@ran-sh/dsh-crew 0.5.7 → 1.0.1

package/official-web-bridge/lib/client.js

@@ -179,7 +179,16 @@ function componentState(status, keys, { aligned = false } = {}) {
 	if (evidence.some((value) => typeof value !== "boolean")) return READINESS_STATES.UNKNOWN;
 	return evidence.every(Boolean) && (!aligned || status.components.target_alignment === true) ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
 }
-function runtimeState(runtime) {
+function runtimeState(runtime, readinessSnapshot) {
+	if (readinessSnapshot && typeof readinessSnapshot === "object") {
+		const identity = readinessSnapshot.runtime;
+		if (!(identity?.execution_plane === "hub-3210" && identity.profile === "dsh-crew" && Number(identity.listen_port) === 3210 && typeof identity.runtime_id === "string" && identity.runtime_id.trim())) return READINESS_STATES.UNAVAILABLE;
+		const row = Array.isArray(readinessSnapshot.readiness_matrix?.rows) ? readinessSnapshot.readiness_matrix.rows.find((entry) => entry?.id === "hub_compatibility") : void 0;
+		if (row?.status === "PASS") return READINESS_STATES.READY;
+		if (row?.status === "FAIL") return READINESS_STATES.UNAVAILABLE;
+		if (row?.status === "NOT_RUN" || row?.status === "SKIP") return READINESS_STATES.DEGRADED;
+		return READINESS_STATES.UNKNOWN;
+	}
 	if (runtime === void 0) return READINESS_STATES.UNKNOWN;
 	if (runtime === null) return READINESS_STATES.UNAVAILABLE;
 	return runtime?.ok === true && runtime.service === "dsh-crew-hub" ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
@@ -190,7 +199,7 @@ function bridgeState(surface) {
 	return READINESS_STATES.UNKNOWN;
 }
 /** Project only structured, non-secret installer/runtime evidence. */
-function projectHostReadiness({ installStatus, runtime, surface } = {}) {
+function projectHostReadiness({ installStatus, runtime, surface, readinessSnapshot } = {}) {
 	const codex = installStatus?.codex;
 	const claude = installStatus?.claude;
 	const zcode = installStatus?.zcode;
@@ -230,7 +239,7 @@ function projectHostReadiness({ installStatus, runtime, surface } = {}) {
 		},
 		{
 			id: "crew_harness",
-			state: runtimeState(runtime),
+			state: runtimeState(runtime, readinessSnapshot),
 			detail: runtime?.runtime_version ?? null
 		},
 		{
@@ -434,7 +443,7 @@ const COPY = {
 			"follow-dsh": "跟随 Harness · 使用各档独立的模型优先级",
 			"deepseek-official": "DeepSeek Official · 使用旧版固定模型路由"
 		},
-		workerProviderHint: "仅作用于 Hub 模式；Standalone 始终用 deepseek-official + DEEPSEEK_API_KEY。",
+		workerProviderHint: "仅作用于 Hub 模式；Standalone 仅保留为旧版迁移元数据，不是生产执行路径。",
 		workerModels: "Worker 模型",
 		refreshHarnessModels: "刷新 Harness 模型",
 		refreshingModels: "刷新中…",
@@ -503,11 +512,23 @@ const COPY = {
 		providerDeletePlan: "生成删除计划",
 		providerDelete: "确认删除",
 		providerPlanReady: "计划已生成；再次确认后才会修改 3210 配置。",
+		providerRollback: "回滚",
+		providerRollbackConfirm: "按已保存事务恢复这个 Harness Provider 及原有路由？",
+		providerRollbackUnavailable: "没有可验证的回滚事务",
 		providerReplacement: "替换 Harness 默认 Provider（输入 Provider id）",
 		providerDeleteConfirm: "确认按计划删除这个 Harness Provider？会清理路由引用并重启 3210。",
 		providerDeleteBlocked: "当前 Provider 不能删除（内置、在用、已删除或缺少可用替换）。",
 		providerLifecycleError: "Provider 生命周期操作失败",
 		providerNoInventory: "暂时无法读取 3210 Provider inventory。",
+		credentialReferences: "Credential 引用",
+		credentialReferenceHint: "仅显示引用名、归属和孤儿状态；不会读取或删除密钥。",
+		credentialOrphan: "孤儿 · 可单独申请清理",
+		credentialInUse: (count) => `使用中 · ${count} 个 Provider`,
+		credentialPurgePlan: "申请清理",
+		credentialPurgeConfirm: "这是不可恢复的 Crew-owned 凭据清理，确认继续？",
+		credentialPurging: "清理中…",
+		credentialPurgeUnavailable: "凭据清理不可用",
+		credentialPurgeUnverified: "已执行清理，但验证失败；引用仍保留用于恢复检查",
 		customProviders: "自定义 Provider",
 		addProvider: "＋ 添加 Provider",
 		noCustomProviders: "暂无。添加后会出现在上方的视觉 / 生图 provider 选择里。",
@@ -745,7 +766,7 @@ const COPY = {
 			"follow-dsh": "Follow Harness · use each tier's ordered model priority",
 			"deepseek-official": "DeepSeek Official · use legacy fixed model routing"
 		},
-		workerProviderHint: "Applies to Hub workers only; Standalone always uses deepseek-official + DEEPSEEK_API_KEY.",
+		workerProviderHint: "Applies to Hub workers only; Standalone is legacy migration metadata only and is not a production execution path.",
 		workerModels: "Worker Models",
 		refreshHarnessModels: "Refresh Harness Models",
 		refreshingModels: "Refreshing…",
@@ -814,11 +835,23 @@ const COPY = {
 		providerDeletePlan: "Plan deletion",
 		providerDelete: "Confirm delete",
