kaiyuan/chatgpt-on-wechat
1
0
Fork 0
mirror of https://github.com/zhayujie/chatgpt-on-wechat.git synced 2026-07-17 11:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor(custom): id-based routing, single source of truth, security fixes

Browse Source 
Rework the multi custom-provider design per maintainer review:

1. Data model: use server-generated uuid4 short id as primary key;
   'name' is now a pure display label that can be freely renamed.

2. Routing: drop 'custom_active_provider'; activate a provider by
   setting bot_type to 'custom:<id>'. Single source of truth — no
   pointer drift between bot_type and a separate active selector.

3. Security: drag_sensitive() now recursively masks api_key/secret in
   nested structures (custom_providers list); previously only top-level
   string fields were masked.

4. Per-provider model: the provider's 'model' field now takes effect on
   the main chat path and agent path (was silently ignored before).

5. XSS fix: replace all inline onclick handlers in custom-provider UI
   with data-* attributes + event delegation. Provider names never
   appear in executable HTML contexts.

Legacy compatibility: bot_type='custom' (no colon) still reads the flat
custom_api_key/custom_api_base fields byte-for-byte identically.

Closes: consolidates #2876 into this PR as requested.
Ref: #2838
This commit is contained in:
kirs-hi
2026-06-11 17:25:24 +08:00
parent cffa590d3e
commit 1940d628a8
11 changed files with 504 additions and 353 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
docs/ja/models/custom.mdx
View File

