fix(providers): 供应商名称唯一性防护，修复同名静默覆盖导致 API Key 丢失 — bump to v0.8.6

src/App.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useReducer, useState } from "react";
+import { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { invoke } from "@tauri-apps/api/core";
 import { getCurrentWindow } from "@tauri-apps/api/window";
 import { useConfig } from "./hooks/useConfig";
@@ -99,7 +99,20 @@ export default function App() {
   const [pendingNewProviders, setPendingNewProviders] = useState<Set<string>>(
     () => new Set(),
   );
+  // The provider an earlier name collision overwrote in memory, held so it
+  // can be put back. Non-null means the in-memory config is missing an entry,
+  // so trySave hard-blocks on it; the rename / delete paths restore it.
+  const displacedRef = useRef<{ key: string; provider: Provider } | null>(null);
 
+  // Every "abandon the in-memory config" path goes through here. The reload
+  // brings back the on-disk truth, which includes whatever a collision
+  // displaced, so the stash is obsolete once the reload has actually
+  // returned. Clearing it only afterwards keeps a *failed* reload (config
+  // unchanged, still collided) from looking clean to trySave.
+  const reloadFromDisk = useCallback(async () => {
+    await refresh();
+    displacedRef.current = null;
+  }, [refresh]);
 
   useEffect(() => {
     if (!loading) {
@@ -170,6 +183,26 @@ export default function App() {
     async (target?: string): Promise<boolean> => {
       if (!config) return false;
       if (dirty) {
+        // Hard blocks ahead of the completeness confirm. Both describe a
+        // config that loses data the moment it reaches disk, so there is
+        // nothing here for the user to confirm.
+        if (displacedRef.current) {
+          alert(t("saveBlockedDisplaced"));
+          return false;
+        }
+        const blankNames = Object.keys(config.providers).filter(
+          (key) => key.trim() === ""
+        );
+        if (blankNames.length > 0) {
+          // JSON.stringify keeps a blank name readable in the message —
+          // joining the raw keys renders as nothing after the colon.
+          alert(
+            t("saveBlockedNameConflict", {
+              names: blankNames.map((k) => JSON.stringify(k)).join(", "),
+            })
+          );
+          return false;
+        }
         const issues = validateProviders(config, config.models, tGeneric, target);
         if (issues.length > 0) {
           const summary = issues
@@ -203,7 +236,7 @@ export default function App() {
         case "R":
           e.preventDefault();
           if (dirty && !confirm(t("unsavedConfirm"))) return;
-          refresh();
+          void reloadFromDisk();
           break;
         case "o":
         case "O":
@@ -216,7 +249,7 @@ export default function App() {
     };
     window.addEventListener("keydown", handler);
     return () => window.removeEventListener("keydown", handler);
-  }, [trySave, refresh, dirty, t, agent]);
+  }, [trySave, reloadFromDisk, dirty, t, agent]);
 
