dsh-magpie-connector 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.3.1
+
+- Replace both README demo GIFs with representative PNG screenshots (the model picker grouped by provider; per-provider visibility, default effort and usage cards in Settings), because the DSH plugin store does not show GIFs by default. No runtime behavior changes.
+
+## 0.3.0
+
+**BREAKING:** the single provider route `dsh-magpie-connector` is retired and not aliased. Sessions, the default model and any external configuration saved with that route id no longer resolve; reselect the model after upgrading, and update anything that lists the exact route id (subagent routing, egress allowlists).
+
+- **Grouping on stock DSH.** One real route per gateway `owned_by`: `dsh-magpie-connector-<owner>` (lower-cased, 1–48 chars of `a-z0-9._-`; anything else goes to `-other`). The official picker shows `Magpie (<Owner>)` groups without any Host extension; the `displayGroup` metadata is gone.
+- **Route identity.** Every model result carries the requested route as `provider`; lookups are by model id, so capabilities are identical on any plugin route.
+- **Replay across routes.** Native reasoning replay uses a fixed transport identity, so encrypted reasoning survives tool turns, restarts and switching between plugin routes; foreign or tampered history degrades to plain history.
+- **Remembered owners.** `settings.json` `knownOwners` (max 32, first-seen order) registers routes at start-up before the first sync. Invalid values are reset as a whole (`knownOwnersReset`), over-limit owners are reported (`ownerLimitReached`, `rejectedOwners`), and owners that disappear keep their empty route.
+- **Failure handling.** A failed first registration (route owned by another plugin, or a host listener `INVARIANT`) is reported as `routeRegistrationError` in Settings and requires a DSH restart; replace conflicts roll back the new owner and still publish catalog changes. Settings writes go through one synchronous writer, so owner discovery never deadlocks with settings requests or overwrites concurrent line saves.
+- **Speed control** shows on any plugin route.
+
 ## 0.2.0
 
 **BREAKING:** the settings format changes from a single top-level `baseUrl` to an ordered `lines[]` list, and credentials move to per-line derived refs. Existing `settings.json` files with only `baseUrl` and the legacy fixed refs (`MAGPIE_API_KEY`, `MAGPIE_ACCESS_CLIENT_ID`, `MAGPIE_ACCESS_CLIENT_SECRET`) are **not read, migrated or deleted**; reconfigure the connection in Settings after upgrading. `visibleModels` / `defaultEfforts` are preserved. Back up `settings.json` and the old credential refs before upgrading if you need a rollback path.

package/README.md

@@ -3,15 +3,16 @@
 English · [简体中文](README.zh.md)
 
 <p align="center">
-  <img src="docs/model-picker.gif" alt="Model picker grouped by upstream provider, with the GPT-only standard/fast control" width="49%">
+  <img src="docs/model-picker.png" alt="Model picker grouped by upstream provider: Magpie (Claude), Magpie (GPT), Magpie (deepseek)" width="49%">
+  <img src="docs/settings.png" alt="Settings: the connection line on top, then models grouped by provider with visibility, default effort and usage cards" width="49%">
 </p>
 
-*Model picker recorded from an isolated DSH host with a local mock Magpie gateway; models and accounts are synthetic. A fresh settings screenshot is pending re-recording.*
+*Left: model picker grouped by upstream provider. Right: Settings → Magpie — the connection line, then per-provider model visibility, default effort and usage cards. Captured from an isolated DSH host with a local mock Magpie gateway; models and accounts are synthetic.*
 
-[Repository](https://github.com/prgrmrwy/dsh-magpie-connector) · [Releases](https://github.com/prgrmrwy/dsh-magpie-connector/releases) · [npm](https://www.npmjs.com/package/dsh-magpie-connector)
+![Magpie connector architecture: Web GUI and Host plugin, credentials and settings, Magpie gateway and upstream providers, optionally through Cloudflare Access](docs/architecture.en.svg)
 
 <!-- problem -->
-**Connect a self-hosted Magpie gateway to DeepSeek Harness as one provider route: models grouped by their upstream provider, read-only usage cards, and a per-session fast mode.** Magpie keeps managing logins, accounts, routing and provider egress; this plugin adds the DSH side.
+**Connect a self-hosted Magpie gateway to DeepSeek Harness with one provider route per upstream owner: models grouped by upstream provider on stock DSH, read-only usage cards, and a per-session fast mode.** Magpie keeps managing logins, accounts, routing and provider egress; this plugin adds the DSH side.
 
