@mars-sea/dsh-commandcode-provider 0.10.1 → 0.10.3

package/lib/client.js

@@ -66,8 +66,8 @@ window.__ModuleLoader__.load({
 				exceededWarning: "  ⚠️ 超限!",
 				resetSuffix: "重置 {when}",
 				partialFailures: "⚠️  部分端点失败: {list}",
-				noData: "(no data — check your API key)",
-				errorText: "Could not fetch Command Code usage: {message}",
+				noData: "（无数据 — 请检查 API 密钥）",
+				errorText: "获取 Command Code 用量失败：{message}",
 				imageGate: "当前会话已包含图片，而模型 {model} 不支持图片输入；请选择支持图片的模型，或先移除会话中的图片。"
 			},
 			en: {
@@ -343,9 +343,17 @@ window.__ModuleLoader__.load({
 			addedRules = [];
 			/** Staged edits to stored routing rules, by stored row id. */
 			ruleDrafts = /* @__PURE__ */ new Map();
-			/** Stored routing rule rows staged for removal. */
-			removedRuleIds = /* @__PURE__ */ new Set();
-			/** The catalog the rule editor offers (Host-side). */
+			/**
+			* Stored routing rule rows staged for removal, by stored row id with a
+			* content snapshot. The snapshot makes reconcile content-based: stored
+			* row ids are positional (`rule-N`) and shift after any write, so an
+			* id-only check would misread a landed removal as pending (and a retry
+			* would delete the wrong row).
+			*/
+			removedRuleIds = /* @__PURE__ */ new Map();
+			/** Staged visible-model allowlist (undefined = no draft). */
+			visibleModelsDraft = void 0;
+			/** The catalog the model editors offer (Host-side). */
 			catalogModels = [];
 			catalogFailed = false;
 			saving = false;
@@ -398,8 +406,8 @@ window.__ModuleLoader__.load({
 				const snapshot = this.scope.getSnapshot();
 				const named = typeof snapshot.value?.apiKeyEnv === "string" && snapshot.value.apiKeyEnv.length > 0 ? snapshot.value.apiKeyEnv : DEFAULT_API_KEY_REF;
 				if (named === this.credentialRef) return;
+				this.credentialStates.delete(this.credentialRef);
 				this.credentialRef = named;
-				this.credentialStates.delete(named);
 			}
 			/** Subscribe to state projections. @returns the disposer. */
 			subscribe(listener) {
@@ -437,9 +445,10 @@ window.__ModuleLoader__.load({
 					accounts,
 					accountsRemoving: [...this.removedRefs],
 					rules: this.effectiveRules(),
+					visibleModels: this.effectiveVisibleModels(),
 					catalogModels: this.catalogModels,
 					catalogFailed: this.catalogFailed,
-					dirty: plan.length > 0 || this.accountsDirty() || this.rulesDirty(),
+					dirty: plan.length > 0 || this.accountsDirty() || this.rulesDirty() || this.visibleModelsDirty(),
 					invalid: plan.some((item) => item.run === void 0),
 					saving: this.saving,
 					failed: this.failed,
@@ -525,7 +534,16 @@ window.__ModuleLoader__.load({
 			removeRule(id) {
 				const addedIndex = this.addedRules.findIndex((_, index) => `new-${index}` === id);
 				if (addedIndex >= 0) this.addedRules.splice(addedIndex, 1);
-				else this.removedRuleIds.add(id);
+				else {
+					const stored = this.storedRules().find((rule) => rule.id === id);
+					this.removedRuleIds.set(id, stored === void 0 ? {
+						models: [],
+						account: ""
+					} : {
+						models: [...stored.models],
+						account: stored.account
+					});
+				}
 				this.ruleDrafts.delete(id);
 				this.failed = false;
 				this.publish();
@@ -598,10 +616,11 @@ window.__ModuleLoader__.load({
 			}
 			/** Discard every staged edit. */
 			discard() {
-				if (this.staged.size === 0 && !this.accountsStaged() && !this.rulesStaged() && !this.failed) return;
+				if (this.staged.size === 0 && !this.accountsStaged() && !this.rulesStaged() && !this.visibleModelsStaged() && !this.failed) return;
 				this.staged.clear();
 				this.clearAccountStaging();
 				this.clearRuleStaging();
+				this.clearVisibleModelsStaging();
 				this.failed = false;
 				this.publish();
 			}
@@ -618,7 +637,8 @@ window.__ModuleLoader__.load({
 				const plan = this.plan();
 				const accountRuns = this.accountPlan();
 				const ruleRuns = this.rulesPlan();
-				if (plan.length === 0 && accountRuns.length === 0 && ruleRuns.length === 0 || this.saving) return;
+				const visibleRuns = this.visibleModelsPlan();
+				if (plan.length === 0 && accountRuns.length === 0 && ruleRuns.length === 0 && visibleRuns.length === 0 || this.saving) return;
 				const runs = [];
 				for (const item of plan) {
 					if (item.run === void 0) return;
@@ -631,10 +651,19 @@ window.__ModuleLoader__.load({
 				for (const run of [
 					...runs,
 					...accountRuns,
-					...ruleRuns
-				]) if (!await run()) {
-					landed = false;
-					break;
+					...ruleRuns,
+					...visibleRuns
+				]) {
+					let ok = false;
+					try {
+						ok = await run();
+					} catch {
+						ok = false;
+					}
+					if (!ok) {
+						landed = false;
+						break;
+					}
 				}
 				this.saving = false;
 				this.failed = !landed;
@@ -643,9 +672,11 @@ window.__ModuleLoader__.load({
 					this.staged.clear();
 					this.clearAccountStaging();
 					this.clearRuleStaging();
+					this.clearVisibleModelsStaging();
 				} else {
 					this.reconcileAccountStaging();
 					this.reconcileRuleStaging();
+					this.reconcileVisibleModelsStaging();
 				}
 				this.publish();
 			}
@@ -798,10 +829,10 @@ window.__ModuleLoader__.load({
 				if (changed) this.publish();
 			}
 			/**
-			* Fetch the model catalog for the routing-rule editor through the Host
-			* Remote. Runs once at construction; call again (e.g. from the client entry
-			* once the Remote mount lands) to (re)try — a later success clears a prior
-			* failure flag so the editor recovers without a page reload.
