@qilin-agent/client-ui-settings-models 3.1.6 → 3.1.7

package/README.i18n.yaml

@@ -18,11 +18,11 @@
   en: cac50319f379a794
   zh: 5452cb099584cfd7
 /qilin-agent-client-ui-settings-models/use-this-package/api-keys:
-  en: c00d5d85c4109332
-  zh: 819771ed99ac20ca
+  en: 644c771c6398d855
+  zh: 3fae98747222b713
 /qilin-agent-client-ui-settings-models/use-this-package/editing-a-provider:
-  en: b93e6fb3b4e5aada
-  zh: bf06a3054caa9187
+  en: bf92096bdde5e93a
+  zh: 4012a71b7d0f01d2
 /qilin-agent-client-ui-settings-models/use-this-package/adding-and-deleting-providers:
   en: 30c980f905a0245d
   zh: bc119152d4f1a16d
@@ -42,8 +42,8 @@
   en: dfa69c8f6c7e522e
   zh: ee084759767805b4
 /qilin-agent-client-ui-settings-models/understand-the-implementation/onboarding-coordinator:
-  en: 9b6d2ab855c49bd3
-  zh: 6fc401f0587d725d
+  en: 616fda9b1af8283d
+  zh: 53c45f136a5b76d0
 /qilin-agent-client-ui-settings-models/further-exploration:
   en: 79d843a7353898ac
   zh: ba499db1207ea7ac

package/README.md

@@ -31,15 +31,19 @@ A provider with a stored catalog error remains visible with its diagnostic and e
 
 ### API keys
 
-The primary field on an editor card is a single **API key** input — the page never asks for an environment-variable name. A typed key stores write-only through `credentials.set` under the profile's reference, deriving `<ROUTE>_API_KEY` when the profile has none, and the pi-ai profile records that derivation as `apiKeyEnv`, so `settings.yaml` never carries a key value. Leaving a new pi-ai provider's key blank saves a reference-free profile and preserves provider-native authentication (for example the Bedrock credential chain or Vertex ADC). A nonempty draft has the same reveal control as masked conversation text: **Show secret** reveals the current input and **Hide secret** masks it. Changing or clearing the input masks it again. Stored credentials are never read into the input. A row labels API-key state with a green solid dot only when a referenced credential is confirmed configured, and with a red solid dot only when a named reference is confirmed missing. A successful Apply emits a local accessible status message without echoing secret material.
+API-key inputs start empty and use `autocomplete="new-password"` to ask browsers not to autofill saved login passwords. A nonempty draft has the same reveal control as masked conversation text: **Show secret** reveals the current input and **Hide secret** masks it. Changing or clearing the input masks it again. Stored credentials are never read into the input.
+
+The primary field on an editor card is a single **API key** input — the page never asks for an environment-variable name. A typed key stores write-only through `credentials.set` under the profile's reference, deriving `<ROUTE>_API_KEY` when the profile has none, and the pi-ai profile records that derivation as `apiKeyEnv`, so `settings.yaml` never carries a key value. Leaving a new pi-ai provider's key blank saves a reference-free profile and preserves provider-native authentication (for example the Bedrock credential chain or Vertex ADC). The field's placeholder and help tooltip use the profile's `apiKeyEnv` when it has one; otherwise they use the credential variables of the route's `nativeAuth`, excluding `baseURLEnv` address variables, in lookup order, as the configurable-provider directory reports them. These display hints omit references containing `oauth` (case-insensitively), and describe saved credentials followed by the displayed environment fallbacks. This presentation filter does not change the [credential resolution order](../../../docs/subsystems/credentials.md), the adapter's complete environment list, or an explicit reference. A filtered explicit reference still has a usable key input with the plain placeholder and no tooltip. A native route that has no key authentication omits the key field and authentication help entirely; an explicit reference still enables the field. A profile without a reference on a route without `nativeAuth`, such as a hand-declared route, shows the plain key placeholder and no tooltip. A row labels API-key state with a green solid dot only when a referenced credential is confirmed configured, and with a red solid dot only when a named reference is confirmed missing. A successful Apply emits a local accessible status message without echoing secret material.
+
+The editor reads redacted `CredentialInfo` from the page snapshot to choose the saved-credential placeholder or environment detection, without displaying a credential-source label. The card runs no credential probe of its own; refreshing the snapshot updates an open editor, and the hint never receives a credential value or changes field writability.
 
