@undefineds.co/xpod 0.4.16 → 0.4.18

package/config/xpod.base.json

@@ -179,6 +179,9 @@
         "accountStorage": {
           "@id": "urn:solid-server:default:AccountStorage"
         },
+        "sessionExtractor": {
+          "@id": "urn:solid-server:default:CredentialsExtractor"
+        },
         "ValidatingIdentityProviderHttpHandler:_args_externalAccountIssuer": {
           "@id": "urn:solid-server:default:variable:oidcIssuer"
         }

package/dist/components/context.jsonld

@@ -1579,6 +1579,13 @@
           "args_externalAccountIssuer": {
             "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_externalAccountIssuer"
           },
+          "args_sessionExtractor": {
+            "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_sessionExtractor"
+          },
+          "args_hostClientIds": {
+            "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_hostClientIds",
+            "@container": "@list"
+          },
           "providerFactory": {
             "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_providerFactory"
           },
@@ -1593,6 +1600,13 @@
           },
           "externalAccountIssuer": {
             "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_externalAccountIssuer"
+          },
+          "sessionExtractor": {
+            "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_sessionExtractor"
+          },
+          "hostClientIds": {
+            "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_hostClientIds",
+            "@container": "@list"
           }
         }
       },

package/dist/identity/ValidatingIdentityProviderHttpHandler.d.ts

@@ -1,7 +1,8 @@
 import { OperationHttpHandler, type InteractionHandler, type OperationHttpHandlerInput, type ProviderFactory, type ResponseDescription } from '@solid/community-server';
-import type { CookieStore } from '@solid/community-server';
+import type { CookieStore, CredentialsExtractor } from '@solid/community-server';
 interface AccountExistenceStorage {
     has: (type: string, id: string) => Promise<boolean>;
+    find: (type: string, query: Record<string, unknown>) => Promise<Array<Record<string, unknown>>>;
 }
 export interface ValidatingIdentityProviderHttpHandlerArgs {
     /**
@@ -26,6 +27,24 @@ export interface ValidatingIdentityProviderHttpHandlerArgs {
      * the local cookie store must be left untouched instead of expired.
      */
     externalAccountIssuer?: string;
+    /**
+     * Reads the caller's own already-verified credentials.
+     *
+     * The Account cookie is issued on the account authority's own origin, so a page the Xpod
+     * Gateway serves cannot present it. What that page does hold is the WebID session Xpod signed
+     * it in with, which names the same Account whenever the WebID is one the Account already linked.
+     *
+     * This is CSS's own request-scoped extractor, so that session's DPoP proof is verified once for
+     * the whole request. Verifying the same proof again would be a replay and always fail, which is
+     * exactly what the `jti` guard is for - including when this handler asks.
+     */
+    sessionExtractor?: CredentialsExtractor;
+    /**
+     * OIDC clients whose Solid session may name its own Account. Defaults to the
+     * client the Xpod host itself logs in with, so a third-party Solid app holding a
+     * token for the same WebID can never turn it into Account authority.
+     */
+    hostClientIds?: string[];
 }
 /**
  * CSS-compatible IdP operation handler that drops stale account cookies.
@@ -41,6 +60,8 @@ export declare class ValidatingIdentityProviderHttpHandler extends OperationHttp
     private readonly handler;
     private readonly accountStorage;
     private readonly externalAccountIssuer?;
+    private readonly sessionExtractor?;
+    private readonly hostClientIds;
     constructor(args: ValidatingIdentityProviderHttpHandlerArgs);
     handle({ operation, request, response }: OperationHttpHandlerInput): Promise<ResponseDescription>;
     private findAccountCookies;
@@ -48,5 +69,15 @@ export declare class ValidatingIdentityProviderHttpHandler extends OperationHttp
     private findBrowserAccountCookie;
     private normalizeAccountCookie;
     private findValidAccount;
+    /**
+     * Names the Account that owns the WebID of the caller's own Solid session.
+     *
+     * The session is only accepted when its DPoP proof verifies and its client is one
+     * the Xpod host itself logs in with, so holding somebody's token is not enough and
+     * a third-party app cannot spend its own token here. The Account is then read from
+     * CSS's own WebID links: a session can only ever reach the Account it already
+     * belongs to, never another one.
+     */
+    private findSessionAccount;
 }
 export {};

package/dist/identity/ValidatingIdentityProviderHttpHandler.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ValidatingIdentityProviderHttpHandler = void 0;
 const global_logger_factory_1 = require("global-logger-factory");
 const community_server_1 = require("@solid/community-server");
+const RememberedClientGrantStore_1 = require("./oidc/RememberedClientGrantStore");
 const ACCOUNT_TYPE = 'account';
 const ACCOUNT_COOKIE_NAME = 'css-account';
 const ACCOUNT_TOKEN_AUTHORIZATION_SCHEME = 'CSS-Account-Token ';
@@ -22,6 +23,8 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
         this.handler = args.handler;
         this.accountStorage = args.accountStorage;
         this.externalAccountIssuer = args.externalAccountIssuer;
+        this.sessionExtractor = args.sessionExtractor;
+        this.hostClientIds = args.hostClientIds ?? [RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID];
     }
     async handle({ operation, request, response }) {
         // The browser sends the native, path-scoped signed cookie for this URL.
@@ -54,8 +57,15 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
         const authorizationCookie = this.findAuthorizationAccountCookie(request);
         const cookies = this.findAccountCookies(operation, authorizationCookie, browserCookie);
         const { accountId, selectedCookie, expiredCookie } = await this.findValidAccount(cookies, browserCookie);
+        // An Account cookie stays authoritative; the host's own Solid session is the
+        // second source, for pages that hold a WebID but never saw the account origin.
+        const sessionAccountId = accountId ?? await this.findSessionAccount(request);
         const normalizedOperation = this.normalizeAccountCookie(operation, selectedCookie);
-        const representation = await this.handler.handleSafe({ operation: normalizedOperation, oidcInteraction, accountId });
+        const representation = await this.handler.handleSafe({
+            operation: normalizedOperation,
+            oidcInteraction,
+            accountId: sessionAccountId,
+        });
         if (expiredCookie && !representation.metadata?.has(community_server_1.SOLID_HTTP.terms.accountCookie)) {
             const metadata = new community_server_1.RepresentationMetadata(representation.metadata);
             metadata.set(community_server_1.SOLID_HTTP.terms.accountCookie, expiredCookie);
@@ -145,6 +155,48 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
         }
         return { accountId: selectedAccountId, selectedCookie, expiredCookie };
     }
+    /**
+     * Names the Account that owns the WebID of the caller's own Solid session.
+     *
+     * The session is only accepted when its DPoP proof verifies and its client is one
+     * the Xpod host itself logs in with, so holding somebody's token is not enough and
+     * a third-party app cannot spend its own token here. The Account is then read from
+     * CSS's own WebID links: a session can only ever reach the Account it already
+     * belongs to, never another one.
+     */
+    async findSessionAccount(request) {
+        if (!this.sessionExtractor) {
+            return undefined;
+        }
+        // Only a DPoP-bound session may name an Account. A Bearer token is replayable, so accepting
+        // one here would let anybody who copied it mint Account authority from a Pod credential.
+        if (!/^DPoP /iu.test(request.headers.authorization ?? '')) {
+            return undefined;
+        }
+        let credentials;
+        try {
+            credentials = await this.sessionExtractor.handleSafe(request);
+        }
+        catch (error) {
+            // No session at all, or one this deployment does not accept: stay anonymous.
+            this.logger.debug(`No host session credentials: ${(0, community_server_1.createErrorMessage)(error)}`);
+            return undefined;
+        }
+        const webId = credentials.agent?.webId;
+        const clientId = credentials.client?.clientId;
+        if (!webId || !clientId || !this.hostClientIds.includes(clientId)) {
+            return undefined;
+        }
+        const links = await this.accountStorage.find(community_server_1.WEBID_STORAGE_TYPE, { webId });
+        const accountId = links
+            .map((link) => link.accountId)
+            .find((value) => typeof value === 'string' && value !== '');
+        if (!accountId) {
+            this.logger.debug(`WebID ${webId} is not linked to an Account.`);
+            return undefined;
+        }
+        return accountId;
+    }
 }
 exports.ValidatingIdentityProviderHttpHandler = ValidatingIdentityProviderHttpHandler;
 //# sourceMappingURL=ValidatingIdentityProviderHttpHandler.js.map