+			* Fetch the model catalog for the settings page's model editors through
+			* the Host Remote. Runs once at construction; call again (e.g. from the
+			* client entry once the Remote mount lands) to (re)try — a later success
+			* clears a prior failure flag so the editors recover without a page reload.
 			*/
 			refreshCatalog() {
 				const models = this.api.models;
@@ -812,7 +843,18 @@ window.__ModuleLoader__.load({
 				}
 				models().then((response) => {
 					if (response.ok && Array.isArray(response.value?.models)) {
-						this.catalogModels = response.value.models;
+						const shaped = [];
+						for (const model of response.value.models) {
+							if (typeof model !== "object" || model === null) continue;
+							const entry = model;
+							if (typeof entry.id !== "string" || typeof entry.name !== "string") continue;
+							shaped.push({
+								id: entry.id,
+								name: entry.name,
+								...typeof entry.tier === "string" ? { tier: entry.tier } : {}
+							});
+						}
+						this.catalogModels = shaped;
 						this.catalogFailed = false;
 					} else this.catalogFailed = true;
 				}, () => {
@@ -978,11 +1020,70 @@ window.__ModuleLoader__.load({
 				this.ruleDrafts.clear();
 				this.removedRuleIds.clear();
 			}
-			/** Drop rule staging the stored section already reflects (partial-save retry). */
+			/**
+			* Drop rule staging the stored section already reflects (partial-save
+			* retry). Stored row ids are positional (`rule-N`) and shift after any
+			* write, so every check here is content-based, never id-based:
+			* - landed additions (in `addedRules`, already in stored) are dropped, or
+			*   a retry would persist them twice;
+			* - staged removals whose snapshot row is gone from stored have landed
+			*   (drop them); a removal whose snapshot still matches a stored row is
+			*   still pending (keep it).
+			*/
 			reconcileRuleStaging() {
-				const storedIds = new Set(this.storedRules().map((rule) => rule.id));
-				for (const id of [...this.removedRuleIds]) if (!storedIds.has(id)) this.removedRuleIds.delete(id);
-				for (const id of [...this.ruleDrafts.keys()]) if (!storedIds.has(id)) this.ruleDrafts.delete(id);
+				const stored = this.storedRules();
+				this.addedRules = this.addedRules.filter((added) => !stored.some((rule) => sameModels(added.models, rule.models) && added.account === rule.account));
+				for (const [id, snapshot] of [...this.removedRuleIds]) if (!stored.some((rule) => sameModels(snapshot.models, rule.models) && snapshot.account === rule.account)) this.removedRuleIds.delete(id);
+				this.ruleDrafts.clear();
+			}
+			/** The stored visible-model allowlist (`visibleModels`); empty = show all. */
+			storedVisibleModels() {
+				const raw = this.scope.getSnapshot().value?.visibleModels;
+				if (!Array.isArray(raw)) return [];
+				return raw.filter((m) => typeof m === "string" && m !== "");
+			}
+			/** Effective visible-model allowlist: staged draft or stored value. */
+			effectiveVisibleModels() {
+				return this.visibleModelsDraft ?? this.storedVisibleModels();
+			}
+			/** Whether the staged visible-model selection differs from stored. */
+			visibleModelsDirty() {
+				return this.visibleModelsDraft !== void 0 && !sameModels(this.visibleModelsDraft, this.storedVisibleModels());
+			}
+			/** Whether any visible-model staging exists. */
+			visibleModelsStaged() {
+				return this.visibleModelsDraft !== void 0;
+			}
+			/** Reset the visible-model staged edit. */
+			clearVisibleModelsStaging() {
+				this.visibleModelsDraft = void 0;
+			}
+			/** Drop visible-model staging the stored section already reflects. */
+			reconcileVisibleModelsStaging() {
+				if (this.visibleModelsDraft !== void 0 && sameModels(this.visibleModelsDraft, this.storedVisibleModels())) this.visibleModelsDraft = void 0;
+			}
+			/** The visible-model writes a save performs (empty when nothing staged). */
+			visibleModelsPlan() {
+				if (!this.visibleModelsDirty()) return [];
+				return [() => this.writeVisibleModels()];
+			}
+			/** Persist the staged visible-model allowlist into the settings section. */
+			async writeVisibleModels() {
+				const list = this.visibleModelsDraft ?? [];
+				await this.scope.set("visibleModels", list);
+				return sameModels(this.storedVisibleModels(), list);
+			}
+			/** Stage the visible-model allowlist (multi-select). */
+			editVisibleModels(models) {
+				this.visibleModelsDraft = [...models];
+				this.failed = false;
+				this.publish();
+			}
+			/** Stage "show all models" (clears the allowlist). */
+			clearVisibleModels() {
+				this.visibleModelsDraft = [];
+				this.failed = false;
+				this.publish();
 			}
 			/** The routing-rule writes a save performs (empty when nothing staged). */
 			rulesPlan() {
@@ -991,7 +1092,10 @@ window.__ModuleLoader__.load({
 			}
 			/** Persist the staged routing rules into the settings section. */
 			async writeRules() {
-				const list = [...this.storedRules().filter((rule) => !this.removedRuleIds.has(rule.id)).map((rule) => {
+				const list = [...this.storedRules().filter((rule) => {
+					const snapshot = this.removedRuleIds.get(rule.id);
+					return snapshot === void 0 || !sameModels(snapshot.models, rule.models) || snapshot.account !== rule.account;
+				}).map((rule) => {
 					const draft = this.ruleDrafts.get(rule.id);
 					return {
 						models: draft !== void 0 && draft.models.length > 0 ? draft.models : rule.models,
@@ -1001,9 +1105,16 @@ window.__ModuleLoader__.load({
 					models: rule.models,
 					account: rule.account
 				}))].filter((rule) => rule.models.length > 0);
-				await this.scope.set("modelAccountRules", list);
+				const seen = /* @__PURE__ */ new Set();
+				const deduped = list.filter((rule) => {
+					const key = `${rule.account}\u0001${[...rule.models].sort().join("
")}`;
+					if (seen.has(key)) return false;
+					seen.add(key);
+					return true;
+				});
+				await this.scope.set("modelAccountRules", deduped);
 				const after = this.storedRules();
-				return after.length === list.length && list.every((item, index) => after[index] !== void 0 && sameModels(after[index].models, item.models) && after[index].account === item.account);
+				return after.length === deduped.length && deduped.every((item, index) => after[index] !== void 0 && sameModels(after[index].models, item.models) && after[index].account === item.account);
 			}
 			publish() {
 				if (this.disposed) return;
@@ -1149,6 +1260,16 @@ window.__ModuleLoader__.load({
 			if (value >= 1e3) return `${(value / 1e3).toFixed(1)}K`;
 			return String(value);
 		}
+		/**
+		* Format a success-rate percentage (already in percent units, e.g. 99.96):
+		* at most two decimals, trailing zeros trimmed — `100` stays `100`, not
+		* `100.00`, and the raw upstream float `99.965552876334` becomes `99.97`.
