@goodandready/dsh-model-sync 0.5.7 → 0.5.9

package/lib/adapter-registry.js

@@ -1,8 +1,6 @@
 import { catalogRequestError } from './reliability.js'
-import { canUseGenericAdapter, createGenericAdapter } from './generic-adapter.js'
+import { canUseGenericAdapter, createGenericAdapter, readBoundedText, MAX_RESPONSE_BYTES } from './generic-adapter.js'
 import { normalizeModels, parseClinePassModels } from './models.js'
-
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
 const SAFE_AUTH = new Set(['bearer', 'x-api-key', 'query-key', 'none'])
 const SAFE_PARSERS = new Set(['openai', 'google', 'clinebot-plan'])
 const CAPABILITIES = new Set(['vision', 'tools', 'reasoning', 'embeddings', 'code'])
@@ -99,14 +97,32 @@ function mappedRows(provider, rows, descriptor) {
 }
 
 function parseRows(provider, payload, descriptor) {
+  if (payload && (payload.error || payload.errors)) {
+    const message = typeof payload.error === 'string'
+      ? payload.error
+      : payload.error?.message || (Array.isArray(payload.errors) ? payload.errors.map(e => e?.message || e).join(', ') : 'endpoint returned error payload')
+    const err = new Error(`endpoint returned error payload: ${message}`)
+    err.adapterCode = 'schema'
+    throw err
+  }
   const parserKind = descriptor.parse || descriptor.parser
   if (parserKind === 'clinebot-plan') {
     const plan = payload?.data?.plan || payload?.data || payload?.plan || payload
     const included = plan?.features?.included || plan?.includedModels || []
+    if (!Array.isArray(included)) {
+      const err = new Error('model catalog response does not contain plan features')
+      err.adapterCode = 'schema'
+      throw err
+    }
     return parseClinePassModels(included)
   }
   if (parserKind === 'google') {
-    const rows = Array.isArray(payload?.models) ? payload.models : []
+    const rows = payload?.models
+    if (!Array.isArray(rows)) {
+      const err = new Error('model catalog response does not contain models array')
+      err.adapterCode = 'schema'
+      throw err
+    }
     return normalizeModels(provider, rows.map((row) => ({
       ...row,
       id: String(row.name ?? '').replace(/^models\//, ''),
@@ -115,8 +131,13 @@ function parseRows(provider, payload, descriptor) {
       maxTokens: row.outputTokenLimit,
     })))
   }
-  const rows = pathValue(payload, descriptor.modelsPath) ?? payload?.data ?? payload?.models ?? payload?.availableModels
-  return normalizeModels(provider, Array.isArray(rows) ? mappedRows(provider, rows, descriptor) : [])
+  const rows = pathValue(payload, descriptor.modelsPath) ?? (Array.isArray(payload) ? payload : (payload?.data ?? payload?.models ?? payload?.availableModels))
+  if (!Array.isArray(rows)) {
+    const err = new Error('model catalog response does not contain models array')
+    err.adapterCode = 'schema'
+    throw err
+  }
+  return normalizeModels(provider, mappedRows(provider, rows, descriptor))
 }
 
 function privateHttpHost(hostname) {
@@ -214,17 +235,14 @@ async function fetchSpecific(profile, descriptor, options) {
     }
     const respEtag = response.headers?.get?.('etag') || undefined
     const respLastMod = response.headers?.get?.('last-modified') || undefined
-    const declared = Number(response.headers?.get?.('content-length') ?? NaN)
-    if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES) {
-      const error = new Error('model catalog response is too large')
-      error.adapterCode = 'schema'
-      throw error
-    }
-    const text = await response.text()
-    if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-      const error = new Error('model catalog response is too large')
-      error.adapterCode = 'schema'
-      throw error
+    let text
+    try {
+      text = await readBoundedText(response, MAX_RESPONSE_BYTES)
+    } catch (err) {
+      if (err.message === 'model catalog response is too large') {
+        err.adapterCode = 'schema'
+      }
+      throw err
     }
     try { payload = JSON.parse(text) } catch {
       const error = new Error('model catalog response is not valid JSON')

package/lib/alias-resolver.js

@@ -15,7 +15,7 @@ export function validateAliasName(name) {
   return /^@?[a-zA-Z0-9_\-.]{1,64}$/.test(clean)
 }
 
