@edge-sky/dsh-oauth-adapter 0.1.2-dev.1 → 0.1.2-dev.2

package/README.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record: the git blob hash of each side as of the
 # last confirmed-consistent state. Both languages carry equal authority.
-README.md: f3e3243d02440749e53038872e3fdca91f516468
-README.zh.md: 31a969685a57a6919b8544e24a7e09c2a4b77303
+README.md: fd0eef65a18d89c5e1dd49d9bc0fc89f9c2a770a
+README.zh.md: aeb4cf30a05c98c1b885c4c7eece00f3bb138c39

package/README.md

@@ -56,3 +56,30 @@ pnpm test
 ```
 
 Tests cover provider responses, matching, retained results, revisions, migration recovery, cancellation, actual rc adapter requests with network interception, and published rc model-page bundles in a DOM environment with replayable snapshots. WebSocket tests bind a loopback port. All test credentials are synthetic; these checks do not establish live-account discovery or inference success for any provider. DSH source changes are not required.
+
+## Local package and installation verification
+
+`npm pack` and `npm publish` from the package directory run type checking, a fresh build, and tests through `prepack`; a failure stops packaging. Do not bypass this check with `--ignore-scripts`. Published versions cannot be overwritten, so a fixed release needs a new version number.
+
+A temporary `DSH_HOME` lets you test a local tarball without affecting existing accounts or profiles or changing DSH code:
+
+```sh
+pnpm install --frozen-lockfile
+artifact_dir=$(mktemp -d)
+npm pack --pack-destination "$artifact_dir"
+export DSH_HOME=$(mktemp -d)
+mkdir -p "$DSH_HOME/profiles/web"
+cat > "$DSH_HOME/profiles/web/pnpm-workspace.yaml" <<'YAML'
+packages:
+  - .
+nodeLinker: hoisted
+autoInstallPeers: false
+allowBuilds:
+  '@google/genai': false
+  protobufjs: false
+YAML
+npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add "$artifact_dir"/*.tgz
+npx @deepseek-ai/dsh@0.1.2-rc.1 web --no-open
+```
+
+After stopping the server, run `unset DSH_HOME` to restore the default directory. The test profile explicitly skips installation scripts for these two dependencies; the plugin repository's policy does not propagate to consumers. New users still need to configure this policy in their own profiles. Successful startup verifies plugin loading; real-account login, model discovery, and inference need separate verification.

package/README.zh.md

@@ -56,3 +56,30 @@ pnpm test
 ```
 
 测试覆盖供应商响应、匹配、失败保留、revision 冲突、迁移恢复、取消、经过网络拦截的真实 rc 适配器请求，以及 DOM 环境中加载已发布 rc 模型页产物的可重放快照。WebSocket 测试需要绑定回环端口。测试凭据全部为合成数据，这些验证不代表任何供应商的真实账号发现或推理调用已经通过。无需修改 DSH 源码。
+
+## 本地打包与安装验证
+
+`npm pack` 和从目录执行的 `npm publish` 通过 `prepack` 运行类型检查、重新构建和测试；任何一步失败都会终止打包。不要使用 `--ignore-scripts` 跳过该检查。已发布版本不能覆盖，修复后发布必须使用新版本号。
+
+使用临时 `DSH_HOME` 可以测试本地 tarball，不影响现有账号与 profile，也不需要修改 DSH 代码：
+
+```sh
+pnpm install --frozen-lockfile
+artifact_dir=$(mktemp -d)
+npm pack --pack-destination "$artifact_dir"
+export DSH_HOME=$(mktemp -d)
+mkdir -p "$DSH_HOME/profiles/web"
+cat > "$DSH_HOME/profiles/web/pnpm-workspace.yaml" <<'YAML'
+packages:
+  - .
