dsh-cline-pass 0.2.7 → 0.2.8

package/README.en.md

@@ -90,7 +90,7 @@ The provider route and the setup panel are unaffected — the panel is a browser
 
 ## Upstream channels
 
-For a new model, click **Auto-configure** in the panel to probe, validate, and configure channels. Expand a model row to adjust channel order or exclude a channel.
+For a new model, expand its row and click **Probe** to discover channels, then **Validate** to check which channels actually honor a pin. Choose a channel order or exclusions as needed. Validation sends one real request per channel and does not change the stored pin; **Test** checks the saved pin rules.
 
 You can also run the tools in this order:
 

package/README.md

@@ -90,7 +90,7 @@ cline_pass_accounts action=mode mode=roundrobin
 
 ## 上游渠道
 
-首次使用模型时，可以在面板点击 **一键配置**，自动探测、校验和配置渠道。展开模型行可调整渠道顺序或排除渠道。
+首次使用模型时，展开面板中的模型行，先点击 **探测** 获取渠道，再点击 **校验** 检查各渠道是否确实采用了钉住规则，最后按需要选择渠道顺序或排除渠道。校验会向每个渠道发出一次真实请求，不会自动修改钉住配置；**测试** 可验证已保存的钉住规则。
 
 也可以按以下顺序调用工具：
 

package/lib/accounts.js

@@ -0,0 +1,31 @@
+/** Account edits shared by the panel and management tools. */
+
+/** Allocate a stable reference without folding distinct account names together. */
+function credentialName(name, accounts) {
+  const stem = name.toUpperCase().replace(/[^A-Z0-9]+/g, '_')
+  const base = `CLINE_PASS_${stem}_KEY`
+  const used = new Set(Object.entries(accounts).filter(([key]) => key !== name).map(([, entry]) => String(entry?.apiKeyEnv ?? '')))
+  // Keep the familiar name for simple lowercase ids. Other ids carry their
+  // exact bytes, so case and punctuation remain distinct even on concurrent adds.
+  const encoded = `${base}__${Buffer.from(name).toString('hex').toUpperCase()}`
+  let ref = /^[a-z0-9_]+$/.test(name) && !used.has(base) ? base : encoded
+  for (let suffix = 2; used.has(ref); suffix += 1) ref = `${encoded}_${suffix}`
+  return ref
+}
+
+/** Apply only supplied fields when updating; allocate defaults on creation. */
+export function accountProfileFor(name, changes, accounts, defaultRef = '') {
+  if (!/^[A-Za-z0-9._-]+$/.test(name) || name === '__proto__') {
+    throw new Error('the account name may use letters, digits, dot, dash and underscore only (except __proto__)')
+  }
+  const existing = Object.hasOwn(accounts, name) ? accounts[name] : undefined
+  const previous = existing ?? {}
+  const suppliedRef = String(changes?.apiKeyEnv ?? '').trim()
+  const priorRef = String(previous.apiKeyEnv ?? '').trim() || (existing === undefined ? '' : String(defaultRef))
+  return {
+    displayName: changes?.displayName === undefined ? (String(previous.displayName ?? '') || name) : (String(changes.displayName).trim() || name),
+    apiKeyEnv: suppliedRef || priorRef || credentialName(name, accounts),
+    enabled: changes?.enabled === undefined ? previous.enabled !== false : changes.enabled !== false,
+    baseURL: changes?.baseURL === undefined ? String(previous.baseURL ?? '') : String(changes.baseURL ?? '').trim(),
+  }
+}

package/lib/adapter.js

@@ -29,6 +29,7 @@ import {
   classifyUpstreamError,
   errorText,
   injectPrefs,
+  isAuthenticationError,
   parseRouting,
   pinAdherence,
   pinWarnings,
@@ -480,7 +481,7 @@ export function streamErrorCode(message, status) {
   const windowDetail = detail.replace(/[_-]/g, ' ')
   const spentWindow = /\b(?:weekly|monthly|daily|(?:five|5)\s*hour|plan)\b[\s\S]{0,80}?\b(?:exceed\w*|exhaust\w*|reach\w*|used\s+up|out\s+of|deplet\w*|spent)\b|\b(?:exceed\w*|exhaust\w*|reach\w*|used\s+up|out\s+of|deplet\w*)\b[\s\S]{0,80}?\b(?:weekly|monthly|daily|(?:five|5)\s*hour|plan)\b[\s\S]{0,40}?\b(?:limit|cap|quota|credits|budget|allowance)\b/i.test(windowDetail)
   if (status === 402 || isQuotaExceededError(detail) || spentWindow) return QUOTA_EXCEEDED_CODE
-  if (/unauthorized|re-authenticate|invalid api key|401|403/i.test(detail)) return 'AUTH'
+  if (isAuthenticationError(detail, status)) return 'AUTH'
   if (status === 429 || /429|rate limit|rate-?limited/i.test(detail)) return 'RATE_LIMIT'
   if (isContextWindowExceededError(detail)) return CONTEXT_WINDOW_EXCEEDED_CODE
   if (status === 400) return 'INVALID_REQUEST'
@@ -909,11 +910,13 @@ export class ClinePassAdapter extends LlmAdapter {
          * cannot see, because this gateway does not stream it.
          */
         let usage = null
+        let finishFailure = null
         try {
           for (;;) {
             const next = await watchdog.next(iterator)
             if (next.done === true) break
             if (next.value?.type === 'usage') usage = next.value.usage
+            if (next.value?.type === 'finish' && next.value.reason?.kind === 'error') finishFailure = next.value.reason.failure
             if (firstChunkMs === 0) firstChunkMs = Date.now() - startedAt
             yielded = true
             yield next.value
@@ -996,7 +999,8 @@ export class ClinePassAdapter extends LlmAdapter {
           ttfb: firstByteMs,
           ttft: firstChunkMs,
           stream: true,
-          error: null,
+          error: finishFailure?.message ?? null,
+          code: finishFailure?.code ?? '',
           account: account.name,
           adherence,
           warnings,
@@ -1009,7 +1013,7 @@ export class ClinePassAdapter extends LlmAdapter {
         // Marking it usable no matter who answered is how a false "available"
         // reached the verdict map the exclusion allow-list is built from — the
         // map then vouched for the very channels it was meant to exclude.
-        if (attempt.upstream !== null && adherence === 'adopted') this.config.learnUpstream(options.model, attempt.upstream, 'ok', '', Date.now() - attemptStarted)
+        if (finishFailure === null && attempt.upstream !== null && adherence === 'adopted') this.config.learnUpstream(options.model, attempt.upstream, 'ok', '', Date.now() - attemptStarted)
         return
       } finally {
         // Held until the attempt ends, response body included, so the slot

