dsh-keys-manager 0.2.2 → 0.2.4

package/lib/client.js

@@ -44,9 +44,20 @@ var zh = {
   title: "\u5BC6\u94A5\u7BA1\u7406",
   subtitle: "\u4E3A\u540C\u4E00\u4E2A Provider \u914D\u7F6E\u591A\u4E2A API Key\u3002\u5355\u4F1A\u8BDD\u56FA\u5B9A\u4F7F\u7528\u4E00\u4E2A Key\uFF0C\u65B0\u4F1A\u8BDD\u8F6E\u6362\uFF1B\u5931\u8D25\u540E\u81EA\u52A8\u51B7\u5374\u5E76\u6062\u590D\u3002",
   search: "\u641C\u7D22 Provider\uFF08\u540D\u79F0\u3001ID \u6216\u73AF\u5883\u53D8\u91CF\uFF09",
+  filterAll: "\u5168\u90E8",
+  filterBuiltin: "\u5185\u7F6E",
+  filterPlugin: "\u63D2\u4EF6",
+  filterOauth: "\u652F\u6301 OAuth",
+  filterTransport: "\u4F20\u8F93",
+  filterGroup: "\u7B5B\u9009",
+  // Unattributed requests (I-000120, D8): the compass's fixed copy, shared
+  // with the filter plan's dictionary task — one pair, never a second.
+  unattributed: "{n} \u65E0\u5F52\u5C5E",
+  unattributedHint: "\u8BE5\u8DEF\u7531\u5728\u5F52\u5C5E\u8BFB\u53D6\u5C1A\u672A\u843D\u5730\uFF08\u6216\u5DF2\u5931\u8D25\uFF09\u671F\u95F4\u5E94\u7B54\u7684\u6D41\u5C1D\u8BD5\u6570\uFF1B\u5931\u8D25\u8F6C\u79FB\u91CD\u8BD5\u4F1A\u5404\u8BA1\u4E00\u6B21\uFF0C\u6545\u5355\u4E2A\u8BF7\u6C42\u53EF\u80FD\u88AB\u8BA1\u591A\u6B21\u3002\u8BFB\u53D6\u5B8C\u6210\u5F52\u5C5E\u540E\u6E05\u96F6\u3002",
   managed: "\u5DF2\u63A5\u7BA1",
   available: "\u53EF\u6DFB\u52A0 Providers",
   managedEmpty: "\u8FD8\u6CA1\u6709\u63A5\u7BA1\u7684 Provider\u3002\u4ECE\u4E0B\u65B9\u9009\u62E9\u4E00\u4E2A\u5F00\u59CB\u3002",
+  managedFilteredEmpty: "\u5F53\u524D\u7B5B\u9009\u4E0B\u6CA1\u6709\u5DF2\u63A5\u7BA1\u7684 Provider\u3002",
   availableEmpty: "\u6CA1\u6709\u5339\u914D\u7684 Provider\u3002",
   keys: "\u5BC6\u94A5",
   healthy: "\u53EF\u7528",
@@ -194,7 +205,8 @@ var zh = {
   deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002",
   // Transport accounts (llm-omp-transports/<route>): managed beside the
   // pi-ai pool, so the copy never promises a key-pool fallback.
-  transportAccounts: "\u4F20\u8F93\u8D26\u6237",
+  transportEmpty: "\u8FD8\u6CA1\u6709\u4F20\u8F93\u8D26\u6237\u3002",
+  transportProviderHint: "\u8BE5\u8DEF\u7531\u7531\u4F20\u8F93\u63D2\u4EF6\u63D0\u4F9B\uFF0C\u51ED\u8BC1\u5C31\u5728\u672C\u5361\u7247\u4E2D\u7BA1\u7406\u3002",
   transportTag: "\u4F20\u8F93",
   transportSignIn: "\u767B\u5F55",
   transportExpires: "\u6709\u6548\u671F\u81F3 {time}",
@@ -203,16 +215,32 @@ var zh = {
   transportStatusNeedsReauth: "\u9700\u91CD\u65B0\u767B\u5F55",
   transportStatusSignedOut: "\u672A\u767B\u5F55",
   transportRemoveTitle: "\u79FB\u9664 {name} \u4F20\u8F93\u8D26\u6237\uFF1F",
-  transportRemoveBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u4F20\u8F93\u8DEF\u7531\u4FDD\u5B58\u7684\u6388\u6743\uFF0C\u5E76\u53D6\u6D88\u4ECD\u5728\u8FDB\u884C\u7684\u767B\u5F55\uFF1B\u8DEF\u7531\u81EA\u8EAB\u4E0D\u4F1A\u91CD\u5EFA\u5B83\u3002\u8981\u6062\u590D\u670D\u52A1\u9700\u8981\u91CD\u65B0\u767B\u5F55\u3002"
+  transportRemoveBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u4F20\u8F93\u8DEF\u7531\u4FDD\u5B58\u7684\u6388\u6743\uFF0C\u5E76\u53D6\u6D88\u4ECD\u5728\u8FDB\u884C\u7684\u767B\u5F55\uFF1B\u8DEF\u7531\u81EA\u8EAB\u4E0D\u4F1A\u91CD\u5EFA\u5B83\u3002\u8981\u6062\u590D\u670D\u52A1\u9700\u8981\u91CD\u65B0\u767B\u5F55\u3002",
+  // The route's model allow-list, edited in the transport card.
