feat: AI assistant bubble + multi-provider temp-mail + settings view

src/server/ai-agent.ts

@@ -310,6 +310,25 @@ async function callLLM(messages: ChatMessage[]): Promise<any> {
   return JSON.parse(text);
 }
 
+// 拉取端点真实可用模型列表（GET {base}/models）。可传入未保存的 base/key 先试。
+export async function listModels(baseUrl?: string, apiKey?: string): Promise<string[]> {
+  const base = (baseUrl || getAiBaseUrl())?.replace(/\/+$/, "");
+  const key = apiKey || getAiApiKey();
+  if (!base) throw new Error("先填模型端点 base_url");
+  if (!key) throw new Error("先填 API Key");
+  const res = await fetch(`${base}/models`, { headers: { authorization: `Bearer ${key}` } });
+  const text = await res.text();
+  if (!res.ok) {
+    let msg = `拉取模型失败 HTTP ${res.status}`;
+    try { const j = JSON.parse(text); msg = j.error?.message || j.message || msg; } catch { /* keep */ }
+    throw new Error(msg);
+  }
+  let j: any; try { j = JSON.parse(text); } catch { throw new Error("端点返回非 JSON（可能不支持 /models）"); }
+  const arr: any[] = Array.isArray(j) ? j : (j.data ?? j.models ?? []);
+  const ids = arr.map((m) => (typeof m === "string" ? m : m.id ?? m.name ?? m.model)).filter(Boolean);
+  return Array.from(new Set(ids)).sort();
+}
+
 export async function runAgent(
   history: ChatMessage[],
   maxSteps = 6

src/server/index.ts

@@ -13,6 +13,7 @@ import { eventRoutes } from "./routes/events";
 import { clawAuthRoutes } from "./routes/claw-auth";
 import { cfMailRoutes } from "./routes/cf-mail";
 import { aiRoutes } from "./routes/ai";
+import { secretRoutes } from "./routes/secrets";
 import { startAllMailboxListeners } from "./listener-manager";
 import { hasClawMailConfig } from "./runtime-config";
 import { hydrateFromSupabase } from "./hydrate";
@@ -60,6 +61,7 @@ await eventRoutes(app);
 await clawAuthRoutes(app);
 await cfMailRoutes(app);
 await aiRoutes(app);
+await secretRoutes(app);
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const webRoot = join(__dirname, "../web");

src/server/routes/ai.ts

@@ -1,7 +1,7 @@
 // /api/ai/* —— 右下角 AI 气泡的后端：跑助手 + 配置 LLM 端点。
 import type { FastifyInstance } from "fastify";
 import { z } from "zod";
-import { runAgent, type ChatMessage } from "../ai-agent";
+import { runAgent, listModels, type ChatMessage } from "../ai-agent";
 import { aiConfigured, getAiConfigStatus, saveAiConfig, clearAiConfig } from "../runtime-config";
 
 const chatBody = z.object({
@@ -35,6 +35,15 @@ export async function aiRoutes(app: FastifyInstance): Promise<void> {
     return getAiConfigStatus();
   });
 
+  app.post("/api/ai/models", async (request, reply) => {
+    const body = (request.body ?? {}) as { baseUrl?: string; apiKey?: string };
+    try {
+      return { models: await listModels(body.baseUrl, body.apiKey) };
+    } catch (error) {
+      return reply.code(502).send({ error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+
   app.post("/api/ai/chat", async (request, reply) => {
     if (!aiConfigured()) {
       return reply.code(409).send({ error: "AI 未配置：请先在设置里填入模型端点(base_url)和 key" });

src/server/routes/secrets.ts

@@ -0,0 +1,28 @@
+// /api/secrets —— 在管理员门后揭示真实凭据，供设置页「凭据·可复制」用。
+// 整个 /api/* 已被 ADMIN_PASSWORD 门拦住（index.ts onRequest），没登录的人取不到。
+// 仅按需拉取（前端点「加载凭据」才调），平时不下发明文。
+import type { FastifyInstance } from "fastify";
+import { listProviders } from "../temp-providers";
+import { getClawApiKey, getDashboardCookie, getAiApiKey } from "../runtime-config";
+
+export async function secretRoutes(app: FastifyInstance): Promise<void> {
+  app.get("/api/secrets", async () => {
+    return {
+      temp: listProviders().map((p) => ({
+        id: p.id,
+        name: p.name,
+        type: p.type,
+        endpoint: p.endpoint,
+        domain: p.domain,
+        password: p.password || null
+      })),
+      claw: {
+        apiKey: getClawApiKey() ?? null,
+        hasCookie: Boolean(getDashboardCookie())
+      },
+      ai: {
+        apiKey: getAiApiKey() ?? null
+      }
+    };
+  });
+}