package/lib/client.js

@@ -505,7 +505,7 @@ window.__ModuleLoader__.load({
      * in front of it once an entry is no longer from today — a long-lived host
      * process would otherwise show times that look like they were all this hour.
      */
-    function stamp(value) {
+    function historyStamp(value) {
       const at = new Date(Number(value ?? 0))
       if (!Number.isFinite(at.getTime())) return '-'
       const pad = (part) => String(part).padStart(2, '0')
@@ -966,7 +966,7 @@ window.__ModuleLoader__.load({
             action: { kind: 'validate', model, data: result },
             notice: {
               kind: (summary.ok ?? 0) > 0 ? 'ok' : 'warn',
-              text: `${model} · available=${summary.ok ?? 0} rate-limited=${summary.limited ?? 0} not-pinnable=${summary.bad ?? 0} auth-failed=${summary.auth ?? 0}`,
+              text: `${model} · available=${summary.ok ?? 0} rate-limited=${summary.limited ?? 0} not-pinnable=${summary.bad ?? 0} auth-failed=${summary.auth ?? 0} unknown=${summary.unknown ?? 0}`,
             },
           })
         }
@@ -1163,12 +1163,8 @@ window.__ModuleLoader__.load({
      * whether any picker offers this model, and the one action that matters. The
      * finer pin actions and the channel list live behind the expander.
      *
-     * The expander holds the three steps that are not the one-click path:
-     * discovering channels (probe), verifying what actually serves the stored pin
-     * (test), and dropping it (reset). Validating every channel is what
-     * auto-configure already does before it pins, so it is not a separate button
-     * here — running it alone costs one real request per channel to re-learn
-     * verdicts the same click would have produced.
+     * Discover channels, validate them, and choose a pin explicitly. Validation
+     * costs one real request per channel; it does not change the stored pin.
      */
     function ModelRow(props) {
       const { t, model, disabled, actions } = props
@@ -1201,6 +1197,7 @@ window.__ModuleLoader__.load({
         open ? h('div', { key: 'detail', className: 'cp-panel' }, [
           h('div', { key: 'actions', className: 'cp-row' }, [
             action('probe', t('probe'), actions.probeModel),
+            action('validate', t('validate'), actions.validateModel),
             action('test', t('testPin'), actions.testModel),
             action('reset', t('reset'), actions.resetModel),
           ]),
@@ -1256,7 +1253,7 @@ window.__ModuleLoader__.load({
             onClick: () => actions.testKey(account.apiKeyEnv, ''),
           }, t('test')),
           active || !pooled ? null : h('button', {
-            key: 'use', type: 'button', className: 'cp-btn',
+            key: 'use', type: 'button', className: 'cp-btn', disabled,
             onClick: () => actions.setAccountMode({ active: account.key }),
           }, t('accountsSetActive')),
           h('button', {
@@ -1275,9 +1272,8 @@ window.__ModuleLoader__.load({
     /**
      * The accounts card.
      *
-     * One table: the key field belongs to the account a request would actually
-     * use, instead of to whichever account happened to be first, and the pool
-     * controls sit in the section body where they apply to the whole list.
+     * The key editor belongs to the account selected for editing. It stays put
+     * while requests rotate or cool down; quota follows the effective account.
      *
      * It folds like every other section, with one exception: before an account is
      * usable this is the only thing left to act on, so it opens itself. A card
@@ -1292,7 +1288,7 @@ window.__ModuleLoader__.load({
       const single = data.accountMode !== 'roundrobin'
       const fallback = data.accounts.find((account) => account.enabled)?.key ?? ''
       const activeKey = data.activeAccount === '' ? fallback : data.activeAccount
-      // The key field follows the account requests will actually use.
+      // Editing is an explicit account choice, independent of request rotation.
       const target = data.accounts.find((account) => account.key === activeKey) ?? data.accounts[0]
       // A row can be deleted only when an explicit `accounts` entry stands behind
       // it; a lone implicit account is the top-level key, so deleting it would
@@ -1357,7 +1353,7 @@ window.__ModuleLoader__.load({
         target === undefined ? null : h('div', { key: 'key', className: 'cp-row cp-acct-key' }, [
           h('span', { key: 'l', className: 'cp-muted' }, fill(t('accountsFor'), { name: target.displayName })),
           h(KeyField, {
-            key: 'field',
+            key: `field:${target.key}:${target.apiKeyEnv}`,
             t,
             account: target,
             disabled,
@@ -1471,7 +1467,7 @@ window.__ModuleLoader__.load({
           color: failed ? 'var(--dsw-alias-state-error-primary)' : 'var(--dsw-alias-state-success-primary)',
           title: failed ? entry.error : 'ok',
         })),
-        h('td', { key: 'when', className: 'cp-history-when' }, stamp(entry.ts)),
+        h('td', { key: 'when', className: 'cp-history-when' }, historyStamp(entry.ts)),
         // Model and its serving channel share a cell: the panel is ~480px wide and
         // a column of its own squeezed the model id — the one identifier a reader
         // scans for — down to a truncated stub.
@@ -1711,9 +1707,8 @@ window.__ModuleLoader__.load({
         void props.loadUsage().then((result) => setReadFailed(result === undefined))
       }, [state.data])
 
