@ran-sh/dsh-crew 1.0.2 → 1.0.3

package/src/client/index.tsx

@@ -106,13 +106,14 @@ const COPY = {
     harnessProviders: 'Harness Providers', harnessProviderHint: '3210 Crew Harness 的真实 Provider 注册与生命周期；不是视觉 / 生图适配器。',
     providerState: (state: string) => `状态：${state}`, providerModels: (count: number) => `${count} 个模型`, providerJobs: (count: number) => `${count} 个运行任务`,
     providerOfficialBuiltin: '· 官方内置（不可删除）', providerSourceUnresolved: '· 来源未解析（安全锁定）',
+    providerLayerMigration: '检测到旧版 profile Provider', providerLayerMigrationHint: '这些 Provider 仍在 Crew profile/base 层，所以 3210 原生页面不会显示删除。请先按迁移计划提升到 Harness 用户设置层；不会复制密钥。', providerLayerMigrationPlan: '迁移计划', providerLayerMigrate: '迁移到用户层', providerLayerMigrating: '迁移中…', providerLayerMigrationConfirm: '确认把这个 Provider 移到 Harness 用户设置层？会先保存可回滚快照，不会复制密钥值。', providerLayerRollback: '回滚迁移',
     providerDeletePlan: '生成删除计划', providerDelete: '确认删除', providerPlanReady: '计划已生成；再次确认后才会修改 3210 配置。', providerRollback: '回滚', providerRollbackConfirm: '按已保存事务恢复这个 Harness Provider 及原有路由？', providerRollbackUnavailable: '没有可验证的回滚事务',
     providerReplacement: '替换 Harness 默认 Provider（输入 Provider id）', providerDeleteConfirm: '确认按计划删除这个 Harness Provider？会清理路由引用并重启 3210。',
     providerDeleteBlocked: '当前 Provider 不能删除（内置、在用、已删除或缺少可用替换）。', providerLifecycleError: 'Provider 生命周期操作失败', providerDeletePending: '配置可能已变更，事务仍待重启/验证；请刷新状态后选择回滚。', providerRollbackContinue: '继续回滚验证', recoveryUnresolved: '发现不可自动恢复的事务', recoveryStorage: '存储项', recoveryQuarantine: '隔离', recoveryQuarantineConfirm: '该事务清单无法安全恢复。将其移入隔离区并阻止自动使用，继续？',
     providerNoInventory: '暂时无法读取 3210 Provider inventory。',
     credentialReferences: 'Credential 引用', credentialReferenceHint: '仅显示引用名、归属和孤儿状态；不会读取或删除密钥。',
     credentialOrphan: '孤儿 · 可单独申请清理', credentialInUse: (count: number) => `使用中 · ${count} 个 Provider`, credentialPurgePlan: '申请清理', credentialPurgeConfirm: '这是不可恢复的 Crew-owned 凭据清理，确认继续？', credentialPurging: '清理中…', credentialPurgeUnavailable: '凭据清理不可用', credentialPurgeUnverified: '已执行清理，但验证失败；引用仍保留用于恢复检查',
-    customProviders: '自定义 Provider', addProvider: '＋ 添加 Provider',
+    customProviders: '多模态适配器', addProvider: '＋ 添加多模态适配器',
     noCustomProviders: '暂无。添加后会出现在上方的视觉 / 生图 provider 选择里。',
     providerName: '名称', modelsField: '模型列表（逗号分隔）',
     providerType: '接入方式', typeApi: 'API · 兼容 OpenAI 接口', typeCli: 'CLI · 本地命令',
@@ -246,13 +247,14 @@ const COPY = {
     harnessProviders: 'Harness Providers', harnessProviderHint: 'Live Provider registration and lifecycle in the 3210 Crew Harness; separate from vision / image-gen adapters.',
     providerState: (state: string) => `State: ${state}`, providerModels: (count: number) => `${count} models`, providerJobs: (count: number) => `${count} running jobs`,
     providerOfficialBuiltin: '· official built-in (immutable)', providerSourceUnresolved: '· source unresolved (locked)',
+    providerLayerMigration: 'Legacy profile Providers detected', providerLayerMigrationHint: 'These Providers still exist in the Crew profile/base layer, so the native 3210 page cannot show Delete. Promote them to Harness user settings with an explicit plan; keys are never copied.', providerLayerMigrationPlan: 'Migration plan', providerLayerMigrate: 'Migrate to user layer', providerLayerMigrating: 'Migrating…', providerLayerMigrationConfirm: 'Move this Provider into Harness user settings? A rollback snapshot is saved first; credential values are never copied.', providerLayerRollback: 'Rollback migration',
