@rezti/dsh-rez-suite 0.1.5 → 0.1.6

package/lib/index.js

@@ -1,6 +1,7 @@
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { REZ_CREDENTIAL_REFS, REZ_DEFAULT_CONNECTIONS, REZ_SYSTEMS, mergeConnections, secretConfigured, writeManagedCredential } from "@rezti/dsh-rez-sso";
 import { mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { DatabaseSync } from "node:sqlite";
 //#region ../../node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.2/node_modules/@deepseek-ai/cosmokit/lib/index.js
@@ -2865,13 +2866,14 @@ const FORMAT_VERSION = 1;
 function rezStorePath() {
 	return join(homedir(), ".dsh", "dsh-rez-suite.json");
 }
-/** Defaults: panel-only. Company MCP rows live in cordis.patch.yml. */
+/** Defaults: company MCP endpoints. Secrets live in credentials.yaml / env. */
 function defaultConfig() {
 	return {
 		enabled: true,
 		announceToAgent: true,
 		role: "all",
 		servers: {},
+		connections: JSON.parse(JSON.stringify(REZ_DEFAULT_CONNECTIONS)),
 		billing: {
 			inputCostPer1k: .001,
 			outputCostPer1k: .002,
@@ -2896,10 +2898,37 @@ function maskServer(server) {
 function publicConfig(config) {
 	const servers = {};
 	for (const [id, server] of Object.entries(config.servers)) servers[id] = maskServer(server);
+	const connections = mergeConnections(config.connections);
 	return {
 		enabled: config.enabled,
 		role: config.role,
 		servers,
+		connections: {
+			odoo: {
+				enabled: connections.odoo.enabled,
+				url: connections.odoo.url,
+				secretConfigured: secretConfigured("odoo"),
+				secretRef: REZ_CREDENTIAL_REFS.odoo
+			},
+			nextcloud: {
+				enabled: connections.nextcloud.enabled,
+				url: connections.nextcloud.url,
+				username: connections.nextcloud.username,
+				secretConfigured: secretConfigured("nextcloud"),
+				secretRef: REZ_CREDENTIAL_REFS.nextcloud
+			},
+			wechat: {
+				enabled: connections.wechat.enabled,
+				secretConfigured: secretConfigured("wechat"),
+				secretRef: REZ_CREDENTIAL_REFS.wechat
+			},
+			homeassistant: {
+				enabled: connections.homeassistant.enabled,
+				url: connections.homeassistant.url,
+				secretConfigured: secretConfigured("homeassistant"),
+				secretRef: REZ_CREDENTIAL_REFS.homeassistant
+			}
+		},
 		billing: { ...config.billing }
 	};
 }
@@ -2911,6 +2940,7 @@ function mergeConfig(base, override) {
 	if (typeof value.enabled === "boolean") result.enabled = value.enabled;
 	if (typeof value.announceToAgent === "boolean") result.announceToAgent = value.announceToAgent;
 	if (value.role === "engineer" || value.role === "sales" || value.role === "operations" || value.role === "all") result.role = value.role;
+	result.connections = mergeConnections(value.connections ?? result.connections);
 	if (typeof value.servers === "object" && value.servers !== null) for (const [id, raw] of Object.entries(value.servers)) {
 		if (typeof raw !== "object" || raw === null) continue;
 		const incoming = raw;
@@ -3019,8 +3049,25 @@ function mergeMaskedRecord(base, incoming) {
 /** Apply a browser-safe public patch without overwriting masked secrets. */
 function applyPublicPatch(current, patch) {
 	const next = JSON.parse(JSON.stringify(current));
+	const secrets = [];
 	if (typeof patch.enabled === "boolean") next.enabled = patch.enabled;
 	if (patch.role === "engineer" || patch.role === "sales" || patch.role === "operations" || patch.role === "all") next.role = patch.role;
+	if (typeof patch.connections === "object" && patch.connections !== null) {
+		const incoming = patch.connections;
+		next.connections = mergeConnections({
+			...next.connections,
+			...incoming
+		});
+		for (const system of Object.keys(REZ_CREDENTIAL_REFS)) {
+			const row = incoming[system];
+			if (typeof row !== "object" || row === null) continue;
+			const secret = row.secret;
+			if (typeof secret === "string" && secret.length > 0 && secret !== SECRET_MASK) secrets.push({
+				system,
+				value: secret
+			});
+		}
+	}
 	if (typeof patch.servers === "object" && patch.servers !== null) for (const [id, raw] of Object.entries(patch.servers)) {
 		if (typeof raw !== "object" || raw === null) continue;
 		const incoming = raw;
@@ -3046,11 +3093,14 @@ function applyPublicPatch(current, patch) {
 		if (typeof value.outputCostPer1k === "number") next.billing.outputCostPer1k = value.outputCostPer1k;
