feat(HEL-560): 数据中枢接管数据源/模型池/会员，注册改一次性邀请码

主站
- 新增 m0006 invite_codes 迁移；注册强制邀请码（首个管理员除外），消码与建号
  同一事务，并发提交只有一个能成功
- 新增 /api/hub-admin/* 服务端点（共享 HUB_ADMIN_TOKEN，先于鉴权校验），供数据
  中枢桥接读写会话/密码/模型池/会员/邀请码，并提供供应商模型列表拉取
- 前端：注册表单加邀请码（桌面 login、index.html、移动端）；「系统管理」改为
  「数据中枢」入口指向 8766，原模型池与会员管理分区移除，仅留「行情管理」；
  随之清理陈旧 CSS

数据中枢
- 取消独立账号：删除 hub_admin/hub_sessions 与登录、改密、锁定逻辑，改为校验
  主站 xiaobai_session，仅管理员可进，CSRF 由会话派生，危险操作二次确认走主站
- 控制台新增数据源凭证可编辑区（原有内容一项不删）、供应商制模型池（自动拉取
  /models，失败退回卡内手动录入）、会员管理与邀请码页
- 日夜双主题：颜色收敛为同名 token 换值，SVG 改用 inline style 以吃到变量

自测
- 主站 verify_baseline 通过（498 项）；数据中枢 235 项通过
- tools/verify_datahub_console.py 端到端跑通两服务真实对话；
  tools/verify_datahub_console_ui.py 浏览器跑通门禁/凭证/模型池/会员/主题/1030 窄屏

Co-authored-by: multica-agent <github@multica.ai>

backend/application.py

@@ -50,9 +50,11 @@ from backend.features.themes.routes import ThemeRoutesMixin
 from backend.http import HttpTransportMixin
 from backend.http.dispatch import (
     AUTHENTICATED_POST_HANDLERS,
+    HUB_SERVICE_HANDLERS,
     PUBLIC_POST_HANDLERS,
     ApplicationHttpDispatchMixin,
 )
+from backend.http.hubadmin import HubAdminHttpMixin
 from backend.jobs.service import JobServiceMixin
 from backend.llm import LLMGateway
 from backend.llm.http import LLMHttpMixin
@@ -152,6 +154,7 @@ class RequestHandler(
     AlertHttpMixin,
     ReviewHttpMixin,
     LLMHttpMixin,
+    HubAdminHttpMixin,
     ApplicationHttpDispatchMixin,
     HttpTransportMixin,
     BaseHTTPRequestHandler,

backend/database/migrations/__init__.py

@@ -3,6 +3,7 @@ from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
 from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
 from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
 from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
+from .m0006_invite_codes import MIGRATION as M0006_INVITE_CODES
 from .runner import Migration, MigrationError, MigrationRunner
 
 MIGRATIONS = (
@@ -11,6 +12,7 @@ MIGRATIONS = (
     M0003_LLM_AUDIT,
     M0004_MENTOR_NOTES,
     M0005_ACCOUNT_SWITCH_GRANTS,
+    M0006_INVITE_CODES,
 )
 
 __all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]

backend/database/migrations/m0006_invite_codes.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+import sqlite3
+
+from backend.database.migrations.runner import Migration
+
+
+def create_invite_codes(connection: sqlite3.Connection) -> None:
+    connection.execute(
+        """
+        CREATE TABLE IF NOT EXISTS invite_codes (
+            code TEXT PRIMARY KEY,
+            status TEXT NOT NULL DEFAULT 'unused',
+            note TEXT NOT NULL DEFAULT '',
+            created_by INTEGER,
+            created_at TEXT NOT NULL,
+            used_by INTEGER,
+            used_at TEXT NOT NULL DEFAULT '',
+            revoked_at TEXT NOT NULL DEFAULT '',
+            FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE SET NULL,
+            FOREIGN KEY (used_by) REFERENCES users(id) ON DELETE SET NULL
+        )
+        """
+    )
+    connection.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_invite_codes_status
+        ON invite_codes(status, created_at DESC)
+        """
+    )
+
+
+MIGRATION = Migration(
+    version="0006",
+    name="create_invite_codes",
+    action=create_invite_codes,
+    signature="invite-codes:v1:code,status,note,created,used,revoked",
+)

backend/features/accounts/application.py

@@ -28,8 +28,14 @@ class AccountApplicationMixin:
     def update_membership(self, payload: dict[str, Any]) -> None:
         self.accounts.update_membership(payload)
 