package/dist/identity/ValidatingIdentityProviderHttpHandler.jsonld

@@ -46,6 +46,35 @@
             ]
           },
           "comment": "External account authority (Cloud+Local mode). When set, account cookies are issued and validated by the remote authority, so cookies unknown to the local cookie store must be left untouched instead of expired."
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_sessionExtractor",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "css:dist/authentication/CredentialsExtractor.jsonld#CredentialsExtractor",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Reads the caller's own already-verified credentials.  The Account cookie is issued on the account authority's own origin, so a page the Xpod Gateway serves cannot present it. What that page does hold is the WebID session Xpod signed it in with, which names the same Account whenever the WebID is one the Account already linked.  This is CSS's own request-scoped extractor, so that session's DPoP proof is verified once for the whole request. Verifying the same proof again would be a replay and always fail, which is exactly what the `jti` guard is for - including when this handler asks."
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_hostClientIds",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              {
+                "@type": "ParameterRangeArray",
+                "parameterRangeValue": "xsd:string"
+              },
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "OIDC clients whose Solid session may name its own Account. Defaults to the client the Xpod host itself logs in with, so a third-party Solid app holding a token for the same WebID can never turn it into Account authority."
         }
       ],
       "memberFields": [
@@ -76,6 +105,14 @@
           "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_externalAccountIssuer",
           "memberFieldName": "externalAccountIssuer"
         },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_sessionExtractor",
+          "memberFieldName": "sessionExtractor"
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_hostClientIds",
+          "memberFieldName": "hostClientIds"
+        },
         {
           "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_constructor",
           "memberFieldName": "constructor"
@@ -103,6 +140,10 @@
         {
           "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_findValidAccount",
           "memberFieldName": "findValidAccount"
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_findSessionAccount",
+          "memberFieldName": "findSessionAccount"
         }
       ],
       "constructorArguments": [
@@ -138,6 +179,18 @@
               "value": {
                 "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_externalAccountIssuer"
               }
+            },
+            {
+              "keyRaw": "sessionExtractor",
+              "value": {
+                "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_sessionExtractor"
+              }
+            },
+            {
+              "keyRaw": "hostClientIds",
+              "value": {
+                "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_hostClientIds"
+              }
             }
           ]
         }

package/node_modules/@undefineds.co/ai-connections/dist/AiClientConfigurationSection.js