+nodeLinker: hoisted
+autoInstallPeers: false
+allowBuilds:
+  '@google/genai': false
+  protobufjs: false
+YAML
+npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add "$artifact_dir"/*.tgz
+npx @deepseek-ai/dsh@0.1.2-rc.1 web --no-open
+```
+
+停止服务器后执行 `unset DSH_HOME` 恢复默认目录。测试 profile 的脚本策略显式跳过这两个依赖的安装脚本；插件仓库的策略不会传播到消费端。新用户仍需在自己的 profile 中配置该策略。启动成功只验证插件加载；真实账号登录、模型发现和推理需要单独验证。

package/lib/client.js

@@ -6,8 +6,37 @@ window.__ModuleLoader__.load({
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 		let react = require("react");
 		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/model-types.ts
+		const MODEL_PROTOCOLS = {
+			"github-copilot": [
+				"openai-completions",
+				"openai-responses",
+				"anthropic-messages"
+			],
+			openrouter: ["openai-completions", "anthropic-messages"],
+			"openai-codex": ["openai-codex-responses"],
+			xai: ["openai-responses"],
+			anthropic: ["anthropic-messages"],
+			"kimi-coding": ["anthropic-messages"]
+		};
+		function modelText(value) {
+			return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value);
+		}
+		/** Validate at the wire and durable-data boundaries; fixed-protocol routes accept no override. */
+		function validManual(provider, value) {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+			const m = value;
+			if (Object.keys(m).some((k) => ![
+				"id",
+				"name",
+				"api"
+			].includes(k)) || !modelText(m.id)) return false;
+			if (m.name !== void 0 && !modelText(m.name)) return false;
+			const choices = MODEL_PROTOCOLS[provider];
+			return choices.length === 1 ? m.api === void 0 : typeof m.api === "string" && choices.includes(m.api);
+		}
+		//#endregion
 		//#region src/protocol.ts
-		/** Shared browser/Host wire vocabulary for the OAuth account surface. */
 		const OAUTH_SOCKET_PATH = "/_edge-sky/dsh-oauth";
 		const OAUTH_SOCKET_PROTOCOL = "dsh-oauth-v1";
 		const PROVIDERS = [
@@ -49,6 +78,262 @@ window.__ModuleLoader__.load({
 			}
 		];
 		//#endregion
+		//#region src/client/OAuthModelsSection.tsx
+		/** OAuth-specific model management mounted inside the existing Models settings page. */
+		function ModelForm({ provider, initial, busy, t, save, close }) {
+			const [id, setId] = (0, react.useState)(initial?.id ?? "");
+			const [name, setName] = (0, react.useState)(initial?.name ?? "");
+			const choices = MODEL_PROTOCOLS[provider];
+			const [api, setApi] = (0, react.useState)(initial?.api ?? choices[0]);
+			const model = {
+				id: id.trim(),
+				...name.trim() ? { name: name.trim() } : {},
+				...choices.length > 1 ? { api } : {}
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
+				className: "dsh-oauth-model-form",
+				onSubmit: (event) => {
+					event.preventDefault();
+					if (validManual(provider, model)) save(model);
+				},
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t("modelId"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						required: true,
+						maxLength: 256,
+						value: id,
+						readOnly: initial !== void 0,
+						onChange: (event) => setId(event.target.value)
+					})] }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t("modelName"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						maxLength: 256,
+						value: name,
+						onChange: (event) => setName(event.target.value),
+						placeholder: id
+					})] }),
+					choices.length > 1 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [t("modelProtocol"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("select", {
+						value: api,
+						onChange: (event) => setApi(event.target.value),
+						children: choices.map((choice) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+							value: choice,
+							children: choice === "openai-completions" ? "Chat Completions" : choice === "openai-responses" ? "Responses" : choice === "openai-codex-responses" ? "Codex Responses" : "Anthropic Messages"
+						}, choice))
+					})] }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-oauth-muted",
+						children: t("manualModelHint")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "submit",
+						disabled: busy || !validManual(provider, model),
+						children: t("saveModel")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						disabled: busy,
+						onClick: close,
+						children: t("cancel")
+					})
+				]
+			});
+		}
