@mars-sea/dsh-commandcode-provider 0.10.4 → 0.10.5

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.5] - 2026-09-11
+
+### Added
+- **The terminal settings page lists every model as a checkbox.** The TUI's model allowlist was a text field expecting comma-separated catalog ids typed from memory; it now renders the whole catalog under plan-tier headings (Go → GOAT → Pro → Provider), free models first, each row carrying its plan/deal/context summary as the footer hint. Everything reads as checked until something is excluded, matching the adapter's "an unset allowlist shows every model" rule, and a model this build does not recognize (retired upstream, or added after this release) still gets a row of its own instead of becoming impossible to switch from the terminal.
+- **`Config.modelVisibility`, a per-model override layer beside `visibleModels`.** The TUI cannot add an id to the array it edits, so each checkbox records `modelVisibility.<id>` (true listed / false hidden) instead; an id absent from the map keeps following `visibleModels`, and the subscription-tier filter still applies on top. A hand-edited document carrying a non-boolean entry falls back to the array rather than hiding the model.
+
+### Fixed
+- **The terminal model checkboxes now save the model you toggled.** dsh-TUI keys a staged edit by the field's PATH, so the whole list of checkboxes sharing one `visibleModels` path shared one draft: each of them parsed that same draft on save, every write op addressed the same path, and only the last field's op survived — silently replacing the allowlist with what the last catalog model's row evaluated to instead of the row the user had switched. Each checkbox now addresses a path of its own, and a toggle writes only when it disagrees with the inherited state, so switching a model back leaves no residue in the document.
+
+### Changed
+- **Per-release compatibility now covers dsh `0.1.5-rc.2`.** `dsh.compatibility.dshReleases` declares it `compatible` alongside `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.3-alpha.2`, `0.1.5-alpha.1` and `0.1.5-rc.1`, so the DSH STORE can list the plugin for the current Harness release. Verified on a dsh-TUI profile running that engine: the `/settings` → Command Code page, the model checkbox list, and the picker's catalog all behave as they do on 0.1.5-rc.1. An older release keeps its own record rather than being replaced, so a user who has not moved to the newest engine still sees the listing.
+
+### Documentation
+- **The install and update instructions now say which profile receives the plugin and how to escape pnpm's release-age gate** (both READMEs). A `dsh-tui` profile owns its own plugin list, so the web install does not reach the terminal: the terminal UI needs its own `dsh plugin --profile dsh-tui add`, and it now shows an exact version because a bare package name — or `@latest` — is silently resolved to the previous release for the first 24 hours after a publish (pnpm 11's `minimumReleaseAge`) and the install still exits successfully, which is how a fresh terminal install can end up with no Command Code settings page and no `commandcode` models at all.
+
 ## [0.10.4] - 2026-09-11
 
 ### Added

package/README.md

@@ -47,7 +47,15 @@ Pick the release line that matches your DeepSeek Harness version:
   dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1
   ```
 
-> The `latest` tag now always points at the current 0.1.2-line plugin release, so a plain `@latest` install gets the newest stable release for dsh 0.1.2+. Users on the old 0.5.0-era Harness line must pin `@0.9.1` explicitly.
+> The `latest` tag points at the current 0.1.2-line plugin release. Users on the old 0.5.0-era Harness line must pin `@0.9.1` explicitly.
+
+**pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
+
+```sh
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.10.5
+```
+
+The same applies to every profile you install into, including the terminal UI below.
 
 Fresh pnpm 10 marketplace generations are supported directly. Do not add a separate `@deepseek-ai/dsh-invariants` dependency; the plugin declares it as a Host peer so the active dsh profile remains the owner of Harness packages.
 
@@ -60,6 +68,14 @@ dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     #
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # older dsh (0.5.0 line, unmaintained)
 ```
 
+Each profile updates separately — the terminal UI owns its own plugin list (see below):
+
+```sh
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.10.5
+```
+
+To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
+
 Then restart the web app.
 