 ### Editing a provider
 
-A blank key field offers a saved credential when one is detected, with no status text below the input; otherwise it offers environment authentication. Redacted `credentials.describe` checks distinguish a detected environment reference, no detected variables, and an unconfirmed read. A missing-variable hint names the first variable to configure, and a detected environment reference names the variable it found. Address configuration variables do not count as credentials. Detection does not validate credentials, test a connection, or inspect provider-managed files such as AWS profiles and Google application-default credentials. A nonempty input shows no authentication status text. The page reads native variable names as well as named references, in batches of at most 64, and never reads their values into the Client.
+A blank key field offers a saved credential when one is detected, with no status text below the input; otherwise it offers environment authentication. Redacted credential checks from the page snapshot distinguish a detected environment reference, no detected variables, and an unconfirmed read. A missing-variable hint names the first variable to configure, and a detected environment reference names the variable it found. Address configuration variables do not count as credentials. Hidden authentication references still participate in detection; a generic detected hint keeps their names hidden. Detection does not validate credentials, test a connection, or inspect provider-managed files such as AWS profiles and Google application-default credentials. A nonempty input shows no authentication status text. The page reads native variable names as well as named references, in batches of at most 64, and never reads their values into the Client.
 
-A provider whose directory entry reports `baseURLEnv` shows those configuration names below the **Base URL** input while no endpoint is stored; a profile endpoint remains the first placeholder choice.
+A provider whose directory entry reports `baseURLEnv` shows those configuration names below the **Base URL** input only while no endpoint is stored and the directory reports no `defaultBaseURL`; a stored profile endpoint, else that catalog endpoint, is the placeholder choice.
 
-The collapsed 自定义设置 fold carries the curated extras: `baseURL` for both families (the deepseek placeholder shows the public endpoint), each adapter's model catalog, and the **display name** and **API protocol** of a pi-ai route the adapter does not ship. Profile `headers` remain deployment configuration in `settings.yaml` or Cordis config and have no Models-page editor. The Provider ID stays fixed: it is the settings key, the name every other namespace and every logged session references, and the stem of a credential reference the page cannot read back to move. There is no provider-scoped reasoning-effort field: effort is a per-model capability, so a provider-scoped control could only be set to a value some models reject. Each model row edits `id`, optional display `name`, optional `contextWindow`/`maxTokens`, input types, and, on a hand-declared pi-ai route, reasoning levels; unrelated model fields survive edits.
+The collapsed 自定义设置 fold carries the curated extras: `baseURL` for both families (the placeholder shows the endpoint the profile resolves to — the public endpoint for deepseek, else the `defaultBaseURL` the configurable-provider directory reports for a pi-ai catalog route), each adapter's model catalog, and the **display name** and **API protocol** of a pi-ai route the adapter does not ship. Profile `headers` remain deployment configuration in `settings.yaml` or Cordis config and have no Models-page editor. The Provider ID stays fixed: it is the settings key, the name every other namespace and every logged session references, and the stem of a credential reference the page cannot read back to move. There is no provider-scoped reasoning-effort field: effort is a per-model capability, so a provider-scoped control could only be set to a value some models reject. Each model row edits `id`, optional display `name`, optional `contextWindow`/`maxTokens`, input types, and, on a hand-declared pi-ai route, reasoning levels; unrelated model fields survive edits.
 
 The DeepSeek card edits the shared `llm-deepseek` endpoint, credentials, and model catalog without a protocol selector. When Cordis YAML selects Messages, the public endpoint placeholder is `https://api.deepseek.com/anthropic`. Saving the card preserves protocol configuration.
 
@@ -79,7 +83,7 @@ Each settings write carries the card's current `revision`, so a concurrent write
 
 ### Onboarding coordinator
 
-The DeepSeek step renders the existing `ProviderEditor` in credential-only mode inside this package's onboarding modal; `credentials.set` stays the only secret write, and no provider settings are changed.
+The DeepSeek step renders the existing `ProviderEditor` in credential-only mode inside this package's onboarding modal; `credentials.set` stays the only secret write, and no provider settings are changed. The Host publishes the `credentialOnboarding` option (default `true`) with the page bootstrap; `false` leaves the API-key step to a native shell that owns credential onboarding.
 