-      // The history section follows the host's retained count: every panel read
-      // carries it, so the rows are re-read whenever new requests landed instead
-      // of going stale the moment the first read completed.
+      // Revisions keep advancing when retained rows have reached the cap.
+      // Older hosts expose only the retained count.
       React.useEffect(() => {
         if (state.data === null) return
         let cancelled = false
@@ -1722,7 +1717,7 @@ window.__ModuleLoader__.load({
           setHistory({ entries: result.entries ?? [], total: Number(result.total ?? 0) })
         })
         return () => { cancelled = true }
-      }, [state.data?.historySize])
+      }, [state.data?.historyRevision ?? state.data?.historySize])
 
   
   
@@ -1885,7 +1880,7 @@ window.__ModuleLoader__.load({
           h('span', { key: 'n', className: 'cp-grow' }, data?.ready === true ? t('keyOk') : t('keyMissing')),
         ]),
         account === undefined ? null : h(KeyField, {
-          key: 'key',
+          key: `key:${account.key}:${account.apiKeyEnv}`,
           t,
           account,
           disabled: state.busy !== null || data?.settingsAvailable === false,
@@ -2105,6 +2100,7 @@ window.__ModuleLoader__.load({
     /** A local timestamp, matching the panel's own reading of "updated at". */
     function stamp(ms) {
       const at = new Date(Number(ms ?? 0))
+      if (!Number.isFinite(at.getTime())) return '-'
       const pad = (n) => String(n).padStart(2, '0')
       return `${at.getFullYear()}/${at.getMonth() + 1}/${at.getDate()} ${pad(at.getHours())}:${pad(at.getMinutes())}:${pad(at.getSeconds())}`
     }
@@ -2181,12 +2177,12 @@ window.__ModuleLoader__.load({
       // 3. The quota reading beside the model selector. It mounts for every
       //    session but renders nothing unless the selected model is this
       //    provider's, so no other model pays for a usage request.
-      ctx.slots.inject('conversation.input.right', () => ctx.slots.register({
+      const registerUsage = (usageCtx) => usageCtx.slots.inject('conversation.input.right', () => usageCtx.slots.register({
         name: 'conversation.input.right',
         id: `${NS}-usage`,
         order: 100,
         inject: (sessionId) => ({
-          directory: ctx.modelDirectories.directoryFor(sessionId).store,
+          directory: usageCtx.modelDirectories.directoryFor(sessionId).store,
           // The route name is configuration, so it is only known once a state
           // read has landed. Read it at render time rather than capturing it:
           // the pill can mount before the first read completes.
@@ -2207,6 +2203,12 @@ window.__ModuleLoader__.load({
         }),
       }, UsagePill))
 
+      // Newer Cordis service methods execute in the consumer's context. The
+      // directory resolver reads remote.session, so give this slot its explicit
+      // dependency without requiring that newer service on legacy hosts.
+      if (ctx.get('remote.session') !== undefined) ctx.inject(['remote.session'], registerUsage)
+      else registerUsage(ctx)
+
       // The first read is lazy (each component asks for it), because the RPC
       // transport only exists once Connection has activated.
       void controller.refresh()

package/lib/compat.js

@@ -145,10 +145,37 @@ export function installLiveSection(settings, owner, ns, schema, seed, hooks) {
  * @param removals - key paths to delete, e.g. `[['accounts', 'name']]`.
  */
 export async function updateLiveSection(settings, ns, patch, removals = []) {
+  if (removals.length > 0 && typeof settings?.mutate !== 'function') {
+    throw new Error('the settings service cannot remove configuration keys')
+  }
   if (removals.length > 0 && typeof settings?.mutate === 'function') {
     // Unset first, then merge the rest: the merge cannot resurrect a key the
     // unset already removed, because the patch no longer mentions it.
     await settings.mutate(ns, removals.map((path) => ({ op: 'unset', path: [...path] })))
   }
   if (Object.keys(patch).length > 0) await settings.update(ns, patch)
-}
+}
+
+/** The same recursive patch semantics for hosts without a settings service. */
+export function patchConfig(config, patch, removals = []) {
+  const merge = (source, changes) => {
+    const next = { ...source }
+    for (const [key, value] of Object.entries(changes)) {
+      next[key] = value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? merge(source?.[key], value)
+        : value
+    }
+    return next
+  }
+  const unset = (source, path) => {
+    if (source === null || typeof source !== 'object' || path.length === 0) return source
+    const [key, ...rest] = path
+    const next = { ...source }
+    if (rest.length === 0) delete next[key]
+    else if (Object.hasOwn(next, key)) next[key] = unset(next[key], rest)
+    return next
+  }
+  let next = config
+  for (const path of removals) next = unset(next, path)
+  return merge(next, patch)
+}

