@goodandready/dsh-model-sync 0.2.7 → 0.2.10

package/README.md

@@ -14,6 +14,8 @@ OAuth, subscription, and tool-only routes are intentionally outside the scope.
 
 Runtime, scheduler, HTTP API, reconciliation, model allowlists, and Settings UI are implemented. The release workflow includes staging and production verification before publication.
 
+The Settings UI groups synchronization controls, run summaries, configured providers, diagnostics, notifications, history, and editors into responsive cards that follow the DSH theme.
+
 ## Development
 
 See the project documentation under ``docs/`` for architecture, research, testing, and release notes.
@@ -45,7 +47,32 @@ Omit `provider` to discover all enabled API-key providers in one run. The Settin
 An empty `models` array means all models in the latest available catalog. The selected catalog is written to DSH's `llm-pi-ai` settings, so the standard DSH model picker refreshes from the resulting list.
 
 
+The plugin-owned `adapterRegistry` setting adds an opt-in declarative adapter without copying code. A provider entry can specify `endpoint`, `auth` (`bearer`, `x-api-key`, `query-key`, or `none`), `parser`, `modelsPath`, field paths, and explicit capability mappings. Endpoints must be HTTPS except loopback HTTP; credential-like static headers and URL query/fragment data are rejected. Existing built-in descriptors and OpenAI-compatible routes remain the default. Runtime integrations can register an explicit adapter implementation through the registry escape hatch, provided it implements `discover` and `health`.
+
 The full catalog discovered by an applied run is cached in the plugin's own settings
 separately from the model allowlist. After a restart, the model chooser can show the
 full last-known catalog while the standard DSH picker still exposes only the selected
 models. Dry-run remains read-only and does not persist this cache.
+
+
+`GET /dsh-model-sync/report` returns the latest stable aggregate report. It distinguishes success, partial success, failure, and empty runs, includes provider/model counts, and labels whether the source was manual or scheduled. `GET /dsh-model-sync/notifications` returns the bounded in-app notification ledger; repeated identical failures update an occurrence counter instead of creating noise. `POST /dsh-model-sync/notifications/read` and `POST /dsh-model-sync/notifications/acknowledge` accept `{ "id": "sync-notice-..." }` and persist the corresponding state for applied runs. Report and notification text is redacted before it leaves the synchronizer; no webhook or MCP dependency is required.
+
+`GET /dsh-model-sync/credentials` returns bounded diagnostics for configured provider credential references. It calls the DSH credentials `describe` seam only, reports masked reference labels, source/configured state, rotation order, and the last safe request outcome. It never resolves or returns a credential value. `POST /dsh-model-sync/credentials/check` runs the health probe and returns the same diagnostics in one response; a failed reference is recorded per provider without hiding the remaining rotation entries.
+
+`GET /dsh-model-sync/history` returns the bounded history of applied runs. Use
+`?provider=<id>&details=true` for one provider's full snapshots and metadata diff.
+`POST /dsh-model-sync/history/rollback` accepts `{ "historyId": "sync-…", "provider": "openai" }`
+and restores only that provider's catalog; it never changes the model allowlist.
+History is written only by non-dry-run synchronization, is retained according to
+`historyLimit` (1–200, default 50), and redacts credential-shaped error values.
+Rename detection requires an explicit provider `aliases` or `previousIds` field;
+model-id similarity is never guessed.
+
+
+Lifecycle protection keeps a model `stale` after a missing discovery and only
+moves it to `removed` after the configured `staleGraceRuns` and an explicit
+removal confirmation. Provider-declared `deprecated`/`deprecationDate`/
+`expiration_date` metadata is retained as an audit status. Repeated transport or
+credential failures do not advance lifecycle counters. The full catalog cache
+retains stale entries until the user confirms removal; the model picker defaults
+to active models while explicit selections may still name a retained model.

package/lib/adapter-registry.js

@@ -1,7 +1,12 @@
+import { catalogRequestError } from './reliability.js'
 import { canUseGenericAdapter, createGenericAdapter } from './generic-adapter.js'
 import { normalizeModels } from './models.js'
 
 const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
+const SAFE_AUTH = new Set(['bearer', 'x-api-key', 'query-key', 'none'])
+const SAFE_PARSERS = new Set(['openai', 'google'])
+const CAPABILITIES = new Set(['vision', 'tools', 'reasoning', 'embeddings'])
+const BLOCKED_HEADERS = /authorization|api[_-]?key|token|secret|cookie/i
 
 const PROVIDER_ADAPTERS = Object.freeze({
   anthropic: { endpoint: 'https://api.anthropic.com/v1/models', auth: 'x-api-key', headers: { 'anthropic-version': '2023-06-01' } },
@@ -16,13 +21,13 @@ const PROVIDER_ADAPTERS = Object.freeze({
   cerebras: { endpoint: 'https://api.cerebras.ai/v1/models', auth: 'bearer' },
   fireworks: { endpoint: 'https://api.fireworks.ai/inference/v1/models', auth: 'bearer' },
   huggingface: { endpoint: 'https://router.huggingface.co/v1/models', auth: 'bearer' },
-  'moonshotai': { endpoint: 'https://api.moonshot.ai/v1/models', auth: 'bearer' },
+  moonshotai: { endpoint: 'https://api.moonshot.ai/v1/models', auth: 'bearer' },
   'moonshotai-cn': { endpoint: 'https://api.moonshot.cn/v1/models', auth: 'bearer' },
   nvidia: { endpoint: 'https://integrate.api.nvidia.com/v1/models', auth: 'bearer' },
   'qwen-token-plan': { endpoint: 'https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1/models', auth: 'bearer' },
   'qwen-token-plan-cn': { endpoint: 'https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1/models', auth: 'bearer' },
   together: { endpoint: 'https://api.together.ai/v1/models', auth: 'bearer' },
-  'xiaomi': { endpoint: 'https://api.xiaomimimo.com/v1/models', auth: 'bearer' },
+  xiaomi: { endpoint: 'https://api.xiaomimimo.com/v1/models', auth: 'bearer' },
   'xiaomi-token-plan-ams': { endpoint: 'https://token-plan-ams.xiaomimimo.com/v1/models', auth: 'bearer' },
   'xiaomi-token-plan-cn': { endpoint: 'https://token-plan-cn.xiaomimimo.com/v1/models', auth: 'bearer' },
   'xiaomi-token-plan-sgp': { endpoint: 'https://token-plan-sgp.xiaomimimo.com/v1/models', auth: 'bearer' },
@@ -30,8 +35,32 @@ const PROVIDER_ADAPTERS = Object.freeze({
   'zai-coding-cn': { endpoint: 'https://open.bigmodel.cn/api/coding/paas/v4/models', auth: 'bearer' },
 })
 