+		function ProviderModels({ page, controller, busy, error, t }) {
+			const [editing, setEditing] = (0, react.useState)();
+			const [submitted, setSubmitted] = (0, react.useState)(false);
+			const [confirmMigration, setConfirmMigration] = (0, react.useState)(false);
+			(0, react.useEffect)(() => {
+				if (submitted && !busy) {
+					if (!error) setEditing(void 0);
+					setSubmitted(false);
+				}
+			}, [
+				busy,
+				error,
+				submitted
+			]);
+			const errorCode = error?.code ?? page.errorCode;
+			const errorLabel = errorCode === "settings-conflict" ? "modelConflict" : errorCode === "discovery-unsupported" ? "modelUnsupported" : errorCode === "discovery-auth" ? "modelAuthFailed" : errorCode === "discovery-timeout" ? "modelTimedOut" : errorCode === "route-conflict" ? "modelRouteConflict" : "modelOperationFailed";
+			const disabled = busy || !page.connected || !page.writable;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("article", {
+				className: "dsh-oauth-model-provider",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", { children: PROVIDERS.find((p) => p.id === page.provider)?.modelGroupLabel }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", { children: [
+						page.connected ? t("modelConnected") : t("disconnected"),
+						" · ",
+						page.source === "account" ? t("accountCatalog") : t("builtinCatalog")
+					] }),
+					page.syncedAt && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", { children: [
+						t("lastModelSync"),
+						": ",
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
+							dateTime: page.syncedAt,
+							children: new Date(page.syncedAt).toLocaleString()
+						})
+					] }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", { children: [
+						t("matchedModels"),
+						": ",
+						page.counts.matched,
+						" · ",
+						t("pendingModels"),
+						": ",
+						page.counts.pending,
+						" · ",
+						t("manualModels"),
+						": ",
+						page.counts.manual
+					] }),
+					(error || page.error) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						role: "alert",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t(errorLabel) }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: t("technicalDetails") }), error?.message ?? page.error] })]
+					}),
+					page.migration ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						disabled,
+						onClick: () => setConfirmMigration(!confirmMigration),
+						children: t("reviewMigration")
+					}), confirmMigration && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("migrationDescription") }),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", { children: [
+							page.migration.fields.join(", "),
+							" · ",
+							page.migration.models,
+							" ",
+							t("modelsTitle")
+						] }),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							disabled,
+							onClick: () => controller.migrateModels(page.provider),
+							children: t("confirmMigration")
+						})
+					] })] }) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						disabled: disabled || !page.managed,
+						onClick: () => controller.syncModels(page.provider),
+						children: busy ? t("modelWorking") : t("syncModels")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						disabled: disabled || !page.managed,
+						onClick: () => setEditing(null),
+						children: t("addModel")
+					})] }),
+					editing !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelForm, {
+						provider: page.provider,
+						...editing === null ? {} : { initial: editing },
+						busy,
+						t,
+						save: (model) => {
+							setSubmitted(true);
+							controller.saveModel(page.provider, model);
+						},
+						close: () => setEditing(void 0)
+					}, editing?.id ?? "new"),
+					[
+						"matched",
+						"pending",
+						"manual"
+					].map((source) => {
+						const rows = page.rows.filter((row) => (row.source === "catalog" ? "matched" : row.source) === source);
+						if (!rows.length) return null;
+						return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+							"aria-label": t(source === "pending" ? "pendingModels" : source === "manual" ? "manualModels" : "matchedModels"),
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", { children: t(source === "pending" ? "pendingModels" : source === "manual" ? "manualModels" : "matchedModels") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+								className: "dsh-oauth-model-list",
