给桌面应用装上 AI 大脑 — ClashMind 的智能配置管理实战

// Rust 侧：启动 AI sidecar 并等待 ready 信号
const AI_READY_TIMEOUT: Duration = Duration::from_secs(10);

pub async fn start_ai(app: &AppHandle, state: &AiSidecarState) -> Result<(), AiSidecarError> {
    let (mut rx, child) = app
        .shell()
        .sidecar("binaries/ai-service")
        .map_err(|e| AiSidecarError::SpawnFailed(e.to_string()))?
        .spawn()
        .map_err(|e| AiSidecarError::SpawnFailed(e.to_string()))?;

    let (ready_tx, ready_rx) = oneshot::channel();
    // 读取 stdout，监听 ready 信号和 JSON-RPC 响应
    // ...省略 reader task 细节

    match tokio::time::timeout(AI_READY_TIMEOUT, ready_rx).await {
        Ok(Ok(Ok(()))) => Ok(()),
        Ok(Ok(Err(e))) => { stop_ai(Some(app), state); Err(e) }
        Err(_) => { stop_ai(Some(app), state); Err(AiSidecarError::ReadyTimeout) }
    }
}

// 多 Provider 工厂：统一接口，按 provider 分发
export function createModel(settings: ProviderSettings): LanguageModel {
  const apiKey = normalizeOptionalString(settings.apiKey);
  const baseUrl = normalizeOptionalString(settings.baseUrl);

  switch (settings.provider) {
    case "openai":
      return createOpenAI({ ...(apiKey ? { apiKey } : {}), ...(baseUrl ? { baseURL: baseUrl } : {}) })(settings.model);
    case "openai_compatible": {
      if (!baseUrl) throw new Error("OpenAI Compatible 渠道缺少 Base URL");
      const compatible = createOpenAI({ ...(apiKey ? { apiKey } : {}), baseURL: baseUrl });
      // 关键：兼容网关必须强制走 .chat() 而非 Responses API
      return compatible.chat(settings.model);
    }
    case "claude":
      return createAnthropic({ ...(apiKey ? { apiKey } : {}), ...(baseUrl ? { baseURL: baseUrl } : {}) })(settings.model);
    case "gemini":
      return createGoogleGenerativeAI({ ...(apiKey ? { apiKey } : {}), ...(baseUrl ? { baseURL: baseUrl } : {}) })(settings.model);
  }
}

async function listModels(settings): Promise<ModelCatalogResult> {
  if (providerRequiresApiKey(provider) && !apiKey) {
    // 没有 Key，回退到内置列表
    return createFallbackCatalog(provider, "缺少 API Key，无法自动获取模型");
  }
  try {
    const models = await fetchModelsFromRemote(provider, apiKey, baseUrl);
    if (models.length === 0) return createFallbackCatalog(provider, "远端接口未返回可用模型");
    return { models, source: "remote" };
  } catch (error) {
    return createFallbackCatalog(provider, `自动获取模型失败: ${getErrorMessage(error)}`);
  }
}

const addRuleParameters = z.object({
  type: z.enum(["DOMAIN", "DOMAIN-SUFFIX", "DOMAIN-KEYWORD", "IP-CIDR", "GEOIP", "PROCESS-NAME", "MATCH"])
    .describe("路由规则类型"),
  value: z.string().min(1).optional().describe("规则值，MATCH 类型可省略"),
  policy: z.string().min(1).describe("目标策略或代理组"),
  position: z.enum(["prepend", "append"]).default("prepend").describe("插入位置"),
}).strict();

export const configTools = {
  add_rule: tool({
    description: "添加路由规则，返回待确认操作",
    inputSchema: addRuleParameters,
    execute: async (params) =>
      finalizeValidatedChange("add_rule", params, validateRuleParameters(params)),
  }),
  // ...
};

function finalizeValidatedChange<TAction extends string, TParams extends ConfigToolParams>(
  action: TAction, params: TParams, validation: ValidationResult,
): ConfigToolResult<TAction, TParams> {
  if (!validation.valid) return createValidationErrorResult(validation);
  return pendingConfirmation(action, params);
}