 		if (typeof value.monthlyBudget === "number") next.billing.monthlyBudget = value.monthlyBudget;
 	}
-	return next;
+	return {
+		next,
+		secrets
+	};
 }
 /** Build every /api/dsh-rez-suite route (exact paths). */
 function makeRoutes(deps) {
-	const { getConfig, updateConfig, host, tokens } = deps;
+	const { getConfig, updateConfig, host, tokens, onCredentialWritten } = deps;
 	const guard = (req, res, method) => {
 		if (!isLoopbackRequest(req)) {
 			writeJson(res, 403, { error: "forbidden: loopback-only" });
@@ -3077,8 +3127,11 @@ function makeRoutes(deps) {
 					writeJson(res, 400, { error: "invalid JSON body" });
 					return;
 				}
-				const next = applyPublicPatch(getConfig(), body);
-				writeJson(res, 200, { config: publicConfig(await updateConfig(next)) });
+				const { next, secrets } = applyPublicPatch(getConfig(), body);
+				const saved = await updateConfig(next);
+				for (const item of secrets) writeManagedCredential(REZ_CREDENTIAL_REFS[item.system], item.value);
+				for (const system of REZ_SYSTEMS) onCredentialWritten?.(REZ_CREDENTIAL_REFS[system]);
+				writeJson(res, 200, { config: publicConfig(saved) });
 			}
 		},
 		{
@@ -7537,6 +7590,22 @@ const Config = Schema.object({
 		"all"
 	]).default("all"),
 	servers: Schema.dict(serverSchema).default({}),
+	connections: Schema.object({
+		odoo: Schema.object({
+			enabled: Schema.boolean().default(true),
+			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.odoo.url)
+		}).default(REZ_DEFAULT_CONNECTIONS.odoo),
+		nextcloud: Schema.object({
+			enabled: Schema.boolean().default(true),
+			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.url),
+			username: Schema.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.username)
+		}).default(REZ_DEFAULT_CONNECTIONS.nextcloud),
+		wechat: Schema.object({ enabled: Schema.boolean().default(true) }).default(REZ_DEFAULT_CONNECTIONS.wechat),
+		homeassistant: Schema.object({
+			enabled: Schema.boolean().default(true),
+			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.homeassistant.url)
+		}).default(REZ_DEFAULT_CONNECTIONS.homeassistant)
+	}).default(REZ_DEFAULT_CONNECTIONS),
 	billing: Schema.object({
 		inputCostPer1k: Schema.number().default(.001),
 		outputCostPer1k: Schema.number().default(.002),
@@ -7572,13 +7641,19 @@ function delegatedHost() {
 		state: "disconnected",
 		toolCount: 0,
 		registeredTools: 0,
-		lastError: "owned by @deepseek-ai/dsh-mcp-client"
-	}));
-	const test = async () => COMPOSED_SERVERS.map((server) => ({
-		server,
-		ok: false,
-		error: "MCP is composed by dsh-mcp-client; set REZ_* credentials and check dsh logs"
+		lastError: secretConfigured(server) ? "owned by @deepseek-ai/dsh-mcp-client" : "missing " + REZ_CREDENTIAL_REFS[server]
 	}));
+	const test = async () => COMPOSED_SERVERS.map((server) => {
+		return secretConfigured(server) ? {
+			server,
+			ok: true,
+			serverInfo: REZ_CREDENTIAL_REFS[server] + " configured"
+		} : {
+			server,
+			ok: false,
+			error: "missing " + REZ_CREDENTIAL_REFS[server]
+		};
+	});
 	return {
 		status,
 		test,
@@ -7609,7 +7684,11 @@ function apply(ctx, config) {
 			return value;
 		},
 		host,
-		tokens
+		tokens,
+		onCredentialWritten: (ref) => {
+			const emit = ctx.emit;
+			emit("credentials/updated", ref);
+		}
 	});
 	let disposeRoutes;
 	let disposeTools;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rezti/dsh-rez-suite",
   "description": "ReZ-TI employee plugin for DeepSeek Harness: one install enables company MCP (Odoo / Nextcloud / WeCom / Weixin-ClawBot / Home Assistant) and work identity.",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -38,13 +38,13 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3",
-    "@rezti/dsh-rez-ha-bridge": "0.1.4",
-    "@rezti/dsh-rez-sso": "0.1.4",
-    "@rezti/dsh-rez-nextcloud": "0.1.4",
-    "@rezti/dsh-rez-intent": "0.1.3",
-    "@rezti/dsh-rez-odoo": "0.1.4",
+    "@rezti/dsh-rez-nextcloud": "0.1.5",
+    "@rezti/dsh-rez-odoo": "0.1.5",
+    "@rezti/dsh-rez-sso": "0.1.5",
+    "@rezti/dsh-rez-ha-bridge": "0.1.5",
+    "@rezti/dsh-rez-wechat": "0.1.5",
     "@rezti/dsh-rez-token-manager": "0.1.3",
-    "@rezti/dsh-rez-wechat": "0.1.4"
+    "@rezti/dsh-rez-intent": "0.1.3"
   },
   "peerDependencies": {
     "react": "^18.2.0",

