dsh-connect 0.8.0 → 0.9.2

package/lib/index.d.ts

@@ -37,11 +37,21 @@ export * as settings from "./settings/index.js";
 /** Cordis plugin name used by loader diagnostics. */
 export declare const name = "connect";
 /**
- * Host-plane services this plugin must wait for before `apply` runs. All three
- * are provided by the base bundle. The credential store is NOT listed here:
- * cordis v4 has no `?` optional-inject marker — `"credentials?"` would be treated
- * as a required service literally named "credentials?" and stall the plugin. The
- * store is instead fetched lazily inside `apply` via the optional `ctx.get()`.
+ * Host-plane services this plugin must wait for before `apply` runs. All four
+ * are rows in the always-loaded `@deepseek-ai/dsh-base` bundle — the shared core
+ * of every base-backed profile — so requiring them cannot stall the plugin in
+ * any profile that can load `dsh-connect` at all.
+ *
+ * `credentials` must be listed here, not read lazily inside `apply`: a
+ * `ctx.get("credentials")` at apply time returns `undefined`, because this
+ * plugin activates before the credentials row does. That silently disabled the
+ * whole credential path — `migrateConfigSecrets` never seeded the store (so an
+ * upgraded user's working channels displayed "未配置凭据"), `injectSecrets`
+ * never merged store-backed secrets into a channel config, and
+ * `settings.saveCredentials` threw `not-configured` for every pane save. Note
+ * cordis v4 has no `?` optional-inject marker, so `"credentials?"` would be read
+ * as a required service literally named `"credentials?"` — that is a syntax
+ * hazard, not a reason the service itself is unavailable.
  */
 export declare const inject: string[];
 /**
@@ -50,89 +60,73 @@ export declare const inject: string[];
  * web-settings state path. Each channel's own `Config` schema is also exported
  * (as `feishu.Config`, etc.) for reference; the merged entry validates loosely.
  */
-export declare const Config: z<Schemastery.ObjectS<{
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    /** Optional path to persist web-settings edits (non-secret). */
+    settingsStatePath: z<string, string, "plain">;
     /** Agent preset id composed into each bound session; omit for the roster default. */
-    agentPreset: z<string, string>;
+    agentPreset: z<string, string, "plain">;
     /** Absolute working directory per agent; defaults to the process cwd. */
-    workDir: z<string, string>;
+    workDir: z<string, string, "plain">;
     /** Optional workspace directories offered by the `/dir` chooser. */
-    workspaces: z<string[], string[]>;
+    workspaces: z<string[], string[], "plain">;
     /** Vision-capable model used to describe images when the main model can't see them. */
-    visionModel: z<Schemastery.ObjectS<{
-        provider: z<string, string>;
-        model: z<string, string>;
-    }>, Schemastery.ObjectT<{
-        provider: z<string, string>;
-        model: z<string, string>;
-    }>>;
+    visionModel: z<Schemastery.ObjectS<NoInfer<{
+        provider: z<string, string, "plain">;
+        model: z<string, string, "plain">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        provider: z<string, string, "plain">;
+        model: z<string, string, "plain">;
+    }>>, "plain">;
     /** User-facing message language: `zh` (default) or `en`. */
-    language: z<"zh" | "en", "zh" | "en">;
+    language: z<"zh" | "en", "zh" | "en", "plain">;
     /** Sender allowlist; empty = all senders allowed. */
-    allowUsers: z<string[], string[]>;
+    allowUsers: z<string[], string[], "plain">;
     /** Chat allowlist; empty = all chats allowed. */
-    allowChats: z<string[], string[]>;
+    allowChats: z<string[], string[], "plain">;
     /** Directory for the bindings.json routing store. */
-    stateDir: z<string, string>;
+    stateDir: z<string, string, "plain">;
     /** Automatically create a Web mirror for new sessions (default: true). */
-    autoMirror: z<boolean, boolean>;
+    autoMirror: z<boolean, boolean, "plain">;
     /** Liveness heartbeat interval ms for the streaming card; 0 disables it (default: 60000). */
-    streamHeartbeatMs: z<number, number>;
+    streamHeartbeatMs: z<number, number, "plain">;
     /** Default notification level for streaming replies. Default 'result' (final answer only) keeps cards short. */