 		providerPlanReady: "Plan ready; a second confirmation is required before changing 3210 config.",
+		providerRollback: "Rollback",
+		providerRollbackConfirm: "Restore this Harness Provider and its previous routing from the saved transaction?",
+		providerRollbackUnavailable: "No verified rollback transaction is available",
 		providerReplacement: "Replacement Harness Default provider id",
 		providerDeleteConfirm: "Delete this Harness Provider per the plan? Routing refs will be scrubbed and 3210 restarted.",
 		providerDeleteBlocked: "This Provider cannot be deleted (built-in, in use, already absent, or missing a valid replacement).",
 		providerLifecycleError: "Provider lifecycle operation failed",
 		providerNoInventory: "3210 Provider inventory is temporarily unavailable.",
+		credentialReferences: "Credential references",
+		credentialReferenceHint: "Names, ownership, and orphan status only; values are never read or deleted.",
+		credentialOrphan: "orphan · separate purge approval required",
+		credentialInUse: (count) => `in use · ${count} provider(s)`,
+		credentialPurgePlan: "Purge…",
+		credentialPurgeConfirm: "This irreversibly removes a Crew-owned credential. Continue?",
+		credentialPurging: "Purging…",
+		credentialPurgeUnavailable: "Credential purge unavailable",
+		credentialPurgeUnverified: "Purge ran but verification failed; the reference remains visible for recovery",
 		customProviders: "Custom providers",
 		addProvider: "＋ Add provider",
 		noCustomProviders: "None yet. Added providers appear in the vision / image-gen selects above.",
@@ -1406,6 +1439,9 @@ function WorkersPanel({ ctx }) {
 	const [modelCatalogBusy, setModelCatalogBusy] = (0, react.useState)(false);
 	const [providerInventory, setProviderInventory] = (0, react.useState)(null);
 	const [providerHealth, setProviderHealth] = (0, react.useState)([]);
+	const [credentialRefs, setCredentialRefs] = (0, react.useState)([]);
+	const [credentialUnverified, setCredentialUnverified] = (0, react.useState)([]);
+	const [credentialLifecycleBusy, setCredentialLifecycleBusy] = (0, react.useState)(null);
 	const [providerInventoryError, setProviderInventoryError] = (0, react.useState)("");
 	const [providerLifecycleBusy, setProviderLifecycleBusy] = (0, react.useState)(null);
 	const [modelPickerTier, setModelPickerTier] = (0, react.useState)(null);
@@ -1414,6 +1450,7 @@ function WorkersPanel({ ctx }) {
 	const [expandedSections, setExpandedSections] = (0, react.useState)(() => readSectionState(sectionStorage()));
 	const [surface, setSurface] = (0, react.useState)("detecting");
 	const [runtimeInfo, setRuntimeInfo] = (0, react.useState)(void 0);
+	const [readinessSnapshot, setReadinessSnapshot] = (0, react.useState)(void 0);
 	const toggleSection = (sectionId) => {
 		setExpandedSections((current) => ({
 			...current,
@@ -1494,13 +1531,15 @@ function WorkersPanel({ ctx }) {
 	}, [detectSurface]);
 	const refreshAll = (0, react.useCallback)(async () => {
 		try {
-			const [j, s, c, pr, pi, ph] = await Promise.all([
+			const [j, s, c, pr, pi, ph, cr, ext] = await Promise.all([
 				get("/jobs"),
 				get("/install/status"),
 				get("/config"),
 				get("/presets"),
 				get("/providers").catch(() => null),
-				get("/provider-health").catch(() => null)
+				get("/provider-health").catch(() => null),
+				get("/credential-references").catch(() => null),
+				get("/extension").catch(() => null)
 			]);
 			if (j.ok) setJobs(j.jobs ?? []);
 			if (s.ok) setStatus(s.status);
@@ -1514,6 +1553,11 @@ function WorkersPanel({ ctx }) {
 			}))]);
 			if (pi?.ok) setProviderInventory(pi);
 			if (ph?.ok) setProviderHealth(ph.health ?? []);
+			if (cr?.ok) {
+				setCredentialRefs(cr.records ?? []);
+				setCredentialUnverified(cr.unverified_purges ?? []);
+			}
+			if (ext?.ok) setReadinessSnapshot(ext.extension?.readiness_snapshot ?? void 0);
 		} catch {}
 	}, [get]);
 	(0, react.useEffect)(() => {
@@ -1547,14 +1591,59 @@ function WorkersPanel({ ctx }) {
 	const refreshProviderInventory = (0, react.useCallback)(async () => {
 		setProviderInventoryError("");
 		try {
-			const [result, health] = await Promise.all([get("/providers"), get("/provider-health").catch(() => null)]);
+			const [result, health, refs] = await Promise.all([
+				get("/providers"),
+				get("/provider-health").catch(() => null),
+				get("/credential-references").catch(() => null)
+			]);
 			if (!result.ok) throw new Error(result.error ?? copy.providerNoInventory);
 			setProviderInventory(result);
 			if (health?.ok) setProviderHealth(health.health ?? []);