+  transportModels: "\u6A21\u578B",
+  transportModelsAll: "\u5168\u90E8\u6A21\u578B",
+  transportModelsSelected: "\u5DF2\u9009 {n}/{total}",
+  transportModelsLoading: "\u6B63\u5728\u52A0\u8F7D\u6A21\u578B\u2026",
+  transportModelsClear: "\u6E05\u9664\u9009\u62E9",
+  transportModelsHint: "\u4E0D\u52FE\u9009\u4EFB\u4F55\u6A21\u578B\u8868\u793A\u4F7F\u7528\u5168\u90E8\u6A21\u578B\uFF1B\u4FDD\u5B58\u540E\u8BE5\u8DEF\u7531\u7684\u6A21\u578B\u5217\u8868\u968F\u4E4B\u6536\u7A84\u3002"
 };
 var en = {
   nav: "Keys Manager",
   title: "Keys Manager",
   subtitle: "Give one provider several API keys. A session keeps one key; new sessions rotate; failures cool down and recover automatically.",
   search: "Search providers by name, id, or environment variable",
+  filterAll: "All",
+  filterBuiltin: "Built-in",
+  filterPlugin: "Plugin",
+  filterOauth: "OAuth-capable",
+  filterTransport: "Transport",
+  filterGroup: "Filters",
+  unattributed: "{n} unattributed",
+  unattributedHint: "Stream attempts this route served with no account owner because its ownership read had not landed (or had failed). A failover retry is a new attempt, so one request can be counted more than once. The count clears when a read attributes the route.",
   managed: "Managed",
   available: "Available providers",
   managedEmpty: "No managed providers yet. Adopt one below to start.",
+  managedFilteredEmpty: "No managed providers match the current filter.",
   availableEmpty: "No matching providers.",
   keys: "keys",
   healthy: "healthy",
@@ -359,7 +387,8 @@ var en = {
   deleteAccountBody: "This removes the account\u2019s stored OAuth grant from the credential store. If it is the active account, the provider route stops serving it and falls back to its API-key pool; the provider stays managed.",
   deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again.",
   // Transport accounts — same values as locale/en.json.
-  transportAccounts: "Transport accounts",
+  transportEmpty: "No transport accounts yet.",
+  transportProviderHint: "Served by a transport plugin: its credential is managed inside this card.",
   transportTag: "Transport",
   transportSignIn: "Sign in",
   transportExpires: "Expires {time}",
@@ -368,7 +397,14 @@ var en = {
   transportStatusNeedsReauth: "Sign in again",
   transportStatusSignedOut: "Not signed in",
   transportRemoveTitle: "Remove the {name} transport account?",
-  transportRemoveBody: "This removes the grant stored for this transport route from the credential store and cancels a sign-in still in progress; the route does not recreate it. Sign in again to restore service."
+  transportRemoveBody: "This removes the grant stored for this transport route from the credential store and cancels a sign-in still in progress; the route does not recreate it. Sign in again to restore service.",
+  // The route's model allow-list, edited in the transport card.
+  transportModels: "Models",
+  transportModelsAll: "All models",
+  transportModelsSelected: "{n} of {total} selected",
+  transportModelsLoading: "Loading models\u2026",
+  transportModelsClear: "Clear selection",
+  transportModelsHint: "Leave every model unchecked to use the full catalog; saving narrows the list this route advertises."