-    notifyLevel: z<"full" | "important" | "result", "full" | "important" | "result">;
+    notifyLevel: z<"full" | "important" | "result", "full" | "important" | "result", "plain">;
     /** Proactive progress-notice interval ms when a turn stays silent (default: 300000 = 5 min; 0 disables). */
-    progressTimeoutMs: z<number, number>;
-    /** Channels to activate; default: all built-in channels. */
-    channels: z<("feishu" | "web" | "telegram" | "dingtalk")[], ("feishu" | "web" | "telegram" | "dingtalk")[]>;
-    /** Keys applied to every channel that doesn't set its own (e.g. a shared `language`). */
-    channelDefaults: z<any, any>;
-    feishu: z<any, any>;
-    telegram: z<any, any>;
-    dingtalk: z<any, any>;
-    web: z<any, any>;
+    progressTimeoutMs: z<number, number, "plain">;
+}>>, Schemastery.ObjectT<NoInfer<{
     /** Optional path to persist web-settings edits (non-secret). */
-    settingsStatePath: z<string, string>;
-}>, Schemastery.ObjectT<{
+    settingsStatePath: z<string, string, "plain">;
     /** Agent preset id composed into each bound session; omit for the roster default. */
-    agentPreset: z<string, string>;
+    agentPreset: z<string, string, "plain">;
     /** Absolute working directory per agent; defaults to the process cwd. */
-    workDir: z<string, string>;
+    workDir: z<string, string, "plain">;
     /** Optional workspace directories offered by the `/dir` chooser. */
-    workspaces: z<string[], string[]>;
+    workspaces: z<string[], string[], "plain">;
     /** Vision-capable model used to describe images when the main model can't see them. */
-    visionModel: z<Schemastery.ObjectS<{
-        provider: z<string, string>;
-        model: z<string, string>;
-    }>, Schemastery.ObjectT<{
-        provider: z<string, string>;
-        model: z<string, string>;
-    }>>;
+    visionModel: z<Schemastery.ObjectS<NoInfer<{
+        provider: z<string, string, "plain">;
+        model: z<string, string, "plain">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        provider: z<string, string, "plain">;
+        model: z<string, string, "plain">;
+    }>>, "plain">;
     /** User-facing message language: `zh` (default) or `en`. */
-    language: z<"zh" | "en", "zh" | "en">;
+    language: z<"zh" | "en", "zh" | "en", "plain">;
     /** Sender allowlist; empty = all senders allowed. */
-    allowUsers: z<string[], string[]>;
+    allowUsers: z<string[], string[], "plain">;
     /** Chat allowlist; empty = all chats allowed. */
-    allowChats: z<string[], string[]>;
+    allowChats: z<string[], string[], "plain">;
     /** Directory for the bindings.json routing store. */
-    stateDir: z<string, string>;
+    stateDir: z<string, string, "plain">;
     /** Automatically create a Web mirror for new sessions (default: true). */
-    autoMirror: z<boolean, boolean>;
+    autoMirror: z<boolean, boolean, "plain">;
     /** Liveness heartbeat interval ms for the streaming card; 0 disables it (default: 60000). */
-    streamHeartbeatMs: z<number, number>;
+    streamHeartbeatMs: z<number, number, "plain">;
     /** Default notification level for streaming replies. Default 'result' (final answer only) keeps cards short. */
-    notifyLevel: z<"full" | "important" | "result", "full" | "important" | "result">;
+    notifyLevel: z<"full" | "important" | "result", "full" | "important" | "result", "plain">;
     /** Proactive progress-notice interval ms when a turn stays silent (default: 300000 = 5 min; 0 disables). */
-    progressTimeoutMs: z<number, number>;
-    /** Channels to activate; default: all built-in channels. */
-    channels: z<("feishu" | "web" | "telegram" | "dingtalk")[], ("feishu" | "web" | "telegram" | "dingtalk")[]>;
-    /** Keys applied to every channel that doesn't set its own (e.g. a shared `language`). */
-    channelDefaults: z<any, any>;
-    feishu: z<any, any>;
-    telegram: z<any, any>;
-    dingtalk: z<any, any>;
-    web: z<any, any>;
-    /** Optional path to persist web-settings edits (non-secret). */
-    settingsStatePath: z<string, string>;
-}>>;
+    progressTimeoutMs: z<number, number, "plain">;
+}>>, "plain">;
 /** The merged plugin's config type (core fields + channel selector + settings). */
 export interface ConnectSettingsConfig extends ConnectConfig {
     /** Channels to activate; default: all built-in channels. */