+			if (refs?.ok) {
+				setCredentialRefs(refs.records ?? []);
+				setCredentialUnverified(refs.unverified_purges ?? []);
+			}
 		} catch (error) {
 			setProviderInventoryError(error?.message ?? copy.providerNoInventory);
 		}
 	}, [get, copy]);
+	const purgeCredentialRef = (0, react.useCallback)(async (ref) => {
+		if (ref?.ownership !== "crew-owned" || ref?.orphan !== true || ref?.purge_capability !== "eligible") return;
+		const referenceId = String(ref.reference_id ?? "");
+		if (!referenceId || !window.confirm(copy.credentialPurgeConfirm)) return;
+		setCredentialLifecycleBusy(referenceId);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(referenceId);
+			const planned = await post(`/credential-references/${encoded}/purge-plan`, {});
+			if (!planned.ok || !planned.plan) throw new Error(planned.code ?? copy.credentialPurgeUnavailable);
+			if (!window.confirm(`${copy.credentialPurgeConfirm}\n\n${referenceId}`)) return;
+			const result = await readJson(await fetch(withLang(`/credential-references/${encoded}`), {
+				method: "DELETE",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					plan_id: planned.plan.plan_id,
+					expected_revision: planned.plan.expected_revision,
+					confirm: true,
+					lang: locale === "zh" ? "zh" : "en"
+				})
+			}), `/credential-references/${encoded}`);
+			if (!result.ok || result.state !== "VERIFIED") throw new Error(result.code ?? copy.credentialPurgeUnavailable);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setCredentialLifecycleBusy(null);
+		}
+	}, [
+		copy,
+		locale,
+		post,
+		readJson,
+		refreshProviderInventory,
+		withLang
+	]);
 	(0, react.useEffect)(() => {
 		if (surface === CREW_UI_SURFACES.OFFICIAL) refreshHarnessModels();
 	}, [surface, refreshHarnessModels]);
@@ -1922,6 +2011,43 @@ function WorkersPanel({ ctx }) {
 			setProviderLifecycleBusy(null);
 		}
 	};
+	const rollbackHarnessProvider = async (record, transactionId) => {
+		if (!record || !transactionId || record.desired_state !== "absent") {
+			setNotice(copy.providerRollbackUnavailable);
+			return;
+		}
+		if (!window.confirm(copy.providerRollbackConfirm)) return;
+		setProviderLifecycleBusy(`rollback:${record.id}`);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(record.id);
+			const result = await post(`/providers/${encoded}/rollback`, {
+				transaction_id: transactionId,
+				confirm: true
+			});
+			if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+			if (result.restart_required === true && result.state === "ROLLBACK_PENDING") {
+				const restartPath = "http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart";
+				const restarted = await readJson(await fetch(restartPath, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ confirm: true })
+				}), restartPath);
+				if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+				const verified = await post(`/providers/${encoded}/verify-rollback`, {
+					transaction_id: transactionId,
+					confirm: true
+				});
+				if (!verified.ok || verified.state !== "ROLLED_BACK") throw new Error(verified.code ?? verified.error ?? copy.providerLifecycleError);
+			} else if (result.state !== "ROLLED_BACK") throw new Error(result.code ?? copy.providerLifecycleError);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setProviderLifecycleBusy(null);
+		}
+	};
 	/** Card: title + one-line description header, then its fields. */
 	const block = (text, fields, gridded = true) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 		style: S.block,
@@ -2021,7 +2147,8 @@ function WorkersPanel({ ctx }) {
 	const hostReadiness = projectHostReadiness({
 		installStatus: status,
 		runtime: runtimeInfo,
-		surface
+		surface,
+		readinessSnapshot
 	});
 	if (!currentSurfaceResponsibilities.fullControlPlane) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(MinimalCrewPanel, {
 		locale,
@@ -3463,6 +3590,7 @@ function WorkersPanel({ ctx }) {
 						(providerInventory?.records ?? []).map((record) => {
 							const blocked = record.ownership === "harness" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0;
 							const lifecycle = record.desired_state === "absent" ? "absent" : record.lifecycle?.enabled === false ? "disabled" : record.lifecycle?.catalogued ? "catalogued" : "configured";
+							const rollbackTransaction = (providerInventory?.lifecycle_transactions ?? []).find((entry) => entry.provider_id === record.id && ["VERIFIED", "RESTART_PENDING"].includes(entry.state));
 							return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: {
