dsh-calibguard 0.3.5 → 0.3.6

package/README.en.md

@@ -4,7 +4,7 @@ English | [中文](README.md)
 
 ![license](https://img.shields.io/badge/license-MIT-green)
 ![node](https://img.shields.io/badge/node-%E2%89%A520-blue)
-![tests](https://img.shields.io/badge/tests-103%20passed-brightgreen)
+![tests](https://img.shields.io/badge/tests-105%20passed-brightgreen)
 [![npm](https://img.shields.io/npm/v/dsh-calibguard.svg)](https://www.npmjs.com/package/dsh-calibguard)
 
 Plugs the [CalibGuard](https://github.com/P-436/CG) file-security auditing engine into
@@ -228,10 +228,11 @@ After pressing Save:
 - **the AI uses the same values** (precedence: plugin config < shared settings < per-call options);
 - changes take effect immediately, no restart;
 - the API key goes into the DSH credential store (`ctx.credentials`), not into that settings file;
-- the **credential name** is only the name of the storage slot (not the secret): fill it in the panel
-  (e.g. `DEEPSEEK_API_KEY`) together with the API key; the name is remembered in shared settings
-  (`credentialRef`) and the value is written to the DSH credential store. Leave it empty to use the
-  plugin config `credentialRef`;
+- the **credential name** is only the name of the storage slot (not the secret; pre-filled as
+  `DEEPSEEK_API_KEY`): fill in the API key and save; the name is remembered in shared settings
+  (`credentialRef`) and the value goes to the DSH credential store first. **If the current DSH version
+  cannot be written from a plugin, the key is stored in the local `~/.dsh/calibguard-credentials.json`
+  (0600, this machine only)** and the panel tells you where it landed;
 - **audit results**: every audit writes JSON + Markdown into the engine's `reports/` directory
   (default `<engineRoot>/reports`, `engineRoot` defaults to `~/.dsh/calibguard-engine`). The panel shows
   that path, has a "clear results" button, and each item links to its Markdown report.
@@ -277,7 +278,8 @@ Common keys of the loader row `config` (full table: [docs/configuration.md](docs
 | First audit is slow | Normal: ~475 MB of weights are loaded once (then the process stays resident) |
 | Big file takes tens of seconds | Normal: full-text sliding-window inference; see [docs/performance.md](docs/performance.md) |
 | Gray zone always goes to manual review | No credential configured: save "credential name + API key" in the panel, or set `credentialRef`, or configure it in DSH Models |
-| **Panel says "credentialRef required" when saving the API key** | Upgrade to ≥ **0.3.3**: the panel has a "credential name" field and remembers it (no plugin config edit needed); older versions require `credentialRef` in the plugin config |
+| **Panel says "credentialRef required" when saving the API key** | Upgrade to ≥ **0.3.3**: the panel has a "credential name" field (defaults to `DEEPSEEK_API_KEY`) and remembers it; older versions require `credentialRef` in the plugin config |
+| **"This environment does not support writing the DSH credential store"** | Since 0.3.6 the key automatically falls back to the local `~/.dsh/calibguard-credentials.json` (0600) and the panel shows the storage location; you can also configure it in the DSH Models page, or use plugin config `llmApiKey` (not recommended) |
 | **Where are audit results saved / how to clear them** | In the engine's `reports/` directory (default `<engineRoot>/reports`): JSON + Markdown per audit. The panel shows the path and has a "clear results" button; AI tools return `report_md_path` / `report_json_path` |
 | **"First audit will load the model" hint shows every time** | Since 0.3.3 it is only shown while the model is not loaded yet; afterwards the button just says "auditing…" and the header shows "model loaded" |
