feat: add AI prompts and source navigation skills

skills/new-api-admin/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: new-api-admin
+description: Locate the current new-api routes, authorization checks and handlers for an administrative request, derive its API contract, and execute within the supplied account's permissions.
+---
+
+# new-api administrator source navigation
+
+Start from the administrator's request. Use this guide to find its implementation in the official [QuantumNous/new-api repository](https://github.com/QuantumNous/new-api). Determine the available operation from the current code and account permissions.
+
+## Common capability entrypoints
+
+Choose a matching entry before searching the whole repository. Each row points to where the current interface, input construction and validation live. Follow the actual route to establish permission and response semantics.
+
+| Capability | Find the client call / input construction | Confirm the implementation |
+| --- | --- | --- |
+| Model prices and billing mode | [model-pricing/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/model-pricing/api.ts): `getModelPricing`, `saveModelPricing`, `buildPricingChanges`; [pricing.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/model-pricing/pricing.ts): `pricingFromDraft` | [controller/model_pricing_config.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/model_pricing_config.go) → [model/model_pricing_config.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/model/model_pricing_config.go) |
+| Group pricing and availability | [group-ratio-form.tsx](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/system-settings/models/group-ratio-form.tsx) and the caller that saves it; [system-settings/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/system-settings/api.ts) | [controller/option.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/option.go) → [setting/ratio_setting/group_ratio.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/setting/ratio_setting/group_ratio.go) |
+| Channels and routing | [channels/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/channels/api.ts) | [router/channel-router.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/router/channel-router.go) → [controller/channel.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/channel.go); follow the specific handler named by the route |
+| Users and permissions | [users/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/users/api.ts) and its imported types | [controller/user.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/user.go), [controller/authz.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/authz.go), and the referenced [service/authz](https://github.com/QuantumNous/new-api/tree/main/service/authz) definitions |
+| Model metadata | [models/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/models/api.ts) | [controller/model_meta.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/model_meta.go) |
+| Subscription plans and redemption codes | [subscriptions/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/subscriptions/api.ts) or [redemption-codes/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/redemption-codes/api.ts) | [controller/subscription.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/subscription.go) or [controller/redemption.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/redemption.go) |
+| Usage and audit records | [usage-logs/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/usage-logs/api.ts) or [audit/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/usage-logs/audit/api.ts) | [controller/log.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/log.go) or `GetAuditLogs` in [controller/access_token.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/access_token.go) |
+| General system settings | [system-settings/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/system-settings/api.ts) and the calling settings section | [controller/option.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/option.go): `OptionUpdateRequest`, `GetOptions`, `UpdateOption`; follow the selected option into its setting implementation |
+
+### Model price lookup path
+
+For a request to change model prices, read this chain in order:
+
+1. In `model-pricing/api.ts`, inspect `getModelPricing` and `saveModelPricing` to find the current read/write endpoints and payload wrapper. Inspect `ModelPricingChange` and `buildPricingChanges` to see how the frontend builds a change from the current snapshot.
+2. In `model-pricing/pricing.ts`, inspect `PRICING_KEYS` and `pricingFromDraft` to identify the fields for the requested billing mode. Follow the calling editor and [currency.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/model-pricing/currency.ts) if display-currency conversion matters. For an expression, read [pkg/billingexpr/expr.md](https://raw.githubusercontent.com/QuantumNous/new-api/main/pkg/billingexpr/expr.md) for its units and semantics.
+3. Find those endpoints in [router/api-router.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/router/api-router.go), then read `UpdateModelPricingConfig` and the model's `ModelPricingChange`, `ValidateModelPricing`, `UpdateModelPricing`. Resolve the actual role requirement, concurrency check, configured/default distinction, and replacement/merge behavior from this code.
+4. Use that contract to construct only the requested model changes. Derive success/conflict handling from the controller and use the read implementation to verify the resulting configuration. For user-visible price presentation, follow [controller/pricing.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/pricing.go).
+
+## Find the relevant implementation
+
+1. **Locate the route.** Start with [router/api-router.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/router/api-router.go) and follow the relevant registration or route table in [router/](https://github.com/QuantumNous/new-api/tree/main/router). Search using the object or action from the request. If the terminology is unclear, locate the matching frontend call in [web/src/features](https://github.com/QuantumNous/new-api/tree/main/web/src/features) first. Continue once the full grouped path, method, handler and middleware chain are known.
+2. **Resolve authority.** Follow that chain through [middleware/auth.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/middleware/auth.go). When it invokes fine-grained authorization, read the referenced definitions and resolver in [service/authz](https://github.com/QuantumNous/new-api/tree/main/service/authz). Follow target-ownership, role and verification checks inside the handler too. Use the identity/capability flow found in the code to establish the current account's authority; an administrator label alone does not determine it.