 									display: "flex",
@@ -3507,9 +3635,95 @@ function WorkersPanel({ ctx }) {
 											deleteHarnessProvider(record);
 										},
 										children: providerLifecycleBusy === record.id ? copy.working : copy.providerDeletePlan
+									}),
+									record.desired_state === "absent" && rollbackTransaction && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: {
+											...S.btn,
+											padding: "2px 8px"
+										},
+										disabled: providerLifecycleBusy !== null,
+										onClick: () => {
+											rollbackHarnessProvider(record, rollbackTransaction.transaction_id);
+										},
+										children: providerLifecycleBusy === `rollback:${record.id}` ? copy.working : copy.providerRollback
 									})
 								]
 							}, record.id);
+						}),
+						(credentialRefs.length > 0 || credentialUnverified.length > 0) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: {
+								marginTop: 10,
+								borderTop: "1px solid rgba(128,128,128,0.16)",
+								paddingTop: 8
+							},
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									style: {
+										fontWeight: 600,
+										fontSize: 12.5
+									},
+									children: copy.credentialReferences
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									style: {
+										fontSize: 11,
+										opacity: .6,
+										margin: "3px 0 7px"
+									},
+									children: copy.credentialReferenceHint
+								}),
+								credentialUnverified.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: {
+										color: "#c55",
+										fontSize: 11.5
+									},
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: S.mono,
+											children: entry.reference_id
+										}),
+										" · ",
+										copy.credentialPurgeUnverified
+									]
+								}, `unverified:${entry.reference_id}`)),
+								credentialRefs.map((ref) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: {
+										display: "flex",
+										alignItems: "center",
+										gap: 8,
+										fontSize: 11.5,
+										flexWrap: "wrap"
+									},
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: S.mono,
+											children: ref.reference_id
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: { opacity: .65 },
+											children: ref.ownership
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: { color: ref.orphan ? "#c98735" : void 0 },
+											children: ref.orphan ? copy.credentialOrphan : copy.credentialInUse(ref.consumer_count ?? 0)
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { flex: 1 } }),
+										ref.ownership === "crew-owned" && ref.orphan === true && ref.purge_capability === "eligible" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											style: {
+												...S.btn,
+												padding: "2px 8px"
+											},
+											disabled: credentialLifecycleBusy !== null,
+											onClick: () => {
+												purgeCredentialRef(ref);
+											},
+											children: credentialLifecycleBusy === ref.reference_id ? copy.credentialPurging : copy.credentialPurgePlan
+										})
+									]
+								}, ref.reference_id))
+							]
 						})
 					]
 				}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "0.5.7",
+  "version": "1.0.1",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/client/host-readiness.mjs

@@ -15,7 +15,20 @@ function componentState(status, keys, { aligned = false } = {}) {
   return ready ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
 }
 
-function runtimeState(runtime) {
+function runtimeState(runtime, readinessSnapshot) {
+  if (readinessSnapshot && typeof readinessSnapshot === 'object') {
+    const identity = readinessSnapshot.runtime;
+    if (!(identity?.execution_plane === 'hub-3210' && identity.profile === 'dsh-crew'
+      && Number(identity.listen_port) === 3210 && typeof identity.runtime_id === 'string' && identity.runtime_id.trim())) {
+      return READINESS_STATES.UNAVAILABLE;
+    }
+    const row = Array.isArray(readinessSnapshot.readiness_matrix?.rows)
+      ? readinessSnapshot.readiness_matrix.rows.find((entry) => entry?.id === 'hub_compatibility') : undefined;
+    if (row?.status === 'PASS') return READINESS_STATES.READY;
+    if (row?.status === 'FAIL') return READINESS_STATES.UNAVAILABLE;
+    if (row?.status === 'NOT_RUN' || row?.status === 'SKIP') return READINESS_STATES.DEGRADED;
+    return READINESS_STATES.UNKNOWN;
+  }
   if (runtime === undefined) return READINESS_STATES.UNKNOWN;
   if (runtime === null) return READINESS_STATES.UNAVAILABLE;
