64, st *StreamState) ([][]byte, error)
-
-	// DoneMarker 返回该协议的流终止标记；OpenAI 是 "[DONE]"，无此概念的
-	// 协议返回空串（调用方因此不写那一行）。
-	DoneMarker() string
-}
-
-// ---- 兜底实现：OpenAI wire ----
-
-// openAISerializer 是内核的**容错兜底**，输出与改造前手写的 OpenAI wire
-// 字节级一致（golden 锁定）。它不是默认业务路径——适配器一旦声明序列化
-// 钩子就完全取代它。
-type openAISerializer struct{}
-
-// OpenAISerializer 返回兜底 OpenAI 序列化器。暴露给同包测试与
-// 「未配置任何适配器」的启动兜底路径使用。
-func OpenAISerializer() Serializer { return openAISerializer{} }
-
-func (openAISerializer) NonStream(resp *types.UnifiedResponse, modelName, id string, created int64) ([]byte, error) {
-	msg := RespMessage{Role: "assistant", Content: resp.Content}
-	if resp.ReasoningContent != "" {
-		msg.ReasoningContent = resp.ReasoningContent
-	}
-	if len(resp.ToolCalls) > 0 {
-		msg.ToolCalls = toolCallsWire(resp.ToolCalls)
-	}
-	out := ChatCompletion{
-		ID:      id,
-		Object:  "chat.completion",
-		Created: created,
-		Model:   modelName,
-		Choices: []ChatChoice{{Index: 0, Message: msg, FinishReason: resp.FinishReason}},
-		Cost:    resp.Cost,
-	}
-	if resp.TokenUsage.Total > 0 || resp.TokenUsage.Prompt > 0 || resp.TokenUsage.Completion > 0 {
-		out.Usage = &resp.TokenUsage
-	}
-	return json.Marshal(out)
-}
-
-func (openAISerializer) OpenRolePreamble(modelName, id string, created int64, st *StreamState) ([]byte, error) {
-	return json.Marshal(ChatChunk{
-		ID: id, Object: "chat.completion.chunk", Created: created, Model: modelName,
-		Choices: []ChunkChoice{{Index: 0, Delta: RespMessage{Role: "assistant"}}},
-	})
-}
-
-func (openAISerializer) Chunk(ck *types.UnifiedChunk, modelName, id string, created int64, st *StreamState) ([]byte, error) {
-	delta := RespMessage{Role: "assistant", Content: ck.Content}
-	if ck.ReasoningContent != "" {
-		delta.ReasoningContent = ck.ReasoningContent
-	}
-	if len(ck.ToolCalls) > 0 {
-		delta.ToolCalls = ck.ToolCalls
-	}
-	choice := ChunkChoice{Index: 0, Delta: delta}
-	if ck.Done {
-		fin := ck.FinishReason
-		if fin == "" {
-			fin = "stop"
-		}
-		st.LastFinish = fin
-		choice.FinishReason = &fin
-	}
-	return json.Marshal(ChatChunk{
-		ID: id, Object: "chat.completion.chunk", Created: created, Model: modelName,
-		Choices: []ChunkChoice{choice},
-	})
-}
-
-func (openAISerializer) Close(modelName, id string, created int64, st *StreamState) ([][]byte, error) {
-	fin := st.LastFinish
-	if fin == "" {
-		fin = "stop"
-	}
-	term, err := json.Marshal(ChatChunk{
-		ID: id, Object: "chat.completion.chunk", Created: created, Model: modelName,
-		Choices: []ChunkChoice{{Index: 0, Delta: RespMessage{}, FinishReason: &fin}},
-	})
-	if err != nil {
-		return nil, err
-	}
-	out := [][]byte{term}
-	// OpenAI 的 usage 帧：空 choices + usage + 可选 cost。
-	if st.Usage != nil || st.Cost != "" {
-		var tut *types.TokenUsage
-		if st.Usage != nil {
-			tut = st.Usage
-		} else {
-			tut = &types.TokenUsage{}
-		}
-		u, err := json.Marshal(ChatChunk{
-			ID: id, Object: "chat.completion.chunk", Created: created, Model: modelName,
-			Choices: []ChunkChoice{}, Usage: tut, Cost: st.Cost,
-		})
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, u)
-	}
-	return out, nil
-}
-
-func (openAISerializer) DoneMarker() string { return "[DONE]" }
-
-// ---- 适配器钩子通道 ----
-
-// luaSerializer 把对外序列化委托给适配器的 serialize_response /
-// serialize_chunk 钩子。适配器声明了钩子就**完全取代**兜底实现。
-type luaSerializer struct {
-	vm      *lua.VM
-	adapter string
-	// responseOK / chunkOK 在构造时一次性探测（HasFn 不占用 worker）。
-	responseOK bool
-	chunkOK    bool
-	// openPreambleOK / closeOK 是可选钩子；未声明时借用兜底实现的对应行为，
-	// 这样「只实现 serialize_chunk」的适配器也能立刻可用。
-	openPreambleOK bool
-	closeOK        bool
-}
-
-// serializerFor 为某个适配器名挑选序列化器。
-//
-// 这是「适配器优先、兜底让步」的唯一决策点：适配器声明了对外序列化
-// 钩子就返回 luaSerializer（其输出不再与 OpenAI 兜底混合），否则返回
-// 兜底 OpenAI。
-func serializerFor(vm *lua.VM, adapter string) Serializer {
-	if vm == nil {
-		return OpenAISerializer()
-	}
-	resp := vm.HasFn(adapter, "serialize_response")
-	chunk := vm.HasFn(adapter, "serialize_chunk")
-	if !resp && !chunk {
-		return OpenAISerializer()
-	}
-	return &luaSerializer{
-		vm:             vm,
-		adapter:        adapter,
-		responseOK:     resp,
-		chunkOK:        chunk,
-		openPreambleOK: vm.HasFn(adapter, "serialize_open_preamble"),
-		closeOK:        vm.HasFn(adapter, "serialize_close"),
-	}
-}
-
-func (s *luaSerializer) NonStream(resp *types.UnifiedResponse, modelName, id string, created int64) ([]byte, error) {
-	if !s.responseOK {
-		// 该适配器只实现了流式钩子：非流式沿用兜底。这是唯一允许兜底
-		// 参与的场景——适配器**没有**就该方向的实现，而不是「冲突」。
-		return openAISerializer{}.NonStream(resp, modelName, id, created)
-	}
-	payload := map[string]interface{}{
-		"model":         modelName,
-		"id":            id,
-		"created":       created,
-		"content":       resp.Content,
-		"reasoning":     resp.ReasoningContent,
-		"finish_reason": resp.FinishReason,
-		"token_usage":   resp.TokenUsage,
-		"cost":          resp.Cost,
-	}
-	if len(resp.ToolCalls) > 0 {
-		payload["tool_calls"] = resp.ToolCalls
-	}
-	out, err := s.vm.Transform(s.adapter, "serialize_response", wireJSON(payload))
-	if err != nil || out == "" {
-		// 钩子失败：明确退回兜底，而不是产出一半适配器字段 + 一半 OpenAI
-		// 字段的混合体（那正是「让步」规则要避免的）。
-		return openAISerializer{}.NonStream(resp, modelName, id, created)
-	}
-	return []byte(out), nil
-}
-
-func (s *luaSerializer) OpenRolePreamble(modelName, id string, created int64, st *StreamState) ([]byte, error) {
-	if !s.openPreambleOK {
-		return openAISerializer{}.OpenRolePreamble(modelName, id, created, st)
-	}
-	out, err := s.vm.Transform(s.adapter, "serialize_open_preamble",
-		wireJSON(map[string]interface{}{"model": modelName, "id": id, "created": created}))
-	if err != nil {
-		return openAISerializer{}.OpenRolePreamble(modelName, id, created, st)
-	}
-	if out == "" {
-		return nil, nil // 该协议不需要角色前导
-	}
-	return []byte(out), nil
-}
-
-func (s *luaSerializer) Chunk(ck *types.UnifiedChunk, modelName, id string, created int64, st *StreamState) ([]byte, error) {
-	if !s.chunkOK {
-		return openAISerializer{}.Chunk(ck, modelName, id, created, st)
-	}
-	payload := map[string]interface{}{
-		"model":         modelName,
-		"id":            id,
-		"created":       created,
-		"content":       ck.Content,
-		"reasoning":     ck.ReasoningContent,
-		"done":          ck.Done,
-		"finish_reason": ck.FinishReason,
-	}
-	if len(ck.ToolCalls) > 0 {
-		payload["tool_calls"] = ck.ToolCalls
-	}
-	if ck.Usage != nil {
-		payload["usage"] = ck.Usage
-	}
-	if ck.Cost != "" {
-		payload["cost"] = ck.Cost
-	}
-	out, err := s.vm.Transform(s.adapter, "serialize_chunk", wireJSON(payload))
-	if err != nil {
-		return openAISerializer{}.Chunk(ck, modelName, id, created, st)
-	}
-	if out == "" {
-		return nil, nil
-	}
-	// 适配器的终止帧要驱动审计记录与收尾逻辑，所以把终止原因抄回状态。
-	if ck.Done && st.LastFinish == "" {
-		if fin := ck.FinishReason; fin != "" {
-			st.LastFinish = fin
-		}
-	}
-	return []byte(out), nil
-}
-
-func (s *luaSerializer) Close(modelName, id string, created int64, st *StreamState) ([][]byte, error) {
-	if !s.closeOK {
-		return openAISerializer{}.Close(modelName, id, created, st)
-	}
-	out, err := s.vm.Transform(s.adapter, "serialize_close",
-		wireJSON(map[string]interface{}{
-			"model": modelName, "id": id, "created": created,
-			"finish_reason": st.LastFinish, "cost": st.Cost,
-			"has_usage": st.Usage != nil,
-		}))
-	if err != nil {
-		return openAISerializer{}.Close(modelName, id, created, st)
-	}
-	if out == "" {
-		return nil, nil
-	}
-	// 适配器可以返回多帧（换行分隔），因为 Anthropic 的收尾本身就是
-	// message_stop + 若干 delta；单帧限制会逼适配器把多事件塞进一个 JSON。
-	var frames [][]byte
-	for _, line := range splitLines(out) {
-		if line == "" {
-			continue
-		}
-		frames = append(frames, []byte(line))
-	}
-	return frames, nil
-}
-
-// DoneMarker 返回协议自己的流终止标记。适配器可用 serialize_done_marker
-// 声明；未声明时若有自定义流式序列化就返回空串（表示「没有 [DONE] 这种
-// 概念」），否则沿用 OpenAI 的 [DONE]。
-func (s *luaSerializer) DoneMarker() string {
-	if s.vm.HasFn(s.adapter, "serialize_done_marker") {
-		out, err := s.vm.Transform(s.adapter, "serialize_done_marker", "{}")
-		if err == nil {
-			return out
-		}
-	}
-	if s.chunkOK {
-		// 适配器接管了流式序列化：只有它没显式声明标记时才不发 [DONE]，
-		// 因为擅自给 Anthropic 流加一行 "[DONE]" 会让严格客户端报错。
-		return ""
-	}
-	return "[DONE]"
-}
-
-// splitLines 切分多行帧输出。
-func splitLines(s string) []string {
-	var out []string
-	start := 0
-	for i := 0; i < len(s); i++ {
-		if s[i] == '\n' {
-			out = append(out, trimCR(s[start:i]))
-			start = i + 1
-		}
-	}
-	if start < len(s) {
-		out = append(out, trimCR(s[start:]))
-	}
-	return out
-}
-
-func trimCR(s string) string {
-	if n := len(s); n > 0 && s[n-1] == '\r' {
-		return s[:n-1]
-	}
-	return s
-}
-
-// ---- 共享辅助 ----
-
-var wireSeq int64
-
-func newWireID() string {
-	n := atomic.AddInt64(&wireSeq, 1)
-	return fmt.Sprintf("chatcmpl-%d", n)
-}
-
-func newCreated() int64 { return time.Now().Unix() }
-
-// wireJSON 是本文件私有的 JSON 编码助手（包内已有 discover.go 的 mustJSON，
-// 那个返回 []byte 且忽略错误，语义不同，故不共用）。
-func wireJSON(v interface{}) string {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return "{}"
-	}
-	return string(b)
-}
-
-// serializerCache 按 (VM, 适配器名) 缓存 Serializer。
-//
-// VM 必须进键里：缓存曾经只按适配器名做键，结果一个进程内两个 VM（或
-// 热重载后的新旧 VM）会共享同一条判定。插件在运行时改写适配器后声明了
-// serialize_response，另一条缓存记录仍会说「没声明」，于是新钩子永远不
-// 生效——而且因为判定本身不会报错，表现只是「适配器说好的对外格式没
-// 出现」，极难定位。
-//
-// HasFn 的代价决定了它必须被缓存：它会**编译一次适配器脚本**来回答
-// 「这个适配器声明了哪些函数」，放在每个请求上等于把加载成本翻倍。
-//
-// 失效由 vmGeneration 负责：适配器重写时 VM 的代号会变（见 adapterEpoch），
-// 于是旧条目再也匹配不上，无需显式清扫。
-var serializerCache sync.Map // cacheKey -> Serializer
-
-// cacheKey 是 (VM 指针, VM 代号, 适配器名) 的复合键。
-type cacheKey struct {
-	vm   *lua.VM
-	gen  uint64
-	name string
-}
-
-func serializerForCached(vm *lua.VM, adapter string) Serializer {
-	if vm == nil {
-		return OpenAISerializer()
-	}
-	k := cacheKey{vm: vm, gen: adapterEpoch(vm, adapter), name: adapter}
-	if v, ok := serializerCache.Load(k); ok {
-		return v.(Serializer)
-	}
-	s := serializerFor(vm, adapter)
-	actual, _ := serializerCache.LoadOrStore(k, s)
-	return actual.(Serializer)
-}
-
-// adapterEpoch 返回该适配器「当前这份代码」的代号。适配器被重写后代号变化，
-// 使旧缓存条目自动失效（见 serializerCache 的注释）。
-func adapterEpoch(vm *lua.VM, adapter string) uint64 {
-	return vm.AdapterRevision(adapter)
-}
-
-// serializerForSource 解析「实际服务该请求的那个源」该用哪个序列化器。
-//
-// 必须按**服务者**选，而不是按调用方请求的首选源选：direct 请求在候选源
-// 之间故障转移时，usedSrc 可能与请求 model 所属的源完全不同；按首选源选
-// 会让故障转移后的响应带着另一个源的对外格式。
-//
-// 源名查不到时（配置在选择之后被改、或插件装的源尚未注册）退回兜底
-// OpenAI：那是「刚部署 / 异常态下仍能服务」的保证，而不是静默产出错误格式。
-func serializerForSource(vm *lua.VM, sources []SourceRef, sourceName string) Serializer {
-	for _, s := range sources {
-		if s.Name == sourceName {
-			return serializerForCached(vm, s.Adapter)
-		}
-	}
-	return OpenAISerializer()
-}
-
-// SourceRef 是解析序列化器所需的最小源信息（名字 + 适配器）。
-type SourceRef struct {
-	Name    string
-	Adapter string
-}
-
-// serializerFor 是 Gateway 侧的解析入口：按**实际服务该请求的源**挑序列化器。
-//
-// cands 传候选列表时用它做故障转移后的解析（服务源可能不是首选）；传 nil
-// 表示 AUTO 路径——AUTO 的服务源由链决定，不在调用方的候选集里，退回按
-// 当前配置里全部源查找。
-func (g *Gateway) serializerFor(sourceName string, cands []*provider.Provider) Serializer {
-	vm := g.core.VM()
-	if vm == nil {
-		return OpenAISerializer()
-	}
-	if cands != nil {
-		refs := make([]SourceRef, 0, len(cands))
-		for _, p := range cands {
-			refs = append(refs, SourceRef{Name: p.Name(), Adapter: p.Adapter()})
-		}
-		return serializerForSource(vm, refs, sourceName)
-	}
-	refs := make([]SourceRef, 0, 16)
-	for _, s := range g.core.Sources() {
-		refs = append(refs, SourceRef{Name: s.Name, Adapter: s.Adapter})
-	}
-	return serializerForSource(vm, refs, sourceName)
-}

