@rezti/dsh-rez-suite 0.1.5 → 0.1.7

package/src/client/panel/ConfigTab.tsx

@@ -1,11 +1,11 @@
 /**
- * Config tab: role, billing rates, and a generic editor for every MCP server
- * in config.servers (stdio and streamable-http), with one-click tests.
+ * Config tab: company MCP connections (Odoo / Nextcloud / WeCom / HA),
+ * role, and billing. Secrets are write-only and land in credentials.yaml.
  */
 
 import { useEffect, useState, type ReactNode } from 'react'
 import type { RezApi } from '../api.ts'
-import type { RezMcpServerSpec, RezPublicConfig, RezRoleId, RezTestResult } from '../../protocol.ts'
+import type { RezPublicConfig, RezPublicConnection, RezRoleId, RezTestResult } from '../../protocol.ts'
 import { errorMessage, tt } from './helpers.ts'
 import css from './panel.module.css'
 
@@ -16,6 +16,15 @@ const ROLES: Array<{ value: RezRoleId; label: string }> = [
   { value: 'operations', label: 'role.operations' },
 ]
 
+type SecretDrafts = {
+  odoo: string
+  nextcloud: string
+  wechat: string
+  homeassistant: string
+}
+
+const EMPTY_SECRETS: SecretDrafts = { odoo: '', nextcloud: '', wechat: '', homeassistant: '' }
+
 function Field({ label, children }: { label: string; children: ReactNode }) {
   return (
     <div className={css.field}>
@@ -34,47 +43,88 @@ function Section({ title, children }: { title: string; children: ReactNode }) {
   )
 }
 
-function parseRecord(text: string): Record<string, string> {
-  const value: unknown = JSON.parse(text)
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('expected a JSON object')
-  const out: Record<string, string> = {}
-  for (const [key, item] of Object.entries(value as Record<string, unknown>)) {
-    out[key] = String(item)
-  }
-  return out
+function SecretField({
+  label,
+  configured,
+  value,
+  onChange,
+}: {
+  label: string
+  configured: boolean
+  value: string
+  onChange: (value: string) => void
+}) {
+  return (
+    <Field label={label}>
+      <input
+        className={css.input}
+        type="password"
+        autoComplete="off"
+        value={value}
+        placeholder={configured ? tt('config.secretConfigured') : tt('config.secretMissing')}
+        onChange={event => { onChange(event.target.value) }}
+      />
+    </Field>
+  )
+}
+
+function McpSection({
+  title,
+  row,
+  secret,
+  onEnabled,
+  onUrl,
+  onUsername,
+  onSecret,
+  urlLabel,
+  secretLabel,
+  usernameLabel,
+}: {
+  title: string
+  row: RezPublicConnection
+  secret: string
+  onEnabled: (enabled: boolean) => void
+  onUrl?: (url: string) => void
+  onUsername?: (username: string) => void
+  onSecret: (secret: string) => void
+  urlLabel?: string
+  secretLabel: string
+  usernameLabel?: string
+}) {
+  return (
+    <Section title={title}>
+      <Field label={tt('config.enabled')}>
+        <input className={css.checkbox} type="checkbox" checked={row.enabled} onChange={event => { onEnabled(event.target.checked) }} />
+      </Field>
+      {onUrl !== undefined && urlLabel !== undefined && (
+        <Field label={urlLabel}>
+          <input className={css.input} value={row.url ?? ''} onChange={event => { onUrl(event.target.value) }} />
+        </Field>
+      )}
+      {onUsername !== undefined && usernameLabel !== undefined && (
+        <Field label={usernameLabel}>
+          <input className={css.input} value={row.username ?? ''} onChange={event => { onUsername(event.target.value) }} />
+        </Field>
+      )}
+      <SecretField label={secretLabel} configured={row.secretConfigured} value={secret} onChange={onSecret} />
+      <p className={css.message}>{row.secretRef}</p>
+    </Section>
+  )
 }
 