package/lib/engine.js

@@ -25,6 +25,7 @@ import {
   errorText,
   extractAvailableProviders,
   injectPrefs,
+  isAuthenticationError,
   isAdherenceOk,
   mergeUpstreams,
   parseRouting,
@@ -210,8 +211,8 @@ export function createEngine({
     })
     const payload = unwrapEnvelope(result.json)
     const ms = Date.now() - started
-    if (payload?.error !== undefined && payload?.choices === undefined) {
-      const message = errorText(payload.error)
+    if (!result.ok || (payload?.error !== undefined && payload?.choices === undefined) || !Array.isArray(payload?.choices) || payload.choices.length === 0) {
+      const message = errorText(payload?.error) || String(payload?.message ?? '') || result.text.slice(0, 400) || (result.ok ? 'gateway returned no completion' : `HTTP ${result.status}`)
       store.learn(model, { ok: false, lastError: message, lastMs: ms })
       return { ok: false, ms, model, error: message }
     }
@@ -342,15 +343,16 @@ export function createEngine({
           const ms = Date.now() - started
           let status = 'unknown'
           let note = ''
-          if (payload?.error !== undefined && payload?.choices === undefined) {
-            note = errorText(payload.error)
-            status = classifyUpstreamError(note)
+          if (!result.ok || (payload?.error !== undefined && payload?.choices === undefined)) {
+            note = errorText(payload?.error) || result.text || `HTTP ${result.status}`
+            status = isAuthenticationError(note, result.status) ? 'auth' : classifyUpstreamError(note)
           } else if (payload?.choices !== undefined) {
             const routing = parseRouting(payload)
             const adherence = pinAdherence(attempt, routing)
-            if (isAdherenceOk(adherence)) {
+            if (adherence === 'adopted') {
               status = 'ok'
-              if (adherence === 'fallback') note = `answered by ${routing.finalProvider ?? 'another channel'}`
+            } else if (adherence === 'unresolved') {
+              note = 'the response did not name the serving channel; the pin could not be verified'
             } else {
               status = 'not-adopted'
               note = `pin not adopted: served by ${routing.finalProvider ?? '(unknown)'}`
@@ -362,7 +364,7 @@ export function createEngine({
         }
       }))
       for (const result of settled) {
-        store.learnUpstream(model, result.upstream, result.status, result.note, result.ms)
+        store.learnUpstream(model, result.upstream, result.status, result.note, result.ms, { includeUnknown: true })
         results.push(result)
       }
     }
@@ -463,12 +465,18 @@ export function createEngine({
       })
       const payload = unwrapEnvelope(result.json)
       const ms = Date.now() - started
-      if (payload?.error !== undefined && payload?.choices === undefined) {
-        const message = errorText(payload.error)
-        const authFailed = /unauthorized|re-authenticate|invalid\s*api|401/i.test(message)
-        return { ok: !authFailed, authorized: !authFailed, ms, model, error: message }
-      }
-      return { ok: true, authorized: true, ms, model, error: '' }
+      const message = errorText(payload?.error) || String(payload?.message ?? '') || (result.ok ? '' : result.text.slice(0, 400)) || (result.ok ? '' : `HTTP ${result.status}`)
+      if (isAuthenticationError(message, result.status)) return { ok: false, authorized: false, ms, model, error: message || `HTTP ${result.status}` }
+      const hasCompletion = result.ok && Array.isArray(payload?.choices) && payload.choices.length > 0
+      // A structured model/quota refusal can establish authorization without a
+      // completion. Server failures, HTML and malformed success bodies cannot.
+      const modelError = /empty response content|\bmodel(?:id)?\b|context|max[_ -]?tokens|reasoning|no (?:allowed|available) providers/i.test(message)
+      const modelRefusal = payload?.error !== undefined && (
+        [402, 429].includes(result.status)
+        || ((result.ok || [400, 404, 422].includes(result.status)) && modelError)
+      )
+      const authorized = hasCompletion || modelRefusal
+      return { ok: authorized, authorized, ms, model, error: authorized && hasCompletion ? '' : (message || 'gateway returned no completion; authorization could not be verified') }
     } catch (error) {
       return { ok: false, authorized: false, ms: Date.now() - started, model, error: errorText(error) }
     }