// 脱敏器：遍历 proxies，替换敏感字段
const SENSITIVE_PROXY_FIELDS = [
  "server", "password", "uuid", "key",
  "private-key", "public-key", "token", "obfs-password",
] as const;

export class ConfigSanitizer {
  sanitize(yamlContent: string) {
    const document = loadConfigDocument(yamlContent);
    const mappings: SanitizeMapping[] = [];
    let serverCounter = 0;

    for (const [index, proxy] of getProxies(document).entries()) {
      for (const field of SENSITIVE_PROXY_FIELDS) {
        if (typeof proxy[field] !== "string") continue;
        const placeholder = field === "server"
          ? `SERVER_${++serverCounter}` : "[REDACTED]";
        mappings.push({ proxyName: proxy.name, field, placeholder, originalValue: proxy[field] });
        proxy[field] = placeholder;
      }
    }
    return { sanitized: dumpConfigDocument(document), mappings };
  }
}

// Diff 生成：LCS 算法 + 中文摘要 + 占位符警告
export function generateDiff(originalYaml: string, toolResults: PendingConfigChange[]): ConfigDiff {
  const document = structuredClone(loadYamlDocument(originalYaml));
  const changes: DiffChange[] = [];
  for (const result of toolResults) applyPendingChange(document, result, changes);

  const original = dumpYamlDocument(originalDocument);
  const modified = dumpYamlDocument(document);
  const unifiedDiff = buildUnifiedDiff(original, modified);
  const summary = appendPlaceholderWarning(buildSummary(changes), unifiedDiff);
  return { original, modified, unifiedDiff, summary, changes };
}

// 摘要示例："本次将新增 1 项，调整 1 项：新增规则「DOMAIN-KEYWORD YouTube」，策略指向「Proxy」；
//           更新 DNS 配置：「上游 DNS」「增强模式」"

const result = streamText({
  model: createModel(chatParams.settings),
  system: prompt.system,
  messages: prompt.messages,
  tools: allTools,
  stopWhen: stepCountIs(5),  // 防止无限工具调用循环
});

const pendingConfigChanges: Array<{ toolCallId: string; change: PendingConfigChange }> = [];
for await (const chunk of result.fullStream) {
  switch (chunk.type) {
    case "text-delta":
      context.writeResult({ type: "text_delta", content: chunk.text });
      break;
    case "tool-call":
      context.writeResult({ type: "tool_call", name: chunk.toolName, id: chunk.toolCallId,
        input: normalizeToolInput(chunk.input) });
      break;
    case "tool-result":
      if (isPendingConfigChange(chunk.output)) {
        pendingConfigChanges.push({ toolCallId: chunk.toolCallId, change: chunk.output });
        // 多个 pending change 合并成一个统一 Diff
        const { diff, applyPayload } = await buildPendingConfigPreview(
          pendingConfigChanges.map(item => item.change),
        );
        // 推送合并后的 diff 给前端
      }
      break;
    case "finish":
      context.writeResult({ type: "done", tokensUsed: chunk.totalUsage.totalTokens });
      break;
  }
}

// Rust 侧：AI 变更前自动创建快照
const AI_SNAPSHOT_DESCRIPTION: &str = "AI 配置变更前自动备份";

pub async fn apply_config_change(
    app_handle: AppHandle,
    mihomo_state: tauri::State<'_, MihomoState>,
    original_config: String,
    modified_config: String,
) -> Result<(), AiConfigChangeError> {
    let config_file = active_config_file_path(&geoip_config);
    // 防漂移校验：当前运行配置必须和 AI 生成 diff 时的基线一致
    let current_runtime = read_runtime_config(&mihomo_state).await?;
    let original_value = serde_yaml::from_str::<serde_json::Value>(&original_config)?;
    if current_runtime != original_value {
        return Err(AiConfigChangeError::StaleBase);
    }

    // 创建快照
    let current_content = read_config_file(&config_file).await?;
    let db = db::get_db_pool(&app_handle).await?;
    create_snapshot_with_cleanup(&db, &config_file, &current_content, "ai",
        Some(AI_SNAPSHOT_DESCRIPTION)).await?;

    // 写入新配置并热重载，失败则自动回滚
    write_config_and_reload(&config_file, &modified_config, &current_content, &mihomo_state).await
}

# 安全约束（摘要）

## 明确禁止
- 禁止删除所有代理节点；任何删除操作后，至少保留一个可用节点
- 禁止删除 MATCH 兜底规则，禁止让 MATCH 不在最后一条
- 禁止修改 external-controller 和 secret
- 禁止输出、还原、猜测脱敏后的敏感字段真实值

## 必须满足
- rules 最后一条必须保留 MATCH
- 未经用户明确要求，不关闭 dns.enable
- 新增节点时，缺失敏感字段可使用占位说明，但不能伪造真实值

## 危险请求处理
- 当用户要求"删光节点""清空配置"时，直接拒绝并提供安全替代方案