internal/gateway/serializer_test.go

@@ -1,367 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-
-	"llmsproxy/internal/lua"
-	"llmsproxy/internal/types"
-)
-
-// 本文件锁定对外序列化的**优先级契约**：
-//
-//	适配器声明 serialize_* → 适配器完全接管
-//	适配器未声明          → 兜底 OpenAI（保证刚部署/未配适配器仍能服务）
-//
-// 以及「让步」的定义：适配器接管后，内核绝不再往它的输出上补任何 OpenAI
-// 字段。两个序列化器混在一起产出的东西比任何一个都糟——客户端无法解析，
-// 而排查时会指向错误的层。
-
-// luaVMFor 建一个会 seed 内置适配器的 VM（目录名必须是 "adapters"）。
-func luaVMFor(t *testing.T) *lua.VM {
-	t.Helper()
-	vm := lua.NewVM(filepath.Join(t.TempDir(), "adapters"))
-	if err := vm.Start(); err != nil {
-		t.Fatalf("vm start: %v", err)
-	}
-	t.Cleanup(vm.Stop)
-	return vm
-}
-
-// TestFallbackUsedWhenAdapterDeclaresNothing 是「兜底」本身的测试。
-//
-// 注：anthropic 现在**确实**声明了 serialize_*（Phase 2 给了它 Anthropic
-// 形状），所以本测试只在仍未声明钩子的那些内置适配器上验证兜底行为。
-// 这正是设计意图：谁声明谁接管，没声明的继续用 OpenAI 兜底。
-func TestFallbackUsedWhenAdapterDeclaresNothing(t *testing.T) {
-	vm := luaVMFor(t)
-	for _, name := range []string{"openai", "gemini", "ollama", "deepseek", "github", "groq"} {
-		for _, hook := range []string{"serialize_response", "serialize_chunk"} {
-			if vm.HasFn(name, hook) {
-				t.Errorf("内置适配器 %s 声明了 %s —— 兜底测试的前提已不成立", name, hook)
-			}
-		}
-	}
-	ser := serializerFor(vm, "openai")
-	if _, isFallback := ser.(openAISerializer); !isFallback {
-		t.Fatalf("未声明钩子的适配器应得到兜底序列化器，得到 %T", ser)
-	}
-
-	// 对照：声明了钩子的适配器不走兜底
-	if _, isFallback := serializerFor(vm, "anthropic").(openAISerializer); isFallback {
-		t.Error("anthropic 声明了 serialize_response，不应走兜底")
-	}
-}
-
-// TestAdapterSerializerWinsOverFallback 锁定核心规则：适配器声明钩子即接管，
-// 且内核不与兜底混合任何字段。
-func TestAdapterSerializerWinsOverFallback(t *testing.T) {
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, "adapters"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	// 一个刻意用**非 OpenAI 形状**的适配器：如果内核混入了兜底字段
-	// （object/choices/usage 等），下面断言会失败。
-	adapter := `
-local adapter = {}
-adapter.name = "anthropicish"
-adapter.version = "1.0.0"
-adapter.endpoint = "/chat/completions"
-
--- 非流式：故意用 content[] 分块 + 没有 choices/usage
-function adapter.serialize_response(payload)
-  local p = json.decode(payload)
-  return json.encode({
-    type = "message",
-    role = "assistant",
-    model = p.model,
-    content = { { type = "text", text = p.content } },
-    stop_reason = (p.finish_reason ~= "" and p.finish_reason or "end_turn"),
-  })
-end
-
--- 流式：event: style 的帧，且不带 OpenAI 的 object 字段
-function adapter.serialize_chunk(payload)
-  local p = json.decode(payload)
-  return json.encode({
-    type = "content_block_delta",
-    delta = { type = "text_delta", text = p.content },
-  })
-end
-
-return adapter
-`
-	if err := os.WriteFile(filepath.Join(dir, "adapters", "anthropicish.lua"), []byte(adapter), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	vm := lua.NewVM(filepath.Join(dir, "adapters"))
-	if err := vm.Start(); err != nil {
-		t.Fatalf("vm: %v", err)
-	}
-	defer vm.Stop()
-
-	ser := serializerFor(vm, "anthropicish")
-	if _, isFallback := ser.(openAISerializer); isFallback {
-		t.Fatal("声明了 serialize_* 的适配器必须接管序列化，而不是拿到兜底")
-	}
-
-	// 非流式输出必须是适配器形状，且**不含**任何 OpenAI 字段
-	resp := &types.UnifiedResponse{
-		Model:        "m",
-		Content:      "hello",
-		FinishReason: "stop",
-		TokenUsage:   types.TokenUsage{Prompt: 3, Completion: 1, Total: 4},
-	}
-	body, err := ser.NonStream(resp, "m", "id-1", 1700000000)
-	if err != nil {
-		t.Fatalf("NonStream: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(body, &got); err != nil {
-		t.Fatalf("adapter output not JSON: %v (%s)", err, body)
-	}
-	if got["type"] != "message" {
-		t.Errorf("适配器输出未被采用：type = %v, want message", got["type"])
-	}
-	// 「让步」的硬断言：OpenAI 字段一个都不许出现
-	for _, k := range []string{"object", "choices", "usage", "created"} {
-		if _, leaked := got[k]; leaked {
-			t.Errorf("兜底 OpenAI 字段 %q 混进了适配器的输出（让步规则被违反）: %s", k, body)
-		}
-	}
-	// 适配器没有读 usage，但兜底也不许替它补上
-	if _, has := got["token_usage"]; has {
-		t.Errorf("兜底补了 token_usage 字段，适配器输出被污染: %s", body)
-	}
-}
-
-// TestAdapterSerializerStreamWinsOverFallback 同上，流式路径。
-func TestAdapterSerializerStreamWinsOverFallback(t *testing.T) {
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, "adapters"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	adapter := `
-local adapter = {}
-adapter.name = "streamsh"
-adapter.version = "1.0.0"
-adapter.endpoint = "/chat/completions"
-
-function adapter.serialize_chunk(payload)
-  local p = json.decode(payload)
-  return json.encode({ type = "content_block_delta", text = p.content })
-end
-
--- 显式声明收尾与终止标记，证明协议语义完全由适配器决定
-function adapter.serialize_close(payload)
-  local p = json.decode(payload)
-  return json.encode({ type = "message_stop", stop_reason = p.finish_reason })
-end
-
-return adapter
-`
-	if err := os.WriteFile(filepath.Join(dir, "adapters", "streamsh.lua"), []byte(adapter), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	vm := lua.NewVM(filepath.Join(dir, "adapters"))
-	if err := vm.Start(); err != nil {
-		t.Fatalf("vm: %v", err)
-	}
-	defer vm.Stop()
-
-	ser := serializerFor(vm, "streamsh")
-	if _, isFallback := ser.(openAISerializer); isFallback {
-		t.Fatal("声明 serialize_chunk 的适配器必须接管流式序列化")
-	}
-	st := &StreamState{}
-	b, err := ser.Chunk(&types.UnifiedChunk{Content: "hi"}, "m", "id", 1, st)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(b), `"content_block_delta"`) {
-		t.Errorf("chunk 未采用适配器形状: %s", b)
-	}
-	if strings.Contains(string(b), "chat.completion.chunk") || strings.Contains(string(b), `"choices"`) {
-		t.Errorf("兜底 OpenAI 帧混进了适配器输出: %s", b)
-	}
-
-	// 终止标记：适配器接管流式后，内核不得自作主张发 [DONE]
-	if m := ser.DoneMarker(); m != "" {
-		t.Errorf("适配器接管流式时 DoneMarker 应为空（不擅自发 [DONE]），实得 %q", m)
-	}
-	// 但它没声明 serialize_close 时，收尾仍借用兜底形状 —— 这是「没实现」
-	// 不是「冲突」，允许兜底。
-	if _, isFallbackClose := ser.(interface {
-		Close(model, id string, created int64, st *StreamState) ([][]byte, error)
-	}); !isFallbackClose {
-		t.Fatal("Close 不应在接口上")
-	}
-}
-
-// TestFallbackIsUsedWhenAdapterHookFails 验证钩子**执行失败**时的行为。
-//
-// 契约：退回兜底的完整输出，而不是产出「一半适配器字段 + 一半 OpenAI
-// 字段」的混合体。混合体比任何一个单独结果都更难排查。
-func TestFallbackIsUsedWhenAdapterHookFails(t *testing.T) {
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, "adapters"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	adapter := `
-local adapter = {}
-adapter.name = "broken"
-adapter.version = "1.0.0"
-adapter.endpoint = "/chat/completions"
-function adapter.serialize_response(payload)
-  error("deliberate failure")
-end
-return adapter
-`
-	if err := os.WriteFile(filepath.Join(dir, "adapters", "broken.lua"), []byte(adapter), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	vm := lua.NewVM(filepath.Join(dir, "adapters"))
-	if err := vm.Start(); err != nil {
-		t.Fatalf("vm: %v", err)
-	}
-	defer vm.Stop()
-
-	ser := serializerFor(vm, "broken")
-	resp := &types.UnifiedResponse{Content: "fallback still works", FinishReason: "stop"}
-	body, err := ser.NonStream(resp, "m", "id", 1)
-	if err != nil {
-		t.Fatalf("钩子失败后必须仍能产出兜底输出，而非报错终止: %v", err)
-	}
-	if !strings.Contains(string(body), "chat.completion") {
-		t.Errorf("钩子失败后未退回兜底 OpenAI 形状: %s", body)
-	}
-}
-
-// TestFallbackSavesUnconfiguredDeployment 直接覆盖用户说的场景：
-// 「刚部署没有配置任何适配器」。
-func TestFallbackSavesUnconfiguredDeployment(t *testing.T) {
-	// 完全不建 VM（模拟适配器目录不存在/为空）
-	ser := serializerFor(nil, "whatever")
-	body, err := ser.NonStream(&types.UnifiedResponse{Content: "no adapters configured"}, "m", "id", 1)
-	if err != nil {
-		t.Fatalf("无适配器时兜底必须可用: %v", err)
-	}
-	if !strings.Contains(string(body), "chat.completion") {
-		t.Errorf("无适配器兜底输出形状不对: %s", body)
-	}
-}
-
-// TestSerializerCacheFollowsAdapterRewrite 验证插件运行时改写适配器后，
-// 缓存不会继续持有旧的序列化器判定（否则新声明的钩子永远不生效，而因为
-// 判定本身不报错，表现只是「适配器说好的格式没出现」，极难定位）。
-func TestSerializerCacheFollowsAdapterRewrite(t *testing.T) {
-	vm := luaVMFor(t)
-	if _, isFallback := serializerForCached(vm, "openai").(openAISerializer); !isFallback {
-		t.Fatal("前提不成立：改写前 openai 应走兜底")
-	}
-	// 插件改写该适配器，加一个 serialize_response
-	src := `local a = {}
-a.name = "openai"
-a.version = "9"
-a.endpoint = "/chat/completions"
-function a.serialize_response(p) return '{"rewritten":true}' end
-return a`
-	if err := vm.LoadAdapterSource("openai", src); err != nil {
-		t.Fatalf("rewrite: %v", err)
-	}
-	// 无需任何显式清缓存动作：修订号变化即让旧条目失效。
-	after := serializerForCached(vm, "openai")
-	if _, stillFallback := after.(openAISerializer); stillFallback {
-		t.Error("缓存未随适配器改写失效：已声明 serialize_response 却仍走兜底")
-	}
-	body, err := after.NonStream(&types.UnifiedResponse{Content: "x"}, "m", "id", 1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(body), "rewritten") {
-		t.Errorf("改写后的序列化器未生效: %s", body)
-	}
-}
-
-// TestSerializerCacheIsPerVM 是那个 bug 的回归测试：缓存曾经只按适配器名做键，
-// 于是同一进程内两个 VM 共享同一条判定——一个适配器被重写后，另一个 VM 的
-// 缓存会说「没声明钩子」，新钩子永远不生效。
-func TestSerializerCacheIsPerVM(t *testing.T) {
-	vm1 := luaVMFor(t)
-	vm2 := luaVMFor(t)
-	// 两个 VM 各自独立：改写 vm1 不得影响 vm2 的判定
-	if err := vm1.LoadAdapterSource("openai", `local a={} a.name="openai" a.version="9"
-a.endpoint="/x" function a.serialize_response(p) return '{"only_vm1":true}' end return a`); err != nil {
-		t.Fatal(err)
-	}
-	if _, f := serializerForCached(vm1, "openai").(openAISerializer); f {
-		t.Error("vm1 改写后应改走适配器序列化")
-	}
-	if _, f := serializerForCached(vm2, "openai").(openAISerializer); !f {
-		t.Error("vm2 未被改写，却因共享缓存而丢失了兜底判定（跨 VM 串扰）")
-	}
-}
-
-// ---- 并发安全 ----
-
-// TestSerializerForConcurrent 是压力测试：多 goroutine 并发取序列化器
-// （缓存是 sync.Map，HasFn 会编译脚本 —— 这里验证并发下不 panic、不返回
-// 半初始化对象，且每次结果自洽）。
-func TestSerializerForConcurrent(t *testing.T) {
-	vm := luaVMFor(t)
-	const workers, iters = 16, 40
-	var wg sync.WaitGroup
-	errs := make(chan string, workers*iters)
-	for w := 0; w < workers; w++ {
-		wg.Add(1)
-		go func(w int) {
-			defer wg.Done()
-			for i := 0; i < iters; i++ {
-				name := "openai"
-				if w%2 == 1 {
-					name = "anthropic"
-				}
-				ser := serializerForCached(vm, name)
-				if ser == nil {
-					errs <- "nil serializer"
-					return
-				}
-				// 结果必须自洽：同一适配器每次拿到同一类型，且形状与该适配器
-				// 声明的协议一致（openai→OpenAI，anthropic→Anthropic）。
-				_, isFallback := ser.(openAISerializer)
-				wantShape := "chat.completion"
-				switch name {
-				case "anthropic":
-					if isFallback {
-						errs <- "anthropic 并发下退回兜底"
-						return
-					}
-					wantShape = `"type":"message"`
-				default:
-					if !isFallback {
-						errs <- name + " 并发下未走兜底"
-						return
-					}
-				}
-				body, err := ser.NonStream(&types.UnifiedResponse{Content: "x"}, "m", "id", 1)
-				if err != nil {
-					errs <- "serialize: " + err.Error()
-					return
-				}
-				if !strings.Contains(string(body), wantShape) {
-					errs <- "并发下输出形状不一致: " + name + " -> " + string(body)
-					return
-				}
-			}
-		}(w)
-	}
-	wg.Wait()
-	close(errs)
-	for e := range errs {
-		t.Error(e)
-	}
-}

internal/gateway/server.go

@@ -115,7 +115,7 @@ func (g *Gateway) loginRecord(ip string, ok bool, now int64) {
 	}
 }
 
-func New(c *core.Core) (*Gateway, error) {
+func New(c *core.Core, gatewayKeys []string) (*Gateway, error) {
 	sub, err := fs.Sub(uiFS, "ui")
 	if err != nil {
 		return nil, err
@@ -216,50 +216,16 @@ func (g *Gateway) routes(w http.ResponseWriter, r *http.Request) {
 	switch {
 	case r.URL.Path == "/v1/chat/completions":
 		g.handleChat(w, r)
-	case r.URL.Path == "/v1/messages":
-		// Anthropic Messages protocol. Scheduling, quotas, cooldowns, AUTO
-		// chain and accounting are EXACTLY the ones /v1/chat/completions uses —
-		// only the wire shapes differ, and those come from the serving
-		// adapter's serialize_* hooks. The kernel holds no Anthropic field
-		// names (see serializer.go: the fallback is OpenAI, and any adapter
-		// that declares serialize_* replaces it wholesale).
-		g.handleMessages(w, r)
 	case r.URL.Path == "/v1/images/generations":
 		g.handleImage(w, r)
 	case r.URL.Path == "/v1/models":
 		g.handleModels(w, r)
 	case r.URL.Path == "/api/adapters" || strings.HasPrefix(r.URL.Path, "/api/adapters/"):
 		g.handleAdaptersAPI(w, r)
-	case r.URL.Path == "/api/v1" || strings.HasPrefix(r.URL.Path, "/api/v1/"):
-		g.apiV1Routes(w, r)
-	// Must precede the /api/sources prefix match: a generic HasPrefix on
-	// "/api/sources/" would otherwise swallow "/api/sources/discover" and the
-	// operator would get "source name required in path" instead of a catalog.
-	case r.URL.Path == "/api/sources/discover" || strings.HasPrefix(r.URL.Path, "/api/sources/discover/"):
-		g.handleSourceDiscoverAPI(w, r)
 	case r.URL.Path == "/api/sources" || strings.HasPrefix(r.URL.Path, "/api/sources/"):
 		g.handleSourcesAPI(w, r)
 	case r.URL.Path == "/api/source_templates" || strings.HasPrefix(r.URL.Path, "/api/source_templates/"):
 		g.handleSourceTemplatesAPI(w, r)
-	case r.URL.Path == "/api/ui-inject" || strings.HasPrefix(r.URL.Path, "/api/ui-inject/"):
-		g.handlePluginUI(w, r)
-	case r.URL.Path == "/api/plugins/billing/rules":
-		// Checked BEFORE the generic /api/plugins/ prefix: the plugin router
-		// treats anything after the name as a plugin sub-resource and would
-		// 404 on "rules" instead of reaching the billing editor.
-		g.handleBillingRules(w, r)
-	case strings.HasPrefix(r.URL.Path, pluginHTTPPrefix):
-		// Before the generic plugin router: these paths belong to a PLUGIN, not to
-		// the plugin manager, and "http" is a valid sub-resource name otherwise.
-		g.handlePluginHTTP(w, r)
-	case strings.HasPrefix(r.URL.Path, "/plugins/") || strings.HasPrefix(r.URL.Path, "/v1/plugins/"):
-		// Custom mounts a plugin or adapter claimed (R3). Checked AFTER every
-		// kernel route so a claim can never shadow one — ValidateCustomMount
-		// refuses the overlap at load time, and this ordering is the second line
-		// of defence for a table that somehow slipped through.
-		g.handleCustomMount(w, r)
-	case r.URL.Path == "/api/plugins" || strings.HasPrefix(r.URL.Path, "/api/plugins/"):
-		g.handlePluginsAPI(w, r)
 	case r.URL.Path == "/api/chat":
 		g.handleChat(w, r)
 	case r.URL.Path == "/api/status":
@@ -328,43 +294,20 @@ func (g *Gateway) auth(next http.Handler) http.Handler {
 			http.Redirect(w, r, "/login?continue="+url.QueryEscape(r.URL.Path), http.StatusFound)
 			return
 		}
-		next.ServeHTTP(w, r.WithContext(withAuthNamed(r.Context(), key, rec.Role, rec.Name)))
+		next.ServeHTTP(w, r.WithContext(withAuth(r.Context(), key, rec.Role)))
 	})
 }
 
-// authCtx carries the authenticated gateway key, its role, and the key's
-// configured NAME.
-//
-// The name is here because plugin HTTP endpoints authorise by key name rather
-// than by secret, and looking the name up from the key at the point of use would
-// mean reading config on every request. It is "" for a key configured without
-// one, which such an endpoint can never match.
+// authCtx carries the authenticated gateway key and its role.
 type authCtx struct {
 	key  string
 	role string
-	name string
 }
 
 type authCtxKeyT struct{}
 
 func withAuth(ctx context.Context, key, role string) context.Context {
-	return withAuthNamed(ctx, key, role, "")
-}
-
-// withAuthNamed is withAuth plus the key's configured name.
-func withAuthNamed(ctx context.Context, key, role, name string) context.Context {
-	return context.WithValue(ctx, authCtxKeyT{}, authCtx{key: key, role: role, name: name})
-}
-
-// reqKeyName returns the authenticated key's configured name, or "" if it has
-// none. Plugin endpoint authorisation is written against this, not against the
-// secret: a secret is rotated without notice, so a rule keyed on it would
-// silently stop matching.
-func reqKeyName(ctx context.Context) string {
-	if a, ok := ctx.Value(authCtxKeyT{}).(authCtx); ok {
-		return a.name
-	}
-	return ""
+	return context.WithValue(ctx, authCtxKeyT{}, authCtx{key: key, role: role})
 }
 
 // reqKey returns the authenticated gateway key id (masked suffix for display).