+								children: rows.map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: row.name }),
+										" ",
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: row.id }),
+										" ",
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t(row.source === "pending" ? "pendingModels" : row.source === "manual" ? "manualModels" : "matchedModels") })
+									] }),
+									row.source === "pending" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										disabled: disabled || !page.managed,
+										onClick: () => setEditing({
+											id: row.id,
+											name: row.name
+										}),
+										children: t("configureModel")
+									}),
+									row.source === "manual" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										disabled,
+										onClick: () => setEditing({
+											id: row.id,
+											name: row.name,
+											...MODEL_PROTOCOLS[page.provider].length > 1 ? { api: row.api } : {}
+										}),
+										children: t("editModel")
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										disabled,
+										onClick: () => controller.deleteModel(page.provider, row.id),
+										children: t("deleteModel")
+									})] })
+								] }, row.id))
+							})]
+						}, source);
+					}),
+					page.total === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("noModels") }),
+					page.total > 10 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("nav", {
+						"aria-label": t("modelsPagination"),
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								disabled: page.offset === 0 || busy,
+								onClick: () => controller.readModels(page.provider, Math.max(0, page.offset - 10)),
+								children: t("previousModels")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
+								page.offset + 1,
+								"–",
+								Math.min(page.offset + 10, page.total),
+								" / ",
+								page.total
+							] }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								disabled: page.offset + 10 >= page.total || busy,
+								onClick: () => controller.readModels(page.provider, page.offset + 10),
+								children: t("nextModels")
+							})
+						]
+					})
+				]
+			});
+		}
+		function OAuthModelsSection(props) {
+			const { controller, t } = props;
+			if (!controller || !t) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(OAuthModels, {
+				controller,
+				t
+			});
+		}
+		function OAuthModels({ controller, t }) {
+			const snapshot = (0, react.useSyncExternalStore)(controller.subscribe, controller.getSnapshot, controller.getSnapshot);
+			(0, react.useEffect)(() => {
+				controller.loadModels();
+			}, [controller]);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "dsh-oauth-section",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", { children: t("modelsTitle") }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("modelsIntro") }),
+					snapshot.connection !== "open" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						role: "status",
+						children: t("hostDisconnected")
+					}),
+					PROVIDERS.map((provider) => {
+						const page = snapshot.modelPages?.[provider.id];
+						if (!page) return null;
+						if (!page.connected && !page.managed && page.counts.manual === 0) return null;
+						const error = snapshot.modelErrors?.[provider.id];
+						return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ProviderModels, {
+							page,
+							controller,
+							t,
+							busy: snapshot.connection !== "open" || snapshot.modelBusy?.[provider.id] === true || page.busy,
+							...error ? { error } : {}
+						}, provider.id);
+					})
+				]
+			});
+		}
+		//#endregion
 		//#region src/client/OAuthAccountsSection.tsx
 		/** OAuth account settings page. */
 		function safeHttpUrl(value) {
@@ -179,7 +464,7 @@ window.__ModuleLoader__.load({
 						t: props.t
 					}, props.attempt.prompt.id),
 					props.attempt.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ErrorPanel, {
-						message: props.attempt.error,
+						message: props.attempt.phase === "authorized" ? props.t("loginSyncFailed") : props.attempt.error,
 						...props.attempt.errorDetail === void 0 ? {} : { detail: props.attempt.errorDetail },
 						t: props.t