 ### What you get
 
@@ -19,7 +20,7 @@ English · [简体中文](README.zh.md)
 |---|---|
 | **Gateway lines** (basic) | Each line has its own URL and gateway key. The model catalog comes from the gateway's `GET /models`; Responses-capable models use Responses, everything else uses Chat Completions. Text, tool round trips, images, usage, cancellation and DSH-managed retries go through. |
 | **Automatic multi-line failover** (signature) | Empty on first install; normally one line; add backup lines and let the order decide priority. Before every gateway operation the plugin picks the first reachable complete line with a ≤600ms TCP probe (10s positive / 15s negative in-memory cache, no background polling), so home uses the LAN while outside falls back to the public endpoint. Switching lines carries the catalog over (no flash), clears usage cards and re-syncs the new line; single-line users keep 0.1.x behavior. |
-| **Grouped by upstream provider** (signature) | The model picker shows `Magpie (Claude)`, `Magpie (GPT)` and `Magpie (<other owner>)` headings while the real route stays one `dsh-magpie-connector`. Settings and usage cards use the same grouping, and a provider that only appears in usage is never dropped. |
+| **Grouped by upstream provider** (signature) | Works on stock DSH, no Host extension needed: the plugin registers one real provider route per gateway `owned_by` (`dsh-magpie-connector-claude`, `-codex`, `-opencode-go`, …; missing or invalid ownership goes to `-other`), so the official model picker shows `Magpie (Claude)`, `Magpie (Codex)`, `Magpie (Opencode-go)`, `Magpie (Other)` groups. Settings and usage cards use the same grouping, and a provider that only appears in usage is never dropped. |
 | **Per-line Cloudflare Access** | Each line independently chooses Direct or Cloudflare Access. Access-enabled line requests carry the service token pair plus the bearer key; the token is never sent to a plain-HTTP line. |
 | **Read-only usage cards** | Each upstream account shows plan, expiry, window readings and Codex reset credits when the gateway provides them. Cards are read once when settings open and only re-read when you press **Refresh** on that card; bars turn orange above 70% and red at 90%. |
 | **Model visibility and default effort** | Per provider, leave visibility untouched to follow the gateway catalog, or save an explicit allowlist so new models stay hidden. Per model, save a default reasoning effort; DSH applies it on the next request. |
@@ -33,7 +34,7 @@ dsh plugin --profile web add dsh-magpie-connector
 
 Restart DSH and refresh the Web page. Inside [ohmydsh](https://github.com/prgrmrwy/ohmydsh) you can instead enable the local `dsh-magpie-connector` manifest entry and rebuild. Tested with DSH `0.2.0-rc.2`, Web UI, Node.js `>=22.19`.
 
-The model picker headings need the managed five-package Host extension that ohmydsh's Pet compatibility layer builds for the reviewed `0.2.0-rc.2` pin. Stock rc.2 still uses the route and generation normally, with a flat provider list.
+> **0.3.0 BREAKING upgrade**: the single `dsh-magpie-connector` route is retired. Sessions and the default model saved on it no longer resolve; pick the model again from a `Magpie (…)` group. Routes that depend on the exact route id elsewhere (e.g. subagent routing, egress allowlists) must list the new `dsh-magpie-connector-<owner>` ids.
 
 ### Configure
 
@@ -52,8 +53,8 @@ Need another method — custom headers, mTLS, another zero-trust gateway? **Issu
 
 | Where | What you do |
 |---|---|
-| **Model picker** | Search across group headings, model names and full ids. Headings come from the gateway's `owned_by`; the route behind every item is still `dsh-magpie-connector`, so model ids, visibility keys and default effort do not change. |
-| **Model menu groups** | A model with a non-empty `owned_by` appears under `Magpie (<owner>)`; `claude` and `codex` are shown as Claude and GPT. Missing ownership falls back to `Magpie (Other)` instead of guessing from the model name. |
+| **Model picker** | Search across group headings, model names and full ids. Each group is a real route `dsh-magpie-connector-<owner>`; model ids stay the gateway's full ids, and visibility keys and default effort are unchanged. |
+| **Model menu groups** | `owned_by` (lower-cased; 1–48 chars of `a-z0-9._-`) picks the route and the label `Magpie (<Owner>)` with the first letter capitalised. Missing or invalid ownership goes to `Magpie (Other)` instead of guessing from the model name. Owners seen once are remembered in `settings.json` `knownOwners` (max 32) so their routes exist right after a restart; the models appear once the first catalog sync finishes. An owner that disappears keeps its (empty, hidden) route. Clearing `knownOwners` by hand invalidates selections saved on the removed routes. If route registration fails at start-up (another plugin owns the id), Settings shows the error and DSH must be restarted after resolving it. |
 | **Composer speed control** | Shows only for the current model when the gateway advertises the `priority` tier (on current Magpie: the Codex/GPT models), and updates as soon as the selection changes. Hover the model menu to see effort; the official picker shows one effort value. |
 | **Settings → Magpie** | Connection, advanced connection mode, per-provider model sections with visibility checkboxes and default effort selects, plus the usage cards for that provider. |
 | **Usage card refresh** | Each card has its own **Refresh**, which asks Magpie to re-read that one account. A cold gateway may return no cards at all; the connection panel then offers **Fetch models and usage**, which first re-synchronizes the catalog and then asks Magpie to read every account once. A restricted held key cannot initialize an empty cache — ask the Magpie administrator to read usage first. |
@@ -68,22 +69,22 @@ Need another method — custom headers, mTLS, another zero-trust gateway? **Issu
 - **Not supported:** `stop` sequences fail before any network access (`MAGPIE_STOP_UNSUPPORTED`) because Magpie cannot preserve them across every upstream translation. Usage cards and Codex reset credits are display-only; the plugin never calls account-management or reset endpoints.
 - **Secrets stay out of responses and logs.** Gateway-reflected text is redacted with the current key before it can reach the settings API or logs. Files are written `0600`; the settings API reports only `configured` / `writable`.
 