-    def register_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
-        return self.accounts.register(username, password, device_hash)
+    def register_account(
+        self,
+        username: str,
+        password: str,
+        device_hash: str = "",
+        invite_code: str = "",
+    ) -> dict[str, Any]:
+        return self.accounts.register(username, password, device_hash, invite_code)
 
     def login_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
         return self.accounts.login(username, password, device_hash)

backend/features/accounts/http.py

@@ -41,6 +41,7 @@ class AccountHttpMixin:
                 str(body.get("username") or ""),
                 str(body.get("password") or ""),
                 token_hash(device_raw),
+                str(body.get("invite_code") or ""),
             )
             self._send_authenticated_session(result, HTTPStatus.CREATED, device_raw)
         except (ValueError, json.JSONDecodeError) as exc:

backend/features/accounts/repository.py

@@ -5,6 +5,9 @@ from datetime import datetime, timezone
 from typing import Any
 
 
+INVITE_CONSUMED_MESSAGE = "邀请码无效或已被使用，请联系管理员重新获取。"
+
+
 class AccountRepositoryMixin:
     """Original SQLite account persistence methods, moved without query changes."""
 
@@ -23,11 +26,14 @@ class AccountRepositoryMixin:
         username: str,
         password_salt: str,
         password_hash: str,
+        invite_code: str = "",
     ) -> dict[str, Any]:
         now = datetime.now(timezone.utc).isoformat(timespec="seconds")
         try:
             with self.connect() as connection:
                 role = "admin" if int(connection.execute("SELECT COUNT(*) FROM users").fetchone()[0]) == 0 else "user"
+                if invite_code and not self._consume_invite_code(connection, invite_code, now):
+                    raise ValueError(INVITE_CONSUMED_MESSAGE)
                 cursor = connection.execute(
                     """
                     INSERT INTO users
@@ -37,10 +43,91 @@ class AccountRepositoryMixin:
                     (username, password_salt, password_hash, role, now, now),
                 )
                 user_id = int(cursor.lastrowid)
+                if invite_code:
+                    connection.execute(
+                        "UPDATE invite_codes SET used_by = ? WHERE code = ?",
+                        (user_id, invite_code),
+                    )
         except sqlite3.IntegrityError as exc:
             raise ValueError("该账号名已被使用。") from exc
         return {"id": user_id, "username": username, "role": role, "created_at": now}
 
+    @staticmethod
+    def _consume_invite_code(
+        connection: sqlite3.Connection, code: str, used_at: str
+    ) -> bool:
+        cursor = connection.execute(
+            """
+            UPDATE invite_codes SET status = 'used', used_at = ?
+            WHERE code = ? AND status = 'unused'
+            """,
+            (used_at, code),
+        )
+        return cursor.rowcount > 0
+
+    def invite_code(self, code: str) -> dict[str, Any] | None:
+        with self.connect() as connection:
+            row = connection.execute(
+                """
+                SELECT code, status, note, created_at, used_at, revoked_at, used_by
+                FROM invite_codes WHERE code = ?
+                """,
+                (code,),
+            ).fetchone()
+        return dict(row) if row else None
+
+    def create_invite_codes(
+        self, codes: list[str], note: str, created_by: int
+    ) -> list[str]:
+        now = datetime.now(timezone.utc).isoformat(timespec="seconds")
+        with self.connect() as connection:
+            for code in codes:
+                connection.execute(
+                    """
+                    INSERT INTO invite_codes (code, status, note, created_by, created_at)
+                    VALUES (?, 'unused', ?, ?, ?)
+                    """,
+                    (code, note, created_by or None, now),
+                )
+        return list(codes)
+
+    def revoke_invite_code(self, code: str) -> bool:
+        now = datetime.now(timezone.utc).isoformat(timespec="seconds")
+        with self.connect() as connection:
+            cursor = connection.execute(
+                """
+                UPDATE invite_codes SET status = 'revoked', revoked_at = ?
+                WHERE code = ? AND status = 'unused'
+                """,
+                (now, code),
+            )
+        return cursor.rowcount > 0
+
+    def list_invite_codes(self, limit: int = 100) -> list[dict[str, Any]]:
+        with self.connect() as connection:
+            rows = connection.execute(
+                """
+                SELECT c.code, c.status, c.note, c.created_at, c.used_at, c.revoked_at,
+                       u.username AS used_by_username
+                FROM invite_codes AS c
+                LEFT JOIN users AS u ON u.id = c.used_by
+                ORDER BY c.created_at DESC, c.code
+                LIMIT ?
+                """,
+                (max(1, min(500, int(limit))),),
+            ).fetchall()
+        return [dict(row) for row in rows]
+
+    def count_invite_codes(self) -> dict[str, int]:
+        with self.connect() as connection:
+            rows = connection.execute(
+                "SELECT status, COUNT(*) AS total FROM invite_codes GROUP BY status"
+            ).fetchall()
+        counts = {"unused": 0, "used": 0, "revoked": 0}
+        for row in rows:
+            counts[str(row["status"])] = int(row["total"])
+        return counts
+
     def user_by_username(self, username: str) -> dict[str, Any] | None:
         with self.connect() as connection:
             row = connection.execute(