internal/gateway/source_fields_test.go

@@ -1,495 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"llmsproxy/internal/config"
-	"llmsproxy/internal/core"
-)
-
-// This file covers the second round of the same class of defect bf0657b fixed.
-//
-// bf0657b stopped a partial source edit from clobbering api_key. The upsert
-// still rewrites the WHOLE source, so every other field the request could not
-// express was reset to its zero value on any edit: proxy_url, api_key_env,
-// timeout and queue_timeout.
-//
-// The four are worse than cosmetic because they change how the source dials out.
-// proxy_url silently turns a proxied upstream into a direct one (or vice versa)
-// and api_key_env turns a source whose credential lives in an environment
-// variable into a credential-less source — which keeps answering 200 on write
-// and only fails on the NEXT call upstream, long after the editor left.
-//
-// The trigger is not exotic scripting: the WebUI's own edit form posts exactly
-// such a payload. See TestWebUIEditPayloadPreservesRoutingFields.
-
-// richGateway writes a config.yaml whose source carries all four fragile
-// fields, then boots a gateway over it.
-func richGateway(t *testing.T) *Gateway {
-	t.Helper()
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	cfg := `listen: 127.0.0.1:8080
-gateway_keys:
-  - sk-test
-default_model: AUTO
-adapter_dir: ` + filepath.Join(dir, "adapters") + `
-runtime_file: ` + filepath.Join(dir, "runtime.json") + `
-sources:
-  - name: rich
-    base_url: https://api.deepseek.com
-    api_key: sk-live
-    adapter: deepseek
-    proxy_url: http://127.0.0.1:7890
-    timeout: 300s
-    queue_timeout: 90s
-    max_concurrent: 8
-    models:
-      - id: deepseek-v4-flash
-        priority: 100
-        kind: chat
-`
-	if err := os.WriteFile(cfgPath, []byte(cfg), 0600); err != nil {
-		t.Fatal(err)
-	}
-	c, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	core, err := core.NewFromConfig(c)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(core.Close)
-	g, err := New(core)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return g
-}
-
-// sourceField reads one field off the live source, i.e. what the routes
-// actually use rather than what the file happens to contain.
-func sourceField(t *testing.T, g *Gateway, name string, get func(config.Source) interface{}) interface{} {
-	t.Helper()
-	for _, s := range g.core.Sources() {
-		if s.Name == name {
-			return get(s)
-		}
-	}
-	t.Fatalf("source %q not found", name)
-	return nil
-}
-
-// webUIPayload is byte-for-byte the JSON that index.html's saveSource() builds
-// from the edit dialog. It deliberately carries none of the four fragile
-// fields, because the dialog has no inputs for them.
-const webUIPayload = `{
-  "name":"rich","base_url":"https://api.deepseek.com","api_key":"sk-live",
-  "adapter":"deepseek","endpoint":"","image_endpoint":"",
-  "models":[{"id":"deepseek-v4-flash","priority":100,"kind":"chat"}],
-  "headers":{},"meta":{},"temperature":0,"max_tokens":0,"max_concurrent":16,"rpm":0
-}`
-
-// TestWebUIEditPayloadPreservesRoutingFields is the regression test for the
-// reported defect: changing max_concurrent from 8 to 16 in the UI must not
-// silently drop the proxy, the env-var credential, or the timeouts.
-func TestWebUIEditPayloadPreservesRoutingFields(t *testing.T) {
-	g := richGateway(t)
-
-	// The one field the operator actually changed.
-	rr := doReq(t, g, "POST", "/api/sources", webUIPayload)
-	if rr.Code != 200 {
-		t.Fatalf("edit status=%d body=%s", rr.Code, rr.Body.String())
-	}
-
-	checks := []struct {
-		field string
-		got   interface{}
-		want  interface{}
-	}{
-		{"proxy_url", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.ProxyURL }),
-			"http://127.0.0.1:7890"},
-		{"timeout", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.Timeout }),
-			300 * time.Second},
-		{"queue_timeout", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.QueueTimeout }),
-			90 * time.Second},
-		// The field the edit DID change, so a fix that simply refuses to write
-		// anything would also pass the three assertions above.
-		{"max_concurrent", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.MaxConcurrent }),
-			16},
-	}
-	for _, c := range checks {
-		if c.got != c.want {
-			t.Errorf("%s = %v, want %v", c.field, c.got, c.want)
-		}
-	}
-}
-
-// TestSourceEditPreservesAPIKeyEnv is called out separately because it is the
-// only one of the four whose loss is a credential failure rather than a routing
-// difference, and it is invisible until the next upstream call.
-func TestSourceEditPreservesAPIKeyEnv(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	cfg := `listen: 127.0.0.1:8080
-gateway_keys:
-  - sk-test
-default_model: AUTO
-adapter_dir: ` + filepath.Join(dir, "adapters") + `
-runtime_file: ` + filepath.Join(dir, "runtime.json") + `
-sources:
-  - name: envonly
-    base_url: https://api.deepseek.com
-    api_key_env: DEEPSEEK_KEY
-    adapter: deepseek
-    max_concurrent: 8
-    models:
-      - id: deepseek-v4-flash
-        priority: 100
-        kind: chat
-`
-	if err := os.WriteFile(cfgPath, []byte(cfg), 0600); err != nil {
-		t.Fatal(err)
-	}
-	c, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	core, err := core.NewFromConfig(c)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(core.Close)
-	g, err := New(core)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// A credential-less source is legitimate, so the API must not invent one
-	// here; the point is that the ENV reference survives the edit.
-	rr := doReq(t, g, "POST", "/api/sources", `{
-      "name":"envonly","base_url":"https://api.deepseek.com","api_key":"",
-      "adapter":"deepseek","models":[{"id":"deepseek-v4-flash","priority":100,"kind":"chat"}],
-      "headers":{},"meta":{},"max_concurrent":4}`)
-	if rr.Code != 200 {
-		t.Fatalf("edit status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	got := sourceField(t, g, "envonly", func(s config.Source) interface{} { return s.APIKeyEnv })
-	if got != "DEEPSEEK_KEY" {
-		t.Fatalf("api_key_env = %v after an edit that did not mention it; "+
-			"the source now has no credential and will only fail on the next upstream call", got)
-	}
-	if n := sourceField(t, g, "envonly", func(s config.Source) interface{} { return s.MaxConcurrent }); n != 4 {
-		t.Fatalf("max_concurrent = %v, want the edited 4", n)
-	}
-}
-
-// TestSourceEditPersistsInheritedFieldsToDisk: inheriting in memory is not
-// enough — the values must reach config.yaml, or a restart silently undoes the
-// fix and the field is lost anyway.
-func TestSourceEditPersistsInheritedFieldsToDisk(t *testing.T) {
-	g := richGateway(t)
-	if rr := doReq(t, g, "POST", "/api/sources", webUIPayload); rr.Code != 200 {
-		t.Fatalf("edit status=%d: %s", rr.Code, rr.Body.String())
-	}
-	raw, err := os.ReadFile(g.core.Config().Path)
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-	text := string(raw)
-	for _, want := range []string{
-		"proxy_url: http://127.0.0.1:7890",
-	} {
-		if !strings.Contains(text, want) {
-			t.Errorf("config.yaml lost %q on an unrelated edit:\n%s", want, text)
-		}
-	}
-	// The durations are re-serialized in Go's canonical form (300s becomes
-	// 5m0s), so they must be checked SEMANTICALLY. Asserting the original
-	// spelling would be a false red: the value survived, only its text changed.
-	// Re-loading the file is also the only way to prove the persisted value
-	// parses back to the same duration.
-	reloaded, err := config.Load(g.core.Config().Path)
-	if err != nil {
-		t.Fatalf("re-read config: %v", err)
-	}
-	if len(reloaded.Sources) == 0 {
-		t.Fatal("no sources after reload")
-	}
-	s := reloaded.Sources[0]
-	if s.Timeout != 300*time.Second {
-		t.Errorf("persisted timeout = %v, want 300s", s.Timeout)
-	}
-	if s.QueueTimeout != 90*time.Second {
-		t.Errorf("persisted queue_timeout = %v, want 90s", s.QueueTimeout)
-	}
-	if s.ProxyURL != "http://127.0.0.1:7890" {
-		t.Errorf("persisted proxy_url = %v, want it preserved", s.ProxyURL)
-	}
-}
-
-// ---- explicit set / clear, i.e. the pointer semantics actually work ----
-
-func TestSourceOptionalFieldsCanBeSet(t *testing.T) {
-	g := richGateway(t)
-	rr := doReq(t, g, "POST", "/api/sources", `{
-      "name":"rich","base_url":"https://api.deepseek.com","api_key":"sk-live",
-      "adapter":"deepseek","models":[{"id":"deepseek-v4-flash","priority":100,"kind":"chat"}],
-      "headers":{},"meta":{},
-      "proxy_url":"http://127.0.0.1:1080",
-      "api_key_env":"NEW_ENV_KEY",
-      "timeout":"45s",
-      "queue_timeout":"5s"}`)
-	if rr.Code != 200 {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	for _, c := range []struct {
-		field string
-		got   interface{}
-		want  interface{}
-	}{
-		{"proxy_url", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.ProxyURL }), "http://127.0.0.1:1080"},
-		{"api_key_env", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.APIKeyEnv }), "NEW_ENV_KEY"},
-		{"timeout", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.Timeout }), 45 * time.Second},
-		{"queue_timeout", sourceField(t, g, "rich", func(s config.Source) interface{} { return s.QueueTimeout }), 5 * time.Second},
-	} {
-		if c.got != c.want {
-			t.Errorf("%s = %v, want %v", c.field, c.got, c.want)
-		}
-	}
-}
-
-// TestSourceOptionalFieldsCanBeCleared is the half that an "empty means
-// inherit" implementation gets wrong: it can never clear a field, so emptying
-// the proxy box in the UI would keep using the old proxy forever.
-func TestSourceOptionalFieldsCanBeCleared(t *testing.T) {
-	g := richGateway(t)
-	rr := doReq(t, g, "POST", "/api/sources", `{
-      "name":"rich","base_url":"https://api.deepseek.com","api_key":"sk-live",
-      "adapter":"deepseek","models":[{"id":"deepseek-v4-flash","priority":100,"kind":"chat"}],
-      "headers":{},"meta":{},
-      "proxy_url":"","timeout":"","queue_timeout":""}`)
-	if rr.Code != 200 {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if got := sourceField(t, g, "rich", func(s config.Source) interface{} { return s.ProxyURL }); got != "" {
-		t.Errorf("proxy_url = %v, want it cleared", got)
-	}
-	// A cleared timeout falls back to the config default (120s), which is what
-	// mergedSources applies for a zero value — assert the effective behaviour
-	// rather than the raw zero, since that is what a caller actually gets.
-	if got := sourceField(t, g, "rich", func(s config.Source) interface{} { return s.Timeout }); got != config.DefaultSourceTimeout {
-		t.Errorf("timeout = %v, want the default %v after clearing", got, config.DefaultSourceTimeout)
-	}
-	// api_key_env was NOT in the request, so it must be untouched even though
-	// its sibling fields were cleared.
-	_ = rr
-}
-
-// TestSourceOptionalFieldsClearIsScoped: clearing the proxy must not clear the
-// env credential that the same request did not mention.
-func TestSourceOptionalFieldsClearIsScoped(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.yaml")
-	cfg := `listen: 127.0.0.1:8080
-gateway_keys:
-  - sk-test
-default_model: AUTO
-adapter_dir: ` + filepath.Join(dir, "adapters") + `
-runtime_file: ` + filepath.Join(dir, "runtime.json") + `
-sources:
-  - name: both
-    base_url: https://api.deepseek.com
-    api_key_env: DEEPSEEK_KEY
-    adapter: deepseek
-    proxy_url: http://127.0.0.1:7890
-    max_concurrent: 8
-    models:
-      - id: deepseek-v4-flash
-        priority: 100
-        kind: chat
-`
-	os.WriteFile(cfgPath, []byte(cfg), 0600)
-	c, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	core, err := core.NewFromConfig(c)
-	if err != nil {
-		t.Fatalf("core: %v", err)
-	}
-	t.Cleanup(core.Close)
-	g, err := New(core)
-	if err != nil {
-		t.Fatal(err)
-	}
-	rr := doReq(t, g, "POST", "/api/sources", `{
-      "name":"both","base_url":"https://api.deepseek.com","api_key":"",
-      "adapter":"deepseek","models":[{"id":"deepseek-v4-flash","priority":100,"kind":"chat"}],
-      "headers":{},"meta":{},"proxy_url":""}`)
-	if rr.Code != 200 {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if got := sourceField(t, g, "both", func(s config.Source) interface{} { return s.APIKeyEnv }); got != "DEEPSEEK_KEY" {
-		t.Errorf("api_key_env = %v; clearing proxy_url must not touch it", got)
-	}
-	if got := sourceField(t, g, "both", func(s config.Source) interface{} { return s.ProxyURL }); got != "" {
-		t.Errorf("proxy_url = %v, want cleared", got)
-	}
-}
-
-func TestSourceRejectsBadDuration(t *testing.T) {
-	g := richGateway(t)
-	before := sourceField(t, g, "rich", func(s config.Source) interface{} { return s.Timeout })
-	rr := doReq(t, g, "POST", "/api/sources", `{
-      "name":"rich","base_url":"https://api.deepseek.com","api_key":"sk-live",
-      "adapter":"deepseek","models":[{"id":"deepseek-v4-flash","priority":100,"kind":"chat"}],
-      "headers":{},"meta":{},"timeout":"not-a-duration"}`)
-	if rr.Code != 400 {
-		t.Fatalf("status=%d, want 400 for an unparseable duration: %s", rr.Code, rr.Body.String())
-	}
-	if !strings.Contains(rr.Body.String(), "timeout") {
-		t.Errorf("the error must name the offending field: %s", rr.Body.String())
-	}
-	// A rejected write must leave the source exactly as it was.
-	if after := sourceField(t, g, "rich", func(s config.Source) interface{} { return s.Timeout }); after != before {
-		t.Errorf("a rejected edit still changed timeout: %v -> %v", before, after)
-	}
-}
-
-// TestSourceCreateSetsOptionalFields: the create path must accept them too, and
-// must not require an existing source to inherit from (a nil-pointer crash
-// here would only show up as a 500 on every new source).
-func TestSourceCreateSetsOptionalFields(t *testing.T) {
-	up := mockUpstream()
-	defer up.Close()
-	g := newTestGateway(t)
-	rr := doReq(t, g, "POST", "/api/sources", `{
-      "name":"fresh","base_url":"`+up.URL+`","api_key":"sk-x","adapter":"openai",
-      "models":[{"id":"m1","kind":"chat"}],"headers":{},"meta":{},
-      "proxy_url":"http://127.0.0.1:7890","timeout":"10s","queue_timeout":"3s"}`)
-	if rr.Code != 200 {
-		t.Fatalf("create status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if got := sourceField(t, g, "fresh", func(s config.Source) interface{} { return s.ProxyURL }); got != "http://127.0.0.1:7890" {
-		t.Errorf("proxy_url = %v, want it set on create", got)
-	}
-	if got := sourceField(t, g, "fresh", func(s config.Source) interface{} { return s.Timeout }); got != 10*time.Second {
-		t.Errorf("timeout = %v, want 10s on create", got)
-	}
-}
-
-// TestSourceRevealExposesDurations guards the round-trip the edit form depends
-// on. config.Source tags Timeout/QueueTimeout `json:"-"`, so marshaling the
-// struct omits them; the form then reads an empty timeout box and — because it
-// always sends the box back — CLEARS the stored timeout on any unrelated save.
-// A test that only checks "the edit preserves timeout" would not have caught
-// that, because the loss happens between the read and the write.
-//
-// The credentials are asserted in the same breath: they came from the same
-// branch, and an earlier iteration of this fix masked the key and broke the
-// form's other half.
-func TestSourceRevealExposesDurations(t *testing.T) {
-	up := mockUpstream()
-	defer up.Close()
-	g := newTestGateway(t, config.Source{
-		Name:    "revealed",
-		BaseURL: up.URL,
-		Adapter: "openai",
-		APIKey:  "sk-reveal-me",
-		Models:  []config.Model{{ID: "m1", Kind: "chat"}},
-		Timeout: 300 * time.Second,
-	})
-
-	rr := doReq(t, g, "GET", "/api/v1/sources/revealed?reveal=credentials", "")
-	if rr.Code != 200 {
-		t.Fatalf("reveal status=%d: %s", rr.Code, rr.Body.String())
-	}
-	var view struct {
-		Source map[string]interface{} `json:"source"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &view); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	// Duration strings, matching what the write path parses.
-	if got := view.Source["timeout"]; got != "5m0s" {
-		t.Errorf("reveal timeout = %v, want the string \"5m0s\"; the edit form "+
-			"would show an empty box and clear the stored value on save", got)
-	}
-	// The unset one shows the DEFAULT, not "": ApplyDefaults filled
-	// QueueTimeout before the form ever sees it. Both are acceptable as long as
-	// the value round-trips, so assert it is a parseable duration string.
-	qs, _ := view.Source["queue_timeout"].(string)
-	if _, err := time.ParseDuration(qs); err != nil {
-		t.Errorf("reveal queue_timeout = %q is not a duration string: %v", qs, err)
-	}
-	if got := view.Source["api_key"]; got != "sk-reveal-me" {
-		t.Errorf("reveal api_key = %v, want it in the clear for the form", got)
-	}
-	// The masked view must NOT gain the durations' secrets — it is fine for it
-	// to omit them, but it must never carry the key.
-	masked := doReq(t, g, "GET", "/api/v1/sources/revealed", "")
-	if strings.Contains(masked.Body.String(), "sk-reveal-me") {
-		t.Error("the masked view leaked the key")
-	}
-}
-
-// TestSourcePayloadCoversEveryEditableField is the guard against the class
-// itself. Any config.Source field a source edit can legitimately set must
-// exist on sourcePayload, otherwise the upsert resets it.
-//
-// It reflects over the STRUCT rather than over json.Marshal output: the four
-// pointer fields carry `omitempty`, so a nil pointer legitimately disappears
-// from the marshaled form — that absence is precisely the "not mentioned" signal
-// the handler relies on. Checking marshaled keys would therefore report a
-// healthy field as missing.
-func TestSourcePayloadCoversEveryEditableField(t *testing.T) {
-	// Fields of config.Source that a source edit can legitimately set.
-	want := []string{
-		"name", "base_url", "api_key", "api_key_env", "adapter", "endpoint",
-		"image_endpoint", "models", "headers", "proxy_url", "meta",
-		"temperature", "max_tokens", "max_concurrent", "rpm",
-		"timeout", "queue_timeout",
-	}
-	pt := reflect.TypeOf(sourcePayload{})
-	for _, f := range want {
-		if _, ok := pt.FieldByName(f); !ok {
-			// Tolerate a differently-spelled Go field only when the JSON tag
-			// matches, so the check stays about the wire contract.
-			if !hasJSONTag(pt, f) {
-				t.Errorf("config.Source has %q but sourcePayload has no such JSON key: "+
-					"an edit that omits it resets the stored value", f)
-			}
-		}
-	}
-}
-
-// hasJSONTag reports whether any field of t carries the given JSON name.
-func hasJSONTag(t reflect.Type, name string) bool {
-	for i := 0; i < t.NumField(); i++ {
-		if jsonName(t.Field(i)) == name {
-			return true
-		}
-	}
-	return false
-}
-
-// jsonName returns the JSON name of a struct field, falling back to the Go
-// field name when no tag is present.
-func jsonName(f reflect.StructField) string {
-	tag := f.Tag.Get("json")
-	if tag == "" {
-		return f.Name
-	}
-	if n := strings.Split(tag, ",")[0]; n != "" {
-		return n
-	}
-	return f.Name
-}

internal/gateway/sources_api_test.go

@@ -1,259 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// These cover the two write-path defects found while adding a model to a live
-// source by hand:
-//
-//  1. PUT /api/sources/{name} was documented in the API index but not
-//     implemented, so it answered 405 while POST (which does the same upsert)
-//     worked. A caller following the documented contract could not edit a
-//     source at all.
-//  2. POST is an upsert that replaces the whole source, so a partial edit that
-//     did not carry api_key persisted an empty/placeholder credential. The
-//     source kept its name and models and answered 401 on the next call, well
-//     after the writing script had exited 0.
-//
-// The second one is the dangerous class: a write that reports success and
-// breaks the source later.
-
-// sourceAPIKey reads the stored key back the way an operator would, i.e. what
-// the routes actually use, not what the file happens to contain.
-func sourceAPIKey(t *testing.T, g *Gateway, name string) string {
-	t.Helper()
-	for _, s := range g.core.Sources() {
-		if s.Name == name {
-			return s.APIKey
-		}
-	}
-	t.Fatalf("source %q not found", name)
-	return ""
-}
-
-func seededGateway(t *testing.T) (*Gateway, string) {
-	t.Helper()
-	up := mockUpstream()
-	t.Cleanup(up.Close)
-	g := newTestGateway(t, config.Source{
-		Name:    "seeded",
-		BaseURL: up.URL,
-		Adapter: "openai",
-		APIKey:  "sk-real-credential",
-		Models:  []config.Model{{ID: "m-one", Kind: "chat"}},
-	})
-	return g, up.URL
-}
-
-func TestSourcePutUpdatesSource(t *testing.T) {
-	g, up := seededGateway(t)
-
-	// A single-field edit: change one model's priority, name the source only in
-	// the path. This is the shape the API index documents for PUT.
-	rr := doReq(t, g, "PUT", "/api/sources/seeded", fmt.Sprintf(
-		`{"base_url":%q,"adapter":"openai","api_key":"sk-real-credential","models":[{"id":"m-one","priority":42,"kind":"chat"}]}`, up))
-	if rr.Code != http.StatusOK {
-		t.Fatalf("PUT status=%d body=%s", rr.Code, rr.Body.String())
-	}
-
-	var found bool
-	for _, s := range g.core.Sources() {
-		if s.Name != "seeded" {
-			continue
-		}
-		found = true
-		for _, m := range s.Models {
-			if m.ID == "m-one" && m.Priority != 42 {
-				t.Fatalf("priority not applied: %+v", s.Models)
-			}
-		}
-	}
-	if !found {
-		t.Fatal("source vanished after PUT")
-	}
-	// And it must be routable, not merely stored.
-	if rr := doReq(t, g, "GET", "/v1/models", ""); rr.Code != http.StatusOK ||
-		!strings.Contains(rr.Body.String(), "m-one") {
-		t.Fatalf("model not routable after PUT: %d %s", rr.Code, rr.Body.String())
-	}
-}
-
-func TestSourcePutRejectsNameMismatch(t *testing.T) {
-	g, _ := seededGateway(t)
-	// Body names a different source than the path. Silently preferring either
-	// one would let a client edit a source it did not name.
-	rr := doReq(t, g, "PUT", "/api/sources/seeded", `{"name":"other","base_url":"http://x","models":[{"id":"m"}]}`)
-	if rr.Code != http.StatusBadRequest {
-		t.Fatalf("name mismatch accepted: status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if sourceAPIKey(t, g, "seeded") != "sk-real-credential" {
-		t.Fatal("rejected PUT still mutated the source")
-	}
-}
-
-func TestSourcePutRequiresNameInPath(t *testing.T) {
-	g, _ := seededGateway(t)
-	rr := doReq(t, g, "PUT", "/api/sources", `{"base_url":"http://x","models":[{"id":"m"}]}`)
-	if rr.Code != http.StatusBadRequest {
-		t.Fatalf("PUT without a name in the path: status=%d body=%s", rr.Code, rr.Body.String())
-	}
-}
-
-func TestSourceUpsertKeepsAPIKey(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		sentKey string
-	}{
-		{"explicit mask", keepExistingAPIKey},
-		{"omitted key", ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			g, up := seededGateway(t)
-			rr := doReq(t, g, "PUT", "/api/sources/seeded", fmt.Sprintf(
-				`{"base_url":%q,"adapter":"openai","api_key":%q,"models":[{"id":"m-one"},{"id":"m-two"}]}`,
-				up, tc.sentKey))
-			if rr.Code != http.StatusOK {
-				t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-			}
-			if got := sourceAPIKey(t, g, "seeded"); got != "sk-real-credential" {
-				t.Fatalf("api_key was clobbered: got %q, want the pre-existing credential", got)
-			}
-			// The failure this guards is a source that looks configured but
-			// cannot authenticate, so assert the route still works.
-			if rr := doReq(t, g, "GET", "/v1/models", ""); rr.Code != http.StatusOK {
-				t.Fatalf("source unusable after edit: %d %s", rr.Code, rr.Body.String())
-			}
-		})
-	}
-}
-
-func TestSourceUpsertStillWritesNewKey(t *testing.T) {
-	// The keep-existing path must not swallow a deliberate rotation.
-	g, up := seededGateway(t)
-	rr := doReq(t, g, "PUT", "/api/sources/seeded", fmt.Sprintf(
-		`{"base_url":%q,"adapter":"openai","api_key":"sk-rotated","models":[{"id":"m-one"}]}`, up))
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if got := sourceAPIKey(t, g, "seeded"); got != "sk-rotated" {
-		t.Fatalf("rotation ignored: got %q", got)
-	}
-}
-
-func TestSourceUpsertNewSourceMayHaveNoKey(t *testing.T) {
-	// Empty is a real value for a credential-less source (local upstreams), so
-	// inherit-on-empty must not invent one for a source that does not exist yet.
-	up := mockUpstream()
-	defer up.Close()
-	g := newTestGateway(t)
-	rr := doReq(t, g, "POST", "/api/sources", fmt.Sprintf(
-		`{"name":"noauth","base_url":%q,"adapter":"openai","models":[{"id":"local-m"}]}`, up.URL))
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if got := sourceAPIKey(t, g, "noauth"); got != "" {
-		t.Fatalf("unexpected key on a new credential-less source: %q", got)
-	}
-}
-
-func TestSourceModelIDsIsAdditive(t *testing.T) {
-	// "Add one model" is the edit that motivated the defect: it needs no read
-	// of the existing list, so it must not require one.
-	g, up := seededGateway(t)
-	rr := doReq(t, g, "PUT", "/api/sources/seeded", fmt.Sprintf(
-		`{"base_url":%q,"adapter":"openai","api_key":%q,"model_ids":["m-two","m-two"," m-three "]}`, up, keepExistingAPIKey))
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	var ids []string
-	for _, s := range g.core.Sources() {
-		if s.Name == "seeded" {
-			for _, m := range s.Models {
-				ids = append(ids, m.ID)
-			}
-		}
-	}
-	// m-one kept, m-two not duplicated, blank entries dropped, whitespace trimmed.
-	want := map[string]int{"m-one": 1, "m-two": 1, "m-three": 1}
-	if len(ids) != len(want) {
-		t.Fatalf("models=%v, want exactly %v", ids, want)
-	}
-	seen := map[string]int{}
-	for _, id := range ids {
-		seen[id]++
-	}
-	for id, n := range want {
-		if seen[id] != n {
-			t.Fatalf("models=%v: %q appears %d times, want %d", ids, id, seen[id], n)
-		}
-	}
-}
-
-func TestSourceWriteRejectsNonAdmin(t *testing.T) {
-	g, up := seededGateway(t)
-	for _, m := range []string{"POST", "PUT", "DELETE"} {
-		req, _ := http.NewRequest(m, "/api/sources/seeded", strings.NewReader(fmt.Sprintf(
-			`{"name":"seeded","base_url":%q,"models":[{"id":"m"}]}`, up)))
-		req.Header.Set("Authorization", "Bearer sk-not-a-real-key")
-		req.Header.Set("Content-Type", "application/json")
-		rr := httptest.NewRecorder()
-		g.Handler().ServeHTTP(rr, req)
-		if rr.Code == http.StatusOK {
-			t.Fatalf("%s allowed for an unknown key: %s", m, rr.Body.String())
-		}
-	}
-	if sourceAPIKey(t, g, "seeded") != "sk-real-credential" {
-		t.Fatal("unauthenticated write mutated the source")
-	}
-}
-
-// TestSourceWritePersistsToDisk guards the difference between "the in-memory
-// registry accepted it" and "it will survive a restart". The api_key must be
-// sealed at rest, never the literal placeholder.
-func TestSourceWritePersistsToDisk(t *testing.T) {
-	g, up := seededGateway(t)
-	rr := doReq(t, g, "PUT", "/api/sources/seeded", fmt.Sprintf(
-		`{"base_url":%q,"adapter":"openai","api_key":%q,"models":[{"id":"m-one"}]}`, up, keepExistingAPIKey))
-	if rr.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	raw, err := os.ReadFile(g.core.Config().Path)
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-	text := string(raw)
-	if strings.Contains(text, keepExistingAPIKey) {
-		t.Fatal("the keep-mask was persisted as a literal api_key")
-	}
-	if strings.Contains(text, "sk-real-credential") {
-		t.Fatal("api_key stored in plaintext; it must be sealed at rest")
-	}
-	if !strings.Contains(text, "m-one") {
-		t.Fatal("source not persisted")
-	}
-	// The masked GET view must not leak the credential either.
-	rr = doReq(t, g, "GET", "/api/v1/sources/seeded", "")
-	if rr.Code != http.StatusOK {
-		t.Fatalf("get status=%d", rr.Code)
-	}
-	var view struct {
-		Source struct {
-			APIKey string `json:"api_key"`
-		} `json:"source"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &view); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if view.Source.APIKey == "sk-real-credential" {
-		t.Fatal("GET /api/v1/sources leaked the plaintext api_key")
-	}
-}