     providerDeletePlan: 'Plan deletion', providerDelete: 'Confirm delete', providerPlanReady: 'Plan ready; a second confirmation is required before changing 3210 config.', providerRollback: 'Rollback', providerRollbackConfirm: 'Restore this Harness Provider and its previous routing from the saved transaction?', providerRollbackUnavailable: 'No verified rollback transaction is available',
     providerReplacement: 'Replacement Harness Default provider id', providerDeleteConfirm: 'Delete this Harness Provider per the plan? Routing refs will be scrubbed and 3210 restarted.',
     providerDeleteBlocked: 'This Provider cannot be deleted (built-in, in use, already absent, or missing a valid replacement).', providerLifecycleError: 'Provider lifecycle operation failed', providerDeletePending: 'Configuration may already be changed; the transaction still needs restart/verification. Refresh status and use rollback if needed.', providerRollbackContinue: 'Continue rollback verification', recoveryUnresolved: 'An unrecoverable recovery transaction is blocking deletion', recoveryStorage: 'storage entry', recoveryQuarantine: 'Quarantine', recoveryQuarantineConfirm: 'This recovery manifest cannot be safely reopened. Move it into the quarantine area and keep it out of automatic recovery?',
     providerNoInventory: '3210 Provider inventory is temporarily unavailable.',
     credentialReferences: 'Credential references', credentialReferenceHint: 'Names, ownership, and orphan status only; values are never read or deleted.',
     credentialOrphan: 'orphan · separate purge approval required', credentialInUse: (count: number) => `in use · ${count} provider(s)`, credentialPurgePlan: 'Purge…', credentialPurgeConfirm: 'This irreversibly removes a Crew-owned credential. Continue?', credentialPurging: 'Purging…', credentialPurgeUnavailable: 'Credential purge unavailable', credentialPurgeUnverified: 'Purge ran but verification failed; the reference remains visible for recovery',
-    customProviders: 'Custom providers', addProvider: '＋ Add provider',
+    customProviders: 'Multimodal adapters', addProvider: '＋ Add multimodal adapter',
     noCustomProviders: 'None yet. Added providers appear in the vision / image-gen selects above.',
     providerName: 'Name', modelsField: 'Models (comma-separated)',
     providerType: 'Connection', typeApi: 'API · OpenAI-compatible', typeCli: 'CLI · local command',
@@ -925,6 +927,65 @@ function WorkersPanel({ ctx }: { ctx: any }) {
     }
   };
 
+  const migrateHarnessProvider = async (entry: any) => {
+    if (!entry || !['promote-existing-user', 'materialize-user'].includes(entry.action)) {
+      setNotice(entry?.blocked_reason ?? copy.providerLayerMigrationHint);
+      return;
+    }
+    if (!window.confirm(copy.providerLayerMigrationConfirm)) return;
+    const id = String(entry.provider_id ?? '');
+    if (!id) return;
+    setProviderLifecycleBusy(`migrate:${id}`);
+    setNotice(copy.providerLayerMigrating);
+    try {
+      const encoded = encodeURIComponent(id);
+      const planned = await post(`/providers/${encoded}/migrate-plan`, {});
+      if (!planned.ok || !planned.plan) throw new Error(planned.code ?? copy.providerLifecycleError);
+      if (!window.confirm(`${copy.providerLayerMigrationConfirm}\n\n${id}`)) return;
+      const result = await post(`/providers/${encoded}/migrate`, { plan_id: planned.plan.plan_id, confirm: true });
+      if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+      if (result.restart_required === true && result.result?.state === 'RESTART_PENDING') {