@@ -22,10 +22,16 @@ export function AiClientIcon({ client, className = 'h-4 w-4' }) {
 }
 export function AiClientConfigurationSection({ bridge, endpoint, client, createClientCredential, manualApiKey, autoApply = false, compact = false, onComplete, }) {
     const [status, setStatus] = useState({ status: 'notConfigured' });
+    // §7.3 第 5–6 步：密钥结果、配置写入、Gateway 检查、客户端验证分开呈现
+    const [stages, setStages] = useState([]);
     const [dryRun, setDryRun] = useState();
     const [confirmationValue, setConfirmationValue] = useState('');
     const [busy, setBusy] = useState(false);
     const autoApplyStarted = useRef(false);
+    /** §7.3 第 3 步：明确选择为这个客户端新建 Key，还是使用用户已有的 Key。 */
+    const [keySource, setKeySource] = useState('create');
+    /** 写入失败后保留的凭据：重试只重写配置，不再新建 Key（§7.3）。 */
+    const leaseRef = useRef(undefined);
     useEffect(() => {
         setDryRun(undefined);
         setConfirmationValue('');
@@ -58,7 +64,23 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
         let lease;
         let applied = false;
         try {
-            lease = await createClientCredential(client);
+            // 已经有上次失败留下的凭据就沿用，只有第一次才申请
+            lease = leaseRef.current;
+            if (!lease) {
+                lease = await createClientCredential(client);
+                leaseRef.current = lease;
+            }
+            setStages([
+                {
+                    id: 'key',
+                    label: '密钥',
+                    state: 'ok',
+                    detail: '本次使用这个 Xpod Key；重试不会新建 Key。',
+                },
+                { id: 'write', label: '配置写入', state: 'unknown', detail: '正在写入配置…' },
+                { id: 'gateway', label: 'Gateway 检查', state: 'unknown', detail: '本步骤未检查 Xpod 网关。' },
+                { id: 'client', label: '客户端验证', state: 'unknown', detail: '配置已写入，尚未验证客户端。' },
+            ]);
             await bridge.apply({
                 client,
                 planId: plan.planId,
@@ -71,6 +93,10 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
                 } : {}),
             });
             applied = true;
+            leaseRef.current = undefined;
+            setStages((current) => current.map((stage) => (stage.id === 'write'
+                ? { ...stage, state: 'ok', detail: '配置已写入；客户端是否已采用仍未验证。' }
+                : stage)));
             setStatus({ status: 'configured' });
             setDryRun(undefined);
             onComplete?.();
@@ -81,13 +107,13 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
                 recoveryMessage = `${AI_CLIENT_LABELS[client]} 配置失败。请重试。`;
             }
             if (lease && !applied) {
-                try {
-                    await lease.revoke();
-                }
-                catch (revokeError) {
-                    recoveryMessage = `${recoveryMessage}；自动撤销 API Key 失败：${errorMessage(revokeError)}。请在“API KEYS”中手动撤销。`;
-                }
+                // §7.3：写入失败时保留这个 Key 和原任务，重试只重写配置，不重复建 Key；
+                // 用户仍可在 API KEYS 里手动撤销。
+                recoveryMessage = `${recoveryMessage}；已保留本次使用的 Xpod Key，重试只会重新写入配置。`;
             }
+            setStages((current) => current.map((stage) => (stage.id === 'write'
+                ? { ...stage, state: 'failed', detail: recoveryMessage }
+                : stage)));
             setStatus(failedAndRestoredError(error)
                 ? { status: 'failedAndRestored', message: '配置写入失败，已自动恢复原配置。' }
                 : { status: 'unavailable', message: recoveryMessage });
@@ -148,11 +174,14 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
     const confirmation = dryRun?.confirmation;
     const confirmationSatisfied = !confirmation?.required || confirmationValue === confirmation.token;
     const clientLabel = AI_CLIENT_LABELS[client];
-    const manual = !bridge;
+    // 选择「使用已有 Key」时走手动配置路径：本页不申请新凭据，只给可复制的配置
+    const manual = !bridge || keySource === 'existing';
     const manualConfig = manualConfigurationText(client, endpoint, manualApiKey);
-    return (_jsxs("div", { className: compact ? '' : 'overflow-hidden rounded-md border border-border/60', children: [!compact ? _jsxs("div", { className: "flex flex-wrap items-center gap-2 px-3 py-2", children: [_jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: _jsx(AiClientIcon, { client: client }) }), _jsxs("div", { className: "min-w-[10rem] flex-1", children: [_jsx("div", { className: "text-sm font-medium", children: clientLabel }), !manual ? _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: status.message ?? (status.status === 'configured'
+    return (_jsxs("div", { className: compact ? '' : 'overflow-hidden rounded-md border border-border/60', children: [bridge && createClientCredential ? (_jsxs("div", { className: "border-b border-border/60 px-3 py-2", children: [_jsxs("div", { role: "tablist", "aria-label": `${clientLabel} 的 Key 来源`, className: "flex flex-wrap gap-2", children: [_jsx("button", { type: "button", role: "tab", "aria-selected": keySource === 'create', "data-testid": "client-key-source-create", className: `rounded-lg border px-3 py-1 text-xs ${keySource === 'create' ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setKeySource('create'), children: "\u4E3A\u8FD9\u4E2A\u5BA2\u6237\u7AEF\u65B0\u5EFA Key" }), _jsx("button", { type: "button", role: "tab", "aria-selected": keySource === 'existing', "data-testid": "client-key-source-existing", className: `rounded-lg border px-3 py-1 text-xs ${keySource === 'existing' ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setKeySource('existing'), children: "\u4F7F\u7528\u6211\u5DF2\u7ECF\u6709\u7684 Key" })] }), _jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: keySource === 'existing'
+                            ? '本页不会新建 Key：请把已有 Key 粘进客户端配置。共用一个 Key 时，停用它会影响所有使用它的客户端。'
+                            : '会为这个客户端单独创建一个 Key；停用只影响它自己。' })] })) : null, !compact ? _jsxs("div", { className: "flex flex-wrap items-center gap-2 px-3 py-2", children: [_jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: _jsx(AiClientIcon, { client: client }) }), _jsxs("div", { className: "min-w-[10rem] flex-1", children: [_jsx("div", { className: "text-sm font-medium", children: clientLabel }), !manual ? _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: status.message ?? (status.status === 'configured'
                                     ? `${clientLabel} 正在使用 Xpod。`
-                                    : '可自动写入本机配置。') }) : null] }), !manual ? _jsx(Badge, { variant: "secondary", children: statusLabel(status.status) }) : null, manual ? (_jsx(AiCopyButton, { value: manualConfig, label: `${clientLabel} 配置`, variant: "ghost", size: "icon", iconClassName: "h-4 w-4" })) : (_jsxs("div", { className: "flex items-center gap-1", children: [_jsx(Button, { variant: "outline", size: "sm", "aria-label": `配置 ${clientLabel}`, disabled: busy, onClick: () => void plan(), children: "\u914D\u7F6E" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `恢复 ${clientLabel} 配置`, disabled: status.status === 'notConfigured' || busy, onClick: () => void restore(), children: _jsx(RotateCcw, { className: "h-4 w-4" }) })] }))] }) : null, compact && busy ? (_jsxs("div", { className: "py-1 text-xs text-muted-foreground", children: ["\u6B63\u5728\u5E94\u7528 ", clientLabel, " \u914D\u7F6E\u2026"] })) : null, compact && !busy && status.message ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 py-1 text-xs text-destructive", children: [_jsx("span", { children: status.message }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => void plan(), children: "\u91CD\u8BD5\u5E94\u7528\u914D\u7F6E" })] })) : null, dryRun ? (_jsxs("div", { className: "space-y-3 border-t border-border/60 bg-muted/20 px-4 py-3", children: [_jsx("div", { className: "text-xs font-medium", children: "\u5C06\u6267\u884C\u4EE5\u4E0B\u66F4\u6539" }), dryRun.changes.map((change) => (_jsxs("div", { className: "text-xs text-muted-foreground", children: [_jsx("span", { className: "font-mono", children: change.target }), ' · ', changeActionLabel(change.action), change.backup ? ' · 创建备份' : ''] }, `${change.target}:${change.action}`))), confirmation?.required ? (_jsxs("div", { className: "space-y-2", children: [confirmation.message ? _jsx("div", { className: "text-xs text-muted-foreground", children: confirmation.message }) : null, _jsxs("div", { className: "text-xs text-muted-foreground", children: ["\u786E\u8BA4\u7801\uFF1A", _jsx("code", { className: "font-mono text-foreground", children: confirmation.token })] }), _jsx(Input, { "aria-label": `输入确认码以应用 ${clientLabel} 配置`, value: confirmationValue, onChange: (event) => setConfirmationValue(event.target.value) })] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { size: "sm", "aria-label": confirmation?.required
+                                    : '可自动写入本机配置。') }) : null] }), !manual ? _jsx(Badge, { variant: "secondary", children: statusLabel(status.status) }) : null, manual ? (_jsx(AiCopyButton, { value: manualConfig, label: `${clientLabel} 配置`, variant: "ghost", size: "icon", iconClassName: "h-4 w-4" })) : (_jsxs("div", { className: "flex items-center gap-1", children: [_jsx(Button, { variant: "outline", size: "sm", "aria-label": `配置 ${clientLabel}`, disabled: busy, onClick: () => void plan(), children: "\u914D\u7F6E" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `恢复 ${clientLabel} 配置`, disabled: status.status === 'notConfigured' || busy, onClick: () => void restore(), children: _jsx(RotateCcw, { className: "h-4 w-4" }) })] }))] }) : null, compact && busy ? (_jsxs("div", { className: "py-1 text-xs text-muted-foreground", children: ["\u6B63\u5728\u5E94\u7528 ", clientLabel, " \u914D\u7F6E\u2026"] })) : null, compact && !busy && status.message ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 py-1 text-xs text-destructive", children: [_jsx("span", { children: status.message }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => void plan(), children: "\u91CD\u8BD5\u5E94\u7528\u914D\u7F6E" })] })) : null, stages.length > 0 ? (_jsx("ul", { "data-testid": "client-setup-stages", className: "space-y-1 border-t border-border/60 px-4 py-3 text-xs", children: stages.map((stage) => (_jsxs("li", { "data-testid": "client-setup-stage", "data-stage": stage.id, "data-stage-state": stage.state, className: "flex gap-2", children: [_jsx("span", { "aria-hidden": "true", children: stage.state === 'ok' ? '✓' : stage.state === 'failed' ? '✕' : '?' }), _jsx("span", { className: "font-medium", children: stage.label }), _jsx("span", { className: "min-w-0 flex-1 text-muted-foreground", children: stage.detail })] }, stage.id))) })) : null, dryRun ? (_jsxs("div", { className: "space-y-3 border-t border-border/60 bg-muted/20 px-4 py-3", children: [_jsx("div", { className: "text-xs font-medium", children: "\u5C06\u6267\u884C\u4EE5\u4E0B\u66F4\u6539" }), dryRun.changes.map((change) => (_jsxs("div", { className: "text-xs text-muted-foreground", children: [_jsx("span", { className: "font-mono", children: change.target }), ' · ', changeActionLabel(change.action), change.backup ? ' · 创建备份' : ''] }, `${change.target}:${change.action}`))), confirmation?.required ? (_jsxs("div", { className: "space-y-2", children: [confirmation.message ? _jsx("div", { className: "text-xs text-muted-foreground", children: confirmation.message }) : null, _jsxs("div", { className: "text-xs text-muted-foreground", children: ["\u786E\u8BA4\u7801\uFF1A", _jsx("code", { className: "font-mono text-foreground", children: confirmation.token })] }), _jsx(Input, { "aria-label": `输入确认码以应用 ${clientLabel} 配置`, value: confirmationValue, onChange: (event) => setConfirmationValue(event.target.value) })] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { size: "sm", "aria-label": confirmation?.required
                                     ? `确认并应用 ${clientLabel} 配置`
                                     : `应用 ${clientLabel} 配置`, disabled: !createClientCredential || busy || !confirmationSatisfied, onClick: () => void apply(), children: confirmation?.required ? '确认并应用' : '应用配置' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy, onClick: () => {
                                     setDryRun(undefined);