internal/gateway/stats.go

@@ -43,42 +43,11 @@ type Req struct {
 	// accounting at all (even when the hit count is 0). The WebUI shows
 	// "0%" instead of "—" for such rows.
 	CacheReported bool `json:"cache_reported,omitempty"`
-	// Reasoning is completion_tokens_details.reasoning_tokens.
-	//
-	// It is a SUBSET of Compl, not an addition: reasoning tokens are billed at
-	// the completion rate and already counted there. This field exists so a
-	// pricing rule can split them when a provider prices thinking tokens
-	// differently (most do NOT — OpenAI and DeepSeek bill them as ordinary
-	// output), and so a reader can see what fraction of a bill is thinking.
-	// 0 means "not reported", which is NOT the same as "no reasoning happened" —
-	// three of the sources measured return no such field at all.
-	Reasoning int64 `json:"reasoning_tokens,omitempty"`
-	OK        bool  `json:"ok"`
+	OK            bool `json:"ok"`
 	// Status http status code
 	Status int `json:"status"`
 	// Err short error message
 	Err string `json:"error,omitempty"`
-	// ImageCount is how many images an image-generation request produced.
-	// Kept separate from Compl/Prompt: image generation has no token concept,
-	// so counting images as "completion tokens" would corrupt the token totals.
-	ImageCount int `json:"image_count,omitempty"`
-
-	// Walk is the AUTO chain's step-by-step trace for this request: which tiers
-	// were skipped and why, which slots hard-failed, which one served it. It is
-	// the only way a consumer can tell "tier 1 served this" from "tier 1 was
-	// cooling so we dropped to tier 3" — a distinction that is the entire point
-	// of a priority chain.
-	//
-	// json:"-" — deliberately NOT persisted. The audit file is a hot append and
-	// this is observational detail: on a degraded gateway every request would
-	// carry a multi-element array, and the audit trail's own retention (16 files
-	// x 16 MB) is already the largest thing on the box. A plugin that wants the
-	// walk sees it live at request_end; an operator post-mortem reads it from the
-	// plugin's own accumulated state or from /api/auto slot health.
-	//
-	// Only populated when a plugin is loaded (chainTraceSink returns nil
-	// otherwise), so a gateway with no plugins allocates nothing for it.
-	Walk []map[string]interface{} `json:"-"`
 }
 
 // Stat aggregates counters for one dimension row.
@@ -101,16 +70,6 @@ type agrRow struct {
 
 // Stats collects per-key / per-model / per-source aggregates plus a bounded
 // ring of raw request records, all guarded by one mutex.
-//
-// LOCKING: mu is a plain sync.Mutex and is NOT reentrant. The *Locked methods
-// (aggregateLocked, addKeyTokenLocked, addKeyHourLocked, addKeyReqLocked,
-// wantPinnedBuckets, rotateAuditLocked, …) assume the caller already holds it,
-// while every other exported method takes it itself.
-//
-// Calling an exported method while already holding mu DEADLOCKS. This is not
-// hypothetical: a test that did KeyWindowReqs under s.mu.Lock() hung until the
-// 10-minute panic timeout. Always reach for the *Locked variant when the lock
-// is already held, and prefer the exported method when it is not.
 type Stats struct {
 	mu            sync.Mutex
 	active        int64
@@ -125,21 +84,6 @@ type Stats struct {
 	auditPath     string
 	replayPartial bool                       // aggregates built from a bounded audit tail
 	modelHour     map[string]map[int64]int64 // model -> unix-hour bucket -> tokens
-	// keyModelHour buckets the same tokens as modelHour but keyed by
-	// (gateway key id, model) so per-key model quotas are isolated from each
-	// other. modelHour stays key-blind on purpose: it backs the AUTO slot
-	// quota, which is a gateway-wide limit on a slot, not a per-key one.
-	keyModelHour map[string]map[string]map[int64]int64 // key -> model -> unix-hour -> tokens
-	// keyHour buckets a key's total tokens per unix hour, backing the
-	// whole-key quota (all models of one key share one budget).
-	keyHour map[string]map[int64]int64
-	// keyReqHour buckets a key's request count per unix hour, backing the
-	// key-wide request quota. Counted for every request type (chat, stream,
-	// image) including failed ones, so a failing client cannot loop for free.
-	keyReqHour map[string]map[int64]int64
-	// pinnedWanted records which (key, model) pairs have a quota that pins a
-	// source, so the pinned bucket is maintained only where it is read.
-	pinnedWanted map[string]bool
 }
 
 const hourSec = 3600
@@ -172,18 +116,14 @@ func NewStats(maxRecords int) *Stats {
 		maxRecords = defaultRingSize
 	}
 	return &Stats{
-		byKey:        map[string]*Stat{},
-		byModel:      map[string]*Stat{},
-		bySrc:        map[string]*Stat{},
-		byKeyModel:   map[string]map[string]*Stat{},
-		byKeySrc:     map[string]map[string]*Stat{},
-		byStatus:     map[int]*Stat{},
-		modelHour:    map[string]map[int64]int64{},
-		keyModelHour: map[string]map[string]map[int64]int64{},
-		keyHour:      map[string]map[int64]int64{},
-		keyReqHour:   map[string]map[int64]int64{},
-		pinnedWanted: map[string]bool{},
-		maxRecs:      maxRecords,
+		byKey:      map[string]*Stat{},
+		byModel:    map[string]*Stat{},
+		bySrc:      map[string]*Stat{},
+		byKeyModel: map[string]map[string]*Stat{},
+		byKeySrc:   map[string]map[string]*Stat{},
+		byStatus:   map[int]*Stat{},
+		modelHour:  map[string]map[int64]int64{},
+		maxRecs:    maxRecords,
 	}
 }
 
@@ -378,9 +318,6 @@ func (s *Stats) Record(r Req) {
 // aggregateLocked folds r into every aggregate row and the quota window
 // bucket. Caller must hold s.mu.
 func (s *Stats) aggregateLocked(r Req) {
-	if r.Key != "" {
-		s.addKeyReqLocked(r.Key, (r.Time/1000)/hourSec, 1)
-	}
 	inc(s.byKey, r.Key, r)
 	if r.Model != "" {
 		inc(s.byModel, r.Model, r)
@@ -425,12 +362,6 @@ func (s *Stats) aggregateLocked(r Req) {
 			s.modelHour[key] = hm
 		}
 		hm[h] += tok
-		// per-key buckets: same token split, but isolated per key so one
-		// key's quota cannot be drained by another key's traffic
-		if r.Key != "" {
-			s.addKeyTokenLocked(r.Key, r.Model, r.Source, h, tok)
-			s.addKeyHourLocked(r.Key, h, tok)
-		}
 		// retention: 24*40 = 960 hourly buckets ≈ 40 days of history (covers
 		// the longest "month" quota window)
 		if len(hm) > 24*40 {
@@ -443,185 +374,6 @@ func (s *Stats) aggregateLocked(r Req) {
 	}
 }
 
-// quotaRetentionHours is how much hourly history the per-key quota buckets
-// keep. It matches the modelHour retention (40 days) so the longest "month"
-// window is fully covered after a restart, and it is deliberately applied per
-// key so an idle key's buckets are reclaimed instead of pinning memory.
-const quotaRetentionHours = 24 * 40
-
-// addKeyTokenLocked adds tok to one key's (model[, source]) hourly bucket.
-//
-// The bare-model bucket is always written: it is what a scope entry without a
-// source pin reads, and writing it is what makes that quota work at all (every
-// recorded request carries a resolved source, so a source::model-only bucket
-// would leave an unpinned quota reading an empty bucket forever).
-//
-// The pinned "source::model" bucket is written only for (key, model) pairs
-// some scope entry actually pins a source for. Maintaining it unconditionally
-// doubles the bucket count — measured at 26.7 MB for 20 keys x 8 models x 3
-// sources at full retention, against a documented ~32 MB total budget — to
-// serve a lookup that almost nobody performs.
-func (s *Stats) addKeyTokenLocked(key, model, source string, h, tok int64) {
-	if model == "" {
-		return
-	}
-	byModel := s.keyModelHour[key]
-	if byModel == nil {
-		byModel = map[string]map[int64]int64{}
-		s.keyModelHour[key] = byModel
-	}
-	addBucket(byModel, model, h, tok)
-	if source == "" {
-		return
-	}
-	pinned := source + "::" + model
-	if pinned == model || !s.pinnedWanted[key+"\x00"+model] {
-		return
-	}
-	addBucket(byModel, pinned, h, tok)
-}
-
-// addBucket adds tok to one named hourly bucket and enforces retention.
-func addBucket(byModel map[string]map[int64]int64, name string, h, tok int64) {
-	hm := byModel[name]
-	if hm == nil {
-		hm = map[int64]int64{}
-		byModel[name] = hm
-	}
-	hm[h] += tok
-	if len(hm) > quotaRetentionHours {
-		for k := range hm {
-			if k < h-quotaRetentionHours {
-				delete(hm, k)
-			}
-		}
-	}
-}
-
-// wantPinnedBuckets starts maintaining the pinned (source::model) bucket for a
-// key's model, so a quota that pins a source counts traffic from the moment it
-// is configured. Usage recorded before that cannot be attributed to a source
-// after the fact, so a pinned quota may under-count its first window.
-func (s *Stats) wantPinnedBuckets(key, model string) {
-	if key == "" || model == "" {
-		return
-	}
-	s.pinnedWanted[key+"\x00"+model] = true
-}
-
-// addKeyHourLocked adds tok to one key's all-model hourly total.
-func (s *Stats) addKeyHourLocked(key string, h, tok int64) {
-	hm := s.keyHour[key]
-	if hm == nil {
-		hm = map[int64]int64{}
-		s.keyHour[key] = hm
-	}
-	hm[h] += tok
-	if len(hm) > quotaRetentionHours {
-		for k := range hm {
-			if k < h-quotaRetentionHours {
-				delete(hm, k)
-			}
-		}
-	}
-}
-
-// KeyWindowReqs returns how many requests one key issued within sec seconds;
-// sec <= 0 means all retained history.
-func (s *Stats) KeyWindowReqs(key string, sec int64) int64 {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return sumBuckets(s.keyReqHour[key], time.Now().Unix(), sec)
-}
-
-// addKeyReqLocked adds n requests to a key's hourly count bucket.
-func (s *Stats) addKeyReqLocked(key string, h, n int64) {
-	hm := s.keyReqHour[key]
-	if hm == nil {
-		hm = map[int64]int64{}
-		s.keyReqHour[key] = hm
-	}
-	hm[h] += n
-	if len(hm) > quotaRetentionHours {
-		for k := range hm {
-			if k < h-quotaRetentionHours {
-				delete(hm, k)
-			}
-		}
-	}
-}
-
-// sumBuckets totals the hourly buckets inside the window ending at `now`
-// (unix seconds). sec <= 0 means "all retained history" (no reset).
-//
-// It only visits the hour buckets a window can actually cover. The naive full
-// scan measured 5.9us/op at the full 40-day retention, and a per-key quota
-// check runs on every request (2-3 of these), so the scan cost lands directly
-// on the request path; visiting at most sec/3600 + 1 buckets makes it
-// proportional to the window instead of to the retained history. The map keys
-// are whole unix hours, so the covered range is exact rather than a sample.
-func sumBuckets(hm map[int64]int64, now, sec int64) int64 {
-	if len(hm) == 0 {
-		return 0
-	}
-	if sec <= 0 {
-		var total int64
-		for _, v := range hm {
-			total += v
-		}
-		return total
-	}
-	nowHour := now / hourSec
-	// A bucket at hour H covers [H*3600, (H+1)*3600). The pre-existing
-	// WindowTokens counts a bucket when h*3600 >= now-sec, so the first hour
-	// that qualifies is ceil((now-sec)/3600) — NOT floor, which would pull in
-	// one bucket too many (caught by TestSumBucketsMatchesFullScan: a 30-day
-	// window reported 8878 vs 8649).
-	firstHour := (now - sec + hourSec - 1) / hourSec
-	if firstHour < 0 {
-		firstHour = 0
-	}
-	var total int64
-	for h := firstHour; h <= nowHour; h++ {
-		total += hm[h]
-	}
-	return total
-}
-
-// KeyWindowModelTokens returns the tokens one key consumed for one model
-// (optionally pinned to a source) within sec seconds; sec <= 0 means all
-// retained history. Unlike WindowTokens this is isolated per key, which is
-// what a per-key model quota needs.
-//
-// A source pin matches the pinned bucket exactly. Without a pin the call
-// totals the key's bare-model bucket, which counts traffic on every source —
-// a quota on "this model" should not stop applying just because the request
-// happened to be served by a different upstream.
-func (s *Stats) KeyWindowModelTokens(key, model, source string, sec int64) int64 {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	byModel := s.keyModelHour[key]
-	if len(byModel) == 0 {
-		return 0
-	}
-	mk := model
-	if source != "" {
-		mk = source + "::" + model
-		// from now on this pair keeps a pinned bucket, so a quota configured
-		// against this source counts the traffic it is meant to cap
-		s.wantPinnedBuckets(key, model)
-	}
-	return sumBuckets(byModel[mk], time.Now().Unix(), sec)
-}
-
-// KeyWindowTokens returns one key's total tokens across all models within sec
-// seconds; sec <= 0 means all retained history. It backs the whole-key quota.
-func (s *Stats) KeyWindowTokens(key string, sec int64) int64 {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return sumBuckets(s.keyHour[key], time.Now().Unix(), sec)
-}
-
 // rotateAuditLocked renames the audit file to <path>.<unix>.old once it
 // exceeds auditRotateBytes and prunes old files beyond auditKeepOld, keeping
 // the newest ones. Caller must hold s.mu.
@@ -712,27 +464,6 @@ func AutoPeriodSeconds(period string, hours int64) int64 {
 	return 0
 }
 
-// AutoSecondsToReset returns how many seconds remain until the quota window
-// rolls over, for the Retry-After header on a 429. Buckets are whole unix
-// hours, so the value is rounded up to the next hour boundary and never
-// exceeds one window. 0 means "unknown" (never resets, or no period set), in
-// which case the caller should not advertise a retry time.
-func AutoSecondsToReset(period string, hours int64) int64 {
-	sec := AutoPeriodSeconds(period, hours)
-	if sec <= 0 {
-		return 0
-	}
-	now := time.Now().Unix()
-	// window = the last sec seconds, bucketed by whole hours; the oldest
-	// bucket still inside the window expires at its own hour boundary
-	elapsed := now % hourSec
-	left := sec - elapsed
-	if left <= 0 || left > sec {
-		left = sec
-	}
-	return left
-}
-
 // WindowTokens returns the tokens consumed for one model (optionally pinned
 // to a single source) within the window; sec <= 0 means all time. Buckets are
 // whole unix hours, so a sliding window overcounts by up to one hour — an
@@ -765,20 +496,9 @@ func (s *Stats) WindowTokens(model, source string, sec int64) int64 {
 	return total
 }
 