 export function ConfigTab({ api }: { api: RezApi }) {
   const [config, setConfig] = useState<RezPublicConfig | null>(null)
+  const [secrets, setSecrets] = useState<SecretDrafts>(EMPTY_SECRETS)
   const [loading, setLoading] = useState(true)
   const [saving, setSaving] = useState(false)
   const [testing, setTesting] = useState(false)
   const [message, setMessage] = useState('')
   const [error, setError] = useState('')
   const [results, setResults] = useState<RezTestResult[]>([])
-  const [argsText, setArgsText] = useState<Record<string, string>>({})
-  const [envText, setEnvText] = useState<Record<string, string>>({})
-  const [headerText, setHeaderText] = useState<Record<string, string>>({})
-
-  const initTexts = (next: RezPublicConfig): void => {
-    const args: Record<string, string> = {}
-    const envs: Record<string, string> = {}
-    const headers: Record<string, string> = {}
-    for (const [id, server] of Object.entries(next.servers)) {
-      args[id] = (server.args ?? []).join('\n')
-      envs[id] = JSON.stringify(server.env ?? {}, null, 2)
-      headers[id] = JSON.stringify(server.headers ?? {}, null, 2)
-    }
-    setArgsText(args)
-    setEnvText(envs)
-    setHeaderText(headers)
-  }
 
   const load = async (): Promise<void> => {
     try {
-      const next = await api.getConfig()
-      setConfig(next)
-      initTexts(next)
+      setConfig(await api.getConfig())
     } catch (err) {
       setError(errorMessage(err))
     } finally {
@@ -91,10 +141,10 @@ export function ConfigTab({ api }: { api: RezApi }) {
     setConfig(prev => prev === null ? prev : { ...prev, [key]: value })
   }
 
-  const updateServer = (id: string, patch: Partial<RezMcpServerSpec>): void => {
+  const patchConnection = (id: keyof RezPublicConfig['connections'], patch: Partial<RezPublicConnection>): void => {
     setConfig(prev => prev === null ? prev : {
       ...prev,
-      servers: { ...prev.servers, [id]: { ...prev.servers[id], ...patch } },
+      connections: { ...prev.connections, [id]: { ...prev.connections[id], ...patch } },
     })
   }
 
@@ -103,9 +153,20 @@ export function ConfigTab({ api }: { api: RezApi }) {
     setMessage('')
     setError('')
     try {
-      const saved = await api.saveConfig(config)
+      const payload = {
+        enabled: config.enabled,
+        role: config.role,
+        billing: config.billing,
+        connections: {
+          odoo: { ...config.connections.odoo, secret: secrets.odoo || undefined },
+          nextcloud: { ...config.connections.nextcloud, secret: secrets.nextcloud || undefined },
+          wechat: { ...config.connections.wechat, secret: secrets.wechat || undefined },
+          homeassistant: { ...config.connections.homeassistant, secret: secrets.homeassistant || undefined },
+        },
+      }
+      const saved = await api.saveConfig(payload)
       setConfig(saved)
-      initTexts(saved)
+      setSecrets(EMPTY_SECRETS)
       setMessage(tt('config.saved'))
     } catch (err) {
       setError(errorMessage(err))
@@ -129,27 +190,16 @@ export function ConfigTab({ api }: { api: RezApi }) {
   }
 