 ## Getting an API key
@@ -81,12 +97,14 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 
 ## Terminal UI (dsh-TUI)
 
-The plugin also works under a terminal front door — no separate install and no extra configuration:
+The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.10.5
 ```
 
+Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
+
 Then pick the provider in the model selector, or name it directly:
 
 ```text
@@ -95,7 +113,9 @@ Then pick the provider in the model selector, or name it directly:
 
 `/model` lists every registered provider, with Command Code's live catalog and its plan/deal/context annotations. The `/commandcode` usage dashboard works there too.
 
-**Entering the key.** The TUI has no web Models page, so the plugin declares its own page in the TUI settings screen — **`/settings` → Command Code** — with the API key, the API base, the out-of-plan model filter, the model allowlist, the active account, and the command language. The key field is write-only: it shows whether a key is configured and writes what you type to the credential store, never to a settings document. The same page is the only place a TUI-only user needs to visit.
+**Entering the key.** The TUI has no web Models page, so the plugin declares its own page in the TUI settings screen — **`/settings` → Command Code** — with the API key, the API base, the out-of-plan model filter, the active account, and the command language. The key field is write-only: it shows whether a key is configured and writes what you type to the credential store, never to a settings document. The same page is the only place a TUI-only user needs to visit.
+
+**Picking models.** That page lists the whole catalog as checkboxes, grouped by plan tier (Go → GOAT → Pro → Provider) with the free models first, so nothing has to be typed from memory. Everything starts checked, because an unset allowlist means "show every model" — uncheck the ones you do not want in the picker. The choice is stored as per-model overrides next to the `visibleModels` list the web page edits, so both surfaces can be used interchangeably and a plain `visibleModels` written by hand still works.
 
 Alternatively, set the key outside the TUI — any of these work, in this order of precedence:
 

package/README.zh-CN.md

@@ -45,7 +45,15 @@
   dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1
   ```
 
-> `latest` tag 现在始终指向当前 0.1.2 线的插件版本，普通 `@latest` 安装即可获得 dsh 0.1.2+ 的最新稳定版。旧 0.5.0 时代的 Harness 用户必须显式钉住 `@0.9.1`。
+> `latest` tag 指向当前 0.1.2 线的插件版本。旧 0.5.0 时代的 Harness 用户必须显式钉住 `@0.9.1`。
+
+**pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
+
+```sh
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.10.5
+```
+
+这一点对每个 profile 都成立，包括下面的终端界面。
 
 插件可直接在 pnpm 10 的全新插件市场 generation 中安装。不要另行添加 `@deepseek-ai/dsh-invariants` dependency；插件已将其声明为 Host peer，Harness 包仍由当前 dsh profile 统一管理。
 
@@ -58,6 +66,14 @@ dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     #
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # 更早的 dsh（0.5.0 线，不再维护）
 ```
 
+每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
+
+```sh
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.10.5
+```
+
+要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
+
 然后重启 Web 应用。
 
 ## 获取 API key
@@ -79,12 +95,14 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 
 ## 终端界面（dsh-TUI）
 
-插件同样支持终端前端，无需单独安装、无需额外配置：
+插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.10.5
 ```
 
+这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
+
 之后在模型选择器里选，或者直接指定：
 
 ```text
@@ -93,7 +111,9 @@ dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider
 
 `/model` 会列出所有已注册的 provider，Command Code 的实时目录连同套餐/优惠/上下文标注一起出现，`/commandcode` 用量面板在终端里同样可用。
 
-**填写 API key。** 终端没有网页版 Models 页面，所以插件会在终端设置页里声明自己的页面 —— **`/settings` → Command Code** —— 包含 API key、API 地址、隐藏套餐外模型、模型白名单、当前账号和命令语言。key 字段是只写的：它只显示"是否已配置"，输入的内容写进凭据库，不会写进任何 settings 文档。只用终端的用户只需要访问这一个页面。
+**填写 API key。** 终端没有网页版 Models 页面，所以插件会在终端设置页里声明自己的页面 —— **`/settings` → Command Code** —— 包含 API key、API 地址、隐藏套餐外模型、当前账号和命令语言。key 字段是只写的：它只显示"是否已配置"，输入的内容写进凭据库，不会写进任何 settings 文档。只用终端的用户只需要访问这一个页面。
+
+**选择模型。** 同一页面把整个模型目录列成勾选框，按套餐档位分组（Go → GOAT → Pro → Provider），免费模型排在最前，不需要手打任何模型 id。默认全部勾选——未设置白名单就等于"显示全部模型"；把不想在选择器里看到的取消勾选即可。选择会以「单模型覆盖」的形式保存在网页端编辑的 `visibleModels` 列表旁边，两个界面可以混用，手写的 `visibleModels` 也照常生效。
 