 | **NVIDIA GPU (e.g. RTX 2060) but the engine keeps using CPU** | The installed torch is the CPU build (old installer behavior). Upgrade to ≥0.3.3 (the panel will tell you) and run `node setup.mjs --reinstall-torch` (~2.5 GB) in the plugin directory, then restart DSH |
@@ -299,7 +301,7 @@ dsh-CalibGuard/
 ├── engine/              Bundled engine core copied from CG_GUI (code / tokenizer / calibration, no weights)
 ├── cordis.patch.yml     Bundle patch (inserts the loader row)
 ├── scripts/             link-dsh (dev-time junction), bridge-selftest (engine self-check)
-├── test/                node --test (103 cases; auto-skip when the engine env is missing)
+├── test/                node --test (105 cases; auto-skip when the engine env is missing)
 ├── .github/workflows/   publish.yml: npm trusted publishing (OIDC, optional)
 └── docs/                configuration, performance, troubleshooting, plugin contract, design notes
 ```

package/README.md

@@ -4,7 +4,7 @@
 
 ![license](https://img.shields.io/badge/license-MIT-green)
 ![node](https://img.shields.io/badge/node-%E2%89%A520-blue)
-![tests](https://img.shields.io/badge/tests-103%20passed-brightgreen)
+![tests](https://img.shields.io/badge/tests-105%20passed-brightgreen)
 [![npm](https://img.shields.io/npm/v/dsh-calibguard.svg)](https://www.npmjs.com/package/dsh-calibguard)
 
 把 [CalibGuard](https://github.com/P-436/CG) 的文件安全审计引擎接进 **DeepSeek Harness（DSH）**：
@@ -217,8 +217,9 @@ AI 能看到完整四档结论与证据；若你说「只审高危文件」，
 - **AI 调用同样使用这份设置**（优先级：插件配置 < 共享设置 < 本次调用参数）；
 - 改完立即生效，**不用重启**；
 - API Key 写入 DSH 凭据库（`ctx.credentials`），不落入该设置文件；
-- **凭据名**只是"保存位置"的名字（不是密钥本身）：面板里填（如 `DEEPSEEK_API_KEY`）+ API Key，
-  保存后名字记进共享设置的 `credentialRef`，值写进 DSH 凭据库；留空则用插件配置里的 `credentialRef`；
+- **凭据名**只是"保存位置"的名字（不是密钥本身，面板默认预填 `DEEPSEEK_API_KEY`）：填 API Key 保存后，
+  名字记进共享设置的 `credentialRef`，值优先写入 DSH 凭据库；**当前 DSH 版本不支持从插件写凭据库时，
+  自动保存到本机 `~/.dsh/calibguard-credentials.json`（0600，仅本机）**，面板会明确提示存储位置；
 - **审计结果**：每次审计在引擎的 `reports/` 目录生成 JSON + Markdown（默认 `<engineRoot>/reports`，
   `engineRoot` 默认 `~/.dsh/calibguard-engine`）。面板结果区会显示该路径并可「清空结果」，
   条目里的「查看 Markdown 报告」可直接打开。
@@ -262,7 +263,8 @@ AI 能看到完整四档结论与证据；若你说「只审高危文件」，
 | 侧边栏没有图标 / 面板报 `not found` | 客户端与路由在宿主启动时加载：**重启 DSH** |
 | **首次运行要等十几分钟** | 正常：首次下载模型（约 442 MB，自动镜像回退）并安装依赖（1–3 GB）；面板顶部有进度卡片，只需一次 |
 | 首次审计很慢 | 正常：要加载约 475 MB 权重（之后走常驻进程） |
-| **面板保存 API Key 提示"需要 credentialRef"** | 升级到 ≥ **0.3.3**：面板「凭据名」可直接填写并记住（不用改插件配置）；旧版本请把 `credentialRef` 写进插件配置 |
+| **面板保存 API Key 提示"需要 credentialRef"** | 升级到 ≥ **0.3.3**：面板「凭据名」可直接填写并记住（默认预填 `DEEPSEEK_API_KEY`）；旧版本请把 `credentialRef` 写进插件配置 |
+| **提示"当前环境不支持写入 DSH 凭据库"** | ≥0.3.6 起会自动回退到本机凭据文件 `~/.dsh/calibguard-credentials.json`（0600），面板会显示存储位置；想改回凭据库时在 DSH Models 页配置即可。也可用插件配置 `llmApiKey`（不推荐） |
 | **审计结果保存在哪 / 想清空** | 保存在引擎 `reports/` 目录（默认 `<engineRoot>/reports`），每次审计生成 JSON + Markdown；面板结果区显示路径并带「清空结果」按钮；AI 工具返回 `report_md_path` / `report_json_path` |
 | **审计时总提示"首次会加载模型"** | 0.3.3 起只在模型尚未加载时提示；加载后按钮只显示「审计中…」，顶部状态显示「模型 已加载」 |
 | **有 NVIDIA 显卡（如 RTX 2060）但一直显示 CPU** | 说明装的是 CPU 版 torch（旧版安装器行为）。升级到 ≥0.3.3 后面板会给出提示；在插件目录运行 `node setup.mjs --reinstall-torch`（约 2.5 GB）装上 CUDA 版即可，之后重启 DSH |
@@ -286,7 +288,7 @@ dsh-CalibGuard/
 ├── engine/              从 CG_GUI 复制来的引擎核心（代码/词表/校准参数，不含 475 MB 权重）
 ├── cordis.patch.yml     组合包 patch（把插件行插进 profile 配置树）
 ├── scripts/             link-dsh（开发期挂包）、bridge-selftest（引擎自检）
-├── test/                node --test（103 个用例；缺引擎环境时自动 skip）
+├── test/                node --test（105 个用例；缺引擎环境时自动 skip）
 ├── .github/workflows/   publish.yml：npm 可信发布（OIDC，可选）
 └── docs/                配置全表、性能、排错、插件契约、实现决策
 ```

