@rezti/dsh-rez-suite 0.1.4 → 0.1.6

package/src/client/panel/panel.module.css

@@ -1,117 +1,89 @@
 /**
- * dsh-rez-suite panel styles. Scoped by plugin data attributes, colors ride
- * dsh --dsw-* tokens. The center-column takeover rules are attribute-scoped
- * and must stay in this stylesheet (imported by mount.tsx).
+ * Settings-native styles for the ReZ card/tab. Colors ride dsh --dsw-* tokens
+ * so the form matches 设置 → 插件. The stylesheet is inlined into client.js
+ * at wrap time — dsh only loads the JS module, not lib/style.css.
  */
 
-[data-pane='conversation'] {
-  position: relative;
+.shell {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  min-width: 0;
 }
 
-[data-dsh-rez-view] {
-  position: absolute;
-  inset: 0;
-  display: none;
-  z-index: 60;
-  background: var(--dsw-alias-bg-base);
+.card {
+  list-style: none;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 12px;
+  background: var(--dsw-alias-bg-layer-3);
+  transition: border-color 0.16s, background 0.16s;
 }
 
-html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [data-dsh-rez-view] {
-  display: block;
+.card:hover {
+  border-color: var(--dsw-alias-label-dimmed);
 }
 
-html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [data-pane='conversation'] > :not([data-dsh-rez-view]),
-html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [class*='centerCol'] > :not([data-dsh-rez-view]) {
-  display: none !important;
+.cardOpen {
+  background: var(--dsw-alias-bg-layer-2);
+  border-color: var(--dsw-alias-label-dimmed);
 }
 
-.entry {
-  display: flex;
-  align-items: center;
-  gap: 8px;
+.header {
   width: 100%;
-  height: 32px;
-  padding: 0 12px;
-  background: transparent;
-  border: none;
-  border-radius: 8px;
-  color: var(--dsw-alias-label-secondary);
+  appearance: none;
+  border: 0;
+  background: none;
+  font: inherit;
+  color: inherit;
+  text-align: left;
   cursor: pointer;
-  font-size: 13px;
-  white-space: nowrap;
-}
-
-.entry:hover {
-  background: var(--dsw-specific-sidebar-nav-item-hover);
-  color: var(--dsw-alias-label-primary);
-}
-
-.entryIcon {
-  display: inline-flex;
+  display: flex;
   align-items: center;
-  justify-content: center;
-  flex: none;
-}
-
-.entryLabel {
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-[data-dsh-frame][data-sidebar-collapsed] .entry {
-  justify-content: center;
-  padding: 0;
-  width: 100%;
-}
-
-[data-dsh-frame][data-sidebar-collapsed] .entryLabel {
-  display: none;
+  gap: 12px;
+  padding: 14px 16px;
+  border-radius: 12px;
 }
 
-.view {
-  overflow: hidden;
+.header:focus-visible {
+  outline: 2px solid var(--dsw-alias-brand-primary);
+  outline-offset: -2px;
 }
 
-.panel {
+.headText {
+  flex: 1;
+  min-width: 0;
   display: flex;
   flex-direction: column;
-  height: 100%;
-  min-width: 0;
-  min-height: 0;
-  padding: 14px 16px 16px;
-  gap: 10px;
-  background: var(--dsw-alias-bg-base);
+  gap: 4px;
+}
+
+.name {
+  font-size: 15px;
+  font-weight: 600;
+  line-height: 1.4;
   color: var(--dsw-alias-label-primary);
-  font-family: var(--dsw-font-family);
 }
 
-.panelHeader {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  flex: none;
+.description {
+  font-size: 13px;
+  line-height: 1.5;
+  color: var(--dsw-alias-label-tertiary);
 }
 
-.panelTitle {
-  margin: 0;
-  flex: 1;
-  font-size: 16px;
-  font-weight: 700;
+.chevron {
+  flex: none;
+  color: var(--dsw-alias-label-tertiary);
+  transition: transform 0.16s;
 }
 