 };
 var LOCALE_DICTS = { zh, en };
 
@@ -386,6 +422,13 @@ var CSS = `
 .km-stat{display:flex;flex-direction:column;gap:2px;padding:11px 14px;border:1px solid var(--dsw-alias-border-l1);border-radius:10px;background:var(--dsw-alias-bg-layer-1)}
 .km-stat strong{font-size:19px;line-height:1.15;font-weight:650;font-variant-numeric:tabular-nums}
 .km-stat span{color:var(--dsw-alias-label-secondary);font-size:12px}
+.km-filters{display:flex;flex-wrap:wrap;gap:8px;margin:0 0 12px}
+.km-chip{display:inline-flex;align-items:center;gap:6px;padding:5px 11px;border:1px solid var(--dsw-alias-border-l1);border-radius:999px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);font:inherit;font-size:12.5px;cursor:pointer}
+.km-chip:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary)}
+.km-chip:focus-visible{border-color:var(--dsw-alias-state-business-primary);box-shadow:0 0 0 2px color-mix(in srgb,var(--dsw-alias-state-business-primary) 20%,transparent)}
+.km-chip-on{border-color:color-mix(in srgb,var(--dsw-alias-state-business-primary) 55%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 12%,var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-label-primary)}
+.km-chip-count{font-size:11.5px;color:var(--dsw-alias-label-secondary);font-variant-numeric:tabular-nums}
+.km-chip-on .km-chip-count{color:inherit}
 .km-search{position:relative;display:flex;align-items:center;margin:0 0 20px}
 .km-search-icon{position:absolute;left:12px;color:var(--dsw-alias-label-secondary);pointer-events:none}
 .km-search-input{width:100%;box-sizing:border-box;padding:10px 38px 10px 36px;border:1px solid var(--dsw-alias-border-l1);border-radius:10px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);font:inherit;outline:none}
@@ -428,6 +471,19 @@ var CSS = `
 .km-account-row{position:relative;display:grid;grid-template-columns:minmax(0,1.35fr) minmax(150px,.8fr) minmax(150px,.9fr) 32px;gap:10px;align-items:center;padding:10px 11px 10px 14px;border-top:1px solid var(--dsw-alias-border-l1)}
 .km-account-row:first-child{border-top:0}
 .km-account-row::before{content:'';position:absolute;left:0;top:12px;bottom:12px;width:2px;border-radius:1px;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 55%,transparent)}
+.km-transport-row{grid-template-columns:minmax(0,1.35fr) minmax(150px,.8fr) minmax(150px,.9fr) auto}
+.km-transport-body{display:flex;flex-direction:column;gap:10px}
+.km-models{border:1px solid var(--dsw-alias-border-l1);border-radius:9px;background:var(--dsw-alias-bg-layer-1)}
+.km-models-head{display:flex;align-items:center;gap:7px;width:100%;padding:9px 11px;border:0;border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;font-weight:550;text-align:left;cursor:pointer}
+.km-models-head:hover{background:var(--dsw-alias-bg-layer-2)}
+.km-models-title{font-weight:600}
+.km-models-body{display:flex;flex-direction:column;gap:9px;padding:9px 11px 11px;border-top:1px solid var(--dsw-alias-border-l1)}
+.km-models-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:3px 10px;max-height:220px;overflow:auto}
+.km-model-option{display:flex;align-items:center;gap:7px;min-width:0;font-size:12px;color:var(--dsw-alias-label-primary);cursor:pointer}
+.km-model-option input{flex:0 0 auto;margin:0;accent-color:var(--dsw-alias-state-business-primary)}
+.km-model-option span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.km-models-actions{display:flex;justify-content:flex-end;gap:8px}
+.km-models-failure{display:flex;flex-direction:column;gap:8px;align-items:flex-start}
 .km-account-glyph{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;flex:0 0 22px;border-radius:50%;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 14%,var(--dsw-alias-bg-layer-2));color:var(--dsw-alias-state-business-primary)}
 .km-key-identity{min-width:0;display:flex;flex-direction:column;gap:2px}
 .km-key-alias-line{display:flex;align-items:center;gap:6px;min-width:0}
@@ -437,7 +493,7 @@ var CSS = `
 .km-key-last{display:flex;flex-direction:column;gap:2px;min-width:0}
 .km-key-time{font-size:11.5px;color:var(--dsw-alias-label-secondary);font-variant-numeric:tabular-nums}
 .km-key-time.km-warn{color:var(--dsw-alias-state-warn-primary)}
-.km-key-actions{position:relative;display:flex;justify-content:flex-end}
+.km-key-actions{position:relative;display:flex;justify-content:flex-end;gap:6px}
 .km-status{display:inline-flex;align-items:center;gap:5px;padding:2px 7px;border-radius:999px;border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-layer-2);font-size:11px;white-space:nowrap;color:var(--dsw-alias-label-secondary)}
 .km-status-success{color:var(--dsw-alias-state-success-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-success-primary) 26%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 8%,transparent)}
 .km-status-warn{color:var(--dsw-alias-state-warn-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 30%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 8%,transparent)}
@@ -553,6 +609,8 @@ select.km-input{appearance:auto}