 也可以在终端外配置 key，以下三种方式按优先级生效：
 

package/lib/client.js

@@ -2051,7 +2051,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region package.json
-		var version = "0.10.4";
+		var version = "0.10.5";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"

package/lib/index.d.ts

@@ -52,6 +52,16 @@ interface CommandCodeConnectionOptions {
    * catalog regardless so the page can always offer every model.
    */
   visibleModels?: string[] | undefined;
+  /**
+   * Per-model visibility overrides, keyed by catalog id. Written by the
+   * terminal settings page, whose checkbox list gives every model its own
+   * boolean field: a field writes one value at one path, so membership in
+   * {@link visibleModels} cannot be expressed from there, while a flag can.
+   * An id present here decides that model on its own (true = listed, false =
+   * hidden); an id absent here follows {@link visibleModels} exactly as it did
+   * before, so composition configs and the web page are unaffected.
+   */
+  modelVisibility?: Readonly<Record<string, boolean>> | undefined;
   /**
    * Optional protocol hint. `'auto'` (default) uses billing/cache plus
    * Provider API fallback; `'cli'` forces `/alpha/generate`; `'openai'`
@@ -1277,6 +1287,17 @@ interface TuiSettingsSectionsService {
 declare const ACTIVE_ACCOUNT_AUTO = "auto";
 /** The selector value meaning "no language override — follow the shell locale". */
 declare const LANG_AUTO = "auto";
+/** One catalog model offered as a checkbox. */
+interface TuiModelChoice {
+  /** Catalog model id, e.g. `deepseek/deepseek-v4-pro`. */
+  readonly id: string;
+  /** Minimum plan tier key from `KNOWN_PLANS`. */
+  readonly tier: string;
+  /** Whether the model is currently free, so it leads its group. */
+  readonly free: boolean;
+  /** Footer hint for the focused row: plan tier · deal · peak · `Image`. */
+  readonly hint: string;
+}
 /** Everything the section needs from the plugin entry. */
 interface CommandCodeTuiSettingsDeps {
   /** The plugin's settings namespace (`llm-commandcode`). */
@@ -1298,6 +1319,21 @@ interface CommandCodeTuiSettingsDeps {
     id: string;
     label: string;
   }[];
+  /**
+   * The stored model allowlist, read LIVE at save time. A checkbox judges its
+   * inherited state against this, so it must be read when the write runs, not
+   * captured when the section was registered. An empty list means "every model
+   * is visible" (the adapter's rule).
+   */
+  visibleModels: () => readonly string[];
+  /**
+   * The per-model override map the checkboxes write, read per registration so
+   * ids this build's catalog does not know still get a row of their own. Same
+   * live-read rule as {@link visibleModels}.
+   */
+  modelVisibility?: () => Readonly<Record<string, boolean>> | undefined;
+  /** The models to offer as checkboxes; defaults to the static snapshot. */
+  modelChoices?: () => readonly TuiModelChoice[];
 }
 /**
  * Build the section descriptor. Pure, so tests can pin the exact fields
@@ -1308,9 +1344,9 @@ interface CommandCodeTuiSettingsDeps {
  * cannot express "unset" — cycling only ever lands on a declared option, so a
  * `select` would strand the user on a pinned value with no way back to
  * automatic. The `auto` sentinel plus a `parse` that clears the path keeps the
- * unset state reachable. The two booleans format their EFFECTIVE default
- * (`filterModelsByPlan` unset means true at the adapter), so a fresh install
- * reads true instead of the screen's "(empty)".
+ * unset state reachable. `filterModelsByPlan` formats its EFFECTIVE default
+ * (unset means true at the adapter), so a fresh install reads true instead of
+ * the screen's "(empty)".
  */
 declare function buildCommandCodeTuiSection(deps: CommandCodeTuiSettingsDeps): TuiSettingsSection;
 /**
@@ -1367,6 +1403,15 @@ interface Config {
    * filter card; applies after the subscription-tier filter.
    */
   visibleModels?: string[];
+  /**
+   * Per-model visibility overrides from the terminal settings page's checkbox
+   * list, keyed by catalog id (`true` = listed, `false` = hidden). An id here
+   * decides that model on its own; an id absent here follows `visibleModels`.
+   * dsh-TUI keys a staged edit by the field's path, so the checkboxes need one
+   * path per model — a map — because a boolean field cannot express "this id
+   * is a member of the array".
+   */
+  modelVisibility?: Record<string, boolean>;
   /**
    * Extra accounts for multi-account rotation. The top-level
    * `apiKey`/`apiKeyEnv` (plus the CLI auth file) always form the first