-function modelScoreForCode(provider, model) {
+function modelScoreForCode(model) {
   let score = 0
   const id = String(model?.id ?? '').toLowerCase()
   const name = String(model?.name ?? '').toLowerCase()
@@ -208,7 +208,7 @@ export function resolveAlias(aliasName, {
     if (strategy === 'best-code') {
       const scored = available.map((item) => ({
         ...item,
-        score: modelScoreForCode(item.provider, item.model),
+        score: modelScoreForCode(item.model),
       }))
       scored.sort((a, b) => b.score - a.score)
       const best = scored[0]

package/lib/client.js

@@ -25,23 +25,23 @@ window.__ModuleLoader__.load({
       '.dms-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding-bottom:8px;display:flex;flex-direction:column;gap:10px;box-sizing:border-box}' +
       '.dms-wrap{display:flex;flex-direction:column;gap:14px;max-width:760px;box-sizing:border-box;color:var(--dsw-alias-label-primary,inherit)}' +
       '.dms-wrap>p{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.55}' +
-      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
+      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
       '.dms-toolbar>select{flex:1 1 190px;min-width:190px}' +
       '.dms-toolbar>.dms-actions{flex-basis:100%}' +
       '.dms-toolbar>label{display:inline-flex;align-items:flex-start;gap:7px;font-size:12px;line-height:1.35;color:var(--dsw-alias-label-secondary)}' +
       '.dms-toolbar>select,.dms-editor input,.dms-editor textarea,.dms-input{box-sizing:border-box;min-width:0;background:var(--dsw-specific-input-major,var(--dsw-alias-bg-layer-2,transparent));border:1px solid var(--dsw-alias-border-l1,var(--dsw-alias-border-l2));border-radius:6px;color:var(--dsw-alias-label-primary);font:inherit;padding:7px 9px}' +
       '.dms-toolbar>label input{accent-color:var(--dsw-alias-brand-primary,var(--dsw-alias-button-info-fill))}' +
       '.dms-actions{display:flex;align-items:center;flex-wrap:wrap;gap:7px}' +
-      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
-      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
+      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
+      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2);border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
       '.dms-btn:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary);background:var(--dsw-alias-bg-layer-2)}' +
       '.dms-btn:disabled{opacity:.45;cursor:default}' +
       '.dms-section>strong{display:block;font-size:13px;font-weight:650}' +
       '.dms-provider-wrap{margin:0 0 7px}' +
-      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
+      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
       '.dms-provider>span{min-width:0;overflow-wrap:anywhere;line-height:1.4}' +
       '.dms-section>div[style]{padding:8px 0;border-top:1px solid var(--dsw-alias-border-l2)}' +
-      '.dms-editor{display:flex;flex-direction:column;align-items:stretch;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box;border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
+      '.dms-editor{display:flex;flex-direction:column;align-items:stretch;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box;border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
       '.dms-editor strong{font-size:13px}' +
       '.dms-editor label{display:block;gap:5px;margin-top:8px;color:var(--dsw-alias-label-secondary);font-size:12px}' +
       '.dms-editor label input,.dms-editor label textarea{width:100%}' +
@@ -53,10 +53,10 @@ window.__ModuleLoader__.load({
       '.dms-grid-2{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:12px}' +
       '.dms-badge{font-size:11px;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
       '.dms-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:var(--dsw-alias-state-success-secondary,var(--dsw-alias-bg-layer-2))}' +
-      '.dms-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:var(--dsw-alias-state-warning-secondary,var(--dsw-alias-bg-layer-2))}' +
+      '.dms-badge-warn{border-color:var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);background:var(--dsw-alias-state-warn-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:var(--dsw-alias-state-error-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:6px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
-      '.dms-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
+      '.dms-input:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}' +
