feat: 增强设置功能，支持当前识别的管理 IP 和白名单更新逻辑

src/web/App.tsx

@@ -6,6 +6,7 @@ import NotificationPanel from './components/NotificationPanel.js';
 import { api } from './api.js';
 import { clearAuthSession, hasValidAuthSession, persistAuthSession } from './authSession.js';
 import { I18nProvider, useI18n } from './i18n.js';
+import { resolveLoginErrorMessage } from './loginError.js';
 const Dashboard = lazy(() => import('./pages/Dashboard.js'));
 const Sites = lazy(() => import('./pages/Sites.js'));
 const Accounts = lazy(() => import('./pages/Accounts.js'));
@@ -131,7 +132,21 @@ function Login({ onLogin, t }: { onLogin: (token: string) => void; t: (text: str
       if (res.ok) {
         onLogin(token);
       } else {
-        setError(t('登录令牌无效'));
+        let reason = '';
+        try {
+          const text = await res.text();
+          if (text) {
+            try {
+              const parsed = JSON.parse(text) as { message?: unknown; error?: unknown };
+              if (typeof parsed.message === 'string') reason = parsed.message;
+              else if (typeof parsed.error === 'string') reason = parsed.error;
+              else reason = text;
+            } catch {
+              reason = text;
+            }
+          }
+        } catch {}
+        setError(t(resolveLoginErrorMessage(res.status, reason)));
         setLoading(false);
       }
     } catch {
@@ -709,4 +724,3 @@ export default function App() {
   );
 }
 
-

src/web/i18n.tsx

@@ -8,6 +8,8 @@ const LANGUAGE_STORAGE_KEY = 'app_language';
 const zhToEn: Record<string, string> = {
   '管理员': 'Admin',
   '登录令牌无效': 'Invalid admin token',
+  '当前 IP 不在管理白名单中': 'Current IP is not in admin allowlist',
+  '当前识别到的管理端 IP（由服务端判定）：': 'Current recognized admin IP (server-side detected):',
   '无法连接到服务器': 'Unable to connect to server',
   '请输入管理员令牌后继续。': 'Enter admin token to continue.',
   '管理员令牌': 'Admin Token',

src/web/loginError.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { resolveLoginErrorMessage } from './loginError.js';
+
+describe('resolveLoginErrorMessage', () => {
+  it('returns IP allowlist hint when backend rejects by IP', () => {
+    expect(resolveLoginErrorMessage(403, 'IP not allowed')).toBe('当前 IP 不在管理白名单中');
+  });
+
+  it('returns invalid token message for auth failures', () => {
+    expect(resolveLoginErrorMessage(403, 'Invalid token')).toBe('登录令牌无效');
+    expect(resolveLoginErrorMessage(401, 'Missing Authorization header')).toBe('登录令牌无效');
+  });
+});

src/web/loginError.ts

@@ -0,0 +1,11 @@
+function normalizeReason(reason: string): string {
+  return (reason || '').trim().toLowerCase();
+}
+
+export function resolveLoginErrorMessage(status: number, reason: string): string {
+  const normalizedReason = normalizeReason(reason);
+  if (status === 403 && normalizedReason.includes('ip not allowed')) {
+    return '当前 IP 不在管理白名单中';
+  }
+  return '登录令牌无效';
+}

src/web/pages/Settings.tsx

@@ -19,6 +19,7 @@ type RuntimeSettings = {
   routingWeights: RoutingWeights;
   proxyTokenMasked?: string;
   adminIpAllowlist?: string[];
+  currentAdminIp?: string;
 };
 
 const defaultWeights: RoutingWeights = {
@@ -88,6 +89,7 @@ export default function Settings() {
         adminIpAllowlist: Array.isArray(runtimeInfo.adminIpAllowlist)
           ? runtimeInfo.adminIpAllowlist.filter((item: unknown) => typeof item === 'string')
           : [],
+        currentAdminIp: typeof runtimeInfo.currentAdminIp === 'string' ? runtimeInfo.currentAdminIp : '',
       });
       setAdminIpAllowlistText(
         Array.isArray(runtimeInfo.adminIpAllowlist)
@@ -176,10 +178,16 @@ export default function Settings() {
         .split(/\r?\n|,/g)
         .map((item) => item.trim())
         .filter((item) => item.length > 0);
-      await api.updateRuntimeSettings({
+      const res = await api.updateRuntimeSettings({
         adminIpAllowlist: allowlist,
       });
-      setRuntime((prev) => ({ ...prev, adminIpAllowlist: allowlist }));
+      setRuntime((prev) => ({
+        ...prev,
+        adminIpAllowlist: allowlist,
+        currentAdminIp: typeof res?.currentAdminIp === 'string'
+          ? res.currentAdminIp
+          : prev.currentAdminIp,
+      }));
       toast.success('安全设置已保存');
     } catch (err: any) {
       toast.error(err?.message || '保存失败');
@@ -446,6 +454,12 @@ export default function Settings() {
           <div style={{ fontSize: 12, color: 'var(--color-text-muted)', marginBottom: 12 }}>
             登录会话默认 12 小时自动过期。可选配置管理端 IP 白名单（每行一个 IP）。
           </div>
+          <div style={{ fontSize: 12, color: 'var(--color-text-muted)', marginBottom: 6 }}>
+            {tr('当前识别到的管理端 IP（由服务端判定）：')}
+          </div>
+          <code style={{ display: 'block', padding: '10px 14px', background: 'var(--color-bg)', borderRadius: 'var(--radius-sm)', fontSize: 13, fontFamily: 'var(--font-mono)', color: 'var(--color-text-secondary)', border: '1px solid var(--color-border-light)', marginBottom: 10 }}>
+            {runtime.currentAdminIp || tr('未知')}
+          </code>
           <textarea
             value={adminIpAllowlistText}
             onChange={(e) => setAdminIpAllowlistText(e.target.value)}

src/web/pages/helpers/modelTesterSession.test.ts

@@ -84,6 +84,16 @@ describe('modelTesterSession', () => {
     expect(restored?.parameterEnabled).toEqual(DEFAULT_PARAMETER_ENABLED);
   });
 
+  it('defaults top_p to disabled when parameter switches are missing', () => {
+    const restored = parseModelTesterSession(JSON.stringify({
+      model: 'gpt-4o',
+      messages: [{ role: 'user', content: 'hello' }],
+      pendingPayload: null,
+    }));
+
+    expect(restored?.parameterEnabled.top_p).toBe(false);
+  });
+
   it('returns null for malformed or missing session payload', () => {
     expect(parseModelTesterSession(null)).toBeNull();
     expect(parseModelTesterSession('not-json')).toBeNull();

src/web/pages/helpers/modelTesterSession.ts

@@ -96,7 +96,7 @@ export const DEFAULT_INPUTS: ModelTesterInputs = {
 
 export const DEFAULT_PARAMETER_ENABLED: ParameterEnabled = {
   temperature: true,
-  top_p: true,
+  top_p: false,
   max_tokens: false,
   frequency_penalty: true,
   presence_penalty: true,