+		* The `%` suffix is appended by the caller (the card and the dashboard line
+		* both compose it).
+		*/
+		function formatSuccessRate(value) {
+			return String(Number(value.toFixed(2)));
+		}
 		/** One window's fill ratio in [0, 1]; 0 when uncapped. */
 		function windowRatio(used, cap) {
 			if (cap <= 0) return 0;
@@ -1437,7 +1558,7 @@ window.__ModuleLoader__.load({
 		/** The wire namespace all Command Code endpoints share. */
 		const REMOTE_NAMESPACE = "commandcode";
 		/**
-		* Build the validator helpers one endpoint uses Sequence. `prefix` names the
+		* Build the validator helpers one endpoint uses. `prefix` names the
 		* endpoint in the rejection message (e.g. `commandcode/report result:`), so
 		* each wire file keeps its own diagnostic phrasing while sharing the helper
 		* bodies.
@@ -1493,14 +1614,13 @@ window.__ModuleLoader__.load({
 		/** Canonical `<namespace>/<method>` endpoint of the usage report Remote. */
 		const USAGE_REPORT_ENDPOINT = "commandcode/report";
 		/**
-		* The shared read/validate helpers, prefixed with the report endpoint so
-		* rejection messages name the offending boundary (the catalog endpoint below
-		* shares this prefix, matching the historical behavior).
+		* The shared read/validate helpers for the usage report endpoint, prefixed
+		* so rejection messages name the offending boundary.
 		*/
-		const { reject: reject$1, record, stringField, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
+		const { reject: reject$1, record: record$1, stringField: stringField$1, numberField, booleanField } = makeBoundaryValidator("commandcode/report result:");
 		/** Validate one window-limit block (`fiveHour` / `weekly`). */
 		function windowLimit(value, field) {
-			const source = record(value, field);
+			const source = record$1(value, field);
 			return {
 				used: numberField(source, "used", `${field}.used`),
 				cap: numberField(source, "cap", `${field}.cap`),
@@ -1514,7 +1634,7 @@ window.__ModuleLoader__.load({
 		* malformed frame fails the boundary instead of rendering garbage.
 		*/
 		function parseUsageReport(value) {
-			const source = record(value, "report");
+			const source = record$1(value, "report");
 			const failures = source.failures;
 			if (!Array.isArray(failures) || failures.some((entry) => typeof entry !== "string")) reject$1("failures");
 			const report = { failures };
@@ -1524,15 +1644,15 @@ window.__ModuleLoader__.load({
 				else reject$1("blocked");
 			}
 			if (source.account !== void 0) {
-				const account = record(source.account, "account");
+				const account = record$1(source.account, "account");
 				report.account = {
-					id: stringField(account, "id", "account.id"),
-					name: stringField(account, "name", "account.name"),
-					userName: stringField(account, "userName", "account.userName")
+					id: stringField$1(account, "id", "account.id"),
+					name: stringField$1(account, "name", "account.name"),
+					userName: stringField$1(account, "userName", "account.userName")
 				};
 			}
 			if (source.usage !== void 0) {
-				const usage = record(source.usage, "usage");
+				const usage = record$1(source.usage, "usage");
 				report.usage = {
 					totalCount: numberField(usage, "totalCount", "usage.totalCount"),
 					totalCost: numberField(usage, "totalCost", "usage.totalCost"),
@@ -1542,11 +1662,11 @@ window.__ModuleLoader__.load({
 					totalTokensIn: numberField(usage, "totalTokensIn", "usage.totalTokensIn"),
 					totalTokensOut: numberField(usage, "totalTokensOut", "usage.totalTokensOut"),
 					totalCredits: numberField(usage, "totalCredits", "usage.totalCredits"),
-					periodBasis: stringField(usage, "periodBasis", "usage.periodBasis")
+					periodBasis: stringField$1(usage, "periodBasis", "usage.periodBasis")
 				};
 			}
 			if (source.credits !== void 0) {
-				const credits = record(source.credits, "credits");
+				const credits = record$1(source.credits, "credits");
 				report.credits = {
 					monthlyCredits: numberField(credits, "monthlyCredits", "credits.monthlyCredits"),
 					purchasedCredits: numberField(credits, "purchasedCredits", "credits.purchasedCredits"),
@@ -1556,13 +1676,13 @@ window.__ModuleLoader__.load({
 				};
 			}
 			if (source.plan !== void 0) {
-				const plan = record(source.plan, "plan");
+				const plan = record$1(source.plan, "plan");
 				const monthly = plan.monthlyCredits;
 				if (monthly !== null && (typeof monthly !== "number" || !Number.isFinite(monthly))) reject$1("plan.monthlyCredits");
 				report.plan = {
-					planId: stringField(plan, "planId", "plan.planId"),
-					name: stringField(plan, "name", "plan.name"),
-					status: stringField(plan, "status", "plan.status"),
+					planId: stringField$1(plan, "planId", "plan.planId"),
+					name: stringField$1(plan, "name", "plan.name"),
+					status: stringField$1(plan, "status", "plan.status"),
 					monthlyCredits: monthly,
 					currentPeriodEnd: numberField(plan, "currentPeriodEnd", "plan.currentPeriodEnd")
 				};
@@ -1571,20 +1691,20 @@ window.__ModuleLoader__.load({
 		}
 		/** Parse one untrusted boundary value into a {@link CommandCodeAccountUsage}. */
 		function parseAccountUsage(value) {
-			const source = record(value, "account");
+			const source = record$1(value, "account");
 			return {
-				id: stringField(source, "id", "account.id"),
-				label: stringField(source, "label", "account.label"),
+				id: stringField$1(source, "id", "account.id"),
+				label: stringField$1(source, "label", "account.label"),
 				configured: booleanField(source, "configured", "account.configured"),
 				active: booleanField(source, "active", "account.active"),
-				mark: stringField(source, "mark", "account.mark"),
+				mark: stringField$1(source, "mark", "account.mark"),
 				cooldownUntil: numberField(source, "cooldownUntil", "account.cooldownUntil"),
 				report: parseUsageReport(source.report)
 			};
 		}
 		/** Parse the wire result into a {@link CommandCodeAccountsReport}. */
 		function parseAccountsReport(value) {
-			const accounts = record(value, "result").accounts;
+			const accounts = record$1(value, "result").accounts;
 			if (Array.isArray(accounts)) return { accounts: accounts.map(parseAccountUsage) };
 			return reject$1("accounts");
 		}
@@ -1595,19 +1715,27 @@ window.__ModuleLoader__.load({
 		};
 		/** Canonical `<namespace>/<method>` endpoint of the model-catalog Remote. */
 		const MODELS_ENDPOINT = "commandcode/models";
+		/**
+		* The shared read/validate helpers for the model-catalog endpoint — a
+		* separate instance so catalog boundary errors name `commandcode/models`,
+		* not the report endpoint.