backend/features/accounts/service.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import secrets
 import threading
 from collections.abc import Callable
@@ -82,16 +83,123 @@ class AccountService:
     MAX_GRANTS_PER_DEVICE = 5
     SWITCH_REAUTH_MESSAGE = "该账号需重新验证"
 
-    def register(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
+    INVITE_ALPHABET = "ACDEFGHJKLMNPQRTUVWXY34679"
+    INVITE_MAX_BATCH = 20
+    INVITE_LIST_LIMIT = 500
+
+    def register(
+        self,
+        username: str,
+        password: str,
+        device_hash: str = "",
+        invite_code: str = "",
+    ) -> dict[str, Any]:
         username = username.strip()
         self.validate_input(username, password)
         with self.auth_lock:
+            code = self.checked_invite_code(invite_code)
             salt, password_digest = hash_password(password)
-            user = self.database.create_user(username, salt, password_digest)
+            user = self.database.create_user(username, salt, password_digest, code)
         result = self.create_session(user)
         self.remember_account(device_hash, int(user["id"]), fresh=True)
         return result
 
+    @classmethod
+    def normalize_invite_code(cls, value: str) -> str:
+        raw = "".join(
+            character
+            for character in str(value or "").upper()
+            if character.isalnum()
+        )
+        if raw.startswith("XB") and len(raw) == 14:
+            body = raw[2:]
+            return f"XB-{body[0:4]}-{body[4:8]}-{body[8:12]}"
+        return raw[:64]
+
+    @staticmethod
+    def mask_invite_code(code: str) -> str:
+        groups = str(code or "").split("-")
+        if len(groups) < 3:
+            return str(code or "")
+        return f"{groups[0]}-{groups[1]}-••••"
+
+    @staticmethod
+    def invite_handle(code: str) -> str:
+        return hashlib.sha256(str(code or "").encode("utf-8")).hexdigest()[:16]
+
+    def checked_invite_code(self, invite_code: str) -> str:
+        if self.database.count_users() == 0:
+            return ""
+        code = self.normalize_invite_code(invite_code)
+        if not code:
+            raise ValueError("请填写邀请码，注册需要管理员发放的一次性邀请码。")
+        record = self.database.invite_code(code)
+        status = str((record or {}).get("status") or "")
+        if not record:
+            raise ValueError("邀请码不存在，请向管理员确认。")
+        if status == "used":
+            raise ValueError("该邀请码已被使用。")
+        if status != "unused":
+            raise ValueError("该邀请码已作废。")
+        return code
+
+    def generate_invite_codes(
+        self, count: int, note: str = "", created_by: int = 0
+    ) -> list[dict[str, str]]:
+        try:
+            total = int(count or 1)
+        except (TypeError, ValueError) as exc:
+            raise ValueError("生成数量不正确。") from exc
+        if total < 1 or total > self.INVITE_MAX_BATCH:
+            raise ValueError(f"每次最多生成 {self.INVITE_MAX_BATCH} 个邀请码。")
+        codes: list[str] = []
+        while len(codes) < total:
+            body = "".join(secrets.choice(self.INVITE_ALPHABET) for _ in range(12))
+            code = f"XB-{body[0:4]}-{body[4:8]}-{body[8:12]}"
+            if code in codes or self.database.invite_code(code):
+                continue
+            codes.append(code)
+        self.database.create_invite_codes(codes, str(note or "").strip()[:60], created_by)
+        return [{"code": code, "code_id": self.invite_handle(code)} for code in codes]
+
+    def _stored_invite_code(self, reference: str) -> str:
+        normalized = self.normalize_invite_code(reference)
+        if normalized and self.database.invite_code(normalized):
+            return normalized
+        handle = str(reference or "").strip().lower()
+        for row in self.database.list_invite_codes(self.INVITE_LIST_LIMIT):