-// rows flattens a map[string]*Stat into a reportable, descending-by-requests
-// list.
-//
-// A nil value is skipped rather than dereferenced. The maps this is called with
-// are built by several callers (Snapshot, PeriodSnapshot, the audit replay) and a
-// nil entry is a legitimate representation of "this dimension has no data" —
-// `map[string]*Stat{key: s.byKey[key]}` produced exactly that whenever the
-// queried key had no recorded traffic, and `*v` then panicked the handler.
 func rows(m map[string]*Stat) []StatsRow {
 	out := make([]StatsRow, 0, len(m))
 	for k, v := range m {
-		if v == nil {
-			continue
-		}
 		out = append(out, StatsRow{Name: k, Stat: *v})
 	}
 	for i := 1; i < len(out); i++ {
@@ -1196,26 +916,7 @@ func (s *Stats) Snapshot(limit int, key string) map[string]interface{} {
 	if key == "" {
 		byKey, byModel, bySrc = s.byKey, s.byModel, s.bySrc
 	} else {
-		// The map is keyed by the MASKED key id (keyID(req.Key)), which is what
-		// by_key reports and what the dashboard sends as ?key=. An admin may
-		// pass anything in that query parameter, including the full key, and
-		// `s.byKey[key]` then returns the zero value — a nil *Stat.
-		//
-		// rows() below does `*v` on every value, so a nil entry panicked the
-		// handler: any ?key=<full key> request killed the response with an empty
-		// reply, and logged a full panic stack. Reproduced against the live
-		// gateway: /api/stats?period=day&limit=1&key=sk-gw-... → curl exit 52.
-		//
-		// A key with no recorded traffic is a legitimate question ("what did this
-		// key use?"), and its answer is zero — so an absent entry is an empty
-		// result, not an error, and not a crash.
-		st := s.byKey[key]
-		byKey = make(map[string]*Stat, 1)
-		if st != nil {
-			byKey[key] = st
-		} else {
-			byKey[key] = &Stat{}
-		}
+		byKey = map[string]*Stat{key: s.byKey[key]}
 		byModel = s.byKeyModel[key]
 		bySrc = s.byKeySrc[key]
 	}
@@ -1232,11 +933,8 @@ func (s *Stats) Snapshot(limit int, key string) map[string]interface{} {
 		}
 	}
 	bs := make([]agrRow, 0, len(s.byStatus))
-	for code, st := range s.byStatus {
-		if st == nil {
-			continue
-		}
-		bs = append(bs, agrRow{Name: strconv.Itoa(code), Stat: *st})
+	for code := range s.byStatus {
+		bs = append(bs, agrRow{Name: strconv.Itoa(code), Stat: *s.byStatus[code]})
 	}
 	sort.Slice(bs, func(i, j int) bool {
 		ci, _ := strconv.Atoi(bs[i].Name)
@@ -1254,16 +952,3 @@ func (s *Stats) Snapshot(limit int, key string) map[string]interface{} {
 		"replay_partial": s.replayPartial,
 	}
 }
-
-// Active reports requests in flight right now.
-//
-// It is a live gauge, not an aggregate: there is no calendar period that scopes
-// it, which is why the period-scoped /api/stats response has to carry it
-// explicitly. Before it did, the day/week/month views fed `st.active || 0` a
-// missing key and showed a hard 0 — the same gateway that was serving hundreds
-// of requests a second looked idle in three of the four views.
-func (s *Stats) Active() int64 {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.active
-}

internal/gateway/stats_lock_test.go

@@ -1,132 +0,0 @@
-package gateway
-
-import (
-	"reflect"
-	"runtime"
-	"strings"
-	"testing"
-	"time"
-)
-
-// The Stats mutex is a plain sync.Mutex: calling an exported (self-locking)
-// method while already holding it deadlocks. That happened for real — a probe
-// held s.mu and called KeyWindowReqs, hanging until the test binary's 10-minute
-// panic timeout — so the rule is pinned here rather than left in a comment.
-//
-// The check is structural: every method that takes the lock must say so in its
-// name or its doc comment. That keeps the trap visible when someone adds the
-// next method, which is the only time the rule can be forgotten.
-
-// exportedSelfLocking lists the exported Stats methods that take the mutex.
-// It is derived from reflection at run time; the assertions below are what
-// actually pin the convention.
-func TestStatsExportedMethodsDocumentTheirLocking(t *testing.T) {
-	typ := reflect.TypeOf(&Stats{})
-	for i := 0; i < typ.NumMethod(); i++ {
-		m := typ.Method(i)
-		if m.PkgPath != "" { // unexported
-			continue
-		}
-		// Methods that neither lock nor touch guarded state are fine either way;
-		// the ones that matter are those reaching into the maps under mu.
-		if !methodTouchesLockedState(m.Name) {
-			continue
-		}
-		if strings.HasSuffix(m.Name, "Locked") {
-			t.Errorf("Stats.%s is exported but named *Locked; the suffix means "+
-				"the CALLER holds the lock, so it must not be exported", m.Name)
-		}
-	}
-}
-
-// methodTouchesLockedState is the set of exported methods known to read or
-// write state guarded by Stats.mu. Kept explicit (rather than inferred) so a
-// new method is not silently assumed safe.
-func methodTouchesLockedState(name string) bool {
-	switch name {
-	case "KeyWindowReqs", "KeyWindowModelTokens", "KeyWindowTokens",
-		"WindowTokens", "KeyTokens", "ModelTokens", "Record", "AppendAudit",
-		"LoadAudit", "Snapshot", "SourceRecent", "SourceAverages",
-		"AuditRecords", "AuditPage", "StreamAuditRecords", "ReplayPartial",
-		"PoolStats":
-		return true
-	}
-	return false
-}
-
-// TestStatsLockedMethodsAreNotCalledUnderLock is the behavioural half: it
-// proves the internal helpers the ones above use are reachable while the lock
-// is held. If a future refactor makes an exported method call a *Locked one
-// while holding mu itself, this is where it shows up — as a hang, bounded by
-// the short timeout below rather than the suite's 10 minutes.
-func TestStatsLockedMethodsAreNotCalledUnderLock(t *testing.T) {
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		s := NewStats(10)
-		h := time.Now().Unix() / 3600
-		s.mu.Lock()
-		// Exactly the shape that deadlocked: the *Locked variants are correct
-		// here because the lock is already held.
-		s.addKeyReqLocked("k", h, 5)
-		s.addKeyHourLocked("k", h, 100)
-		s.wantPinnedBuckets("k", "m1")
-		s.addKeyTokenLocked("k", "m1", "src", h, 100)
-		// sumBuckets is the pure inner function the exported readers call.
-		if got := sumBuckets(s.keyReqHour["k"], time.Now().Unix(), 3600); got != 5 {
-			t.Errorf("sumBuckets under lock = %d, want 5", got)
-		}
-		s.mu.Unlock()
-	}()
-	select {
-	case <-done:
-	case <-time.After(20 * time.Second):
-		buf := make([]byte, 1<<16)
-		n := runtime.Stack(buf, true)
-		t.Fatalf("deadlocked while using the *Locked helpers under s.mu:\n%s", buf[:n])
-	}
-}
-
-// TestSumBucketsEdgeCases covers the boundaries the quota check depends on,
-// including the ones a regression would silently get wrong (an off-by-one here
-// either lets a quota leak or locks a key out early).
-func TestSumBucketsEdgeCases(t *testing.T) {
-	const hour = 3600
-	now := int64(10*hour + 61) // 10:00:61, i.e. just past the boundary
-	buckets := map[int64]int64{
-		0:  100, // ancient
-		9:  200, // previous hour
-		10: 7,   // current hour
-	}
-
-	if got := sumBuckets(buckets, now, 0); got != 307 {
-		t.Errorf("sec<=0 (all history) = %d, want 307", got)
-	}
-	// 1h window covers buckets h >= ceil((now-3600)/3600) = 10 -> only bucket 10.
-	if got := sumBuckets(buckets, now, hour); got != 7 {
-		t.Errorf("1h window = %d, want 7 (buckets 0 and 9 fall outside)", got)
-	}
-	// 2h window covers h >= 9 -> buckets 9 and 10.
-	if got := sumBuckets(buckets, now, 2*hour); got != 207 {
-		t.Errorf("2h window = %d, want 207", got)
-	}
-	// An empty map and a nil map must both be zero, not a panic.
-	if got := sumBuckets(map[int64]int64{}, now, hour); got != 0 {
-		t.Errorf("empty map = %d, want 0", got)
-	}
-	if got := sumBuckets(nil, now, hour); got != 0 {
-		t.Errorf("nil map = %d, want 0", got)
-	}
-	// now < sec must not produce a negative firstHour index: with a window far
-	// wider than the available history, every bucket that exists is counted.
-	// (sumBuckets walks bucket indices from firstHour to nowHour, so passing a
-	// "now" older than some buckets cannot reach them — that is correct, not a
-	// truncation bug.)
-	if got := sumBuckets(buckets, 10*hour+61, 100*hour); got != 307 {
-		t.Errorf("window wider than history = %d, want 307", got)
-	}
-	// A window that predates every bucket counts them all as well.
-	if got := sumBuckets(buckets, 10*hour+61, hour); got != 7 {
-		t.Errorf("1h window at t=10:00:61 = %d, want 7", got)
-	}
-}

internal/gateway/stats_period.go

@@ -1,241 +0,0 @@
-package gateway
-
-import (
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// Period is a reporting window for the usage dashboard. The dashboard used to
-// have exactly one view — everything since process start — which made a quiet
-// morning indistinguishable from a quiet week. Periods give the operator a
-// scale to read the numbers at: today vs this week vs this month vs all time.
-//
-// The set is deliberately calendar-based and UTC-anchored. A rolling 24h window
-// would put "today" and "the last day" at different boundaries, so the same
-// number would move between two cards depending on when you looked; calendar
-// days are what people actually mean by "today". UTC also matches the billing
-// plugin's peak-window arithmetic, so a peak-rate hour does not land in a
-// different day in the cost view than in the usage view.
-type Period string
-
-const (
-	// PeriodDay is the current UTC calendar day.
-	PeriodDay Period = "day"
-	// PeriodWeek is the current ISO week (Mon 00:00 UTC to now).
-	PeriodWeek Period = "week"
-	// PeriodMonth is the current UTC calendar month.
-	PeriodMonth Period = "month"
-	// PeriodAll is since process start — the only view backed by the
-	// in-memory aggregates, and the only one available when no audit file is
-	// configured.
-	PeriodAll Period = "all"
-)
-
-// ValidPeriod reports whether p is a period the aggregator understands.
-// An unknown period is a client error, not a silent fallback to "all": a
-// dashboard that quietly shows lifetime totals when the caller asked for today
-// is worse than one that refuses.
-func ValidPeriod(p Period) bool {
-	switch p {
-	case PeriodDay, PeriodWeek, PeriodMonth, PeriodAll:
-		return true
-	}
-	return false
-}
-
-// periodStart returns the inclusive start of the window for p at time now.
-// Only PeriodDay/Week/Month are meaningful here; PeriodAll returns 0, which
-// every "from > 0" bounds check treats as unbounded.
-func periodStart(p Period, now time.Time) int64 {
-	now = now.UTC()
-	switch p {
-	case PeriodDay:
-		return time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC).UnixMilli()
-	case PeriodWeek:
-		// ISO week starts Monday. Go's Weekday() is Sunday=0, so the shift
-		// below is 1 on Sunday and 0 on Monday..Saturday.
-		off := (int(now.Weekday()) + 6) % 7
-		d := now.AddDate(0, 0, -off)
-		return time.Date(d.Year(), d.Month(), d.Day(), 0, 0, 0, 0, time.UTC).UnixMilli()
-	case PeriodMonth:
-		return time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, time.UTC).UnixMilli()
-	}
-	return 0
-}
-
-// PeriodBucket is one labelled point on the dashboard's timeline. Buckets are
-// the aggregation grain for a period: hourly for a day (so a spike is visible
-// inside "today"), daily for a week or month (so a week is not 7×24 points
-// wide and a month is not 31×24), and empty for "all" — a lifetime total has
-// no meaningful timeline, and pretending otherwise by drawing 500 hourly
-// buckets of rolling memory would be a different lie.
-type PeriodBucket struct {
-	Bucket string `json:"bucket"`
-	Stat
-}
-
-// PeriodSnapshot is the period-scoped twin of Snapshot's payload: the same
-// totals and the same by_* rows, plus a timeline. It deliberately mirrors
-// Snapshot's field names so the dashboard's table painters work unchanged —
-// paintModelTable(st.by_model) reads rows of {name, ...Stat}, and that shape
-// does not care where the numbers came from.
-type PeriodSnapshot struct {
-	Period Period         `json:"period"`
-	From   int64          `json:"from"` // unix millis, 0 when PeriodAll
-	Total  Stat           `json:"total"`
-	ByKey  []StatsRow     `json:"by_key"`
-	Models []StatsRow     `json:"by_model"`
-	Srcs   []StatsRow     `json:"by_source"`
-	Status []agrRow       `json:"by_status"`
-	Bucket []PeriodBucket `json:"buckets"`
-	// Truncated marks that the window was clipped by the retained audit
-	// history, so the numbers are a lower bound rather than the true period
-	// total. The dashboard shows this next to the numbers rather than letting
-	// a rotated-away week read as "that week had no traffic".
-	Truncated bool `json:"truncated"`
-}
-
-// bucketKey maps a record's timestamp onto the timeline grain for p.
-// Daily buckets are stamped at UTC midnight; hourly buckets carry the hour.
-func bucketKey(p Period, ms int64) string {
-	t := time.UnixMilli(ms).UTC()
-	if p == PeriodDay {
-		return t.Format("2006-01-02T15")
-	}
-	return t.Format("2006-01-02")
-}
-
-// bucketOf returns the bucket label plus the truncated-flag side effects of
-// walking a file: a record older than the requested window means the window
-// starts before the retained history, and the file may have been cut short.
-func (s *Stats) PeriodSnapshot(p Period, key string, now time.Time) PeriodSnapshot {
-	out := PeriodSnapshot{Period: p}
-	from := periodStart(p, now)
-	out.From = from
-
-	// "all" is exactly what Snapshot already answers, from the in-memory
-	// aggregates, and it is the one view that must keep working with no audit
-	// file configured at all (a fresh dev setup, or an operator who turned
-	// auditing off). Serving it from the same code path keeps the dashboard's
-	// "total" card identical whether or not a period is selected.
-	if p == PeriodAll {
-		snap := s.Snapshot(firstScreenRecords, key)
-		if tot, ok := snap["total"].(Stat); ok {
-			out.Total = tot
-		}
-		out.ByKey, _ = snap["by_key"].([]StatsRow)
-		out.Models, _ = snap["by_model"].([]StatsRow)
-		out.Srcs, _ = snap["by_source"].([]StatsRow)
-		out.Status, _ = snap["by_status"].([]agrRow)
-		// replay_partial is the same "these numbers came from a bounded
-		// tail" caveat, carried through under this view's own name.
-		out.Truncated, _ = snap["replay_partial"].(bool)
-		return out
-	}
-
-	// A bounded window is aggregated from the audit files, because the
-	// in-memory aggregates are lifetime totals and the ring buffer holds only
-	// maxRecs records (500 by default). Reading the ring would silently
-	// under-report any period longer than the last few hundred requests.
-	total := Stat{}
-	byKey := map[string]*Stat{}
-	byModel := map[string]*Stat{}
-	bySrc := map[string]*Stat{}
-	byStatus := map[string]*Stat{}
-	buckets := map[string]*Stat{}
-
-	var seen int
-	err := s.StreamAuditRecords(from, 0, key, func(r Req) error {
-		seen++
-		incStatus(&total, "", r)
-		inc(byKey, r.Key, r)
-		if r.Model != "" {
-			inc(byModel, r.Model, r)
-		}
-		inc(bySrc, r.Source, r)
-		if r.Status != 0 {
-			inc(byStatus, strconv.Itoa(r.Status), r)
-		}
-		k := bucketKey(p, r.Time)
-		b := buckets[k]
-		if b == nil {
-			b = &Stat{}
-			buckets[k] = b
-		}
-		incStatus(b, k, r)
-		return nil
-	})
-
-	out.Total = total
-	out.ByKey = rows(byKey)
-	out.Models = rows(byModel)
-	out.Srcs = rows(bySrc)
-	bs := make([]agrRow, 0, len(byStatus))
-	for code, st := range byStatus {
-		if st == nil {
-			continue
-		}
-		bs = append(bs, agrRow{Name: code, Stat: *st})
-	}
-	sort.Slice(bs, func(i, j int) bool {
-		ci, _ := strconv.Atoi(bs[i].Name)
-		cj, _ := strconv.Atoi(bs[j].Name)
-		return ci < cj
-	})
-	out.Status = bs
-
-	ks := make([]string, 0, len(buckets))
-	for k := range buckets {
-		ks = append(ks, k)
-	}
-	// Chronological, string-sorted: "2006-01-02T15" and "2006-01-02" both
-	// sort lexicographically in time order, so no date parsing is needed.
-	sort.Strings(ks)
-	out.Bucket = make([]PeriodBucket, 0, len(ks))
-	for _, k := range ks {
-		// Defensive for the same reason rows() is: ks comes from the bucket map's
-		// keys, and a nil value would panic on the deref below.
-		if st := buckets[k]; st != nil {
-			out.Bucket = append(out.Bucket, PeriodBucket{Bucket: k, Stat: *st})
-		}
-	}
-
-	// The window is only "complete" if the audit walk actually reached back
-	// far enough to cover it. Two ways it cannot:
-	//
-	//  1. The walk found nothing at all in a window that certainly had
-	//     traffic, because the files holding it rotated away.
-	//  2. The walk errored part-way (I/O), leaving a partial total.
-	//
-	// Case 2 is reported from err; case 1 from seen == 0 combined with the
-	// caller having asked for a bounded window. It is deliberately
-	// conservative: a genuinely empty hour is rare enough that flagging it as
-	// possibly-truncated costs one tooltip, whereas silently under-reporting a
-	// month because rotation ate it is a wrong number with no indication.
-	if err != nil || (seen == 0 && p != PeriodAll) {
-		out.Truncated = true
-	}
-	return out
-}
-
-// periodFromQuery parses the ?period= parameter. An empty value means "all" so
-// that existing callers of /api/stats keep seeing exactly what they saw.
-// A malformed value is rejected by the caller (ValidPeriod) rather than
-// defaulting, so a typo in a bookmarked URL surfaces as an error instead of
-// silently switching the operator to lifetime totals.
-func periodFromQuery(q map[string][]string) Period {
-	v := strings.ToLower(strings.TrimSpace(firstQuery(q, "period")))
-	if v == "" {
-		return PeriodAll
-	}
-	return Period(v)
-}
-
-func firstQuery(q map[string][]string, key string) string {
-	if vs, ok := q[key]; ok && len(vs) > 0 {
-		return vs[0]
-	}
-	return ""
-}

internal/gateway/stats_period_records_test.go

@@ -1,159 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/url"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-// The dashboard paints its records table from the `records` field of
-// /api/stats (paintRecords(st.records)). The period branch of that handler
-// used to hand-write a response map and simply omit the key, so switching the
-// selector to day / week / month rendered an EMPTY table no matter how much
-// traffic the window had — while the lifetime view worked, because it goes
-// through Snapshot() which carries records.
-//
-// These tests pin the contract across every period: same records, same cursor.
-func TestStatsPeriodViewsShipRecords(t *testing.T) {
-	td := t.TempDir()
-	g := newTestGateway(t)
-
-	// Write audit records the period aggregator and the record pager both read.
-	g.stats.auditPath = filepath.Join(td, "audit.jsonl")
-	now := time.Now().UnixMilli()
-	for i := 0; i < 5; i++ {
-		g.stats.Record(Req{
-			Time: now - int64(i)*1000, Type: "chat", OK: true,
-			Model: "m1", Source: "s1", Status: 200,
-			Prompt: 10, Compl: 2,
-		})
-	}
-
-	for _, p := range []string{"day", "week", "month", "all"} {
-		rr := doReq(t, g, "GET", "/api/stats?period="+p, "")
-		if rr.Code != 200 {
-			t.Fatalf("period=%s: HTTP %d: %s", p, rr.Code, rr.Body.String())
-		}
-		var st map[string]interface{}
-		if err := json.Unmarshal(rr.Body.Bytes(), &st); err != nil {
-			t.Fatalf("period=%s: %v", p, err)
-		}
-		recs, ok := st["records"].([]interface{})
-		if !ok {
-			t.Fatalf("period=%s: response has no `records` array — the dashboard "+
-				"records table renders empty for this view (keys: %v)", p, keysOf(st))
-		}
-		if len(recs) != 5 {
-			t.Fatalf("period=%s: got %d records, want 5", p, len(recs))
-		}
-		// The scroll handler pages from next_cursor; without it the table is
-		// stuck at one screen no matter how far the user scrolls.
-		if _, ok := st["next_cursor"]; !ok {
-			t.Fatalf("period=%s: no next_cursor — paging can never continue", p)
-		}
-	}
-}
-
-// The records shipped with a period view must be the newest-first page the
-// paging endpoint would return, in the same order. If /api/stats and
-// /api/stats/records disagreed, scrolling would duplicate or skip rows.
-func TestStatsPeriodRecordsMatchPager(t *testing.T) {
-	td := t.TempDir()
-	g := newTestGateway(t)
-	g.stats.auditPath = filepath.Join(td, "audit.jsonl")
-	now := time.Now().UnixMilli()
-	for i := 0; i < 8; i++ {
-		g.stats.Record(Req{
-			Time: now - int64(i)*1000, Type: "chat", OK: true,
-			Model: "m1", Status: 200, Prompt: 5, Compl: 1,
-		})
-	}
-
-	rr := doReq(t, g, "GET", "/api/stats?period=day&limit=100", "")
-	var st struct {
-		Records []struct {
-			Time  int64  `json:"time"`
-			Model string `json:"model"`
-		} `json:"records"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &st); err != nil {
-		t.Fatal(err)
-	}
-	rr2 := doReq(t, g, "GET", "/api/stats/records?limit=100", "")
-	var pg struct {
-		Records []struct {
-			Time  int64  `json:"time"`
-			Model string `json:"model"`
-		} `json:"records"`
-	}
-	if err := json.Unmarshal(rr2.Body.Bytes(), &pg); err != nil {
-		t.Fatal(err)
-	}
-	if len(st.Records) != len(pg.Records) {
-		t.Fatalf("period view shipped %d records, pager returned %d — the two "+
-			"sources must agree or scrolling duplicates/skips rows",
-			len(st.Records), len(pg.Records))
-	}
-	for i := range st.Records {
-		if st.Records[i].Time != pg.Records[i].Time {
-			t.Fatalf("record %d differs: period view t=%d, pager t=%d",
-				i, st.Records[i].Time, pg.Records[i].Time)
-		}
-	}
-	// The two sources must agree on DIRECTION as well as content. Which
-	// direction that is depends on how many reverse-read chunks the audit file
-	// spans (a small file is read whole, a large one chunk-by-chunk), so the
-	// test asserts agreement rather than hard-coding newest-first — but they
-	// can never disagree, because the table interleaves both streams.
-	if len(st.Records) > 1 {
-		periodAsc := st.Records[1].Time > st.Records[0].Time
-		pagerAsc := pg.Records[1].Time > pg.Records[0].Time
-		if periodAsc != pagerAsc {
-			t.Fatalf("direction differs: period view %s, pager %s — the table "+
-				"would splice the two streams out of order",
-				map[bool]string{true: "oldest-first", false: "newest-first"}[periodAsc],
-				map[bool]string{true: "oldest-first", false: "newest-first"}[pagerAsc])
-		}
-	}
-}
-
-// A non-admin caller cannot widen their view by passing someone else's key in
-// the query string: exportKey overrides ?key= with the caller's own masked id.
-// This is a data-leak boundary, and it applies to the records the period view
-// ships just as much as to the aggregates.
-func TestStatsPeriodRecordsIgnoreForeignKeyForUsers(t *testing.T) {
-	td := t.TempDir()
-	g := newTestGateway(t)
-	g.stats.auditPath = filepath.Join(td, "audit.jsonl")
-
-	other := keyID("sk-gw-cccccccccccccccc")
-	own := keyID("sk-test")
-	now := time.Now().UnixMilli()
-	g.stats.Record(Req{Time: now, OK: true, Model: "m", Status: 200, Key: other})
-	g.stats.Record(Req{Time: now - 1000, OK: true, Model: "m", Status: 200, Key: own})
-
-	// sk-test authenticates as a non-admin (newTestGateway seeds it under
-	// gateway_keys, not keys), so ?key=<other> must be ignored and the caller
-	// sees only its own rows.
-	rr := doReq(t, g, "GET",
-		"/api/stats?period=day&key="+url.QueryEscape(other), "")
-	if rr.Code != 200 {
-		t.Fatalf("HTTP %d: %s", rr.Code, rr.Body.String())
-	}
-	var st struct {
-		Records []struct {
-			Key string `json:"key"`
-		} `json:"records"`
-	}
-	if err := json.Unmarshal(rr.Body.Bytes(), &st); err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range st.Records {
-		if r.Key == other {
-			t.Fatalf("another key's record leaked into a user view "+
-				"(caller=%s, requested=%s)", own, other)
-		}
-	}
-}