+		*/
+		const { record: catalogRecord, stringField: catalogString } = makeBoundaryValidator("commandcode/models result:");
 		/** Parse one untrusted boundary value into a {@link CommandCodeCatalogModel}. */
 		function parseCatalogModel(value) {
-			const source = record(value, "model");
-			return {
-				id: stringField(source, "id", "model.id"),
-				name: stringField(source, "name", "model.name")
+			const source = catalogRecord(value, "model");
+			const model = {
+				id: catalogString(source, "id", "model.id"),
+				name: catalogString(source, "name", "model.name")
 			};
+			if (source.tier !== void 0) model.tier = catalogString(source, "tier", "model.tier");
+			return model;
 		}
 		/** Parse the wire result into a {@link CommandCodeCatalog}. */
 		function parseCatalog(value) {
-			const models = record(value, "result").models;
+			const models = catalogRecord(value, "result").models;
 			if (Array.isArray(models)) return { models: models.map(parseCatalogModel) };
-			return reject$1("models");
+			throw new TypeError("commandcode/models result: invalid models");
 		}
 		/** The Client-face contribution for the model-catalog endpoint. */
 		const MODELS_REMOTE_CONTRIBUTION = {
@@ -1631,45 +1759,29 @@ window.__ModuleLoader__.load({
 		];
 		/** The shared read/validate helpers, prefixed with the login endpoint so
 		* rejection messages name the offending boundary. */
-		/** Reject one boundary value with a field-naming error. A module-level
-		* function declaration (not the factory's destructured arrow) so TypeScript's
-		* control-flow analysis recognizes it as never-returning and narrows `state`
-		* after the guard below. */
-		function reject(field) {
-			throw new TypeError(`commandcode/login result: invalid ${field}`);
-		}
+		const { reject, record, stringField } = makeBoundaryValidator("commandcode/login result:");
 		/**
 		* Parse one untrusted boundary value into a {@link CommandCodeLoginStatus}.
 		* Every field is shape-checked so a malformed frame fails the boundary
 		* instead of leaking into the page.
 		*/
 		function parseLoginStatus(value) {
-			if (typeof value !== "object" || value === null || Array.isArray(value)) reject("status");
-			const source = value;
+			const source = record(value, "status");
 			const state = source.state;
-			if (state !== "idle" && state !== "waiting" && state !== "success" && state !== "failed") reject("state");
-			const status = { state };
-			if (source.authUrl !== void 0) {
-				if (typeof source.authUrl !== "string") reject("authUrl");
-				status.authUrl = source.authUrl;
-			}
-			if (source.userName !== void 0) {
-				if (typeof source.userName !== "string") reject("userName");
-				status.userName = source.userName;
-			}
-			if (source.keyName !== void 0) {
-				if (typeof source.keyName !== "string") reject("keyName");
-				status.keyName = source.keyName;
-			}
-			if (source.reason !== void 0) {
-				if (!REASONS.includes(source.reason)) reject("reason");
-				status.reason = source.reason;
-			}
-			if (source.message !== void 0) {
-				if (typeof source.message !== "string") reject("message");
-				status.message = source.message;
+			if (state === "idle" || state === "waiting" || state === "success" || state === "failed") {
+				const status = { state };
+				if (source.authUrl !== void 0) status.authUrl = stringField(source, "authUrl", "authUrl");
+				if (source.userName !== void 0) status.userName = stringField(source, "userName", "userName");
+				if (source.keyName !== void 0) status.keyName = stringField(source, "keyName", "keyName");
+				if (source.reason !== void 0) {
+					const reason = source.reason;
+					if (typeof reason === "string" && REASONS.includes(reason)) status.reason = reason;
+					else reject("reason");
+				}
+				if (source.message !== void 0) status.message = stringField(source, "message", "message");
+				return status;
 			}
-			return status;
+			return reject("state");
 		}
 		/** The strict result codec shared by all three login endpoints. */
 		const loginStatusSchema = { parse: parseLoginStatus };
@@ -1735,8 +1847,128 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region src/client/model-select.ts
+		/**
+		* Model-select helpers for the settings page's model editors (browser half).
+		*
+		* The routing-rule editor and the visible-models filter both pick catalog
+		* models through the same checkbox multi-select dropdown (`ModelMultiSelect`
+		* in section.tsx). The dropdown's data shaping — search filtering, stale-id
+		* detection, tier grouping — lives here, React-free, so node tests can drive
+		* it directly.
+		*
+		* Dependency-free by design: the client bundle may only import platform/seed
+		* modules, so the plan snapshot below is a deliberately small vendored copy
+		* (tier key → heading label) rather than an import of src/capabilities.ts.
+		* When upstream adds a plan tier, extend BOTH tables.
+		*
+		* @module dsh-commandcode-provider/model-select
+		*/
+		/**
+		* Minimum plan tier → dropdown section heading. Mirrors the Host-side
+		* `KNOWN_PLANS` values + `PLAN_LABELS` in src/capabilities.ts (kept as a
+		* vendored copy because the client bundle cannot import host modules).
+		* Covers every tier key `KNOWN_PLANS` uses today; an unknown tier key falls
+		* back to the raw key rather than vanishing the row.