+            if self.invite_handle(str(row["code"])) == handle:
+                return str(row["code"])
+        return ""
+
+    def revoke_invite_code(self, reference: str) -> None:
+        code = self._stored_invite_code(reference)
+        record = self.database.invite_code(code) if code else None
+        if not record:
+            raise ValueError("邀请码不存在。")
+        if str(record.get("status")) == "used":
+            raise ValueError("该邀请码已被使用，无法作废。")
+        if not self.database.revoke_invite_code(code):
+            raise ValueError("该邀请码已作废。")
+
+    def invite_overview(self, limit: int = 100) -> dict[str, Any]:
+        codes = []
+        for row in self.database.list_invite_codes(limit):
+            code = str(row["code"])
+            codes.append(
+                {
+                    "code_id": self.invite_handle(code),
+                    "code_masked": self.mask_invite_code(code),
+                    "status": str(row["status"]),
+                    "note": str(row.get("note") or ""),
+                    "created_at": str(row.get("created_at") or ""),
+                    "used_at": str(row.get("used_at") or ""),
+                    "revoked_at": str(row.get("revoked_at") or ""),
+                    "used_by_username": str(row.get("used_by_username") or ""),
+                }
+            )
+        return {"summary": self.database.count_invite_codes(), "codes": codes}
+
     def login(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
         username = username.strip()
         if not username or not password:

backend/features/system/service.py

@@ -128,6 +128,7 @@ class SystemServiceMixin:
                     "base_url": profile["base_url"],
                     "model": profile["model"],
                     "configured": self._profile_configured(profile),
+                    "api_key_last4": profile["api_key"][-4:],
                 }
             )
         return {

backend/http/dispatch.py

@@ -11,6 +11,24 @@ PUBLIC_POST_HANDLERS = {
     "/api/auth/forget": "auth_forget",
 }
 
+# Service-to-service bridge for the data hub console. These paths are guarded by
+# the shared HUB_ADMIN_TOKEN header instead of a browser session, so they stay
+# out of the user-facing route registry on purpose.
+HUB_SERVICE_HANDLERS = {
+    "/api/hub-admin/session": "hub_session_check",
+    "/api/hub-admin/session/logout": "hub_session_logout",
+    "/api/hub-admin/password/check": "hub_password_check",
+    "/api/hub-admin/status": "hub_system_status",
+    "/api/hub-admin/settings/save": "hub_save_settings",
+    "/api/hub-admin/settings/test": "hub_test_model",
+    "/api/hub-admin/models/fetch": "hub_fetch_models",
+    "/api/hub-admin/members": "hub_members",
+    "/api/hub-admin/membership/save": "hub_save_membership",
+    "/api/hub-admin/invites": "hub_invites",
+    "/api/hub-admin/invites/create": "hub_create_invites",
+    "/api/hub-admin/invites/revoke": "hub_revoke_invite",
+}
+
 AUTHENTICATED_POST_HANDLERS = {
     "/api/auth/logout": "auth_logout",
     "/api/account/birth-profile": "save_birth_profile",
@@ -81,6 +99,10 @@ class ApplicationHttpDispatchMixin:
 
     def do_POST(self) -> None:
         parsed = urlparse(self.path)
+        if parsed.path in HUB_SERVICE_HANDLERS:
+            if self.require_service_token():
+                self._dispatch_named_handler(parsed.path, HUB_SERVICE_HANDLERS)
+            return
         if self._dispatch_named_handler(parsed.path, PUBLIC_POST_HANDLERS):
             return
         if not self.require_auth() or not self.require_csrf():

backend/http/handler.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import mimetypes
+import os
 import secrets
 from collections.abc import Iterable
 from http import HTTPStatus
@@ -62,6 +63,14 @@ class HttpTransportMixin:
             return False
         return True
 