 </details>
 

package/README.zh.md

@@ -31,15 +31,19 @@ kind: "package-reference"
 
 ### API 密钥
 
-编辑卡片上的主字段是单独一个 **API 密钥**输入框——页面从不询问环境变量名。键入的密钥经 `credentials.set` 以**只写**方式存入 profile 的引用之下，profile 没有引用时便派生 `<ROUTE>_API_KEY`，pi-ai profile 会把这次派生记录为 `apiKeyEnv`，因此 `settings.yaml` 从不携带密钥值。为新的 pi-ai 提供方留空密钥会保存一个不带引用的 profile，从而保留提供方原生认证（例如 Bedrock 凭据链或 Vertex ADC）。非空草稿拥有与掩码会话文本相同的显隐控件：**显示密钥**显示当前输入，**隐藏密钥**重新掩码。修改或清空输入都会重新掩码。已存储的凭据绝不会读入输入框。只有确认引用的凭据已配置时，行才会以绿色实心点标示 API 密钥状态；只有确认具名引用缺失时，才会以红色实心点标示。「应用」成功后会发出本地无障碍状态消息，且绝不回显任何机密内容。
+API 密钥输入框初始为空，并使用 `autocomplete="new-password"` 提示浏览器不要自动填充已保存的登录密码。非空草稿拥有与掩码会话文本相同的显隐控件：**显示密钥**显示当前输入，**隐藏密钥**重新掩码。修改或清空输入都会重新掩码。已存储的凭据绝不会读入输入框。
+
+编辑卡片上的主字段是单独一个 **API 密钥**输入框——页面从不询问环境变量名。键入的密钥经 `credentials.set` 以**只写**方式存入 profile 的引用之下，profile 没有引用时便派生 `<ROUTE>_API_KEY`，pi-ai profile 会把这次派生记录为 `apiKeyEnv`，因此 `settings.yaml` 从不携带密钥值。为新的 pi-ai 提供方留空密钥会保存一个不带引用的 profile，从而保留提供方原生认证（例如 Bedrock 凭据链或 Vertex ADC）。输入框的占位符与帮助提示优先使用 profile 的 `apiKeyEnv`；没有时使用路由 `nativeAuth` 的凭据变量（按可配置提供方目录报告的查找顺序，并排除 `baseURLEnv` 地址变量）。这些展示提示会忽略包含 `oauth` 的引用（不区分大小写），并按「已保存凭据在前、其后为所显示环境后备」的方式描述。此展示过滤不改变[凭据解析顺序](../../../docs/subsystems/credentials.zh.md)、适配器的完整环境列表或显式引用。被过滤的显式引用仍提供可用的密钥输入框，占位符为普通样式且无提示。没有密钥认证的原生路由会完全省略密钥输入框与认证帮助；显式引用仍会启用该输入框。profile 无引用且路由无 `nativeAuth`（例如手工声明的路由）时，显示普通密钥占位符且无提示。只有确认引用的凭据已配置时，行才会以绿色实心点标示 API 密钥状态；只有确认具名引用缺失时，才会以红色实心点标示。「应用」成功后会发出本地无障碍状态消息，且绝不回显任何机密内容。
+
+编辑器从页面快照读取脱敏的 `CredentialInfo` 来选择「已保存凭据」占位符或环境检测，不显示凭据来源标签。卡片自身不发起凭据探测；快照刷新会更新已打开的编辑器，提示也绝不接收凭据值、绝不改变字段的可写性。
 