+		*/
+		const TIER_HEADINGS = {
+			go: "Go",
+			goat: "GOAT",
+			pro: "Pro",
+			provider: "Provider",
+			max: "Max"
+		};
+		/**
+		* The dropdown section heading for a catalog model id, or undefined for
+		* models outside the known plan tiers (unmapped models and stale ids render
+		* unheaded). `knownPlans` is the Host-side `KNOWN_PLANS` table, threaded in
+		* by the caller so this module stays dependency-free.
+		*/
+		function tierHeadingFor(modelId, knownPlans) {
+			const tier = knownPlans[modelId];
+			if (tier === void 0) return void 0;
+			return TIER_HEADINGS[tier] ?? tier;
+		}
+		/**
+		* Whether `text` matches `query` as a case-insensitive substring over the
+		* model id AND display name. An empty/blank query matches everything.
+		*/
+		function matchesModelQuery(model, query) {
+			const needle = query.trim().toLowerCase();
+			if (needle === "") return true;
+			return model.id.toLowerCase().includes(needle) || model.name.toLowerCase().includes(needle);
+		}
+		/**
+		* Build the dropdown options: the catalog (already in picker order) plus
+		* any selected ids the catalog no longer carries, flagged stale so the UI
+		* can mark them — a saved selection never silently loses an entry, and the
+		* user can see which ones went stale upstream.
+		*
+		* When `query` is non-blank, catalog rows are filtered by
+		* {@link matchesModelQuery}; stale rows are kept only while they match too,
+		* so a search for a live model does not surface unrelated stale ids.
+		*/
+		function buildModelSelectOptions(catalog, selected, query = "") {
+			const catalogIds = new Set(catalog.map((model) => model.id));
+			const options = catalog.filter((model) => matchesModelQuery(model, query)).map((model) => ({
+				value: model.id,
+				label: model.name,
+				stale: false
+			}));
+			const seen = new Set(catalogIds);
+			for (const id of selected) {
+				if (id === "" || seen.has(id)) continue;
+				seen.add(id);
+				if (catalogIds.has(id)) continue;
+				if (!matchesModelQuery({
+					id,
+					name: id
+				}, query)) continue;
+				options.push({
+					value: id,
+					label: id,
+					stale: true
+				});
+			}
+			return options;
+		}
+		/**
+		* Group dropdown options under plan-tier headings (`tierOf` maps a model id
+		* to its tier heading, or undefined for unmapped models — see
+		* {@link tierHeadingFor}). Live rows keep their relative order; stale ids
+		* and unmapped live rows share one trailing unheaded group. Groups merge
+		* repeats, so a catalog interleaving two tiers still renders one section
+		* per tier.
+		*/
+		function groupModelSelectOptions(options, tierOf) {
+			const groups = [];
+			const byHeading = /* @__PURE__ */ new Map();
+			for (const option of options) {
+				const heading = option.stale ? void 0 : tierOf(option.value);
+				let group = byHeading.get(heading);
+				if (group === void 0) {
+					group = {
+						heading,
+						options: []
+					};
+					byHeading.set(heading, group);
+					groups.push(group);
+				}
+				group.options.push(option);
+			}
+			return groups;
+		}
+		/**
+		* Toggle one model id in a selection: remove it when present, append it
+		* when absent (append keeps catalog order irrelevant — the picker re-sorts
+		* by plan tier on render).
+		*/
+		function toggleModelSelection(selected, modelId) {
+			return selected.includes(modelId) ? selected.filter((value) => value !== modelId) : [...selected, modelId];
+		}
+		//#endregion
 		//#region package.json
-		var version = "0.10.1";
+		var version = "0.10.3";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -1759,8 +1991,13 @@ window.__ModuleLoader__.load({
 		/**
 		* This package's GitHub releases page, derived from the repository field so
 		* the update hint's link target can never drift from the published home.
+		* Tolerates both repository shapes (`{ url }` and the plain string form).
 		*/
-		const PLUGIN_RELEASES_URL = `${repository.url.replace(/^git\+/, "").replace(/\.git$/, "")}/releases`;
+		const PLUGIN_RELEASES_URL = (() => {
+			const repo = repository;
+			const url = typeof repo === "string" ? repo : repo?.url;
+			return `${typeof url === "string" ? url.replace(/^git\+/, "").replace(/\.git$/, "") : "https://github.com/Mars-Sea/dsh-commandcode-provider"}/releases`;
+		})();
 		/** Abort a hung registry request rather than keep the footer waiting. */
 		const FETCH_TIMEOUT_MS = 5e3;
 		/**
@@ -1812,7 +2049,10 @@ window.__ModuleLoader__.load({
 		}
 		/** Split a tolerant version string into numeric core + prerelease ids. */
 		function splitVersion(value) {
-			const [coreText = "", preText] = value.trim().replace(/^v/i, "").split("-");
+			const cleaned = value.trim().replace(/^v/i, "");
+			const dash = cleaned.indexOf("-");
+			const coreText = dash < 0 ? cleaned : cleaned.slice(0, dash);
+			const preText = dash < 0 ? void 0 : cleaned.slice(dash + 1);
 			return {
 				core: coreText === "" ? [0] : coreText.split(".").map((part) => {
 					const parsed = Number.parseInt(part, 10);
@@ -1951,6 +2191,7 @@ window.__ModuleLoader__.load({
 								className: "cc-reset",
 								disabled,
 								onClick: onReset,
+								"aria-label": `${label} — ${t("reset")}`,
 								children: t("reset")
 							})]
 						})]
@@ -2005,7 +2246,11 @@ window.__ModuleLoader__.load({
 							}),
 							overridden > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: "cc-badge",
-								children: overridden === 1 ? t("advancedOverriddenOne") : t("advancedOverriddenMany").replace("{count}", String(overridden))
+								children: overridden === 1 ? t("advancedOverriddenOne") : t("advancedOverriddenMany", { count: overridden })
+							}) : null,
+							!expanded && invalid ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "cc-badge cc-badgeWarn",
+								children: t("advancedInvalid")
 							}) : null,
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "cc-advancedSpacer" }),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
@@ -2108,9 +2353,9 @@ window.__ModuleLoader__.load({
 				className: "cc-field",
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					className: "cc-fieldHead",
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 						className: "cc-label",
-						htmlFor: id,
+						"aria-hidden": "true",
 						children: label
 					}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 						className: "cc-badges",
@@ -2122,6 +2367,7 @@ window.__ModuleLoader__.load({