-.iconButton {
-  border: none;
-  background: transparent;
-  color: var(--dsw-alias-label-secondary);
-  cursor: pointer;
-  font-size: 14px;
-  padding: 4px 8px;
-  border-radius: 6px;
+.chevronOpen {
+  transform: rotate(180deg);
 }
 
-.iconButton:hover {
-  background: var(--dsw-alias-interactive-bg-hover);
-  color: var(--dsw-alias-label-primary);
+.body {
+  border-top: 1px solid var(--dsw-alias-border-l2);
+  margin: 0 16px 12px;
+  padding-top: 8px;
 }
 
 .tabBar {
@@ -143,21 +115,12 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
   border-bottom-color: var(--dsw-alias-state-business-primary);
 }
 
-.panelContent {
-  flex: 1;
-  min-height: 0;
-  display: flex;
-  flex-direction: column;
-  overflow: hidden;
-}
-
 .tabBody {
   display: flex;
   flex-direction: column;
   gap: 12px;
-  flex: 1;
-  min-height: 0;
-  overflow-y: auto;
+  padding: 12px 0 4px;
+  min-width: 0;
 }
 
 .section {
@@ -174,13 +137,14 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
   margin: 0;
   font-size: 13px;
   font-weight: 600;
+  color: var(--dsw-alias-label-primary);
 }
 
 .field {
-  display: grid;
-  grid-template-columns: 140px 1fr;
-  gap: 8px;
-  align-items: center;
+  display: flex;
+  flex-direction: column;
+  align-items: stretch;
+  gap: 4px;
 }
 
 .label {
@@ -188,11 +152,12 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
   color: var(--dsw-alias-label-secondary);
 }
 
-.input, .select {
+.input,
+.select {
   padding: 6px 8px;
   font-size: 13px;
   color: var(--dsw-alias-label-primary);
-  background: var(--dsw-specific-input-major);
+  background: var(--dsw-specific-input-major, var(--dsw-alias-bg-layer-3));
   border: 1px solid var(--dsw-alias-border-l2);
   border-radius: 8px;
   outline: none;
@@ -217,28 +182,24 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
   font-size: 13px;
   border-radius: 8px;
   border: 1px solid var(--dsw-alias-border-l2);
-  background: var(--dsw-specific-input-major);
+  background: var(--dsw-specific-input-major, var(--dsw-alias-bg-layer-3));
   color: var(--dsw-alias-label-primary);
   cursor: pointer;
 }
 
-.button:hover {
+.button:hover:not(:disabled) {
   background: var(--dsw-alias-interactive-bg-hover);
 }
 
-.qr {
-  display: block;
-  width: 240px;
-  height: 240px;
-  margin: 8px 0;
-  background: #fff;
-  border-radius: 8px;
+.button:disabled {
+  opacity: 0.4;
+  cursor: default;
 }
 
 .primaryButton {
-  background: var(--dsw-alias-state-business-primary);
-  border-color: var(--dsw-alias-state-business-primary);
-  color: #fff;
+  background: var(--dsw-alias-label-primary);
+  border-color: var(--dsw-alias-label-primary);
+  color: var(--dsw-alias-bg-layer-3);
 }
 
 .dangerButton {
@@ -247,8 +208,19 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
   color: #fff;
 }
 
+.qr {
+  display: block;
+  width: 200px;
+  height: 200px;
+  margin: 8px 0;
+  background: #fff;
+  border-radius: 8px;
+}
+
 .message {
+  margin: 0;
   font-size: 12.5px;
+  line-height: 1.5;
   color: var(--dsw-alias-label-secondary);
 }
 
@@ -257,8 +229,6 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
 }
 
 .tableWrap {
-  flex: 1;
-  min-height: 0;
   overflow: auto;
   border: 1px solid var(--dsw-alias-border-l1);
   border-radius: 10px;
@@ -304,11 +274,11 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
 
 .cards {
   display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(160px, 1fr));
+  grid-template-columns: repeat(auto-fill, minmax(140px, 1fr));
   gap: 8px;
 }
 