package/src/client/locales.ts

@@ -27,16 +27,23 @@ export const zh = {
   'config.env': '环境变量 (JSON)',
   'config.headers': 'Headers (JSON)',
   'config.jsonInvalid': 'JSON 格式错误：{error}',
+  'config.mcpHint': '四个公司 MCP 在这里配。密钥写入 ~/.dsh/.credentials.yaml（REZ_*）。新填的密钥会立刻拉起连接；改 URL 后如果已经连上，需要重启 dsh web。',
+  'config.secretConfigured': '已配置（留空则保持）',
+  'config.secretMissing': '未配置',
   'config.odoo': 'Odoo',
-  'config.odoo.url': 'Odoo URL',
-  'config.odoo.apiKey': 'API Key',
+  'config.odoo.url': 'Odoo MCP URL',
+  'config.odoo.apiKey': 'API Token',
   'config.nextcloud': 'Nextcloud',
-  'config.nextcloud.url': 'Nextcloud URL',
+  'config.nextcloud.url': 'Nextcloud 主机',
   'config.nextcloud.username': '用户名',
   'config.nextcloud.appPassword': 'App Password',
   'config.wecom': '企业微信',
   'config.wecom.botId': 'Bot ID',
   'config.wecom.secret': 'Secret',
+  'config.wecom.webhook': '群机器人 Webhook',
+  'config.ha': 'Home Assistant',
+  'config.ha.url': 'HA MCP URL',
+  'config.ha.token': '长期访问令牌',
   'config.fs': '本地文件 (fs-mcp-server)',
   'config.fs.root': '根目录',
   'config.sqlite': 'SQLite (sqlite-mcp-server)',
@@ -122,16 +129,23 @@ export const en: Record<RezKey, string> = {
   'config.env': 'Env vars (JSON)',
   'config.headers': 'Headers (JSON)',
   'config.jsonInvalid': 'Invalid JSON: {error}',
+  'config.mcpHint': 'Company MCP lives here. Secrets go to ~/.dsh/.credentials.yaml (REZ_*). A newly saved secret starts the connection immediately; URL changes after a live connection need a dsh web restart.',
+  'config.secretConfigured': 'Configured (leave blank to keep)',
+  'config.secretMissing': 'Not configured',
   'config.odoo': 'Odoo',
-  'config.odoo.url': 'Odoo URL',
-  'config.odoo.apiKey': 'API Key',
+  'config.odoo.url': 'Odoo MCP URL',
+  'config.odoo.apiKey': 'API token',
   'config.nextcloud': 'Nextcloud',
-  'config.nextcloud.url': 'Nextcloud URL',
+  'config.nextcloud.url': 'Nextcloud host',
   'config.nextcloud.username': 'Username',
-  'config.nextcloud.appPassword': 'App Password',
+  'config.nextcloud.appPassword': 'App password',
   'config.wecom': 'WeCom',
   'config.wecom.botId': 'Bot ID',
   'config.wecom.secret': 'Secret',
+  'config.wecom.webhook': 'Group bot webhook',
+  'config.ha': 'Home Assistant',
+  'config.ha.url': 'HA MCP URL',
+  'config.ha.token': 'Long-lived access token',
   'config.fs': 'Local files (fs-mcp-server)',
   'config.fs.root': 'Root directory',
   'config.sqlite': 'SQLite (sqlite-mcp-server)',