@@ -1,21 +1,21 @@
---
title: カスタム
description: カスタムベンダー設定。サードパーティ API プロキシやローカルモデル向け
title: Custom
description: Custom vendor configuration for third-party API proxies and local models
---
OpenAI 互換プロトコルで接続するサードパーティのモデルサービスや、ローカルにデプロイしたモデルに適しています。例えば：
For model services accessed via the OpenAI-compatible protocol or locally deployed models, such as:
- **サードパーティ API プロキシ**：統一された API Base から複数のモデルを呼び出す
- **ローカルモデル**：Ollama、vLLM、LocalAI などのツールでローカルにデプロイしたモデル
- **プライベートデプロイ**：企業内部にデプロイしたモデルサービス
- **Third-party API proxies**: call multiple models through a unified API base
- **Local models**: models deployed locally with tools like Ollama, vLLM, LocalAI
- **Private deployments**: model services deployed inside an enterprise
<Note>
`openai` ベンダーとの違い：カスタムベンダーを選択した場合、`/config model` でモデルを切り替えてもベンダータイプは自動で切り替わらず、常にカスタムの API アドレスを使用します。
Difference from the `openai` vendor: when a custom vendor is selected, switching models via `/config model` does not automatically switch the vendor type — the custom API address is always used.
</Note>
## テキスト対話
## Text Chat
### サードパーティ API プロキシ
### Third-party API proxy
```json
{
@@ -26,16 +26,16 @@ OpenAI 互換プロトコルで接続するサードパーティのモデルサ
}
```
| パラメータ | 説明 |
| Parameter | Description |
| --- | --- |
| `bot_type` | `custom` に設定する必要があります |
| `model` | モデル名。プロキシサービスがサポートする任意のモデル名を指定 |
| `custom_api_key` | API キー。プロキシサービスから提供されます |
| `custom_api_base` | API アドレス。プロキシサービスから提供され、OpenAI プロトコル互換である必要があります |
| `bot_type` | Must be set to `custom` |
| `model` | Model name; any model name supported by the proxy service |
| `custom_api_key` | API key provided by the proxy service |
| `custom_api_base` | API endpoint provided by the proxy service; must be OpenAI-compatible |
### ローカルモデル
### Local models
ローカルモデルは通常 API Key が不要で、API Base のみ設定します：
Local models usually do not require an API key — only the API base needs to be filled in:
```json
{
@@ -45,38 +45,39 @@ OpenAI 互換プロトコルで接続するサードパーティのモデルサ
}
```
一般的なローカルデプロイツールとデフォルトアドレス：
Common local deployment tools and their default endpoints:
| ツール | デフォルト API Base |
| Tool | Default API Base |
| --- | --- |
| [Ollama](https://ollama.com) | `http://localhost:11434/v1` |
| [vLLM](https://docs.vllm.ai) | `http://localhost:8000/v1` |
| [LocalAI](https://localai.io) | `http://localhost:8080/v1` |
### モデル切り替え
### Switching Models
カスタムベンダーでモデルを切り替える際は `model` のみが変更され、`bot_type` と API アドレスは変わりません：
Switching models under a custom vendor only changes `model` — `bot_type` and the API endpoint remain unchanged:
```
/config model qwen3.5:27b
```
## 複数のカスタムベンダーを設定する
## Configuring Multiple Custom Providers
複数の OpenAI 互換サードパーティサービス（例：SiliconFlow、Qiniu）を同時に設定したい場合は、`custom_providers` リストを使用し、`custom_active_provider` で現在有効なベンダーを指定します：
If you need to configure several OpenAI-compatible third-party services at once (e.g. SiliconFlow, Qiniu), use the `custom_providers` list and activate one by setting `bot_type` to `"custom:<id>"`:
```json
{
"bot_type": "custom",
"custom_active_provider": "siliconflow",
"bot_type": "custom:3f2a9c1b",
"custom_providers": [
{
"id": "3f2a9c1b",
"name": "siliconflow",
"api_key": "YOUR_SILICONFLOW_KEY",
"api_base": "https://api.siliconflow.cn/v1",
"model": "deepseek-ai/DeepSeek-V3"
},
{
"id": "a1b2c3d4",
"name": "qiniu",
"api_key": "YOUR_QINIU_KEY",
"api_base": "https://api.qnaigc.com/v1",
@@ -86,11 +87,18 @@ OpenAI 互換プロトコルで接続するサードパーティのモデルサ
}
```
| パラメータ | 説明 |
| Parameter | Description |
| --- | --- |
| `custom_providers` | カスタムベンダーのリスト。各項目に `name`、`api_key`、`api_base`、任意の `model` を含む |
| `custom_active_provider` | 有効なベンダーの `name`。空の場合はリストの最初の項目が使用される |
| `custom_providers` | List of custom providers; each item has `id`, `name`, `api_key`, `api_base`, and an optional `model` |
| `bot_type` | Set to `"custom:<id>"` to activate a specific provider; `id` is the provider's unique identifier |
| `id` | Server-generated short identifier (8-char hex); used as the primary key for each provider |
| `name` | User-facing display label — can be freely renamed without breaking anything |
| `model` | Optional; when set, this model is used instead of the global `model` field |
<Note>
`custom_providers` が空の場合、上記の単一ベンダー設定 `custom_api_key` / `custom_api_base` に自動的にフォールバックするため、既存の設定はそのまま動作します。
The `id` is auto-generated by the web console when you add a provider — you don't need to create it manually. If editing `config.json` by hand, use any unique 8-character hex string (e.g. run `python3 -c "import uuid; print(uuid.uuid4().hex[:8])"`).
</Note>
<Note>
When `bot_type` is exactly `"custom"` (no colon suffix), CowAgent uses the legacy single-provider `custom_api_key` / `custom_api_base` fields, so existing configurations keep working without any changes.
</Note>