-.card {
+.stat {
   padding: 10px;
   border: 1px solid var(--dsw-alias-border-l1);
   border-radius: 10px;
@@ -322,4 +292,5 @@ html[data-dsh-rez-active]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-act
 .cardValue {
   font-size: 15px;
   font-weight: 600;
+  color: var(--dsw-alias-label-primary);
 }

package/src/client/settings-card.tsx

@@ -0,0 +1,68 @@
+/**
+ * ReZ settings pages: one accordion card in 设置 → 插件 → 插件配置,
+ * plus a dedicated Plugins tab for the same content.
+ */
+
+import { useMemo, useState } from 'react'
+import { RezApi } from './api.ts'
+import { tt } from './panel/helpers.ts'
+import { AuditTab } from './panel/AuditTab.tsx'
+import { ConfigTab } from './panel/ConfigTab.tsx'
+import { StatusTab } from './panel/StatusTab.tsx'
+import { WeixinTab } from './panel/WeixinTab.tsx'
+import css from './panel/panel.module.css'
+
+export type RezTab = 'config' | 'weixin' | 'status' | 'audit'
+
+const TABS: ReadonlyArray<{ id: RezTab; label: () => string }> = [
+  { id: 'config', label: () => tt('tab.config') },
+  { id: 'weixin', label: () => tt('tab.weixin') },
+  { id: 'status', label: () => tt('tab.status') },
+  { id: 'audit', label: () => tt('tab.audit') },
+]
+
+export function RezSettingsPage() {
+  const api = useMemo(() => new RezApi(), [])
+  const [activeTab, setActiveTab] = useState<RezTab>('config')
+  return (
+    <div className={css.shell}>
+      <div className={css.tabBar} role="tablist">
+        {TABS.map(tab => (
+          <button
+            key={tab.id}
+            type="button"
+            role="tab"
+            aria-selected={activeTab === tab.id}
+            data-active={activeTab === tab.id ? '' : undefined}
+            className={css.tab}
+            onClick={() => { setActiveTab(tab.id) }}
+          >
+            {tab.label()}
+          </button>
+        ))}
+      </div>
+      {activeTab === 'config' && <ConfigTab api={api} />}
+      {activeTab === 'weixin' && <WeixinTab api={api} />}
+      {activeTab === 'status' && <StatusTab api={api} />}
+      {activeTab === 'audit' && <AuditTab api={api} />}
+    </div>
+  )
+}
+
+export function RezPluginCard() {
+  const [open, setOpen] = useState(false)
+  return (
+    <li className={css.card + (open ? ' ' + css.cardOpen : '')}>
+      <button type="button" className={css.header} onClick={() => { setOpen(!open) }}>
+        <div className={css.headText}>
+          <div className={css.name}>{tt('settings.title')}</div>
+          <div className={css.description}>{tt('settings.description')}</div>
+        </div>
+        <svg className={css.chevron + (open ? ' ' + css.chevronOpen : '')} viewBox="0 0 14 14" width="14" height="14" aria-hidden="true">
+          <path d="M3 5l4 4 4-4" fill="none" stroke="currentColor" strokeWidth="1.4" strokeLinecap="round" strokeLinejoin="round" />
+        </svg>
+      </button>
+      {open ? <div className={css.body}><RezSettingsPage /></div> : null}
+    </li>
+  )
+}

package/src/index.ts

@@ -2,9 +2,9 @@
  * dsh-rez-suite — employee-facing host half.
  *
  * MCP connections are owned by official @deepseek-ai/dsh-mcp-client rows in
- * this package's cordis.patch.yml. This plugin only mounts the Rez panel,
- * loopback settings API, and a short system-prompt announcement. Do not
- * start a second MCP host here.
+ * this package's cordis.patch.yml. This plugin only mounts the loopback
+ * settings API, a Settings → Plugins card, and a short system-prompt
+ * announcement. Do not start a second MCP host here.
  */
 