package/src/client/panel/ConfigTab.tsx

@@ -1,11 +1,11 @@
 /**
- * Config tab: role, billing rates, and a generic editor for every MCP server
- * in config.servers (stdio and streamable-http), with one-click tests.
+ * Config tab: company MCP connections (Odoo / Nextcloud / WeCom / HA),
+ * role, and billing. Secrets are write-only and land in credentials.yaml.
  */
 
 import { useEffect, useState, type ReactNode } from 'react'
 import type { RezApi } from '../api.ts'
-import type { RezMcpServerSpec, RezPublicConfig, RezRoleId, RezTestResult } from '../../protocol.ts'
+import type { RezPublicConfig, RezPublicConnection, RezRoleId, RezTestResult } from '../../protocol.ts'
 import { errorMessage, tt } from './helpers.ts'
 import css from './panel.module.css'
 
@@ -16,6 +16,15 @@ const ROLES: Array<{ value: RezRoleId; label: string }> = [
   { value: 'operations', label: 'role.operations' },
 ]
 
+type SecretDrafts = {
+  odoo: string
+  nextcloud: string
+  wechat: string
+  homeassistant: string
+}
+
+const EMPTY_SECRETS: SecretDrafts = { odoo: '', nextcloud: '', wechat: '', homeassistant: '' }
+
 function Field({ label, children }: { label: string; children: ReactNode }) {
   return (
     <div className={css.field}>
@@ -34,47 +43,88 @@ function Section({ title, children }: { title: string; children: ReactNode }) {
   )
 }
 
-function parseRecord(text: string): Record<string, string> {
-  const value: unknown = JSON.parse(text)
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('expected a JSON object')
-  const out: Record<string, string> = {}
-  for (const [key, item] of Object.entries(value as Record<string, unknown>)) {
-    out[key] = String(item)
-  }
-  return out
+function SecretField({
+  label,
+  configured,
+  value,
+  onChange,
+}: {
+  label: string
+  configured: boolean
+  value: string
+  onChange: (value: string) => void
+}) {
+  return (
+    <Field label={label}>
+      <input
+        className={css.input}
+        type="password"
+        autoComplete="off"
+        value={value}
+        placeholder={configured ? tt('config.secretConfigured') : tt('config.secretMissing')}
+        onChange={event => { onChange(event.target.value) }}
+      />
+    </Field>
+  )
+}
+
+function McpSection({
+  title,
+  row,
+  secret,
+  onEnabled,
+  onUrl,
+  onUsername,
+  onSecret,
+  urlLabel,
+  secretLabel,
+  usernameLabel,
+}: {
+  title: string
+  row: RezPublicConnection
+  secret: string
+  onEnabled: (enabled: boolean) => void
+  onUrl?: (url: string) => void
+  onUsername?: (username: string) => void
+  onSecret: (secret: string) => void
+  urlLabel?: string
+  secretLabel: string
+  usernameLabel?: string
+}) {
+  return (
+    <Section title={title}>
+      <Field label={tt('config.enabled')}>
+        <input className={css.checkbox} type="checkbox" checked={row.enabled} onChange={event => { onEnabled(event.target.checked) }} />
+      </Field>
+      {onUrl !== undefined && urlLabel !== undefined && (
+        <Field label={urlLabel}>
+          <input className={css.input} value={row.url ?? ''} onChange={event => { onUrl(event.target.value) }} />
+        </Field>
+      )}
+      {onUsername !== undefined && usernameLabel !== undefined && (
+        <Field label={usernameLabel}>
+          <input className={css.input} value={row.username ?? ''} onChange={event => { onUsername(event.target.value) }} />
+        </Field>
+      )}
+      <SecretField label={secretLabel} configured={row.secretConfigured} value={secret} onChange={onSecret} />
+      <p className={css.message}>{row.secretRef}</p>
+    </Section>
+  )
 }
 