   // "Add provider" opens the preset picker; the empty form is reachable via
   // the picker's "+ custom config" entry (handleAddCustomProvider).
@@ -228,7 +261,15 @@ export default function App() {
   const handleAddCustomProvider = () => {
     if (!config) return;
     setShowPresetPicker(false);
-    const name = `provider-${providers.length + 1}`;
+    // Counting alone can land on a taken name (delete `provider-2`, add:
+    // `provider-3` may already exist), and that collision would silently
+    // overwrite an existing provider before the user types anything.
+    let n = providers.length + 1;
+    let name = `provider-${n}`;
+    while (name in config.providers) {
+      n++;
+      name = `provider-${n}`;
+    }
     const defaultType = agent === "kimi_code" ? "kimi" : "openai";
     updateConfig((cfg) => ({
       ...cfg,
@@ -292,6 +333,16 @@ export default function App() {
       const oldEntry = Object.entries(providers).find(
         ([, p]) => p.name === editingProvider
       );
+      const oldKey = oldEntry ? oldEntry[0] : editingProvider;
+      // Judged against the pre-change map: the name this write lands on is
+      // exactly the entry the overwrite below would destroy without a trace.
+      const displacedKey =
+        provider.name !== oldKey && provider.name in cfg.providers
+          ? provider.name
+          : null;
+      // Both branches assign `next`; the initial value is only there so
+      // TypeScript can infer its type.
+      let next = cfg;
       if (oldEntry && oldEntry[0] !== provider.name) {
         delete providers[oldEntry[0]];
         // Re-key this provider's model aliases so the `<provider>/<model>`
@@ -317,10 +368,37 @@ export default function App() {
         // pool entries.
         const raw_other = rekeySubagentPoolAliases(cfg.raw_other, aliasMap);
         setEditingProvider(provider.name);
-        return { ...cfg, providers, models, default_model, raw_other };
+        next = { ...cfg, providers, models, default_model, raw_other };
+      } else {
+        providers[provider.name] = provider;
+        next = { ...cfg, providers };
       }
-      providers[provider.name] = provider;
-      return { ...cfg, providers };
+      // Put back the entry an earlier collision displaced. This must run
+      // AFTER the rename above moved the edited provider off that key: while
+      // the edited entry still holds it, the key is present in `providers`
+      // and the condition would never fire. Running it before the stashing
+      // below also empties the ref, so a second collision in a row can stash
+      // its own victim instead of being skipped.
+      if (
+        displacedRef.current &&
+        provider.name !== displacedRef.current.key &&
+        !(displacedRef.current.key in providers)
+      ) {
+        providers[displacedRef.current.key] = displacedRef.current.provider;
+        displacedRef.current = null;
+      }
+      // Stash whatever this write is about to overwrite. The write itself
+      // still goes through: the name input is controlled and reports every
+      // keystroke, so rejecting a colliding one would make the text jump back
+      // as the user types. Keeping the loss out of config.toml is trySave's
+      // job, not the input's.
+      if (displacedKey && displacedRef.current == null) {
+        displacedRef.current = {
+          key: displacedKey,
+          provider: cfg.providers[displacedKey],
+        };
+      }
+      return next;
     });
   };
 
@@ -329,6 +407,14 @@ export default function App() {
     updateConfig((cfg) => {
       const providers = { ...cfg.providers };
       delete providers[name];
+      // The stash holds a provider an earlier collision overwrote in memory.
+      // Deleting frees the key the edited entry was squatting on, so the
+      // displaced provider can go back instead of staying stranded — a
+      // stranded stash blocks every later save until the user discards.
+      if (displacedRef.current && !(displacedRef.current.key in providers)) {
+        providers[displacedRef.current.key] = displacedRef.current.provider;
+        displacedRef.current = null;
+      }
       const models = { ...cfg.models };
       const removedAliases: string[] = [];
       for (const key of Object.keys(models)) {
@@ -371,19 +457,25 @@ export default function App() {
   };
 
   const handleDuplicateProvider = async (name: string) => {
+    if (!config) return;
+    const src = config.providers[name];
+    if (!src) return;
+    // Resolved outside the updater so the toast below can name the entry that
+    // was actually created (`-copy-2` and up when `-copy` is taken). The
+    // closure's config is the same map the updater starts from.
+    let newName = `${name}-copy`;
+    let n = 2;
+    while (config.providers[newName]) {
+      newName = `${name}-copy-${n}`;
+      n++;
+    }
     updateConfig((cfg) => {
-      const src = cfg.providers[name];
-      if (!src) return cfg;
-      let newName = `${name}-copy`;
-      let n = 2;
-      while (cfg.providers[newName]) {
-        newName = `${name}-copy-${n}`;
-        n++;
-      }
+      const source = cfg.providers[name];
+      if (!source) return cfg;
       // Clone the provider (deactivated, clear its remembered default model
       // since the model aliases will be re-keyed to the new name below).
       const copied = setProviderDefaultModel(
-        { ...src, name: newName, active: false },
+        { ...source, name: newName, active: false },
         null
       );
       const providers = { ...cfg.providers, [newName]: copied };
@@ -395,7 +487,7 @@ export default function App() {
     // No immediate save: the copy lives in memory only, like every other
     // edit. Abandoning (back → discard) must leave the config unchanged;
     // the copy persists when the user saves (Ctrl+S / footer / switch).
-    setSwitchMessage(t("copiedProvider", { name: `${name}-copy` }));
+    setSwitchMessage(t("copiedProvider", { name: newName }));
     setTimeout(() => setSwitchMessage(null), 3000);
   };
 