package/lib/index.js

@@ -28,7 +28,7 @@ import {
   DEFAULT_STREAM_IDLE_TIMEOUT_MS,
 } from './adapter.js'
 import { catalogEntry, MODEL_CATALOG, REASONING_EFFORTS } from './catalog.js'
-import { installLiveSection, liveConfigReader, markVolatile, resolveLiveRefs, updateLiveSection } from './compat.js'
+import { installLiveSection, liveConfigReader, markVolatile, patchConfig, resolveLiveRefs, updateLiveSection } from './compat.js'
 import { createEngine } from './engine.js'
 import { createPanel, PANEL_PATH, registerPanel } from './panel.js'
 import { BUILD_TAG } from './protocol.js'
@@ -294,18 +294,29 @@ export function apply(ctx, config) {
    * avoid. Keeping one ordering is also what stops the cooldown rule from being
    * applied in one place and forgotten in the other.
    */
-  const candidateAccounts = (exclude = []) => {
+  const candidateAccounts = async (exclude = []) => {
     const skip = new Set(exclude.map(String))
-    const enabled = accountProfiles().filter(([, profile]) => profile.enabled)
+    const failures = []
+    const resolved = await Promise.all(accountProfiles().filter(([key, profile]) => profile.enabled && !skip.has(key)).map(async ([key, profile]) => {
+      try {
+        const value = await resolveKey(profile.apiKeyEnv)
+        if (value === undefined) throw new LlmError(`cline-pass: no API key for account "${key}"; store it at ${profile.apiKeyEnv} or configure another account`, 'MISSING_CREDENTIAL')
+        return [key, profile, assertUsableApiKey(value, 'cline-pass', profile.apiKeyEnv)]
+      } catch (error) {
+        failures.push(error)
+        return undefined
+      }
+    }))
+    const enabled = resolved.filter((entry) => entry !== undefined)
     // Accounts that just refused a request are stood down for a while, so a pool
     // does not spend one failed round trip per call rediscovering the same
     // exhausted key. When every candidate is cooling the oldest one is used
     // anyway: a window can reset, and refusing to try at all would be worse.
     const now = Date.now()
     const eligible = enabled.filter(([key]) => !skip.has(key) && (cooling.get(key) ?? 0) <= now)
-    if (eligible.length > 0) return eligible
+    if (eligible.length > 0) return { ordered: eligible, error: failures[0] }
     const pool = enabled.filter(([key]) => !skip.has(key))
-    return [...pool].sort((left, right) => (cooling.get(left[0]) ?? 0) - (cooling.get(right[0]) ?? 0))
+    return { ordered: [...pool].sort((left, right) => (cooling.get(left[0]) ?? 0) - (cooling.get(right[0]) ?? 0)), error: failures[0] }
   }
 
   /**
@@ -315,9 +326,9 @@ export function apply(ctx, config) {
    * account is in line must not move it either — otherwise showing the user their
    * quota would change which account answers them.
    */
-  const effectiveAccount = () => {
+  const effectiveAccount = async () => {
     const cfg = live()
-    const ordered = candidateAccounts()
+    const { ordered } = await candidateAccounts()
     if (ordered.length === 0) return ''
     if (cfg.accountMode === 'roundrobin' && ordered.length > 1) return ordered[roundRobin % ordered.length][0]
     return (ordered.find(([key]) => key === cfg.activeAccount) ?? ordered[0])[0]
@@ -330,8 +341,11 @@ export function apply(ctx, config) {
     if (enabled.length === 0) {
       throw new LlmError('cline-pass: every configured account is disabled; enable one or add another', 'MISSING_CREDENTIAL')
     }
-    const ordered = candidateAccounts(exclude)
-    if (ordered.length === 0) return undefined
+    const { ordered, error } = await candidateAccounts(exclude)
+    if (ordered.length === 0) {
+      if (exclude.length > 0) return undefined
+      throw error ?? new LlmError('cline-pass: no usable account credentials', 'MISSING_CREDENTIAL')
+    }
     let picked
     if (cfg.accountMode === 'roundrobin' && ordered.length > 1) {
       picked = ordered[roundRobin % ordered.length]
@@ -339,15 +353,8 @@ export function apply(ctx, config) {
     } else {
       picked = ordered.find(([key]) => key === cfg.activeAccount) ?? ordered[0]
     }
-    const [key, profile] = picked
-    const value = await resolveKey(profile.apiKeyEnv)
-    if (value === undefined) {
-      throw new LlmError(
-        `cline-pass: no API key for account "${key}"; store it at ${profile.apiKeyEnv} (cline_pass_accounts action="add" name=${key} key=… writes it, or use the dsh Models page), or export ${profile.apiKeyEnv} in the launching environment`,
-        'MISSING_CREDENTIAL',
-      )
-    }
-    return { name: key, key: assertUsableApiKey(value, 'cline-pass', profile.apiKeyEnv), baseURL: profile.baseURL }
+    const [key, profile, value] = picked
+    return { name: key, key: value, baseURL: profile.baseURL }
   }
 
   // ── connection facts ──────────────────────────────────────────────────────
@@ -524,12 +531,8 @@ export function apply(ctx, config) {
   const updateConfig = async (patch, removals = []) => {
     const settings = ctx.get('settings')
     if (settings === undefined) {
-      const next = { ...liveConfig, ...patch }
-      for (const path of removals) {
-        if (path.length === 1) delete next[path[0]]
-        else if (path.length === 2 && next[path[0]] !== undefined) delete next[path[0]][path[1]]
-      }
-      liveConfig = next
+      liveConfig = patchConfig(live(), patch, removals)
+      current = () => liveConfig
       return
     }
     await updateLiveSection(settings, DEFAULT_SETTINGS_NS, patch, removals)

package/lib/panel.js

@@ -14,6 +14,7 @@
  * @module dsh-cline-pass/panel
  */
 import { fetchUsageLimits } from './cline.js'
+import { accountProfileFor } from './accounts.js'
 import { normalizePinMode } from './protocol.js'
 