-### Architecture
-
-![Magpie connector architecture: Web GUI and Host plugin, credentials and settings, Magpie gateway and upstream providers, optionally through Cloudflare Access](docs/architecture.en.svg)
+### Code map
 
 Entry: [index.ts](src/index.ts). Adapter and request/stream mapping: [adapter.ts](src/host/adapter.ts). Routes: [routes.ts](src/host/routes.ts). Transport allowlist: [transport.ts](src/host/transport.ts). Settings page: [SettingsPage.ts](src/client/SettingsPage.ts). The diagram source, with credential-free repository evidence: [architecture.en.json](docs/architecture.en.json).
 
 ### Development
 
+In a standalone checkout of this repository:
+
 ```sh
 npm install
-npm test --workspace=dsh-magpie-connector
-npm run typecheck --workspace=dsh-magpie-connector
-npm run build --workspace=dsh-magpie-connector
+npm run typecheck
+npm test
+npm run build
 ```
 
-Tests use local mock gateways and the real wire library; no real key is required. Build output is not committed. Both `prepare` and `prepack` build the package.
+Inside the ohmydsh monorepo, install once at the root and add `--workspace=dsh-magpie-connector` to the last three commands. Tests use local mock gateways and the real wire library; no real key is required. Build output is not committed. Both `prepare` and `prepack` build the package.
 
 ## Removal
 <!-- section: removal -->
@@ -96,6 +97,8 @@ Restart DSH and refresh the page. Disposal releases registrations, timers and co
 
 Inside [ohmydsh](https://github.com/prgrmrwy/ohmydsh), set the manifest entry to `enabled: false` and rebuild instead.
 
-## License
+## Source, license and contributing
+
+This plugin is developed in [ohmydsh](https://github.com/prgrmrwy/ohmydsh) (`packages/dsh-magpie-connector`); [this repository](https://github.com/prgrmrwy/dsh-magpie-connector) is its release mirror, published automatically to [npm](https://www.npmjs.com/package/dsh-magpie-connector) and [GitHub Releases](https://github.com/prgrmrwy/dsh-magpie-connector/releases). Current behavior is specified in [`openspec/specs/dsh-magpie-connector`](https://github.com/prgrmrwy/ohmydsh/blob/main/openspec/specs/dsh-magpie-connector/spec.md).
 
-MIT. `@earendil-works/pi-ai` and `undici` are separate MIT-licensed dependencies; the bird artwork follows the notice in [THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES).
+[MIT](LICENSE). `@earendil-works/pi-ai` and `undici` are separate MIT-licensed dependencies; the bird artwork follows the notice in [THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES). Issues and pull requests are welcome at [prgrmrwy/dsh-magpie-connector](https://github.com/prgrmrwy/dsh-magpie-connector/issues).

package/README.zh.md

@@ -3,15 +3,16 @@
 [English](README.md) · 简体中文
 
 <p align="center">
-  <img src="docs/model-picker.gif" alt="模型选择器：按上游 provider 分组，仅 GPT 显示标准/快速" width="49%">
+  <img src="docs/model-picker.png" alt="模型选择器：按上游 provider 分组为 Magpie (Claude)、Magpie (GPT)、Magpie (deepseek)" width="49%">
+  <img src="docs/settings.png" alt="设置页：顶部连接线路，下方按 provider 分组的模型可见性、默认 effort 与用量卡片" width="49%">
 </p>
 
-*模型选择器录屏来自隔离 DSH 宿主与本地 mock Magpie 网关，模型和账号均为演示数据；设置页的线路列表截图待重录。*
+*左：按上游 provider 分组的模型选择器；右：设置 → Magpie，顶部连接线路，下方按 provider 分组的模型可见性、默认 effort 与用量卡片。截图来自隔离 DSH 宿主与本地 mock Magpie 网关，模型和账号均为演示数据。*
 
-[插件仓库](https://github.com/prgrmrwy/dsh-magpie-connector) · [版本发布](https://github.com/prgrmrwy/dsh-magpie-connector/releases) · [npm](https://www.npmjs.com/package/dsh-magpie-connector)
+![Magpie connector 架构：Web GUI 与 Host 插件、凭据与设置、Magpie 网关与上游 provider，可选经 Cloudflare Access](docs/architecture.zh.svg)
 
 <!-- problem -->
-**把自托管的 Magpie 网关作为一个 provider route 接入 DeepSeek Harness：模型按上游 provider 分组展示，附带只读用量卡片和会话级快速档。** Magpie 继续负责登录、账号、路由和厂商出站代理，本插件补齐 DSH 侧。
+**把自托管的 Magpie 网关接入 DeepSeek Harness，每个上游归属对应一个 provider route：原版 DSH 即按上游 provider 分组展示模型，附带只读用量卡片和会话级快速档。** Magpie 继续负责登录、账号、路由和厂商出站代理，本插件补齐 DSH 侧。
 