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAchC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7H,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAClH,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,IAAI,YAAY,EAAE,cAAc,EAAE,OAAO,IAAI,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC1J,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,WAAW,EACX,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAG/C,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAC;AAEhD,qDAAqD;AACrD,eAAO,MAAM,IAAI,YAAY,CAAC;AAE9B;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAA8C,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,MAAM;IACjB,qFAAqF;;IAErF,yEAAyE;;IAEzE,oEAAoE;;IAEpE,uFAAuF;;;;;;;;IAEvF,4DAA4D;;IAE5D,qDAAqD;;IAErD,iDAAiD;;IAEjD,qDAAqD;;IAErD,0EAA0E;;IAE1E,6FAA6F;;IAE7F,gHAAgH;;IAEhH,4GAA4G;;IAE5G,4DAA4D;;IAE5D,yFAAyF;;;;;;IAMzF,gEAAgE;;;IAhChE,qFAAqF;;IAErF,yEAAyE;;IAEzE,oEAAoE;;IAEpE,uFAAuF;;;;;;;;IAEvF,4DAA4D;;IAE5D,qDAAqD;;IAErD,iDAAiD;;IAEjD,qDAAqD;;IAErD,0EAA0E;;IAE1E,6FAA6F;;IAE7F,gHAAgH;;IAEhH,4GAA4G;;IAE5G,4DAA4D;;IAE5D,yFAAyF;;;;;;IAMzF,gEAAgE;;GAEhE,CAAC;AAEH,mFAAmF;AACnF,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,+EAA+E;AAC/E,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,OAAO,EAAE,cAAc,CAAC;KACzB;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,qBAAqB,GAAG,IAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAiElG;;;;;;AAaD,wBAAuC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAKL,KAAK,WAAW,EAEjB,MAAM,wBAAwB,CAAC;AAyBhC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7H,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAClH,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,IAAI,YAAY,EAAE,cAAc,EAAE,OAAO,IAAI,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC1J,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,WAAW,EACX,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAG/C,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAC;AAsIhD,qDAAqD;AACrD,eAAO,MAAM,IAAI,YAAY,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,MAAM,UAA6D,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,MAAM;IAmCjB,gEAAgE;;IAlChE,qFAAqF;;IAErF,yEAAyE;;IAEzE,oEAAoE;;IAEpE,uFAAuF;;;;;;;;IAEvF,4DAA4D;;IAE5D,qDAAqD;;IAErD,iDAAiD;;IAEjD,qDAAqD;;IAErD,0EAA0E;;IAE1E,6FAA6F;;IAE7F,gHAAgH;;IAEhH,4GAA4G;;;IAY5G,gEAAgE;;IAlChE,qFAAqF;;IAErF,yEAAyE;;IAEzE,oEAAoE;;IAEpE,uFAAuF;;;;;;;;IAEvF,4DAA4D;;IAE5D,qDAAqD;;IAErD,iDAAiD;;IAEjD,qDAAqD;;IAErD,0EAA0E;;IAE1E,6FAA6F;;IAE7F,gHAAgH;;IAEhH,4GAA4G;;aAc5G,CAAC;AAEH,mFAAmF;AACnF,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,+EAA+E;AAC/E,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,OAAO,EAAE,cAAc,CAAC;KACzB;CACF;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,qBAAqB,GAAG,IAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAkNlG;;;;;;AAaD,wBAAuC"}

package/lib/index.js

@@ -13,12 +13,15 @@
 import { join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { ConnectService } from "./service.js";
-import { activateChannels, CHANNELS, injectSecrets, } from "./settings/channels.js";
+import { resolveStateDir } from "./state-dir.js";
+import { CHANNELS, extractConfigSecrets, injectSecrets, } from "./settings/channels.js";
+import { ChannelRuntime } from "./settings/channel-runtime.js";
+import { CONNECT_PRESENTATION, installConnectSection, materializeConfig, paneConfigFields, sectionOf, } from "./settings/namespace.js";
+import { importLegacySection } from "./settings/legacy-import.js";
 import { installSettingsRpc } from "./settings/settings-rpc.js";
 import { createSettingsService } from "./settings/settings-service.js";
-import { CHANNEL_CONFIG_FIELDS } from "./settings/settings-model.js";
-import { createCredentialStore, } from "./settings/credential-store.js";
-import { register as feishuRegister } from "./channels/feishu/index.js";
+import { CHANNEL_SECRET_KEYS, createCredentialStore, } from "./settings/credential-store.js";
+import { register as feishuRegister, loadCredentials } from "./channels/feishu/index.js";
 import { register as telegramRegister } from "./channels/telegram/index.js";
 import { register as dingtalkRegister } from "./channels/dingtalk/index.js";
 import { register as webRegister } from "./channels/web/index.js";
@@ -44,16 +47,145 @@ export * as dingtalk from "./channels/dingtalk/index.js";
 export * as web from "./channels/web/index.js";
 // Web-settings stack (host RPC + credential store + persistence + client model).