@@ -468,7 +560,7 @@ export default function App() {
     if (!saved) {
       // Validation was cancelled: undo the in-memory switch by reloading
       // the on-disk state, and skip the activation + /reload nudge.
-      await refresh();
+      await reloadFromDisk();
       return;
     }
     await invoke("activate_agent_config_command", { agent });
@@ -495,17 +587,29 @@ export default function App() {
         next.delete(target);
         return next;
       });
-      await refresh();
+      await reloadFromDisk();
     } else if (dirty) {
       // Real edits to a previously-saved provider — keep the existing
       // unsaved-changes confirm so the user doesn't lose work by accident.
       if (!confirm(t("unsavedConfirm"))) return;
-      await refresh();
+      await reloadFromDisk();
     }
     setView("list");
   };
 
   const handleApplyProviderJson = (provider: Provider, models: Model[]) => {
+    if (!config) return;
+    // Source-level rejection: applying is a single deliberate action, so
+    // refusing here leaves both the panel and the config untouched (unlike
+    // the name input, which takes every keystroke and stashes the loss).
+    if (provider.name.trim() === "") {
+      alert(t("validationNameEmpty"));
+      return;
+    }
+    if (provider.name !== editingProvider && provider.name in config.providers) {
+      alert(t("applyJsonNameConflict"));
+      return;
+    }
     updateConfig((cfg) => {
       const providers = { ...cfg.providers };
       const oldName = editingProvider;
@@ -581,7 +685,7 @@ export default function App() {
             <button
               type="button"
               className="mt-2 px-2 py-1 border border-red-400/30 rounded hover:bg-red-900/30"
-              onClick={() => refresh()}
+              onClick={() => void reloadFromDisk()}
             >
               {t("retry")}
             </button>
@@ -746,9 +850,18 @@ export default function App() {
             agent={agent}
           />
         ) : currentProvider ? (
+          // `nameConflict` is read from the displaced-entry stash during
+          // render: the collision write happens inside updateConfig's
+          // updater, which sets the ref before React re-renders, so this pass
+          // already sees the new value (same precedent as setEditingProvider
+          // inside that updater).
           <ProviderEdit
             agent={agent}
             provider={currentProvider}
+            allProviderNames={Object.keys(config.providers).filter(
+              (k) => k !== editingProvider
+            )}
+            nameConflict={displacedRef.current != null}
             models={Object.values(config.models).filter(
               (m) => m.provider === currentProvider.name
             )}
@@ -914,7 +1027,7 @@ export default function App() {
               if (dirty && !confirm(t("unsavedConfirm"))) {
                 return;
               }
-              refresh();
+              void reloadFromDisk();
             }}
             disabled={loading}
             className="px-3 py-1.5 text-sm border border-border rounded hover:bg-hover-2 focus:ring-2 focus:ring-blue-500 focus:outline-none disabled:opacity-50"