package/docs/configuration.md

@@ -46,11 +46,14 @@
 
 ## 三、云端复核的 Key 从哪来（不硬编码、不隐式继承）
 
-1. `credentialRef`（推荐；插件配置或面板「凭据名」两者取其一）→ `ctx.credentials.resolve(ref)`，优先级
-   **继承环境 > `~/.dsh/.credentials.yaml` > `<cwd>/.env` > `$DSH_HOME/.env`**；
+1. `credentialRef`（推荐；插件配置或面板「凭据名」两者取其一，面板默认 `DEEPSEEK_API_KEY`）→
+   `ctx.credentials.resolve(ref)`，优先级 **继承环境 > `~/.dsh/.credentials.yaml` > `<cwd>/.env` > `$DSH_HOME/.env`**；
    解析到的值随请求走 **stdin** 下发，**不进 argv、不进子进程环境变量**，且每次操作重新解析（换 Key 下一次审计即生效）。
 2. `llmApiKey`（字面值，次选）。
-3. `CG_GUI/gui-settings.json` 里的 `deepseek_api_key`（`useGuiSettings: true` 时生效）。
+3. 同名环境变量（名字来自 `credentialRef`）；
+4. 本地凭据回退文件 `$DSH_HOME/calibguard-credentials.json`（面板保存时若 DSH 版本不支持写凭据库，
+   会自动写到这里；仅本机、权限 0600，值不落共享设置文件）；
+5. `CG_GUI/gui-settings.json` 里的 `deepseek_api_key`（`useGuiSettings: true` 时生效）。
 