src/web/src/api.ts

@@ -468,6 +468,24 @@ export async function saveAiConfig(input: {
   });
 }
 
+export type SecretBundle = {
+  temp: Array<{ id: string; name: string; type: "php" | "cf"; endpoint: string; domain: string; password: string | null }>;
+  claw: { apiKey: string | null; hasCookie: boolean };
+  ai: { apiKey: string | null };
+};
+
+export async function fetchSecrets(): Promise<SecretBundle> {
+  return requestJson<SecretBundle>("/api/secrets");
+}
+
+export async function fetchAiModels(baseUrl?: string, apiKey?: string): Promise<string[]> {
+  const data = await requestJson<{ models: string[] }>("/api/ai/models", {
+    method: "POST",
+    body: JSON.stringify({ baseUrl, apiKey })
+  });
+  return data.models;
+}
+
 export async function aiChat(
   messages: AiChatMessage[]
 ): Promise<{ reply: string; toolTrace: Array<{ name: string; args: any }> }> {

src/web/src/components/SettingsView.tsx

@@ -1,9 +1,12 @@
 import { useEffect, useState } from "react";
 import {
   fetchAiConfig,
+  fetchAiModels,
   fetchCfStatus,
+  fetchSecrets,
   saveAiConfig,
   type AiConfigStatus,
+  type SecretBundle,
   type TempProviderPublic
 } from "../api";
 import { usePrefs } from "../i18n";
@@ -89,11 +92,75 @@ export function SettingsView({
   const [aiModel, setAiModel] = useState("");
   const [aiKey, setAiKey] = useState("");
   const [aiBusy, setAiBusy] = useState(false);
+  const [aiModels, setAiModels] = useState<string[]>([]);
+  const [modelsBusy, setModelsBusy] = useState(false);
 
   useEffect(() => {
     fetchAiConfig().then((c) => { setAi(c); setAiBase(c.baseUrl); setAiModel(c.model); }).catch(() => {});
   }, []);
 
+  async function loadModels() {
+    if (!aiBase.trim()) { onError(L("先填 Base URL", "Fill Base URL first")); return; }
+    setModelsBusy(true);
+    try {
+      const list = await fetchAiModels(aiBase.trim(), aiKey || undefined);
+      setAiModels(list);
+      onStatus(L(`拉到 ${list.length} 个模型`, `${list.length} models`));
+    } catch (e) {
+      onError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setModelsBusy(false);
+    }
+  }
+
+  // ---- 凭据·可复制（B 方案：揭示真实密钥/口令）----
+  const [secrets, setSecrets] = useState<SecretBundle | null>(null);
+  const [secretsBusy, setSecretsBusy] = useState(false);
+  const [revealed, setRevealed] = useState<Record<string, boolean>>({});
+
+  async function loadSecrets() {
+    setSecretsBusy(true);
+    try {
+      setSecrets(await fetchSecrets());
+    } catch (e) {
+      onError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setSecretsBusy(false);
+    }
+  }
+
+  function copyText(text: string) {
+    const done = () => onStatus(L("已复制到剪贴板", "Copied"));
+    if (navigator.clipboard?.writeText) {
+      navigator.clipboard.writeText(text).then(done).catch(() => onError(L("复制失败，手动选中吧", "Copy failed")));
+    } else {
+      onError(L("此浏览器不支持自动复制", "Clipboard unavailable"));
+    }
+  }
+
+  function maskSecret(v: string) {
+    if (v.length <= 8) return "••••••";
+    return `${v.slice(0, 4)}••••••${v.slice(-3)}`;
+  }
+
+  function secretRow(key: string, label: string, value: string | null) {
+    const shown = revealed[key];
+    return (
+      <div className="secret-row" key={key}>
+        <span className="secret-label">{label}</span>
+        <code className="secret-val">{value ? (shown ? value : maskSecret(value)) : L("未设", "not set")}</code>
+        {value && (
+          <div className="secret-ops">
+            <button className="mini-link" onClick={() => setRevealed((r) => ({ ...r, [key]: !r[key] }))}>
+              {shown ? L("🙈 隐藏", "🙈 hide") : L("👁 查看", "👁 show")}
+            </button>
+            <button className="mini-link" onClick={() => copyText(value)}>{L("复制", "copy")}</button>
+          </div>
+        )}
+      </div>
+    );
+  }
+
   async function saveAi() {
     setAiBusy(true);
     try {
@@ -177,8 +244,17 @@ export function SettingsView({
           <label className="wide"><span>Base URL</span>
             <input value={aiBase} onChange={(e) => setAiBase(e.target.value)} placeholder="https://api.example.com/v1" spellCheck={false} />
           </label>
-          <label><span>{L("模型", "Model")}</span>
-            <input value={aiModel} onChange={(e) => setAiModel(e.target.value)} placeholder="gpt-4o-mini" spellCheck={false} />
+          <label><span>
+            {L("模型", "Model")}
+            <button type="button" className="mini-link" onClick={loadModels} disabled={modelsBusy || !aiBase.trim()}>
+              {modelsBusy ? L("获取中…", "fetching…") : L("↻ 获取模型", "↻ fetch models")}
+            </button>
+          </span>
+            <input list="ai-model-list" value={aiModel} onChange={(e) => setAiModel(e.target.value)}
+              placeholder={aiModels.length ? L("选择或输入", "pick or type") : L("先点「获取模型」", "click fetch first")} spellCheck={false} />
+            <datalist id="ai-model-list">
+              {aiModels.map((m) => <option key={m} value={m} />)}
+            </datalist>
           </label>
           <label><span>API Key {ai?.hasKey ? L("（已存，留空不改）", "(saved)") : ""}</span>
             <input type="password" value={aiKey} onChange={(e) => setAiKey(e.target.value)} placeholder="sk-…" autoComplete="new-password" />
@@ -191,6 +267,39 @@ export function SettingsView({
           </div>
         </div>
       </div>
+
+      {/* ===== 凭据·可复制 ===== */}
+      <div className="settings-card">
+        <div className="settings-head">
+          <div>
+            <h3>{L("凭据 · 可复制", "Credentials · copy")}</h3>
+            <p>{L("你存的真实密钥/口令：临时源密码、claw 出口 API key、AI key。点「查看」看明文、点「复制」进剪贴板。仅本后台（已过管理员门）可见。", "Real stored secrets: temp-source passwords, claw API key, AI key. Click show / copy. Visible only inside this admin panel.")}</p>
+          </div>
+          {!secrets && (
+            <button className="primary" onClick={loadSecrets} disabled={secretsBusy}>
+              {secretsBusy ? L("加载中…", "loading…") : L("🔓 加载凭据", "🔓 Load")}
+            </button>
+          )}
+        </div>
+        {secrets && (
+          <div className="secret-list">
+            {secrets.temp.map((t) =>
+              secretRow(
+                `t:${t.id}`,
+                `${t.name} · ${t.type === "cf" ? L("x-admin-auth 口令", "x-admin-auth") : L("管理员密码", "admin password")}`,
+                t.password
+              )
+            )}
+            {secretRow("claw", L("claw 出口 · CLAW_API_KEY", "claw · CLAW_API_KEY"), secrets.claw.apiKey)}
+            {secretRow("ai", L("AI 助手 · API Key", "AI · API Key"), secrets.ai.apiKey)}
+            <div className="settings-form-foot">
+              <span className="settings-note">{L("提醒：这些是真实密钥，复制后别贴到公开地方。", "These are real secrets — don't paste them anywhere public.")}</span>
+              <span style={{ flex: 1 }} />
+              <button onClick={() => { setSecrets(null); setRevealed({}); }}>{L("收起", "Hide all")}</button>
+            </div>
+          </div>
+        )}
+      </div>
     </div>
   );
 