+        const restartPath = 'http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart';
+        const restarted = await readJson(await fetch(restartPath, {
+          method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ confirm: true }),
+        }), restartPath);
+        if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+        const verified = await post(`/providers/${encoded}/verify-migration`, { transaction_id: planned.plan.plan_id, confirm: true });
+        if (!verified.ok || verified.state !== 'VERIFIED') throw new Error(verified.code ?? verified.error ?? copy.providerLifecycleError);
+      }
+      setNotice(copy.saved);
+      await refreshProviderInventory();
+    } catch (error: any) {
+      try { await refreshProviderInventory(); } catch { /* preserve the original migration error */ }
+      setNotice(String(error?.message ?? error));
+    } finally {
+      setProviderLifecycleBusy(null);
+    }
+  };
+
+  const rollbackHarnessMigration = async (record: any, transactionId: string) => {
+    if (!record?.id || !transactionId || !window.confirm(copy.providerRollbackConfirm)) return;
+    setProviderLifecycleBusy(`rollback-migrate:${record.id}`);
+    setNotice(copy.working);
+    try {
+      const encoded = encodeURIComponent(record.id);
+      const result = await post(`/providers/${encoded}/rollback-migration`, { transaction_id: transactionId, confirm: true });
+      if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+      if (result.restart_required === true) {
+        const restartPath = 'http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart';
+        const restarted = await readJson(await fetch(restartPath, {
+          method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ confirm: true }),
+        }), restartPath);
+        if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+      }
+      setNotice(copy.saved);
+      await refreshProviderInventory();
+    } catch (error: any) {
+      setNotice(String(error?.message ?? error));
+      try { await refreshProviderInventory(); } catch { /* preserve the original rollback error */ }
+    } finally { setProviderLifecycleBusy(null); }
+  };
+
   const rollbackHarnessProvider = async (record: any, transactionId: string, transactionState: string = 'VERIFIED') => {
     const continuing = ['ROLLBACK_PENDING', 'ROLLBACK_RESTART_PENDING'].includes(transactionState);
     const recoverable = ['PLANNED', 'TOMBSTONE_APPLYING', 'TOMBSTONE_APPLIED', 'REFERENCES_APPLYING', 'REFERENCES_APPLIED', 'DECLARATIONS_APPLYING', 'DECLARATIONS_APPLIED', 'DELETE_RESTART_PENDING', 'ROLLBACK_APPLYING', 'ROLLBACK_RESTORED'].includes(transactionState);
@@ -1475,6 +1536,27 @@ function WorkersPanel({ ctx }: { ctx: any }) {
           summary={sectionSummary(copy.providerCount(providerInventory?.records?.length ?? 0), providerInventoryError ? copy.providerLifecycleError : '')}
           expanded={!!expandedSections.harnessProviders} onToggle={() => toggleSection('harnessProviders')}>
           {providerInventoryError && <div style={{ fontSize: 12, color: '#c55' }}>{providerInventoryError}</div>}
+          {!providerInventoryError && (providerInventory?.migration?.providers?.length ?? 0) > 0 && (
+            <div style={{ border: '1px solid rgba(201,135,53,0.45)', borderRadius: 7, padding: '8px 10px', marginBottom: 8 }}>
+              <div style={{ fontWeight: 650, fontSize: 12.5 }}>{copy.providerLayerMigration}</div>