package/lib/index.js

@@ -1875,7 +1875,12 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const access = this.deps.options().filterModelsByPlan === false ? void 0 : await this.loadBillingAccess();
 		const visible = this.deps.options().visibleModels;
 		const allow = Array.isArray(visible) && visible.length > 0 ? new Set(visible.filter((id) => typeof id === "string" && id !== "")) : void 0;
-		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).filter((model) => allow === void 0 || allow.has(model.id)).map(toInfo).sort(compareByPlan);
+		const overrides = this.deps.options().modelVisibility;
+		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).filter((model) => {
+			const override = overrides?.[model.id];
+			if (typeof override === "boolean") return override;
+			return allow === void 0 || allow.has(model.id);
+		}).map(toInfo).sort(compareByPlan);
 	}
 	async resolveModel(provider, model, signal) {
 		const entry = this.catalog.find((m) => m.id === model) ?? (await this.loadCatalog(signal)).find((m) => m.id === model);
@@ -3786,6 +3791,57 @@ var CommandCodeSearchProvider = class {
 const ACTIVE_ACCOUNT_AUTO = "auto";
 /** The selector value meaning "no language override — follow the shell locale". */
 const LANG_AUTO = "auto";
+/** Tier display names, mirroring the web dropdown's headings (`model-select.ts`). */
+const TIER_TITLES = {
+	go: "Go",
+	goat: "GOAT",
+	pro: "Pro",
+	provider: "Provider",
+	max: "Max"
+};
+/** Tiers in picker order; a model outside this set joins the "Other" group. */
+const TIER_ORDER = [
+	"go",
+	"goat",
+	"pro",
+	"provider",
+	"max"
+];
+/** The group holding models this build's catalog does not know. */
+const OTHER_GROUP_ID = "models-other";
+/**
+* Every model this build knows, in checkbox order: plan tier (Go first), then
+* free before paid inside a tier, then by id.
+*
+* The list is the static capability snapshot rather than a live catalog read
+* on purpose — a settings page must draw synchronously, and the snapshot is
+* synced from the same upstream table the picker's tier headings come from.
+* A model added upstream after this build still reaches the user: an empty
+* allowlist shows everything, and a model named in the allowlist but absent
+* here is rendered by the "Other" group instead of disappearing.
+*/
+function commandCodeTuiModelChoices() {
+	return Object.keys(KNOWN_PLANS).map((id) => ({
+		id,
+		tier: KNOWN_PLANS[id] ?? "",
+		free: isFreeModel(id),
+		hint: capabilityDescription(id)
+	})).sort((a, b) => {
+		const tierDelta = tierRank(a.tier) - tierRank(b.tier);
+		if (tierDelta !== 0) return tierDelta;
+		if (a.free !== b.free) return a.free ? -1 : 1;
+		return a.id.localeCompare(b.id);
+	});
+}
+/** Sort rank of a tier key; unknown tiers trail every known one. */
+function tierRank(tier) {
+	const rank = TIER_ORDER.indexOf(tier);
+	return rank === -1 ? TIER_ORDER.length : rank;
+}
+/** The stored allowlist as a clean id list (non-strings and blanks dropped). */
+function storedIds(value) {
+	return Array.isArray(value) ? value.filter((id) => typeof id === "string" && id !== "") : [];
+}
 /**
 * Build the section descriptor. Pure, so tests can pin the exact fields
 * without a dsh-TUI host.
@@ -3795,13 +3851,65 @@ const LANG_AUTO = "auto";
 * cannot express "unset" — cycling only ever lands on a declared option, so a
 * `select` would strand the user on a pinned value with no way back to
 * automatic. The `auto` sentinel plus a `parse` that clears the path keeps the
-* unset state reachable. The two booleans format their EFFECTIVE default
-* (`filterModelsByPlan` unset means true at the adapter), so a fresh install
-* reads true instead of the screen's "(empty)".