-function parseRows(provider, payload, parser) {
-  if (parser === 'google') {
+function pathValue(value, path) {
+  if (typeof path !== 'string' || !path.trim()) return undefined
+  return path.split('.').reduce((current, key) => current && typeof current === 'object' ? current[key] : undefined, value)
+}
+
+function mappedRows(provider, rows, descriptor) {
+  const fields = descriptor.fields && typeof descriptor.fields === 'object' ? descriptor.fields : {}
+  const capabilityMap = descriptor.capabilityMap && typeof descriptor.capabilityMap === 'object' ? descriptor.capabilityMap : {}
+  return rows.map((row) => {
+    const mapped = { ...(row && typeof row === 'object' ? row : {}) }
+    for (const [target, source] of Object.entries(fields)) {
+      if (!['id', 'name', 'description', 'contextWindow', 'maxTokens', 'pricing', 'tags'].includes(target)) continue
+      const value = pathValue(row, source)
+      if (value !== undefined) mapped[target] = value
+    }
+    for (const capability of CAPABILITIES) {
+      const sources = Array.isArray(capabilityMap[capability]) ? capabilityMap[capability] : [capabilityMap[capability]]
+      const source = sources.find((item) => typeof item === 'string' && pathValue(row, item) !== undefined)
+      if (source) mapped[capability] = pathValue(row, source)
+    }
+    return mapped
+  })
+}
+
+function parseRows(provider, payload, descriptor) {
+  if (descriptor.parse === 'google') {
     const rows = Array.isArray(payload?.models) ? payload.models : []
     return normalizeModels(provider, rows.map((row) => ({
       ...row,
@@ -41,47 +70,138 @@ function parseRows(provider, payload, parser) {
       maxTokens: row.outputTokenLimit,
     })))
   }
-  const rows = payload?.data ?? payload?.models ?? payload?.availableModels
-  return normalizeModels(provider, Array.isArray(rows) ? rows : [])
+  const rows = pathValue(payload, descriptor.modelsPath) ?? payload?.data ?? payload?.models ?? payload?.availableModels
+  return normalizeModels(provider, Array.isArray(rows) ? mappedRows(provider, rows, descriptor) : [])
+}
+
+function privateHttpHost(hostname) {
+  const host = String(hostname ?? '').toLowerCase()
+  return host === 'localhost' || host === '127.0.0.1' || host === '::1'
+}
+
+export function normalizeAdapterConfig(config, profile = {}) {
+  const source = config && typeof config === 'object' ? config : {}
+  const base = profile.baseURL ? String(profile.baseURL).replace(/\/+$/, '') : ''
+  const endpointValue = source.endpoint || (base ? (base.endsWith('/models') ? base : base + '/models') : '')
+  if (typeof endpointValue !== 'string' || !endpointValue.trim()) throw Object.assign(new Error('adapter endpoint is required'), { code: 'ADAPTER_CONFIG_INVALID' })
+  let endpoint
+  try { endpoint = new URL(endpointValue) } catch { throw Object.assign(new Error('adapter endpoint must be a valid URL'), { code: 'ADAPTER_CONFIG_INVALID' }) }
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || !['https:', 'http:'].includes(endpoint.protocol)) {
+    throw Object.assign(new Error('adapter endpoint must not contain credentials, query, or hash'), { code: 'ADAPTER_CONFIG_INVALID' })
+  }
+  if (endpoint.protocol === 'http:' && !privateHttpHost(endpoint.hostname)) {
+    throw Object.assign(new Error('adapter endpoint must use https outside loopback'), { code: 'ADAPTER_CONFIG_INVALID' })
+  }
+  const auth = source.auth === undefined ? 'bearer' : String(source.auth)
+  if (!SAFE_AUTH.has(auth)) throw Object.assign(new Error('adapter auth mode is unsupported'), { code: 'ADAPTER_CONFIG_INVALID' })
+  const parse = source.parser === undefined ? 'openai' : String(source.parser)
+  if (!SAFE_PARSERS.has(parse)) throw Object.assign(new Error('adapter parser is unsupported'), { code: 'ADAPTER_CONFIG_INVALID' })
+  const headers = {}
+  if (source.headers !== undefined) {
+    if (!source.headers || typeof source.headers !== 'object' || Array.isArray(source.headers)) throw Object.assign(new Error('adapter headers must be an object'), { code: 'ADAPTER_CONFIG_INVALID' })
+    for (const [key, value] of Object.entries(source.headers).slice(0, 20)) {
+      if (!/^[A-Za-z0-9-]{1,64}$/.test(key) || BLOCKED_HEADERS.test(key) || typeof value !== 'string' || value.length > 256 || !/^[\x20-\x7E]*$/.test(value)) {
+        throw Object.assign(new Error('adapter headers contain an unsafe field'), { code: 'ADAPTER_CONFIG_INVALID' })
+      }
+      headers[key] = value
+    }
+  }
+  const modelsPath = typeof source.modelsPath === 'string' && /^[A-Za-z0-9_.-]{1,128}$/.test(source.modelsPath.trim()) ? source.modelsPath.trim() : 'data'
+  const capabilityMap = source.capabilityMap && typeof source.capabilityMap === 'object' && !Array.isArray(source.capabilityMap) ? structuredClone(source.capabilityMap) : {}
+  for (const key of Object.keys(capabilityMap)) if (!CAPABILITIES.has(key)) delete capabilityMap[key]
+  const fields = source.fields && typeof source.fields === 'object' && !Array.isArray(source.fields) ? structuredClone(source.fields) : {}
+  for (const key of Object.keys(fields)) if (!['id', 'name', 'description', 'contextWindow', 'maxTokens', 'pricing', 'tags'].includes(key) || typeof fields[key] !== 'string' || fields[key].length > 128) delete fields[key]
+  for (const key of Object.keys(capabilityMap)) {
+    const values = Array.isArray(capabilityMap[key]) ? capabilityMap[key] : [capabilityMap[key]]
+    capabilityMap[key] = values.filter((value) => typeof value === 'string' && value.length <= 128).slice(0, 8)
+  }
+  return { endpoint: endpoint.toString(), auth, parse, headers, modelsPath, capabilityMap, fields }
 }
 