   .km-key-row,.km-account-row{grid-template-columns:minmax(0,1fr) 32px;gap:6px}
   .km-key-status,.km-key-last{grid-column:1;padding-left:0}
   .km-key-actions{grid-column:2;grid-row:1}
+  .km-transport-row{grid-template-columns:minmax(0,1fr) auto}
+  .km-transport-row .km-key-actions{justify-content:flex-end;flex-wrap:wrap}
   .km-settings-grid{grid-template-columns:1fr}
   .km-form-grid{grid-template-columns:1fr}
   .km-provider-side .km-status{display:none}
@@ -614,6 +672,37 @@ function wrapComponent(Component, runtime) {
   };
 }
 
+// src/client/format.ts
+function cooldownMinutes(ms) {
+  return ms / 6e4;
+}
+function cooldownMs(minutes) {
+  return Math.max(0.5, minutes) * 6e4;
+}
+function graceMinutes(ms) {
+  return ms / 6e4;
+}
+function graceMs(minutes) {
+  return Math.max(0, minutes) * 6e4;
+}
+function shapeTransportModels(value) {
+  const record = value !== null && typeof value === "object" ? value : {};
+  const catalog = [];
+  if (Array.isArray(record.catalog)) {
+    for (const row of record.catalog) {
+      if (row === null || typeof row !== "object") continue;
+      const { id, name } = row;
+      if (typeof id === "string" && id.length > 0 && typeof name === "string") catalog.push({ id, name });
+    }
+  }
+  const models = Array.isArray(record.models) ? record.models.filter((id) => typeof id === "string") : [];
+  return { catalog, models };
+}
+function modelPickerRows(view) {
+  const selected = new Set(view.models);
+  return view.catalog.map((row) => ({ id: row.id, name: row.name, selected: selected.has(row.id) }));
+}
+
 // src/client/store.ts
 function messageOf(error) {
   if (error instanceof Error && error.message.length > 0) return error.message;
@@ -713,6 +802,9 @@ function createStore(ctx) {
   const attemptOutcome = (value) => {
     return { ok: true, value: value ?? null };
   };
+  const modelsOutcome = (value) => {
+    return { ok: true, value: shapeTransportModels(value) };
+  };
   const testOutcome = (value) => {
     const result = value ?? {};
     return {
@@ -801,6 +893,14 @@ function createStore(ctx) {
     removeTransportAccount(route) {
       return send("removeTransportAccount", { provider: route }, stateOutcome);
     },
+    async transportModels(route) {
+      const result = await rpcRead("transportModels", { provider: route });
+      if (!result.ok) return { ok: false, error: result.error.message };
+      return { ok: true, value: shapeTransportModels(result.value) };
+    },
+    saveTransportModels(route, models) {
+      return send("saveTransportModels", { provider: route, models }, modelsOutcome);
+    },
     tick() {
       update({ now: Date.now() });
       if (snapshot.status === "ready" && snapshot.busy === null) void this.load({ keepError: true });
@@ -814,22 +914,6 @@ function createStore(ctx) {
 
 // src/client/ui.ts
 var import_react2 = __toESM(require("react"), 1);
-
-// src/client/format.ts
-function cooldownMinutes(ms) {
-  return ms / 6e4;
-}
-function cooldownMs(minutes) {
-  return Math.max(0.5, minutes) * 6e4;
-}
-function graceMinutes(ms) {
-  return ms / 6e4;
-}
-function graceMs(minutes) {
-  return Math.max(0, minutes) * 6e4;
-}
-
-// src/client/ui.ts
 var h = import_react2.default.createElement;
 function cx(...values) {
   return values.filter(Boolean).join(" ");
@@ -873,6 +957,37 @@ function providerInitial(provider) {
 function oauthCapable(provider) {
   return provider.nativeAuth?.oauth === true && provider.accountSupported !== false;
 }
+function originOf(provider) {
+  return provider.origin ?? (provider.extra ? "plugin" : "dsh");
+}
+var FILTER_CHIPS = [
+  { value: "all", label: "filterAll" },
+  { value: "builtin", label: "filterBuiltin" },
+  { value: "plugin", label: "filterPlugin" },
+  { value: "oauth", label: "filterOauth" },
+  { value: "transport", label: "filterTransport" }
+];
+function matchesFilter(provider, filter) {
+  switch (filter) {
+    case "transport":
+      return provider.transport === true;
+    case "builtin":
+      return provider.transport !== true && originOf(provider) === "dsh";
+    case "plugin":
+      return provider.transport !== true && originOf(provider) === "plugin";
+    case "oauth":
+      return provider.transport !== true && oauthCapable(provider);
+    default:
+      return true;
+  }
+}
+function orphanTransportAccounts(providers, transportAccounts) {
+  return transportAccounts.filter((account) => !providers.some((provider) => provider.transport === true && provider.provider === account.id));
+}
+function managedEntryCount(providers, transportAccounts) {
+  const cards = providers.filter((provider) => provider.managed || provider.transport === true).length;
+  return cards + orphanTransportAccounts(providers, transportAccounts).length;
+}
 function accountIdentityOf(key, provider) {
   const oauth = key.oauth;
   if (oauth !== null && oauth !== void 0) {
@@ -1648,7 +1763,118 @@ function TransportAccountRow({ account }) {
     }) : null
   );
 }