 							className: "cc-reset",
 							disabled,
 							onClick: onReset,
+							"aria-label": `${label} — ${t("reset")}`,
 							children: t("reset")
 						})]
 					})]
@@ -2251,6 +2497,7 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "cc-usageBar",
 						role: "progressbar",
+						"aria-label": label,
 						"aria-valuemin": 0,
 						"aria-valuemax": 100,
 						"aria-valuenow": Math.round(ratio * 100),
@@ -2368,7 +2615,7 @@ window.__ModuleLoader__.load({
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(UsageStat, {
 								label: t("usageSuccessRate"),
-								value: `${report.usage.successRate}%`
+								value: `${formatSuccessRate(report.usage.successRate)}%`
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(UsageStat, {
 								label: t("usageCost"),
@@ -2456,7 +2703,10 @@ window.__ModuleLoader__.load({
 		/** The status dot on an account tab: cooling/invalid warn, everything else ok. */
 		function AccountTabDot({ entry }) {
 			const cls = entry.mark === "invalid-credential" ? "cc-tabDot cc-tabDotError" : entry.mark !== "" || entry.cooldownUntil > 0 ? "cc-tabDot cc-tabDotWarn" : "cc-tabDot cc-tabDotOk";
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: cls });
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+				className: cls,
+				"aria-hidden": "true"
+			});
 		}
 		/**
 		* The account-usage card: the `/commandcode` dashboard's facts rendered as
@@ -2532,12 +2782,10 @@ window.__ModuleLoader__.load({
 					}) : null,
 					entries.length > 1 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "cc-tabs",
-						role: "tablist",
 						"aria-label": t("accountsTitle"),
 						children: entries.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 							type: "button",
-							role: "tab",
-							"aria-selected": selected?.id === entry.id,
+							"aria-pressed": selected?.id === entry.id,
 							className: selected?.id === entry.id ? "cc-tab cc-tabActive" : "cc-tab",
 							onClick: () => setSelectedId(entry.id),
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountTabDot, { entry }), entry.label]
@@ -2780,6 +3028,7 @@ window.__ModuleLoader__.load({
 						value: rule.account,
 						disabled,
 						onChange: (event) => onAccount(event.target.value),
+						"aria-label": t("ruleAccount"),
 						children: targets.map((target) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 							value: target.value,
 							children: target.label
@@ -2793,59 +3042,91 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/**
-		* A checkbox multi-select dropdown for routing-rule models. The trigger shows
-		* the selection count; the anchored Menu lists every catalog model with a
-		* checkbox, toggled by clicking the row. Selected ids the catalog no longer
-		* carries still render so a saved rule never silently loses a selection.
+		* A checkbox multi-select dropdown for picking catalog models (the
+		* routing-rule rows and the visible-models filter share it). The trigger
+		* shows the selection count; the Menu lists every catalog model with a
+		* checkbox, toggled by clicking the row. A search box under the trigger
+		* (inside the Menu anchor, so focusing it never trips the outside-click
+		* close) filters the list by id/display-name substring, and items group
+		* under plan-tier headings in picker order. Selected ids the catalog no
+		* longer carries still render — flagged stale — so a saved selection never
+		* silently loses an entry, and the VisibleModelsCard offers a one-click
+		* cleanup.
 		*/
 		function ModelMultiSelect({ id, selected, catalog, disabled, t, onSelect }) {
 			const [open, setOpen] = (0, react.useState)(false);
-			const options = [...catalog.map((model) => ({
-				value: model.id,
-				label: model.name
-			})), ...selected.filter((id) => !catalog.some((model) => model.id === id)).map((id) => ({
-				value: id,
-				label: id
-			}))];
-			const selectedSet = new Set(selected);
-			const items = options.map((option) => ({
+			const [query, setQuery] = (0, react.useState)("");
+			(0, react.useEffect)(() => {
+				if (open) setQuery("");
+			}, [open]);
+			const tiers = (0, react.useMemo)(() => Object.fromEntries(catalog.flatMap((model) => model.tier === void 0 ? [] : [[model.id, model.tier]])), [catalog]);
+			const options = buildModelSelectOptions(catalog, selected, query);
+			const items = groupModelSelectOptions(options, (modelId) => tierHeadingFor(modelId, tiers)).flatMap((group) => [...group.heading === void 0 ? [] : [{
+				type: "label",
+				id: `cc-tier-${group.heading}`,
+				text: group.heading
+			}], ...group.options.map((option) => ({
 				id: option.value,
 				label: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 					className: "cc-checkRow",
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-						type: "checkbox",
-						className: "cc-check",
-						checked: selectedSet.has(option.value),
-						readOnly: true,
-						tabIndex: -1
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "cc-checkName",
-						children: option.label
-					})]
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							type: "checkbox",
+							className: "cc-check",
+							checked: selected.includes(option.value),
+							readOnly: true,
+							tabIndex: -1
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "cc-checkName",
+							children: option.label
+						}),
+						option.stale ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "cc-badge",
+							children: t("modelStale")
+						}) : null
+					]
 				})
-			}));
+			}))]);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Menu, {
 				open,
 				onClose: () => setOpen(false),
 				onSelect: (modelId) => {
-					onSelect(selectedSet.has(modelId) ? selected.filter((value) => value !== modelId) : [...selected, modelId]);
+					onSelect(toggleModelSelection(selected, modelId));
 				},
 				selectedIds: selected,
 				items,
+				footer: options.length === 0 ? [{
+					type: "label",
+					id: "cc-model-search-empty",
+					text: t("modelSearchEmpty")
+				}] : [],
 				portal: true,
-				anchor: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-					id,
-					type: "button",
-					className: "cc-input cc-ruleTrigger",
-					disabled: disabled || catalog.length === 0,
-					onClick: () => setOpen((value) => !value),
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "cc-ruleTriggerText",
-						children: selected.length === 0 ? t("ruleModelPick") : t("ruleModelCount", { count: selected.length })