20
docs/models/custom.mdx
View File

@@ -63,20 +63,21 @@ Switching models under a custom vendor only changes `model` — `bot_type` and t
## Configuring Multiple Custom Providers
If you need to configure several OpenAI-compatible third-party services at once (e.g. SiliconFlow, Qiniu), use the `custom_providers` list and select the active one with `custom_active_provider`:
If you need to configure several OpenAI-compatible third-party services at once (e.g. SiliconFlow, Qiniu), use the `custom_providers` list and activate one by setting `bot_type` to `"custom:<id>"`:
```json
{
"bot_type": "custom",
"custom_active_provider": "siliconflow",
"bot_type": "custom:3f2a9c1b",
"custom_providers": [
{
"id": "3f2a9c1b",
"name": "siliconflow",
"api_key": "YOUR_SILICONFLOW_KEY",
"api_base": "https://api.siliconflow.cn/v1",
"model": "deepseek-ai/DeepSeek-V3"
},
{
"id": "a1b2c3d4",
"name": "qiniu",
"api_key": "YOUR_QINIU_KEY",
"api_base": "https://api.qnaigc.com/v1",
@@ -88,9 +89,16 @@ If you need to configure several OpenAI-compatible third-party services at once
| Parameter | Description |
| --- | --- |
| `custom_providers` | List of custom providers; each item has `name`, `api_key`, `api_base`, and an optional `model` |
| `custom_active_provider` | The `name` of the active provider; when empty, the first entry in the list is used |
| `custom_providers` | List of custom providers; each item has `id`, `name`, `api_key`, `api_base`, and an optional `model` |
| `bot_type` | Set to `"custom:<id>"` to activate a specific provider; `id` is the provider's unique identifier |
| `id` | Server-generated short identifier (8-char hex); used as the primary key for each provider |
| `name` | User-facing display label — can be freely renamed without breaking anything |
| `model` | Optional; when set, this model is used instead of the global `model` field |
<Note>
When `custom_providers` is empty, CowAgent automatically falls back to the single-provider `custom_api_key` / `custom_api_base` fields above, so existing configurations keep working without any changes.
The `id` is auto-generated by the web console when you add a provider — you don't need to create it manually. If editing `config.json` by hand, use any unique 8-character hex string (e.g. run `python3 -c "import uuid; print(uuid.uuid4().hex[:8])"`).
</Note>
<Note>
When `bot_type` is exactly `"custom"` (no colon suffix), CowAgent uses the legacy single-provider `custom_api_key` / `custom_api_base` fields, so existing configurations keep working without any changes.
</Note>

64
docs/zh/models/custom.mdx
View File

@@ -1,21 +1,21 @@
---
title: 自定义
description: 自定义厂商配置，适用于第三方 API 代理和本地模型
title: Custom
description: Custom vendor configuration for third-party API proxies and local models
---
适用于通过 OpenAI 兼容协议接入的第三方模型服务或本地部署的模型，例如：
For model services accessed via the OpenAI-compatible protocol or locally deployed models, such as:
- **第三方 API 代理**：使用统一的 API Base 调用多种模型
- **本地模型**：通过 Ollama、vLLM、LocalAI 等工具在本地部署的模型
- **私有化部署**：企业内部部署的模型服务
- **Third-party API proxies**: call multiple models through a unified API base
- **Local models**: models deployed locally with tools like Ollama, vLLM, LocalAI
- **Private deployments**: model services deployed inside an enterprise
<Note>
与 `openai` 厂商的区别：选择自定义厂商后，通过 `/config model` 切换模型时，不会自动切换厂商类型，始终使用自定义的 API 地址。
Difference from the `openai` vendor: when a custom vendor is selected, switching models via `/config model` does not automatically switch the vendor type — the custom API address is always used.