-function ProviderCard({ provider, expanded, onToggle, now }) {
+function TransportModels({ route }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const [open, setOpen] = import_react2.default.useState(false);
+  const [view, setView] = import_react2.default.useState(null);
+  const [draft, setDraft] = import_react2.default.useState(/* @__PURE__ */ new Set());
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const loading = import_react2.default.useRef(false);
+  async function load() {
+    if (loading.current) return;
+    loading.current = true;
+    setError(null);
+    const result = await runtime.store.transportModels(route);
+    loading.current = false;
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    setView(result.value);
+    setDraft(new Set(result.value.models));
+  }
+  function toggle() {
+    const next = !open;
+    setOpen(next);
+    if (next && view === null) void load();
+  }
+  function toggleModel(id) {
+    setDraft((current) => {
+      const next = new Set(current);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  }
+  async function save() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.saveTransportModels(route, [...draft]);
+    setBusy(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    setView(result.value);
+    setDraft(new Set(result.value.models));
+  }
+  const rows = view === null ? [] : modelPickerRows(view);
+  const errorLine = error === null ? null : h("div", { className: "km-inline-error", role: "alert" }, error);
+  return h(
+    "div",
+    { className: "km-models" },
+    h(
+      "button",
+      {
+        type: "button",
+        className: "km-models-head",
+        onClick: toggle,
+        "aria-expanded": open
+      },
+      h(Icon, { name: "chevron", size: 14, className: cx("km-chevron", open && "km-chevron-open") }),
+      h("span", { className: "km-models-title" }, t("transportModels")),
+      view === null ? null : h(
+        "span",
+        { className: "km-muted" },
+        draft.size === 0 ? t("transportModelsAll") : t("transportModelsSelected", { n: draft.size, total: view.catalog.length })
+      )
+    ),
+    open ? h(
+      "div",
+      { className: "km-models-body" },
+      // A failed load leaves no view: showing the loading line next to the
+      // error would claim a request that already finished, and Save must stay
+      // off without a view so a failed read cannot clear the saved selection.
+      // A failed save keeps the loaded view and reports above the grid.
+      view === null ? null : errorLine,
+      view === null ? error !== null ? h(
+        "div",
+        { className: "km-models-failure" },
+        errorLine,
+        h(Button, { size: "small", variant: "primary", onClick: () => void load() }, t("reload"))
+      ) : h("div", { className: "km-muted" }, t("transportModelsLoading")) : h("div", { className: "km-models-grid" }, rows.map((row) => h(
+        "label",
+        { key: row.id, className: "km-model-option" },
+        h("input", {
+          type: "checkbox",
+          checked: draft.has(row.id),
+          onChange: () => toggleModel(row.id),
+          disabled: busy
+        }),
+        h("span", null, row.name)
+      ))),
+      h(
+        "div",
+        { className: "km-models-actions" },
+        h(
+          Button,
+          { size: "small", variant: "primary", onClick: () => void save(), disabled: busy || view === null },
+          busy ? t("saving") : t("save")
+        ),
+        h(Button, {
+          size: "small",
+          variant: "ghost",
+          onClick: () => setDraft(/* @__PURE__ */ new Set()),
+          disabled: busy || view === null || draft.size === 0
+        }, t("transportModelsClear"))
+      ),
+      h("div", { className: "km-field-hint" }, t("transportModelsHint"))
+    ) : null
+  );
+}
+function ProviderCard({ provider, expanded, onToggle, now, transportAccount }) {
   const runtime = useRuntime();
   const t = useT();
   const [adding, setAdding] = import_react2.default.useState(false);
@@ -1663,11 +1889,15 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
   const keyCount = provider.keyCount;
   const warning = provider.warning;
   const isExtra = provider.extra;
-  const origin = provider.origin ?? (provider.extra ? "plugin" : "dsh");
-  const originLabel = origin === "plugin" ? t("pluginBuiltin") : origin === "dsh" ? t("dshBuiltin") : t("customProvider");
+  const transport = provider.transport === true;
+  const origin = originOf(provider);
+  const originLabel = transport || origin === "plugin" ? t("pluginBuiltin") : origin === "dsh" ? t("dshBuiltin") : t("customProvider");
   const providerMeta = [
     provider.provider,
-    provider.active ? t("active") : provider.configured ? t("configured") : t("notConfigured"),
+    // `active`/`configured` are read off the route's profile or the host's
+    // provider list, neither of which describes a transport route: its state
+    // is the account row it carries (signed out when the host lists none).