-async function fetchSpecific(profile, descriptor, { resolveCredential, fetchImpl, signal }) {
+async function requestSpecific(profile, descriptor, { resolveCredential, fetchImpl, signal }) {
   const apiKey = profile.apiKeyEnv ? await resolveCredential(profile.apiKeyEnv) : ''
-  const url = new URL(profile.baseURL ? `${String(profile.baseURL).replace(/\/+$/, '')}/models` : descriptor.endpoint)
+  const url = new URL(descriptor.endpoint)
   const headers = { Accept: 'application/json', ...(descriptor.headers ?? {}) }
-  if (descriptor.auth === 'bearer' && apiKey) headers.Authorization = `Bearer ${apiKey}`
+  if (descriptor.auth === 'bearer' && apiKey) headers.Authorization = 'Bearer ' + apiKey
   if (descriptor.auth === 'x-api-key' && apiKey) headers['x-api-key'] = apiKey
   if (descriptor.auth === 'query-key' && apiKey) url.searchParams.set('key', apiKey)
-  const response = await fetchImpl(url, { headers, signal })
-  if (!response.ok) throw new Error(`model catalog request failed with HTTP ${response.status}`)
+  let response
+  try { response = await fetchImpl(url, { headers, signal }) } catch (error) {
+    if (error && typeof error === 'object') error.adapterCode = 'endpoint'
+    throw error
+  }
+  if (!response.ok) {
+    const error = catalogRequestError(response.status)
+    error.adapterCode = [401, 403].includes(response.status) ? 'auth' : 'http'
+    throw error
+  }
+  return response
+}
+
+async function fetchSpecific(profile, descriptor, options) {
+  const response = await requestSpecific(profile, descriptor, options)
   const text = await response.text()
-  if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) throw new Error('model catalog response is too large')
+  if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
+    const error = new Error('model catalog response is too large')
+    error.adapterCode = 'schema'
+    throw error
+  }
   let payload
-  try {
-    payload = JSON.parse(text)
-  } catch {
-    throw new Error('model catalog response is not valid JSON')
+  try { payload = JSON.parse(text) } catch {
+    const error = new Error('model catalog response is not valid JSON')
+    error.adapterCode = 'schema'
+    throw error
   }
-  return parseRows(profile.provider, payload, descriptor.parse)
+  return parseRows(profile.provider, payload, descriptor)
+}
+
+async function probeSpecific(profile, descriptor, options) {
+  const startedAt = Date.now()
+  const response = await requestSpecific(profile, descriptor, options)
+  if (typeof response.body?.cancel === 'function') await response.body.cancel()
+  return { statusCode: response.status, latencyMs: Date.now() - startedAt }
 }
 
-export function createProviderAdapterRegistry({ resolveCredential, fetchImpl = fetch } = {}) {
+export function createProviderAdapterRegistry({ resolveCredential, fetchImpl = fetch, adapters = {} } = {}) {
   const generic = createGenericAdapter({ resolveCredential, fetchImpl })
-  return Object.freeze({
+  const explicit = new Map()
+  for (const [id, adapter] of Object.entries(adapters ?? {})) {
+    if (adapter?.discover && adapter?.health) explicit.set(id, Object.freeze({ id: 'explicit:' + id, canHandle: adapter.canHandle ?? (() => true), discover: adapter.discover, health: adapter.health }))
+  }
+  function register(id, adapter) {
+    if (typeof id !== 'string' || !/^[A-Za-z0-9._:-]{1,64}$/.test(id) || !adapter?.discover || !adapter?.health) {
+      throw Object.assign(new Error('adapter implementation must expose discover and health'), { code: 'ADAPTER_IMPLEMENTATION_INVALID' })
+    }
+    const normalized = Object.freeze({ id: 'explicit:' + id, canHandle: adapter.canHandle ?? (() => true), discover: adapter.discover, health: adapter.health })
+    explicit.set(id, normalized)
+    return normalized
+  }
+  function declarative(profile, config) {
+    const descriptor = normalizeAdapterConfig(config, profile)
+    return Object.freeze({
+      id: 'declarative:' + profile.provider,
+      canHandle: () => true,
+      discover: (current, options = {}) => fetchSpecific(current, descriptor, { resolveCredential, fetchImpl, ...options }),
+      health: (current, options = {}) => probeSpecific(current, descriptor, { resolveCredential, fetchImpl, ...options }),
+      descriptor,
+    })
+  }
+  const registry = {
     descriptors: PROVIDER_ADAPTERS,
-    select(profile) {
+    register,
+    select(profile, config) {
+      if (profile?.adapterId && explicit.has(profile.adapterId)) return explicit.get(profile.adapterId)
+      if (config && config.enabled !== false && (config.endpoint || profile?.baseURL)) return declarative(profile, config)
       if (canUseGenericAdapter(profile)) return generic
       const descriptor = PROVIDER_ADAPTERS[profile?.provider]
       if (!descriptor) return null
       return Object.freeze({
-        id: `provider:${profile.provider}`,
+        id: 'provider:' + profile.provider,
         canHandle: () => true,
-        discover: (current, options = {}) => fetchSpecific(current, descriptor, {
-          resolveCredential,
-          fetchImpl,
-          ...options,
-        }),
+        discover: (current, options = {}) => fetchSpecific(current, { ...descriptor, modelsPath: 'data', fields: {}, capabilityMap: {} }, { resolveCredential, fetchImpl, ...options }),
+        health: (current, options = {}) => probeSpecific(current, descriptor, { resolveCredential, fetchImpl, ...options }),
       })
     },
-  })
+  }
+  return Object.freeze(registry)
 }