   return runtime?.ok === true && runtime.service === 'dsh-crew-hub'
@@ -30,7 +43,7 @@ function bridgeState(surface) {
 }
 
 /** Project only structured, non-secret installer/runtime evidence. */
-export function projectHostReadiness({ installStatus, runtime, surface } = {}) {
+export function projectHostReadiness({ installStatus, runtime, surface, readinessSnapshot } = {}) {
   const codex = installStatus?.codex;
   const claude = installStatus?.claude;
   const zcode = installStatus?.zcode;
@@ -40,7 +53,7 @@ export function projectHostReadiness({ installStatus, runtime, surface } = {}) {
     { id: 'ds_reviewer', state: componentState(codex, ['reviewer_role'], { aligned: true }) },
     { id: 'claude_plugin', state: componentState(claude, ['enabled', 'marketplace', 'snapshot', 'permissions']) },
     { id: 'zcode_mcp', state: componentState(zcode, ['mcp', 'policy', 'worker_agent', 'reviewer_agent', 'config_prompt', 'status_prompt', 'ownership']) },
-    { id: 'crew_harness', state: runtimeState(runtime), detail: runtime?.runtime_version ?? null },
+    { id: 'crew_harness', state: runtimeState(runtime, readinessSnapshot), detail: runtime?.runtime_version ?? null },
     { id: 'official_bridge', state: bridgeState(surface) },
   ];
 }

package/src/client/index.tsx

@@ -75,7 +75,7 @@ const COPY = {
     statePresetHint: '切到 Custom 可单独配置各档状态。',
     workerProvider: 'Worker Provider',
     workerProviderDesc: { 'follow-dsh': '跟随 Harness · 使用各档独立的模型优先级', 'deepseek-official': 'DeepSeek Official · 使用旧版固定模型路由' },
-    workerProviderHint: '仅作用于 Hub 模式；Standalone 始终用 deepseek-official + DEEPSEEK_API_KEY。',
+    workerProviderHint: '仅作用于 Hub 模式；Standalone 仅保留为旧版迁移元数据，不是生产执行路径。',
     workerModels: 'Worker 模型', refreshHarnessModels: '刷新 Harness 模型', refreshingModels: '刷新中…',
     modelPriority: '模型优先级', addPriorityModel: '＋ 添加优先模型', modelSearch: '搜索 Provider 或 Model…',
     harnessDefault: 'Harness 默认模型', providerUnavailable: 'Provider 不可用', notAdvertised: '当前未列出',
@@ -105,10 +105,12 @@ const COPY = {
     visionProvider: '视觉 provider', visionModel: '视觉模型', imagegenProvider: '生图 provider',
     harnessProviders: 'Harness Providers', harnessProviderHint: '3210 Crew Harness 的真实 Provider 注册与生命周期；不是视觉 / 生图适配器。',
     providerState: (state: string) => `状态：${state}`, providerModels: (count: number) => `${count} 个模型`, providerJobs: (count: number) => `${count} 个运行任务`,
-    providerDeletePlan: '生成删除计划', providerDelete: '确认删除', providerPlanReady: '计划已生成；再次确认后才会修改 3210 配置。',
+    providerDeletePlan: '生成删除计划', providerDelete: '确认删除', providerPlanReady: '计划已生成；再次确认后才会修改 3210 配置。', providerRollback: '回滚', providerRollbackConfirm: '按已保存事务恢复这个 Harness Provider 及原有路由？', providerRollbackUnavailable: '没有可验证的回滚事务',
     providerReplacement: '替换 Harness 默认 Provider（输入 Provider id）', providerDeleteConfirm: '确认按计划删除这个 Harness Provider？会清理路由引用并重启 3210。',
     providerDeleteBlocked: '当前 Provider 不能删除（内置、在用、已删除或缺少可用替换）。', providerLifecycleError: 'Provider 生命周期操作失败',
     providerNoInventory: '暂时无法读取 3210 Provider inventory。',
+    credentialReferences: 'Credential 引用', credentialReferenceHint: '仅显示引用名、归属和孤儿状态；不会读取或删除密钥。',
+    credentialOrphan: '孤儿 · 可单独申请清理', credentialInUse: (count: number) => `使用中 · ${count} 个 Provider`, credentialPurgePlan: '申请清理', credentialPurgeConfirm: '这是不可恢复的 Crew-owned 凭据清理，确认继续？', credentialPurging: '清理中…', credentialPurgeUnavailable: '凭据清理不可用', credentialPurgeUnverified: '已执行清理，但验证失败；引用仍保留用于恢复检查',
     customProviders: '自定义 Provider', addProvider: '＋ 添加 Provider',
     noCustomProviders: '暂无。添加后会出现在上方的视觉 / 生图 provider 选择里。',
     providerName: '名称', modelsField: '模型列表（逗号分隔）',
@@ -212,7 +214,7 @@ const COPY = {
     statePresetHint: 'Switch to Custom to configure each tier state separately.',
     workerProvider: 'Worker Provider',
     workerProviderDesc: { 'follow-dsh': 'Follow Harness · use each tier\'s ordered model priority', 'deepseek-official': 'DeepSeek Official · use legacy fixed model routing' },
-    workerProviderHint: 'Applies to Hub workers only; Standalone always uses deepseek-official + DEEPSEEK_API_KEY.',
+    workerProviderHint: 'Applies to Hub workers only; Standalone is legacy migration metadata only and is not a production execution path.',
     workerModels: 'Worker Models', refreshHarnessModels: 'Refresh Harness Models', refreshingModels: 'Refreshing…',
     modelPriority: 'Model Priority', addPriorityModel: '＋ Add Priority Model', modelSearch: 'Search Provider or Model…',
     harnessDefault: 'Harness Default', providerUnavailable: 'Provider unavailable', notAdvertised: 'Currently not advertised',