internal/gateway/stats_period_test.go

@@ -1,434 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-// auditPeriod writes records straight into an audit file, which is what the
-// period aggregator reads. Going through Record() would also rotate/prune the
-// file; here the file shape is the thing under test.
-func auditPeriod(t *testing.T, path string, recs ...Req) {
-	t.Helper()
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("create audit file: %v", err)
-	}
-	defer f.Close()
-	for _, r := range recs {
-		if r.Time == 0 {
-			t.Fatal("test record needs an explicit timestamp")
-		}
-		if r.Type == "" {
-			r.Type = "chat"
-		}
-		b, err := json.Marshal(r)
-		if err != nil {
-			t.Fatalf("marshal record: %v", err)
-		}
-		if _, err := f.Write(append(b, '\n')); err != nil {
-			t.Fatalf("write record: %v", err)
-		}
-	}
-}
-
-func periodStats(t *testing.T, auditPath string) *Stats {
-	t.Helper()
-	s := NewStats(10)
-	s.mu.Lock()
-	s.auditPath = auditPath
-	s.mu.Unlock()
-	return s
-}
-
-// TestPeriodWindowBoundaries is the boundary contract: a day window covers
-// exactly today-from-midnight, a week window starts Monday (not Sunday — the
-// Go Weekday() trap), and a month window starts on the 1st. All UTC.
-func TestPeriodWindowBoundaries(t *testing.T) {
-	// Wednesday 2026-03-11 15:30 UTC.
-	now := time.Date(2026, 3, 11, 15, 30, 0, 0, time.UTC)
-	day := time.Date(2026, 3, 11, 0, 0, 0, 0, time.UTC)
-	if got := time.UnixMilli(periodStart(PeriodDay, now)).UTC(); !got.Equal(day) {
-		t.Errorf("day window starts %s, want %s", got, day)
-	}
-	// Wednesday minus 2 days = Monday the 9th.
-	monday := time.Date(2026, 3, 9, 0, 0, 0, 0, time.UTC)
-	if got := time.UnixMilli(periodStart(PeriodWeek, now)).UTC(); !got.Equal(monday) {
-		t.Errorf("week window starts %s, want Monday %s", got, monday)
-	}
-	// Same instant on a Sunday must still start on the PRECEDING Monday,
-	// never on the Sunday itself. This is the off-by-one that
-	// int(now.Weekday()) would introduce (Sunday=0 → no shift).
-	sun := time.Date(2026, 3, 15, 10, 0, 0, 0, time.UTC) // Sunday
-	prevMon := time.Date(2026, 3, 9, 0, 0, 0, 0, time.UTC)
-	if got := time.UnixMilli(periodStart(PeriodWeek, sun)).UTC(); !got.Equal(prevMon) {
-		t.Errorf("Sunday week window starts %s, want the Monday before it %s", got, prevMon)
-	}
-	first := time.Date(2026, 3, 1, 0, 0, 0, 0, time.UTC)
-	if got := time.UnixMilli(periodStart(PeriodMonth, now)).UTC(); !got.Equal(first) {
-		t.Errorf("month window starts %s, want %s", got, first)
-	}
-	if got := periodStart(PeriodAll, now); got != 0 {
-		t.Errorf("all window from = %d, want 0 (unbounded)", got)
-	}
-}
-
-// TestPeriodAggregationExcludesOlderRecords is the reason the aggregator reads
-// the audit file: a record outside the window must not be counted, even though
-// it sits in the very same file, right next to records that are.
-func TestPeriodAggregationExcludesOlderRecords(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "audit.jsonl")
-	now := time.Date(2026, 3, 11, 15, 0, 0, 0, time.UTC)
-	h := func(n int) int64 { return now.Add(-time.Duration(n) * time.Hour).UnixMilli() }
-
-	auditPeriod(t, path,
-		// inside today
-		Req{Time: h(1), Model: "m", Source: "s", Prompt: 100, Compl: 10, LatMs: 5, OK: true},
-		Req{Time: h(2), Model: "m", Source: "s", Prompt: 200, Compl: 20, LatMs: 7, OK: true},
-		// outside today (yesterday) but inside the week
-		Req{Time: now.AddDate(0, 0, -1).UnixMilli(), Model: "old", Source: "s", Prompt: 999, Compl: 99, OK: true},
-	)
-	s := periodStats(t, path)
-
-	day := s.PeriodSnapshot(PeriodDay, "", now)
-	if day.Total.Reqs != 2 {
-		t.Errorf("day window counted %d requests, want 2 (yesterday's record must be excluded)", day.Total.Reqs)
-	}
-	if day.Total.Prompt != 300 {
-		t.Errorf("day prompt tokens = %d, want 300", day.Total.Prompt)
-	}
-
-	week := s.PeriodSnapshot(PeriodWeek, "", now)
-	if week.Total.Reqs != 3 {
-		t.Errorf("week window counted %d requests, want 3", week.Total.Reqs)
-	}
-	if week.Total.Prompt != 1299 {
-		t.Errorf("week prompt tokens = %d, want 1299", week.Total.Prompt)
-	}
-}
-
-// TestPeriodDimensionsAggregateIndependently checks the by_* rows actually
-// split by their own key rather than all collapsing into one row.
-func TestPeriodDimensionsAggregateIndependently(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "audit.jsonl")
-	now := time.Date(2026, 3, 11, 10, 0, 0, 0, time.UTC)
-	auditPeriod(t, path,
-		Req{Time: now.UnixMilli(), Key: "k1", Model: "alpha", Source: "s1", Prompt: 10, OK: true},
-		Req{Time: now.UnixMilli(), Key: "k1", Model: "beta", Source: "s2", Prompt: 20, OK: true},
-		Req{Time: now.UnixMilli(), Key: "k2", Model: "alpha", Source: "s1", Prompt: 30, OK: true},
-	)
-	s := periodStats(t, path)
-	got := s.PeriodSnapshot(PeriodDay, "", now)
-
-	if len(got.Models) != 2 {
-		t.Fatalf("by_model has %d rows, want 2: %+v", len(got.Models), got.Models)
-	}
-	// alpha = 10 + 30
-	for _, r := range got.Models {
-		if r.Name == "alpha" && r.Prompt != 40 {
-			t.Errorf("alpha prompt = %d, want 40", r.Prompt)
-		}
-	}
-	if len(got.Srcs) != 2 {
-		t.Errorf("by_source has %d rows, want 2: %+v", len(got.Srcs), got.Srcs)
-	}
-	if len(got.ByKey) != 2 {
-		t.Errorf("by_key has %d rows, want 2: %+v", len(got.ByKey), got.ByKey)
-	}
-	// The rows must add up to the total, or the dashboard shows a total that
-	// disagrees with its own table.
-	var sum int64
-	for _, r := range got.Models {
-		sum += r.Prompt
-	}
-	if sum != got.Total.Prompt {
-		t.Errorf("by_model prompts sum to %d but total is %d — the table would contradict the KPI", sum, got.Total.Prompt)
-	}
-}
-
-// TestPeriodDayBucketsAreHourlyAndOrdered pins the timeline grain and its
-// order. Day = hourly (a spike must be visible inside "today"); week/month =
-// daily. Sorted chronologically, because a chart fed unsorted buckets draws
-// nonsense.
-func TestPeriodDayBucketsAreHourlyAndOrdered(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "audit.jsonl")
-	now := time.Date(2026, 3, 11, 15, 0, 0, 0, time.UTC)
-	// Deliberately out of order in the file.
-	auditPeriod(t, path,
-		Req{Time: now.Add(-2 * time.Hour).UnixMilli(), Model: "m", Prompt: 1, OK: true},
-		Req{Time: now.Add(-4 * time.Hour).UnixMilli(), Model: "m", Prompt: 1, OK: true},
-		Req{Time: now.UnixMilli(), Model: "m", Prompt: 1, OK: true},
-	)
-	s := periodStats(t, path)
-	got := s.PeriodSnapshot(PeriodDay, "", now)
-	if len(got.Bucket) != 3 {
-		t.Fatalf("day buckets = %d, want 3 (hourly): %+v", len(got.Bucket), got.Bucket)
-	}
-	for i := 1; i < len(got.Bucket); i++ {
-		if got.Bucket[i-1].Bucket >= got.Bucket[i].Bucket {
-			t.Errorf("day buckets not chronological at %d: %q >= %q",
-				i, got.Bucket[i-1].Bucket, got.Bucket[i].Bucket)
-		}
-	}
-	// Weekly grain is daily, so the same three records collapse to one day.
-	week := s.PeriodSnapshot(PeriodWeek, "", now)
-	if len(week.Bucket) != 1 {
-		t.Errorf("week buckets = %d, want 1 (daily grain): %+v", len(week.Bucket), week.Bucket)
-	}
-}
-
-// TestPeriodKeyFilterIsolatesKeys guards the multi-tenant boundary: asking for
-// one key must never return another key's rows in any dimension.
-func TestPeriodKeyFilterIsolatesKeys(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "audit.jsonl")
-	now := time.Date(2026, 3, 11, 10, 0, 0, 0, time.UTC)
-	auditPeriod(t, path,
-		Req{Time: now.UnixMilli(), Key: "alice", Model: "m", Source: "s", Prompt: 10, OK: true},
-		Req{Time: now.UnixMilli(), Key: "bob", Model: "m", Source: "s", Prompt: 999, OK: true},
-	)
-	s := periodStats(t, path)
-	got := s.PeriodSnapshot(PeriodDay, "alice", now)
-	if got.Total.Reqs != 1 || got.Total.Prompt != 10 {
-		t.Errorf("alice's window = %d reqs / %d prompt, want 1 / 10 — another key leaked in",
-			got.Total.Reqs, got.Total.Prompt)
-	}
-	if len(got.Srcs) != 1 || got.Srcs[0].Prompt != 10 {
-		t.Errorf("by_source leaked: %+v", got.Srcs)
-	}
-}
-
-// TestPeriodAllUsesLifetimeAggregates checks "all" still answers from the
-// in-memory aggregates (no audit file needed) and carries the same rows the
-// dashboard already renders.
-func TestPeriodAllUsesLifetimeAggregates(t *testing.T) {
-	s := NewStats(100)
-	now := time.Date(2026, 3, 11, 10, 0, 0, 0, time.UTC)
-	s.Record(Req{Time: now.AddDate(0, 0, -40).UnixMilli(), Key: "k", Model: "m", Source: "s", Prompt: 7, OK: true})
-	s.Record(Req{Time: now.UnixMilli(), Key: "k", Model: "m", Source: "s", Prompt: 3, OK: true})
-
-	got := s.PeriodSnapshot(PeriodAll, "", now)
-	if got.Total.Reqs != 2 || got.Total.Prompt != 10 {
-		t.Errorf("all view = %d reqs / %d prompt, want 2 / 10 (lifetime)", got.Total.Reqs, got.Total.Prompt)
-	}
-	if len(got.Models) != 1 || got.Models[0].Prompt != 10 {
-		t.Errorf("all view by_model = %+v, want one row with 10 prompt", got.Models)
-	}
-	// A lifetime total has no timeline to draw; buckets must stay empty
-	// rather than inventing 500 hourly points.
-	if len(got.Bucket) != 0 {
-		t.Errorf("all view produced %d buckets, want 0", len(got.Bucket))
-	}
-}
-
-// TestPeriodEmptyWindowFlagsTruncated covers the "rotated away" case: a bounded
-// window with nothing to show may mean "quiet day" or "the files are gone".
-// The aggregator must not report a confidently wrong zero.
-func TestPeriodEmptyWindowFlagsTruncated(t *testing.T) {
-	dir := t.TempDir()
-	s := periodStats(t, filepath.Join(dir, "audit.jsonl")) // file does not exist
-	now := time.Date(2026, 3, 11, 10, 0, 0, 0, time.UTC)
-	got := s.PeriodSnapshot(PeriodDay, "", now)
-	if got.Total.Reqs != 0 {
-		t.Errorf("empty window reqs = %d, want 0", got.Total.Reqs)
-	}
-	if !got.Truncated {
-		t.Error("★ an empty bounded window must be flagged truncated — otherwise a " +
-			"rotated-away week reads as 'no traffic that week'")
-	}
-}
-
-// TestValidPeriodRejectsUnknown guards the deliberate strictness: a typo must
-// be an error, not a silent fallback to lifetime totals.
-func TestValidPeriodRejectsUnknown(t *testing.T) {
-	for _, ok := range []Period{PeriodDay, PeriodWeek, PeriodMonth, PeriodAll} {
-		if !ValidPeriod(ok) {
-			t.Errorf("ValidPeriod(%q) = false, want true", ok)
-		}
-	}
-	for _, bad := range []Period{"", "year", "hour", "today", "DAY "} {
-		if ValidPeriod(bad) {
-			t.Errorf("ValidPeriod(%q) = true, want false", bad)
-		}
-	}
-}
-
-// TestPeriodStatusDimensionCountsFailures covers by_status, which nothing else
-// exercised — an aggregation branch with no test is exactly how a period view
-// silently loses the failure pie. M8 (disabling the status dimension) is
-// caught only because this test exists.
-func TestPeriodStatusDimensionCountsFailures(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "audit.jsonl")
-	now := time.Date(2026, 3, 11, 10, 0, 0, 0, time.UTC)
-	auditPeriod(t, path,
-		Req{Time: now.UnixMilli(), Model: "m", Source: "s", Status: 200, OK: true, Prompt: 5},
-		Req{Time: now.UnixMilli(), Model: "m", Source: "s", Status: 502, OK: false, Prompt: 1},
-		Req{Time: now.UnixMilli(), Model: "m", Source: "s", Status: 502, OK: false, Prompt: 1},
-		Req{Time: now.UnixMilli(), Model: "m", Source: "s", Status: 429, OK: false, Prompt: 1},
-	)
-	s := periodStats(t, path)
-	got := s.PeriodSnapshot(PeriodDay, "", now)
-
-	byCode := map[string]int64{}
-	for _, r := range got.Status {
-		byCode[r.Name] = r.Reqs
-	}
-	if len(got.Status) != 3 {
-		t.Fatalf("by_status has %d rows, want 3 (200/502/429): %+v", len(got.Status), got.Status)
-	}
-	if byCode["200"] != 1 || byCode["502"] != 2 || byCode["429"] != 1 {
-		t.Errorf("by_status counts = %v, want 200:1 502:2 429:1", byCode)
-	}
-	// Status codes must sort numerically: "429" before "502" lexically would
-	// render the failure legend in the wrong order.
-	if got.Status[0].Name != "200" || got.Status[1].Name != "429" || got.Status[2].Name != "502" {
-		t.Errorf("by_status not numerically sorted: %s, %s, %s",
-			got.Status[0].Name, got.Status[1].Name, got.Status[2].Name)
-	}
-	// The failure rows must agree with the OK/Err split on the total, or the
-	// pie and the KPI row contradict each other.
-	if got.Total.OK != 1 || got.Total.Err != 3 {
-		t.Errorf("total ok/err = %d/%d, want 1/3", got.Total.OK, got.Total.Err)
-	}
-}
-
-func TestPeriodFromQuery(t *testing.T) {
-	cases := []struct {
-		query string
-		want  Period
-	}{
-		{"", PeriodAll}, // no selector → unchanged legacy behaviour
-		{"?period=day", PeriodDay},
-		{"?period=WEEK", PeriodWeek},
-		{"?period=month", PeriodMonth},
-		{"?period=all", PeriodAll},
-	}
-	for _, c := range cases {
-		r := httptest.NewRequest(http.MethodGet, "/api/stats"+c.query, nil)
-		if got := periodFromQuery(r.URL.Query()); got != c.want {
-			t.Errorf("periodFromQuery(%q) = %q, want %q", c.query, got, c.want)
-		}
-	}
-}
-
-// TestPeriodWeekMayStartBeforeMonth pins a fact that looks like a bug and
-// gets reported as one: the calendar periods are NOT nested.
-//
-// On 2026-10-03 (a Saturday) the ISO week runs Mon 2026-09-28 .. Sat
-// 10-03, while the month window is 10-01 .. 10-03. The week therefore reaches
-// back into the previous month and its total is legitimately LARGER than the
-// month's. Anyone reading only the totals will conclude the aggregator is
-// broken; it is not, and this test exists so a future "fix" that makes the
-// windows nested (e.g. clamping the week to the month) is caught as the
-// regression it would be.
-func TestPeriodWeekMayStartBeforeMonth(t *testing.T) {
-	// Saturday 2026-10-03, UTC.
-	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
-
-	weekFrom := periodStart(PeriodWeek, now)
-	monthFrom := periodStart(PeriodMonth, now)
-
-	weekFromD := time.UnixMilli(weekFrom).UTC()
-	monthFromD := time.UnixMilli(monthFrom).UTC()
-
-	if got := weekFromD.Format("2006-01-02"); got != "2026-09-28" {
-		t.Fatalf("week window start = %s, want 2026-09-28 (the Monday)", got)
-	}
-	if got := monthFromD.Format("2006-01-02"); got != "2026-10-01" {
-		t.Fatalf("month window start = %s, want 2026-10-01", got)
-	}
-	if !weekFromD.Before(monthFromD) {
-		t.Fatal("this test only means anything when the week starts before the month")
-	}
-	// The week must reach strictly further back than the month window does,
-	// otherwise the nesting intuition would hold and the UI note would be noise.
-	if back := monthFromD.Sub(weekFromD).Hours() / 24; back <= 0 {
-		t.Fatalf("week should start at least a day before the month window, got %v days back", back)
-	}
-}
-
-// The same overlap must be visible in the aggregate numbers, not just in the
-// window bounds: a week total larger than a month total is the exact symptom
-// an operator reported.
-func TestPeriodWeekTotalCanExceedMonthTotal(t *testing.T) {
-	dir := t.TempDir()
-	audit := filepath.Join(dir, "audit.jsonl")
-
-	// Two records before the month window (inside this ISO week) and one
-	// inside October.
-	pre := time.Date(2026, 9, 29, 10, 0, 0, 0, time.UTC).UnixMilli()
-	in1 := time.Date(2026, 10, 1, 10, 0, 0, 0, time.UTC).UnixMilli()
-	in2 := time.Date(2026, 10, 3, 10, 0, 0, 0, time.UTC).UnixMilli()
-
-	auditPeriod(t, audit,
-		Req{Time: pre, OK: true, Prompt: 100, Compl: 10},
-		Req{Time: pre + 1000, OK: true, Prompt: 100, Compl: 10},
-		Req{Time: in1, OK: true, Prompt: 50, Compl: 5},
-		Req{Time: in2, OK: true, Prompt: 50, Compl: 5},
-	)
-
-	s := periodStats(t, audit)
-	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
-
-	week := s.PeriodSnapshot(PeriodWeek, "", now)
-	month := s.PeriodSnapshot(PeriodMonth, "", now)
-
-	if week.Total.Reqs != 4 {
-		t.Fatalf("week reqs = %d, want 4 (both September records fall in this ISO week)", week.Total.Reqs)
-	}
-	if month.Total.Reqs != 2 {
-		t.Fatalf("month reqs = %d, want 2", month.Total.Reqs)
-	}
-	if week.Total.Tokens <= month.Total.Tokens {
-		t.Fatalf("week tokens (%d) must exceed month tokens (%d): the week reaches into September",
-			week.Total.Tokens, month.Total.Tokens)
-	}
-	// Day must be a strict subset of both, which is the only nesting that holds.
-	day := s.PeriodSnapshot(PeriodDay, "", now)
-	if day.Total.Reqs != 1 {
-		t.Fatalf("day reqs = %d, want 1", day.Total.Reqs)
-	}
-	if day.Total.Tokens >= month.Total.Tokens || day.Total.Tokens >= week.Total.Tokens {
-		t.Fatal("today must be contained in both the week and the month totals")
-	}
-}
-
-// TestPeriodStatsCarryActiveGauge pins the live "active requests" gauge onto
-// every period response.
-//
-// It is a live gauge, not an aggregate, so no calendar window can scope it — but
-// the period response is what the day/week/month views render from, and it used
-// to omit the field entirely. The UI then evaluated `st.active || 0` and printed
-// a hard 0 in three of four views, while the all-time view (whose response did
-// carry the field) showed the truth. Reading "0 active" off a busy gateway is
-// worse than reading nothing: it is a confident wrong answer.
-func TestPeriodStatsCarryActiveGauge(t *testing.T) {
-	for _, period := range []string{"day", "week", "month", "all"} {
-		g := newTestGateway(t)
-		rr := doReq(t, g, http.MethodGet, "/api/stats?period="+period, "")
-		if rr.Code != http.StatusOK {
-			t.Fatalf("period=%s: %d", period, rr.Code)
-		}
-		var out map[string]interface{}
-		if err := json.Unmarshal(rr.Body.Bytes(), &out); err != nil {
-			t.Fatalf("period=%s decode: %v", period, err)
-		}
-		v, ok := out["active"]
-		if !ok {
-			t.Errorf("period=%s response has no active field; the UI renders 0", period)
-			continue
-		}
-		if _, ok := v.(float64); !ok {
-			t.Errorf("period=%s active is %T, want a number", period, v)
-		}
-	}
-}