 export function ConfigTab({ api }: { api: RezApi }) {
   const [config, setConfig] = useState<RezPublicConfig | null>(null)
+  const [secrets, setSecrets] = useState<SecretDrafts>(EMPTY_SECRETS)
   const [loading, setLoading] = useState(true)
   const [saving, setSaving] = useState(false)
   const [testing, setTesting] = useState(false)
   const [message, setMessage] = useState('')
   const [error, setError] = useState('')
   const [results, setResults] = useState<RezTestResult[]>([])
-  const [argsText, setArgsText] = useState<Record<string, string>>({})
-  const [envText, setEnvText] = useState<Record<string, string>>({})
-  const [headerText, setHeaderText] = useState<Record<string, string>>({})
-
-  const initTexts = (next: RezPublicConfig): void => {
-    const args: Record<string, string> = {}
-    const envs: Record<string, string> = {}
-    const headers: Record<string, string> = {}
-    for (const [id, server] of Object.entries(next.servers)) {
-      args[id] = (server.args ?? []).join('\n')
-      envs[id] = JSON.stringify(server.env ?? {}, null, 2)
-      headers[id] = JSON.stringify(server.headers ?? {}, null, 2)
-    }
-    setArgsText(args)
-    setEnvText(envs)
-    setHeaderText(headers)
-  }
 
   const load = async (): Promise<void> => {
     try {
-      const next = await api.getConfig()
-      setConfig(next)
-      initTexts(next)
+      setConfig(await api.getConfig())
     } catch (err) {
       setError(errorMessage(err))
     } finally {
@@ -91,10 +141,10 @@ export function ConfigTab({ api }: { api: RezApi }) {
     setConfig(prev => prev === null ? prev : { ...prev, [key]: value })
   }
 
-  const updateServer = (id: string, patch: Partial<RezMcpServerSpec>): void => {
+  const patchConnection = (id: keyof RezPublicConfig['connections'], patch: Partial<RezPublicConnection>): void => {
     setConfig(prev => prev === null ? prev : {
       ...prev,
-      servers: { ...prev.servers, [id]: { ...prev.servers[id], ...patch } },
+      connections: { ...prev.connections, [id]: { ...prev.connections[id], ...patch } },
     })
   }
 
@@ -103,9 +153,20 @@ export function ConfigTab({ api }: { api: RezApi }) {
     setMessage('')
     setError('')
     try {
-      const saved = await api.saveConfig(config)
+      const payload = {
+        enabled: config.enabled,
+        role: config.role,
+        billing: config.billing,
+        connections: {
+          odoo: { ...config.connections.odoo, secret: secrets.odoo || undefined },
+          nextcloud: { ...config.connections.nextcloud, secret: secrets.nextcloud || undefined },
+          wechat: { ...config.connections.wechat, secret: secrets.wechat || undefined },
+          homeassistant: { ...config.connections.homeassistant, secret: secrets.homeassistant || undefined },
+        },
+      }
+      const saved = await api.saveConfig(payload)
       setConfig(saved)
-      initTexts(saved)
+      setSecrets(EMPTY_SECRETS)
       setMessage(tt('config.saved'))
     } catch (err) {
       setError(errorMessage(err))
@@ -129,27 +190,16 @@ export function ConfigTab({ api }: { api: RezApi }) {
   }
 
