chore: windows CI matrix, dependabot, eslint, coverage, random test ports, HERMES refresh

- CI: matrix [ubuntu, windows] — windows is this project's primary deployment
  shape (start.cmd / scheduled task / pkg exe / registry toasts), so platform
  regressions must be caught on it; coverage step runs once on ubuntu
- .github/dependabot.yml: weekly npm + github-actions updates (dev deps grouped)
- ESLint (flat config) + 'npm run lint' in CI: catch real issues (unused vars,
  useless escapes/assignments, missing error cause); style-only rules kept off;
  all 24 findings fixed — several were genuine dead code (server-side esc(),
  hasModelsChanged, TOAST_ENABLED_REG, empty UpstreamModel interface)
- Integration tests use random free ports instead of fixed 9091/9911, so
  parallel runs or occupied ports no longer cause false failures
- 'npm run test:coverage' + CI coverage summary (v8 provider; child-process
  integration traffic is not counted, so numbers are a conservative trend)
- HERMES_TEST_PROMPT.md: add count_tokens endpoint + stream_options.include_usage
  scenario (T2), new T13 for documented-unsupported fields, fix the stale T10
  expectation (unknown models pass through since 4.9, no silent substitution)
  and the HTML-stripped <think> reference

Author: wjf1

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-deps:
+        dependency-type: development
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -7,7 +7,13 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # ubuntu 是基线；windows 是本项目的主要部署形态（start.cmd / 计划任务 /
+        # pkg exe / 注册表通知），必须同缸回归路径分隔符与 spawn 行为差异
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
 
@@ -19,6 +25,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Lint
+        run: npm run lint
+
       - name: Typecheck
         run: npm run typecheck
 
@@ -28,3 +37,8 @@ jobs:
 
       - name: Test
         run: npx vitest run
+
+      # 覆盖率只在基线系统跑一份，避免矩阵重复
+      - name: Coverage
+        if: matrix.os == 'ubuntu-latest'
+        run: npx vitest run --coverage --coverage.reporter=text-summary

HERMES_TEST_PROMPT.md

@@ -31,6 +31,7 @@ as a client. Everything you need is at `http://127.0.0.1:9090`.
 
 - `POST /v1/chat/completions` — main target
 - `POST /v1/messages` — Anthropic-style (secondary; test if time permits)
+- `POST /v1/messages/count_tokens` — local token estimate (CJK-aware; never calls upstream, safe to call anytime)
 - `GET  /v1/models` — list available model ids first; pick 2-3 for your tests (one claude, one gpt, one other)
 - `GET  /health` — confirm proxy is up before starting
 
@@ -51,7 +52,8 @@ Verify against OpenAI spec:
 - Last data chunk: `delta: {}` with `finish_reason: "stop"`
 - Very last line: `data: [DONE]`
 - All chunks share the same `id`/`created`/`model`
-Report: chunk count, any chunk missing fields, any ` thinking` text leaking into `content`.
+Report: chunk count, any chunk missing fields, any raw `<think>` tag text leaking into `content`.
+Extra: repeat with `stream_options: {include_usage: true}` — the final chunk should carry a `usage` object. Without that flag, no chunk should contain a `usage` field.
 
 ### T3 — Reasoning / thinking visibility
 Send with `reasoning_effort: "high"` (and separately omit it).
@@ -103,8 +105,10 @@ Verify: no 400/500 error, model responds about the image (even vaguely). Report
 ### T10 — Model resolution
 Request a model with a vendor prefix (e.g. `"openai/gpt-5.6-sol"` if `gpt-5.6-sol` exists) and
 an unknown model (`"definitely-not-a-real-model"`).
-Verify: prefix version works (proxy strips/aliases); unknown falls back to a valid model rather
-than erroring — and the RESPONSE `model` field tells you which was actually used.
+Verify: prefix version works (proxy strips/aliases), and the RESPONSE `model` field tells you which
+was actually used. An unknown model id is passed through **as-is** to upstream (since 4.9 — the proxy
+must NOT silently substitute a default model), so expect a structured upstream error with a stable
+`code` (e.g. `MODEL_NOT_FOUND`) rather than a fabricated response.
 
 ### T11 — Edge inputs
 - Very long message (~20k chars): should not error.
@@ -119,6 +123,11 @@ than erroring — and the RESPONSE `model` field tells you which was actually us
 - If any upstream error surfaces mid-stream, verify it arrives as a content chunk containing
   `[Upstream Error: ...]` followed by a proper finish + [DONE] (stream must always terminate cleanly).
 
+### T13 — Unsupported fields are accepted silently
+Send a request containing `stop: ["x"]`, `response_format: {type: "json_object"}`, `top_k`, and `logprobs`.
+Verify: no 4xx/5xx and a normal response comes back. These fields are **accepted but ignored** by design
+(documented in README) — report only if the proxy errors or the response envelope is malformed.
+
 ---
 
 ## Report format (final deliverable)

eslint.config.js

@@ -0,0 +1,23 @@
+// ESLint flat config。目标：拦真问题（未用变量、未定义引用、误用），不搞风格洁癖
+// —— 格式交给编辑器/个人习惯，避免无意义的全量 churn。
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  {
+    // 构建产物、前端 SPA（经 tests/dashboard-spa.test.ts 单独守卫）、依赖
+    ignores: ['dist/**', 'node_modules/**', 'public/**', '*.mjs'],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    rules: {
+      // 本项目大量使用 any 承接上游无契约的 wire 事件 —— 有意为之
+      '@typescript-eslint/no-explicit-any': 'off',
+      // 以 _ 开头的参数/变量视为有意忽略
+      '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
+      // 防御式编程里 "catch {}" 是常态
+      'no-empty': ['error', { allowEmptyCatch: true }],
+    },
+  },
+);