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsList.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useContext, useRef } from 'react';
+import { useContext, useRef, useState } from 'react';
 import { Avatar, AvatarFallback, AvatarImage, cn } from '@undefineds.co/shared-ui';
 import { WorkspaceLayoutContext } from '@undefineds.co/extension-sdk/react';
 import { XPOD_AVATAR, getProviderAvatar, getProviderAvatarBackground } from './provider-visuals.js';
@@ -26,9 +26,20 @@ export function AiConnectionsList({ controller }) {
     const providers = searchQuery
         ? providerItems.filter((provider) => providerDisplayName(provider, providerProducts).toLocaleLowerCase().includes(searchQuery))
         : providerItems;
+    // §7.3：已有配置时先呈现已连接对象，全量 Provider 目录只在"添加连接"时出现；
+    // 什么都没配置时，目录本身就是连接任务的入口，直接出现。
+    const [adding, setAdding] = useState(false);
+    const configured = (provider) => {
+        const state = providerStates[provider.id];
+        return state === 'configured' || state === 'connected';
+    };
+    const configuredProviders = providers.filter(configured);
+    const catalogProviders = providers.filter((provider) => !configured(provider));
+    const showCatalog = adding || configuredProviders.length === 0;
+    const shownProviders = showCatalog ? providers : configuredProviders;
     const items = [
         ...AI_CONNECTIONS_PINNED_SECTIONS.map((section) => ({ kind: 'section', id: section.id, label: section.label })),
-        ...providers.map((provider) => ({ kind: 'provider', provider })),
+        ...shownProviders.map((provider) => ({ kind: 'provider', provider })),
     ];
     const optionRefs = useRef([]);
     const selectedIndex = items.findIndex((item) => item.kind === 'section'
@@ -45,14 +56,14 @@ export function AiConnectionsList({ controller }) {
     return (_jsxs("div", { role: "listbox", "aria-label": "AI \u670D\u52A1", "aria-orientation": "vertical", className: "py-2", children: [_jsx("section", { className: "mb-3", "aria-label": "API Keys", children: items.filter((item) => item.kind === 'section').map((item) => {
                     const index = items.indexOf(item);
                     return (_jsxs(WorkspaceOption, { index: index, selected: selectedSection === item.id, tabbable: selectedIndex === index || (selectedIndex < 0 && index === 0), label: item.label, optionRefs: optionRefs, onActivate: () => activate(item), onMove: (nextIndex) => moveSelection(items, nextIndex, controller, optionRefs), children: [_jsx(PinnedMark, { section: item.id }), _jsx("span", { className: cn('min-w-0 flex-1 truncate text-sm font-medium', selectedSection === item.id ? 'text-foreground' : 'text-foreground/80'), children: item.label })] }, item.id));
-                }) }), _jsxs("section", { children: [_jsx("h2", { className: "px-5 py-1 text-[11px] font-semibold uppercase tracking-wider text-muted-foreground", children: "Provider" }), providers.map((provider) => {
+                }) }), _jsxs("section", { "data-testid": "ai-provider-section", children: [_jsxs("div", { className: "flex items-center justify-between gap-2 px-5 py-1", children: [_jsx("h2", { className: "text-[11px] font-semibold uppercase tracking-wider text-muted-foreground", children: configuredProviders.length > 0 && !showCatalog ? '已连接' : 'Provider' }), configuredProviders.length > 0 ? (_jsx("button", { type: "button", "data-testid": "ai-add-connection", className: "text-[11px] text-primary underline-offset-4 hover:underline", "aria-expanded": showCatalog, onClick: () => setAdding((value) => !value), children: showCatalog ? '收起目录' : '添加连接' })) : null] }), shownProviders.map((provider) => {
                         const index = items.findIndex((item) => item.kind === 'provider'
                             && item.provider.id === provider.id
                             && item.provider.credentialId === provider.credentialId);
                         const selected = selectedSection === 'provider' && selectedProvider === provider.id && provider.credentialId === selectedCredentialId;
                         const state = providerStates[provider.id] ?? 'loading';
                         return (_jsxs(WorkspaceOption, { index: index, selected: selected, tabbable: selected || (selectedIndex < 0 && index === 0), label: providerDisplayName(provider, providerProducts), describedBy: `ai-connections-provider-${provider.id}-${provider.credentialId ?? 'default'}-status`, optionRefs: optionRefs, onActivate: () => activate({ kind: 'provider', provider }), onMove: (nextIndex) => moveSelection(items, nextIndex, controller, optionRefs), children: [_jsxs(Avatar, { className: "h-9 w-9 shrink-0 rounded-md border border-border/20", style: getProviderAvatarBackground(provider.id) ? { backgroundColor: getProviderAvatarBackground(provider.id) } : undefined, children: [_jsx(AvatarImage, { src: getProviderAvatar(provider.id), className: "object-cover" }), _jsx(AvatarFallback, { className: "rounded-md bg-muted text-[10px] font-bold uppercase text-muted-foreground", children: providerMark(provider.id) })] }), _jsx("span", { className: cn('min-w-0 flex-1 truncate text-sm font-medium', selected ? 'text-foreground' : 'text-foreground/80'), children: providerDisplayName(provider, providerProducts) }), _jsx(ProviderStateIndicator, { state: state, statusId: `ai-connections-provider-${provider.id}-${provider.credentialId ?? 'default'}-status` })] }, `${provider.id}:${provider.credentialId ?? 'default'}`));
-                    }), providers.length === 0 ? (_jsx("p", { className: "p-8 text-center text-xs text-muted-foreground", children: "\u65E0\u7ED3\u679C" })) : null] }), providerLoadError ? (_jsxs("p", { className: "px-4 py-2 text-xs text-destructive", children: ["Provider \u72B6\u6001\u8BFB\u53D6\u5931\u8D25\uFF1A", providerLoadError] })) : null] }));
+                    }), shownProviders.length === 0 ? (_jsx("p", { className: "p-8 text-center text-xs text-muted-foreground", children: "\u65E0\u7ED3\u679C" })) : null] }), providerLoadError ? (_jsxs("p", { className: "px-4 py-2 text-xs text-destructive", children: ["Provider \u72B6\u6001\u8BFB\u53D6\u5931\u8D25\uFF1A", providerLoadError] })) : null] }));
 }
 function WorkspaceOption({ index, selected, tabbable, label, describedBy, statusId, optionRefs, onActivate, onMove, children, }) {
     const handleKeyDown = (event) => {

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsPanel.d.ts

@@ -1,6 +1,6 @@
 import { type AiConnectionsClient, type AiConnectionsProvider, type AiProviderConnectionSummary, type AiProviderSummary } from './contract/ai-connections-client';
 import { type AiConnectionsWorkspaceSection, type ProviderProductState } from './controller';
-import type { AiClientConfigurationBridge } from './AiClientConfigurationSection';
+import { type AiClientConfigurationBridge } from './AiClientConfigurationSection';
 import { type CredentialRow } from './collections';
 export interface AiConnectionsPanelProps {
     client: AiConnectionsClient;