 /**
@@ -121,7 +122,8 @@ export function createPanel({ control, engine, store }) {
     const accounts = (await control.accountsWithKeys()).map((account) => accountView(account, declaredNames.has(String(account.key))))
     const hidden = new Set((config.hiddenModels ?? []).map(String))
     const models = (config.knownModels ?? []).map((id) => projectModel(id, config.perModel?.[id] ?? {}, store.metaOf(id), hidden.has(String(id))))
-    const usable = accounts.some((account) => account.keyConfigured && account.enabled)
+    const effectiveAccount = await control.effectiveAccount()
+    const usable = effectiveAccount !== '' && accounts.some((account) => account.keyConfigured && account.enabled)
     const pinned = models.filter((model) => model.pinned.length > 0).length
     return {
       provider: control.providerName,
@@ -134,7 +136,7 @@ export function createPanel({ control, engine, store }) {
       // one: `activeAccount` only decides single mode, and round-robin picks from
       // the cursor. Usage is per account, so a reading has to name the account it
       // belongs to or the surface showing it describes someone else's quota.
-      effectiveAccount: control.effectiveAccount(),
+      effectiveAccount,
       accounts,
       ready: usable,
       models,
@@ -144,6 +146,7 @@ export function createPanel({ control, engine, store }) {
       usage: store.usage(),
       catalogCount: Number(store.catalog()?.ids?.length ?? 0),
       historySize: store.historySize(),
+      historyRevision: store.historyRevision(),
       // The stored value, not the running one: the switch states what the user
       // wants, and reporting the running value would snap it back to where it
       // started the moment they clicked it, which reads as a failed click. The
@@ -253,15 +256,13 @@ export function createPanel({ control, engine, store }) {
     const ref = String(payload?.ref ?? '').trim()
     const config = readConfig()
     let key = typed
-    let baseURL = String(config.baseURL ?? '')
-    let label = typed.length > 0 ? '(typed key)' : ref
+    const account = ref === '' ? undefined : control.accounts().find((entry) => String(entry.apiKeyEnv) === ref)
+    const baseURL = String(account?.baseURL ?? '') || String(config.baseURL ?? '')
+    const label = String(account?.key ?? (typed.length > 0 ? '(typed key)' : ref))
     if (key.length === 0) {
       if (ref.length === 0) throw new Error('testing a key needs a `value` or the `ref` of a stored account')
-      const account = control.accounts().find((entry) => String(entry.apiKeyEnv) === ref)
       key = await control.readCredential(ref)
       if (key === '') throw new Error(`no key is stored at ${ref}`)
-      baseURL = String(account?.baseURL ?? '') || baseURL
-      label = String(account?.key ?? ref)
     }
     const model = (config.knownModels ?? [])[0] ?? 'cline-pass/glm-5.3-flash'
     const result = await engine.testAccount({ key, baseURL, model })
@@ -289,14 +290,9 @@ export function createPanel({ control, engine, store }) {
         baseURL: '',
       }
     }
-    const apiKeyEnv = String(payload?.apiKeyEnv ?? '').trim()
-      || `CLINE_PASS_${name.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_KEY`
-    accounts[name] = {
-      displayName: String(payload?.displayName ?? '').trim() || name,
-      apiKeyEnv,
-      enabled: payload?.enabled !== false,
-      baseURL: '',
-    }
+    const profile = accountProfileFor(name, payload, accounts, config.apiKeyEnv)
+    const apiKeyEnv = profile.apiKeyEnv
+    accounts[name] = profile
     await control.updateConfig({ accounts })
     const value = String(payload?.key ?? '').trim()
     if (value.length > 0) await control.setCredential(apiKeyEnv, value)
@@ -476,6 +472,7 @@ export function createPanel({ control, engine, store }) {
         effort: String(entry.effort ?? ''),
         stream: entry.stream === true,
         error: firstLine(entry.error, 200),
+        code: String(entry.code ?? ''),
       })),
     }
   }

package/lib/protocol.js

@@ -19,7 +19,7 @@
  * log instead, which turns "did the patched code actually load?" into a
  * question with an answer.
  */
-export const BUILD_TAG = 'dshfix-3'
+export const BUILD_TAG = 'dshfix-4'
 
 /**
  * The gateway wraps some answers in a `{ data: … }` envelope; unwrap it.
@@ -45,6 +45,12 @@ export function errorText(value) {
   }
 }
 