@@ -242,10 +244,12 @@ const COPY = {
     visionProvider: 'Vision provider', visionModel: 'Vision model', imagegenProvider: 'Image-gen provider',
     harnessProviders: 'Harness Providers', harnessProviderHint: 'Live Provider registration and lifecycle in the 3210 Crew Harness; separate from vision / image-gen adapters.',
     providerState: (state: string) => `State: ${state}`, providerModels: (count: number) => `${count} models`, providerJobs: (count: number) => `${count} running jobs`,
-    providerDeletePlan: 'Plan deletion', providerDelete: 'Confirm delete', providerPlanReady: 'Plan ready; a second confirmation is required before changing 3210 config.',
+    providerDeletePlan: 'Plan deletion', providerDelete: 'Confirm delete', providerPlanReady: 'Plan ready; a second confirmation is required before changing 3210 config.', providerRollback: 'Rollback', providerRollbackConfirm: 'Restore this Harness Provider and its previous routing from the saved transaction?', providerRollbackUnavailable: 'No verified rollback transaction is available',
     providerReplacement: 'Replacement Harness Default provider id', providerDeleteConfirm: 'Delete this Harness Provider per the plan? Routing refs will be scrubbed and 3210 restarted.',
     providerDeleteBlocked: 'This Provider cannot be deleted (built-in, in use, already absent, or missing a valid replacement).', providerLifecycleError: 'Provider lifecycle operation failed',
     providerNoInventory: '3210 Provider inventory is temporarily unavailable.',
+    credentialReferences: 'Credential references', credentialReferenceHint: 'Names, ownership, and orphan status only; values are never read or deleted.',
+    credentialOrphan: 'orphan · separate purge approval required', credentialInUse: (count: number) => `in use · ${count} provider(s)`, credentialPurgePlan: 'Purge…', credentialPurgeConfirm: 'This irreversibly removes a Crew-owned credential. Continue?', credentialPurging: 'Purging…', credentialPurgeUnavailable: 'Credential purge unavailable', credentialPurgeUnverified: 'Purge ran but verification failed; the reference remains visible for recovery',
     customProviders: 'Custom providers', addProvider: '＋ Add provider',
     noCustomProviders: 'None yet. Added providers appear in the vision / image-gen selects above.',
     providerName: 'Name', modelsField: 'Models (comma-separated)',
@@ -526,6 +530,9 @@ function WorkersPanel({ ctx }: { ctx: any }) {
   const [modelCatalogBusy, setModelCatalogBusy] = useState(false);
   const [providerInventory, setProviderInventory] = useState<any>(null);
   const [providerHealth, setProviderHealth] = useState<any[]>([]);
+  const [credentialRefs, setCredentialRefs] = useState<any[]>([]);
+  const [credentialUnverified, setCredentialUnverified] = useState<any[]>([]);
+  const [credentialLifecycleBusy, setCredentialLifecycleBusy] = useState<string | null>(null);
   const [providerInventoryError, setProviderInventoryError] = useState('');
   const [providerLifecycleBusy, setProviderLifecycleBusy] = useState<string | null>(null);
   const [modelPickerTier, setModelPickerTier] = useState<'flash' | 'pro' | null>(null);
@@ -534,6 +541,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
   const [expandedSections, setExpandedSections] = useState<Record<string, boolean>>(() => readSectionState(sectionStorage()));
   const [surface, setSurface] = useState<string>('detecting');
   const [runtimeInfo, setRuntimeInfo] = useState<any>(undefined);
+  const [readinessSnapshot, setReadinessSnapshot] = useState<any>(undefined);
 
   const toggleSection = (sectionId: string) => {
     setExpandedSections((current) => ({ ...current, [sectionId]: !current[sectionId] }));
@@ -609,9 +617,9 @@ function WorkersPanel({ ctx }: { ctx: any }) {
 
   const refreshAll = useCallback(async () => {
     try {
-      const [j, s, c, pr, pi, ph] = await Promise.all([
+      const [j, s, c, pr, pi, ph, cr, ext] = await Promise.all([
         get('/jobs'), get('/install/status'), get('/config'), get('/presets'),
-        get('/providers').catch(() => null), get('/provider-health').catch(() => null),
+        get('/providers').catch(() => null), get('/provider-health').catch(() => null), get('/credential-references').catch(() => null), get('/extension').catch(() => null),
       ]);
       if (j.ok) setJobs(j.jobs ?? []);
       if (s.ok) setStatus(s.status);
@@ -622,6 +630,8 @@ function WorkersPanel({ ctx }: { ctx: any }) {
       ]);