 import type { Context } from '@deepseek-ai/cordis'
@@ -15,6 +15,7 @@ import z from '@deepseek-ai/schemastery'
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 import type {} from '@deepseek-ai/dsh-tools'
+import { REZ_CREDENTIAL_REFS, REZ_DEFAULT_CONNECTIONS, secretConfigured } from '@rezti/dsh-rez-sso'
 import type { McpHost } from './mcp-host.ts'
 import { makeRoutes } from './routes.ts'
 import { defaultConfig, mergeConfig, saveConfig } from './store.ts'
@@ -45,6 +46,24 @@ export const Config: z<RezConfig> = z.object({
   announceToAgent: z.boolean().default(true),
   role: z.union(['engineer', 'sales', 'operations', 'all'] as const).default('all'),
   servers: z.dict(serverSchema).default({}),
+  connections: z.object({
+    odoo: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.odoo.url),
+    }).default(REZ_DEFAULT_CONNECTIONS.odoo),
+    nextcloud: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.url),
+      username: z.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.username),
+    }).default(REZ_DEFAULT_CONNECTIONS.nextcloud),
+    wechat: z.object({
+      enabled: z.boolean().default(true),
+    }).default(REZ_DEFAULT_CONNECTIONS.wechat),
+    homeassistant: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.homeassistant.url),
+    }).default(REZ_DEFAULT_CONNECTIONS.homeassistant),
+  }).default(REZ_DEFAULT_CONNECTIONS),
   billing: z.object({
     inputCostPer1k: z.number().default(0.001),
     outputCostPer1k: z.number().default(0.002),
@@ -60,7 +79,7 @@ export const REZ_GUIDANCE = [
   '本机已安装 ReZ-TI 套件（一次安装）：工作身份由 dsh-rez-sso 提供，MCP 由官方 dsh-mcp-client 接入 Odoo / Nextcloud / 企业微信 / Home Assistant。',
   '工具名 mcp__odoo__*、mcp__nextcloud__*、mcp__wechat__*、mcp__homeassistant__*。',
   '密钥：REZ_ODOO_TOKEN、REZ_NEXTCLOUD_PASSWORD、REZ_WECHAT_WEBHOOK、REZ_HA_TOKEN。',
-  '个人微信（QClaw/ClawBot）：打开 Rez 面板「微信」页扫码，然后直接在微信里说话，不必再跑命令、也不要调用微信 MCP 工具。',
+  '个人微信（QClaw/ClawBot）：打开 设置 → 插件 → ReZ-TI → 微信 扫码，然后直接在微信里说话，不必再跑命令、也不要调用微信 MCP 工具。',
   '意图用 rez_set_intent（erp/files/chat/home/auto）。审计用 rez_audit。',
   '涉及资金、对外发送、设备控制、生产写入时先征得用户批准。',
 ].join('')
@@ -73,16 +92,19 @@ function delegatedHost(): McpHost {
   const status = (): RezServerStatus[] => COMPOSED_SERVERS.map(server => ({
     server,
     enabled: true,
-    state: 'disconnected',
+    state: 'disconnected' as const,
     toolCount: 0,
     registeredTools: 0,
-    lastError: 'owned by @deepseek-ai/dsh-mcp-client',
-  }))
-  const test = async (): Promise<RezTestResult[]> => COMPOSED_SERVERS.map(server => ({
-    server,
-    ok: false,
-    error: 'MCP is composed by dsh-mcp-client; set REZ_* credentials and check dsh logs',
+    lastError: secretConfigured(server)
+      ? 'owned by @deepseek-ai/dsh-mcp-client'
+      : 'missing ' + REZ_CREDENTIAL_REFS[server],
   }))
+  const test = async (): Promise<RezTestResult[]> => COMPOSED_SERVERS.map(server => {
+    const ok = secretConfigured(server)
+    return ok
+      ? { server, ok: true, serverInfo: REZ_CREDENTIAL_REFS[server] + ' configured' }
+      : { server, ok: false, error: 'missing ' + REZ_CREDENTIAL_REFS[server] }
+  })
   return {
     status,
     test,
@@ -119,6 +141,10 @@ export function apply(ctx: Context, config?: RezConfig): void {
     },
     host,
     tokens,
+    onCredentialWritten: (ref) => {
+      const emit = ctx.emit as unknown as (event: string, value: string) => void
+      emit('credentials/updated', ref)
+    },
   })
 
   let disposeRoutes: (() => void) | undefined

package/src/protocol.ts

@@ -35,12 +35,29 @@ export interface RezMcpServerSpec {
   toolCallTimeoutMs?: number
 }
 