       '.dms-btn-primary{background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;border-color:transparent!important;font-weight:600}' +
       '.dms-btn-primary:hover:not(:disabled){opacity:0.88}' +
       '.dms-btn-danger{color:var(--dsw-alias-state-error-primary)!important;border-color:var(--dsw-alias-state-error-primary)!important}' +
@@ -517,7 +517,7 @@ window.__ModuleLoader__.load({
                 }, updaterChecking ? t.checkingUpdates : (updaterStatus ? t.upToDate : t.checkForUpdates))
           )
         ),
-        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
+        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success-primary)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
         updaterError ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-error-primary)', marginTop: 8, fontSize: 12 } }, updaterError) : null
       )
     }
@@ -1117,7 +1117,7 @@ window.__ModuleLoader__.load({
               return React.createElement('div', { key: p.name, style: { display: 'flex', flexDirection: 'column', gap: 4, padding: '8px 10px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 6, background: 'var(--dsw-alias-bg-layer-2)' } },
                 React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
                   React.createElement('div', { style: { display: 'flex', gap: 8, alignItems: 'center' } },
-                    React.createElement('strong', { style: { fontFamily: 'monospace', fontSize: 13, color: 'var(--dsw-alias-state-brand-primary)' } }, p.name),
+                    React.createElement('strong', { style: { fontFamily: 'monospace', fontSize: 13, color: 'var(--dsw-alias-brand-primary)' } }, p.name),
                     React.createElement('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } }, p.label)
                   ),
                   button(isResolving ? t.resolvingAlias : t.resolveAlias, () => resolveSmartAlias(p.name), 'secondary')
@@ -1318,8 +1318,8 @@ window.__ModuleLoader__.load({
                     React.createElement('input', { type: 'checkbox', checked: selectionDraft.includes(model.id), onChange: (e) => setSelectionDraft((current) => e.target.checked ? [...current, model.id] : current.filter((id) => id !== model.id)) }),
                     ` ${model.name ?? model.id} (${model.id})`,
                     isNewModel(model, row) ? React.createElement('span', { style: { marginLeft: 6, fontSize: 11, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-business-primary)', color: 'white' } }, 'NEW') : null,
-                    deprecationDays !== null ? React.createElement('span', { style: { marginLeft: 6, fontSize: 10, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-warning-primary)', color: 'white' } }, deprecationDays > 0 ? t.deprecatesIn.replace('%d', deprecationDays) : t.deprecated) : null,
-                    (model.contextWindow && maxContext > 0 && model.contextWindow >= maxContext) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-warning-primary)', color: 'white' } }, '★') : null,
+                    deprecationDays !== null ? React.createElement('span', { style: { marginLeft: 6, fontSize: 10, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-warn-primary)', color: 'white' } }, deprecationDays > 0 ? t.deprecatesIn.replace('%d', deprecationDays) : t.deprecated) : null,
+                    (model.contextWindow && maxContext > 0 && model.contextWindow >= maxContext) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-warn-primary)', color: 'white' } }, '★') : null,
                     (model.pricing && minPrice !== Infinity && model.pricing.inputPerToken === minPrice) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-success-primary)', color: 'white' } }, '$') : null,
                     model.tags && model.tags.length ? React.createElement('small', { style: { marginLeft: 6, color: 'var(--dsw-alias-label-secondary)' } }, model.tags.join(', ')) : null,
                     model.pricing ? React.createElement('small', { style: { marginLeft: 6, color: 'var(--dsw-alias-label-secondary)', fontSize: 11 } }, `in $${(model.pricing.inputPerToken * 1000000).toFixed(2)}/1M` + (model.pricing.cacheReadPerToken !== undefined ? ` / cache $${(model.pricing.cacheReadPerToken * 1000000).toFixed(2)}` : '') + (model.pricing.outputPerToken !== undefined ? ` / out $${(model.pricing.outputPerToken * 1000000).toFixed(2)}` : '')) : null,