 ### 你会得到什么
 
@@ -19,7 +20,7 @@
 |---|---|
 | **Magpie 网关接入**（基础） | 每条线路只需地址和该线路的 key。模型目录来自网关 `GET /models`；支持 Responses 的模型走 Responses，其余走 Chat Completions。文本、工具往返、图片、usage、取消以及 DSH 统一重试都能正常工作。 |
 | **多线路自动切换**（特色） | 通常一条线路（首次安装为空，最多 5 条），可添加备用线路并按序号自动选择：每次操作前对候选地址做 ≤600ms 的 TCP 可达探测（正缓存 10s / 负缓存 15s，不后台轮询），在家走局域网、在外自动落到公网。切换线路时模型目录继承不闪断、用量卡片清空并按新线路重读；单线路（通常一条）行为与旧版一致。 |
-| **按上游 provider 分组**（特色） | 模型选择器显示 `Magpie (Claude)`、`Magpie (GPT)`、`Magpie (<其它归属>)` 等标题，真实 route 始终只有一个 `dsh-magpie-connector`。设置页和用量卡片使用同一套分组，只出现在用量里的 provider 也不会被丢弃。 |
+| **按上游 provider 分组**（特色） | 原版 DSH 即可使用，无需 Host 扩展：插件按网关 `owned_by` 为每个归属注册一个真实 provider route（`dsh-magpie-connector-claude`、`-codex`、`-opencode-go` 等；缺失或不合法归入 `-other`），官方模型选择器因此显示 `Magpie (Claude)`、`Magpie (Codex)`、`Magpie (Opencode-go)`、`Magpie (Other)` 分组。设置页和用量卡片使用同一套分组，只出现在用量里的 provider 也不会被丢弃。 |
 | **按线路的 Cloudflare Access** | 每条线路可单独选择「直连」或「Cloudflare Access」。启用后该线路的请求带上服务令牌两项并保留 bearer key；服务令牌永远不会发往明文 HTTP 线路。 |
 | **只读用量卡片** | 每个上游账号展示计划、到期时间、各窗口读数和 Codex 重置次数（网关提供时）。打开设置页只读一次，之后只有点单张卡片的「刷新」才会重新读取；用量条超过 70% 变橙、达到 90% 变红。 |
 | **模型可见性与默认 effort** | 每个 provider 不设置可见性时跟随网关目录；保存过选择后只显示勾选项，新上架模型默认隐藏。每个模型可保存一个默认推理 effort，DSH 在下一次请求应用。 |
@@ -33,7 +34,7 @@ dsh plugin --profile web add dsh-magpie-connector
 
 重启 DSH 并刷新页面。在 [ohmydsh](https://github.com/prgrmrwy/ohmydsh) 中也可以直接启用 local `dsh-magpie-connector` manifest 条目后重新构建。已验证 DSH `0.2.0-rc.2`、Web UI、Node.js `>=22.19`。
 
-模型选择器的分组标题依赖 ohmydsh 的 Pet 兼容层为 reviewed `0.2.0-rc.2` pin 构建的受管五包 Host 扩展。stock rc.2 仍可正常使用 route 与生成，但 provider 内列表保持 flat。
+> **0.3.0 BREAKING 升级**：旧的单一 route `dsh-magpie-connector` 已退役。保存在它上面的会话与默认模型不再可用，请在 `Magpie (…)` 分组中重选模型。其它依赖精确 route id 的配置（例如子任务路由、出口豁免列表）需改成新的 `dsh-magpie-connector-<owner>`。
 
 ### 配置
 
@@ -52,8 +53,8 @@ dsh plugin --profile web add dsh-magpie-connector
 
 | 位置 | 做什么 |
 |---|---|
-| **模型选择器** | 统一搜索覆盖分组标题、型号名和完整 id。标题来自网关的 `owned_by`；每项背后的 route 仍然是 `dsh-magpie-connector`，model id、可见性键和默认 effort 都不变。 |
-| **模型菜单分组** | `owned_by` 非空的模型显示在 `Magpie (<owner>)` 下，`claude`、`codex` 分别显示为 Claude 和 GPT。缺失归属时显示 `Magpie (Other)`，不按模型名猜测。 |
+| **模型选择器** | 统一搜索覆盖分组标题、型号名和完整 id。每个分组是一个真实 route `dsh-magpie-connector-<owner>`；model id 保持网关完整 id，可见性键和默认 effort 不变。 |
+| **模型菜单分组** | `owned_by`（转小写，1–48 个 `a-z0-9._-` 字符）决定 route 和标题 `Magpie (<Owner>)`（首字母大写）。缺失或不合法时归入 `Magpie (Other)`，不按模型名猜测。见过的归属记在 `settings.json` 的 `knownOwners`（最多 32 个），重启后 route 立即存在，首次目录同步完成后模型才出现。归属下架后其 route 保留（空组自动隐藏）。手动清空 `knownOwners` 会让保存在被移除 route 上的选择失效。启动时若 route 注册失败（例如被别的插件占用），设置页会显示错误，排除后需重启 DSH。 |
 | **输入框速度控件** | 仅当前模型被网关声明为 `priority` 档时显示（当前 Magpie 上即 Codex/GPT 模型），切换模型后立即更新。悬停模型菜单可看 effort；官方选择器只显示一个 effort 值。 |
 | **设置 → Magpie** | 连接、接入方式、按 provider 分组的模型区（可见性复选框与默认 effort 选择器），以及该 provider 的用量卡片。 |
 | **用量卡片刷新** | 每张卡片有独立的「刷新」，请求 Magpie 重新读取这一个账号。网关冷启动可能没有任何卡片；此时连接面板提供「获取模型与用量」，先同步模型目录，再请 Magpie 读取全部账号一次。受限 held key 无法初始化空缓存，需要管理员先在 Magpie 中读取一次。 |
@@ -70,22 +71,22 @@ dsh plugin --profile web add dsh-magpie-connector
 - **不支持：** 非空 `stop` 序列会在发请求前失败（`MAGPIE_STOP_UNSUPPORTED`），因为 Magpie 无法在所有上游协议转换中保留 stop。用量卡片与 Codex 重置次数只读展示，插件不会调用账号管理或重置端点。
 - **密钥不会进入响应或日志。** 网关反射的文本在进入设置接口或日志之前会用当前 key 脱敏。写盘文件权限 `0600`；设置接口只报告 `configured` / `writable`。
 