 三者都没有 → 云端复核不可用、灰区转人工（安全降级）。桥接子进程**不会**去读宿主的
 `DEEPSEEK_API_KEY`：它的环境已按 DSH 的 `scrubbedParentEnv` 清洗（`*KEY*` / `*PASSWORD*` /

package/docs/troubleshooting.md

@@ -9,6 +9,7 @@
 | 每份文件都 `manual_review` + `CUDA error: no kernel image` | 设备定档失效：确认 `device` 未被强制成 `cuda` |
 | 灰区全部转人工、`llm.status=api_error` | 没配凭据（预期降级）→ 设 `credentialRef`（推荐）或在 DSH Models 页配置 |
 | `凭据引用 X 未配置` 告警 | `credentialRef` 指向的引用在 DSH 凭据库里没有值；在 Models 页填 Key 或用 `llmApiKey` |
+| **提示"当前环境不支持写入 DSH 凭据库"** | ≥0.3.6 会自动回退到 `~/.dsh/calibguard-credentials.json`（0600，仅本机），面板会显示存储位置；清空即删该文件或到 DSH Models 页重新配置 |
 | **面板保存 API Key 报「需要 credentialRef」** | 升级到 ≥0.3.3：面板「凭据名」直接填（如 `DEEPSEEK_API_KEY`）并保存，会记进共享设置；旧版本只能把 `credentialRef` 写进插件配置 |
 | **审计结果在哪里 / 怎么清空** | 引擎 `reports/` 目录（默认 `<engineRoot>/reports`）：每次审计生成 JSON + Markdown；面板结果区显示路径并有「清空结果」，工具返回 `report_md_path` / `report_json_path` |
 | **每次审计都提示"首次会加载模型"** | 0.3.3 起仅在模型未加载时提示；加载后不再出现，顶部状态显示「模型 已加载」 |

package/lib/client.js

@@ -406,7 +406,7 @@ window.__ModuleLoader__.load({
           writable: Boolean(payload && payload.credentialWritable),
           configured: Boolean(llm.configured),
         })
-        setCredName(function (prev) { return prev || (payload && payload.credentialRef) || '' })
+        setCredName(function (prev) { return prev || (payload && payload.credentialRef) || 'DEEPSEEK_API_KEY' })
         setForm(function (current) {
           var next = update(current, 'llmEnabled', llm.enabled !== false)
           next = update(next, 'allowThreshold', gate.allowThreshold !== undefined ? gate.allowThreshold : current.allowThreshold)
@@ -490,7 +490,11 @@ window.__ModuleLoader__.load({
           }).then(function (outcome) {
             setApiKey('')
             if (outcome && outcome.credentialRef) setCredName(outcome.credentialRef)
-            setSettingsMsg('已保存 ✓ 参数共用；API Key 已写入 DSH 凭据库（' + ((outcome && outcome.credentialRef) || credentialName) + '）')
+            var storage = outcome && outcome.credentialStorage
+            setSettingsMsg(storage === 'local-file'
+              ? '已保存 ✓ 参数共用；当前 DSH 版本不支持从插件写入凭据库，API Key 已保存到本机文件 '
+                + '（~/.dsh/calibguard-credentials.json，仅本机可见）'
+              : '已保存 ✓ 参数共用；API Key 已写入 DSH 凭据库（' + ((outcome && outcome.credentialRef) || credentialName) + '）')
             refreshStatus()
             loadSettings()
           }).catch(function (err) {
@@ -631,6 +635,7 @@ window.__ModuleLoader__.load({
 
       var envInfo = status && status.environment ? status.environment : null
       var engineInfo = status && status.status ? status.status : null
+      var envPreparing = Boolean(envInfo) && !engineInfo && envInfo.state !== 'failed'
       var reportDir = (engineInfo && engineInfo.reportDir)
         || (status && status.settings && status.settings.reportDir)
         || (result && result.config && result.config.reportDir)
@@ -657,8 +662,16 @@ window.__ModuleLoader__.load({
           + ' ｜ 云端复核 ' + (engineInfo.llm.enabled ? (engineInfo.llm.configured ? '可用' : '已启用但无凭据') : '关闭')
         : (envFailed ? '环境准备失败' : (envBusy ? '首次运行：正在准备引擎与依赖…' : '状态读取中…'))
 