 					}),
@@ -297,6 +582,40 @@ window.__ModuleLoader__.load({
 		//#region src/client/locales.ts
 		/** English copy for the OAuth accounts page. */
 		const en = {
+			modelUnsupported: "This provider does not support account discovery with the current credential. You can still add models manually.",
+			modelAuthFailed: "Model discovery was denied. Reconnect or check this account’s permissions. The previous list was retained.",
+			modelTimedOut: "Model synchronization timed out. The previous list was retained.",
+			modelRouteConflict: "This provider is owned by an existing configuration. Review the details before migration.",
+			loginSyncFailed: "Sign-in succeeded, but model synchronization failed. Open Models to retry.",
+			modelsTitle: "OAuth models",
+			modelsIntro: "Synchronize account-visible models or add a model manually. Manual models survive synchronization.",
+			modelId: "Model ID",
+			modelName: "Display name",
+			modelProtocol: "Request protocol",
+			manualModelHint: "Saving configures a request; it does not verify account access or model capabilities.",
+			saveModel: "Save model",
+			modelConnected: "Connected",
+			accountCatalog: "Account-synchronized list",
+			builtinCatalog: "Built-in list · account access unverified",
+			lastModelSync: "Last successful synchronization",
+			matchedModels: "Matched",
+			pendingModels: "Needs configuration",
+			manualModels: "Manual",
+			modelConflict: "Models changed elsewhere. The list was refreshed; review it and retry.",
+			modelOperationFailed: "The model operation failed. Review the details before retrying.",
+			reviewMigration: "Review migration",
+			migrationDescription: "Move this OAuth provider configuration to plugin management while preserving its ID and credentials. The following configuration fields will be retained:",
+			confirmMigration: "Migrate this provider",
+			modelWorking: "Working…",
+			syncModels: "Synchronize models",
+			addModel: "Add model",
+			configureModel: "Configure",
+			editModel: "Edit",
+			deleteModel: "Delete manual entry",
+			noModels: "No selectable models. Configure an unmatched model or add one manually.",
+			modelsPagination: "OAuth model pages",
+			previousModels: "Previous",
+			nextModels: "Next",
 			nav: "OAuth Accounts",
 			title: "OAuth Accounts",
 			intro: "Connect subscription-backed providers. Their models appear in separate OAuth groups, apart from API-key providers.",
@@ -329,6 +648,40 @@ window.__ModuleLoader__.load({
 		};
 		/** Simplified Chinese copy for the OAuth accounts page. */
 		const zh = {
+			modelUnsupported: "当前凭据不支持查询该供应商的账号模型列表，仍可手动添加模型。",
+			modelAuthFailed: "模型查询被拒绝，请重新连接或检查账号权限。已保留之前的列表。",
+			modelTimedOut: "模型同步超时，已保留之前的列表。",
+			modelRouteConflict: "该供应商由现有配置管理，请查看详情后再迁移。",
+			loginSyncFailed: "登录成功，但模型同步失败。请前往模型页面重试。",
+			modelsTitle: "OAuth 模型",
+			modelsIntro: "同步账号可见模型，或手动添加模型。同步时会保留手动模型。",
+			modelId: "模型 ID",
+			modelName: "显示名称",
+			modelProtocol: "调用协议",
+			manualModelHint: "保存后可以尝试调用，但不代表已经验证账号权限或模型能力。",
+			saveModel: "保存模型",
+			modelConnected: "已连接",
+			accountCatalog: "已同步账号列表",
+			builtinCatalog: "内置列表 · 尚未验证账号权限",
+			lastModelSync: "最近成功同步",
+			matchedModels: "已匹配",
+			pendingModels: "待配置",
+			manualModels: "手动模型",
+			modelConflict: "模型已被其他操作修改。列表已刷新，请确认后重试。",
+			modelOperationFailed: "模型操作失败，请查看详情后重试。",
+			reviewMigration: "预览迁移",
+			migrationDescription: "将此 OAuth 供应商配置迁移到插件管理，保留供应商 ID 和凭据。以下配置字段将被保留：",
+			confirmMigration: "迁移此供应商",
+			modelWorking: "正在处理…",
+			syncModels: "同步模型",
+			addModel: "手动添加",
+			configureModel: "补充配置",
+			editModel: "编辑",
+			deleteModel: "删除手动项",
+			noModels: "暂无可选模型，请补充待配置项或手动添加。",
+			modelsPagination: "OAuth 模型分页",
+			previousModels: "上一页",
+			nextModels: "下一页",
 			nav: "OAuth 账户",
 			title: "OAuth 账户",
 			intro: "连接订阅型模型服务。OAuth 模型会以独立分组显示，与 API 密钥提供商分开。",
@@ -395,6 +748,9 @@ window.__ModuleLoader__.load({
 			reconnectTimer;
 			reconnectDelay = 500;
 			disposed = false;
+			modelsVisible = false;
+			modelRequests = /* @__PURE__ */ new Map();
+			latestModelReads = /* @__PURE__ */ new Map();
 			constructor() {
 				this.connect();
 			}
@@ -453,6 +809,69 @@ window.__ModuleLoader__.load({
 					provider
 				});
 			}
+			loadModels() {
+				this.modelsVisible = true;