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "cc-ruleCaret",
-						"aria-hidden": "true"
-					})]
+				anchor: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+					className: "cc-modelSelectAnchor",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+						id,
+						type: "button",
+						className: "cc-input cc-ruleTrigger",
+						disabled: disabled || catalog.length === 0,
+						onClick: () => setOpen((value) => !value),
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "cc-ruleTriggerText",
+							children: selected.length === 0 ? t("ruleModelPick") : t("ruleModelCount", { count: selected.length })
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "cc-ruleCaret",
+							"aria-hidden": "true"
+						})]
+					}), open ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						type: "search",
+						className: "cc-input cc-modelSearch",
+						placeholder: t("modelSearchPlaceholder"),
+						"aria-label": t("modelSearchPlaceholder"),
+						value: query,
+						disabled,
+						autoFocus: true,
+						onChange: (event) => setQuery(event.target.value)
+					}) : null]
 				})
 			});
 		}
@@ -2901,6 +3182,68 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		/** The visible-model filter card: an allowlist over the catalog. Empty = show all. */
+		function VisibleModelsCard({ t, state, disabled, onSelect, onClear }) {
+			const count = state.visibleModels.length;
+			const pickT = (key, params) => {
+				if (key === "ruleModelPick") return t("visibleModelsPick");
+				if (key === "ruleModelCount") return t("visibleModelsCount", params);
+				return t(key, params);
+			};
+			const catalogIds = new Set(state.catalogModels.map((model) => model.id));
+			const staleIds = state.visibleModels.filter((id) => !catalogIds.has(id));
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "cc-card",
+				"aria-label": t("visibleModelsTitle"),
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "cc-field",
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "cc-fieldHead",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+								className: "cc-label",
+								children: t("visibleModelsTitle")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "cc-badges",
+								children: [staleIds.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "cc-reset",
+									disabled,
+									onClick: () => onSelect(state.visibleModels.filter((id) => catalogIds.has(id))),
+									children: t("visibleModelsCleanStale", { count: staleIds.length })
+								}) : null, count > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "cc-reset",
+									disabled,
+									onClick: onClear,
+									children: t("visibleModelsShowAll")
+								}) : null]
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "cc-hint",
+							children: t("visibleModelsHint")
+						}),
+						state.catalogFailed ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "cc-invalid",
+							children: t("rulesCatalogFailed")
+						}) : null,
+						staleIds.length > 0 && !state.catalogFailed ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "cc-hint",
+							children: t("visibleModelsStaleHint", { count: staleIds.length })
+						}) : null,
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelMultiSelect, {
+							id: "cc-visible-models",
+							selected: state.visibleModels,
+							catalog: state.catalogModels,
+							disabled,
+							t: pickT,
+							onSelect
+						})
+					]
+				})
+			});
+		}
 		/**
 		* Show the "Saved ✓" affordance for a short window after each accepted save.
 		* The controller only counts saves (`savedCount`); the flash timing lives
@@ -2997,6 +3340,13 @@ window.__ModuleLoader__.load({
 						onModels: props.editRuleModels,
 						onAccount: props.editRuleAccount
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(VisibleModelsCard, {
+						t,
+						state,
+						disabled,
+						onSelect: props.editVisibleModels,
+						onClear: props.clearVisibleModels
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "cc-card",
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SecretKeyField, {
@@ -3099,10 +3449,14 @@ window.__ModuleLoader__.load({
 		}
 		/** The closed-panel style: the outlet stays mounted as the detection anchor. */
 		const HIDDEN_STYLE = { display: "none" };
-		/** Decide the card's posture from the injected face and the owner facts. */
-		function cardMode(props) {
-			if (props.useCommandCodeSettings === void 0) return { kind: "registration" };
-			const snapshot = props.useCommandCodeSettings((state) => state);
+		/**
+		* Decide the card's posture from one settings snapshot. Pure: the component
+		* subscribes once and passes the snapshot in, so hook order never depends
+		* on the registration→live transition. (The owner facts stay on the
+		* component — only the snapshot decides the posture.)
+		*/
+		function cardMode(snapshot) {
+			if (snapshot === void 0) return { kind: "registration" };
 			return {
 				kind: "live",
 				ready: snapshot.available,
@@ -3173,8 +3527,8 @@ window.__ModuleLoader__.load({
 		*/
 		function CommandCodeProviderCard(props) {
 			const { t } = props;
-			const mode = cardMode(props);
 			const state = props.useCommandCodeSettings !== void 0 ? props.useCommandCodeSettings((snapshot) => snapshot) : void 0;
+			const mode = cardMode(state);
 			const login = props.useCommandCodeLogin !== void 0 ? props.useCommandCodeLogin((snapshot) => snapshot) : void 0;
 			const dirty = state?.dirty ?? false;
 			const saving = state?.saving ?? false;
@@ -3313,7 +3667,7 @@ window.__ModuleLoader__.load({
 			filterModelsByPlan: "隐藏套餐外模型",
 			filterModelsByPlanHint: "开启后，模型选择器只列出当前套餐可用的模型；账户持有按需余额时会显示全部。",
 			webSearch: "用 Command Code 承载联网搜索",
-			webSearchHint: "开启后，dsh 的 web_search 工具由 Command Code 承担（复用同一个 API key 与地址）；关闭则回退到 dsh 自带的 DeepSeek 搜索。",
+			webSearchHint: "开启后，dsh 的 web_search 工具由 Command Code 承担（复用同一个 API key 与地址），并优先于其他搜索后端；关闭则把选择权交还给之前的后端（如 modsearch），而不是强制回退到 DeepSeek 搜索。",
 			accountsTitle: "多账户轮换",
 			accountsHint: "当前账户达到用量限额（429）或密钥失效（401）时，请求自动切换到下一个账户；全部耗尽时会提示最早的重置时间。",
 			accountAdd: "添加账户",
@@ -3336,6 +3690,16 @@ window.__ModuleLoader__.load({
 			ruleModelCount: "已选 {count} 个模型",
 			ruleAccount: "目标账户",
 			ruleHint: "从下拉列表勾选要路由的模型（可多选），再选择目标账户。",
+			modelSearchPlaceholder: "搜索模型…",
+			modelSearchEmpty: "没有匹配的模型。",
+			modelStale: "已下架",
+			visibleModelsTitle: "模型白名单",
+			visibleModelsHint: "勾选要保留的模型，模型选择器就只列出这些；一个都不勾选时则显示全部模型。保存后，下次打开模型选择器生效。",
