[ranxianglei]

(ai: vllm-qwen/qwen3.8-27b)

Closes #3443

What

The Web UI "Save Key" button sends PUT /__bili/external-summary/credential, which was never registered on the router → permanent 404 (no such management endpoint). External-summary credentials could only be saved by hand-writing <config>.summary-credentials.json.

Root cause (git forensics)

• bcf40118d (external summary feature) added the route inline in src/server.ts.
• 273c83945 (refactor: extract the /__bili + /__acp admin route surface into src/server/admin.ts, audit: 全仓冗余审计与重构计划——server.ts 解体、客户端矩阵去重、死代码、AGENTS.md 模块图腐化 #1440 P2 cut 1) moved all admin routes out of server.ts.
• The feature branch merged AFTER the refactor (PR feat: 统一外部摘要模型、顺序故障转移与多客户端压缩接线 #2167's merge) and the new route line was silently dropped in merge resolution. The handler import stayed in server.ts as dead code; handler, UI and handler-level tests all survived — only the router wiring was lost. Existing tests call handleSummaryCredentialPut directly instead of going through the router, so CI stayed green.

Affects master and every release since (including the reporter's 0.1.197).

Changes

1. src/server/admin.ts — register PUT /__bili/external-summary/credential in handleAdminRoute next to the config routes; inherits the same loopback + trusted-origin gates as the sibling admin paths (the gates sit above the registration).
2. tests/web-routing.test.ts — regression test through the REAL proxy/router (startServer, port 0): malformed body → 400; save → 200 {ok, configured:true} with no key echo and the private store file written; GET /__bili/config reflects secret:<name> status; delete (key: null) → configured:false. Verified red without change 1 (404) and green with it.
3. src/server.ts — drop the dead web-handler import left by the admin-route extraction (all nine symbols unused; same refactor-debris family). Separate labeled commit.

Behavior change (old → new)

• PUT /__bili/external-summary/credential: permanently 404 → working endpoint. Security posture UNCHANGED: loopback-source + trusted-origin gated exactly like every other /__bili/* admin path.
• No other behavior changes. No config-surface change. No kernel change.

Verification

• npm run typecheck clean.
• Targeted suites: tests/web-routing.test.ts 9/9 (incl. the new test), tests/external-summary-settings.test.ts 43/43. Full-suite verdict = remote CI on this head.

[github-actions]

📦 Built Package Artifact

Branch: 2026-10-17_summary-credential-route (aef3fa2)

Option A — Install this exact build (recommended)

npm install -g billion-context@0.0.4057-pr.3445.771633c

This exact version is immutable and reproducible. The rolling pr tag tracks the newest test build across all PRs.

Option B — Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf billion-context-pr3445.tgz
npm install -g package

---

Install instructions are refreshed on each push.

[ranxianglei]

(ai: zhipuai-lb/glm-5.3)

陈旧票清理(第三批动作①):目标 issue #3443 已关。为避免重复劳动关闭本 PR;如判断有误请直接 reopen 并留言。