+/** Account authentication refusals, including responses with no useful body. */
+export function isAuthenticationError(message, status) {
+  const detail = String(message ?? '').replace(/[_-]/g, ' ')
+  return status === 401 || status === 403 || /unauthorized|re\s*authenticate|invalid\s*(?:api\s*key|token)|\b401\b|\b403\b/i.test(detail)
+}
+
 /**
  * Read the routing facts out of one completed gateway response.
  * @param json - raw decoded response body (enveloped or not).
@@ -181,11 +187,12 @@ export function injectPrefs(body, meta, attempt) {
   // Normalized here as well as in buildAttempts: this function is exported, so
   // a caller can hand it an attempt straight from configuration.
   const sort = normalizeSort(attempt?.sort)
-  const excluded = excludeList.filter((name) => name !== upstream)
+  const excluded = excludeList.filter((name) => normalizeSlug(name) !== normalizeSlug(upstream ?? ''))
+  const excludedIds = new Set(excluded.map(normalizeSlug))
   // Each spelling is written in the vocabulary its own router understands.
   const spell = (names, pipeline) => names.map((name) => channelNameFor(name, pipeline))
-  const gatewayAllow = excluded.length > 0 ? knownChannels(meta, 'planner').filter((name) => !excluded.includes(name)) : null
-  const openRouterAllow = excluded.length > 0 ? knownChannels(meta, 'direct').filter((name) => !excluded.includes(name)) : null
+  const gatewayAllow = excluded.length > 0 ? knownChannels(meta, 'planner').filter((name) => !excludedIds.has(normalizeSlug(name))) : null
+  const openRouterAllow = excluded.length > 0 ? knownChannels(meta, 'direct').filter((name) => !excludedIds.has(normalizeSlug(name))) : null
   const pipeline = meta?.pipeline ?? null
   const both = attempt?.spelling !== 'detected'
   const useGateway = both || pipeline === 'planner' || pipeline === null
@@ -278,13 +285,14 @@ export function isAdherenceOk(adherence) {
  */
 export function pinWarnings(attempt, meta) {
   const upstream = attempt?.upstream ?? null
-  const excluded = (attempt?.excludeList ?? []).filter((name) => name !== upstream)
+  const excluded = (attempt?.excludeList ?? []).filter((name) => normalizeSlug(name) !== normalizeSlug(upstream ?? ''))
+  const excludedIds = new Set(excluded.map(normalizeSlug))
   if (excluded.length === 0) return []
   const known = Array.isArray(meta?.upstreams) ? meta.upstreams : []
   if (known.length === 0) {
     return [`excludeUnresolved: this model has no channel list yet, so ${excluded.join(', ')} could not be compiled into an allow-list — run cline_pass_probe for it`]
   }
-  const remaining = known.filter((name) => !excluded.includes(name))
+  const remaining = known.filter((name) => !excludedIds.has(normalizeSlug(name)))
   if (remaining.length === 0 && upstream === null) {
     return [`PIN_UNRESOLVED: every known channel is excluded (${known.join(', ')}), so the request falls back to the gateway's own routing`]
   }
@@ -304,8 +312,8 @@ export function pinWarnings(attempt, meta) {
 export function buildAttempts(config) {
   const listed = (config?.upstreams ?? []).filter((name) => typeof name === 'string' && name.length > 0)
   const exclude = (config?.exclude ?? []).filter((name) => typeof name === 'string' && name.length > 0)
-  const excluded = new Set(exclude)
-  const wanted = listed.filter((name) => !excluded.has(name))
+  const excluded = new Set(exclude.map(normalizeSlug))
+  const wanted = listed.filter((name) => !excluded.has(normalizeSlug(name)))
   const strict = normalizePinMode(config?.pinMode) === 'strict'
   const sort = normalizeSort(config?.sort)
   const base = { strict, sort, excludeList: exclude }
@@ -332,7 +340,7 @@ export function classifyUpstreamError(message) {
   if (/empty response content/i.test(text)) return 'ok'
   if (/429|rate-?limited|temporarily rate/i.test(text)) return 'limited'
   if (/invalid_request|modelid|no allowed providers|no available providers|not found|unsupported/i.test(text)) return 'bad'
-  if (/unauthorized|re-authenticate|401/i.test(text)) return 'auth'
+  if (isAuthenticationError(text)) return 'auth'
   return 'unknown'
 }
 

package/lib/store.js

@@ -26,6 +26,7 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
   const models = new Map()
   /** @type {object[]} newest first */
   const history = []
+  let historyRevision = 0
   let catalog = { ids: [], sources: [], fetchedAt: 0 }
   /** Last quota reading, one entry per enabled account. */
   let usage = { ok: false, accounts: [], fetchedAt: 0 }
@@ -55,10 +56,10 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
       models.set(model, next)
       return next
     },
-    /** Record one upstream's availability verdict; an inconclusive one is dropped. */
-    learnUpstream(model, upstream, status, note, ms) {
+    /** Record a verdict; explicit validation also replaces stale results with unknown. */
+    learnUpstream(model, upstream, status, note, ms, { includeUnknown = false } = {}) {
       if (upstream === undefined || upstream === null || upstream === '') return
-      if (status === 'unknown') return
+      if (status === 'unknown' && !includeUnknown) return
       const current = models.get(model) ?? {}
       models.set(model, {
         ...current,
@@ -67,6 +68,7 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
     },
     /** Append one request-history row (newest first, bounded). */
     record(entry) {
+      historyRevision += 1
       history.unshift({ ts: Date.now(), ...entry })
       if (history.length > historyLimit) history.length = historyLimit
     },
@@ -85,6 +87,10 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
     historySize() {
       return history.length
     },
+    /** Monotonic change counter, including replacements at the retention cap. */
+    historyRevision() {
+      return historyRevision
+    },
     /** The last cached official-catalog scan. */
     catalog() {
       return catalog

package/lib/tools.js

@@ -7,6 +7,7 @@
  * @module dsh-cline-pass/tools
  */
 import { defineTool } from '@deepseek-ai/dsh-tools'
+import { accountProfileFor } from './accounts.js'
 import { BUILD_TAG, normalizePinMode, pinWarnings } from './protocol.js'
 