 export * as settings from "./settings/index.js";
+/**
+ * Backward-compat: on boot, seed the credential store from secrets a channel
+ * config already carries (e.g. `feishu.appId`/`appSecret` written into the
+ * profile before the web-settings pane existed). Keeps the pane's presence
+ * reporting honest — an upgraded user whose channels work via config-file
+ * secrets sees them as "已配置" instead of "未配置凭据".
+ *
+ * Non-destructive by design: a ref the store already holds is never re-written
+ * (pane-saved credentials always win), and only refs present in the config
+ * (non-empty string, at their real flat/nested location) are migrated. Secrets
+ * still never reach the settings state file — they only move into the store.
+ */
+async function seedCredentialRefs(provider, secretKeys, secrets) {
+    for (const [configKey, ref] of Object.entries(secretKeys)) {
+        const value = secrets[configKey];
+        if (value === undefined)
+            continue;
+        let alreadyConfigured = false;
+        try {
+            alreadyConfigured = (await provider.describe(ref)).configured === true;
+        }
+        catch {
+            alreadyConfigured = false;
+        }
+        if (alreadyConfigured)
+            continue;
+        try {
+            await provider.set(ref, value);
+        }
+        catch {
+            // Per-ref migration failure should never block activation.
+        }
+    }
+}
+/**
+ * Fold credentials left behind by the legacy one-click onboarding file into the
+ * store. Feishu's onboarding predates the credential store and wrote its own
+ * JSON, which nothing but the adapter read — so a user who onboarded before the
+ * store existed had a working bot that the settings pane reported as
+ * 「未配置凭据」 forever. Migration is idempotent and never overwrites a value the
+ * store already holds.
+ */
+async function migrateOnboardedSecrets(provider, enabled) {
+    if (!enabled.includes("feishu"))
+        return;
+    let onboarded = null;
+    try {
+        onboarded = loadCredentials();
+    }
+    catch {
+        return;
+    }
+    if (onboarded === null)
+        return;
+    await seedCredentialRefs(provider, CHANNEL_SECRET_KEYS.feishu, {
+        appId: onboarded.appId,
+        appSecret: onboarded.appSecret,
+    });
+}
+async function migrateConfigSecrets(provider, cfg, enabled) {
+    for (const ch of enabled) {
+        const secretKeys = CHANNEL_SECRET_KEYS[ch] ?? {};
+        if (Object.keys(secretKeys).length === 0)
+            continue;
+        const raw = cfg[ch];
+        const secrets = extractConfigSecrets(raw, ch, secretKeys);
+        if (Object.keys(secrets).length === 0)
+            continue;
+        await seedCredentialRefs(provider, secretKeys, secrets);
+    }
+    await migrateOnboardedSecrets(provider, enabled);
+}
+/**
+ * The profile entry id this instance was loaded from (`connect`).
+ *
+ * This — not the package name — is what `SettingsForms.replace()` addresses:
+ * its own jsdoc calls the first argument "Profile entry id". It comes from the
+ * loader entry, which is attached to the fiber at runtime but *typed* only in
+ * `cordis-plugin-loader`'s `declare module` augmentation; that package is the
+ * host's loader, not a dependency of this plugin, so importing the type is not
+ * an option and the narrow cast below is the whole of the compromise. Returns
+ * `undefined` outside a loader (`new Context().plugin(...)` in a test), which
+ * `installConnectSection` reports and degrades on rather than failing.
+ */
+function entryId(ctx) {
+    const fiber = ctx.fiber;
+    const id = fiber?.entry?.options?.id;
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+/**
+ * The Harness home as the host resolved it, when it told us.