</Note>
## 文本对话
## Text Chat
### 第三方 API 代理
### Third-party API proxy
```json
{
@@ -26,16 +26,16 @@ description: 自定义厂商配置，适用于第三方 API 代理和本地模
}
```
| 参数 | 说明 |
| Parameter | Description |
| --- | --- |
| `bot_type` | 必须设为 `custom` |
| `model` | 模型名称，填写代理服务支持的任意模型名 |
| `custom_api_key` | API 密钥，由代理服务提供 |
| `custom_api_base` | API 地址，由代理服务提供，需兼容 OpenAI 协议 |
| `bot_type` | Must be set to `custom` |
| `model` | Model name; any model name supported by the proxy service |
| `custom_api_key` | API key provided by the proxy service |
| `custom_api_base` | API endpoint provided by the proxy service; must be OpenAI-compatible |
### 本地模型
### Local models
本地模型通常不需要 API Key，只需填写 API Base：
Local models usually do not require an API key — only the API base needs to be filled in:
```json
{
@@ -45,38 +45,39 @@ description: 自定义厂商配置，适用于第三方 API 代理和本地模
}
```
常见的本地部署工具及默认地址：
Common local deployment tools and their default endpoints:
| 工具 | 默认 API Base |
| Tool | Default API Base |
| --- | --- |
| [Ollama](https://ollama.com) | `http://localhost:11434/v1` |
| [vLLM](https://docs.vllm.ai) | `http://localhost:8000/v1` |
| [LocalAI](https://localai.io) | `http://localhost:8080/v1` |
### 切换模型
### Switching Models
自定义厂商下切换模型时，只会修改 `model`，不会改变 `bot_type` 和 API 地址：
Switching models under a custom vendor only changes `model` — `bot_type` and the API endpoint remain unchanged:
```
/config model qwen3.5:27b
```
## 配置多个自定义厂商
## Configuring Multiple Custom Providers
如果需要同时配置多个第三方 OpenAI 兼容服务（例如硅基流动、七牛云等），可以使用 `custom_providers` 列表，并通过 `custom_active_provider` 指定当前生效的厂商：
If you need to configure several OpenAI-compatible third-party services at once (e.g. SiliconFlow, Qiniu), use the `custom_providers` list and activate one by setting `bot_type` to `"custom:<id>"`:
```json
{
"bot_type": "custom",
"custom_active_provider": "siliconflow",
"bot_type": "custom:3f2a9c1b",
"custom_providers": [
{
"id": "3f2a9c1b",
"name": "siliconflow",
"api_key": "YOUR_SILICONFLOW_KEY",
"api_base": "https://api.siliconflow.cn/v1",
"model": "deepseek-ai/DeepSeek-V3"
},
{
"id": "a1b2c3d4",
"name": "qiniu",
"api_key": "YOUR_QINIU_KEY",
"api_base": "https://api.qnaigc.com/v1",
@@ -86,11 +87,18 @@ description: 自定义厂商配置，适用于第三方 API 代理和本地模
}
```
| 参数 | 说明 |
| Parameter | Description |
| --- | --- |
| `custom_providers` | 自定义厂商列表，每项包含 `name`、`api_key`、`api_base`、可选的 `model` |
| `custom_active_provider` | 当前生效厂商的 `name`；留空时默认使用列表中的第一个厂商 |
| `custom_providers` | List of custom providers; each item has `id`, `name`, `api_key`, `api_base`, and an optional `model` |
| `bot_type` | Set to `"custom:<id>"` to activate a specific provider; `id` is the provider's unique identifier |
| `id` | Server-generated short identifier (8-char hex); used as the primary key for each provider |
| `name` | User-facing display label — can be freely renamed without breaking anything |
| `model` | Optional; when set, this model is used instead of the global `model` field |
<Note>
当 `custom_providers` 为空时，将自动回退到上文的 `custom_api_key` / `custom_api_base` 单厂商配置，已有配置无需改动即可正常工作。
The `id` is auto-generated by the web console when you add a provider — you don't need to create it manually. If editing `config.json` by hand, use any unique 8-character hex string (e.g. run `python3 -c "import uuid; print(uuid.uuid4().hex[:8])"`).
</Note>
<Note>
When `bot_type` is exactly `"custom"` (no colon suffix), CowAgent uses the legacy single-provider `custom_api_key` / `custom_api_base` fields, so existing configurations keep working without any changes.
</Note>