package/lib/client.js

@@ -4,11 +4,46 @@ window.__ModuleLoader__.load({
     var module = { exports: {} }
     var exports = module.exports
     const React = require('react')
+
+    const CSS = '.dms-wrap{display:flex;flex-direction:column;gap:14px;max-width:760px;box-sizing:border-box;color:var(--dsw-alias-label-primary,inherit)}' +
+      '.dms-wrap>p{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.55}' +
+      '.dms-toolbar,.dms-section,.dms-editor{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary,rgba(255,255,255,.14)));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
+      '.dms-toolbar>select{flex:1 1 190px;min-width:190px}' +
+      '.dms-toolbar>.dms-actions{flex-basis:100%}' +
+      '.dms-toolbar>label{display:inline-flex;align-items:flex-start;gap:7px;font-size:12px;line-height:1.35;color:var(--dsw-alias-label-secondary)}' +
+      '.dms-toolbar>select,.dms-editor input,.dms-editor textarea{box-sizing:border-box;min-width:0;background:var(--dsw-specific-input-major,var(--dsw-alias-bg-layer-2,transparent));border:1px solid var(--dsw-alias-border-l1,var(--dsw-alias-border-l2));border-radius:6px;color:var(--dsw-alias-label-primary);font:inherit;padding:7px 9px}' +
+      '.dms-toolbar>label input{accent-color:var(--dsw-alias-brand-primary,var(--dsw-alias-button-info-fill))}' +
+      '.dms-actions{display:flex;align-items:center;flex-wrap:wrap;gap:7px}' +
+      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary,rgba(255,255,255,.14)));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
+      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
+      '.dms-btn:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary);background:var(--dsw-alias-bg-layer-2,rgba(255,255,255,.05))}' +
+      '.dms-btn:disabled{opacity:.45;cursor:default}' +
+      '.dms-section>strong{display:block;font-size:13px;font-weight:650}' +
+      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0 0 7px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
+      '.dms-provider>span{min-width:0;overflow-wrap:anywhere;line-height:1.4}' +
+      '.dms-section>div[style]{padding:8px 0;border-top:1px solid var(--dsw-alias-border-l2)}' +
+      '.dms-editor{border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
+      '.dms-editor strong{font-size:13px}' +
+      '.dms-editor label{display:block;gap:5px;margin-top:8px;color:var(--dsw-alias-label-secondary);font-size:12px}' +
+      '.dms-editor label input,.dms-editor label textarea{width:100%}' +
+      '.dms-editor input[type="checkbox"]{width:auto;accent-color:var(--dsw-alias-brand-primary)}' +
+      '@media (max-width:540px){.dms-provider{grid-template-columns:1fr!important}.dms-provider .dms-btn{justify-self:start}.dms-toolbar>div:first-child{align-items:stretch;flex-direction:column}.dms-toolbar>div:first-child select{width:100%}.dms-toolbar,.dms-section,.dms-editor{padding:11px 12px}}'
+
+    function ensureStyles() {
+      if (typeof document === 'undefined' || !document.head) return
+      const cssId = 'dsh-model-sync/settings.module.css'
+      if (document.querySelector('style[data-plugin-css="' + cssId + '"]')) return
+      const tag = document.createElement('style')
+      tag.textContent = CSS
+      tag.setAttribute('data-plugin', 'dsh-model-sync')
+      tag.setAttribute('data-plugin-css', cssId)
+      document.head.appendChild(tag)
+    }
     const en = {
-      title: 'Model synchronization', desc: 'Refresh model catalogs for API-key providers. A dry-run is the default; applying changes is explicit.', loading: 'Loading…', refresh: 'Refresh status', refreshAll: 'Refresh all', run: 'Discover', apply: 'Apply changes', dryRun: 'Preview only (dry-run)', all: 'All API-key providers', ok: 'ready', dormant: 'not configured', running: 'running…', noProviders: 'No API-key providers found.', lastRun: 'Last run', selectModels: 'Choose models', saveSelection: 'Save and apply selection', selectAtLeastOne: 'Select at least one model or use All models.', cancel: 'Cancel', selected: 'selected', allModels: 'All models', noModels: 'No models in the current catalog.', pickerNote: 'The selection is applied to the DSH model picker immediately.',
+      title: 'Model synchronization', desc: 'Refresh model catalogs for API-key providers. A dry-run is the default; applying changes is explicit.', loading: 'Loading…', refresh: 'Refresh status', refreshAll: 'Refresh all', run: 'Discover', apply: 'Apply changes', dryRun: 'Preview only (dry-run)', all: 'All API-key providers', ok: 'ready', dormant: 'not configured', running: 'running…', noProviders: 'No API-key providers found.', lastRun: 'Last run', selectModels: 'Choose models', saveSelection: 'Save and apply selection', selectAtLeastOne: 'Select at least one model or use All models.', cancel: 'Cancel', selected: 'selected', allModels: 'All models', noModels: 'No models in the current catalog.', pickerNote: 'The selection is applied to the DSH model picker immediately.', health: 'Check availability', healthOk: 'available', healthError: 'unavailable', healthDormant: 'not configured', policy: 'Model policy', savePolicy: 'Save policy', policyInclude: 'Include patterns (one per line)', policyExclude: 'Exclude patterns (one per line)', policyRequire: 'Required capabilities (comma-separated)', policyDeny: 'Denied capabilities (comma-separated)', policyNote: 'Patterns match model id, name, and tags. Apply changes to update the DSH picker.', scheduler: 'Scheduler', nextRun: 'next run', schedulerOff: 'off', schedulerOn: 'on', removeMissing: 'Confirm stale removal', stale: 'stale', deprecated: 'deprecated', history: 'Synchronization history', historyRun: 'Run', diffAdded: 'added', diffRemoved: 'removed', diffRenamed: 'renamed', diffChanged: 'metadata changed', rollback: 'Rollback catalog', rollbackConfirm: 'Rollback this provider catalog to the selected snapshot?', credentials: 'Credential diagnostics', checkCredentials: 'Check credentials', missingCredential: 'not configured', credentialReady: 'configured', report: 'Run report', success: 'success', partial: 'partial success', failure: 'failed', empty: 'no configured providers', notifications: 'Notifications', markRead: 'Mark read', acknowledge: 'Acknowledge', noNotifications: 'No notifications.',
     }
     const ru = {
-      title: 'Синхронизация моделей', desc: 'Обновляет каталоги моделей у провайдеров с API-ключом. По умолчанию только dry-run; применение запускается явно.', loading: 'Загрузка…', refresh: 'Обновить статус', refreshAll: 'Обновить все', run: 'Проверить', apply: 'Применить изменения', dryRun: 'Только просмотр (dry-run)', all: 'Все API-key провайдеры', ok: 'готов', dormant: 'не настроен', running: 'выполняется…', noProviders: 'API-key провайдеры не найдены.', lastRun: 'Последний запуск', selectModels: 'Выбрать модели', saveSelection: 'Сохранить и применить выбор', selectAtLeastOne: 'Выберите хотя бы одну модель или нажмите «Все модели».', cancel: 'Отмена', selected: 'выбрано', allModels: 'Все модели', noModels: 'В текущем каталоге нет моделей.', pickerNote: 'Выбор сразу применяется к пикеру моделей DSH.',