+    transport ? t(transportStatusKey(transportAccount?.status ?? "signed-out")) : provider.active ? t("active") : provider.configured ? t("configured") : t("notConfigured"),
     provider.api ?? null
   ].filter((value) => Boolean(value));
   async function adopt() {
@@ -1719,7 +1949,7 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
   const adoptable = provider.supported || accountAdoptable;
   return h(
     "div",
-    { className: cx("km-card", "km-provider", expanded && "km-provider-open", managed && "km-provider-managed") },
+    { className: cx("km-card", "km-provider", expanded && "km-provider-open", (managed || transport) && "km-provider-managed") },
     h(
       "button",
       {
@@ -1737,8 +1967,9 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
           { className: "km-provider-title-line" },
           h("span", { className: "km-provider-name" }, provider.displayName || provider.provider),
           h("span", { className: "km-tag" }, originLabel),
+          transport ? h("span", { className: "km-tag km-tag-accent" }, t("transportTag")) : null,
           managed ? h("span", { className: "km-tag km-tag-accent" }, t("managedBadge")) : null,
-          !managed && !provider.supported && !accountAdoptable ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
+          !transport && !managed && !provider.supported && !accountAdoptable ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
         ),
         h(
           "span",
@@ -1752,7 +1983,14 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
       h(
         "span",
         { className: "km-provider-side" },
-        managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, adoptable ? t("unmanaged") : t("unsupported")),
+        // I-000120 / D8: requests this route served without an attributed
+        // account. Rendered only above zero, and the visible label carries the
+        // count so it is the accessible name; the hint stays a description.
+        (provider.unattributedRequests ?? 0) > 0 ? h("span", {
+          className: "km-tag km-tag-warn km-unattributed",
+          title: t("unattributedHint")
+        }, t("unattributed", { n: provider.unattributedRequests ?? 0 })) : null,
+        transport ? null : managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, adoptable ? t("unmanaged") : t("unsupported")),
         managed ? h(StatusPill, { status: provider.status, t }) : null,
         h(Icon, { name: "chevron", size: 16, className: cx("km-chevron", expanded && "km-chevron-open") })
       )
@@ -1762,7 +2000,15 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
       { className: "km-provider-body" },
       error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
       warning !== void 0 || broken ? h(Notice, { tone: "warn", title: t("warning") }, broken ? t("bindingBroken") : warning) : null,
-      !managed ? h(
+      // A transport route has no adopt step and no key pool: its whole
+      // credential surface is the one account row its own plugin serves, plus
+      // the model allow-list its adapter advertises.