+			visibleModelsPick: "选择要保留的模型…",
+			visibleModelsCount: "已选 {count} 个模型",
+			visibleModelsShowAll: "显示全部",
+			visibleModelsStaleHint: "有 {count} 个已选模型在目录中找不到了（可能已下架），不影响其他模型；可清理或保留。",
+			visibleModelsCleanStale: "清理失效（{count}）",
 			overridden: "已覆盖",
 			reset: "重置",
 			invalidNumber: "无效数字",
@@ -3435,7 +3799,7 @@ window.__ModuleLoader__.load({
 			filterModelsByPlan: "Hide out-of-plan models",
 			filterModelsByPlanHint: "When on, the model picker lists only models your subscription includes; any on-demand credit balance shows the full catalog.",
 			webSearch: "Serve dsh web search with Command Code",
-			webSearchHint: "When on, the model-facing web_search tool is backed by Command Code (same API key and base URL as chat). Off falls back to the shipped DeepSeek search.",
+			webSearchHint: "When on, the model-facing web_search tool is backed by Command Code (same API key and base URL as chat), winning over other search backends. Off hands the selection back to the previous backend (e.g. modsearch) instead of forcing the shipped DeepSeek search.",
 			accountsTitle: "Account rotation",
 			accountsHint: "When the active account hits its usage limit (429) or its key fails (401), requests switch to the next account; when every account is exhausted the error names the earliest window reset.",
 			accountAdd: "Add account",
@@ -3458,6 +3822,16 @@ window.__ModuleLoader__.load({
 			ruleModelCount: "{count} model(s) selected",
 			ruleAccount: "Target account",
 			ruleHint: "Check the models to route from the dropdown (multi-select), then pick the target account.",
+			modelSearchPlaceholder: "Search models…",
+			modelSearchEmpty: "No matching models.",
+			modelStale: "Retired",
+			visibleModelsTitle: "Model allowlist",
+			visibleModelsHint: "Check the models you want to keep, and model pickers will list only those. If nothing is checked, every model is shown. After saving, the change applies the next time you open a model picker.",
+			visibleModelsPick: "Select models to keep…",
+			visibleModelsCount: "{count} model(s) selected",
+			visibleModelsShowAll: "Show all",
+			visibleModelsStaleHint: "{count} selected model(s) are no longer in the catalog (possibly retired); other models are unaffected. Clean them up or keep them.",
+			visibleModelsCleanStale: "Clean stale ({count})",
 			overridden: "Overridden",
 			reset: "Reset",
 			invalidNumber: "Invalid number",
@@ -3567,6 +3941,13 @@ window.__ModuleLoader__.load({
 .cc-check:checked{background:var(--dsw-alias-brand-primary);border-color:var(--dsw-alias-brand-primary)}
 .cc-check:checked::after{content:'';position:absolute;top:2px;left:5px;width:3px;height:7px;border:solid #fff;border-width:0 1.5px 1.5px 0;transform:rotate(45deg)}
 .cc-checkName{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+/* The model multi-select search box: stacked under the trigger while the
+ * dropdown is open, same input sizing so the pair reads as one control. The
+ * box lives inside the Menu anchor (which renders inside the Menu's root
+ * span), so focusing/typing it never trips the Menu's outside-click close. */
+.cc-modelSelectAnchor{flex-direction:column;gap:6px;display:flex;width:100%}
+.cc-modelSearch{width:100%}
+.cc-modelSearch::-webkit-search-cancel-button{cursor:pointer}
 /* Selects need their own treatment to sit flush with the text inputs:
  * the UA stylesheet renders <select> border-box (34px total vs the inputs'
  * 36px) and forces its own menulist text metrics, so drop the native
@@ -3621,7 +4002,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 .cc-usageBar{overflow:hidden;background:var(--dsw-alias-bg-layer-1);border-radius:999px;height:6px}
 .cc-usageBarFill{background:var(--dsw-alias-brand-primary);border-radius:999px;height:100%;transition:width .3s ease}
 .cc-usageBarFillWarn{background:var(--dsw-alias-label-error)}
-.cc-usageWindowReset{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:1.5}
+@media (prefers-reduced-motion:reduce){.cc-chevron,.cc-toggle,.cc-toggle::after,.cc-usageBarFill{transition:none}}.cc-usageWindowReset{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:1.5}
 .cc-usageMeta{align-items:center;gap:8px;display:flex}
 .cc-accountReport{flex-direction:column;gap:12px;display:flex}
 .cc-tabs{flex-wrap:wrap;gap:6px;display:flex}
@@ -3638,6 +4019,9 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 .cc-usageBlockedTitle{color:var(--dsw-alias-label-error);margin:0;font-size:13px;font-weight:600;line-height:1.5}
 .cc-usageBlockedHint{color:var(--dsw-alias-label-secondary);margin:0;font-size:12px;line-height:1.5}
 .cc-version{margin:4px 0 0;text-align:center;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}
+/* The Models-page provider panel root: unstyled by design — the row card the
+ * Models page owns supplies the surface, the panel only stacks its controls. */
+.cc-providerCard{flex-direction:column;display:flex}
 /* The update hint rides the footer version line: warning-tinted (with a
  * muted fallback for themes without the alias), quiet until hovered. */
 .cc-versionLink{color:var(--dsw-alias-state-warning-primary,var(--dsw-alias-label-secondary));text-decoration:none}
@@ -3646,7 +4030,6 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
  * authorization link is the only branded element on it. */
 .cc-loginLink{color:var(--dsw-alias-brand-primary);text-decoration:none;font-size:12px;line-height:1.5}
 .cc-loginLink:hover{text-decoration:underline;text-underline-position:under}
-.cc-loginBusy{color:var(--dsw-alias-label-tertiary)}
 .cc-loginDone{color:var(--dsw-alias-state-success-primary,var(--dsw-alias-label-secondary))}
 .cc-loginError{color:var(--dsw-alias-label-error)}
 .cc-saved{color:var(--dsw-alias-state-success-primary,var(--dsw-alias-label-secondary));margin:0;font-size:12px;font-weight:500;line-height:1.5}
@@ -3822,7 +4205,9 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 				addRule: () => controller.addRule(),
 				removeRule: (id) => controller.removeRule(id),
 				editRuleModels: (id, ids) => controller.editRuleModels(id, ids),
-				editRuleAccount: (id, text) => controller.editRuleAccount(id, text)
+				editRuleAccount: (id, text) => controller.editRuleAccount(id, text),
+				editVisibleModels: (ids) => controller.editVisibleModels(ids),
+				clearVisibleModels: () => controller.clearVisibleModels()
 			});
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",