-      return jsx('div', {
-        style: S.page,
+      // 环境准备中自动刷新（装完后无需手动点「刷新状态」）
+      useEffect(function () {
+        if (!envPreparing) return undefined
+        var timer = setInterval(refreshStatus, 4000)
+        return function () { clearInterval(timer) }
+      }, [envPreparing])
+
+      function renderPage() {
+        return jsx('div', {
+          style: S.page,
         children: jsxs(Fragment, {
           children: [
             // ---------- 顶部 ----------
@@ -706,7 +719,10 @@ window.__ModuleLoader__.load({
                     ],
                   }),
                   torchState === 'done'
-                    ? jsx('div', { style: { color: C.allow, fontSize: 12, marginTop: 6 }, children: torchMsg || 'torch 重装完成（如仍显示 CPU，点「刷新状态」）' })
+                    ? jsx('div', {
+                      style: { color: C.allow, fontSize: 12, marginTop: 6 },
+                      children: 'torch 重装完成（面板已自动刷新；若顶部仍显示 CPU，点「刷新状态」或重启 DSH 即可）',
+                    })
                     : null,
                   torchState === 'failed'
                     ? jsx('div', {
@@ -1023,7 +1039,8 @@ window.__ModuleLoader__.load({
                   style: S.note,
                   children: '设置保存在本地 ' + (settingsFile || '$DSH_HOME/calibguard-settings.json')
                     + '（GUI 与 AI 工具共用）；API Key 写入 DSH 凭据库，不落此文件。'
-                    + '「凭据名」只是保存位置的名字（可留空=用插件配置 credentialRef）；'
+                    + '「凭据名」只是保存位置的名字（默认 DEEPSEEK_API_KEY，也会记住你填的名字）；'
+                    + 'API Key 优先写 DSH 凭据库，当前 DSH 版本不支持时自动保存到本机文件。'
                     + '审计结果（JSON + Markdown）保存在引擎的 reports 目录，见下方「审计结果」。',
                 }),
                 jsxs('div', {
@@ -1195,6 +1212,9 @@ window.__ModuleLoader__.load({
           ],
         }),
       })
+      }
+
+      return renderPage()
     }
 
     // ============================== 插件入口 ==============================

package/lib/engine.js

@@ -22,13 +22,14 @@
  * stdin 管道关闭 → 桥接读到 EOF 自行退出，不留孤儿进程。
  */
 import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { join } from 'node:path'
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { buildChildEnv } from './env.js'
 import { toBridgeOptions } from './config.js'
 import { EnvironmentBootstrap, venvPythonPath } from './bootstrap.js'
+import { dshHome } from './settings.js'
 
 /** 桥接脚本相对本文件的位置（spawn 需要真实路径，不能直接把 URL 对象交给子进程）。 */
 const BRIDGE_SCRIPT = fileURLToPath(new URL('../bridge/calibguard_bridge.py', import.meta.url))
@@ -44,6 +45,38 @@ const ENV_WAIT_MS = 60_000
 /** stderr 环形缓冲行数：崩溃时把最后几行回给调用方，便于定位。 */
 const STDERR_TAIL_LINES = 20
 