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsPanel.js

@@ -7,11 +7,13 @@ import { offeringTitle } from './offering-label.js';
 import { AiProviderCard, } from './AiProviderCard.js';
 import { AiModelEditorDialog, } from './AiModelEditorDialog.js';
 import { AiGatewayKeysSection } from './AiGatewayKeysSection.js';
+import { AI_CLIENT_LABELS, AI_CONNECTIONS_CLIENTS, AiClientConfigurationSection, } from './AiClientConfigurationSection.js';
 import { credentialCarriers, withLiveCredentials } from './collections.js';
 import { modelCatalogId, withCatalogModelId } from './AiModelCatalog.js';
 const EMPTY_PROVIDER_SUMMARIES = {};
 export function AiConnectionsPanel({ client, renderToaster = true, openExternal = openExternalUrl, clientConfigurationBridge, selectedSection = 'provider', selectedProvider, selectedCredentialId, providerSummaries: providerSummariesInput = EMPTY_PROVIDER_SUMMARIES, providerProducts = {}, providerLoadError, providerLoading = false, onProviderStateChange, onModelSelectionChange, liveRevision = 0, liveCredentialRows, }) {
     const [connectionStates, setConnectionStates] = useState({});
+    const [activeClient, setActiveClient] = useState(AI_CONNECTIONS_CLIENTS[0]);
     const [models, setModels] = useState([]);
     const [gatewayModels, setGatewayModels] = useState();
     const [gatewayCatalogVersion, setGatewayCatalogVersion] = useState(0);
@@ -705,8 +707,9 @@ export function AiConnectionsPanel({ client, renderToaster = true, openExternal
                         [definition.id]: value,
                     })), onBeginApiKey: () => void beginApiKey(definition.id), onBeginOffering: (offering, mode, method) => void beginOfferingConnect(definition.id, offering, mode, method), onCancelConnect: (attempt) => void cancelConnect(definition.id, attempt), onBeginBrowser: () => void beginBrowserConnect(definition), onSaveApiKey: () => void saveApiKey(definition), onDisconnect: (credential) => void disconnect(definition.id, credential?.id), onCreateApiKeyCredential: (offering, input) => createApiKeyCredential(definition.id, offering, input), onCreateLocalCredential: (offering, method) => createLocalCredential(definition.id, offering, method), onUpdateCredential: (credential, patch) => updateProviderCredential(definition.id, credential, patch), onDeleteCredential: (credential) => void deleteProviderCredential(definition.id, credential), onTestCredential: (credential) => void testProviderCredential(definition.id, credential), onReorderCredentials: (offering, credentials, fromIndex, toIndex) => void reorderProviderCredentials(definition.id, offering, credentials, fromIndex, toIndex), onRefreshQuota: (offering, credential) => void refreshQuota(definition.id, offering, credential), verifyPending: Boolean(verifyingProviders[definition.id]), onVerify: () => void verifyProvider(definition.id), onAddModel: () => openModelEditor(definition.id), onEditModel: (model) => openModelEditor(definition.id, model), onDeleteModel: (model) => void deleteProviderModel(definition.id, model), onModelSelectionChange: handleModelSelectionChange, onDismissError: () => setProviderError(definition.id) }, definition.id));
             })] }));
+    const clientsContent = (_jsxs("section", { "data-testid": "ai-client-first", className: "space-y-4", children: [_jsxs("div", { children: [_jsx("h2", { className: "text-base font-semibold", children: "\u8FDE\u63A5\u5BA2\u6237\u7AEF" }), _jsx("p", { className: "mt-1 text-sm text-muted-foreground", children: "\u5148\u9009\u8981\u63A5\u5165\u7684\u5BA2\u6237\u7AEF\uFF0C\u518D\u51B3\u5B9A\u590D\u7528\u5DF2\u6709 API Key \u8FD8\u662F\u65B0\u5EFA\u4E00\u4E2A\uFF1B\u914D\u7F6E\u5199\u5165\u4E0E\u9A8C\u8BC1\u7ED3\u679C\u4F1A\u5206\u6B65\u663E\u793A\u3002" })] }), _jsx("div", { role: "tablist", "aria-label": "\u9009\u62E9\u5BA2\u6237\u7AEF", className: "flex flex-wrap gap-2", children: AI_CONNECTIONS_CLIENTS.map((candidate) => (_jsx("button", { type: "button", role: "tab", "aria-selected": candidate === activeClient, "data-testid": `ai-client-choice-${candidate}`, className: `rounded-lg border px-3 py-1.5 text-sm ${candidate === activeClient ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setActiveClient(candidate), children: AI_CLIENT_LABELS[candidate] }, candidate))) }), _jsx(AiClientConfigurationSection, { bridge: clientConfigurationBridge, client: activeClient, endpoint: client.apiBase })] }));
     const keyContent = (_jsx(AiGatewayKeysSection, { client: client, clientConfigurationBridge: clientConfigurationBridge, gatewayModels: gatewayModels, modelSelection: gatewayModelSelection, liveRevision: liveRevision }));
-    return (_jsxs("div", { "data-testid": "ai-connections-panel", className: "mx-auto w-full max-w-5xl space-y-10 px-4 py-6 sm:px-8 sm:py-8", children: [renderToaster ? _jsx(Toaster, {}) : null, selectedSection === 'keys' ? keyContent : null, selectedSection === 'provider' ? providerContent : null, selectedSection === 'provider' && modelEditor ? (_jsx(AiModelEditorDialog, { open: true, providerName: PROVIDERS.find((definition) => definition.id === modelEditor.provider)?.name ?? modelEditor.provider, initialValue: modelEditor.model
+    return (_jsxs("div", { "data-testid": "ai-connections-panel", className: "mx-auto w-full max-w-5xl space-y-10 px-4 py-6 sm:px-8 sm:py-8", children: [renderToaster ? _jsx(Toaster, {}) : null, selectedSection === 'clients' ? clientsContent : null, selectedSection === 'keys' ? keyContent : null, selectedSection === 'provider' ? providerContent : null, selectedSection === 'provider' && modelEditor ? (_jsx(AiModelEditorDialog, { open: true, providerName: PROVIDERS.find((definition) => definition.id === modelEditor.provider)?.name ?? modelEditor.provider, initialValue: modelEditor.model
                     ? {
                         id: modelEditor.model.id,
                         name: modelEditor.model.displayName ?? '',

package/node_modules/@undefineds.co/ai-connections/dist/AiGatewayKeyRow.d.ts

@@ -9,9 +9,13 @@ export interface AiGatewayKeyBinding {
  * carries only the purpose declared at creation, the client it was written
  * into, when it was last used, and the one action that still applies: destroy.
  */
-export declare function AiGatewayKeyRow({ record, busy, onDestroy, }: {
+export declare function AiGatewayKeyRow({ record, busy, confirming, onRequestDestroy, onCancelDestroy, onDestroy, }: {
     record: GatewayKeyRecord;
     busy: boolean;
+    /** §7.3：销毁前先说明影响，第二次点击才真正删除。 */
+    confirming?: boolean;
+    onRequestDestroy: () => void;
+    onCancelDestroy: () => void;
     onDestroy: () => void;
 }): import("react").JSX.Element;
 /** Where the credential is in effect: the client application and the device. */