   const renderResult = (result: RezTestResult): string => {
-    if (result.ok) return tt('config.testOk', { tools: result.toolCount ?? 0, latency: result.latencyMs ?? 0 })
-    return tt('config.testFail', { error: result.error ?? '' })
-  }
-
-  const commitArgs = (id: string): void => {
-    updateServer(id, { args: argsText[id] === '' ? [] : argsText[id].split('\n').map(line => line.trim()).filter(Boolean) })
-  }
-
-  const commitRecord = (id: string, kind: 'env' | 'headers'): void => {
-    const text = kind === 'env' ? envText[id] : headerText[id]
-    try {
-      const record = parseRecord(text ?? '{}')
-      updateServer(id, kind === 'env' ? { env: record } : { headers: record })
-      setError('')
-    } catch (err) {
-      setError(tt('config.jsonInvalid', { error: errorMessage(err) }))
+    if (result.ok) {
+      if (result.serverInfo !== undefined) return result.serverInfo
+      return tt('config.testOk', { tools: result.toolCount ?? 0, latency: result.latencyMs ?? 0 })
     }
+    return tt('config.testFail', { error: result.error ?? '' })
   }
 
   return (
     <div className={css.tabBody}>
+      <p className={css.message}>{tt('config.mcpHint')}</p>
       <Section title={tt('config.role')}>
         <Field label={tt('config.role')}>
           <select className={css.select} value={config.role} onChange={event => { setTop('role', event.target.value as RezRoleId) }}>
@@ -161,41 +211,46 @@ export function ConfigTab({ api }: { api: RezApi }) {
         </Field>
       </Section>
 
-      {Object.entries(config.servers).map(([id, server]) => (
-        <Section key={id} title={id}>
-          <Field label={tt('config.enabled')}>
-            <input className={css.checkbox} type="checkbox" checked={server.enabled} onChange={event => { updateServer(id, { enabled: event.target.checked }) }} />
-          </Field>
-          <Field label={tt('config.transport')}>
-            <select className={css.select} value={server.transport} onChange={event => { updateServer(id, { transport: event.target.value as RezMcpServerSpec['transport'] }) }}>
-              <option value="stdio">stdio</option>
-              <option value="streamable-http">streamable-http</option>
-            </select>
-          </Field>
-          {server.transport === 'stdio' ? (
-            <>
-              <Field label={tt('config.command')}>
-                <input className={css.input} value={server.command ?? ''} onChange={event => { updateServer(id, { command: event.target.value }) }} />
-              </Field>
-              <Field label={tt('config.args')}>
-                <textarea className={css.input} rows={3} value={argsText[id] ?? ''} onChange={event => { setArgsText(prev => ({ ...prev, [id]: event.target.value })) }} onBlur={() => { commitArgs(id) }} />
-              </Field>
-              <Field label={tt('config.env')}>
-                <textarea className={css.input} rows={4} value={envText[id] ?? '{}'} onChange={event => { setEnvText(prev => ({ ...prev, [id]: event.target.value })) }} onBlur={() => { commitRecord(id, 'env') }} />
-              </Field>
-            </>
-          ) : (
-            <>
-              <Field label={tt('config.url')}>
-                <input className={css.input} value={server.url ?? ''} onChange={event => { updateServer(id, { url: event.target.value }) }} />
-              </Field>
-              <Field label={tt('config.headers')}>
-                <textarea className={css.input} rows={4} value={headerText[id] ?? '{}'} onChange={event => { setHeaderText(prev => ({ ...prev, [id]: event.target.value })) }} onBlur={() => { commitRecord(id, 'headers') }} />
-              </Field>
-            </>
-          )}
-        </Section>
-      ))}
+      <McpSection
+        title={tt('config.odoo')}
+        row={config.connections.odoo}
+        secret={secrets.odoo}
+        onEnabled={enabled => { patchConnection('odoo', { enabled }) }}
+        onUrl={url => { patchConnection('odoo', { url }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, odoo: value })) }}
+        urlLabel={tt('config.odoo.url')}
+        secretLabel={tt('config.odoo.apiKey')}
+      />
+      <McpSection
+        title={tt('config.nextcloud')}
+        row={config.connections.nextcloud}
+        secret={secrets.nextcloud}
+        onEnabled={enabled => { patchConnection('nextcloud', { enabled }) }}
+        onUrl={url => { patchConnection('nextcloud', { url }) }}
+        onUsername={username => { patchConnection('nextcloud', { username }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, nextcloud: value })) }}
+        urlLabel={tt('config.nextcloud.url')}
+        usernameLabel={tt('config.nextcloud.username')}
+        secretLabel={tt('config.nextcloud.appPassword')}
+      />
+      <McpSection
+        title={tt('config.wecom')}
+        row={config.connections.wechat}
+        secret={secrets.wechat}
+        onEnabled={enabled => { patchConnection('wechat', { enabled }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, wechat: value })) }}
+        secretLabel={tt('config.wecom.webhook')}
+      />
+      <McpSection
+        title={tt('config.ha')}
+        row={config.connections.homeassistant}
+        secret={secrets.homeassistant}
+        onEnabled={enabled => { patchConnection('homeassistant', { enabled }) }}
+        onUrl={url => { patchConnection('homeassistant', { url }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, homeassistant: value })) }}
+        urlLabel={tt('config.ha.url')}
+        secretLabel={tt('config.ha.token')}
+      />
 