-### 架构
-
-![Magpie connector 架构：Web GUI 与 Host 插件、凭据与设置、Magpie 网关与上游 provider，可选经 Cloudflare Access](docs/architecture.zh.svg)
+### 代码导览
 
 入口：[index.ts](src/index.ts)。适配器与请求/流映射：[adapter.ts](src/host/adapter.ts)。路由：[routes.ts](src/host/routes.ts)。传输白名单：[transport.ts](src/host/transport.ts)。设置页：[SettingsPage.ts](src/client/SettingsPage.ts)。不含凭据的图源与仓库证据：[architecture.zh.json](docs/architecture.zh.json)。
 
 ### 开发
 
+在本仓库的独立检出中：
+
 ```sh
 npm install
-npm test --workspace=dsh-magpie-connector
-npm run typecheck --workspace=dsh-magpie-connector
-npm run build --workspace=dsh-magpie-connector
+npm run typecheck
+npm test
+npm run build
 ```
 
-测试使用本机 mock 网关和真实线协议库，不需要真实 key。构建产物不入库；`prepare` 与 `prepack` 都会执行 build。
+在 ohmydsh monorepo 里，在仓库根目录安装一次，后三条命令加上 `--workspace=dsh-magpie-connector`。测试使用本机 mock 网关和真实线协议库，不需要真实 key。构建产物不入库；`prepare` 与 `prepack` 都会执行 build。
 
 ## 移除
 <!-- section: removal -->
@@ -98,6 +99,8 @@ dsh plugin --profile web remove dsh-magpie-connector
 
 在 [ohmydsh](https://github.com/prgrmrwy/ohmydsh) 中则把 manifest 条目设为 `enabled: false` 后重新构建。
 
-## 许可
+## 来源、许可与参与
+
+本插件在 [ohmydsh](https://github.com/prgrmrwy/ohmydsh)（`packages/dsh-magpie-connector`）中持续开发，[本仓库](https://github.com/prgrmrwy/dsh-magpie-connector)是发布镜像，自动发布到 [npm](https://www.npmjs.com/package/dsh-magpie-connector) 与 [GitHub Releases](https://github.com/prgrmrwy/dsh-magpie-connector/releases)。当前行为见规范 [`openspec/specs/dsh-magpie-connector`](https://github.com/prgrmrwy/ohmydsh/blob/main/openspec/specs/dsh-magpie-connector/spec.md)。
 
-MIT。`@earendil-works/pi-ai` 与 `undici` 是分别以 MIT 许可分发的依赖；鸟形图标来源与许可见 [THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES)。
+采用 [MIT](LICENSE) 许可。`@earendil-works/pi-ai` 与 `undici` 是分别以 MIT 许可分发的依赖；鸟形图标来源与许可见 [THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES)。欢迎到 [prgrmrwy/dsh-magpie-connector](https://github.com/prgrmrwy/dsh-magpie-connector/issues) 提 issue 和 PR。