internal/gateway/stats_unknown_key_test.go

@@ -1,140 +0,0 @@
-package gateway
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-)
-
-// TestSnapshotUnknownKeyDoesNotPanic covers a nil-dereference that killed the
-// response for any /api/stats request carrying a ?key= the statistics had no
-// entry for.
-//
-// The maps in Snapshot are keyed by the MASKED key id (keyID(req.Key)) — that
-// is what by_key reports and what the dashboard sends. An admin may pass anything
-// in the query parameter, including the full key, and `s.byKey[key]` then yields
-// the zero value: a nil *Stat. rows() dereferenced every value, so the handler
-// panicked and the client got an empty reply plus a panic stack in the log.
-//
-// Reproduced against the live gateway before the fix:
-//
-//	/api/stats?period=day&limit=1&key=sk-gw-7ffe12c5cbacec40bd39a7291df9a9ed
-//	→ curl: (52) Empty reply from server
-//	→ log: http: panic serving …: invalid memory address or nil pointer dereference
-//	    llmsproxy/internal/gateway.rows  stats.go:771
-//
-// A key with no recorded traffic is a legitimate question, and zero is its
-// answer — not a crash.
-func TestSnapshotUnknownKeyDoesNotPanic(t *testing.T) {
-	s := NewStats(16)
-	// One recorded key, masked the way Record masks it.
-	s.Record(Req{Key: "***aaaaaa", Type: "chat", Model: "m", Prompt: 5, Compl: 2})
-
-	cases := []struct {
-		name string
-		key  string
-	}{
-		{"masked key that exists", "***aaaaaa"},
-		{"masked key that does not exist", "***zzzzzz"},
-		{"full key rather than the mask", "sk-gw-full-key-value"},
-		{"arbitrary text", "not-a-key-at-all"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			// A panic here fails the subtest by unwinding through the test
-			// goroutine; rows() used to take the whole process with it.
-			out := s.Snapshot(10, c.key)
-			byKey, ok := out["by_key"].([]StatsRow)
-			if !ok {
-				t.Fatalf("by_key is %T, want []StatsRow", out["by_key"])
-			}
-			total, _ := out["total"].(Stat)
-			t.Logf("key=%q → by_key %d 条, total.reqs=%d", c.key, len(byKey), total.Reqs)
-		})
-	}
-}
-
-// TestSnapshotUnknownKeyReportsZeroNotAbsence pins the semantics: a key with no
-// traffic answers zero, and the by_key row still exists so a dashboard that keys
-// off its presence renders a row of zeros rather than dropping the key.
-func TestSnapshotUnknownKeyReportsZeroNotAbsence(t *testing.T) {
-	s := NewStats(16)
-	out := s.Snapshot(10, "***zzzzzz")
-	byKey, _ := out["by_key"].([]StatsRow)
-	if len(byKey) != 1 {
-		t.Fatalf("by_key has %d rows, want 1: the queried key must appear with zeros", len(byKey))
-	}
-	if byKey[0].Name != "***zzzzzz" {
-		t.Errorf("row name = %q, want ***zzzzzz", byKey[0].Name)
-	}
-	if byKey[0].Reqs != 0 {
-		t.Errorf("reqs = %d, want 0", byKey[0].Reqs)
-	}
-}
-
-// TestPeriodSnapshotUnknownKeyDoesNotPanic is the same guard on the period view,
-// which builds its own buckets and calls the same flattening helpers.
-func TestPeriodSnapshotUnknownKeyDoesNotPanic(t *testing.T) {
-	dir := t.TempDir()
-	audit := dir + "/audit.jsonl"
-	writeAuditFile(t, audit, 3, "***aaaaaa", time.Now().Add(-time.Hour).UnixMilli())
-	s := periodStats(t, audit)
-
-	for _, key := range []string{"***aaaaaa", "***zzzzzz", "sk-gw-full-key-value"} {
-		out := s.PeriodSnapshot(PeriodAll, key, time.Now())
-		t.Logf("key=%q → total.reqs=%d byKey=%d buckets=%d",
-			key, out.Total.Reqs, len(out.ByKey), len(out.Bucket))
-	}
-}
-
-// TestRowsSkipsNilValues pins the defensive behaviour directly, so a future
-// caller that reintroduces a nil entry fails here rather than in production.
-func TestRowsSkipsNilValues(t *testing.T) {
-	in := map[string]*Stat{
-		"has-traffic": {Reqs: 5},
-		"no-entry":    nil,
-	}
-	got := rows(in)
-	if len(got) != 1 {
-		t.Fatalf("rows() returned %d rows, want 1 (the nil entry must be skipped): %+v", len(got), got)
-	}
-	if got[0].Name != "has-traffic" {
-		t.Errorf("kept %q, want has-traffic", got[0].Name)
-	}
-}
-
-// TestRowsEmptyIsEmptyNotNil keeps the JSON shape honest: an all-nil map yields
-// an empty list, which encodes as [] rather than null — the frontend does
-// Array.isArray checks on these fields.
-func TestRowsEmptyIsEmptyNotNil(t *testing.T) {
-	got := rows(map[string]*Stat{"a": nil})
-	if got == nil {
-		t.Fatal("rows() returned nil; the report field must stay [] instead of null")
-	}
-	if len(got) != 0 {
-		t.Fatalf("got %d rows, want 0", len(got))
-	}
-}
-
-// TestStatsAPIUnknownKeyReturnsJSON exercises the HTTP path so the assertion
-// covers the reported symptom (an empty reply), not just the helper.
-func TestStatsAPIUnknownKeyReturnsJSON(t *testing.T) {
-	g := newTestGateway(t)
-	srv := httptest.NewServer(g.Handler())
-	defer srv.Close()
-
-	req, err := http.NewRequest("GET", srv.URL+"/api/stats?period=day&limit=1&key=sk-gw-full-key", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Authorization", "Bearer sk-test")
-	resp, err := srv.Client().Do(req)
-	if err != nil {
-		t.Fatalf("request failed (an empty reply is what the live gateway produced): %v", err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("status = %d, want 200", resp.StatusCode)
-	}
-}

internal/gateway/thinking_test.go

@@ -1,133 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"testing"
-
-	"llmsproxy/internal/types"
-)
-
-// TestThinkingFromClient 把「客户端措辞 → 中立语义」这条翻译链钉死。
-//
-// v1 的问题：disable_thinking 是内核私有字段，被序列化进交给适配器的 body，
-// 于是 10 个适配器各自写 req.disable_thinking = nil 来清理它。v2 把它换成
-// 双方都认可的 thinking 字段，这条测试确保翻译只发生一次、且在适配器之前。
-func TestThinkingFromClient(t *testing.T) {
-	cases := []struct {
-		name string
-		req  chatRequest
-		want *types.ThinkingConfig
-	}{
-		{
-			name: "无任何字段 → 不带 thinking（上游用自己默认）",
-			req:  chatRequest{},
-			want: nil,
-		},
-		{
-			name: "disable_thinking=true → enabled=false",
-			req:  chatRequest{DisableThinking: true},
-			want: &types.ThinkingConfig{Enabled: boolPtr(false)},
-		},
-		{
-			name: "中立 thinking 显式给出 → 原样透传",
-			req:  chatRequest{Thinking: &types.ThinkingConfig{Enabled: boolPtr(true), BudgetTokens: 4096}},
-			want: &types.ThinkingConfig{Enabled: boolPtr(true), BudgetTokens: 4096},
-		},
-		{
-			name: "两者冲突时，中立的 thinking 优先（它带预算，布尔表达不了）",
-			req: chatRequest{
-				DisableThinking: true,
-				Thinking:        &types.ThinkingConfig{Enabled: boolPtr(true), BudgetTokens: 1024},
-			},
-			want: &types.ThinkingConfig{Enabled: boolPtr(true), BudgetTokens: 1024},
-		},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			got := c.req.thinkingFromClient()
-			if c.want == nil {
-				if got != nil {
-					t.Fatalf("want nil, got %+v", got)
-				}
-				return
-			}
-			if got == nil {
-				t.Fatal("want non-nil thinking, got nil")
-			}
-			if (got.Enabled == nil) != (c.want.Enabled == nil) {
-				t.Fatalf("Enabled presence mismatch: got %v want %v", got.Enabled, c.want.Enabled)
-			}
-			if got.Enabled != nil && *got.Enabled != *c.want.Enabled {
-				t.Errorf("Enabled = %v, want %v", *got.Enabled, *c.want.Enabled)
-			}
-			if got.BudgetTokens != c.want.BudgetTokens {
-				t.Errorf("BudgetTokens = %d, want %d", got.BudgetTokens, c.want.BudgetTokens)
-			}
-		})
-	}
-}
-
-// TestDisableThinkingNeverReachesAdapterBody 是那条泄漏的回归测试：内核私有
-// 字段不得出现在交给适配器的 body 里。
-func TestDisableThinkingNeverReachesAdapterBody(t *testing.T) {
-	var r chatRequest
-	if err := json.Unmarshal([]byte(`{"model":"m","messages":[],"disable_thinking":true}`), &r); err != nil {
-		t.Fatal(err)
-	}
-	inner := &types.ChatRequest{
-		Model:         "m",
-		Thinking:      r.thinkingFromClient(),
-		Tools:         r.rawTools(),
-		ToolChoice:    r.rawToolChoice(),
-		ExtraBody:     r.ExtraBody,
-		ClientSession: "",
-	}
-	body, err := json.Marshal(inner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var m map[string]json.RawMessage
-	if err := json.Unmarshal(body, &m); err != nil {
-		t.Fatal(err)
-	}
-	if _, leaked := m["disable_thinking"]; leaked {
-		t.Errorf("内核私有字段 disable_thinking 泄漏进适配器 body（v1 回归）: %s", body)
-	}
-	if _, ok := m["thinking"]; !ok {
-		t.Errorf("中立 thinking 字段缺失: %s", body)
-	}
-}
-
-// TestToolsPassthroughRaw 确认 tools/tool_choice 以原始形状交给适配器：
-// 内核不解释工具 schema，那是适配器的职责。
-func TestToolsPassthroughRaw(t *testing.T) {
-	var r chatRequest
-	body := `{"model":"m","messages":[],"tools":[{"type":"function","function":{"name":"f","parameters":{"type":"object"}}}],"tool_choice":"auto"}`
-	if err := json.Unmarshal([]byte(body), &r); err != nil {
-		t.Fatal(err)
-	}
-	tools := r.rawTools()
-	if len(tools) == 0 {
-		t.Fatal("tools 未透传")
-	}
-	var decoded []map[string]interface{}
-	if err := json.Unmarshal(tools, &decoded); err != nil {
-		t.Fatalf("tools 不是合法 JSON: %v (%s)", err, tools)
-	}
-	if len(decoded) != 1 || decoded[0]["type"] != "function" {
-		t.Errorf("tools 形状被内核改写: %s", tools)
-	}
-	if tc := string(r.rawToolChoice()); tc != `"auto"` {
-		t.Errorf("tool_choice = %s, want \"auto\"", tc)
-	}
-	// 空值不应变成 "null" 出现在 body 里
-	var empty chatRequest
-	if got := empty.rawTools(); got != nil {
-		t.Errorf("无 tools 时应返回 nil, got %s", got)
-	}
-	if got := empty.rawToolChoice(); got != nil {
-		t.Errorf("无 tool_choice 时应返回 nil, got %s", got)
-	}
-}
-
-func boolPtr(v bool) *bool { return &v }

internal/gateway/token_units_test.go

@@ -1,231 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/config"
-)
-
-// Token accounting must record TOKENS, not byte estimates and not image
-// counts. These tests pin the two units bugs found on 2026-09-27:
-//
-//  1. streamed chat: rec.Compl was only ever the per-chunk byte estimate
-//     (len(content)/3), even when the upstream sent exact usage on its final
-//     frame. Measured on production traffic: the same model reported a
-//     streamed completion median 4-27x its non-streamed median. Upstream 100
-//     recorded as 145.
-//  2. image generation: rec.Compl was set to len(resp.ImageData) — the image
-//     COUNT — and folded into the token totals.
-//
-// A fake upstream that reports FIXED numbers makes both mismatches
-// unambiguous: any difference between what it reports and what the audit
-// record holds is the gateway's doing.
-
-// fixedUsageUpstream reports prompt=prompt completion=compl on both the
-// streaming and the non-streaming path. The streaming path emits usage on its
-// final frame before [DONE], exactly like OpenAI-compatible upstreams.
-func fixedUsageUpstream(t *testing.T, prompt, compl int, images int) *httptest.Server {
-	t.Helper()
-	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var body map[string]interface{}
-		_ = json.NewDecoder(r.Body).Decode(&body)
-		stream, _ := body["stream"].(bool)
-		usage := fmt.Sprintf(`{"prompt_tokens":%d,"completion_tokens":%d,"total_tokens":%d}`,
-			prompt, compl, prompt+compl)
-
-		// Image generation wire: /v1/images/generations style body.
-		if strings.Contains(r.URL.Path, "image") {
-			w.Header().Set("Content-Type", "application/json")
-			var data []string
-			for i := 0; i < images; i++ {
-				data = append(data, `{"b64_json":"AAAA"}`)
-			}
-			fmt.Fprintf(w, `{"created":1,"data":[%s]}`, strings.Join(data, ","))
-			return
-		}
-
-		if !stream {
-			w.Header().Set("Content-Type", "application/json")
-			fmt.Fprintf(w, `{"model":"m1","choices":[{"message":{"content":"pong pong pong"},
-				"finish_reason":"stop"}],"usage":%s}`, usage)
-			return
-		}
-
-		w.Header().Set("Content-Type", "text/event-stream")
-		w.WriteHeader(200)
-		fl, _ := w.(http.Flusher)
-		send := func(s string) {
-			fmt.Fprintf(w, "data: %s\n\n", s)
-			if fl != nil {
-				fl.Flush()
-			}
-		}
-		// Deliberately verbose payloads: a byte-estimating path records a
-		// number far from `compl`, so the test would catch it.
-		send(`{"model":"m1","choices":[{"delta":{"reasoning_content":"` + strings.Repeat("think ", 40) + `"}}]}`)
-		send(`{"model":"m1","choices":[{"delta":{"content":"` + strings.Repeat("answer ", 40) + `"}}]}`)
-		send(`{"model":"m1","choices":[{"delta":{},"finish_reason":"stop"}]}`)
-		send(`{"model":"m1","choices":[],"usage":` + usage + `}`)
-		send(`[DONE]`)
-	}))
-}
-
-// lastChatRecord returns the most recent audit record whose Type is one of the
-// given types.
-func lastChatRecord(t *testing.T, g *Gateway, types ...string) Req {
-	t.Helper()
-	recs := g.stats.AuditRecords(0, 0, "")
-	want := map[string]bool{}
-	for _, ty := range types {
-		want[ty] = true
-	}
-	for i := len(recs) - 1; i >= 0; i-- {
-		if want[recs[i].Type] {
-			return recs[i]
-		}
-	}
-	t.Fatalf("no audit record of type %v found (have %d records)", types, len(recs))
-	return Req{}
-}
-
-// The streamed path must record the upstream's exact usage, not a byte
-// estimate. Before the fix this recorded 145 for an upstream-reported 100.
-func TestStreamedChatRecordsUpstreamUsage(t *testing.T) {
-	const wantPrompt, wantCompl = 44, 100
-	up := fixedUsageUpstream(t, wantPrompt, wantCompl, 0)
-	defer up.Close()
-	g := newTestGateway(t, config.Source{
-		Name: "up", BaseURL: up.URL, Adapter: "openai",
-		Models: []config.Model{{ID: "m1", Priority: 100}},
-	})
-
-	rr := doReq(t, g, "POST", "/v1/chat/completions",
-		`{"model":"m1","messages":[{"role":"user","content":"hi"}],"stream":true}`)
-	if rr.Code != 200 {
-		t.Fatalf("stream status=%d body=%s", rr.Code, rr.Body.String())
-	}
-
-	rec := lastChatRecord(t, g, "stream")
-	if rec.Prompt != wantPrompt || rec.Compl != wantCompl {
-		t.Errorf("streamed record prompt=%d completion=%d, want %d/%d — the audit "+
-			"must carry the upstream's tokens, not a byte estimate",
-			rec.Prompt, rec.Compl, wantPrompt, wantCompl)
-	}
-}
-
-// Streaming and non-streaming must agree on the same request's tokens. This is
-// the cross-path consistency check: the two paths previously recorded 145 and
-// 100 for one identical upstream usage value.
-func TestStreamedAndNonStreamedAgreeOnTokens(t *testing.T) {
-	const wantPrompt, wantCompl = 44, 100
-	up := fixedUsageUpstream(t, wantPrompt, wantCompl, 0)
-	defer up.Close()
-	g := newTestGateway(t, config.Source{
-		Name: "up", BaseURL: up.URL, Adapter: "openai",
-		Models: []config.Model{{ID: "m1", Priority: 100}},
-	})
-
-	if rr := doReq(t, g, "POST", "/v1/chat/completions",
-		`{"model":"m1","messages":[{"role":"user","content":"hi"}]}`); rr.Code != 200 {
-		t.Fatalf("non-stream status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	if rr := doReq(t, g, "POST", "/v1/chat/completions",
-		`{"model":"m1","messages":[{"role":"user","content":"hi"}],"stream":true}`); rr.Code != 200 {
-		t.Fatalf("stream status=%d body=%s", rr.Code, rr.Body.String())
-	}
-
-	chat, stream := lastChatRecord(t, g, "chat"), lastChatRecord(t, g, "stream")
-	if chat.Prompt != stream.Prompt || chat.Compl != stream.Compl {
-		t.Errorf("chat=%d/%d stream=%d/%d — identical upstream usage must record "+
-			"identically on both paths", chat.Prompt, chat.Compl, stream.Prompt, stream.Compl)
-	}
-}
-
-// A fallback to the byte estimate is still correct WHEN the upstream reports no
-// usage at all. Without this the fix could silently zero out every streamed
-// record from upstreams that omit usage.
-func TestStreamedChatFallsBackToEstimateWithoutUsage(t *testing.T) {
-	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		w.WriteHeader(200)
-		fl, _ := w.(http.Flusher)
-		send := func(s string) {
-			fmt.Fprintf(w, "data: %s\n\n", s)
-			if fl != nil {
-				fl.Flush()
-			}
-		}
-		send(`{"model":"m1","choices":[{"delta":{"content":"` + strings.Repeat("abc ", 60) + `"}}]}`)
-		send(`{"model":"m1","choices":[{"delta":{},"finish_reason":"stop"}]}`)
-		send(`[DONE]`)
-	}))
-	defer up.Close()
-	g := newTestGateway(t, config.Source{
-		Name: "up", BaseURL: up.URL, Adapter: "openai",
-		Models: []config.Model{{ID: "m1", Priority: 100}},
-	})
-
-	if rr := doReq(t, g, "POST", "/v1/chat/completions",
-		`{"model":"m1","messages":[{"role":"user","content":"hi"}],"stream":true}`); rr.Code != 200 {
-		t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
-	}
-	rec := lastChatRecord(t, g, "stream")
-	if rec.Compl <= 0 {
-		t.Errorf("completion=%d, want a positive byte-estimate fallback when the "+
-			"upstream reports no usage", rec.Compl)
-	}
-}
-
-// Image generation has no token concept: recording the image COUNT as
-// completion tokens corrupted the token totals. The count is reported
-// separately and must not leak into Prompt/Compl.
-func TestImageGenerationDoesNotRecordTokens(t *testing.T) {
-	up := fixedUsageUpstream(t, 44, 100, 3)
-	defer up.Close()
-	src := config.Source{
-		Name: "up", BaseURL: up.URL, Adapter: "openai",
-		Models: []config.Model{{ID: "img-m", Priority: 100, Kind: "image"}},
-	}
-	g := newTestGateway(t, src)
-
-	rr := doReq(t, g, "POST", "/v1/images/generations",
-		`{"model":"img-m","prompt":"a cat","n":3}`)
-	if rr.Code != 200 {
-		t.Fatalf("image status=%d body=%s", rr.Code, rr.Body.String())
-	}
-
-	rec := lastChatRecord(t, g, "image")
-	if rec.Compl != 0 || rec.Prompt != 0 {
-		t.Errorf("image record prompt=%d completion=%d, want 0/0 — image count is "+
-			"not a token and must not enter the token totals", rec.Prompt, rec.Compl)
-	}
-	if rec.ImageCount != 3 {
-		t.Errorf("image_count=%d, want 3 (the count belongs in its own field)", rec.ImageCount)
-	}
-	// And the aggregate must see zero tokens for it.
-	if got := g.stats.WindowTokens("img-m", "", 3600); got != 0 {
-		t.Errorf("window tokens for an image model = %d, want 0", got)
-	}
-}
-
-// The audit JSON must carry image_count so the WebUI can show images rather
-// than a bogus token figure.
-func TestImageCountSurvivesAuditJSON(t *testing.T) {
-	b, err := json.Marshal(Req{Type: "image", ImageCount: 2, OK: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(b), `"image_count":2`) {
-		t.Errorf("audit JSON %s lacks image_count", b)
-	}
-	// Omitempty keeps chat records unchanged.
-	b2, _ := json.Marshal(Req{Type: "chat", Prompt: 1, Compl: 2, OK: true})
-	if strings.Contains(string(b2), "image_count") {
-		t.Errorf("chat record %s should omit image_count", b2)
-	}
-}