@@ -213,9 +322,13 @@ export function SettingsView({
         <label><span>{L("域名", "Domain")}</span>
           <input value={domain} onChange={(e) => setDomain(e.target.value)} placeholder="x.xyz" spellCheck={false} />
         </label>
-        <label><span>{L("管理员密码 / auth", "Admin password / auth")}</span>
+        <label><span>
+          {type === "cf"
+            ? L("管理员 auth（x-admin-auth 口令）", "Admin auth (x-admin-auth)")
+            : L("管理员密码（X-Admin-Password）", "Admin password (X-Admin-Password)")}
+        </span>
           <input type="password" value={password} onChange={(e) => setPassword(e.target.value)} autoComplete="new-password"
-            placeholder={editingExisting ? (editingProvider?.hasPassword ? L("已设 · 留空不改", "set · leave blank to keep") : L("未设", "not set")) : L("必填", "required")} />
+            placeholder={editingExisting ? (editingProvider?.hasPassword ? L("已设 · 留空不改（出于安全不回显）", "set · blank = keep (never echoed)") : L("未设", "not set")) : L("必填", "required")} />
         </label>
         <div className="settings-form-foot">
           {type === "cf" && (

src/web/src/styles.css

@@ -2201,7 +2201,24 @@ a:hover { text-decoration: underline; text-underline-offset: 2px; }
 }
 .settings-form label { display: flex; flex-direction: column; gap: 5px; }
 .settings-form label.wide { grid-column: 1 / -1; }
-.settings-form label span { font-size: 11.5px; color: var(--text-3); }
+.settings-form label span { font-size: 11.5px; color: var(--text-3); display: flex; align-items: center; gap: 8px; }
+.mini-link {
+  background: none; border: none; padding: 0; cursor: pointer;
+  color: var(--accent); font-size: 11px; font-weight: 500;
+}
+.mini-link:disabled { color: var(--text-3); cursor: default; }
+.secret-list { display: flex; flex-direction: column; gap: 2px; margin-top: 12px; }
+.secret-row {
+  display: flex; align-items: center; gap: 12px;
+  padding: 9px 10px; border-radius: var(--radius);
+}
+.secret-row:hover { background: var(--surface-2); }
+.secret-label { font-size: 12px; color: var(--text-2); min-width: 190px; flex-shrink: 0; }
+.secret-val {
+  flex: 1; font-family: var(--mono, ui-monospace, monospace); font-size: 12px;
+  color: var(--text); word-break: break-all; user-select: all;
+}
+.secret-ops { display: flex; gap: 12px; flex-shrink: 0; }
 .settings-form input,
 .settings-form select {
   background: var(--surface-2);