+* unset state reachable. `filterModelsByPlan` formats its EFFECTIVE default
+* (unset means true at the adapter), so a fresh install reads true instead of
+* the screen's "(empty)".
 */
 function buildCommandCodeTuiSection(deps) {
 	const ref = deps.apiKeyRef();
 	const slots = deps.accountSlots();
+	const choices = (deps.modelChoices ?? commandCodeTuiModelChoices)();
+	const catalogIds = choices.map((choice) => choice.id);
+	const known = new Set(catalogIds);
+	const stored = storedIds(deps.visibleModels());
+	const overrides = deps.modelVisibility?.() ?? {};
+	const extras = [.../* @__PURE__ */ new Set([...stored, ...Object.keys(overrides)])].filter((id) => !known.has(id));
+	const tierGroups = TIER_ORDER.filter((tier) => choices.some((choice) => choice.tier === tier)).map((tier) => ({
+		id: `models-${tier}`,
+		title: `${TIER_TITLES[tier] ?? tier} models`,
+		descriptions: { zh: `${TIER_TITLES[tier] ?? tier} 模型` }
+	}));
+	const unranked = choices.filter((choice) => tierRank(choice.tier) === TIER_ORDER.length);
+	const otherGroup = unranked.length > 0 || extras.length > 0 ? [{
+		id: OTHER_GROUP_ID,
+		title: "Other models",
+		descriptions: { zh: "其他模型" }
+	}] : [];
+	/**
+	* One checkbox: a boolean at a path of its OWN (`modelVisibility.<id>`).
+	*
+	* The path must be unique per model. dsh-TUI keys a staged draft by the
+	* field's path (`fieldKey`), so N checkboxes sharing `visibleModels` share
+	* ONE draft: every one of them then parses that same draft on save, all N
+	* write ops address the same path, and only the LAST field's op survives —
+	* which silently rewrote the allowlist from the last catalog model instead
+	* of the one that was toggled. A per-model key is what makes a checkbox
+	* express one model's state.
+	*
+	* An override equal to what the array already says is written as a CLEAR, so
+	* toggling a model back to its inherited state leaves no residue and the
+	* document stays minimal.
+	*/
+	const modelField = (id, hint, group) => ({
+		path: ["modelVisibility", id],
+		group,
+		kind: "boolean",
+		label: id,
+		...hint === "" ? {} : { hint },
+		format: (value) => {
+			if (typeof value === "boolean") return String(value);
+			const listed = storedIds(deps.visibleModels());
+			return String(listed.length === 0 || listed.includes(id));
+		},
+		parse: (text) => {
+			const on = text.trim() === "true";
+			const listed = storedIds(deps.visibleModels());
+			return on === (listed.length === 0 || listed.includes(id)) ? { kind: "clear" } : {
+				kind: "set",
+				value: on
+			};
+		}
+	});
 	return {
 		ns: deps.ns,
 		title: deps.title ?? "Command Code",
@@ -3817,6 +3925,8 @@ function buildCommandCodeTuiSection(deps) {
 				title: "Models",
 				descriptions: { zh: "模型" }
 			},
+			...tierGroups,
+			...otherGroup,
 			{
 				id: "advanced",
 				title: "Advanced",
@@ -3865,23 +3975,9 @@ function buildCommandCodeTuiSection(deps) {
 					value: text.trim() === "true"
 				})
 			},
-			{
-				path: ["visibleModels"],
-				group: "models",
-				kind: "text",
-				label: "Visible models",
-				descriptions: { zh: "显示的模型" },
-				hint: "Comma-separated catalog ids; empty shows every model.",
-				hintDescriptions: { zh: "以逗号分隔的模型 id；留空表示显示全部模型。" },
-				format: (value) => (Array.isArray(value) ? value.filter((id) => typeof id === "string" && id !== "") : []).join(", "),
-				parse: (text) => {
-					const ids = text.split(",").map((id) => id.trim()).filter((id) => id !== "");
-					return ids.length === 0 ? { kind: "clear" } : {
-						kind: "set",
-						value: ids
-					};
-				}
-			},
+			...choices.filter((choice) => tierRank(choice.tier) !== TIER_ORDER.length).map((choice) => modelField(choice.id, choice.hint, `models-${choice.tier}`)),