+ *
+ * `profileContext.home` is the authoritative answer (it also covers a home
+ * configured outside the environment); `undefined` hands the question to
+ * `resolveHarnessHome()`, which repeats the `$DSH_HOME` → `~/.dsh` precedence on
+ * its own. The pre-0.2 settings document lived in the *home*, not in the
+ * profile directory, which is why this is not derived from the state dir.
+ */
+function harnessHome(ctx) {
+    const profile = ctx.get?.("profileContext");
+    return typeof profile?.home === "string" ? profile.home : undefined;
+}
+/**
+ * The active profile's patch file — `~/.dsh/profiles/<profile>/cordis.patch.yml`.
+ *
+ * Same `profileContext` service as above (`profileContext.patchPath`), and the
+ * same reason for going through `ctx.get`: the field is the host's, not ours.
+ * The one-shot legacy import anchors its marker on this path, because the
+ * marker means "this profile entry has already consumed the legacy document" and
+ * a profile is the only unit that can move without that staying true.
+ */
+function profilePatchPath(ctx) {
+    const profile = ctx.get?.("profileContext");
+    return typeof profile?.patchPath === "string" ? profile.patchPath : undefined;
+}
+/** One-line error text for a warning line; `String()` for a thrown non-Error. */
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
 /** Cordis plugin name used by loader diagnostics. */
 export const name = "connect";
 /**
- * Host-plane services this plugin must wait for before `apply` runs. All three
- * are provided by the base bundle. The credential store is NOT listed here:
- * cordis v4 has no `?` optional-inject marker — `"credentials?"` would be treated
- * as a required service literally named "credentials?" and stall the plugin. The
- * store is instead fetched lazily inside `apply` via the optional `ctx.get()`.
+ * Host-plane services this plugin must wait for before `apply` runs. All four
+ * are rows in the always-loaded `@deepseek-ai/dsh-base` bundle — the shared core
+ * of every base-backed profile — so requiring them cannot stall the plugin in
+ * any profile that can load `dsh-connect` at all.
+ *
+ * `credentials` must be listed here, not read lazily inside `apply`: a
+ * `ctx.get("credentials")` at apply time returns `undefined`, because this
+ * plugin activates before the credentials row does. That silently disabled the
+ * whole credential path — `migrateConfigSecrets` never seeded the store (so an
+ * upgraded user's working channels displayed "未配置凭据"), `injectSecrets`
+ * never merged store-backed secrets into a channel config, and
+ * `settings.saveCredentials` threw `not-configured` for every pane save. Note
+ * cordis v4 has no `?` optional-inject marker, so `"credentials?"` would be read
+ * as a required service literally named `"credentials?"` — that is a syntax
+ * hazard, not a reason the service itself is unavailable.
  */
-export const inject = ["agents", "sessions", "agentDefaultModel"];
+export const inject = ["agents", "sessions", "agentDefaultModel", "credentials"];
 /**
  * Full plugin config: the channel-agnostic core fields plus the channel
  * selector (`channels`), shared `channelDefaults`, per-channel config, and the
@@ -85,14 +217,16 @@ export const Config = z.object({
     notifyLevel: z.union([z.const("full"), z.const("important"), z.const("result")]),
     /** Proactive progress-notice interval ms when a turn stays silent (default: 300000 = 5 min; 0 disables). */
     progressTimeoutMs: z.number(),
-    /** Channels to activate; default: all built-in channels. */
-    channels: z.array(z.union([z.const("feishu"), z.const("telegram"), z.const("dingtalk"), z.const("web")])),
-    /** Keys applied to every channel that doesn't set its own (e.g. a shared `language`). */
-    channelDefaults: z.any(),
-    feishu: z.any(),
-    telegram: z.any(),
-    dingtalk: z.any(),
-    web: z.any(),
+    /**
+     * Channels to activate, shared `channelDefaults`, and the per-channel options
+     * the settings pane edits. Spread from `paneConfigFields()` rather than
+     * restated: those are exactly the fields a profile entry is allowed to
+     * hot-commit, so declaring them here as `volatile` leaves is what turns a pane
+     * save into a live change instead of a remount (see `settings/namespace.ts`).
+     * Each channel's `appSecret`/`appId`/`botToken` stays *outside* this set on
+     * purpose — a volatile container would copy the secret into the profile.