internal/gateway/ui_contract_test.go

@@ -59,82 +59,6 @@ func lineOf(src string, idx int) int {
 	return strings.Count(src[:idx], "\n") + 1
 }
 
-// TestUIEditFormRoundTripsEveryOptionalSourceField pins the JS half of the
-// source-edit contract.
-//
-// The server distinguishes "absent" from "explicitly empty" for proxy_url,
-// api_key_env and timeout (they are pointers). That only helps if the form
-// SENTS them — a form that omits them falls back to "inherit", so clearing the
-// proxy box would silently keep the old proxy, which is the exact bug in the
-// other direction.
-//
-// It must also send the api_key_env value it was given, since that is the one
-// field whose loss is invisible until the next upstream call.
-func TestUIEditFormRoundTripsEveryOptionalSourceField(t *testing.T) {
-	src := uiSource(t)
-	body, ok := jsFunctionBody(src, "saveSource")
-	if !ok {
-		t.Fatal("saveSource() not found in the WebUI")
-	}
-	for _, field := range []string{"proxy_url", "api_key_env", "timeout"} {
-		if !strings.Contains(body, field+":") {
-			t.Errorf("saveSource() does not send %q; the server treats an absent "+
-				"field as \"keep the stored value\", so the form could never clear it", field)
-		}
-	}
-	// The form's inputs must be filled from the values the server sends, or a
-	// save would post an empty box and clear a configured field.
-	for _, read := range []string{`$("#s-proxy")`, `$("#s-keyenv")`, `$("#s-timeout")`} {
-		if !strings.Contains(src, read+".value") {
-			t.Errorf("the source form never reads %s — it would post an empty value", read)
-		}
-	}
-}
-
-// TestUIEditFormReadsDurationsFromTheRevealView: config.Source tags
-// Timeout/QueueTimeout `json:"-"`, so the durations only reach the form if the
-// reveal endpoint adds them explicitly. The form MUST read them (see above),
-// which makes this API response load-bearing rather than informational.
-func TestUIEditFormReadsDurationsFromTheRevealView(t *testing.T) {
-	src := uiSource(t)
-	for _, id := range []string{"s-proxy", "s-keyenv", "s-timeout"} {
-		if !strings.Contains(src, `id="`+id+`"`) {
-			t.Errorf("source form input #%s is missing", id)
-		}
-	}
-	// The timeout box must render through the duration helper. Reading a raw
-	// time.Duration number would show nanoseconds in a box that expects "300s".
-	if !strings.Contains(src, "timeoutText(") {
-		t.Error("the timeout input does not go through timeoutText(); a raw " +
-			"time.Duration JSON number is nanoseconds and would be uneditable")
-	}
-}
-
-// TestUIEditFormSendsEverySourceField is the mirror of
-// TestSourcePayloadCoversEveryEditableField on the JavaScript side: each field
-// the server accepts must be submitted by the form, or the server's upsert has
-// nothing to store for it.
-func TestUIEditFormSendsEverySourceField(t *testing.T) {
-	src := uiSource(t)
-	body, ok := jsFunctionBody(src, "saveSource")
-	if !ok {
-		t.Fatal("saveSource() not found")
-	}
-	// Fields the edit dialog owns. proxy_url / api_key_env / timeout are
-	// covered by the round-trip test above; this one catches the rest.
-	// models and meta are local variables submitted by Go shorthand
-	// (payload = { models, meta }), so they are matched as bare identifiers.
-	for _, field := range []string{
-		"name:", "base_url:", "api_key:", "adapter:", "endpoint:",
-		"image_endpoint:", "max_concurrent:", "rpm:", "temperature:",
-		"models,", "meta,",
-	} {
-		if !strings.Contains(body, field) {
-			t.Errorf("saveSource() does not send %s", field)
-		}
-	}
-}
-
 // TestUIAPICallsDeclareMethod asserts that every api() call passing an options
 // object also declares an HTTP method (or is a GET that only passes an
 // AbortSignal). Without this, fetch defaults to GET and mutating endpoints are
@@ -423,60 +347,3 @@ func cssBlock(src, selector string) (string, bool) {
 	}
 	return src[i : i+j+1], true
 }
-
-// The WebUI ships two locale objects (`zh` and `en`) that every rendered string
-// goes through. A key added to only one of them does not error: t() falls back
-// to `t("key") || "literal"` in some call sites and to the bare key string in
-// others, so the user sees either a hardcoded local string or a raw key name.
-// Nothing in the Go test suite noticed — this was found by hand while adding
-// thImgs. Pin the key sets so a one-sided edit fails here instead of shipping.
-func TestUILocaleKeyParity(t *testing.T) {
-	src := uiSource(t)
-	iZh := strings.Index(src, "zh: {")
-	iEn := strings.Index(src, "en: {")
-	if iZh < 0 || iEn < 0 || iEn < iZh {
-		t.Fatalf("locale blocks not found (zh=%d en=%d)", iZh, iEn)
-	}
-	zh := src[iZh:iEn]
-	en := src[iEn:]
-	// End the EN block at its closing brace, so keys from later objects
-	// (config templates etc.) do not pollute the comparison.
-	if end := strings.Index(en, "\n        },"); end > 0 {
-		en = en[:end]
-	}
-
-	keyRe := regexp.MustCompile(`(?m)^\s*([A-Za-z_][A-Za-z0-9_]*)\s*:`)
-	collect := func(seg string) map[string]bool {
-		m := map[string]bool{}
-		for _, g := range keyRe.FindAllStringSubmatch(seg, -1) {
-			m[g[1]] = true
-		}
-		return m
-	}
-	zk, ek := collect(zh), collect(en)
-	// The locale markers themselves are the two block headers.
-	delete(zk, "zh")
-	delete(ek, "en")
-
-	var missingEN, missingZH []string
-	for k := range zk {
-		if !ek[k] {
-			missingEN = append(missingEN, k)
-		}
-	}
-	for k := range ek {
-		if !zk[k] {
-			missingZH = append(missingZH, k)
-		}
-	}
-	if len(missingEN) > 0 {
-		t.Errorf("translation keys present in zh but missing in en: %v", missingEN)
-	}
-	if len(missingZH) > 0 {
-		t.Errorf("translation keys present in en but missing in zh: %v", missingZH)
-	}
-	if len(zk) < 100 {
-		t.Errorf("only %d zh keys parsed — the block boundary regexp has drifted "+
-			"and this test is no longer checking anything", len(zk))
-	}
-}

internal/gateway/ui_image_page_test.go

@@ -1,195 +0,0 @@
-package gateway
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"llmsproxy/internal/provider"
-)
-
-// TestUI_ChatPageGroupsImageModels is a UI-contract guard for the bug that
-// started this: the chat page listed image models beside chat ones, and picking
-// one posted to /api/chat, which cannot serve it.
-//
-// The contract is asserted on the HTML source rather than by running a browser,
-// because the failure this must catch is a source-level one — an <option>
-// without `disabled`. A DOM assertion in a headless browser would pass right
-// up until someone removed the attribute, and then only if a CI machine had the
-// whole stack up.
-func TestUI_ChatPageGroupsImageModels(t *testing.T) {
-	ui := uiSource(t)
-
-	// The dropdown must read model_kinds, not the flat models list. Reading the
-	// flat list is what made chat and image models indistinguishable.
-	if !strings.Contains(ui, "model_kinds") {
-		t.Error("chat page never reads model_kinds; image models will be " +
-			"indistinguishable from chat models again")
-	}
-
-	// Image options must be rendered disabled. A plain String.replace over the
-	// joined HTML only disables the FIRST match — that bug shipped once here
-	// (one source disabled, five selectable) — so the assertion looks for the
-	// per-item map, not for a global replace.
-	if strings.Contains(ui, `imgOpts.join("").replace`) {
-		t.Error("chat page disables image options with String.replace over the " +
-			"joined HTML, which only rewrites the first option")
-	}
-	if !strings.Contains(ui, "disabled") {
-		t.Error("chat page never emits a disabled attribute for image models")
-	}
-}
-
-// TestUI_HasDedicatedImagePage pins the second half of the fix: image models
-// need somewhere they CAN be tested.
-func TestUI_HasDedicatedImagePage(t *testing.T) {
-	ui := uiSource(t)
-
-	for _, want := range []string{
-		`data-tab="image"`,       // sidebar entry
-		`id="tab-image"`,         // pane
-		`function renderImage`,   // renderer registered with refresh()
-		`tab === "image"`,        // dispatched
-		`/v1/images/generations`, // the endpoint the page actually calls
-	} {
-		if !strings.Contains(ui, want) {
-			t.Errorf("image page is missing %q", want)
-		}
-	}
-
-	// The page must be reachable from TABS; goTab iterates TABS to toggle pane
-	// visibility, so a pane outside that list is present but permanently hidden —
-	// which reads as "the page is blank" because the content is in the DOM.
-	if !strings.Contains(ui, `"image"`) {
-		t.Error(`"image" does not appear in the TABS list`)
-	}
-}
-
-// TestUI_ImagePageCallsTheImageEndpoint is the discriminator: a page that
-// renders an image result but posts to the chat endpoint would produce exactly
-// the original failure, just prettier.
-func TestUI_ImagePageCallsTheImageEndpoint(t *testing.T) {
-	ui := uiSource(t)
-
-	i := strings.Index(ui, "async function sendImage(")
-	if i < 0 {
-		t.Fatal("sendImage() not found")
-	}
-	// Bound the search to the function body rather than the whole file, so a
-	// /v1/images/generations mention elsewhere cannot satisfy this.
-	body := ui[i:]
-	if end := strings.Index(body, "\n      function "); end > 0 {
-		body = body[:end]
-	}
-	if end := strings.Index(body, "\n      async function "); end > 0 {
-		if s := body[:end]; strings.Contains(s, "/v1/images/generations") {
-			body = s
-		} else {
-			body = body[:end]
-		}
-	}
-	if !strings.Contains(body, "/v1/images/generations") {
-		t.Error("sendImage() does not post to /v1/images/generations")
-	}
-}
-
-// TestSourceStatus_ExposesModelKindsToTheUI is the server half of the same
-// contract: the field the UI reads must actually be serialized.
-func TestSourceStatus_ExposesModelKindsToTheUI(t *testing.T) {
-	st := provider.SourceStatus{
-		Name:   "vela",
-		Models: []string{"claude-sonnet-5.5", "gpt-image-2"},
-		ModelKinds: []provider.ModelKindInfo{
-			{ID: "claude-sonnet-5.5", Kind: "chat"},
-			{ID: "gpt-image-2", Kind: "image"},
-		},
-	}
-	b, err := json.Marshal(st)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(b, &got); err != nil {
-		t.Fatal(err)
-	}
-	mk, ok := got["model_kinds"].([]interface{})
-	if !ok || len(mk) != 2 {
-		t.Fatalf("model_kinds = %v, want 2 entries; the UI cannot split the list without it", got["model_kinds"])
-	}
-	last := mk[1].(map[string]interface{})
-	if last["kind"] != "image" {
-		t.Errorf("model_kinds[1].kind = %v, want \"image\"", last["kind"])
-	}
-}
-
-// TestUI_BaseURLFieldExplainsWhereToCut keeps the second bug fixed: the URL
-// hint has to mention the concrete failure, not just say "enter the URL".
-func TestUI_BaseURLFieldExplainsWhereToCut(t *testing.T) {
-	ui := uiSource(t)
-	if !strings.Contains(ui, "urlHint") {
-		t.Fatal("no urlHint; the base_url field gives no guidance about /v1")
-	}
-	hint := ui[strings.Index(ui, "urlHint:"):]
-	if len(hint) > 700 {
-		hint = hint[:700]
-	}
-	// The trap is specific and reproducible: base_url ending in /v1 makes chat
-	// work and image generation 404. Saying only "enter the URL" reproduces the
-	// confusion the hint exists to remove.
-	for _, want := range []string{"/v1", "404"} {
-		if !strings.Contains(hint, want) {
-			t.Errorf("urlHint does not mention %q — the hint must name the concrete failure", want)
-		}
-	}
-}
-
-// TestImageEndpointComposesUnderRealConditions proves the hint describes a
-// reachable path rather than a plausible-sounding one.
-//
-// The case that matters: base_url already ends in /v1 (which is what an
-// operator pastes from an SDK example), so the RELATIVE image endpoint composes
-// to …/v1/images/generations and works, while the gateway's default ABSOLUTE
-// path would produce …/v1/v1/… and 404.
-//
-// The doubled form is served as a 404 here so the test would fail if the code
-// ever reverted to relying on the default.
-func TestImageEndpointComposesUnderRealConditions(t *testing.T) {
-	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/v1/images/generations":
-			_, _ = w.Write([]byte(`{"data":[{"url":"http://example.invalid/x.png"}]}`))
-		default:
-			w.WriteHeader(http.StatusNotFound)
-		}
-	}))
-	defer up.Close()
-
-	// base_url as an operator types it: host root + /v1.
-	base := up.URL + "/v1"
-
-	// What discovery writes when base carries a version segment.
-	relative := base + "/images/generations"
-	resp, err := http.Post(relative, "application/json", strings.NewReader(`{"model":"m"}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		t.Errorf("POST %s = %d, want 200 — the form discovery writes must work", relative, resp.StatusCode)
-	}
-
-	// What the gateway's built-in default would produce for the same base_url.
-	doubled := base + "/v1/images/generations"
-	resp2, err := http.Post(doubled, "application/json", strings.NewReader(`{"model":"m"}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp2.Body.Close()
-	if resp2.StatusCode != http.StatusNotFound {
-		t.Errorf("POST %s = %d, want 404 — this test's premise is that the "+
-			"default image path doubles the version segment; if the upstream ever "+
-			"accepts it, composeImageEndpoint's rule needs rechecking", doubled, resp2.StatusCode)
-	}
-}

internal/gateway/ui_image_wire_test.go

@@ -1,109 +0,0 @@
-package gateway
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestUI_ImageRequestSendsJSONBody pins the bug that made the image page
-// unusable in production while every DOM assertion still passed.
-//
-// The page called api(path, {method, body: {...}}). api() is
-// `(p, o) => fetch(p, o)` — o is the NATIVE fetch options object, so an object
-// in `body` is coerced by fetch into the literal text "[object Object]". The
-// gateway's json.Unmarshal rejected it, the response was a bare 400 with
-// lat_ms 0, and the page showed an error toast with no image and no usable
-// message.
-//
-// What made this expensive: the pane rendered, the model list had all six
-// models, the button enabled itself, the console was clean. Only the WIRE
-// format was wrong, and nothing in the DOM shows a wire format.
-func TestUI_ImageRequestSendsJSONBody(t *testing.T) {
-	body := sendImageSource(t)
-
-	if !strings.Contains(body, "JSON.stringify") {
-		t.Error("sendImage() does not JSON.stringify its body — fetch coerces " +
-			"the object to the text \"[object Object]\" and the gateway answers " +
-			"400 with lat_ms 0")
-	}
-	if !strings.Contains(body, `"Content-Type": "application/json"`) {
-		t.Error("sendImage() does not set Content-Type: application/json; the " +
-			"server sees text/plain and may refuse to parse the body")
-	}
-	// The literal defect, asserted so a later refactor reintroducing it fails
-	// here rather than in a browser.
-	if strings.Contains(body, "body: size ? {") || strings.Contains(body, "body: { model") {
-		t.Error("sendImage() still passes an object literal as the fetch body")
-	}
-}
-
-// TestUI_PostCallsSendJSONString guards every POST in the file, not just the
-// image one. The image page happened to be the only place that used api() with
-// an object body, so a check scoped to it would pass while another page had the
-// same defect.
-func TestUI_PostCallsSendJSONString(t *testing.T) {
-	ui := uiSource(t)
-	lines := strings.Split(ui, "\n")
-
-	var bad []string
-	for i, l := range lines {
-		if !strings.Contains(l, `method: "POST"`) {
-			continue
-		}
-		end := i + 8
-		if end > len(lines) {
-			end = len(lines)
-		}
-		window := strings.Join(lines[i:end], "\n")
-		if !strings.Contains(window, "body:") {
-			continue // no body at all: legitimate (a bare trigger)
-		}
-		if strings.Contains(window, "JSON.stringify") || strings.Contains(window, "FormData") {
-			continue
-		}
-		bad = append(bad, strings.TrimSpace(l))
-	}
-	if len(bad) > 0 {
-		t.Errorf("%d POST call(s) send a non-string body:", len(bad))
-		for _, b := range bad {
-			if len(b) > 100 {
-				b = b[:100]
-			}
-			t.Errorf("    %s", b)
-		}
-	}
-}
-
-// TestUI_ImagePageReportsServerErrors pins that a failed generation surfaces
-// something actionable. The production bug produced a bare "400 Bad Request"
-// toast; the requirement is that the gateway's own message reaches the page.
-func TestUI_ImagePageReportsServerErrors(t *testing.T) {
-	body := sendImageSource(t)
-
-	// api() throws Error(j.error.message) on !r.ok, so appending e.message is
-	// what puts the explanation on screen.
-	if !strings.Contains(body, "e && e.message") {
-		t.Error("sendImage() does not surface the server's error message; a " +
-			"failure would show a bare status with no cause")
-	}
-	// And a success carrying no image must not look like a success.
-	if !strings.Contains(body, "imgNoData") {
-		t.Error("sendImage() does not warn when the upstream returns no image")
-	}
-}
-
-// sendImageSource returns the text of sendImage() only, so an assertion cannot
-// be satisfied by a string that happens to appear elsewhere in the file.
-func sendImageSource(t *testing.T) string {
-	t.Helper()
-	ui := uiSource(t)
-	i := strings.Index(ui, "async function sendImage(")
-	if i < 0 {
-		t.Fatal("sendImage() not found")
-	}
-	body := ui[i:]
-	if end := strings.Index(body[1:], "\n      function "); end > 0 {
-		body = body[:end+1]
-	}
-	return body
-}