feat: 增强配置文件恢复机制，支持损坏文件的备份和恢复

.gitignore

@@ -73,3 +73,4 @@ deepseek2api旧版/
 chat.deepseek.com.har.txt
 chat.deepseek.com2.har.txt
 chat.deepseek.com/
+chat.deepseek.com3.har

internal/config/config_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -462,3 +463,110 @@ func TestAccountTestStatusIsRuntimeOnlyAndNotPersisted(t *testing.T) {
 		t.Fatalf("expected test_status to stay out of persisted config, got: %s", content)
 	}
 }
+
+func TestLoadConfigRecoversFromCorruptFileWithBackup(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/config.json"
+	bakPath := path + ".bak"
+	good := `{"keys":["backup-key"],"accounts":[{"email":"u@example.com","password":"p"}]}`
+	if err := os.WriteFile(bakPath, []byte(good), 0o644); err != nil {
+		t.Fatalf("write bak: %v", err)
+	}
+	if err := os.WriteFile(path, []byte(`{broken-json`), 0o644); err != nil {
+		t.Fatalf("write corrupt: %v", err)
+	}
+
+	cfg, err := loadConfigFromFile(path)
+	if err != nil {
+		t.Fatalf("expected recovery to avoid error, got: %v", err)
+	}
+	if len(cfg.Keys) != 1 || cfg.Keys[0] != "backup-key" {
+		t.Fatalf("expected recovery from backup key, got keys=%#v", cfg.Keys)
+	}
+	content, rerr := os.ReadFile(path)
+	if rerr != nil {
+		t.Fatalf("read recovered path: %v", rerr)
+	}
+	if !strings.Contains(string(content), "backup-key") {
+		t.Fatalf("expected path restored from backup, got: %s", content)
+	}
+	matches, _ := filepath.Glob(dir + "/config.json.corrupt.*")
+	if len(matches) == 0 {
+		t.Fatalf("expected corrupt snapshot to be preserved")
+	}
+}
+
+func TestLoadConfigResetsCorruptFileWithoutBackup(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/config.json"
+	if err := os.WriteFile(path, []byte(`{broken`), 0o644); err != nil {
+		t.Fatalf("write corrupt: %v", err)
+	}
+
+	cfg, err := loadConfigFromFile(path)
+	if err != nil {
+		t.Fatalf("expected reset to avoid error, got: %v", err)
+	}
+	if len(cfg.Keys) != 0 || len(cfg.Accounts) != 0 {
+		t.Fatalf("expected empty config after reset, got keys=%d accounts=%d", len(cfg.Keys), len(cfg.Accounts))
+	}
+	content, rerr := os.ReadFile(path)
+	if rerr != nil {
+		t.Fatalf("read reset path: %v", rerr)
+	}
+	if strings.TrimSpace(string(content)) != "{}" {
+		t.Fatalf("expected path reset to {}, got: %s", content)
+	}
+}
+
+func TestLoadConfigResetsCorruptFileWithCorruptBackup(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/config.json"
+	bakPath := path + ".bak"
+	if err := os.WriteFile(bakPath, []byte(`{also-broken`), 0o644); err != nil {
+		t.Fatalf("write corrupt bak: %v", err)
+	}
+	if err := os.WriteFile(path, []byte(`{broken`), 0o644); err != nil {
+		t.Fatalf("write corrupt: %v", err)
+	}
+
+	cfg, err := loadConfigFromFile(path)
+	if err != nil {
+		t.Fatalf("expected reset to avoid error, got: %v", err)
+	}
+	if len(cfg.Keys) != 0 {
+		t.Fatalf("expected empty config after reset, got keys=%d", len(cfg.Keys))
+	}
+	content, rerr := os.ReadFile(path)
+	if rerr != nil {
+		t.Fatalf("read reset path: %v", rerr)
+	}
+	if strings.TrimSpace(string(content)) != "{}" {
+		t.Fatalf("expected path reset to {}, got: %s", content)
+	}
+}
+
+func TestLoadConfigRefreshesBackupOnSuccessfulLoad(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/config.json"
+	bakPath := path + ".bak"
+	good := `{"keys":["live-key"],"accounts":[]}`
+	if err := os.WriteFile(path, []byte(good), 0o644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	cfg, err := loadConfigFromFile(path)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(cfg.Keys) != 1 || cfg.Keys[0] != "live-key" {
+		t.Fatalf("unexpected keys: %#v", cfg.Keys)
+	}
+	bak, rerr := os.ReadFile(bakPath)
+	if rerr != nil {
+		t.Fatalf("expected backup to be created: %v", rerr)
+	}
+	if !strings.Contains(string(bak), "live-key") {
+		t.Fatalf("expected backup to mirror live config, got: %s", bak)
+	}
+}