+     */
+    ...paneConfigFields(),
     /** Optional path to persist web-settings edits (non-secret). */
     settingsStatePath: z.string(),
 });
@@ -104,13 +238,23 @@ export const Config = z.object({
  * `apply` (the fiber is still LOADING until this function resolves).
  */
 export async function apply(ctx, config = {}) {
-    // Shallow-clone so we never mutate the caller's config object. Only core
-    // fields are consumed by ConnectService; the rest are channel/settings.
-    const cfg = { ...(config ?? {}) };
+    // `config` as the loader resolved it. The pane-editable field set is declared
+    // `volatile` (see `Config` above), so those fields arrive here as *references*
+    // (`{ get() }`) whose value the loader replaces in place, while ordinary
+    // fields arrive as plain data. Both are kept: every consumer below works on a
+    // materialized plain-data copy (`cfg`, and nothing mutates the caller's
+    // object — `materializeConfig` copies as it walks), and the references stay
+    // behind in `rawConfig` so a pane save can be read back without re-running
+    // `apply`.
+    const rawConfig = (config ?? {});
+    const cfg = materializeConfig(rawConfig);
     const connect = new ConnectService(ctx, cfg);
-    // Optional DSH credentials store: report presence + inject secrets into each
-    // channel config so store-backed secrets reach the adapter without the config
-    // file carrying them (they apply on the next plugin load).
+    // DSH credentials store: report presence + inject secrets into each channel
+    // config so store-backed secrets reach the adapter without the config file
+    // carrying them. `credentials` is a declared inject (see `inject` above), so
+    // it is guaranteed present by the time `apply` runs; the optional `ctx.get()`
+    // read is kept only so a bare context (unit tests) degrades to "no store"
+    // rather than throwing.
     const credentialsProvider = ctx.get?.("credentials");
     let credentialStore;
     if (credentialsProvider) {
@@ -122,50 +266,181 @@ export async function apply(ctx, config = {}) {
         }
     }
     const wanted = cfg.channels ?? CHANNELS;
+    // Migrate config-file secrets into the store before activation, so an upgraded
+    // user's already-working channels report as configured (and the store becomes
+    // the single source of truth). Best-effort: never blocks the plugin load.
+    if (credentialStore && credentialsProvider) {
+        try {
+            await migrateConfigSecrets(credentialsProvider, cfg, wanted);
+        }
+        catch {
+            // Ignore a migration failure; activation continues with existing config.
+        }
+    }
     const finalCfg = credentialStore
         ? await injectSecrets(cfg, wanted, (name) => credentialStore.get(name))
         : cfg;
     // Each channel's register receives the connect instance directly.
     const channels = {
-        feishu: (_ctx, channelConfig) => feishuRegister(connect, channelConfig, _ctx),
+        // Feishu additionally gets the credential store so a completed one-click
+        // onboarding lands in the DSH store (and not only in its own legacy file).
+        feishu: (_ctx, channelConfig) => feishuRegister(connect, channelConfig, _ctx, { credentialStore }),
         telegram: (_ctx, channelConfig) => telegramRegister(connect, channelConfig, _ctx),
         dingtalk: (_ctx, channelConfig) => dingtalkRegister(connect, channelConfig, _ctx),
         web: (_ctx, channelConfig) => webRegister(connect, channelConfig, _ctx),
     };
-    activateChannels(ctx, finalCfg, channels);
-    // Expose the web-settings RPC. The host `connection` service is loaded as a
-    // base plugin AFTER this user plugin's apply runs, so a plain optional inject
-    // would see `ctx.connection === undefined` (installSettingsRpc would no-op and
-    // no `/dsh-connect` channel would be mounted → the settings pane hangs on
-    // "加载中"). Instead defer the registration into a nested injection scope that
-    // waits for `connection` to be ready — the same pattern dsh-api-gateway uses
-    // for its `/api` RPC. If the host never provides `connection` (non-web
-    // runtime), the callback never runs and the RPC is simply absent.
-    // Web settings pane state. The pane edits a settings-shape config persisted to
-    // a JSON file and seeded from the live plugin config so it reflects the
-    // channels actually enabled. Only NON-SECRET editable fields are seeded per
-    // channel (secrets live in the credential store, never in the state file).
-    // Default the file path under the state dir so Save persists out of the box.