+/** Company MCP endpoints persisted under ~/.dsh/dsh-rez-suite.json. Secrets are not stored here. */
+export interface RezConnections {
+  odoo: { enabled: boolean; url: string }
+  nextcloud: { enabled: boolean; url: string; username: string }
+  wechat: { enabled: boolean }
+  homeassistant: { enabled: boolean; url: string }
+}
+
+export interface RezPublicConnection {
+  enabled: boolean
+  url?: string
+  username?: string
+  secretConfigured: boolean
+  secretRef: string
+}
+
 /** Full plugin configuration persisted under ~/.dsh/dsh-rez-suite.json. */
 export interface RezConfig {
   enabled: boolean
   announceToAgent: boolean
   role: RezRoleId
   servers: Record<string, RezMcpServerSpec>
+  connections: RezConnections
   billing: {
     inputCostPer1k: number
     outputCostPer1k: number
@@ -56,6 +73,12 @@ export interface RezPublicConfig {
   enabled: boolean
   role: RezRoleId
   servers: Record<string, RezPublicServer>
+  connections: {
+    odoo: RezPublicConnection
+    nextcloud: RezPublicConnection
+    wechat: RezPublicConnection
+    homeassistant: RezPublicConnection
+  }
   billing: { inputCostPer1k: number; outputCostPer1k: number; monthlyBudget: number }
 }
 

package/src/routes.ts

@@ -6,6 +6,13 @@
 
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
+import {
+  REZ_CREDENTIAL_REFS,
+  REZ_SYSTEMS,
+  mergeConnections,
+  writeManagedCredential,
+  type RezSystem,
+} from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezMcpServerSpec, RezRoleId } from './protocol.ts'
 import { REZ_API } from './protocol.ts'
 import type { McpHost } from './mcp-host.ts'
@@ -74,11 +81,25 @@ function mergeMaskedRecord(base: Record<string, string> | undefined, incoming: u
 }
 
 /** Apply a browser-safe public patch without overwriting masked secrets. */
-function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): RezConfig {
+function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): { next: RezConfig; secrets: Array<{ system: RezSystem; value: string }> } {
   const next: RezConfig = JSON.parse(JSON.stringify(current)) as RezConfig
+  const secrets: Array<{ system: RezSystem; value: string }> = []
   if (typeof patch.enabled === 'boolean') next.enabled = patch.enabled
   if (patch.role === 'engineer' || patch.role === 'sales' || patch.role === 'operations' || patch.role === 'all') next.role = patch.role as RezRoleId
 
+  if (typeof patch.connections === 'object' && patch.connections !== null) {
+    const incoming = patch.connections as Record<string, unknown>
+    next.connections = mergeConnections({ ...next.connections, ...incoming })
+    for (const system of Object.keys(REZ_CREDENTIAL_REFS) as RezSystem[]) {
+      const row = incoming[system]
+      if (typeof row !== 'object' || row === null) continue
+      const secret = (row as { secret?: unknown }).secret
+      if (typeof secret === 'string' && secret.length > 0 && secret !== SECRET_MASK) {
+        secrets.push({ system, value: secret })
+      }
+    }
+  }
+
   if (typeof patch.servers === 'object' && patch.servers !== null) {
     for (const [id, raw] of Object.entries(patch.servers as Record<string, unknown>)) {
       if (typeof raw !== 'object' || raw === null) continue
@@ -104,7 +125,7 @@ function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): R
     if (typeof value.outputCostPer1k === 'number') next.billing.outputCostPer1k = value.outputCostPer1k
     if (typeof value.monthlyBudget === 'number') next.billing.monthlyBudget = value.monthlyBudget
   }
-  return next
+  return { next, secrets }
 }
 
 export interface RezRoutesDeps {
@@ -113,11 +134,12 @@ export interface RezRoutesDeps {
   updateConfig: (next: RezConfig) => Promise<RezConfig>
   host: McpHost
   tokens: TokenManager
+  onCredentialWritten?: (ref: string) => void
 }
 