package/node_modules/@undefineds.co/ai-connections/dist/AiGatewayKeyRow.js

@@ -7,14 +7,14 @@ import { AI_CLIENT_LABELS, AI_CONNECTIONS_CLIENTS, AiClientIcon, } from './AiCli
  * carries only the purpose declared at creation, the client it was written
  * into, when it was last used, and the one action that still applies: destroy.
  */
-export function AiGatewayKeyRow({ record, busy, onDestroy, }) {
+export function AiGatewayKeyRow({ record, busy, confirming = false, onRequestDestroy, onCancelDestroy, onDestroy, }) {
     const label = record.name || '未命名 API Key';
     const binding = gatewayKeyBinding(record);
     // Credentials issued through CSS are revoked by client id; a record without
     // one cannot be destroyed from here, so the row says so instead of offering
     // an action that always fails.
     const destroyable = record.kind !== 'client-credentials' || Boolean(record.clientCredentialId);
-    return (_jsxs("li", { "data-key-id": record.id, "data-key-binding": record.appliedTo ? 'bound' : 'unbound', className: "flex flex-wrap items-center gap-x-4 gap-y-2 border-b border-border/60 px-4 py-3 first:rounded-t-xl last:rounded-b-xl last:border-b-0", children: [_jsxs("dl", { className: "flex min-w-0 flex-1 basis-64 flex-wrap items-center gap-x-6 gap-y-2", children: [_jsx(KeyField, { label: "\u7528\u9014", className: "min-w-0 flex-1 basis-28", children: _jsx("span", { className: "block truncate text-sm font-medium text-foreground/90", title: label, children: label }) }), _jsx(KeyField, { label: "\u7ED1\u5B9A", className: "min-w-0 flex-1 basis-28", children: _jsxs("span", { className: "flex min-w-0 items-center gap-1.5 text-xs text-muted-foreground", children: [binding.clientId ? _jsx(AiClientIcon, { client: binding.clientId, className: "h-3.5 w-3.5" }) : null, _jsx("span", { className: "truncate", title: binding.label, children: binding.label })] }) }), _jsx(KeyField, { label: "\u6700\u540E\u4F7F\u7528", className: "shrink-0", children: _jsx("span", { className: "block text-xs text-muted-foreground", children: record.lastUsedAt ? formatTimestamp(record.lastUsedAt) : '暂无调用记录' }) })] }), destroyable ? (_jsxs(Button, { variant: "ghost", size: "sm", className: "h-8 shrink-0 gap-1.5 text-xs text-muted-foreground hover:text-destructive", "aria-label": `销毁 ${label}`, title: `销毁 ${label}`, disabled: busy, onClick: onDestroy, children: [_jsx(Trash2, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "\u9500\u6BC1"] })) : (_jsx("span", { className: "shrink-0 text-[11px] text-muted-foreground", children: "\u7F3A\u5C11 CSS \u51ED\u636E\u6807\u8BC6\uFF0C\u65E0\u6CD5\u5728\u6B64\u9500\u6BC1" }))] }));
+    return (_jsxs("li", { "data-key-id": record.id, "data-key-binding": record.appliedTo ? 'bound' : 'unbound', className: "flex flex-wrap items-center gap-x-4 gap-y-2 border-b border-border/60 px-4 py-3 first:rounded-t-xl last:rounded-b-xl last:border-b-0", children: [_jsxs("dl", { className: "flex min-w-0 flex-1 basis-64 flex-wrap items-center gap-x-6 gap-y-2", children: [_jsx(KeyField, { label: "\u7528\u9014", className: "min-w-0 flex-1 basis-28", children: _jsx("span", { className: "block truncate text-sm font-medium text-foreground/90", title: label, children: label }) }), _jsx(KeyField, { label: "\u7ED1\u5B9A", className: "min-w-0 flex-1 basis-28", children: _jsxs("span", { className: "flex min-w-0 items-center gap-1.5 text-xs text-muted-foreground", children: [binding.clientId ? _jsx(AiClientIcon, { client: binding.clientId, className: "h-3.5 w-3.5" }) : null, _jsx("span", { className: "truncate", title: binding.label, children: binding.label })] }) }), _jsx(KeyField, { label: "\u6700\u540E\u4F7F\u7528", className: "shrink-0", children: _jsx("span", { className: "block text-xs text-muted-foreground", children: record.lastUsedAt ? formatTimestamp(record.lastUsedAt) : '暂无调用记录' }) })] }), destroyable ? confirming ? (_jsxs("div", { "data-testid": "gateway-key-destroy-confirm", className: "mt-2 shrink-0 rounded-lg border border-destructive/40 bg-destructive/5 p-3 text-xs", children: [_jsx("p", { className: "text-foreground", children: "\u5220\u9664\u540E\uFF0C\u6B63\u5728\u4F7F\u7528\u8FD9\u4E2A Key \u7684\u5BA2\u6237\u7AEF\u4F1A\u7ACB\u5373\u5931\u6548\u3002Xpod \u76EE\u524D\u4E0D\u8BB0\u5F55 Key \u4E0E\u5BA2\u6237\u7AEF/\u7528\u9014\u7684\u5173\u8054\uFF0C \u56E0\u6B64\u65E0\u6CD5\u5217\u51FA\u53D7\u5F71\u54CD\u7684\u5BF9\u8C61\uFF1B\u8BF7\u5148\u786E\u8BA4\u6CA1\u6709\u5BA2\u6237\u7AEF\u5728\u7528\u3002\u66F4\u7A33\u59A5\u7684\u505A\u6CD5\u662F\u7ED9\u65B0\u5BA2\u6237\u7AEF\u5355\u72EC\u5EFA\u4E00\u4E2A Key\u3002" }), _jsxs("div", { className: "mt-2 flex flex-wrap gap-2", children: [_jsx(Button, { variant: "secondary", size: "sm", className: "h-8 text-xs", "aria-label": `确认删除 ${label}`, disabled: busy, onClick: onDestroy, children: "\u786E\u8BA4\u5220\u9664" }), _jsx(Button, { variant: "ghost", size: "sm", className: "h-8 text-xs", "aria-label": `取消删除 ${label}`, disabled: busy, onClick: onCancelDestroy, children: "\u53D6\u6D88" })] })] })) : (_jsxs(Button, { variant: "ghost", size: "sm", className: "h-8 shrink-0 gap-1.5 text-xs text-muted-foreground hover:text-destructive", "aria-label": `销毁 ${label}`, title: `销毁 ${label}`, disabled: busy, onClick: onRequestDestroy, children: [_jsx(Trash2, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "\u9500\u6BC1"] })) : (_jsx("span", { className: "shrink-0 text-[11px] text-muted-foreground", children: "\u7F3A\u5C11 CSS \u51ED\u636E\u6807\u8BC6\uFF0C\u65E0\u6CD5\u5728\u6B64\u9500\u6BC1" }))] }));
 }
 /** Where the credential is in effect: the client application and the device. */
 export function gatewayKeyBinding(record) {