+			...unranked.map((choice) => modelField(choice.id, choice.hint, OTHER_GROUP_ID)),
+			...extras.map((id) => modelField(id, capabilityDescription(id), OTHER_GROUP_ID)),
 			{
 				path: ["activeAccount"],
 				group: "advanced",
@@ -3968,15 +4064,18 @@ function tuiSettingsService(ctx) {
 }
 /**
 * Identity of everything in the section that can change at runtime: the
-* credential reference behind the API-key field and the account slots behind
-* the active-account selector. Re-registration is skipped while this matches,
-* so ordinary settings writes never churn the screen's section list.
+* credential reference behind the API-key field, the account slots behind the
+* active-account selector, and the stored-but-unknown allowlist entries that
+* get a checkbox of their own. Re-registration is skipped while this matches,
+* so ordinary settings writes never churn the screen's section list — the
+* checkboxes themselves read their state live and need no re-declaration.
 */
 function sectionSignature(section) {
 	const active = section.fields.find((field) => field.path.join(".") === "activeAccount");
 	return JSON.stringify({
 		secret: section.fields.find((field) => field.secret !== void 0)?.secret?.ref ?? "",
-		options: active?.options?.map((option) => option.value) ?? []
+		options: active?.options?.map((option) => option.value) ?? [],
+		other: section.fields.filter((field) => field.group === OTHER_GROUP_ID).map((field) => field.label)
 	});
 }
 /**
@@ -4065,6 +4164,15 @@ const Config = z.object({
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	filterModelsByPlan: z.boolean(),
 	visibleModels: z.array(z.string()),
+	/**
+	* Per-model visibility overrides for the terminal settings page's checkbox
+	* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
+	* PATH, so two checkboxes sharing one path would overwrite each other's
+	* draft and the section's last model would decide every write; a map gives
+	* each checkbox a path of its own. An id listed here wins over
+	* {@link visibleModels}; ids absent here keep following it.
+	*/
+	modelVisibility: z.dict(z.boolean()),
 	webSearch: z.boolean().default(true),
 	accounts: z.array(z.object({
 		label: z.string(),
@@ -4094,9 +4202,22 @@ function resolveAdapterOptions(config) {
 		requestTimeoutMs: config.requestTimeoutMs ?? 6e4,
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
 		filterModelsByPlan: config.filterModelsByPlan ?? true,
-		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0
+		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0,
+		modelVisibility: readModelVisibility(config.modelVisibility)
 	};
 }
+/**
+* Per-model visibility overrides, cleaned for the adapter. Programmatic
+* construction may bypass Schemastery normalization, so a non-object or a
+* non-boolean entry is dropped here instead of reaching the picker filter.
+* @param raw - The `modelVisibility` value from any config source.
+* @returns A frozen id → boolean map, or undefined when nothing is set.
+*/
+function readModelVisibility(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+	const entries = Object.entries(raw).filter((entry) => entry[0] !== "" && typeof entry[1] === "boolean");
+	return entries.length === 0 ? void 0 : Object.fromEntries(entries);
+}
 function apply(ctx, config) {
 	let current = () => config;
 	let lastRaw;
@@ -4268,7 +4389,9 @@ function apply(ctx, config) {
 			accountSlots: () => slots().map((slot) => ({
 				id: slot.id,
 				label: slot.label
-			}))
+			})),
+			visibleModels: () => options().visibleModels ?? [],
+			modelVisibility: () => options().modelVisibility
 		});
 		tuiCtx.effect(() => () => {
 			refreshTuiSettings = void 0;