package/lib/generic-adapter.js

@@ -1,7 +1,7 @@
 import { catalogRequestError } from './reliability.js'
 import { normalizeModels } from './models.js'
 
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
+export const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
 const SUPPORTED_APIS = new Set(['openai-completions', 'openai-responses'])
 
 function endpointFor(baseURL) {
@@ -10,21 +10,86 @@ function endpointFor(baseURL) {
   return base.endsWith('/models') ? base : `${base}/models`
 }
 
-async function readBody(response) {
+export async function readBoundedText(response, maxBytes = MAX_RESPONSE_BYTES) {
   const declared = Number(response.headers?.get?.('content-length') ?? NaN)
-  if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES) {
+  if (Number.isFinite(declared) && declared > maxBytes) {
     throw new Error('model catalog response is too large')
   }
-  const text = await response.text()
-  if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-    throw new Error('model catalog response is too large')
+
+  if (response.body && typeof response.body[Symbol.asyncIterator] === 'function') {
+    const chunks = []
+    let totalBytes = 0
+    for await (const chunk of response.body) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      totalBytes += buf.byteLength
+      if (totalBytes > maxBytes) {
+        if (typeof response.body.cancel === 'function') {
+          try { await response.body.cancel('response too large') } catch (_err) { /* best-effort */ }
+        } else if (typeof response.body.destroy === 'function') {
+          try { response.body.destroy() } catch (_err) { /* best-effort */ }
+        }
+        throw new Error('model catalog response is too large')
+      }
+      chunks.push(buf)
+    }
+    return Buffer.concat(chunks).toString('utf8')
+  }
+
+  if (response.body && typeof response.body.getReader === 'function') {
+    const reader = response.body.getReader()
+    const chunks = []
+    let totalBytes = 0
+    try {
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        if (value) {
+          const buf = Buffer.isBuffer(value) ? value : Buffer.from(value)
+          totalBytes += buf.byteLength
+          if (totalBytes > maxBytes) {
+            try { await reader.cancel('response too large') } catch (_err) { /* best-effort */ }
+            throw new Error('model catalog response is too large')
+          }
+          chunks.push(buf)
+        }
+      }
+    } finally {
+      try { reader.releaseLock?.() } catch (_err) { /* best-effort */ }
+    }
+    return Buffer.concat(chunks).toString('utf8')
+  }
+
+  if (typeof response.text === 'function') {
+    const text = await response.text()
+    if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+      throw new Error('model catalog response is too large')
+    }
+    return text
   }
-  return text
+
+  return ''
+}
+
+async function readBody(response) {
+  return readBoundedText(response, MAX_RESPONSE_BYTES)
 }
 
 function rowsFrom(payload) {
-  const rows = payload?.data ?? payload?.models ?? payload?.availableModels
-  return Array.isArray(rows) ? rows : []
+  if (payload && (payload.error || payload.errors)) {
+    const message = typeof payload.error === 'string'
+      ? payload.error
+      : payload.error?.message || (Array.isArray(payload.errors) ? payload.errors.map(e => e?.message || e).join(', ') : 'endpoint returned error payload')
+    const err = new Error(`endpoint returned error payload: ${message}`)
+    err.adapterCode = 'schema'
+    throw err
+  }
+  const rows = Array.isArray(payload) ? payload : (payload?.data ?? payload?.models ?? payload?.availableModels)
+  if (!Array.isArray(rows)) {
+    const err = new Error('model catalog response does not contain models array')
+    err.adapterCode = 'schema'
+    throw err
+  }
+  return rows
 }
 
 export function canUseGenericAdapter(profile) {

package/lib/history.js

@@ -27,6 +27,11 @@ function cloneModel(provider, model) {
   if (normalized.pricing) compact.pricing = normalized.pricing
   if (normalized.contextWindow !== undefined) compact.contextWindow = normalized.contextWindow
   if (normalized.maxTokens !== undefined) compact.maxTokens = normalized.maxTokens
+  if (normalized.input !== undefined) compact.input = normalized.input
+  if (normalized.compat !== undefined) compact.compat = normalized.compat
+  if (normalized.tags !== undefined) compact.tags = normalized.tags
+  if (normalized.aliases !== undefined && normalized.aliases.length > 0) compact.aliases = normalized.aliases
+  if (normalized.lifecycle !== undefined) compact.lifecycle = normalized.lifecycle
   return compact
 }
 

package/lib/http.js

@@ -1,4 +1,7 @@
+import crypto from 'node:crypto'
 import { validateAliasName } from './alias-resolver.js'
+import { validatePolicy } from './policy.js'
+
 function normalizeWebhookTestRequest(body) {
   if (!body || typeof body !== "object") throw Object.assign(new Error("body is required"), { code: "INVALID_REQUEST" })
   if (typeof body.url !== "string" || !body.url.trim()) throw Object.assign(new Error("url is required"), { code: "INVALID_REQUEST" })
@@ -30,8 +33,6 @@ function normalizeWebhookTestRequest(body) {
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
   }
 }
-import crypto from 'node:crypto'
-import { validatePolicy } from './policy.js'
 
 const BASE = '/dsh-model-sync'
 
@@ -82,8 +83,6 @@ export function trusted(req, { requireLoopback = false } = {}) {
   }
   // If sec-fetch-site is same-origin or same-site, allow
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
-  // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
-  if (req.headers?.['sec-fetch-mode'] && !host) return false
   // For requests requiring loopback or POST without any browser origin/referer headers, require explicit loopback
   if ((requireLoopback || req?.method === 'POST') && !origin && !referer) {
     if (!isLoopbackAddress(remoteAddress ?? (req?.headers?.host ? req.headers.host.split(':')[0] : ''))) return false