src/components/ProviderEdit.tsx

@@ -12,6 +12,7 @@ import {
   withMaxOutputSize,
 } from "../lib/model-max-output";
 import { capabilitiesFromRef, getModelRef, modelsDevReady } from "../lib/models-dev";
+import { validateProviderName } from "../lib/validation";
 import { getIconMetadata } from "../icons/extracted/metadata";
 import { KimiOAuthDialog } from "./KimiOAuthDialog";
 import { ProviderIcon } from "./ProviderIcon";
@@ -87,6 +88,15 @@ function defaultBaseUrl(agent: Agent, type: ProviderType): string {
 interface ProviderEditProps {
   agent: Agent;
   provider: Provider;
+  /** Names of every OTHER provider. Used to flag a colliding name as the
+   *  user types; the enforced gates live in App.tsx (write path + trySave),
+   *  because Ctrl+S is a window-level listener that bypasses this form. */
+  allProviderNames: string[];
+  /** Set while App holds a displaced entry: the name collides exactly with
+   *  another provider, a case `allProviderNames` cannot see (the edited
+   *  entry has already been re-keyed onto the colliding name and is
+   *  excluded there). */
+  nameConflict?: boolean;
   models: Model[];
   defaultModel: string | null;
   onBack: () => void;
@@ -104,6 +114,8 @@ interface ProviderEditProps {
 export function ProviderEdit({
   agent,
   provider,
+  allProviderNames,
+  nameConflict,
   models,
   defaultModel,
   onBack,
@@ -129,6 +141,14 @@ export function ProviderEdit({
   const [showIconPicker, setShowIconPicker] = useState(false);
   const [kimiOAuthOpen, setKimiOAuthOpen] = useState(false);
 
+  // Display layer only. The enforced gates are the write path in App.tsx
+  // (which stashes whatever a collision overwrites) and trySave; Ctrl+S is a
+  // window-level listener, so a disabled button here cannot stop a save.
+  const nameIssue = validateProviderName(allProviderNames, provider.name);
+  // An exact collision is invisible to the check above (see `nameConflict`),
+  // so the stash flag has to widen the highlight too.
+  const nameError = nameIssue != null || nameConflict === true;
+
   // Preset this provider was created from (if any) — provides the
   // "Get API Key" / referral links shown under the key input.
   const preset = findPresetForProvider(provider);
@@ -170,7 +190,8 @@ export function ProviderEdit({
         <button
           type="button"
           onClick={onSave}
-          className="px-3 py-1.5 text-sm bg-green-600 hover:bg-green-700 text-white rounded focus:ring-2 focus:ring-green-500 focus:outline-none"
+          disabled={nameError}
+          className="px-3 py-1.5 text-sm bg-green-600 hover:bg-green-700 text-white rounded focus:ring-2 focus:ring-green-500 focus:outline-none disabled:opacity-50"
         >
           {t("saveConfig")}
         </button>
@@ -248,10 +269,21 @@ export function ProviderEdit({
                   </label>
                   <input
                     id={nameId}
-                    className="w-full bg-input border border-border rounded-lg px-3 py-2 text-sm focus:ring-2 focus:ring-blue-500 focus:outline-none"
+                    className={`w-full bg-input border rounded-lg px-3 py-2 text-sm focus:ring-2 focus:outline-none ${
+                      nameError
+                        ? "border-red-500 focus:ring-red-500"
+                        : "border-border focus:ring-blue-500"
+                    }`}
                     value={provider.name}
                     onChange={(e) => onChange({ ...provider, name: e.target.value })}
                   />
+                  {nameError && (
+                    <p className="mt-1.5 text-sm text-red-400">
+                      {nameIssue === "empty"
+                        ? t("validationNameEmpty")
+                        : t("validationNameDuplicate")}
+                    </p>
+                  )}
                 </div>
                 <div>
                   <label htmlFor={noteId} className="block text-sm text-content-muted mb-1.5">

src/i18n/en.ts

@@ -17,6 +17,12 @@ export const enTranslations: Record<TranslationKey, string> = {
   validationBlankModels: "Model entries with empty model id: {aliases}",
   saveValidationConfirm:
     "The following providers are not fully configured. Save anyway?\n\n{details}\n\n(Click OK to save to config.toml as-is; click Cancel to keep editing.)",
+  validationNameEmpty: "Provider name is required",
+  validationNameDuplicate: "Name conflicts with another provider",
+  saveBlockedNameConflict: "Save blocked: duplicate or empty provider names: {names}",
+  applyJsonNameConflict: "Name in JSON conflicts with another provider; not applied",
+  saveBlockedDisplaced:
+    "Save blocked: a provider was overwritten by a name conflict during this edit; go back and discard changes, then retry",
   providerNotFound: "Provider not found",
   backToList: "Back to list",
   syncToOmp: "Sync to OMP",