       <Section title={tt('config.billing')}>
         <Field label={tt('config.billing.input')}>

package/src/client/panel/StatusTab.tsx

@@ -36,6 +36,7 @@ export function StatusTab({ api }: { api: RezApi }) {
         <span className={css.message}>{tt('status.total', { role: status.role, count: status.totalRegisteredTools })}</span>
         <button type="button" className={css.button} onClick={() => { void load() }}>{tt('common.refresh')}</button>
       </div>
+      <p className={css.message}>{tt('status.hint')}</p>
       {error !== '' && <div className={css.error}>{error}</div>}
       <div className={css.tableWrap}>
         <table className={css.table}>

package/src/index.ts

@@ -15,12 +15,18 @@ import z from '@deepseek-ai/schemastery'
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 import type {} from '@deepseek-ai/dsh-tools'
+import { REZ_DEFAULT_CONNECTIONS } from '@rezti/dsh-rez-sso'
 import type { McpHost } from './mcp-host.ts'
+import {
+  listRegisteredToolNames,
+  observeComposedServers,
+  testComposedServers,
+} from './observe-mcp.ts'
 import { makeRoutes } from './routes.ts'
 import { defaultConfig, mergeConfig, saveConfig } from './store.ts'
 import { TokenManager } from './token-manager.ts'
 import { rezConfigTool, rezStatusTool } from './tools.ts'
-import type { RezConfig, RezServerStatus, RezTestResult } from './protocol.ts'
+import type { RezConfig } from './protocol.ts'
 
 export const name = 'rez-suite'
 
@@ -45,6 +51,24 @@ export const Config: z<RezConfig> = z.object({
   announceToAgent: z.boolean().default(true),
   role: z.union(['engineer', 'sales', 'operations', 'all'] as const).default('all'),
   servers: z.dict(serverSchema).default({}),
+  connections: z.object({
+    odoo: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.odoo.url),
+    }).default(REZ_DEFAULT_CONNECTIONS.odoo),
+    nextcloud: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.url),
+      username: z.string().default(REZ_DEFAULT_CONNECTIONS.nextcloud.username),
+    }).default(REZ_DEFAULT_CONNECTIONS.nextcloud),
+    wechat: z.object({
+      enabled: z.boolean().default(true),
+    }).default(REZ_DEFAULT_CONNECTIONS.wechat),
+    homeassistant: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.homeassistant.url),
+    }).default(REZ_DEFAULT_CONNECTIONS.homeassistant),
+  }).default(REZ_DEFAULT_CONNECTIONS),
   billing: z.object({
     inputCostPer1k: z.number().default(0.001),
     outputCostPer1k: z.number().default(0.002),
@@ -54,8 +78,6 @@ export const Config: z<RezConfig> = z.object({
 
 const SECTION_ORDER = 150
 
-const COMPOSED_SERVERS = ['odoo', 'nextcloud', 'wechat', 'homeassistant'] as const
-
 export const REZ_GUIDANCE = [
   '本机已安装 ReZ-TI 套件（一次安装）：工作身份由 dsh-rez-sso 提供，MCP 由官方 dsh-mcp-client 接入 Odoo / Nextcloud / 企业微信 / Home Assistant。',
   '工具名 mcp__odoo__*、mcp__nextcloud__*、mcp__wechat__*、mcp__homeassistant__*。',
@@ -69,23 +91,17 @@ function normalize(input: Partial<RezConfig> | undefined): RezConfig {
   return mergeConfig(defaultConfig(), input ?? {})
 }
 