+/**
+ * 本地凭据回退文件：某些 DSH 版本的 ctx.credentials 没有 「set」（无法从插件写入凭据库），
+ * 此时把 Key 写到 $DSH_HOME/calibguard-credentials.json（仅本机、权限尽量收紧），
+ * 避免「面板根本配不了 Key」。优先仍走 DSH 凭据库；文件只是兼容兜底。
+ */
+function localCredentialFile() {
+  return join(dshHome(), 'calibguard-credentials.json')
+}
+
+function readLocalCredentials() {
+  try {
+    const raw = JSON.parse(readFileSync(localCredentialFile(), 'utf8'))
+    return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {}
+  } catch {
+    return {}
+  }
+}
+
+function readLocalCredential(ref) {
+  const value = readLocalCredentials()[ref]
+  return typeof value === 'string' && value ? value : undefined
+}
+
+function writeLocalCredential(ref, value) {
+  const file = localCredentialFile()
+  const data = { ...readLocalCredentials(), [ref]: value }
+  mkdirSync(dirname(file), { recursive: true })
+  writeFileSync(file, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
+  try { chmodSync(file, 0o600) } catch { /* Windows 上可能不支持，忽略 */ }
+  return file
+}
+
 export class CalibGuardEngine {
   /**
    * @param {object} options
@@ -161,22 +194,19 @@ export class CalibGuardEngine {
     const ref = this.effectiveCredentialRef()
     if (!ref) {
       this.lastCredential = { source: 'none', configured: false }
-    /** 面板「重装 torch」任务状态（CPU 版 → GPU 版一键替换用）。 */
-    this.torchJob = { state: 'idle', step: '', message: '', tail: [], startedAt: null, finishedAt: null, error: null }
-    this.torchChild = null
       return { key: undefined, source: 'none' }
     }
 
+    let lookedUpInStore = false
     if (this.credentials?.resolve) {
+      lookedUpInStore = true
       try {
         const resolved = await this.credentials.resolve(ref)
         if (resolved?.value) {
           this.lastCredential = { source: `credentials:${resolved.source ?? 'unknown'}`, configured: true }
           return { key: resolved.value, source: this.lastCredential.source }
         }
-        this.logger?.warn?.(`[calibguard] 凭据引用 ${ref} 未配置（credentialRef），云端复核将不可用`)
-        this.lastCredential = { source: 'credentials:missing', configured: false }
-        return { key: undefined, source: this.lastCredential.source }
+        this.logger?.warn?.(`[calibguard] 凭据引用 ${ref} 未在 DSH 凭据库中找到，继续尝试环境变量/本地凭据文件`)
       } catch (error) {
         this.logger?.warn?.(`[calibguard] 解析凭据 ${ref} 失败：${error?.message ?? error}`)
       }
@@ -188,8 +218,16 @@ export class CalibGuardEngine {
       this.lastCredential = { source: `env:${ref}`, configured: true }
       return { key: fromEnv, source: this.lastCredential.source }
     }
-    this.lastCredential = { source: 'unavailable', configured: false }
-    return { key: undefined, source: 'unavailable' }
+
+    // 最后兜底：插件自己写的本地凭据文件（DSH 版本不支持从插件写凭据库时用）
+    const fromLocal = readLocalCredential(ref)
+    if (fromLocal) {
+      this.lastCredential = { source: 'local-file', configured: true }
+      return { key: fromLocal, source: 'local-file' }
+    }
+
+    this.lastCredential = { source: lookedUpInStore ? 'credentials:missing' : 'unavailable', configured: false }
+    return { key: undefined, source: this.lastCredential.source }
   }
 
   /**
@@ -212,10 +250,20 @@ export class CalibGuardEngine {
       throw new Error('还没有凭据名：请在面板「凭据名」里填一个（如 DEEPSEEK_API_KEY），'
         + '或在插件配置里设置 credentialRef。凭据名不是密钥本身，只是"保存位置"的名字。')
     }
-    if (typeof this.credentials?.set !== 'function') {
-      throw new Error('当前环境不支持写入 DSH 凭据库：请在 DSH Models 页配置 Key，或用插件配置 llmApiKey')
+    // 优先写入 DSH 凭据库；当前 DSH 版本不支持时，退化为本地凭据文件（仅本机、0600）
+    let storage = 'dsh-credentials'
+    if (typeof this.credentials?.set === 'function') {
+      try {
+        await this.credentials.set(ref, value.trim())
+      } catch (error) {
+        this.logger?.warn?.(`[calibguard] 写入 DSH 凭据库失败（${error?.message ?? error}），改用本地凭据文件`)
+        storage = 'local-file'
+        writeLocalCredential(ref, value.trim())
+      }
+    } else {
+      storage = 'local-file'
+      writeLocalCredential(ref, value.trim())
     }
-    await this.credentials.set(ref, value.trim())
     // 记住这个名字（只存名字，不存密钥），下次启动后审计仍能找到它
     if (this.settingsStore) {
       try {
@@ -224,9 +272,9 @@ export class CalibGuardEngine {
         this.logger?.warn?.(`[calibguard] 记住凭据名失败（不影响本次写入）：${error?.message ?? error}`)
       }
     }
-    this.lastCredential = { source: 'credentials:set', configured: true }
-    this.logger?.info?.(`[calibguard] 已写入凭据引用 ${ref}（值不落日志）`)
-    return { ref, saved: true }
+    this.lastCredential = { source: storage, configured: true }
+    this.logger?.info?.(`[calibguard] 已写入凭据引用 ${ref}（存储：${storage}，值不落日志）`)
+    return { ref, saved: true, storage }
   }
 