-    const settingsSeed = {
-        channels: finalCfg.channels ?? CHANNELS,
-        ...(finalCfg.channelDefaults ? { channelDefaults: finalCfg.channelDefaults } : {}),
+    // Channel lifecycle is owned by a runtime, not a one-shot activation: once
+    // the channel list is user-editable, dropping a channel has to *stop* its
+    // adapter (a live Feishu long connection would otherwise outlive its config)
+    // and a reconfigured channel has to restart before the old transport is
+    // still delivering. See `settings/channel-runtime.ts`.
+    const runtime = new ChannelRuntime({
+        ctx,
+        channels,
+        teardown: (name) => connect.unregisterAdapter(name),
+        getSecrets: credentialStore ? (name) => credentialStore.get(name) : undefined,
+    });
+    await runtime.apply(finalCfg);
+    // Web-settings pane state. The pane's store is the profile entry itself (see
+    // the namespace block below); this path backs only the *fallback* store, used
+    // by a host that has no settings service. (The one-shot legacy import used to
+    // record itself here too; it is anchored on the profile entry now, see
+    // `profilePatchPath` — this path is user-relocatable and deletable, which made
+    // it the wrong place to remember that a migration had run.) Resolved through
+    // the shared helper and off the *merged* config, so the state file lands beside
+    // `bindings.json` and can't disagree with the stores. This used to read the raw `cfg.stateDir`,
+    // which made the path `undefined` for every profile that never set
+    // `stateDir` — and an undefined path made the settings service degrade to
+    // in-memory, so a pane save silently vanished.
+    const settingsStatePath = finalCfg.settingsStatePath
+        ?? join(resolveStateDir(finalCfg), "dsh-connect-settings.json");
+    // One projection, two triggers. A change reaches the adapters either through
+    // a write (the settings pane, or the legacy import) or through the loader
+    // committing new values into the volatile references behind `rawConfig`, and
+    // both must hand the runtime the *same* shape: `ChannelRuntime` restarts an
+    // adapter whose config it reads as different, so a mismatch here would bounce
+    // a live channel on every commit.
+    const reconcile = () => {
+        void runtime.apply(sectionOf(materializeConfig(rawConfig)));
     };
-    for (const ch of CHANNELS) {
-        const raw = finalCfg[ch] ?? {};
-        const nonSecret = {};
-        for (const field of CHANNEL_CONFIG_FIELDS[ch] ?? []) {
-            if (raw[field.key] !== undefined)
-                nonSecret[field.key] = raw[field.key];
+    // Register the `connect` profile entry's pane fields with the host, so the
+    // channel selection and the per-channel non-secret options become
+    // user-editable and *effective*: the pane writes them onto the entry, the
+    // loader commits them into the volatile references `rawConfig` carries, and
+    // every change re-reconciles the running adapters through `reconcile`. The
+    // panel's own RPC (`settings/settings-rpc.ts`) is a separate transport onto
+    // the same service and is kept for the pane's compatibility path.
+    //
+    // Deferred through `inject` for the same reason as the RPC below: `settings`
+    // is a `dsh-base` row loaded after a user plugin's `apply` runs, so a plain
+    // optional read would see `undefined` and never register anything. If the
+    // host never provides it the callback never runs and the plugin config
+    // stands on its own — which is exactly what `installConnectSection` falls
+    // back to.
+    //
+    // Set once the seam is live; read lazily by the settings service below, which
+    // is built before the deferred callback runs.
+    let liveSection;
+    const installNamespace = (scopeCtx) => {
+        const settings = scopeCtx.get?.("settings");
+        // Suppress the host's automatic Plugins-page form for this entry: this
+        // plugin ships its own client pane, and two generated editors of the same
+        // fields is how a save silently reverts. `owner` must be *our* fiber — the
+        // method's default is the settings service's own fiber, which would attach
+        // the policy to the service and leave this entry's page alone.
+        if (typeof settings?.configure === "function") {
+            try {
+                const release = settings.configure(CONNECT_PRESENTATION, ctx.fiber);
+                if (typeof release === "function")
+                    ctx.effect(() => release);
+            }
+            catch (error) {
+                scopeCtx.logger?.warn?.(`connect: could not suppress the automatic settings page (${errorText(error)})`);
+            }
+        }
+        const installed = installConnectSection({
+            owner: scopeCtx,
+            settings,
+            config: rawConfig,
+            ns: entryId(ctx),
+            onChange: () => reconcile(),
+        });
+        liveSection = installed.handle;
+        // One-shot: fold a pre-0.2 `$DSH_HOME/settings.yaml` `dsh-connect:` section
+        // into the entry. The host's own legacy import renames that document and
+        // then drops this section — it has no entry by that name — so on an
+        // upgraded install this is the only remaining copy of the user's pane
+        // choices. Nothing happens when there is no such document, and `current` is
+        // the section in force, so the write cannot clear a field the legacy
+        // document does not mention.