+      title: 'Синхронизация моделей', desc: 'Обновляет каталоги моделей у провайдеров с API-ключом. По умолчанию только dry-run; применение запускается явно.', loading: 'Загрузка…', refresh: 'Обновить статус', refreshAll: 'Обновить все', run: 'Проверить', apply: 'Применить изменения', dryRun: 'Только просмотр (dry-run)', all: 'Все API-key провайдеры', ok: 'готов', dormant: 'не настроен', running: 'выполняется…', noProviders: 'API-key провайдеры не найдены.', lastRun: 'Последний запуск', selectModels: 'Выбрать модели', saveSelection: 'Сохранить и применить выбор', selectAtLeastOne: 'Выберите хотя бы одну модель или нажмите «Все модели».', cancel: 'Отмена', selected: 'выбрано', allModels: 'Все модели', noModels: 'В текущем каталоге нет моделей.', pickerNote: 'Выбор сразу применяется к пикеру моделей DSH.', health: 'Проверить доступность', healthOk: 'доступен', healthError: 'недоступен', healthDormant: 'не настроен', policy: 'Политика моделей', savePolicy: 'Сохранить политику', policyInclude: 'Включать (по одному шаблону в строке)', policyExclude: 'Исключать (по одному шаблону в строке)', policyRequire: 'Обязательные возможности (через запятую)', policyDeny: 'Запрещённые возможности (через запятую)', policyNote: 'Шаблоны ищутся в id, названии и тегах модели. Нажмите «Применить», чтобы обновить пикер DSH.', scheduler: 'Планировщик', nextRun: 'следующий запуск', schedulerOff: 'выключен', schedulerOn: 'включён', removeMissing: 'Подтвердить удаление устаревших', stale: 'устарела', deprecated: 'deprecated', history: 'История синхронизаций', historyRun: 'Запуск', diffAdded: 'добавлено', diffRemoved: 'удалено', diffRenamed: 'переименовано', diffChanged: 'изменена метаинформация', rollback: 'Откатить каталог', rollbackConfirm: 'Откатить каталог этого провайдера к выбранному снимку?', credentials: 'Диагностика ключей', checkCredentials: 'Проверить ключи', missingCredential: 'не настроен', credentialReady: 'настроен', report: 'Итог запуска', success: 'успех', partial: 'частичный успех', failure: 'ошибка', empty: 'нет настроенных провайдеров', notifications: 'Уведомления', markRead: 'Прочитано', acknowledge: 'Подтвердить', noNotifications: 'Новых уведомлений нет.',
     }
     const API = '/dsh-model-sync'
     function useLocale(ctx) {
@@ -16,22 +51,60 @@ window.__ModuleLoader__.load({
     }
     function ModelSyncSection({ ctx }) {
       const locale = useLocale(ctx); const t = locale === 'ru' ? ru : en
-      const [status, setStatus] = React.useState(null); const [provider, setProvider] = React.useState(''); const [dryRun, setDryRun] = React.useState(true); const [busy, setBusy] = React.useState(false); const [error, setError] = React.useState('')
-      const [selectionProvider, setSelectionProvider] = React.useState(''); const [selectionDraft, setSelectionDraft] = React.useState([])
+      const [status, setStatus] = React.useState(null); const [provider, setProvider] = React.useState(''); const [dryRun, setDryRun] = React.useState(true); const [removeMissing, setRemoveMissing] = React.useState(false); const [busy, setBusy] = React.useState(false); const [error, setError] = React.useState(''); const [credentialStatus, setCredentialStatus] = React.useState(null)
+      const [selectionProvider, setSelectionProvider] = React.useState(''); const [selectionDraft, setSelectionDraft] = React.useState([]); const [policyProvider, setPolicyProvider] = React.useState(''); const [policyDraft, setPolicyDraft] = React.useState({ include: '', exclude: '', requireCapabilities: '', denyCapabilities: '' })
       const load = React.useCallback(() => { setError(''); return fetch(`${API}/status`).then((r) => r.json()).then(setStatus).catch((e) => setError(String(e?.message ?? e))) }, [])
-      React.useEffect(() => { load(); const timer = setInterval(load, 15000); return () => clearInterval(timer) }, [load])
-      const execute = (targetProvider) => { setBusy(true); setError(''); fetch(`${API}/run`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ provider: targetProvider || undefined, dryRun }) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then(setStatus).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
-      const openSelection = (row) => { const available = row.availableModels ?? row.models ?? []; setSelectionProvider(row.provider); setSelectionDraft(row.selectedModels?.length ? row.selectedModels : available.map((model) => model.id)) }
+      const loadCredentials = React.useCallback(() => { setError(''); return fetch(`${API}/credentials`).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then(setCredentialStatus).catch((e) => setError(String(e?.message ?? e))) }, [])
+      React.useEffect(() => { ensureStyles(); load(); const timer = setInterval(load, 15000); return () => clearInterval(timer) }, [load])
+      const execute = (targetProvider) => { if (!dryRun && removeMissing && !window.confirm(t.removeMissing)) return; setBusy(true); setError(''); fetch(`${API}/run`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ provider: targetProvider || undefined, dryRun, removeMissing }) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then(() => load()).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
+      const checkHealth = (targetProvider) => { setBusy(true); setError(''); fetch(`${API}/health`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(targetProvider ? { provider: targetProvider } : {}) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then(setStatus).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
+      const checkCredentials = (targetProvider) => { setBusy(true); setError(''); fetch(`${API}/credentials/check`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(targetProvider ? { provider: targetProvider } : {}) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then((body) => { setCredentialStatus(body.credentials); setStatus((current) => ({ ...(current ?? {}), lastHealth: body.health })) }).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
+      const updateNotification = (id, action) => { setBusy(true); setError(''); fetch(API + '/notifications/' + action, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id }) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? ('HTTP ' + r.status)); return body }).then(() => load()).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
+      const openSelection = (row) => { const available = row.availableModels ?? row.models ?? []; const defaults = row.selectableModels ?? available; setSelectionProvider(row.provider); setSelectionDraft(row.selectedModels?.length ? row.selectedModels : defaults.map((model) => model.id)) }
       const closeSelection = () => { setSelectionProvider(''); setSelectionDraft([]) }
+      const openPolicy = (row) => { const policy = status?.policies?.[row.provider] ?? row.policy ?? {}; setPolicyProvider(row.provider); setPolicyDraft({ include: (policy.include ?? []).join('\n'), exclude: (policy.exclude ?? []).join('\n'), requireCapabilities: Object.keys(policy.requireCapabilities ?? {}).join(', '), denyCapabilities: Object.keys(policy.denyCapabilities ?? {}).join(', ') }) }
+      const closePolicy = () => { setPolicyProvider(''); setPolicyDraft({ include: '', exclude: '', requireCapabilities: '', denyCapabilities: '' }) }
+      const splitValues = (value) => [...new Set(String(value ?? '').split(/[,\n]+/).map((item) => item.trim()).filter(Boolean))]
+      const capabilityValues = (value) => Object.fromEntries(splitValues(value).map((key) => [key, true]))