package/lib/index.js

@@ -44,7 +44,7 @@ export const Config = Schema.object({
     title: Schema.string().required(),
     message: Schema.string().required(),
     providers: Schema.array(Schema.object({}).loose()).default([]),
-  }).loose()).default([]),
+  }).loose()).default([]).volatile(),
   staleGraceRuns: Schema.number().default(2).volatile(),
   lifecycleRetentionRuns: Schema.number().default(20).volatile(),
   lifecycleRevision: Schema.number().default(0).volatile(),
@@ -54,14 +54,14 @@ export const Config = Schema.object({
     firstMissingAt: Schema.number().default(0),
     lastSeenAt: Schema.number().default(0),
     lastObservedRun: Schema.number().default(0),
-  }).loose())).default({}),
+  }).loose())).default({}).volatile(),
   history: Schema.array(Schema.object({
     id: Schema.string().required(),
     version: Schema.number().required(),
     startedAt: Schema.number().required(),
     finishedAt: Schema.number().required(),
     providers: Schema.array(Schema.object({}).loose()).default([]),
-  }).loose()).default([]),
+  }).loose()).default([]).volatile(),
   providers: Schema.array(Schema.object({
     provider: Schema.string().required(),
     enabled: Schema.boolean().default(true),
@@ -69,7 +69,7 @@ export const Config = Schema.object({
     jitterMinutes: Schema.number().default(0),
     ttlMinutes: Schema.number().default(0),
     autoApply: Schema.boolean().default(false),
-  })).default([]),
+  })).default([]).volatile(),
   aliases: Schema.dict(Schema.object({
     provider: Schema.string(),
     model: Schema.string(),
@@ -79,7 +79,7 @@ export const Config = Schema.object({
     })),
     strategy: Schema.string(),
     updatedAt: Schema.number().default(0),
-  }).loose()).default({}),
+  }).loose()).default({}).volatile(),
   modelSelections: Schema.dict(Schema.array(Schema.string())).default({}).volatile(),
   adapterRegistry: Schema.dict(Schema.object({
     enabled: Schema.boolean().default(true),
@@ -90,7 +90,7 @@ export const Config = Schema.object({
     fields: Schema.any().default({}),
     capabilityMap: Schema.any().default({}),
     headers: Schema.dict(Schema.string()).default({}),
-  }).loose()).default({}),
+  }).loose()).default({}).volatile(),
   modelPolicies: Schema.dict(Schema.object({
     include: Schema.array(Schema.string()).default([]),
     exclude: Schema.array(Schema.string()).default([]),
@@ -100,7 +100,7 @@ export const Config = Schema.object({
     maxPricePerMillion: Schema.number(),
     enableContextFilter: Schema.boolean().default(false),
     minContextTokens: Schema.number(),
-  }).loose()).default({}),
+  }).loose()).default({}).volatile(),
   // Full catalogs are cached separately from the allowlist applied to DSH.
   // This keeps the model picker useful after a restart without widening the
   // active llm-pi-ai catalog.
@@ -108,7 +108,7 @@ export const Config = Schema.object({
     provider: Schema.string().required(),
     id: Schema.string().required(),
     name: Schema.string().required(),
-  }).loose())).default({}),
+  }).loose())).default({}).volatile(),
 })
 
 // DSH serves a namespace's settings form from the volatile fields of its profile
@@ -123,6 +123,7 @@ export function plainConfig(value) {
 }
 
 export function apply(ctx, config) {
+  let liveConfig = undefined
   const baseConfig = structuredClone(plainConfig(config || {}))
   const resolveConfig = (value) => {
     try {
@@ -134,7 +135,7 @@ export function apply(ctx, config) {
       return liveConfig ?? baseConfig
     }
   }
-  let liveConfig = resolveConfig(baseConfig)
+  liveConfig = resolveConfig(baseConfig)
   let reconfigure = () => {}
   let saveConfigImpl = async (patch) => {
     const plainPatch = plainConfig(patch)
@@ -146,14 +147,16 @@ export function apply(ctx, config) {
         ctx.logger.debug('[dsh-model-sync] settings service read failed:', err)
       }
     }
-    if (settings && typeof settings.update === 'function') {
-      try {
-        await settings.update(NS, plainPatch)
-      } catch (err) {
-        if (typeof ctx.logger?.warn === 'function') {
-          ctx.logger.warn('[dsh-model-sync] settings.update failed:', err)
-        }
+    if (!settings || typeof settings.update !== 'function') {
+      throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
+    }
+    try {
+      await settings.update(NS, plainPatch)
+    } catch (err) {
+      if (typeof ctx.logger?.warn === 'function') {
+        ctx.logger.warn('[dsh-model-sync] settings.update failed:', err)
       }
+      throw err
     }
     liveConfig = resolveConfig({ ...liveConfig, ...plainPatch })
     reconfigure()