+      transport ? h(
+        "div",
+        { className: "km-transport-body" },
+        transportAccount !== void 0 ? h("div", { className: "km-keys" }, h(TransportAccountRow, { account: transportAccount })) : h("div", { className: "km-muted" }, t("transportProviderHint")),
+        h(TransportModels, { route: provider.provider })
+      ) : !managed ? h(
         "div",
         { className: "km-adopt" },
         h(
@@ -2178,6 +2424,7 @@ function KeysManagerBody() {
   const state = snapshot.state;
   const now = snapshot.now;
   const [query, setQuery] = import_react2.default.useState("");
+  const [filter, setFilter] = import_react2.default.useState("all");
   const [showAllAvailable, setShowAllAvailable] = import_react2.default.useState(false);
   const [expanded, setExpanded] = import_react2.default.useState(() => /* @__PURE__ */ new Set());
   const loadedRef = import_react2.default.useRef(false);
@@ -2201,9 +2448,23 @@ function KeysManagerBody() {
     ].filter((value) => Boolean(value)).join(" ").toLowerCase();
     return haystack.includes(normalizedQuery);
   };
-  const managed = providers.filter((provider) => provider.managed && matches(provider));
-  const available = providers.filter((provider) => !provider.managed && matches(provider));
+  const managed = providers.filter((provider) => (provider.managed || provider.transport === true) && matchesFilter(provider, filter) && matches(provider));
+  const available = providers.filter((provider) => !provider.managed && provider.transport !== true && matchesFilter(provider, filter) && matches(provider));
   const visibleAvailable = showAllAvailable || normalizedQuery.length > 0 ? available : available.slice(0, 12);
+  const matchesAccount = (account) => {
+    if (normalizedQuery.length === 0) return true;
+    const haystack = [account.id, account.scope, account.displayName].join(" ").toLowerCase();
+    return haystack.includes(normalizedQuery);
+  };
+  const orphanAccounts = orphanTransportAccounts(providers, transportAccounts).filter(matchesAccount);
+  const visibleOrphans = filter === "all" || filter === "transport" ? orphanAccounts : [];
+  const filterCount = (value) => {
+    const searchable = providers.filter(matches);
+    if (value === "all") return searchable.length + orphanAccounts.length;
+    if (value === "transport") return searchable.filter((provider) => provider.transport === true).length + orphanAccounts.length;
+    return searchable.filter((provider) => matchesFilter(provider, value)).length;
+  };
+  const managedHiddenByChip = filter !== "all" && providers.some((provider) => provider.managed || provider.transport === true);
   function toggle(provider) {
     setExpanded((current) => {
       const next = new Set(current);
@@ -2242,7 +2503,7 @@ function KeysManagerBody() {
       h(
         "div",
         { className: "km-summary" },
-        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.managedCount ?? 0), h("span", null, t("managed"))),
+        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : managedEntryCount(providers, transportAccounts)), h("span", null, t("managed"))),
         h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.keyCount ?? 0), h("span", null, t("keys"))),
         h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.healthyKeyCount ?? 0), h("span", null, t("healthy"))),
         h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.coolingKeyCount ?? 0), h("span", null, t("cooling")))
@@ -2259,6 +2520,26 @@ function KeysManagerBody() {
         }, h(Icon, { name: "refresh", size: 14 }), t("refresh"))
       )
     ),
+    // Quick filter: single select, view state only, composed with the text
+    // search below. Counts are derived per predicate from the snapshot.
+    !loading && !failed ? h("div", {
+      className: "km-filters",
+      role: "group",
+      "aria-label": t("filterGroup")
+    }, FILTER_CHIPS.map(
+      (chip) => h(
+        "button",
+        {
+          key: chip.value,
+          type: "button",
+          className: cx("km-chip", `km-chip-${chip.value}`, filter === chip.value && "km-chip-on"),
+          "aria-pressed": filter === chip.value,
+          onClick: () => setFilter(chip.value)
+        },
+        h("span", { className: "km-chip-label" }, t(chip.label)),
+        h("span", { className: "km-chip-count" }, filterCount(chip.value))
+      )
+    )) : null,
     h(
       "div",
       { className: "km-search" },
@@ -2288,15 +2569,29 @@ function KeysManagerBody() {
         "div",
         { className: "km-section-head" },
         h("h2", { className: "km-section-title" }, t("managed")),
-        h("span", { className: "km-section-count" }, managed.length)
+        // What is below it, like the available section: the tile above keeps
+        // the global total.
+        h("span", { className: "km-section-count" }, managed.length + visibleOrphans.length)
       ),
-      managed.length === 0 ? h("div", { className: "km-empty" }, h(Icon, { name: "key", size: 20 }), h("span", null, t("managedEmpty"))) : h("div", { className: "km-provider-list" }, managed.map((provider) => h(ProviderCard, {
+      // The placeholder only when the section renders neither a card nor a row
+      // the active chip selects.