+      const savePolicy = () => { setBusy(true); setError(''); fetch(`${API}/policy`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ provider: policyProvider, include: splitValues(policyDraft.include), exclude: splitValues(policyDraft.exclude), requireCapabilities: capabilityValues(policyDraft.requireCapabilities), denyCapabilities: capabilityValues(policyDraft.denyCapabilities) }) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then(() => { closePolicy(); return load() }).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
       const saveSelection = () => { const row = rows.find((item) => item.provider === selectionProvider); const available = row?.availableModels ?? row?.models ?? []; if (available.length > 0 && selectionDraft.length === 0) { setError(t.selectAtLeastOne); return } const models = selectionDraft.length === available.length ? [] : selectionDraft; setBusy(true); setError(''); fetch(`${API}/selection`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ provider: selectionProvider, models }) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then((body) => { setStatus(body); closeSelection() }).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
-      const rows = (status?.providers ?? []).filter((row) => row.configured); const selectedRow = rows.find((row) => row.provider === selectionProvider); const choices = selectedRow?.availableModels ?? selectedRow?.models ?? []; const button = (label, onClick) => React.createElement('button', { type: 'button', disabled: busy, onClick, style: { marginRight: 8 } }, label)
-      return React.createElement('div', { style: { display: 'flex', flexDirection: 'column', gap: 10, maxWidth: 680 } },
+      const rollback = (entry, targetProvider) => { if (!window.confirm(t.rollbackConfirm)) return; setBusy(true); setError(''); fetch(`${API}/history/rollback`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ historyId: entry.id, provider: targetProvider }) }).then(async (r) => { const body = await r.json(); if (!r.ok) throw new Error(body?.error?.message ?? `HTTP ${r.status}`); return body }).then(() => load()).catch((e) => setError(String(e?.message ?? e))).finally(() => setBusy(false)) }
+      const rows = (status?.providers ?? []).filter((row) => row.configured); const selectedRow = rows.find((row) => row.provider === selectionProvider); const choices = selectedRow?.availableModels ?? selectedRow?.models ?? []; const button = (label, onClick) => React.createElement('button', { type: 'button', disabled: busy, onClick, className: 'dms-btn' }, label)
+      const renderNotifications = () => {
+        const entries = status?.notifications ?? []
+        if (entries.length === 0) return React.createElement('small', { style: { display: 'block', marginTop: 6 } }, t.noNotifications)
+        return entries.map((item) => React.createElement('div', { key: item.id, style: { marginTop: 6 } },
+          React.createElement('span', null, item.title + ': ' + item.message + ' · ' + (item.occurrences ?? 1) + '×'),
+          item.readAt ? null : button(t.markRead, () => updateNotification(item.id, 'read')),
+          item.acknowledgedAt ? null : button(t.acknowledge, () => updateNotification(item.id, 'acknowledge')),
+          React.createElement('small', { style: { display: 'block', marginLeft: 12 } }, (item.providers ?? []).map((row) => row.provider + ': ' + row.status + (row.message ? ' · ' + row.message : '')).join('; '))))
+      }
+      const renderHistory = () => {
+        const entries = status?.history ?? []
+        if (entries.length === 0) return React.createElement('small', { style: { display: 'block', marginTop: 6 } }, t.noHistory)
+        return entries.map((entry) => React.createElement('details', { key: entry.id, style: { marginTop: 6 } },
+          React.createElement('summary', null, `${t.historyRun} #${entry.version} · ${new Date(entry.finishedAt).toLocaleString()}`),
+          (entry.providers ?? []).map((item) => {
+            const counts = item.counts ?? {}
+            const names = (items) => (items ?? []).map((model) => model?.after?.id ?? model?.id).filter(Boolean).join(', ')
+            const details = `+ ${names(item.diff?.added)}; - ${names(item.diff?.removed)}; ⇄ ${(item.diff?.renamed ?? []).map((pair) => `${pair.before?.id} → ${pair.after?.id}`).join(', ')}; ~ ${(item.diff?.changed ?? []).map((pair) => pair.after?.id).join(', ')}`
+            return React.createElement('div', { key: item.provider, style: { margin: '6px 0 6px 12px' } },
+              React.createElement('span', null, `${item.provider}: ${item.status} · +${counts.added ?? 0} ${t.diffAdded}, -${counts.removed ?? 0} ${t.diffRemoved}, ${counts.renamed ?? 0} ${t.diffRenamed}, ${counts.changed ?? 0} ${t.diffChanged}`),
+              item.hasRollback ? button(t.rollback, () => rollback(entry, item.provider)) : null,
+              React.createElement('small', { style: { display: 'block', marginTop: 4 } }, details))
+          })))
+      }
+      return React.createElement('div', { className: 'dms-wrap' },
         React.createElement('p', null, t.desc),
-        React.createElement('div', null, React.createElement('select', { value: provider, onChange: (e) => setProvider(e.target.value) }, React.createElement('option', { value: '' }, t.all), rows.map((row) => React.createElement('option', { key: row.provider, value: row.provider }, row.provider))), React.createElement('label', { style: { marginLeft: 12 } }, React.createElement('input', { type: 'checkbox', checked: dryRun, onChange: (e) => setDryRun(e.target.checked) }), ` ${t.dryRun}`)),
-        React.createElement('div', null, button(t.refresh, load), button(t.refreshAll, () => execute(undefined)), button(dryRun ? t.run : t.apply, () => execute(provider || undefined))),
-        status?.lastRun ? React.createElement('small', null, `${t.lastRun}: ${new Date(status.lastRun.finishedAt).toLocaleString()}`) : null, status?.running || busy ? React.createElement('small', null, t.running) : null, error ? React.createElement('small', { style: { color: 'var(--dsw-alias-state-error-primary)' } }, error) : null, status === null ? React.createElement('small', null, t.loading) : null, rows.length === 0 && status ? React.createElement('small', null, t.noProviders) : null,
-        rows.map((row) => React.createElement('div', { key: row.provider, style: { display: 'flex', alignItems: 'center', gap: 8 } }, React.createElement('span', null, `${row.provider}: ${row.configured ? t.ok : t.dormant} · ${row.models?.length ?? 0} models`), button(t.selectModels, () => openSelection(row)))),
-        selectionProvider ? React.createElement('div', { style: { border: '1px solid var(--dsw-alias-border-primary)', padding: 12, borderRadius: 6 } }, React.createElement('strong', null, `${t.selectModels}: ${selectionProvider}`), React.createElement('div', { style: { margin: '8px 0' } }, choices.length === 0 ? React.createElement('small', null, t.noModels) : choices.map((model) => React.createElement('label', { key: model.id, style: { display: 'block', margin: '4px 0' } }, React.createElement('input', { type: 'checkbox', checked: selectionDraft.includes(model.id), onChange: (e) => setSelectionDraft((current) => e.target.checked ? [...current, model.id] : current.filter((id) => id !== model.id)) }), ` ${model.name ?? model.id} (${model.id})`))), React.createElement('small', null, t.pickerNote), React.createElement('div', { style: { marginTop: 8 } }, button(t.allModels, () => setSelectionDraft(choices.map((model) => model.id))), button(t.saveSelection, saveSelection), button(t.cancel, closeSelection))) : null,