package/lib/models.js

@@ -146,11 +146,8 @@ function normalizeCapabilities(row) {
   if (!result.code && (/(^|[_-])(coder|code|starcoder|codellama)($|[_-])/i.test(idStr) || idStr.includes('coder') || idStr.includes('code-'))) {
     result.code = true
   }
-  if (!result.vision && (/(^|[_-])(vision|vl|multimodal|4v|4o|flash)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
-    // Only set vision if clearly indicated by vision/vl tags
-    if (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision')) {
-      result.vision = true
-    }
+  if (!result.vision && (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
+    result.vision = true
   }
 
   return Object.keys(result).length > 0 ? result : undefined
@@ -276,6 +273,7 @@ function normalizePricing(row) {
   }
   if (typeof source.currency === 'string' && source.currency.trim()) pricing.currency = source.currency.trim()
   if (typeof source.unit === 'string' && source.unit.trim()) pricing.unit = source.unit.trim()
+  if (typeof source.source === 'string' && source.source.trim()) pricing.source = source.source.trim()
   return pricing
 }
 

package/lib/reliability.js

@@ -110,13 +110,11 @@ export async function retryWithBackoff(operation, {
   onRetry,
 } = {}) {
   const total = Math.max(1, Math.floor(Number(attempts) || 1))
-  let lastError
   for (let attempt = 1; attempt <= total; attempt += 1) {
     if (signal?.aborted) throw signal.reason ?? abortError()
     try {
       return await operation({ attempt })
     } catch (error) {
-      lastError = error
       if (attempt >= total || !isRetryableError(error)) throw error
       const exponential = Math.max(0, Number(baseDelayMs) || 0) * (2 ** (attempt - 1))
       // Full jitter: randomized between [0.5, 1.0] of calculated exponential backoff
@@ -130,7 +128,6 @@ export async function retryWithBackoff(operation, {
       await delay(delayMs, signal)
     }
   }
-  throw lastError
 }
 
 export async function mapWithConcurrency(items, worker, concurrency = 4) {

package/lib/synchronizer-transfer.js

@@ -54,7 +54,7 @@ export function createConfigTransfer({
             importedProviders.push(pname)
           }
           if (Array.isArray(pdata.selectedModels)) {
-            currentSelections[pname] = pdata.selectedModels.filter((m) => typeof m === 'string')
+            currentSelections[pname] = [...new Set(pdata.selectedModels.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 1000)
             importedProviders.push(pname)
           }
         }

package/lib/synchronizer.js

@@ -159,12 +159,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
       recordCredentialOutcome(row.provider, { status: 'ok', retries })
       if (result && result.notModified) {
         const config = getConfig() ?? {}
-        const cached = normalizeModels(row.provider, config.modelCatalogs?.[row.provider] ?? row.models ?? [])
+        const existing = providerHttpMeta.get(row.provider)
+        if (existing && (result.etag || result.lastModified)) {
+          if (result.etag) existing.etag = result.etag
+          if (result.lastModified) existing.lastModified = result.lastModified
+        }
+        const memoryModels = existing?.models
+        const cached = normalizeModels(row.provider, memoryModels ?? config.modelCatalogs?.[row.provider] ?? row.models ?? [])
         return { provider: row.provider, status: 'ok', models: cached, retries, notModified: true }
       }
       const models = Array.isArray(result) ? result : []
       if (result?.__httpMeta) {
-        providerHttpMeta.set(row.provider, result.__httpMeta)
+        providerHttpMeta.set(row.provider, { ...result.__httpMeta, models })
       }
       return { provider: row.provider, status: 'ok', models, retries }
     } catch (error) {
@@ -332,7 +338,10 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
         const advertised = selectedModels.length
           ? policyModels.filter((model) => selectedModels.includes(model.id))
           : policyModels
-        const explicitRemoveIds = new Set(lifecycle.removedIds)
+        const policyExcludedIds = current
+          .filter((model) => !filterModels([model], policy).length || (selectedModels.length && !selectedModels.includes(model.id)))
+          .map((model) => model.id)
+        const explicitRemoveIds = new Set([...lifecycle.removedIds, ...policyExcludedIds])
         const reconciliation = reconcileModels(row.provider, current, advertised, { removeMissing: false, removeIds: explicitRemoveIds })
         results.push({
           ...discovered,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",
@@ -53,7 +53,10 @@
   "license": "MIT",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/schemastery": "^3.18.4",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1"
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.4"
   }
 }