+              <div style={{ fontSize: 11.5, opacity: 0.7, marginTop: 3 }}>{copy.providerLayerMigrationHint}</div>
+              <div style={{ fontSize: 11, marginTop: 6, fontFamily: 'monospace' }}>
+                {(providerInventory.migration.providers ?? []).map((entry: any) => (
+                  <div key={entry.provider_id} style={{ display: 'flex', alignItems: 'center', gap: 6, marginTop: 3 }}>
+                    {entry.provider_id} · {entry.action}{entry.harness_default ? ' · Harness Default' : ''}
+                    <span style={{ flex: 1 }} />
+                    {['promote-existing-user', 'materialize-user'].includes(entry.action) && <button type="button" style={{ ...S.btn, padding: '2px 7px' }} disabled={providerLifecycleBusy !== null}
+                      onClick={() => { void migrateHarnessProvider(entry); }}>
+                      {providerLifecycleBusy === `migrate:${entry.provider_id}` ? copy.providerLayerMigrating : copy.providerLayerMigrate}
+                    </button>}
+                  </div>
+                ))}
+              </div>
+              <a href="http://127.0.0.1:3210/" target="_blank" rel="noopener noreferrer" style={{ ...S.btn, display: 'inline-block', textDecoration: 'none', marginTop: 7, padding: '3px 8px' }}>
+                {copy.providerLayerMigrationPlan} → 3210
+              </a>
+            </div>
+          )}
           {!providerInventoryError && (providerInventory?.records?.length ?? 0) === 0 && (
             <div style={{ fontSize: 12, opacity: 0.55 }}>{copy.providerNoInventory}</div>
           )}
@@ -1486,7 +1568,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
             const lifecycleTransactions = providerInventory?.lifecycle_transactions ?? [];
             const recoveryTransactions = (providerInventory?.recovery_transactions ?? []).map((entry: any) => ({ ...entry, state: entry.phase }));
             const rollbackTransaction = [...lifecycleTransactions, ...recoveryTransactions]
-              .filter((entry: any) => entry.provider_id === record.id && ['VERIFIED', 'RESTART_PENDING', 'ROLLBACK_PENDING', 'PLANNED', 'TOMBSTONE_APPLYING', 'TOMBSTONE_APPLIED', 'REFERENCES_APPLYING', 'REFERENCES_APPLIED', 'DECLARATIONS_APPLYING', 'DECLARATIONS_APPLIED', 'DELETE_RESTART_PENDING', 'ROLLBACK_RESTART_PENDING', 'ROLLBACK_RESTORED', 'ROLLBACK_APPLYING'].includes(entry.state))
+              .filter((entry: any) => entry.provider_id === record.id && ['VERIFIED', 'RESTART_PENDING', 'ROLLBACK_PENDING', 'PLANNED', 'TOMBSTONE_APPLYING', 'TOMBSTONE_APPLIED', 'REFERENCES_APPLYING', 'REFERENCES_APPLIED', 'DECLARATIONS_APPLYING', 'DECLARATIONS_APPLIED', 'DELETE_RESTART_PENDING', 'ROLLBACK_RESTART_PENDING', 'ROLLBACK_RESTORED', 'ROLLBACK_APPLYING', 'PREPARED', 'USER_MATERIALIZED', 'BASE_REMOVED'].includes(entry.state))
               .sort((a: any, b: any) => String(a.updated_at ?? '').localeCompare(String(b.updated_at ?? ''))).at(-1);
             return (
               <div key={record.id} style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 12.5, flexWrap: 'wrap' as const }}>
@@ -1504,12 +1586,18 @@ function WorkersPanel({ ctx }: { ctx: any }) {
                     {providerLifecycleBusy === record.id ? copy.working : copy.providerDeletePlan}
                   </button>
                 )}
-                {(record.desired_state === 'absent' || ['PLANNED', 'TOMBSTONE_APPLYING', 'TOMBSTONE_APPLIED', 'REFERENCES_APPLYING', 'REFERENCES_APPLIED', 'DECLARATIONS_APPLYING', 'DECLARATIONS_APPLIED', 'DELETE_RESTART_PENDING', 'ROLLBACK_PENDING', 'ROLLBACK_RESTART_PENDING', 'ROLLBACK_RESTORED', 'ROLLBACK_APPLYING'].includes(rollbackTransaction?.state)) && rollbackTransaction && (