+        React.createElement('div', { className: 'dms-toolbar' }, React.createElement('select', { value: provider, onChange: (e) => setProvider(e.target.value) }, React.createElement('option', { value: '' }, t.all), rows.map((row) => React.createElement('option', { key: row.provider, value: row.provider }, row.provider))), React.createElement('label', { style: { marginLeft: 12 } }, React.createElement('input', { type: 'checkbox', checked: dryRun, onChange: (e) => setDryRun(e.target.checked) }), ` ${t.dryRun}`), React.createElement('label', { style: { marginLeft: 12 } }, React.createElement('input', { type: 'checkbox', checked: removeMissing, onChange: (e) => setRemoveMissing(e.target.checked) }), ` ${t.removeMissing}`)),
+        React.createElement('div', { className: 'dms-actions' }, button(t.refresh, load), button(t.refreshAll, () => execute(undefined)), button(dryRun ? t.run : t.apply, () => execute(provider || undefined)), button(t.health, () => checkHealth(provider || undefined)), button(t.checkCredentials, () => checkCredentials(provider || undefined))),
+        status?.lastRun ? React.createElement('small', null, t.lastRun + ': ' + new Date(status.lastRun.finishedAt).toLocaleString()) : null, status?.lastReport ? React.createElement('div', { style: { marginTop: 8 } }, React.createElement('strong', null, t.report), React.createElement('small', { style: { display: 'block' } }, (t[status.lastReport.outcome] ?? status.lastReport.outcome) + ' · ' + (status.lastReport.counts?.succeeded ?? 0) + '/' + (status.lastReport.counts?.providers ?? 0) + ' providers · ' + (status.lastReport.counts?.models?.added ?? 0) + ' ' + t.diffAdded)) : null, status?.scheduler ? React.createElement('small', null, `${t.scheduler}: ${status.scheduler.active ? t.schedulerOn : t.schedulerOff}${status.scheduler.nextRunAt ? ` · ${t.nextRun}: ${new Date(status.scheduler.nextRunAt).toLocaleString()}` : ''}`) : null, status?.running || busy ? React.createElement('small', null, t.running) : null, error ? React.createElement('small', { style: { color: 'var(--dsw-alias-state-error-primary)' } }, error) : null, status === null ? React.createElement('small', null, t.loading) : null, rows.length === 0 && status ? React.createElement('small', null, t.noProviders) : null,
+        rows.map((row) => { const health = status?.lastHealth?.results?.find((item) => item.provider === row.provider); const healthText = health ? ` · ${health.status === 'ok' ? t.healthOk : health.status === 'dormant' ? t.healthDormant : t.healthError}` : ''; const lifecycleCounts = (row.lifecycleModels ?? []).reduce((counts, model) => { if (model.lifecycleStatus === 'stale') counts.stale += 1; if (model.lifecycleStatus === 'deprecated') counts.deprecated += 1; return counts }, { stale: 0, deprecated: 0 }); const lifecycleText = lifecycleCounts.stale || lifecycleCounts.deprecated ? ` · ${lifecycleCounts.stale} ${t.stale}, ${lifecycleCounts.deprecated} ${t.deprecated}` : ''; return React.createElement('div', { key: row.provider, className: 'dms-provider' }, React.createElement('span', null, `${row.provider}: ${row.configured ? t.ok : t.dormant} · ${row.models?.length ?? 0} models${lifecycleText}${healthText}`), button(t.selectModels, () => openSelection(row)), button(t.policy, () => openPolicy(row))) }),
+        React.createElement('div', { className: 'dms-section' }, React.createElement('strong', null, t.notifications), renderNotifications()),
+        React.createElement('div', { className: 'dms-section' }, React.createElement('strong', null, t.credentials), (credentialStatus?.results ?? []).length === 0 ? React.createElement('small', { style: { display: 'block', marginTop: 6 } }, t.noProviders) : (credentialStatus.results ?? []).map((item) => React.createElement('div', { key: item.provider, style: { marginTop: 6 } }, React.createElement('span', null, `${item.provider}: ${item.rotation?.configured ? `${item.rotation.keyCount} refs` : 'single ref'}${item.lastRequest ? ` · ${item.lastRequest.status}` : ''}`), (item.refs ?? []).map((ref) => React.createElement('small', { key: ref.ref || ref.label, style: { display: 'block', marginLeft: 12 } }, `${ref.order}. ${ref.label} · ${ref.configured === true ? t.credentialReady : t.missingCredential}${ref.source && ref.source !== 'unknown' ? ` · ${ref.source}` : ''}${ref.lastResolution?.status ? ` · ${ref.lastResolution.status}` : ''}`))))),
+        React.createElement('div', { className: 'dms-section' }, React.createElement('strong', null, t.history), renderHistory()),
+        selectionProvider ? React.createElement('div', { className: 'dms-editor' }, React.createElement('strong', null, `${t.selectModels}: ${selectionProvider}`), React.createElement('div', { style: { margin: '8px 0' } }, choices.length === 0 ? React.createElement('small', null, t.noModels) : choices.map((model) => React.createElement('label', { key: model.id, style: { display: 'block', margin: '4px 0' } }, React.createElement('input', { type: 'checkbox', checked: selectionDraft.includes(model.id), onChange: (e) => setSelectionDraft((current) => e.target.checked ? [...current, model.id] : current.filter((id) => id !== model.id)) }), ` ${model.name ?? model.id} (${model.id})`))), React.createElement('small', null, t.pickerNote), React.createElement('div', { style: { marginTop: 8 } }, button(t.allModels, () => setSelectionDraft(choices.map((model) => model.id))), button(t.saveSelection, saveSelection), button(t.cancel, closeSelection))) : null,
+        policyProvider ? React.createElement('div', { style: { border: '1px solid var(--dsw-alias-border-primary)', padding: 12, borderRadius: 6 } }, React.createElement('strong', null, `${t.policy}: ${policyProvider}`), React.createElement('label', { style: { display: 'block', marginTop: 8 } }, t.policyInclude, React.createElement('textarea', { rows: 3, value: policyDraft.include, onChange: (e) => setPolicyDraft((current) => ({ ...current, include: e.target.value })), style: { display: 'block', width: '100%' } })), React.createElement('label', { style: { display: 'block', marginTop: 8 } }, t.policyExclude, React.createElement('textarea', { rows: 3, value: policyDraft.exclude, onChange: (e) => setPolicyDraft((current) => ({ ...current, exclude: e.target.value })), style: { display: 'block', width: '100%' } })), React.createElement('label', { style: { display: 'block', marginTop: 8 } }, t.policyRequire, React.createElement('input', { value: policyDraft.requireCapabilities, onChange: (e) => setPolicyDraft((current) => ({ ...current, requireCapabilities: e.target.value })), style: { display: 'block', width: '100%' } })), React.createElement('label', { style: { display: 'block', marginTop: 8 } }, t.policyDeny, React.createElement('input', { value: policyDraft.denyCapabilities, onChange: (e) => setPolicyDraft((current) => ({ ...current, denyCapabilities: e.target.value })), style: { display: 'block', width: '100%' } })), React.createElement('small', null, t.policyNote), React.createElement('div', { style: { marginTop: 8 } }, button(t.savePolicy, savePolicy), button(t.cancel, closePolicy))) : null,
       )
     }
     function apply(ctx) { ctx.slots.inject('settings.section', () => ctx.slots.register({ name: 'settings.section', id: 'dsh-model-sync', order: 25, label: () => 'Model Sync' }, (props) => React.createElement(ModelSyncSection, { ...props, ctx }))) }