       if (pi?.ok) setProviderInventory(pi);
       if (ph?.ok) setProviderHealth(ph.health ?? []);
+      if (cr?.ok) { setCredentialRefs(cr.records ?? []); setCredentialUnverified(cr.unverified_purges ?? []); }
+      if (ext?.ok) setReadinessSnapshot(ext.extension?.readiness_snapshot ?? undefined);
     } catch { /* instance restarting */ }
   }, [get]);
 
@@ -654,14 +664,40 @@ function WorkersPanel({ ctx }: { ctx: any }) {
   const refreshProviderInventory = useCallback(async () => {
     setProviderInventoryError('');
     try {
-      const [result, health] = await Promise.all([get('/providers'), get('/provider-health').catch(() => null)]);
+      const [result, health, refs] = await Promise.all([get('/providers'), get('/provider-health').catch(() => null), get('/credential-references').catch(() => null)]);
       if (!result.ok) throw new Error(result.error ?? copy.providerNoInventory);
       setProviderInventory(result);
       if (health?.ok) setProviderHealth(health.health ?? []);
+      if (refs?.ok) { setCredentialRefs(refs.records ?? []); setCredentialUnverified(refs.unverified_purges ?? []); }
     } catch (error: any) {
       setProviderInventoryError(error?.message ?? copy.providerNoInventory);
     }
   }, [get, copy]);
+
+  const purgeCredentialRef = useCallback(async (ref: any) => {
+    if (ref?.ownership !== 'crew-owned' || ref?.orphan !== true || ref?.purge_capability !== 'eligible') return;
+    const referenceId = String(ref.reference_id ?? '');
+    if (!referenceId || !window.confirm(copy.credentialPurgeConfirm)) return;
+    setCredentialLifecycleBusy(referenceId);
+    setNotice(copy.working);
+    try {
+      const encoded = encodeURIComponent(referenceId);
+      const planned = await post(`/credential-references/${encoded}/purge-plan`, {});
+      if (!planned.ok || !planned.plan) throw new Error(planned.code ?? copy.credentialPurgeUnavailable);
+      if (!window.confirm(`${copy.credentialPurgeConfirm}\n\n${referenceId}`)) return;
+      const result = await readJson(await fetch(withLang(`/credential-references/${encoded}`), {
+        method: 'DELETE', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ plan_id: planned.plan.plan_id, expected_revision: planned.plan.expected_revision, confirm: true, lang: locale === 'zh' ? 'zh' : 'en' }),
+      }), `/credential-references/${encoded}`);
+      if (!result.ok || result.state !== 'VERIFIED') throw new Error(result.code ?? copy.credentialPurgeUnavailable);
+      setNotice(copy.saved);
+      await refreshProviderInventory();
+    } catch (error: any) {
+      setNotice(String(error?.message ?? error));
+    } finally {
+      setCredentialLifecycleBusy(null);
+    }
+  }, [copy, locale, post, readJson, refreshProviderInventory, withLang]);
 
   useEffect(() => {
     if (surface === CREW_UI_SURFACES.OFFICIAL) void refreshHarnessModels();
@@ -884,6 +920,38 @@ function WorkersPanel({ ctx }: { ctx: any }) {
     }
   };
 
+  const rollbackHarnessProvider = async (record: any, transactionId: string) => {
+    if (!record || !transactionId || record.desired_state !== 'absent') {
+      setNotice(copy.providerRollbackUnavailable);
+      return;
+    }
+    if (!window.confirm(copy.providerRollbackConfirm)) return;
+    setProviderLifecycleBusy(`rollback:${record.id}`);
+    setNotice(copy.working);
+    try {
+      const encoded = encodeURIComponent(record.id);
+      const result = await post(`/providers/${encoded}/rollback`, { transaction_id: transactionId, confirm: true });
+      if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+      if (result.restart_required === true && result.state === 'ROLLBACK_PENDING') {
+        const restartPath = 'http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart';
+        const restarted = await readJson(await fetch(restartPath, {
+          method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ confirm: true }),
+        }), restartPath);
+        if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+        const verified = await post(`/providers/${encoded}/verify-rollback`, { transaction_id: transactionId, confirm: true });
+        if (!verified.ok || verified.state !== 'ROLLED_BACK') throw new Error(verified.code ?? verified.error ?? copy.providerLifecycleError);
+      } else if (result.state !== 'ROLLED_BACK') {
+        throw new Error(result.code ?? copy.providerLifecycleError);
+      }
+      setNotice(copy.saved);
+      await refreshProviderInventory();
+    } catch (error: any) {