+        const handle = installed.handle;
+        if (handle !== undefined) {
+            void importLegacySection({
+                home: harnessHome(scopeCtx),
+                write: (section) => handle.write(section),
+                current: installed.section,
+                statePath: settingsStatePath,
+                entryPath: profilePatchPath(scopeCtx),
+                logger: scopeCtx.logger,
+            });
         }
-        if (Object.keys(nonSecret).length)
-            settingsSeed[ch] = nonSecret;
+    };
+    if (typeof ctx.inject === "function") {
+        ctx.inject(["settings"], installNamespace);
     }
-    const settingsStatePath = finalCfg.settingsStatePath
-        ?? (cfg.stateDir ? join(cfg.stateDir, "dsh-connect-settings.json") : undefined);
-    const settingsService = createSettingsService({ statePath: settingsStatePath, credentialStore, initialConfig: settingsSeed });
+    else {
+        // Bare context (unit tests): no inject-scope API, install directly.
+        installNamespace(ctx);
+    }
+    // A pane save is not the only writer: editing a running profile's patch (or
+    // reloading the plugin entry) commits volatile paths without re-running
+    // `apply`. The host announces that here, so the adapters follow the config
+    // they were started from.
+    ctx.on("loader/volatile-update", () => reconcile());
+    // Expose the web-settings RPC. The host `connection`/`webServer` services are
+    // loaded as base plugins AFTER this user plugin's apply runs, so a plain
+    // optional inject would see `ctx.connection === undefined` and mount nothing
+    // (the settings pane then hangs on "加载中"). Instead defer the registration
+    // into a nested injection scope that waits for both to be ready — the same
+    // pattern dsh-api-gateway uses for its `/api` route. If the host never
+    // provides them (non-web runtime), the callback never runs and the RPC is
+    // simply absent.
+    //
+    // Both services are required in the injected set: `installSettingsRpc` mounts
+    // the channel as a `prefix` route on `webServer` itself (see its doc for why
+    // `connection.rpc.handle` cannot be used for a third-party channel), and it
+    // reads `connection.requestRejection` for the Host/Origin + browser-auth
+    // fence.
+    //
+    // Web settings pane state. When the namespace above is live, that registration
+    // *is* the store: the pane reads and writes this plugin's entry in the active
+    // profile patch (`cordis.patch.yml`) through `liveSection`, a save reconciles
+    // the adapters immediately (via the same `onChange`) and survives a restart.
+    // The JSON file below is then only a fallback for a host with no settings
+    // service, which is why the service takes the handle as a getter, not a value.
+    // Credentials are a second call, and a secret is not config: `onCredentialsSaved`
+    // is the reconcile trigger for that plane, since no config write happens.
+    //
+    // Seeded from the live plugin config so the pane reflects the channels
+    // actually enabled; only NON-SECRET *declared* fields (secrets live in the
+    // credential store, never in either store this file touches), which is
+    // exactly the projection `sectionOf` performs — the same one the write path
+    // applies, so the fallback store cannot drift from the entry.
+    const settingsSeed = { ...sectionOf(finalCfg) };
+    const settingsService = createSettingsService({
+        statePath: settingsStatePath,
+        credentialStore,
+        initialConfig: settingsSeed,
+        live: () => liveSection,
+        // A rotated secret is inert until the adapters are re-applied, and the
+        // namespace's `onChange` only fires for a config write — the pane saves
+        // credentials as a second, separate call. Without this the user pastes a
+        // new appSecret, is told 「已保存」, and the bot stays broken until restart.
+        onCredentialsSaved: () => reconcile(),
+    });
     if (typeof ctx.inject === "function") {
-        ctx.inject(["connection"], (connectionCtx) => {
-            installSettingsRpc(connectionCtx, { service: settingsService });
+        ctx.inject(["connection", "webServer"], (scopeCtx) => {
+            installSettingsRpc(scopeCtx, { service: settingsService });
         });
     }
     else {