+3. **Read the contract.** Open the handler in [controller/](https://github.com/QuantumNous/new-api/tree/main/controller), following its request types, validation, service/model calls and response helpers as needed. Use the matching frontend API call and its callers to understand how inputs are assembled. Continue once the accepted parameters, defaults, units, fields changed, side effects and success/error response are clear from the implementation.
+4. **Perform the request.** Call the supplied instance with the supplied token for the user's authorized action. Interpret the actual response using the code just read and verify the resulting state. If the current account cannot perform it, report the concrete permission or browser-verification requirement found in that flow.
+
+## Source-reading shortcuts
+
+- Fetch any known file as plain text with `https://raw.githubusercontent.com/QuantumNous/new-api/main/<path>`.
+- If the route moved or the feature is unclear, inspect the [repository tree](https://api.github.com/repos/QuantumNous/new-api/git/trees/main?recursive=1), then search for the object, route fragment or handler symbol. With a checkout, use `rg -n '<symbol-or-path-fragment>' router controller service/authz web/src/features`.
+- To resolve frontend payload construction or defaults, follow the feature's API function into its page, form or hook. Follow shared request/response behavior into [web/src/lib/http-client.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/lib/http-client.ts) when relevant.
+- For delegated pagination and response formatting, read `GetPageQuery` in [common/page_info.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/common/page_info.go) and the referenced helpers in [common/gin.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/common/gin.go).
+- Use the deployment's tag or commit when known; otherwise start from `main`. Keep the route, permission definitions and implementation on the same revision. A live/source mismatch needs resolution before retrying a write.
+
+Fetch GitHub source without the instance access token. Keep authenticated calls on the supplied instance and credentials out of files and output. Determine side effects from the handler, regardless of HTTP method; if a write's outcome is uncertain, inspect the state before retrying.
+
+For a request confined to the administrator's own account, use [new-api-user](../new-api-user/SKILL.md).

skills/new-api-user/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: new-api-user
+description: Locate the current new-api source for a user's requested self-service action, derive its API contract, and carry it out with the supplied access token.
+---
+
+# new-api user source navigation
+
+Start from the user's request. Use this guide to find the implementation in the official [QuantumNous/new-api repository](https://github.com/QuantumNous/new-api), then derive the operation from that code.
+
+## Common capability entrypoints
+
+Start with the matching row, then trace its current route and handler using the steps below. These are source locations to inspect; obtain the current request and response from the linked implementation.
+
+| Capability | Find the client call | Confirm the implementation |
+| --- | --- | --- |
+| Account and preferences | [profile/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/profile/api.ts) and its callers | [controller/user.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/user.go) |
+| Personal model API keys | [keys/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/keys/api.ts) and the imported form types | [controller/token.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/token.go) |
+| Displayed model prices | [pricing/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/pricing/api.ts) | [controller/pricing.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/pricing.go), then the referenced model pricing implementation |
+| Wallet and billing history | [wallet/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/wallet/api.ts) | Follow the matched route into [controller/topup.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/topup.go), [controller/user.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/user.go), or the provider handler it names |
+| Personal subscriptions | [subscriptions/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/subscriptions/api.ts), selecting its self-service calls | [controller/subscription.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/subscription.go) |
+| Usage and audit records | [usage-logs/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/usage-logs/api.ts) or [audit/api.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/features/usage-logs/audit/api.ts), selecting the current-user scope | [controller/log.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/log.go) or `GetAuditLogs` in [controller/access_token.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/controller/access_token.go) |
+
+## Find the relevant implementation
+
+1. **Locate the feature.** Open [web/src/features](https://github.com/QuantumNous/new-api/tree/main/web/src/features) and select the directory matching the user's object or UI terminology. Read its API call and the page, hook or form that calls it. Continue once you have the request path and the code constructing its inputs.
+2. **Trace the route.** Find that path in [router/api-router.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/router/api-router.go), following registrations in [router/](https://github.com/QuantumNous/new-api/tree/main/router) when needed. Combine parent groups with the route's local path and follow the attached middleware. Continue once the full route, handler and ownership checks are identified.
+3. **Read the contract.** Open the handler in [controller/](https://github.com/QuantumNous/new-api/tree/main/controller). Follow its input types, validators, called service/model functions and response helpers only as needed. Determine the method, URL, required headers, accepted inputs, defaults, units, update semantics and actual success/error response. Frontend calls help locate the flow; the backend implementation decides what it accepts and returns.
+4. **Perform the request.** Resolve the current-account identity and authentication flow from [middleware/auth.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/middleware/auth.go) and the corresponding handlers. Use the supplied instance URL and token within that account's actual permissions. Execute the user's requested action, interpret the response using the code just read, and verify any changed state before reporting the result.
+
+When a route introduces additional authorization or verification, follow its middleware and controller checks before calling it. A browser-only requirement needs the user's browser flow.
+
+## Source-reading shortcuts
+
+- Fetch any known file as plain text with `https://raw.githubusercontent.com/QuantumNous/new-api/main/<path>`.