   const renderResult = (result: RezTestResult): string => {
-    if (result.ok) return tt('config.testOk', { tools: result.toolCount ?? 0, latency: result.latencyMs ?? 0 })
-    return tt('config.testFail', { error: result.error ?? '' })
-  }
-
-  const commitArgs = (id: string): void => {
-    updateServer(id, { args: argsText[id] === '' ? [] : argsText[id].split('\n').map(line => line.trim()).filter(Boolean) })
-  }
-
-  const commitRecord = (id: string, kind: 'env' | 'headers'): void => {
-    const text = kind === 'env' ? envText[id] : headerText[id]
-    try {
-      const record = parseRecord(text ?? '{}')
-      updateServer(id, kind === 'env' ? { env: record } : { headers: record })
-      setError('')
-    } catch (err) {
-      setError(tt('config.jsonInvalid', { error: errorMessage(err) }))
+    if (result.ok) {
+      if (result.serverInfo !== undefined) return result.serverInfo
+      return tt('config.testOk', { tools: result.toolCount ?? 0, latency: result.latencyMs ?? 0 })
     }
+    return tt('config.testFail', { error: result.error ?? '' })
   }
 
   return (
     <div className={css.tabBody}>
+      <p className={css.message}>{tt('config.mcpHint')}</p>
       <Section title={tt('config.role')}>
         <Field label={tt('config.role')}>
           <select className={css.select} value={config.role} onChange={event => { setTop('role', event.target.value as RezRoleId) }}>
@@ -161,41 +211,46 @@ export function ConfigTab({ api }: { api: RezApi }) {
         </Field>
       </Section>
 
-      {Object.entries(config.servers).map(([id, server]) => (
-        <Section key={id} title={id}>
-          <Field label={tt('config.enabled')}>
-            <input className={css.checkbox} type="checkbox" checked={server.enabled} onChange={event => { updateServer(id, { enabled: event.target.checked }) }} />
-          </Field>
-          <Field label={tt('config.transport')}>
-            <select className={css.select} value={server.transport} onChange={event => { updateServer(id, { transport: event.target.value as RezMcpServerSpec['transport'] }) }}>
-              <option value="stdio">stdio</option>
-              <option value="streamable-http">streamable-http</option>
-            </select>
-          </Field>
-          {server.transport === 'stdio' ? (
-            <>
-              <Field label={tt('config.command')}>
-                <input className={css.input} value={server.command ?? ''} onChange={event => { updateServer(id, { command: event.target.value }) }} />
-              </Field>
-              <Field label={tt('config.args')}>
-                <textarea className={css.input} rows={3} value={argsText[id] ?? ''} onChange={event => { setArgsText(prev => ({ ...prev, [id]: event.target.value })) }} onBlur={() => { commitArgs(id) }} />
-              </Field>
-              <Field label={tt('config.env')}>
-                <textarea className={css.input} rows={4} value={envText[id] ?? '{}'} onChange={event => { setEnvText(prev => ({ ...prev, [id]: event.target.value })) }} onBlur={() => { commitRecord(id, 'env') }} />
-              </Field>
-            </>
-          ) : (
-            <>
-              <Field label={tt('config.url')}>
-                <input className={css.input} value={server.url ?? ''} onChange={event => { updateServer(id, { url: event.target.value }) }} />
-              </Field>
-              <Field label={tt('config.headers')}>
-                <textarea className={css.input} rows={4} value={headerText[id] ?? '{}'} onChange={event => { setHeaderText(prev => ({ ...prev, [id]: event.target.value })) }} onBlur={() => { commitRecord(id, 'headers') }} />
-              </Field>
-            </>
-          )}
-        </Section>
-      ))}
+      <McpSection
+        title={tt('config.odoo')}
+        row={config.connections.odoo}
+        secret={secrets.odoo}
+        onEnabled={enabled => { patchConnection('odoo', { enabled }) }}
+        onUrl={url => { patchConnection('odoo', { url }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, odoo: value })) }}
+        urlLabel={tt('config.odoo.url')}
+        secretLabel={tt('config.odoo.apiKey')}
+      />
+      <McpSection
+        title={tt('config.nextcloud')}
+        row={config.connections.nextcloud}
+        secret={secrets.nextcloud}
+        onEnabled={enabled => { patchConnection('nextcloud', { enabled }) }}
+        onUrl={url => { patchConnection('nextcloud', { url }) }}
+        onUsername={username => { patchConnection('nextcloud', { username }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, nextcloud: value })) }}
+        urlLabel={tt('config.nextcloud.url')}
+        usernameLabel={tt('config.nextcloud.username')}
+        secretLabel={tt('config.nextcloud.appPassword')}
+      />
+      <McpSection
+        title={tt('config.wecom')}
+        row={config.connections.wechat}
+        secret={secrets.wechat}
+        onEnabled={enabled => { patchConnection('wechat', { enabled }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, wechat: value })) }}
+        secretLabel={tt('config.wecom.webhook')}
+      />
+      <McpSection
+        title={tt('config.ha')}
+        row={config.connections.homeassistant}
+        secret={secrets.homeassistant}
+        onEnabled={enabled => { patchConnection('homeassistant', { enabled }) }}
+        onUrl={url => { patchConnection('homeassistant', { url }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, homeassistant: value })) }}
+        urlLabel={tt('config.ha.url')}
+        secretLabel={tt('config.ha.token')}
+      />
 