+      managed.length === 0 && visibleOrphans.length === 0 ? h("div", { className: "km-empty" }, h(Icon, { name: "key", size: 20 }), h(
+        "span",
+        null,
+        normalizedQuery.length > 0 ? t("noSearch") : filter === "transport" ? t("transportEmpty") : managedHiddenByChip ? t("managedFilteredEmpty") : t("managedEmpty")
+      )) : null,
+      managed.length > 0 ? h("div", { className: "km-provider-list" }, managed.map((provider) => h(ProviderCard, {
         key: provider.provider,
         provider,
         now,
+        transportAccount: provider.transport === true ? transportAccounts.find((account) => account.id === provider.provider) : void 0,
         expanded: expanded.has(provider.provider),
         onToggle: () => toggle(provider.provider)
-      })))
+      }))) : null,
+      visibleOrphans.length > 0 ? h("div", { className: "km-provider-list" }, visibleOrphans.map((account) => h(TransportAccountRow, {
+        key: account.scope,
+        account
+      }))) : null
     ) : null,
     !loading && !failed ? h(
       "section",
@@ -2324,20 +2619,6 @@ function KeysManagerBody() {
         h(Button, { variant: "ghost", size: "small", onClick: () => setShowAllAvailable(false) }, t("showLess"))
       ) : null
     ) : null,
-    !loading && !failed && transportAccounts.length > 0 ? h(
-      "section",
-      { className: "km-section" },
-      h(
-        "div",
-        { className: "km-section-head" },
-        h("h2", { className: "km-section-title" }, t("transportAccounts")),
-        h("span", { className: "km-section-count" }, transportAccounts.length)
-      ),
-      h("div", { className: "km-provider-list" }, transportAccounts.map((account) => h(TransportAccountRow, {
-        key: account.scope,
-        account
-      })))
-    ) : null,
     !loading && !failed ? h("section", { className: "km-section" }, h(SettingsCard)) : null,
     h(
       "footer",
@@ -2353,8 +2634,9 @@ function KeysManagerCard({ view }) {
   if (view === "summary") {
     const state = snapshot.state;
     if (state === null) return h("span", { className: "km-summary-line" }, snapshot.status === "error" ? t("loadError") : t("loading"));
-    if (state.managedCount === 0) return h("span", { className: "km-summary-line" }, t("summaryEmpty"));
-    return h("span", { className: "km-summary-line" }, t("summaryText", { providers: state.managedCount, keys: state.keyCount }));
+    const managed = managedEntryCount(state.providers, state.transportAccounts ?? []);
+    if (managed === 0) return h("span", { className: "km-summary-line" }, t("summaryEmpty"));
+    return h("span", { className: "km-summary-line" }, t("summaryText", { providers: managed, keys: state.keyCount }));
   }
   return h(KeysManagerBody);
 }

package/lib/core.d.ts

@@ -1,11 +1,3 @@
-/**
- * Pure key-selection and cooldown policy for the Keys Manager.
- *
- * Nothing here touches Cordis, the filesystem, or a secret. The Host passes
- * plain provider records in and gets the same records back, which keeps the
- * round-robin, sticky-session, cooldown-escalation, and retry decisions
- * unit-testable without a running Harness.
- */
 import type { KeyRecord, KeyStatus, ManagerSettings, ProviderRecord, ProviderStatus } from './domain.js';
 import type { LlmFailureLike } from './host-types.js';
 /** Defaults also exposed in the manager's policy card. */
@@ -111,5 +103,12 @@ export declare function validateKeyPatch(patch: unknown): {
 };
 /** Maximum keys per provider (also used by the Host). */
 export declare const KEY_LIMIT = 32;
+/**
+ * Finish kinds a connection test reports as a completed request. The installed
+ * `@deepseek-ai/dsh-llm` union is `stop | tool-calls | max-tokens | aborted |
+ * error`, so `length`/`toolUse` were never completions. Shared with the tests
+ * so the implementation and its fixtures cannot drift apart again.
+ */
+export declare const TEST_SUCCESS_FINISH_KINDS: readonly ["stop", "tool-calls", "max-tokens"];
 /** Re-export the shared update type for callers that only import core. */
 export type { ManagerSettings };

package/lib/core.js

@@ -279,4 +279,11 @@ export function validateKeyPatch(patch) {
 }
 /** Maximum keys per provider (also used by the Host). */
 export const KEY_LIMIT = MAX_KEYS_PER_PROVIDER;
+/**
+ * Finish kinds a connection test reports as a completed request. The installed
+ * `@deepseek-ai/dsh-llm` union is `stop | tool-calls | max-tokens | aborted |
+ * error`, so `length`/`toolUse` were never completions. Shared with the tests
+ * so the implementation and its fixtures cannot drift apart again.
+ */
+export const TEST_SUCCESS_FINISH_KINDS = ['stop', 'tool-calls', 'max-tokens'];
 //# sourceMappingURL=core.js.map