package/docs/SCREENSHOTS.md

@@ -2,6 +2,5 @@
 
 | file | kind | source | date | reviewer | verdict | note |
 |---|---|---|---|---|---|---|
-| model-picker.gif | screenshot | isolated DSH_HOME instance (temp HOME/XDG/DSH_HOME under /tmp, port 3199), synthetic data: local mock Magpie gateway on loopback with demo models (only Codex models advertise the priority tier, as on Magpie); lossless deviceScaleFactor-2 screenshots of the real Web UI, 1500x880 at 1:1 | 2026-10-28 | lead | pass (viewed frames: demo workspace, mock models and mock account only; no hostname, user, path, token or real session) | Model picker grouped by upstream provider, search, switch to GPT shows the standard/fast control, switch back to Claude hides it immediately |
-
-> Settings screenshot removed pending re-recording after the 0.2.0 line-list settings rewrite; the old recording showed the pre-multi-line connection form.
+| model-picker.png | screenshot | frame 11 of the 2026-10-28 recording (isolated DSH_HOME instance, temp HOME/XDG/DSH_HOME under /tmp, port 3199; local mock Magpie gateway on loopback with demo models; lossless deviceScaleFactor-2 screenshots of the real Web UI, 1500x880 at 1:1), exported losslessly from the global-palette GIF | 2026-10-29 | lead | pass (reviewed frame: demo workspace and mock models only; no hostname, user, path, token or real session) | 106789 bytes; picker open with Magpie (Claude), Magpie (GPT) and Magpie (deepseek) groups; replaces model-picker.gif because the plugin store does not show GIFs by default |
+| settings.png | screenshot | isolated DSH_HOME under /tmp (temp HOME/XDG, port 3199) running the deployed 0.3.0 plugin (code identical to 0.3.1) against a local loopback mock Magpie gateway serving demo models and usage cards; Playwright/CDP deviceScaleFactor-2 screenshot of the settings dialog, 1600x1600 | 2026-10-29 | lead | pass (reviewed: loopback mock address, key from a fake startup env value, demo@example.com account, demo models; no real hostname, user, path, token or session) | 202707 bytes; connection section with line 1 collapsed, then the claude group with per-model default effort and its usage card, codex group below; replaces settings.gif |

package/docs/internal-api.md

@@ -53,7 +53,7 @@ try {
 - `runtime.invalidateCredential(ref?)` maps a `credentials/reference-updated` ref to its line id (`lineIdOfCredentialRef`) and rotates only when that line is active; without a ref it rotates the current generation. It synchronously drops visible old state and aborts background operations before asynchronously resolving/syncing. Own credential writes suppress that listener until the combined settings mutation commits.
 - `runtime.redact(text)` replaces current and active-operation keys literally with `[redacted]`. All gateway strings going into HTTP responses or logs must use this method. Catalog metadata is redacted before it is cached.
 - `runtime.settings(body?)` handles the single-schema settings update `{lines?, resync?}` (plus GET projection) and returns a `Response`; the generic SettingsController adds preference fields (`visibleModels`, `defaultEffort`) around it. Credential fields use the tri-state (omit/null/write) contract above; unknown keys are rejected with 400 and nothing is written.
-- `publish()` must call the adapter registration handle's `replace(['dsh-magpie-connector'])`; no payload-free imitation event is needed. Same-generation sync is single-flight and times out after 15 seconds. Last successful catalog/time survive same-generation failure; identity changes never retain old data.
+- `publish(routes?)` goes through the route registrar: the first non-empty set calls `registerAdapter`, later sets call `replace` (also when only the catalog changed, so open pickers get `llm/adapters-updated`); the result drives owner rollback and `routeRegistrationError`. Same-generation sync is single-flight and times out after 15 seconds. Last successful catalog/time survive same-generation failure; identity changes never retain old data.
 