+				for (const provider of this.snapshot.accounts) this.readModels(provider.provider);
+			}
+			readModels(provider, offset = 0) {
+				if (this.snapshot.connection !== "open") return;
+				const requestId = crypto.randomUUID();
+				this.latestModelReads.set(provider, requestId);
+				this.modelRequests.set(requestId, {
+					provider,
+					write: false
+				});
+				this.send({
+					type: "models-list",
+					requestId,
+					provider,
+					offset
+				});
+			}
+			syncModels(provider) {
+				this.writeModels(provider, { type: "models-sync" });
+			}
+			migrateModels(provider) {
+				this.writeModels(provider, { type: "models-migrate" });
+			}
+			saveModel(provider, model) {
+				this.writeModels(provider, {
+					type: "models-save",
+					model
+				});
+			}
+			deleteModel(provider, id) {
+				this.writeModels(provider, {
+					type: "models-delete",
+					id
+				});
+			}
+			writeModels(provider, operation) {
+				const page = this.snapshot.modelPages?.[provider];
+				if (!page || this.snapshot.modelBusy?.[provider] || this.snapshot.connection !== "open") return;
+				const requestId = crypto.randomUUID();
+				this.modelRequests.set(requestId, {
+					provider,
+					write: true
+				});
+				this.update({
+					...this.snapshot,
+					modelBusy: {
+						...this.snapshot.modelBusy,
+						[provider]: true
+					},
+					modelErrors: {
+						...this.snapshot.modelErrors,
+						[provider]: void 0
+					}
+				});
+				this.send({
+					...operation,
+					requestId,
+					provider,
+					revision: page.revision
+				});
+			}
 			retry() {
 				if (this.socket?.readyState === WebSocket.OPEN || this.socket?.readyState === WebSocket.CONNECTING) return;
 				if (this.reconnectTimer !== void 0) window.clearTimeout(this.reconnectTimer);
@@ -483,6 +902,12 @@ window.__ModuleLoader__.load({
 						...current,
 						connection: "open"
 					});
+					this.modelRequests.clear();
+					this.latestModelReads.clear();
+					this.update({
+						...this.snapshot,
+						modelBusy: {}
+					});
 					this.send({
 						type: "refresh",
 						requestId: crypto.randomUUID()
@@ -551,6 +976,60 @@ window.__ModuleLoader__.load({
 			}
 			receive(message) {
 				switch (message.type) {
+					case "models-changed":
+						if (this.modelsVisible) this.readModels(message.provider, this.snapshot.modelPages?.[message.provider]?.offset ?? 0);
+						return;
+					case "models-page": {
+						const request = this.modelRequests.get(message.requestId);
+						this.modelRequests.delete(message.requestId);
+						if (!request) return;
+						if (!request.write && this.latestModelReads.get(request.provider) !== message.requestId) return;
+						const current = this.snapshot.modelPages?.[request.provider];
+						if (current && message.page.revision < current.revision) {
+							if (request.write) this.update({
+								...this.snapshot,
+								modelBusy: {
+									...this.snapshot.modelBusy,
+									[request.provider]: false
+								}
+							});
+							return;
+						}
+						this.update({
+							...this.snapshot,
+							modelPages: {
+								...this.snapshot.modelPages,
+								[request.provider]: message.page
+							},
+							modelBusy: {
+								...this.snapshot.modelBusy,
+								...request.write ? { [request.provider]: false } : {}
+							}
+						});
+						return;
+					}
+					case "models-error": {
+						const request = this.modelRequests.get(message.requestId);
+						this.modelRequests.delete(message.requestId);
+						if (!request) return;
+						if (!request.write && this.latestModelReads.get(request.provider) !== message.requestId) return;
+						this.update({
+							...this.snapshot,
+							modelBusy: {
+								...this.snapshot.modelBusy,
+								...request.write ? { [request.provider]: false } : {}
+							},
+							modelErrors: {
+								...this.snapshot.modelErrors,
+								[request.provider]: {
+									code: message.code,
+									message: message.message
+								}
+							}
+						});
+						if (request.write) this.readModels(request.provider);
+						return;
+					}
 					case "snapshot":
 						const accounts = [...message.accounts];
 						const reconciled = reconcileAttemptView(this.snapshot.attempt, accounts);
@@ -561,6 +1040,7 @@ window.__ModuleLoader__.load({
 						if (reconciled === void 0) delete nextSnapshot.attempt;