 /** Build every /api/dsh-rez-suite route (exact paths). */
 export function makeRoutes(deps: RezRoutesDeps): WebRoute[] {
-  const { getConfig, updateConfig, host, tokens } = deps
+  const { getConfig, updateConfig, host, tokens, onCredentialWritten } = deps
 
   const guard = (req: IncomingMessage, res: ServerResponse, method: string): boolean => {
     if (!isLoopbackRequest(req)) {
@@ -146,8 +168,14 @@ export function makeRoutes(deps: RezRoutesDeps): WebRoute[] {
           writeJson(res, 400, { error: 'invalid JSON body' })
           return
         }
-        const next = applyPublicPatch(getConfig(), body)
+        const { next, secrets } = applyPublicPatch(getConfig(), body)
         const saved = await updateConfig(next)
+        for (const item of secrets) {
+          writeManagedCredential(REZ_CREDENTIAL_REFS[item.system], item.value)
+        }
+        for (const system of REZ_SYSTEMS) {
+          onCredentialWritten?.(REZ_CREDENTIAL_REFS[system])
+        }
         writeJson(res, 200, { config: publicConfig(saved) })
       },
     },

package/src/store.ts

@@ -8,6 +8,12 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
+import {
+  REZ_CREDENTIAL_REFS,
+  REZ_DEFAULT_CONNECTIONS,
+  mergeConnections,
+  secretConfigured,
+} from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezMcpServerSpec, RezPublicConfig } from './protocol.ts'
 
 /** File format version. */
@@ -36,13 +42,14 @@ export function expandHome(path: string): string {
   return resolve(path)
 }
 
-/** Defaults: panel-only. Company MCP rows live in cordis.patch.yml. */
+/** Defaults: company MCP endpoints. Secrets live in credentials.yaml / env. */
 export function defaultConfig(): RezConfig {
   return {
     enabled: true,
     announceToAgent: true,
     role: 'all',
     servers: {},
+    connections: JSON.parse(JSON.stringify(REZ_DEFAULT_CONNECTIONS)) as RezConfig['connections'],
     billing: {
       inputCostPer1k: 0.001,
       outputCostPer1k: 0.002,
@@ -74,10 +81,37 @@ export function publicConfig(config: RezConfig): RezPublicConfig {
   for (const [id, server] of Object.entries(config.servers)) {
     servers[id] = maskServer(server)
   }
+  const connections = mergeConnections(config.connections)
   return {
     enabled: config.enabled,
     role: config.role,
     servers,
+    connections: {
+      odoo: {
+        enabled: connections.odoo.enabled,
+        url: connections.odoo.url,
+        secretConfigured: secretConfigured('odoo'),
+        secretRef: REZ_CREDENTIAL_REFS.odoo,
+      },
+      nextcloud: {
+        enabled: connections.nextcloud.enabled,
+        url: connections.nextcloud.url,
+        username: connections.nextcloud.username,
+        secretConfigured: secretConfigured('nextcloud'),
+        secretRef: REZ_CREDENTIAL_REFS.nextcloud,
+      },
+      wechat: {
+        enabled: connections.wechat.enabled,
+        secretConfigured: secretConfigured('wechat'),
+        secretRef: REZ_CREDENTIAL_REFS.wechat,
+      },
+      homeassistant: {
+        enabled: connections.homeassistant.enabled,
+        url: connections.homeassistant.url,
+        secretConfigured: secretConfigured('homeassistant'),
+        secretRef: REZ_CREDENTIAL_REFS.homeassistant,
+      },
+    },
     billing: { ...config.billing },
   }
 }
@@ -96,6 +130,8 @@ export function mergeConfig(base: RezConfig, override: unknown): RezConfig {
   if (typeof value.announceToAgent === 'boolean') result.announceToAgent = value.announceToAgent
   if (value.role === 'engineer' || value.role === 'sales' || value.role === 'operations' || value.role === 'all') result.role = value.role
 
+  result.connections = mergeConnections(value.connections ?? result.connections)
+
   if (typeof value.servers === 'object' && value.servers !== null) {
     for (const [id, raw] of Object.entries(value.servers as Record<string, unknown>)) {
       if (typeof raw !== 'object' || raw === null) continue