package/node_modules/@undefineds.co/ai-connections/dist/AiGatewayKeysSection.js

@@ -31,6 +31,7 @@ const SELECT_CLASS = [
  */
 export function AiGatewayKeysSection({ client, clientConfigurationBridge, gatewayModels, modelSelection, liveRevision = 0, }) {
     const [keys, setKeys] = useState([]);
+    const [confirmingKeyId, setConfirmingKeyId] = useState(undefined);
     const [loading, setLoading] = useState(true);
     const [showCreate, setShowCreate] = useState(false);
     const [name, setName] = useState(DEFAULT_KEY_NAME);
@@ -224,7 +225,10 @@ export function AiGatewayKeysSection({ client, clientConfigurationBridge, gatewa
             setBusyKeyId(undefined);
         }
     };
-    return (_jsx(TooltipProvider, { children: _jsxs("section", { className: "space-y-8", "aria-label": "API Keys", children: [_jsx(AiProviderHeader, { name: "Xpod", mark: "XP", avatar: XPOD_AVATAR, infoLabel: "Xpod \u8BF4\u660E", infoLines: [XPOD_DESCRIPTION, XPOD_CREDENTIAL_NOTE], link: { href: client.apiBase, label: '访问 Xpod' }, badge: (_jsx(Badge, { variant: keys.length > 0 ? 'default' : 'secondary', children: keys.length > 0 ? `已签发 ${keys.length} 个` : '未配置' })) }), _jsxs("section", { className: "space-y-3", "aria-label": "\u5F53\u524D\u8FDE\u63A5", children: [_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2", children: [_jsxs("h3", { className: "flex items-center gap-2 text-sm font-medium text-foreground/90", children: [_jsx(Settings2, { "aria-hidden": "true", className: "h-4 w-4 text-primary" }), "\u5F53\u524D\u8FDE\u63A5"] }), _jsx("div", { className: "flex flex-wrap items-center justify-end gap-2", children: _jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", "aria-label": "\u65B0\u5EFA API Key", disabled: creating || loading, onClick: openCreate, children: [_jsx(Plus, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "API Key"] }) })] }), loading ? (_jsxs("div", { className: "flex items-center gap-2 py-6 text-sm text-muted-foreground", children: [_jsx(Loader2, { "aria-hidden": "true", className: "h-4 w-4 animate-spin" }), "\u6B63\u5728\u8BFB\u53D6 API Key"] })) : keys.length === 0 ? (_jsx("p", { className: "py-2 text-xs text-muted-foreground", children: "\u5C1A\u672A\u7B7E\u53D1 API Key" })) : (_jsx("ul", { "aria-label": "API Key \u5217\u8868", className: "rounded-xl border border-border/70", children: keys.map((record) => (_jsx(AiGatewayKeyRow, { record: record, busy: Boolean(busyKeyId), onDestroy: () => void destroy(record) }, record.id))) })), _jsxs("details", { className: "text-xs text-muted-foreground", children: [_jsx("summary", { className: "w-fit cursor-pointer", children: "\u63A5\u5165\u4FE1\u606F" }), _jsx("div", { className: "mt-2 space-y-3", children: _jsxs("section", { className: "space-y-2", "aria-labelledby": "xpod-access-info", children: [_jsx("h4", { id: "xpod-access-info", className: "text-sm font-medium text-foreground", children: "Xpod \u63A5\u5165\u4FE1\u606F" }), _jsx("p", { className: "text-xs text-muted-foreground", children: "API Key \u662F\u7B7E\u53D1\u7ED9\u5BA2\u6237\u7AEF\u5E94\u7528\u7684 CSS \u5BA2\u6237\u7AEF\u51ED\u636E\uFF1BPod \u53EA\u8BB0\u5F55\u5B83\u7ED1\u5B9A\u5230\u54EA\u4E2A\u5BA2\u6237\u7AEF\uFF0C\u4E0D\u4FDD\u5B58 Key \u660E\u6587\u3002" }), _jsx("p", { className: "text-xs text-muted-foreground", children: "\u540C\u4E00\u4E2A API Key \u652F\u6301\u4EE5\u4E0B\u517C\u5BB9\u534F\u8BAE\uFF0C\u6309\u5BA2\u6237\u7AEF\u9009\u62E9\u5E76\u590D\u5236\u5BF9\u5E94\u5730\u5740\uFF1A" }), _jsx(AiEndpointList, { endpoints: xpodProtocolEndpoints(client.apiBase), copy: true, display: "protocol" })] }) })] })] }), _jsx(AiGatewayModelsSection, { models: gatewayModels, selection: modelSelection }), _jsx(Dialog, { open: showCreate, onOpenChange: (open) => { if (!open && (creating || applying))
+    return (_jsx(TooltipProvider, { children: _jsxs("section", { className: "space-y-8", "aria-label": "API Keys", children: [_jsx(AiProviderHeader, { name: "Xpod", mark: "XP", avatar: XPOD_AVATAR, infoLabel: "Xpod \u8BF4\u660E", infoLines: [XPOD_DESCRIPTION, XPOD_CREDENTIAL_NOTE], link: { href: client.apiBase, label: '访问 Xpod' }, badge: (_jsx(Badge, { variant: keys.length > 0 ? 'default' : 'secondary', children: keys.length > 0 ? `已签发 ${keys.length} 个` : '未配置' })) }), _jsxs("section", { className: "space-y-3", "aria-label": "\u5F53\u524D\u8FDE\u63A5", children: [_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2", children: [_jsxs("h3", { className: "flex items-center gap-2 text-sm font-medium text-foreground/90", children: [_jsx(Settings2, { "aria-hidden": "true", className: "h-4 w-4 text-primary" }), "\u5F53\u524D\u8FDE\u63A5"] }), _jsx("div", { className: "flex flex-wrap items-center justify-end gap-2", children: _jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", "aria-label": "\u65B0\u5EFA API Key", disabled: creating || loading, onClick: openCreate, children: [_jsx(Plus, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "API Key"] }) })] }), loading ? (_jsxs("div", { className: "flex items-center gap-2 py-6 text-sm text-muted-foreground", children: [_jsx(Loader2, { "aria-hidden": "true", className: "h-4 w-4 animate-spin" }), "\u6B63\u5728\u8BFB\u53D6 API Key"] })) : keys.length === 0 ? (_jsx("p", { className: "py-2 text-xs text-muted-foreground", children: "\u5C1A\u672A\u7B7E\u53D1 API Key" })) : (_jsx("ul", { "aria-label": "API Key \u5217\u8868", className: "rounded-xl border border-border/70", children: keys.map((record) => (_jsx(AiGatewayKeyRow, { record: record, busy: Boolean(busyKeyId), confirming: confirmingKeyId === record.id, onRequestDestroy: () => setConfirmingKeyId(record.id), onCancelDestroy: () => setConfirmingKeyId((current) => (current === record.id ? undefined : current)), onDestroy: () => {
+                                    setConfirmingKeyId(undefined);
+                                    void destroy(record);
+                                } }, record.id))) })), _jsxs("details", { className: "text-xs text-muted-foreground", children: [_jsx("summary", { className: "w-fit cursor-pointer", children: "\u63A5\u5165\u4FE1\u606F" }), _jsx("div", { className: "mt-2 space-y-3", children: _jsxs("section", { className: "space-y-2", "aria-labelledby": "xpod-access-info", children: [_jsx("h4", { id: "xpod-access-info", className: "text-sm font-medium text-foreground", children: "Xpod \u63A5\u5165\u4FE1\u606F" }), _jsx("p", { className: "text-xs text-muted-foreground", children: "API Key \u662F\u7B7E\u53D1\u7ED9\u5BA2\u6237\u7AEF\u5E94\u7528\u7684 CSS \u5BA2\u6237\u7AEF\u51ED\u636E\uFF1BPod \u53EA\u8BB0\u5F55\u5B83\u7ED1\u5B9A\u5230\u54EA\u4E2A\u5BA2\u6237\u7AEF\uFF0C\u4E0D\u4FDD\u5B58 Key \u660E\u6587\u3002" }), _jsx("p", { className: "text-xs text-muted-foreground", children: "\u540C\u4E00\u4E2A API Key \u652F\u6301\u4EE5\u4E0B\u517C\u5BB9\u534F\u8BAE\uFF0C\u6309\u5BA2\u6237\u7AEF\u9009\u62E9\u5E76\u590D\u5236\u5BF9\u5E94\u5730\u5740\uFF1A" }), _jsx(AiEndpointList, { endpoints: xpodProtocolEndpoints(client.apiBase), copy: true, display: "protocol" })] }) })] })] }), _jsx(AiGatewayModelsSection, { models: gatewayModels, selection: modelSelection }), _jsx(Dialog, { open: showCreate, onOpenChange: (open) => { if (!open && (creating || applying))
                         return; setShowCreate(open); }, children: _jsxs(DialogContent, { className: "sm:max-w-md", "aria-describedby": undefined, children: [_jsx(DialogHeader, { children: _jsx(DialogTitle, { children: issued ? 'API Key 已签发' : '新建 API Key' }) }), issued && issuedClient ? (_jsxs("div", { className: "space-y-5", children: [_jsxs("div", { className: "space-y-1.5", children: [_jsxs("p", { className: "text-sm", children: ["\u5DF2\u7B7E\u53D1\u300C", issued.name || '未命名 API Key', "\u300D\uFF0C\u7528\u9014\uFF1A", AI_CLIENT_LABELS[issuedClient], "\u3002"] }), _jsx("p", { className: "text-xs text-muted-foreground", children: "Xpod \u4E0D\u4FDD\u5B58 Key \u660E\u6587\uFF0C\u8BF7\u7ACB\u5373\u590D\u5236\u6216\u76F4\u63A5\u5E94\u7528\u5230\u5BA2\u6237\u7AEF\uFF1B\u79BB\u5F00\u672C\u6B21\u4F1A\u8BDD\u540E\u65E0\u6CD5\u518D\u6B21\u83B7\u53D6\u3002" })] }), issued.maskedHint ? (_jsx("code", { className: "block truncate rounded-md border border-border/60 bg-muted/30 px-3 py-2 font-mono text-xs text-muted-foreground", children: issued.maskedHint })) : null, !clientConfigurationBridge ? (_jsx("p", { className: "text-xs text-muted-foreground", children: "\u5F53\u524D Web \u73AF\u5883\u65E0\u6CD5\u81EA\u52A8\u5199\u5165\u5BA2\u6237\u7AEF\u914D\u7F6E\uFF0C\u8BF7\u590D\u5236\u540E\u624B\u52A8\u7C98\u8D34\uFF1B\u81EA\u52A8\u5E94\u7528\u9700\u8981\u672C\u673A\u8FDE\u63A5\u3002" })) : null, error ? _jsx("p", { role: "alert", className: "text-sm text-destructive", children: error }) : null, _jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [_jsx(AiCopyButton, { value: () => sessionPlaintext(issued, UNPERSISTED_COPY_MESSAGE), label: "API Key", text: "\u590D\u5236 API Key", disabled: applying, iconClassName: "mr-1.5 h-3.5 w-3.5", copiedIconClassName: "mr-1.5 h-3.5 w-3.5 text-emerald-600", onError: (cause) => setError(errorMessage(cause)) }), _jsx(AiCopyButton, { value: () => manualConfigurationText(issuedClient, client.apiBase, sessionPlaintext(issued, UNPERSISTED_COPY_MESSAGE)), label: `${AI_CLIENT_LABELS[issuedClient]} 配置`, text: `复制 ${AI_CLIENT_LABELS[issuedClient]} 配置`, disabled: applying, iconClassName: "mr-1.5 h-3.5 w-3.5", copiedIconClassName: "mr-1.5 h-3.5 w-3.5 text-emerald-600", onError: (cause) => setError(errorMessage(cause)) }), clientConfigurationBridge ? (appliedClient ? (_jsxs("span", { role: "status", className: "inline-flex items-center gap-1 text-xs text-muted-foreground", children: [_jsx(Check, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "\u5DF2\u5E94\u7528\u5230 ", AI_CLIENT_LABELS[appliedClient]] })) : (_jsxs(Button, { type: "button", size: "sm", disabled: applying, "aria-label": `应用到 ${AI_CLIENT_LABELS[issuedClient]}`, onClick: () => void apply(), children: [applying ? _jsx(Loader2, { "aria-hidden": "true", className: "mr-2 h-4 w-4 animate-spin" }) : null, applying ? '正在应用…' : `应用到 ${AI_CLIENT_LABELS[issuedClient]}`] }))) : null] }), _jsxs(DialogFooter, { children: [_jsx(Button, { type: "button", variant: "ghost", disabled: applying, onClick: beginAnother, children: "\u518D\u5EFA\u4E00\u4E2A" }), _jsx(Button, { type: "button", variant: "outline", onClick: () => setShowCreate(false), children: "\u5B8C\u6210" })] })] })) : (_jsxs("form", { className: "space-y-5", onSubmit: (event) => { event.preventDefault(); if (!creating)
                                     void create(); }, children: [_jsxs("label", { className: "block space-y-2", children: [_jsx("span", { className: "text-sm font-medium", children: "\u540D\u79F0" }), _jsx(Input, { autoFocus: true, "aria-label": "API Key \u540D\u79F0", value: name, disabled: creating, onChange: (event) => setName(event.target.value) })] }), _jsxs("label", { className: "block space-y-2", children: [_jsx("span", { className: "text-sm font-medium", children: "\u7528\u9014" }), _jsxs("select", { "aria-label": "API Key \u7528\u9014", className: SELECT_CLASS, value: purpose, disabled: creating, onChange: (event) => setPurpose(event.target.value), children: [_jsx("option", { value: "", disabled: true, children: "\u9009\u62E9\u5BA2\u6237\u7AEF\u5E94\u7528" }), AI_CONNECTIONS_CLIENTS.map((clientId) => (_jsx("option", { value: clientId, children: AI_CLIENT_LABELS[clientId] }, clientId)))] })] }), _jsx("p", { className: "text-xs text-muted-foreground", children: "\u7528\u9014\u5728\u521B\u5EFA\u65F6\u786E\u5B9A\uFF0CKey \u4F1A\u7ED1\u5B9A\u5230\u8BE5\u5BA2\u6237\u7AEF\u5E94\u7528\u3002" }), error ? _jsx("p", { role: "alert", className: "text-sm text-destructive", children: error }) : null, _jsxs(DialogFooter, { children: [_jsx(Button, { type: "button", variant: "outline", disabled: creating, onClick: () => setShowCreate(false), children: "\u53D6\u6D88" }), _jsxs(Button, { type: "submit", "aria-label": "\u521B\u5EFA API Key", disabled: creating || !name.trim() || !purpose, children: [creating ? _jsx(Loader2, { "aria-hidden": "true", className: "mr-2 h-4 w-4 animate-spin" }) : null, creating ? '正在创建…' : '创建 API Key'] })] })] }))] }) })] }) }));
 }