 ### 编辑提供方
 
-留空的密钥字段在检测到已保存凭据时提供该凭据，输入框下方不显示状态文字；否则提供环境认证。脱敏的 `credentials.describe` 检查区分「已检测到环境引用」「未检测到变量」和「读取状态未确认」。缺少变量的提示会给出需要配置的第一个变量名，检测到环境引用的提示会给出它找到的变量。地址配置变量不计作凭据。检测不验证凭据、不测试连接，也不检查 AWS profile 或 Google 应用默认凭据等提供方管理的文件。非空输入不显示认证状态文字。页面按每批最多 64 项读取原生变量名与具名引用，且绝不把变量值读入 Client。
+留空的密钥字段在检测到已保存凭据时提供该凭据，输入框下方不显示状态文字；否则提供环境认证。来自页面快照的脱敏凭据检查区分「已检测到环境引用」「未检测到变量」和「读取状态未确认」。缺少变量的提示会给出需要配置的第一个变量名，检测到环境引用的提示会给出它找到的变量。地址配置变量不计作凭据。被隐藏的认证引用仍参与检测；笼统的「已检测到」提示不会显示它们的名称。检测不验证凭据、不测试连接，也不检查 AWS profile 或 Google 应用默认凭据等提供方管理的文件。非空输入不显示认证状态文字。页面按每批最多 64 项读取原生变量名与具名引用，且绝不把变量值读入 Client。
 
-目录条目报告 `baseURLEnv` 的提供方，会在未存储端点时把这些配置变量名显示在 **API 地址**输入框下方；profile 端点仍是占位符的首选。
+提供方目录报告 `baseURLEnv` 的提供方，只有在既未存储端点、目录也未报告 `defaultBaseURL` 时，才把这些配置变量名显示在 **API 地址**输入框下方；占位符首选已存储的 profile 端点，否则为目录报告的目录端点。
 
-收起的「自定义设置」折叠区承载精选的额外字段：两个家族都有 `baseURL`（deepseek 的占位符显示公共端点）、各适配器自己的模型目录，以及适配器未提供的 pi-ai 路由的**显示名称**与 **API 协议**。Profile `headers` 仍是 `settings.yaml` 或 Cordis 配置中的部署配置，Models 页面不提供编辑器。Provider ID 保持固定：它是 settings 的键、其他每个 namespace 与每一条已记录会话引用的名字，也是页面读不回、因而搬不走的凭据引用词干。这里没有提供方级的推理等级字段：它是按模型的能力，提供方级的控件只可能被设成某些模型会拒绝的值。每个模型行可编辑 `id`、可选显示 `name`、可选 `contextWindow`/`maxTokens`、输入类型，以及手工声明的 pi-ai 路由上的推理等级；无关的模型字段在编辑后仍会保留。
+收起的「自定义设置」折叠区承载精选的额外字段：两个家族都有 `baseURL`（占位符显示 profile 解析到的端点——deepseek 为公共端点，pi-ai 目录路由则为可配置提供方目录报告的 `defaultBaseURL`）、各适配器自己的模型目录，以及适配器未提供的 pi-ai 路由的**显示名称**与 **API 协议**。Profile `headers` 仍是 `settings.yaml` 或 Cordis 配置中的部署配置，Models 页面不提供编辑器。Provider ID 保持固定：它是 settings 的键、其他每个 namespace 与每一条已记录会话引用的名字，也是页面读不回、因而搬不走的凭据引用词干。这里没有提供方级的推理等级字段：它是按模型的能力，提供方级的控件只可能被设成某些模型会拒绝的值。每个模型行可编辑 `id`、可选显示 `name`、可选 `contextWindow`/`maxTokens`、输入类型，以及手工声明的 pi-ai 路由上的推理等级；无关的模型字段在编辑后仍会保留。
 
 `llm-deepseek` 的 DeepSeek 卡片编辑共用的端点、凭据和模型目录，不提供协议选择器。Cordis YAML 选择 Messages 时，官方端点占位符为 `https://api.deepseek.com/anthropic`；保存卡片不会改写协议配置。
 
@@ -79,7 +83,7 @@ kind: "package-reference"
 
 ### 引导协调器
 
-DeepSeek 步骤在本包的引导模态框内以仅凭据模式渲染既有 `ProviderEditor`；`credentials.set` 仍是唯一的机密写入，且不改变任何提供方设置。
+DeepSeek 步骤在本包的引导模态框内以仅凭据模式渲染既有 `ProviderEditor`；`credentials.set` 仍是唯一的机密写入，且不改变任何提供方设置。宿主随页面引导数据发布 `credentialOnboarding` 选项（默认 `true`）；置为 `false` 时，API 密钥步骤交给负责凭据引导的原生壳。
 
 </details>