       <Section title={tt('config.billing')}>
         <Field label={tt('config.billing.input')}>

package/src/index.ts

@@ -15,6 +15,7 @@ import z from '@deepseek-ai/schemastery'
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 import type {} from '@deepseek-ai/dsh-tools'
+import { REZ_CREDENTIAL_REFS, REZ_DEFAULT_CONNECTIONS, secretConfigured } from '@rezti/dsh-rez-sso'
 import type { McpHost } from './mcp-host.ts'
 import { makeRoutes } from './routes.ts'
 import { defaultConfig, mergeConfig, saveConfig } from './store.ts'
@@ -45,6 +46,24 @@ export const Config: z<RezConfig> = z.object({
   announceToAgent: z.boolean().default(true),
   role: z.union(['engineer', 'sales', 'operations', 'all'] as const).default('all'),
   servers: z.dict(serverSchema).default({}),
+  connections: z.object({
+    odoo: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.odoo.url),
+    }).default(REZ_DEFAULT_CONNECTIONS.odoo),
+    nextcloud: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.url),
+      username: z.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.username),
+    }).default(REZ_DEFAULT_CONNECTIONS.nextcloud),
+    wechat: z.object({
+      enabled: z.boolean().default(true),
+    }).default(REZ_DEFAULT_CONNECTIONS.wechat),
+    homeassistant: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.homeassistant.url),
+    }).default(REZ_DEFAULT_CONNECTIONS.homeassistant),
+  }).default(REZ_DEFAULT_CONNECTIONS),
   billing: z.object({
     inputCostPer1k: z.number().default(0.001),
     outputCostPer1k: z.number().default(0.002),
@@ -73,16 +92,19 @@ function delegatedHost(): McpHost {
   const status = (): RezServerStatus[] => COMPOSED_SERVERS.map(server => ({
     server,
     enabled: true,
-    state: 'disconnected',
+    state: 'disconnected' as const,
     toolCount: 0,
     registeredTools: 0,
-    lastError: 'owned by @deepseek-ai/dsh-mcp-client',
-  }))
-  const test = async (): Promise<RezTestResult[]> => COMPOSED_SERVERS.map(server => ({
-    server,
-    ok: false,
-    error: 'MCP is composed by dsh-mcp-client; set REZ_* credentials and check dsh logs',
+    lastError: secretConfigured(server)
+      ? 'owned by @deepseek-ai/dsh-mcp-client'
+      : 'missing ' + REZ_CREDENTIAL_REFS[server],
   }))
+  const test = async (): Promise<RezTestResult[]> => COMPOSED_SERVERS.map(server => {
+    const ok = secretConfigured(server)
+    return ok
+      ? { server, ok: true, serverInfo: REZ_CREDENTIAL_REFS[server] + ' configured' }
+      : { server, ok: false, error: 'missing ' + REZ_CREDENTIAL_REFS[server] }
+  })
   return {
     status,
     test,
@@ -119,6 +141,10 @@ export function apply(ctx: Context, config?: RezConfig): void {
     },
     host,
     tokens,
+    onCredentialWritten: (ref) => {
+      const emit = ctx.emit as unknown as (event: string, value: string) => void
+      emit('credentials/updated', ref)
+    },
   })
 
   let disposeRoutes: (() => void) | undefined