+      setNotice(String(error?.message ?? error));
+    } finally {
+      setProviderLifecycleBusy(null);
+    }
+  };
+
   /** Card: title + one-line description header, then its fields. */
   const block = (text: { t: string; d: string }, fields: any, gridded = true) => (
     <div style={S.block}>
@@ -927,7 +995,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
   };
   const modelActivity = aggregateModelInvocations(jobs);
   const currentSurfaceResponsibilities = surfaceResponsibilities(surface);
-  const hostReadiness = projectHostReadiness({ installStatus: status, runtime: runtimeInfo, surface });
+  const hostReadiness = projectHostReadiness({ installStatus: status, runtime: runtimeInfo, surface, readinessSnapshot });
 
   if (!currentSurfaceResponsibilities.fullControlPlane) {
     return <MinimalCrewPanel locale={locale} surface={surface} runtime={runtimeInfo} />;
@@ -1384,6 +1452,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
           {(providerInventory?.records ?? []).map((record: any) => {
             const blocked = record.ownership === 'harness' || record.desired_state === 'absent' || Number(record.references?.active_jobs ?? 0) > 0;
             const lifecycle = record.desired_state === 'absent' ? 'absent' : record.lifecycle?.enabled === false ? 'disabled' : record.lifecycle?.catalogued ? 'catalogued' : 'configured';
+            const rollbackTransaction = (providerInventory?.lifecycle_transactions ?? []).find((entry: any) => entry.provider_id === record.id && ['VERIFIED', 'RESTART_PENDING'].includes(entry.state));
             return (
               <div key={record.id} style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 12.5, flexWrap: 'wrap' as const }}>
                 <span style={{ fontWeight: 600 }}>{record.display_name || record.id}</span>
@@ -1398,9 +1467,41 @@ function WorkersPanel({ ctx }: { ctx: any }) {
                     {providerLifecycleBusy === record.id ? copy.working : copy.providerDeletePlan}
                   </button>
                 )}
+                {record.desired_state === 'absent' && rollbackTransaction && (
+                  <button type="button" style={{ ...S.btn, padding: '2px 8px' }} disabled={providerLifecycleBusy !== null}
+                    onClick={() => { void rollbackHarnessProvider(record, rollbackTransaction.transaction_id); }}>
+                    {providerLifecycleBusy === `rollback:${record.id}` ? copy.working : copy.providerRollback}
+                  </button>
+                )}
               </div>
             );
           })}
+          {(credentialRefs.length > 0 || credentialUnverified.length > 0) && (
+            <div style={{ marginTop: 10, borderTop: '1px solid rgba(128,128,128,0.16)', paddingTop: 8 }}>
+              <div style={{ fontWeight: 600, fontSize: 12.5 }}>{copy.credentialReferences}</div>
+              <div style={{ fontSize: 11, opacity: 0.6, margin: '3px 0 7px' }}>{copy.credentialReferenceHint}</div>
+              {credentialUnverified.map((entry: any) => (
+                <div key={`unverified:${entry.reference_id}`} style={{ color: '#c55', fontSize: 11.5 }}>
+                  <span style={S.mono}>{entry.reference_id}</span> · {copy.credentialPurgeUnverified}
+                </div>
+              ))}
+              {credentialRefs.map((ref: any) => (
+                <div key={ref.reference_id} style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 11.5, flexWrap: 'wrap' as const }}>
+                  <span style={S.mono}>{ref.reference_id}</span>
+                  <span style={{ opacity: 0.65 }}>{ref.ownership}</span>
+                  <span style={{ color: ref.orphan ? '#c98735' : undefined }}>{ref.orphan ? copy.credentialOrphan : copy.credentialInUse(ref.consumer_count ?? 0)}</span>
+                  <span style={{ flex: 1 }} />
+                  {ref.ownership === 'crew-owned' && ref.orphan === true && ref.purge_capability === 'eligible' && (
+                    <button type="button" style={{ ...S.btn, padding: '2px 8px' }}
+                      disabled={credentialLifecycleBusy !== null}
+                      onClick={() => { void purgeCredentialRef(ref); }}>
+                      {credentialLifecycleBusy === ref.reference_id ? copy.credentialPurging : copy.credentialPurgePlan}
+                    </button>
+                  )}
+                </div>
+              ))}
+            </div>
+          )}
         </CollapsibleSection>
 
         <CollapsibleSection sectionId="providers" title={copy.sectionNames.providers}