-function delegatedHost(): McpHost {
-  const status = (): RezServerStatus[] => COMPOSED_SERVERS.map(server => ({
-    server,
-    enabled: true,
-    state: 'disconnected',
-    toolCount: 0,
-    registeredTools: 0,
-    lastError: 'owned by @deepseek-ai/dsh-mcp-client',
-  }))
-  const test = async (): Promise<RezTestResult[]> => COMPOSED_SERVERS.map(server => ({
-    server,
-    ok: false,
-    error: 'MCP is composed by dsh-mcp-client; set REZ_* credentials and check dsh logs',
-  }))
+function delegatedHost(ctx: Context, getConfig: () => RezConfig): McpHost {
+  const snapshot = () => observeComposedServers({
+    config: getConfig(),
+    toolNames: listRegisteredToolNames(ctx.tools),
+  })
   return {
-    status,
-    test,
+    status: () => snapshot(),
+    test: async () => testComposedServers({
+      config: getConfig(),
+      toolNames: listRegisteredToolNames(ctx.tools),
+    }),
     sync: async () => undefined,
     dispose: async () => undefined,
   } as unknown as McpHost
@@ -95,7 +111,7 @@ export function apply(ctx: Context, config?: RezConfig): void {
   let current: () => RezConfig = () => normalize(config)
 
   const tokens = new TokenManager(joinTokenDb())
-  const host = delegatedHost()
+  const host = delegatedHost(ctx, () => current())
   ctx.effect(() => () => { tokens.close() }, 'dsh-rez-suite: ledger view')
 
   const tools = [
@@ -119,6 +135,10 @@ export function apply(ctx: Context, config?: RezConfig): void {
     },
     host,
     tokens,
+    onCredentialWritten: (ref) => {
+      const emit = ctx.emit as unknown as (event: string, value: string) => void
+      emit('credentials/updated', ref)
+    },
   })
 