 ## Catalog and adapter
 
@@ -62,7 +62,8 @@ try {
 ```ts
 interface CatalogModel {
   info: LlmResolvedModelInfo
-  provider: string // owned_by, else first id segment
+  provider: string // visibility key: owned_by, else first id segment
+  owner: string // route key (ownerKey), route = dsh-magpie-connector-<owner>
   efforts: string[]
   nativeEndpoints: string[]
   serviceTiers: string[] // tier ids, e.g. priority
@@ -97,7 +98,7 @@ Every request validates same origin and exact API-root-relative path, forces aut
 
 ## Host wiring
 
-`apply(ctx,{home?})` currently registers one `dsh-magpie-connector` adapter, credentials event, `/api/dsh-magpie-connector/settings` through injected `connection.fetch`, starts initial sync, and installs an async effect disposer. It returns `{runtime,adapter}` for focused harness tests. The feature assembly adds cards/speed resources and their controller lifecycle here; do not add another adapter registration or another settings route.
+`apply(ctx,{home?})` registers one adapter on the owner routes derived from `knownOwners` (via `createRouteRegistrar`, see `src/host/registrar.ts`), credentials event, `/api/dsh-magpie-connector/settings` through injected `connection.fetch`, starts initial sync, and installs an async effect disposer. It returns `{runtime,adapter,routes}` for focused harness tests. The feature assembly adds cards/speed resources and their controller lifecycle here; do not add another adapter registration or another settings route.
 
 ## Evidence and remaining assembly
 

package/lib/client/SettingsPage.js

@@ -13,7 +13,7 @@ import { cardKey, formatTime, parseCards, providerOrder, readTime, sameTarget }
 export const EMPTY_TEXT = 'Magpie 未返回可见用量';
 export const RESTRICTED_HINT = '受限的 gateway key 无法让 Magpie 首次读取用量：需要 Magpie 管理员先在 Magpie 中读取一次，或者改用不受限的 key。';
 export const NOT_REREAD = 'Magpie 未重新读取（可能处于节流间隔内）';
-const SYNC_KIND = { unauthorized: 'key 无效（401）', forbidden: '无权访问（403）', http: '网关错误', unreachable: '无法连接网关' };
+const SYNC_KIND = { unauthorized: 'key 无效（401）', forbidden: '无权访问（403）', http: '网关错误', unreachable: '无法连接网关', settings: '设置保存失败', registration: '路由注册失败' };
 export function MagpieSettings({ api }) {
     const [settings, setSettings] = useState();
     const [settingsError, setSettingsError] = useState('');
@@ -307,7 +307,9 @@ function LineCard({ draft, index, total, saving, active, expanded, onToggle, onC
 }
 function SyncStatus({ settings }) {
     const count = (settings.groups ?? []).reduce((n, g) => n + g.models.length, 0);
-    return h('div', { className: 'dmg-meta', 'data-sync': '' }, settings.lastSyncAt ? h('p', null, `共 ${count} 个模型 · 更新于 `, h('time', { dateTime: settings.lastSyncAt }, formatTime(settings.lastSyncAt))) : null, settings.lastSyncError ? h('p', { className: 'dmg-error' }, `同步失败${settings.lastSyncErrorKind ? `（${SYNC_KIND[settings.lastSyncErrorKind] ?? settings.lastSyncErrorKind}）` : ''}：${settings.lastSyncError}`) : null);
+    const rejected = settings.rejectedOwners ?? [];
+    const registration = settings.routeRegistrationError;
+    return h('div', { className: 'dmg-meta', 'data-sync': '' }, settings.lastSyncAt ? h('p', null, `共 ${count} 个模型 · 更新于 `, h('time', { dateTime: settings.lastSyncAt }, formatTime(settings.lastSyncAt))) : null, settings.lastSyncError ? h('p', { className: 'dmg-error' }, `同步失败${settings.lastSyncErrorKind ? `（${SYNC_KIND[settings.lastSyncErrorKind] ?? settings.lastSyncErrorKind}）` : ''}：${settings.lastSyncError}`) : null, registration ? h('p', { className: 'dmg-error', role: 'alert' }, `Magpie 路由注册失败（${registration.code}${registration.route ? `，${registration.route}` : ''}）：需重启 Host 后才能恢复。`) : null, settings.knownOwnersReset ? h('p', { className: 'dmg-hint' }, '归属列表已重置：已保存的归属无效，下次同步会重新建立。') : null, settings.ownerLimitReached ? h('p', { className: 'dmg-hint' }, `归属数量已达上限（32 个），以下归属未能加入：${rejected.join('、')}`) : null);
 }
 function ProviderGroup({ provider, group, settings, cards, busy, saving, mutateSettings, onRefresh, notice, alert }) {
     const [error, setError] = useState('');

package/lib/client/SpeedSelect.d.ts

@@ -1,12 +1,5 @@
 import { type Api } from './api.js';
-/**
- * Composer speed control (`conversation.input.right`): standard / fast for
- * models whose gateway catalog advertises the `priority` service tier. The
- * choice lives in host memory per session (design D9); this component only
- * views it. It renders nothing unless the session's current model is a
- * `dsh-magpie-connector` model listed in `fastModels`.
- */
-export declare const ROUTE = "dsh-magpie-connector";
+export declare function isMagpieRoute(provider: string): boolean;
 export type Tier = 'standard' | 'fast';
 export interface SpeedState {
     visible: boolean;

package/lib/client/SpeedSelect.js

@@ -6,9 +6,11 @@ import { settingsCss } from './styles.js';
  * models whose gateway catalog advertises the `priority` service tier. The
  * choice lives in host memory per session (design D9); this component only
  * views it. It renders nothing unless the session's current model is a
- * `dsh-magpie-connector` model listed in `fastModels`.
+ * owner-route (`dsh-magpie-connector-<owner>`) model listed in `fastModels`.
  */
-export const ROUTE = 'dsh-magpie-connector';
+/** Owner-route id shape (D4/D8); must match the host's `isMagpieRoute` in catalog.ts. Client does not import host code. */
+const MAGPIE_ROUTE = /^dsh-magpie-connector-[a-z0-9][a-z0-9._-]{0,47}$/;