package/lib/credentials.js

@@ -1,4 +1,7 @@
 const PRINTABLE_API_KEY = /^[\x21-\x7E]+$/
+const SAFE_SOURCE = /^(env|file|project-env|user-env|unknown)$/
+const SAFE_REF = /^[A-Za-z_][A-Za-z0-9_]*$/
+const MAX_DIAGNOSTIC_REFS = 32
 
 export function normalizeApiKey(value) {
   if (value === undefined || value === null) return ''
@@ -10,12 +13,90 @@ export function normalizeApiKey(value) {
   return key
 }
 
+export function normalizeCredentialRef(value) {
+  if (typeof value !== 'string') return ''
+  const ref = value.trim()
+  return SAFE_REF.test(ref) ? ref : ''
+}
+
+export function maskCredentialRef(ref) {
+  const value = normalizeCredentialRef(ref)
+  if (!value) return 'invalid reference'
+  if (value.length <= 6) return `••••${value.slice(-2)}`
+  return `${value.slice(0, 2)}…${value.slice(-4)}`
+}
+
+function safeSource(value) {
+  const source = typeof value === 'string' ? value : 'unknown'
+  return SAFE_SOURCE.test(source) ? source : 'unknown'
+}
+
+function safeCode(error) {
+  const code = error?.code ?? error?.status ?? error?.statusCode
+  if (typeof code === 'number' && Number.isFinite(code)) return String(Math.trunc(code)).slice(0, 8)
+  if (typeof code === 'string' && /^[A-Za-z0-9_-]{1,32}$/.test(code)) return code
+  return 'credential-error'
+}
+
+function safeMessage(error) {
+  const source = error instanceof Error ? error.message : String(error ?? '')
+  return source.replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+}
+
 export function createCredentialResolver(ctx) {
   const credentials = ctx?.get?.('credentials') ?? ctx?.credentials
-  return async (ref) => {
-    if (!ref) return ''
-    if (!credentials?.resolve) throw new Error('DSH credentials service is unavailable')
-    const result = await credentials.resolve(ref)
-    return normalizeApiKey(typeof result === 'string' ? result : result?.value)
+  const observations = new Map()
+  const remember = (ref, patch) => {
+    const normalized = normalizeCredentialRef(ref)
+    if (!normalized) return
+    observations.set(normalized, { ...(observations.get(normalized) ?? {}), ...patch, at: Date.now() })
+  }
+  const resolver = async (ref) => {
+    const normalized = normalizeCredentialRef(ref)
+    if (!normalized) return ''
+    if (!credentials?.resolve) {
+      remember(normalized, { status: 'unavailable', code: 'CREDENTIALS_UNAVAILABLE' })
+      throw new Error('DSH credentials service is unavailable')
+    }
+    try {
+      const result = await credentials.resolve(normalized)
+      const value = normalizeApiKey(typeof result === 'string' ? result : result?.value)
+      remember(normalized, { status: value ? 'resolved' : 'missing', source: safeSource(result?.source) })
+      return value
+    } catch (error) {
+      const safe = Object.assign(new Error(safeMessage(error)), {
+        ...(error?.code === undefined ? {} : { code: error.code }),
+        ...(error?.status === undefined ? {} : { status: error.status }),
+        ...(error?.statusCode === undefined ? {} : { statusCode: error.statusCode }),
+      })
+      remember(normalized, { status: 'error', code: safeCode(error), message: safe.message })
+      throw safe
+    }
+  }
+  resolver.describe = async (ref) => {
+    const normalized = normalizeCredentialRef(ref)
+    if (!normalized) return { ref: '', label: maskCredentialRef(''), configured: false, status: 'invalid' }
+    const observed = observations.get(normalized)
+    if (!credentials?.describe) {
+      return { ref: normalized, label: maskCredentialRef(normalized), configured: 'unknown', status: 'describe-unavailable', ...(observed ? { lastResolution: structuredClone(observed) } : {}) }
+    }
+    try {
+      const info = await credentials.describe(normalized)
+      return {
+        ref: normalized,
+        label: maskCredentialRef(normalized),
+        configured: info?.configured === true,
+        source: safeSource(info?.source),
+        writable: info?.writable !== false,
+        ...(observed ? { lastResolution: structuredClone(observed) } : {}),
+      }
+    } catch (error) {
+      return { ref: normalized, label: maskCredentialRef(normalized), configured: 'unknown', status: 'describe-error', code: safeCode(error), message: safeMessage(error), ...(observed ? { lastResolution: structuredClone(observed) } : {}) }
+    }
+  }
+  resolver.diagnostics = async (refs) => {
+    const unique = [...new Set((Array.isArray(refs) ? refs : []).map(normalizeCredentialRef).filter(Boolean))].slice(0, MAX_DIAGNOSTIC_REFS)
+    return Promise.all(unique.map((ref, index) => resolver.describe(ref).then((row) => ({ order: index + 1, ...row }))))
   }
+  return resolver
 }

package/lib/generic-adapter.js

@@ -1,3 +1,4 @@
+import { catalogRequestError } from './reliability.js'
 import { normalizeModels } from './models.js'
 
 const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
@@ -30,6 +31,19 @@ export function canUseGenericAdapter(profile) {
   return Boolean(profile?.baseURL) && SUPPORTED_APIS.has(profile?.api || 'openai-completions')
 }
 
+function requestHeaders(apiKey) {
+  const headers = { Accept: 'application/json' }
+  if (apiKey) headers.Authorization = `Bearer ${apiKey}`
+  return headers
+}
+
+async function resolveGenericRequest(profile, { resolveCredential, fetchImpl, signal }) {
+  const apiKey = profile.apiKeyEnv ? await resolveCredential(profile.apiKeyEnv) : ''
+  const response = await fetchImpl(endpointFor(profile.baseURL), { headers: requestHeaders(apiKey), signal })
+  if (!response.ok) throw catalogRequestError(response.status)
+  return response
+}
+
 export async function discoverOpenAIModels(profile, {
   resolveCredential,
   fetchImpl = fetch,
@@ -38,11 +52,7 @@ export async function discoverOpenAIModels(profile, {
   if (!canUseGenericAdapter(profile)) {
     throw new Error('generic discovery requires an OpenAI-compatible baseURL and protocol')
   }
-  const apiKey = profile.apiKeyEnv ? await resolveCredential(profile.apiKeyEnv) : ''
-  const headers = { Accept: 'application/json' }
-  if (apiKey) headers.Authorization = `Bearer ${apiKey}`
-  const response = await fetchImpl(endpointFor(profile.baseURL), { headers, signal })
-  if (!response.ok) throw new Error(`model catalog request failed with HTTP ${response.status}`)
+  const response = await resolveGenericRequest(profile, { resolveCredential, fetchImpl, signal })
   let payload
   try {
     payload = JSON.parse(await readBody(response))
@@ -52,6 +62,21 @@ export async function discoverOpenAIModels(profile, {
   return normalizeModels(profile.provider ?? '', rowsFrom(payload))
 }
 
+
+export async function probeOpenAIModels(profile, {
+  resolveCredential,
+  fetchImpl = fetch,
+  signal,
+} = {}) {
+  if (!canUseGenericAdapter(profile)) {
+    throw new Error('generic health probe requires an OpenAI-compatible baseURL and protocol')
+  }
+  const startedAt = Date.now()
+  const response = await resolveGenericRequest(profile, { resolveCredential, fetchImpl, signal })
+  if (typeof response.body?.cancel === 'function') await response.body.cancel()
+  return { statusCode: response.status, latencyMs: Date.now() - startedAt }
+}
+
 export function createGenericAdapter({ resolveCredential, fetchImpl = fetch } = {}) {
   return Object.freeze({
     id: 'openai-compatible',
@@ -63,5 +88,12 @@ export function createGenericAdapter({ resolveCredential, fetchImpl = fetch } =
         ...options,
       })
     },
+    health(profile, options = {}) {
+      return probeOpenAIModels(profile, {
+        resolveCredential,
+        fetchImpl,
+        ...options,
+      })
+    },
   })
 }