   let disposeRoutes: (() => void) | undefined

package/src/observe-mcp.ts

@@ -0,0 +1,121 @@
+/**
+ * Live MCP status without a second host.
+ *
+ * Official @deepseek-ai/dsh-mcp-client registers tools as mcp__<server>__*.
+ * The settings Status tab used to hard-code disconnected after MCP ownership
+ * moved; this module reads the same registry the agent sees.
+ */
+
+import { REZ_CREDENTIAL_REFS, secretConfigured, type RezSystem } from '@rezti/dsh-rez-sso'
+import type { RezConfig, RezServerStatus, RezTestResult } from './protocol.ts'
+
+export const COMPOSED_SERVERS = ['odoo', 'nextcloud', 'wechat', 'homeassistant'] as const
+
+export type ComposedServer = (typeof COMPOSED_SERVERS)[number]
+
+export function mcpToolPrefix(server: string): string {
+  return 'mcp__' + server + '__'
+}
+
+/** Count tools whose public name belongs to one composed MCP server. */
+export function countMcpTools(toolNames: readonly string[], server: string): number {
+  const prefix = mcpToolPrefix(server)
+  let count = 0
+  for (const name of toolNames) {
+    if (name.startsWith(prefix)) count += 1
+  }
+  return count
+}
+
+export function listRegisteredToolNames(tools: { schemas?: () => ReadonlyArray<{ name: string }> } | undefined): string[] {
+  if (tools === undefined || typeof tools.schemas !== 'function') return []
+  try {
+    return tools.schemas().map(schema => schema.name)
+  } catch {
+    return []
+  }
+}
+
+export interface ObserveInput {
+  config: RezConfig
+  toolNames: readonly string[]
+  secretPresent?: (server: RezSystem) => boolean
+}
+
+function isEnabled(config: RezConfig, server: ComposedServer): boolean {
+  return config.connections[server].enabled !== false
+}
+
+export function observeServer(
+  server: ComposedServer,
+  input: ObserveInput,
+): RezServerStatus {
+  const enabled = isEnabled(input.config, server)
+  const secret = (input.secretPresent ?? secretConfigured)(server)
+  const toolCount = countMcpTools(input.toolNames, server)
+  const ref = REZ_CREDENTIAL_REFS[server]
+
+  if (!enabled) {
+    return {
+      server,
+      enabled: false,
+      state: 'disconnected',
+      toolCount: 0,
+      registeredTools: 0,
+      lastError: '已在设置中关闭',
+    }
+  }
+
+  if (toolCount > 0) {
+    return {
+      server,
+      enabled: true,
+      state: 'connected',
+      toolCount,
+      registeredTools: toolCount,
+    }
+  }
+
+  if (!secret) {
+    return {
+      server,
+      enabled: true,
+      state: 'disconnected',
+      toolCount: 0,
+      registeredTools: 0,
+      lastError: '未配置 ' + ref,
+    }
+  }
+
+  return {
+    server,
+    enabled: true,
+    state: 'disconnected',
+    toolCount: 0,
+    registeredTools: 0,
+    lastError: ref + ' 已配置，但本机尚未注册 ' + mcpToolPrefix(server) + '*（dsh-mcp-client 未挂上）',
+  }
+}
+
+export function observeComposedServers(input: ObserveInput): RezServerStatus[] {
+  return COMPOSED_SERVERS.map(server => observeServer(server, input))
+}
+
+export function testComposedServers(input: ObserveInput): RezTestResult[] {
+  return observeComposedServers(input).map(row => {
+    if (row.state === 'connected') {
+      return {
+        server: row.server,
+        ok: true,
+        toolCount: row.toolCount,
+        serverInfo: row.toolCount + ' tools registered (' + mcpToolPrefix(row.server) + '*)',
+      }
+    }
+    return {
+      server: row.server,
+      ok: false,
+      toolCount: 0,
+      error: row.lastError ?? 'disconnected',
+    }
+  })
+}

package/src/protocol.ts

@@ -35,12 +35,29 @@ export interface RezMcpServerSpec {
   toolCallTimeoutMs?: number
 }
 
+/** Company MCP endpoints persisted under ~/.dsh/dsh-rez-suite.json. Secrets are not stored here. */
+export interface RezConnections {
+  odoo: { enabled: boolean; url: string }
+  nextcloud: { enabled: boolean; url: string; username: string }
+  wechat: { enabled: boolean }
+  homeassistant: { enabled: boolean; url: string }
+}
+
+export interface RezPublicConnection {
+  enabled: boolean
+  url?: string
+  username?: string
+  secretConfigured: boolean
+  secretRef: string
+}
+
 /** Full plugin configuration persisted under ~/.dsh/dsh-rez-suite.json. */
 export interface RezConfig {
   enabled: boolean
   announceToAgent: boolean
   role: RezRoleId
   servers: Record<string, RezMcpServerSpec>
+  connections: RezConnections
   billing: {
     inputCostPer1k: number
     outputCostPer1k: number
@@ -56,6 +73,12 @@ export interface RezPublicConfig {
   enabled: boolean
   role: RezRoleId
   servers: Record<string, RezPublicServer>
+  connections: {
+    odoo: RezPublicConnection
+    nextcloud: RezPublicConnection
+    wechat: RezPublicConnection
+    homeassistant: RezPublicConnection
+  }
   billing: { inputCostPer1k: number; outputCostPer1k: number; monthlyBudget: number }
 }
 