+    def require_service_token(self) -> bool:
+        expected = str(os.environ.get("HUB_ADMIN_TOKEN") or "").strip()
+        supplied = self.headers.get("X-Hub-Admin-Token", "")
+        if not expected or not supplied or not secrets.compare_digest(supplied, expected):
+            self.send_json({"error": "服务令牌校验失败。"}, HTTPStatus.UNAUTHORIZED)
+            return False
+        return True
+
     def require_admin(self) -> bool:
         if str(getattr(self, "auth_user", {}).get("role") or "user") != "admin":
             self.send_json({"error": "需要管理员权限。"}, HTTPStatus.FORBIDDEN)

backend/http/hubadmin.py

@@ -0,0 +1,155 @@
+from __future__ import annotations
+
+import json
+from http import HTTPStatus
+
+from backend.features.accounts.security import token_hash, verify_password
+
+
+class HubAdminHttpMixin:
+    """Service-to-service bridge used by the data hub console (port 8766).
+
+    Every handler here is reached only after `require_service_token`, so the
+    shared `HUB_ADMIN_TOKEN` is the single trust boundary and no browser
+    session or CSRF token is involved. The data hub still verifies the site
+    session of the operator through `hub_session_check` before it exposes any
+    of these results to a page.
+    """
+
+    def _hub_body(self) -> dict:
+        return self.read_json_body(allow_empty=True)
+
+    def _hub_failure(self, exc: Exception) -> None:
+        self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
+
+    def hub_session_check(self) -> None:
+        try:
+            body = self._hub_body()
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+            return
+        raw_token = str(body.get("session_token") or "")
+        user = (
+            self.application_service.database.session_user(token_hash(raw_token))
+            if raw_token
+            else None
+        )
+        if not user:
+            self.send_json({"ok": True, "authenticated": False})
+            return
+        self.send_json(
+            {
+                "ok": True,
+                "authenticated": True,
+                "user": {
+                    "id": int(user["id"]),
+                    "username": str(user["username"]),
+                    "role": str(user.get("role") or "user"),
+                    "is_admin": str(user.get("role") or "user") == "admin",
+                },
+            }
+        )
+
+    def hub_session_logout(self) -> None:
+        try:
+            body = self._hub_body()
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+            return
+        raw_token = str(body.get("session_token") or "")
+        if raw_token:
+            self.application_service.database.delete_session(token_hash(raw_token))
+        self.send_json({"ok": True})
+
+    def hub_password_check(self) -> None:
+        try:
+            body = self._hub_body()
+            user_id = int(body.get("user_id") or 0)
+        except (TypeError, ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+            return
+        stored = self.application_service.database.user_password(user_id)
+        verified = bool(
+            stored
+            and verify_password(
+                str(body.get("password") or ""),
+                str(stored.get("password_salt") or ""),
+                str(stored.get("password_hash") or ""),
+            )
+        )
+        self.send_json({"ok": True, "verified": verified})
+
+    def hub_system_status(self) -> None:
+        service = self.application_service
+        self.send_json({"ok": True, **service.system_status(), "users": service.admin_users()})
+
+    def hub_save_settings(self) -> None:
+        try:
+            result = self.application_service.save_system_settings(self._hub_body())
+            self.send_json({"ok": True, **result})
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+
+    def hub_test_model(self) -> None:
+        try:
+            body = self._hub_body()
+            result = self.application_service.test_system_llm_profile(
+                str(body.get("model_id") or ""), body.get("profile") or {}
+            )
+            self.send_json({"ok": True, "result": result})
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+
+    def hub_fetch_models(self) -> None:
+        try:
+            body = self._hub_body()
+            models = self.application_service.fetch_llm_models(
+                str(body.get("base_url") or ""),
+                str(body.get("api_key") or ""),
+            )
+            self.send_json({"ok": True, "models": models})
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+
+    def hub_members(self) -> None:
+        service = self.application_service
+        self.send_json(
+            {
+                "ok": True,
+                "users": service.admin_users(),
+                "membership": service.system_status()["membership"],
+            }
+        )
+
+    def hub_save_membership(self) -> None:
+        try:
+            service = self.application_service
+            service.update_membership(self._hub_body())
+            self.send_json({"ok": True, "users": service.admin_users()})
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+
+    def hub_invites(self) -> None:
+        self.send_json({"ok": True, **self.application_service.accounts.invite_overview()})
+
+    def hub_create_invites(self) -> None:
+        try:
+            body = self._hub_body()
+            accounts = self.application_service.accounts
+            codes = accounts.generate_invite_codes(
+                body.get("count") or 1,
+                str(body.get("note") or ""),
+                int(body.get("created_by") or 0),
+            )
+            self.send_json({"ok": True, "created": codes, **accounts.invite_overview()})
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)
+
+    def hub_revoke_invite(self) -> None:
+        try:
+            body = self._hub_body()
+            accounts = self.application_service.accounts
+            accounts.revoke_invite_code(str(body.get("code_id") or body.get("code") or ""))
+            self.send_json({"ok": True, **accounts.invite_overview()})
+        except (ValueError, json.JSONDecodeError) as exc:
+            self._hub_failure(exc)