internal/config/store.go

@@ -130,7 +130,22 @@ func loadConfigFromFile(path string) (Config, error) {
 	}
 	var cfg Config
 	if err := json.Unmarshal(content, &cfg); err != nil {
-		return Config{}, err
+		// 配置文件损坏：保留损坏文件、尝试从 .bak 恢复、恢复失败则重置为 {}。
+		// 不返回错误，避免单点配置损坏导致整个服务启动失败（例如
+		// HuggingFace Space 重启瞬间 config.json 被截断成半截 JSON）。
+		Logger.Error("[config] config file is corrupt, attempting recovery", "path", path, "error", err)
+		if !recoverCorruptConfig(path, content) {
+			return Config{}, nil
+		}
+		content, err = os.ReadFile(path)
+		if err != nil {
+			Logger.Error("[config] re-read after recovery failed, starting with empty config", "path", path, "error", err)
+			return Config{}, nil
+		}
+		if err := json.Unmarshal(content, &cfg); err != nil {
+			Logger.Error("[config] recovered config still invalid, starting with empty config", "path", path, "error", err)
+			return Config{}, nil
+		}
 	}
 	cfg.NormalizeCredentials()
 	cfg.DropInvalidAccounts()
@@ -139,6 +154,13 @@ func loadConfigFromFile(path string) (Config, error) {
 			_ = overwriteFile(path, b, 0o644)
 		}
 	}
+	// 加载成功后刷新可用备份（仅当当前文件合法时才覆盖备份，避免用损坏
+	// 文件覆盖已知好备份）。Vercel 文件系统为临时/只读，跳过。
+	if !IsVercel() {
+		if backupErr := backupConfigFile(path, content); backupErr != nil {
+			Logger.Warn("[config] failed to refresh config backup", "path", path, "error", backupErr)
+		}
+	}
 	return cfg, nil
 }
 

internal/config/store_env_writeback.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 )
 
 func envWritebackEnabled() bool {
@@ -96,3 +97,59 @@ func writeConfigBytes(path string, b []byte) error {
 	}
 	return nil
 }
+
+// backupConfigFile 把当前合法的配置内容快照到 <path>.bak。仅在主配置解析
+// 成功后调用，确保 .bak 永远是已知合法的副本，供 recoverCorruptConfig 使用。
+func backupConfigFile(path string, content []byte) error {
+	if len(content) == 0 {
+		return nil
+	}
+	return overwriteFile(path+".bak", content, 0o644)
+}
+
+// resetConfigToEmpty 把 path 重置为 {}，用于损坏文件无可恢复备份时的兜底。
+func resetConfigToEmpty(path string) {
+	if werr := writeConfigBytes(path, []byte("{}")); werr != nil {
+		Logger.Warn("[config] failed to reset config to empty", "path", path, "error", werr)
+	}
+}
+
+// recoverCorruptConfig 处理主配置文件解析失败的情况：
+//  1. 将损坏文件另存为 <path>.corrupt.<unix> 便于排查
+//  2. 尝试用 <path>.bak 恢复；备份不存在或也损坏则把 path 重置为 {}
+//
+// 返回 true 表示 path 现在指向一个合法的（可能是空的）配置文件。这样避免
+// 单点配置损坏导致整个服务启动失败（例如 HuggingFace Space 重启瞬间
+// config.json 被截断成半截 JSON）。
+func recoverCorruptConfig(path string, corruptContent []byte) bool {
+	corruptPath := fmt.Sprintf("%s.corrupt.%d", path, time.Now().Unix())
+	if werr := overwriteFile(corruptPath, corruptContent, 0o644); werr != nil {
+		Logger.Warn("[config] failed to preserve corrupt config for inspection", "path", corruptPath, "error", werr)
+	}
+
+	bakPath := path + ".bak"
+	bakContent, rerr := os.ReadFile(bakPath)
+	if rerr != nil {
+		Logger.Warn("[config] no backup available, resetting config to empty", "path", path, "bak_path", bakPath, "error", rerr)
+		resetConfigToEmpty(path)
+		return true
+	}
+	if len(strings.TrimSpace(string(bakContent))) == 0 {
+		Logger.Warn("[config] backup is empty, resetting config to empty", "path", path, "bak_path", bakPath)
+		resetConfigToEmpty(path)
+		return true
+	}
+	var probe Config
+	if perr := json.Unmarshal(bakContent, &probe); perr != nil {
+		Logger.Warn("[config] backup is also corrupt, resetting config to empty", "path", path, "bak_path", bakPath, "error", perr)
+		resetConfigToEmpty(path)
+		return true
+	}
+	if werr := writeConfigBytes(path, bakContent); werr != nil {
+		Logger.Error("[config] failed to restore config from backup, resetting to empty", "path", path, "bak_path", bakPath, "error", werr)
+		resetConfigToEmpty(path)
+		return true
+	}
+	Logger.Info("[config] recovered config from backup", "path", path, "bak_path", bakPath)
+	return true
+}