 						else nextSnapshot.attempt = reconciled;
 						this.update(nextSnapshot);
+						if (this.modelsVisible) for (const account of accounts) this.readModels(account.provider, this.snapshot.modelPages?.[account.provider]?.offset ?? 0);
 						return;
 					case "started":
 						const { error: _error, errorDetail: _errorDetail, ...current } = this.snapshot;
@@ -671,11 +1151,19 @@ window.__ModuleLoader__.load({
 .dsh-oauth-actions{display:flex;gap:6px;margin-left:auto}.dsh-oauth-button{box-sizing:border-box;display:inline-flex;align-items:center;justify-content:center;min-height:30px;padding:0 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:15px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:18px;cursor:pointer}.dsh-oauth-button[data-variant=primary]{border-color:transparent;background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}.dsh-oauth-button[data-variant=danger]{border-color:transparent;color:var(--dsw-alias-state-error-primary)}.dsh-oauth-button:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-solid)}.dsh-oauth-button[data-variant=primary]:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover);color:var(--dsw-alias-label-primary-foreground)}.dsh-oauth-button[data-variant=danger]:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.dsh-oauth-button:focus-visible{outline:none;box-shadow:0 0 0 2px var(--dsw-alias-border-l3)}.dsh-oauth-button:disabled{cursor:not-allowed;opacity:.4}
 .dsh-oauth-flow{display:flex;flex-direction:column;gap:8px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l3);font-size:13px;line-height:20px}.dsh-oauth-link{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:8px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:9px;background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary);text-decoration:none}.dsh-oauth-link:hover{background:var(--dsw-alias-interactive-bg-hover-solid)}.dsh-oauth-link-label{font-weight:500}.dsh-oauth-link-host{max-width:240px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--dsw-alias-label-tertiary);font-size:12px}.dsh-oauth-link-icon{color:var(--dsw-alias-brand-text)}.dsh-oauth-code{display:flex;align-items:center;gap:8px}.dsh-oauth-code code{padding:5px 8px;border-radius:6px;background:var(--dsw-alias-bg-module-platform);font-size:14px;letter-spacing:.08em}
 .dsh-oauth-prompt{display:flex;flex-direction:column;gap:7px}.dsh-oauth-input,.dsh-oauth-select{box-sizing:border-box;width:100%;height:34px;padding:0 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-primary)}
+
+.dsh-oauth-model-provider { border: 1px solid var(--border-color, currentColor); border-radius: 8px; padding: 16px; margin-block: 16px; }
+.dsh-oauth-model-provider button { margin: 4px; }
+.dsh-oauth-model-list { padding: 0; list-style: none; }
+.dsh-oauth-model-list li { padding-block: 8px; border-bottom: 1px solid var(--border-color, currentColor); overflow-wrap: anywhere; }
+.dsh-oauth-model-list code { margin-inline: 8px; }
+.dsh-oauth-model-form { display: grid; gap: 12px; margin-block: 12px; }
+.dsh-oauth-model-form label { display: grid; gap: 4px; }
+.dsh-oauth-model-provider nav { display: flex; align-items: center; gap: 8px; }
 `;
 		//#endregion
 		//#region src/client/index.ts
 		const NS = "settings.oauth-accounts";
-		const MODEL_SETTINGS_VISIBILITY = "modelSettingsVisibility";
 		/** Required browser services for settings placement and localized copy. */
 		const inject = ["slots", "locale"];
 		/** Register the OAuth account page and its app-lifetime connection controller. */
@@ -697,11 +1185,16 @@ window.__ModuleLoader__.load({
 			ctx.effect(() => () => {
 				controller.dispose();
 			}, "dsh-oauth-adapter: controller");
-			ctx.inject([MODEL_SETTINGS_VISIBILITY], (scope) => {
-				const visibility = scope.get(MODEL_SETTINGS_VISIBILITY);
-				scope.effect(() => visibility.registerHiddenProviders(PROVIDERS.map((provider) => provider.id)), "dsh-oauth-adapter: hide OAuth providers from Models settings");
-			});
 			const t = ctx.locale.bind(NS);
+			ctx.slots.inject("settings.models.footer", () => ctx.slots.register({
+				name: "settings.models.footer",
+				id: "oauth-models",
+				order: 10,
+				inject: () => ({
+					controller,
+					t
+				})
+			}, OAuthModelsSection));
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",
 				id: "oauth-accounts",