backend/llm/service.py

@@ -6,6 +6,7 @@ from urllib.parse import urlparse
 
 from backend.bootstrap.config import validate_text
 from backend.features.screener.compiler import LLMCompilerError, test_llm_connection
+from backend.llm import transport as llm_transport
 
 
 class LLMServiceMixin:
@@ -208,6 +209,37 @@ class LLMServiceMixin:
             start.isoformat(timespec="seconds"),
         )
 
+    def fetch_llm_models(self, base_url: str, api_key: str) -> list[str]:
+        base_url = str(base_url or "").strip().rstrip("/")
+        parsed = urlparse(base_url)
+        if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+            raise ValueError("Base URL 格式不正确。")
+        key = str(api_key or "").strip()
+        if not key:
+            key = self._stored_api_key(base_url)
+        if not key:
+            raise ValueError("该供应商尚未保存 API Key，请先填写后再拉取模型列表。")
+        try:
+            return llm_transport.list_models(
+                api_key=key,
+                base_url=base_url,
+                timeout=15,
+                user_agent="XiaobaiReviewWeb/0.5",
+            )
+        except llm_transport.OpenAIHTTPError as exc:
+            raise ValueError(exc.describe("模型列表拉取失败")) from exc
+        except llm_transport.OpenAITransportError as exc:
+            raise ValueError(f"模型列表拉取失败：{exc}") from exc
+
+    def _stored_api_key(self, base_url: str) -> str:
+        for item in self._system_credentials.get("llm_models") or []:
+            if not isinstance(item, dict):
+                continue
+            stored = str(item.get("base_url") or "").strip().rstrip("/")
+            if stored == base_url and item.get("api_key"):
+                return str(item["api_key"])
+        return ""
+
     def test_system_llm_profile(self, model_id: str, payload: dict[str, Any]) -> dict[str, Any]:
         current = next(
             (

backend/llm/transport.py

@@ -67,6 +67,37 @@ def chat_completion(
     )
 
 
+def list_models(
+    *,
+    api_key: str,
+    base_url: str,
+    timeout: int,
+    user_agent: str,
+) -> list[str]:
+    request = urllib.request.Request(
+        f"{base_url.rstrip('/')}/models",
+        headers={
+            "Authorization": f"Bearer {api_key}",
+            "User-Agent": user_agent,
+        },
+        method="GET",
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        raise OpenAIHTTPError(exc.code, _http_error_detail(exc)) from exc
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError, OSError) as exc:
+        raise OpenAITransportError(str(exc)) from exc
+    items = payload.get("data") if isinstance(payload, dict) else payload
+    models = []
+    for item in items or []:
+        name = str((item or {}).get("id") or "") if isinstance(item, dict) else str(item or "")
+        if name and name not in models:
+            models.append(name)
+    return models
+
+
 def stream_chat_completion(
     *,
     api_key: str,