   /**
@@ -624,7 +672,8 @@ export class CalibGuardEngine {
       lastExit: this.lastExit,
       credential: { ...this.lastCredential },
       credentialRef: this.effectiveCredentialRef() || null,
-      credentialWritable: typeof this.credentials?.set === 'function',
+      credentialWritable: true,
+      credentialStorage: typeof this.credentials?.set === 'function' ? 'dsh-credentials' : 'local-file',
       environment: this.bootstrap.snapshot(),
       torchJob: this.torchJobSnapshot(),
       gpuTorch: this.gpuTorchStatus(),

package/lib/routes.js

@@ -148,6 +148,7 @@ export function createCalibGuardRoutes({ engine, config, logger, settingsStore }
           credential: diagnostics.credential,
           credentialRef: diagnostics.credentialRef ?? null,
           credentialWritable: Boolean(diagnostics.credentialWritable),
+          credentialStorage: diagnostics.credentialStorage ?? null,
           setupScript,
           torchJob: typeof engine.torchJobSnapshot === 'function' ? engine.torchJobSnapshot() : null,
           gpuTorch: typeof engine.gpuTorchStatus === 'function' ? engine.gpuTorchStatus() : null,
@@ -164,6 +165,7 @@ export function createCalibGuardRoutes({ engine, config, logger, settingsStore }
         credential: diagnostics.credential,
         credentialRef: diagnostics.credentialRef ?? null,
         credentialWritable: Boolean(diagnostics.credentialWritable),
+          credentialStorage: diagnostics.credentialStorage ?? null,
         setupScript,
         settings: engine.settings(),
         settingsFile: settingsStore?.file ?? null,
@@ -181,6 +183,7 @@ export function createCalibGuardRoutes({ engine, config, logger, settingsStore }
           credential: diagnostics.credential,
           credentialRef: diagnostics.credentialRef ?? null,
           credentialWritable: Boolean(diagnostics.credentialWritable),
+          credentialStorage: diagnostics.credentialStorage ?? null,
           setupScript,
           torchJob: typeof engine.torchJobSnapshot === 'function' ? engine.torchJobSnapshot() : null,
           gpuTorch: typeof engine.gpuTorchStatus === 'function' ? engine.gpuTorchStatus() : null,
@@ -213,7 +216,13 @@ export function createCalibGuardRoutes({ engine, config, logger, settingsStore }
       }
       const result = await engine.setCredential(apiKey, name || undefined)
       const ref = result && result.ref ? result.ref : null
-      sendJson(res, 200, { ok: true, ...result, credentialRef: ref, settings: engine.settings() })
+      sendJson(res, 200, {
+        ok: true,
+        ...result,
+        credentialRef: ref,
+        credentialStorage: result && result.storage ? result.storage : null,
+        settings: engine.settings(),
+      })
       sendJson(res, 200, { ok: true, ...result })
     } catch (error) {
       sendJson(res, 400, { error: String(error?.message ?? error) })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-calibguard",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "publishConfig": {
     "access": "public"
   },