src/i18n/zh.ts

@@ -15,6 +15,11 @@ export const zhTranslations = {
   validationBlankModels: "存在未填写 model id 的模型：{aliases}",
   saveValidationConfirm:
     "以下供应商尚未完成配置，仍要保存吗？\n\n{details}\n\n（点击「确定」仍会保存到 config.toml；点击「取消」可继续编辑）",
+  validationNameEmpty: "供应商名称不能为空",
+  validationNameDuplicate: "名称与其他供应商重复",
+  saveBlockedNameConflict: "保存已阻止：以下供应商名称冲突或为空：{names}",
+  applyJsonNameConflict: "JSON 中的名称与其他供应商重复，未应用",
+  saveBlockedDisplaced: "保存已阻止：本次编辑曾发生同名覆盖，请返回并丢弃更改后重试",
   providerNotFound: "供应商不存在",
   backToList: "返回列表",
   syncToOmp: "同步到 OMP",

src/lib/validation.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { validateProviderName } from "./validation";
+
+describe("validateProviderName", () => {
+  it("reports an empty name, including a whitespace-only one", () => {
+    expect(validateProviderName(["TokenHub"], "")).toBe("empty");
+    expect(validateProviderName(["TokenHub"], "   ")).toBe("empty");
+    expect(validateProviderName([], "")).toBe("empty");
+  });
+
+  it("reports a duplicate when another provider already holds the name", () => {
+    expect(validateProviderName(["TokenHub", "other"], "TokenHub")).toBe("duplicate");
+  });
+
+  it("treats case-different names as distinct (case-sensitive exact match)", () => {
+    expect(validateProviderName(["TokenHub"], "tokenhub")).toBe(null);
+    expect(validateProviderName(["tokenhub"], "TokenHub")).toBe(null);
+  });
+
+  it("trims the candidate name before comparing", () => {
+    expect(validateProviderName(["TokenHub"], " TokenHub ")).toBe("duplicate");
+  });
+
+  it("trims the existing names before comparing", () => {
+    expect(validateProviderName([" Foo "], "Foo")).toBe("duplicate");
+  });
+
+  it("accepts a unique name", () => {
+    expect(validateProviderName(["TokenHub", "other"], "TokenHub-2")).toBe(null);
+    expect(validateProviderName([], "TokenHub")).toBe(null);
+  });
+
+  it("prefers 'empty' over 'duplicate' for a blank name", () => {
+    expect(validateProviderName(["   "], "   ")).toBe("empty");
+  });
+});

src/lib/validation.ts

@@ -87,3 +87,31 @@ export function validateProviders(
   }
   return issues;
 }
+
+export type ProviderNameIssue = "empty" | "duplicate";
+
+/**
+ * Check a single provider name against the names of all OTHER providers.
+ * Providers are keyed by name in the config, so a name collision silently
+ * overwrites the existing entry — this helper is the shared gate for both
+ * the edit-page hint and the write-path rejection.
+ *
+ * Comparison is a case-sensitive exact match after trimming, on purpose:
+ * the name IS the storage key, so `TokenHub` and `tokenhub` are two distinct
+ * providers that can coexist. Normalizing (lowercasing, stripping inner
+ * whitespace) would reject names the storage layer accepts, and would block
+ * users who deliberately keep a case-variant copy of a provider.
+ *
+ * Returns "empty" for a blank name (checked first — a blank name has no
+ * meaningful collision semantics), "duplicate" when `allNames` already holds
+ * the trimmed name, and null otherwise.
+ */
+export function validateProviderName(
+  allNames: string[], // names of all OTHER providers (current entry excluded)
+  name: string, // the name being validated
+): ProviderNameIssue | null {
+  const trimmed = name.trim();
+  if (trimmed === "") return "empty";
+  if (allNames.some((other) => other.trim() === trimmed)) return "duplicate";
+  return null;
+}