 /** One model-facing text block. */
@@ -625,6 +626,7 @@ export function registerTools(ctx, { control, engine, store }) {
       apiKeyEnv: { type: 'string', description: 'Credential name holding this account key.' },
       displayName: { type: 'string', description: 'Human-readable label.' },
       enabled: { type: 'boolean', description: 'Whether the account takes part in routing.' },
+      baseURL: { type: 'string', description: 'Override the gateway address for this account; empty uses the provider address.' },
       mode: { type: 'string', enum: ['single', 'roundrobin'], description: 'Pool mode.' },
       active: { type: 'string', description: 'Account key used in single mode.' },
       accounts: {
@@ -638,6 +640,7 @@ export function registerTools(ctx, { control, engine, store }) {
             apiKeyEnv: { type: 'string' },
             displayName: { type: 'string' },
             enabled: { type: 'boolean' },
+            baseURL: { type: 'string' },
             key: { type: 'string' },
           },
         },
@@ -667,21 +670,22 @@ export function registerTools(ctx, { control, engine, store }) {
     async execute(args, exec) {
       const action = String(args.action)
       let note = ''
+      let ok = true
       const nameOf = (value) => String(value ?? '').trim()
       if (action === 'test') {
         let key = String(args.key ?? '').trim()
         let label = args.name === undefined ? '(supplied key)' : nameOf(args.name)
-        let baseURL = readConfig().baseURL
+        const account = args.name === undefined ? undefined : control.accounts().find((entry) => entry.key === nameOf(args.name))
+        if (args.name !== undefined && account === undefined) throw new Error(`no account named ${JSON.stringify(nameOf(args.name))}`)
+        const baseURL = account?.baseURL || readConfig().baseURL
         if (key === '') {
           if (args.name === undefined) throw new Error('cline_pass_accounts action="test" needs `key` or an existing `name`')
-          const account = control.accounts().find((entry) => entry.key === nameOf(args.name))
-          if (account === undefined) throw new Error(`no account named ${JSON.stringify(nameOf(args.name))}`)
           key = await control.readCredential(account.apiKeyEnv)
           if (key === '') throw new Error(`account ${JSON.stringify(account.key)} has no stored key at ${account.apiKeyEnv}; store one with action="add" key=… or through the dsh Models page`)
-          baseURL = account.baseURL || baseURL
         }
         const model = (readConfig().knownModels ?? [])[0] ?? 'cline-pass/glm-5.3-flash'
         const result = await engine.testAccount({ key, baseURL, model, signal: exec.signal })
+        ok = result.authorized === true
         note = result.authorized
           ? `key for ${label} authorized in ${result.ms}ms`
           : `key for ${label} FAILED: ${firstLine(result.error, 200)}`
@@ -693,18 +697,20 @@ export function registerTools(ctx, { control, engine, store }) {
           const next = {}
           for (const [index, entry] of args.accounts.entries()) {
             const key = nameOf(entry?.name) || `account-${index + 1}`
-            next[key] = {
-              displayName: String(entry?.displayName ?? key),
-              apiKeyEnv: String(entry?.apiKeyEnv ?? `CLINE_PASS_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_KEY`),
-              enabled: entry?.enabled !== false,
-              baseURL: '',
-            }
+            if (Object.hasOwn(next, key)) throw new Error(`duplicate account name ${JSON.stringify(key)}`)
+            next[key] = accountProfileFor(key, entry, { ...accounts, ...next }, config.apiKeyEnv)
+          }
+          // Validate every entry before any credential or configuration write.
+          for (const [index, entry] of args.accounts.entries()) {
+            const key = nameOf(entry?.name) || `account-${index + 1}`
             if (typeof entry?.key === 'string' && entry.key.trim() !== '') {
               await control.setCredential(next[key].apiKeyEnv, entry.key.trim())
               note = `stored the key for ${key} in the credential store`
             }
           }
-          await control.updateConfig({ accounts: next })
+          const removals = Object.keys(accounts).filter((key) => !Object.hasOwn(next, key)).map((key) => ['accounts', key])
+          const activeAccount = Object.hasOwn(next, String(config.activeAccount ?? '')) ? config.activeAccount : ''
+          await control.updateConfig({ accounts: next, activeAccount }, removals)
         } else if (action === 'add') {
           const key = nameOf(args.name)
           if (!/^[A-Za-z0-9._-]+$/.test(key)) throw new Error('cline_pass_accounts action="add" needs a `name` of letters, digits, dot, dash or underscore')
@@ -719,13 +725,9 @@ export function registerTools(ctx, { control, engine, store }) {
               baseURL: '',
             }
           }
-          const apiKeyEnv = String(args.apiKeyEnv ?? `CLINE_PASS_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_KEY`)
-          accounts[key] = {
-            displayName: String(args.displayName ?? key),
-            apiKeyEnv,
-            enabled: args.enabled !== false,
-            baseURL: '',
-          }
+          const profile = accountProfileFor(key, args, accounts, config.apiKeyEnv)
+          const apiKeyEnv = profile.apiKeyEnv
+          accounts[key] = profile
           await control.updateConfig({ accounts })
           if (typeof args.key === 'string' && args.key.trim() !== '') {
             await control.setCredential(apiKeyEnv, args.key.trim())
@@ -762,7 +764,7 @@ export function registerTools(ctx, { control, engine, store }) {
       }
       const config = readConfig()
       return {
-        ok: true,
+        ok,
         action,
         note,
         accountMode: config.accountMode === 'roundrobin' ? 'roundrobin' : 'single',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cline-pass",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Self-contained Cline Pass provider for dsh: register Cline Pass subscription models on the harness LLM seam, enumerate and validate the upstream channels behind each model, pin or exclude them with failover, and drive an account pool. No proxy process and no external cline-pass-switcher install required.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,7 +18,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node test/smoke.mjs && node test/client.mjs && node test/pin-adherence.mjs && node test/account-failover.mjs",
+    "test": "node test/smoke.mjs && node test/client.mjs && node test/pin-adherence.mjs && node test/account-failover.mjs && node test/review-regressions.mjs",
     "test:protocol": "node test/pin-adherence.mjs",
     "test:client": "node test/client.mjs",
     "test:mount": "node test/mount.mjs",