+                {(record.desired_state === 'absent' || ['PLANNED', 'TOMBSTONE_APPLYING', 'TOMBSTONE_APPLIED', 'REFERENCES_APPLYING', 'REFERENCES_APPLIED', 'DECLARATIONS_APPLYING', 'DECLARATIONS_APPLIED', 'DELETE_RESTART_PENDING', 'ROLLBACK_PENDING', 'ROLLBACK_RESTART_PENDING', 'ROLLBACK_RESTORED', 'ROLLBACK_APPLYING'].includes(rollbackTransaction?.state)) && rollbackTransaction && rollbackTransaction.source !== 'provider-layer-migration' && (
                   <button type="button" style={{ ...S.btn, padding: '2px 8px' }} disabled={providerLifecycleBusy !== null}
                     onClick={() => { void rollbackHarnessProvider(record, rollbackTransaction.transaction_id, rollbackTransaction.state); }}>
                     {providerLifecycleBusy === `rollback:${record.id}` ? copy.working : rollbackTransaction.state === 'ROLLBACK_PENDING' ? copy.providerRollbackContinue : copy.providerRollback}
                   </button>
                 )}
+                {rollbackTransaction?.source === 'provider-layer-migration' && rollbackTransaction.transaction_id && (
+                  <button type="button" style={{ ...S.btn, padding: '2px 8px' }} disabled={providerLifecycleBusy !== null}
+                    onClick={() => { void rollbackHarnessMigration(record, rollbackTransaction.transaction_id); }}>
+                    {providerLifecycleBusy === `rollback-migrate:${record.id}` ? copy.working : copy.providerLayerRollback}
+                  </button>
+                )}
               </div>
             );
           })}

package/src/credential-reference.mjs

@@ -0,0 +1,38 @@
+// Credential references are identifiers, never credential values. Keep this
+// boundary strict because provider metadata is returned to the browser/UI.
+
+const ENV_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+const HANDLE_REFERENCE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const SECRET_LIKE = /^(?:sk|pk|rk|sess|tok|token|key|secret)[_-]/iu;
+const EMBEDDED_SECRET = /(?:^|\s)(?:bearer|basic)\s+|(?:https?|data):|=/iu;
+
+function rawText(value) {
+  if (typeof value === 'string') return value.trim() || null;
+  if (value && typeof value === 'object') {
+    const candidate = value.name_or_handle ?? value.name ?? value.reference;
+    return typeof candidate === 'string' ? candidate.trim() || null : null;
+  }
+  return null;
+}
+
+/**
+ * Classify a reference without returning an unsafe value. `kind: env` is the
+ * common apiKeyEnv form; non-env stores may use a bounded opaque handle.
+ */
+export function classifyCredentialReference(value, { kind = 'env' } = {}) {
+  const raw = rawText(value);
+  if (!raw) return { present: false, value: null, redacted: false };
+  const normalizedKind = typeof kind === 'string' ? kind.trim().toLowerCase() : 'env';
+  const valid = normalizedKind === 'env'
+    ? ENV_REFERENCE.test(raw) && !SECRET_LIKE.test(raw) && !EMBEDDED_SECRET.test(raw)
+    : HANDLE_REFERENCE.test(raw) && !SECRET_LIKE.test(raw) && !EMBEDDED_SECRET.test(raw);
+  return { present: true, value: valid ? raw : null, redacted: !valid };
+}
+
+export function sanitizeCredentialReference(value, options = {}) {
+  return classifyCredentialReference(value, options).value;
+}
+
+export function hasCredentialReference(value, options = {}) {
+  return classifyCredentialReference(value, options).present;
+}