+- If a feature is unclear or a path has moved, use the [repository tree](https://api.github.com/repos/QuantumNous/new-api/git/trees/main?recursive=1) to find filenames, then search the relevant files for the object, request-path fragment or symbol already found. With a checkout, use `rg -n '<symbol-or-path-fragment>' web/src/features router controller`.
+- If a client call leaves request headers or response handling unclear, follow its imports into [web/src/lib/http-client.ts](https://raw.githubusercontent.com/QuantumNous/new-api/main/web/src/lib/http-client.ts).
+- When the handler delegates pagination or response formatting, read `GetPageQuery` in [common/page_info.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/common/page_info.go) or the referenced `ApiSuccess`/`ApiError` helper in [common/gin.go](https://raw.githubusercontent.com/QuantumNous/new-api/main/common/gin.go).
+- Use a matching deployment tag or commit when known; otherwise start from `main`. Keep reads on the same revision. If the live instance contradicts the source, resolve the version or missing contract before retrying a write.
+
+Fetch GitHub source without the instance access token. Send that token only to the supplied instance; keep it out of repository files and reported output. If a write's outcome is uncertain, read the current state before retrying.
+
+For an administrator's request beyond their own account, continue with [new-api-admin](../new-api-admin/SKILL.md) after verifying the relevant authority.

web/src/features/security/components/access-token-prompt.tsx

@@ -0,0 +1,106 @@
+/*
+Copyright (C) 2023-2026 QuantumNous
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+For commercial licensing, please contact support@quantumnous.com
+*/
+import { ChevronDown, Sparkles } from 'lucide-react'
+import { useTranslation } from 'react-i18next'
+
+import { CopyButton } from '@/components/copy-button'
+import { Button } from '@/components/ui/button'
+import {
+  Collapsible,
+  CollapsibleContent,
+  CollapsibleTrigger,
+} from '@/components/ui/collapsible'
+import { Textarea } from '@/components/ui/textarea'
+import { useIsAdmin } from '@/hooks/use-admin'
+
+export function AccessTokenPrompt(props: { token: string }) {
+  const { t } = useTranslation()
+  const isAdmin = useIsAdmin()
+  const taskScope = isAdmin
+    ? t(
+        'Help me administer this new-api instance within my current permissions.'
+      )
+    : t(
+        'Help me use this new-api instance within the permissions of my own account.'
+      )
+  const prompt = t(
+    '{{taskScope}}\n\nSite URL: {{siteUrl}}\nAuthorization: Bearer {{accessToken}}\n\nSource navigation: {{skillUrl}}\nUse this guide to locate the relevant implementation in the official GitHub repository. Determine the current API, inputs, permissions and response from that code, then carry out my request. Only send the access token to the site above.\n\nMy request:',
+    {
+      taskScope,
+      siteUrl: window.location.origin,
+      accessToken: props.token,
+      skillUrl: `https://raw.githubusercontent.com/QuantumNous/new-api/main/skills/new-api-${isAdmin ? 'admin' : 'user'}/SKILL.md`,
+      nsSeparator: false,
+      interpolation: { escapeValue: false },
+    }
+  )
+  const copyLabel = t('Copy prompt with token')
+
+  return (
+    <Collapsible
+      role='group'
+      aria-label={t('Use with AI')}
+      className='bg-muted/30 min-w-0 rounded-xl border p-3'
+    >
+      <div className='flex items-start gap-2.5'>
+        <Sparkles
+          className='text-primary mt-0.5 size-4 shrink-0'
+          aria-hidden='true'
+        />
+        <div className='min-w-0 space-y-1'>
+          <h5 className='text-sm font-medium'>{t('Use with AI')}</h5>
+          <p className='text-muted-foreground text-xs leading-relaxed'>
+            {t(
+              'Copy a prompt to your AI assistant, then describe what you want to do.'
+            )}
+          </p>
+        </div>
+      </div>
+      <div className='mt-3 flex flex-wrap items-center justify-end gap-2'>
+        <CollapsibleTrigger
+          render={<Button variant='ghost' size='sm' className='group' />}
+        >
+          {t('Preview prompt')}
+          <ChevronDown
+            className='size-3.5 transition-transform group-aria-expanded:rotate-180'
+            aria-hidden='true'
+          />
+        </CollapsibleTrigger>
+        <CopyButton
+          value={prompt}
+          variant='outline'
+          size='sm'
+          aria-label={copyLabel}
+        >
+          {copyLabel}
+        </CopyButton>
+      </div>
+      <CollapsibleContent>
+        <Textarea
+          aria-label={t('Prompt preview')}
+          value={prompt}
+          readOnly
+          spellCheck={false}
+          autoComplete='off'
+          className='bg-background mt-3 h-64 max-h-[50vh] resize-none font-mono text-xs leading-relaxed md:text-xs'
+        />
+      </CollapsibleContent>
+    </Collapsible>
+  )
+}