package/src/routes.ts

@@ -6,6 +6,13 @@
 
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
+import {
+  REZ_CREDENTIAL_REFS,
+  REZ_SYSTEMS,
+  mergeConnections,
+  writeManagedCredential,
+  type RezSystem,
+} from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezMcpServerSpec, RezRoleId } from './protocol.ts'
 import { REZ_API } from './protocol.ts'
 import type { McpHost } from './mcp-host.ts'
@@ -74,11 +81,25 @@ function mergeMaskedRecord(base: Record<string, string> | undefined, incoming: u
 }
 
 /** Apply a browser-safe public patch without overwriting masked secrets. */
-function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): RezConfig {
+function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): { next: RezConfig; secrets: Array<{ system: RezSystem; value: string }> } {
   const next: RezConfig = JSON.parse(JSON.stringify(current)) as RezConfig
+  const secrets: Array<{ system: RezSystem; value: string }> = []
   if (typeof patch.enabled === 'boolean') next.enabled = patch.enabled
   if (patch.role === 'engineer' || patch.role === 'sales' || patch.role === 'operations' || patch.role === 'all') next.role = patch.role as RezRoleId
 
+  if (typeof patch.connections === 'object' && patch.connections !== null) {
+    const incoming = patch.connections as Record<string, unknown>
+    next.connections = mergeConnections({ ...next.connections, ...incoming })
+    for (const system of Object.keys(REZ_CREDENTIAL_REFS) as RezSystem[]) {
+      const row = incoming[system]
+      if (typeof row !== 'object' || row === null) continue
+      const secret = (row as { secret?: unknown }).secret
+      if (typeof secret === 'string' && secret.length > 0 && secret !== SECRET_MASK) {
+        secrets.push({ system, value: secret })
+      }
+    }
+  }
+
   if (typeof patch.servers === 'object' && patch.servers !== null) {
     for (const [id, raw] of Object.entries(patch.servers as Record<string, unknown>)) {
       if (typeof raw !== 'object' || raw === null) continue
@@ -104,7 +125,7 @@ function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): R
     if (typeof value.outputCostPer1k === 'number') next.billing.outputCostPer1k = value.outputCostPer1k
     if (typeof value.monthlyBudget === 'number') next.billing.monthlyBudget = value.monthlyBudget
   }
-  return next
+  return { next, secrets }
 }
 
 export interface RezRoutesDeps {
@@ -113,11 +134,12 @@ export interface RezRoutesDeps {
   updateConfig: (next: RezConfig) => Promise<RezConfig>
   host: McpHost
   tokens: TokenManager
+  onCredentialWritten?: (ref: string) => void
 }
 
 /** Build every /api/dsh-rez-suite route (exact paths). */
 export function makeRoutes(deps: RezRoutesDeps): WebRoute[] {
-  const { getConfig, updateConfig, host, tokens } = deps
+  const { getConfig, updateConfig, host, tokens, onCredentialWritten } = deps
 
   const guard = (req: IncomingMessage, res: ServerResponse, method: string): boolean => {
     if (!isLoopbackRequest(req)) {
@@ -146,8 +168,14 @@ export function makeRoutes(deps: RezRoutesDeps): WebRoute[] {
           writeJson(res, 400, { error: 'invalid JSON body' })
           return
         }
-        const next = applyPublicPatch(getConfig(), body)
+        const { next, secrets } = applyPublicPatch(getConfig(), body)
         const saved = await updateConfig(next)
+        for (const item of secrets) {
+          writeManagedCredential(REZ_CREDENTIAL_REFS[item.system], item.value)
+        }
+        for (const system of REZ_SYSTEMS) {
+          onCredentialWritten?.(REZ_CREDENTIAL_REFS[system])
+        }
         writeJson(res, 200, { config: publicConfig(saved) })
       },
     },