package/node_modules/@undefineds.co/ai-connections/dist/controller.d.ts

@@ -25,6 +25,10 @@ export interface AiProviderDefinition {
 export declare const PROVIDERS: AiProviderDefinition[];
 export type ProviderProductState = 'loading' | 'unconfigured' | 'configured' | 'connected' | 'attention';
 export declare const AI_CONNECTIONS_PINNED_SECTIONS: readonly [{
+    readonly id: "clients";
+    readonly label: "连接客户端";
+    readonly title: "CONNECT CLIENT";
+}, {
     readonly id: "keys";
     readonly label: "Xpod";
     readonly title: "API KEYS";

package/node_modules/@undefineds.co/ai-connections/dist/controller.js

@@ -23,6 +23,8 @@ export const PROVIDERS = [
     { id: 'custom', name: 'Custom', description: '任意 OpenAI 或 Anthropic 兼容服务，自填地址与 API Key。', homeUrl: 'https://undefineds.co', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://example.com/v1' },
 ];
 export const AI_CONNECTIONS_PINNED_SECTIONS = [
+    // §7.3：入口以"把客户端接上"的任务开场，密钥管理紧随其后
+    { id: 'clients', label: '连接客户端', title: 'CONNECT CLIENT' },
     { id: 'keys', label: 'Xpod', title: 'API KEYS' },
 ];
 /**
@@ -125,7 +127,7 @@ export function createAiConnectionsController(host) {
             authenticatedFetch: host.solid.session.fetch,
         }), host.capabilities.aiClientCredentials), host.capabilities.aiConnectionsPodStore, liveCredentials, beginProviderLoad)
         : null;
-    let selectedSection = 'keys';
+    let selectedSection = 'clients';
     let selectedProvider = 'openai';
     let selectedCredentialId;
     let searchQuery = '';