+export function isMagpieRoute(provider) { return MAGPIE_ROUTE.test(provider); }
 /**
  * Calls `onChange` when the session's selected provider/model changes. Other store
  * updates (including the ones our own `load()` causes) are ignored, so a reload
@@ -42,7 +44,7 @@ export function createSpeedLoader(api, models, sessionId) {
         const body = response.body;
         const fastModels = Array.isArray(body.fastModels) ? body.fastModels.filter((m) => typeof m === 'string') : [];
         const tier = body.tier === 'fast' ? 'fast' : 'standard';
-        return { visible: current !== null && current.provider === ROUTE && fastModels.includes(current.model), tier };
+        return { visible: current !== null && isMagpieRoute(current.provider) && fastModels.includes(current.model), tier };
     };
 }
 export function createSpeedSetter(api, sessionId) {

package/lib/client/view-model.d.ts

@@ -44,7 +44,7 @@ export interface ModelGroup {
     provider: string;
     models: ModelRow[];
 }
-export type SyncErrorKind = 'unauthorized' | 'forbidden' | 'http' | 'unreachable';
+export type SyncErrorKind = 'unauthorized' | 'forbidden' | 'http' | 'unreachable' | 'settings' | 'registration';
 export interface LineView {
     id?: string;
     baseUrl?: string;
@@ -97,6 +97,16 @@ export interface SettingsView {
     groups?: ModelGroup[];
     visibleModels?: Record<string, string[]>;
     defaultEfforts?: Record<string, string>;
+    /** Initial route registration failed (design D6): the host must be restarted to recover. */
+    routeRegistrationError?: {
+        code: string;
+        route?: string;
+    };
+    /** knownOwners was invalid at load and reset to empty (spec 归属 route 持久). */
+    knownOwnersReset?: boolean;
+    /** The owner cap (32) rejected new owners; `rejectedOwners` lists them. */
+    ownerLimitReached?: boolean;
+    rejectedOwners?: string[];
 }
 /** Defensive parse: unknown or malformed entries never reach the renderer. */
 export declare function parseCards(body: unknown, httpStatus: number): CardsView;

package/lib/client.js

@@ -226,7 +226,9 @@ window.__ModuleLoader__.load({
 			unauthorized: "key 无效（401）",
 			forbidden: "无权访问（403）",
 			http: "网关错误",
-			unreachable: "无法连接网关"
+			unreachable: "无法连接网关",
+			settings: "设置保存失败",
+			registration: "路由注册失败"
 		};
 		function MagpieSettings({ api }) {
 			const [settings, setSettings] = (0, react.useState)();
@@ -735,10 +737,15 @@ window.__ModuleLoader__.load({
 		}
 		function SyncStatus({ settings }) {
 			const count = (settings.groups ?? []).reduce((n, g) => n + g.models.length, 0);
+			const rejected = settings.rejectedOwners ?? [];
+			const registration = settings.routeRegistrationError;
 			return (0, react.createElement)("div", {
 				className: "dmg-meta",
 				"data-sync": ""
-			}, settings.lastSyncAt ? (0, react.createElement)("p", null, `共 ${count} 个模型 · 更新于 `, (0, react.createElement)("time", { dateTime: settings.lastSyncAt }, formatTime(settings.lastSyncAt))) : null, settings.lastSyncError ? (0, react.createElement)("p", { className: "dmg-error" }, `同步失败${settings.lastSyncErrorKind ? `（${SYNC_KIND[settings.lastSyncErrorKind] ?? settings.lastSyncErrorKind}）` : ""}：${settings.lastSyncError}`) : null);
+			}, settings.lastSyncAt ? (0, react.createElement)("p", null, `共 ${count} 个模型 · 更新于 `, (0, react.createElement)("time", { dateTime: settings.lastSyncAt }, formatTime(settings.lastSyncAt))) : null, settings.lastSyncError ? (0, react.createElement)("p", { className: "dmg-error" }, `同步失败${settings.lastSyncErrorKind ? `（${SYNC_KIND[settings.lastSyncErrorKind] ?? settings.lastSyncErrorKind}）` : ""}：${settings.lastSyncError}`) : null, registration ? (0, react.createElement)("p", {
+				className: "dmg-error",
+				role: "alert"
+			}, `Magpie 路由注册失败（${registration.code}${registration.route ? `，${registration.route}` : ""}）：需重启 Host 后才能恢复。`) : null, settings.knownOwnersReset ? (0, react.createElement)("p", { className: "dmg-hint" }, "归属列表已重置：已保存的归属无效，下次同步会重新建立。") : null, settings.ownerLimitReached ? (0, react.createElement)("p", { className: "dmg-hint" }, `归属数量已达上限（32 个），以下归属未能加入：${rejected.join("、")}`) : null);
 		}
 		function ProviderGroup({ provider, group, settings, cards, busy, saving, mutateSettings, onRefresh, notice, alert }) {
 			const [error, setError] = (0, react.useState)("");
@@ -835,6 +842,19 @@ window.__ModuleLoader__.load({
 				value: id
 			}, id))) : null);
 		}
+		// src/client/SpeedSelect.ts
+		/**
+		* Composer speed control (`conversation.input.right`): standard / fast for
+		* models whose gateway catalog advertises the `priority` service tier. The
+		* choice lives in host memory per session (design D9); this component only
+		* views it. It renders nothing unless the session's current model is a
+		* owner-route (`dsh-magpie-connector-<owner>`) model listed in `fastModels`.
+		*/
+		/** Owner-route id shape (D4/D8); must match the host's `isMagpieRoute` in catalog.ts. Client does not import host code. */
+		const MAGPIE_ROUTE = /^dsh-magpie-connector-[a-z0-9][a-z0-9._-]{0,47}$/;
+		function isMagpieRoute(provider) {
+			return MAGPIE_ROUTE.test(provider);
+		}
 		/**
 		* Calls `onChange` when the session's selected provider/model changes. Other store
 		* updates (including the ones our own `load()` causes) are ignored, so a reload
@@ -876,7 +896,7 @@ window.__ModuleLoader__.load({
 				const fastModels = Array.isArray(body.fastModels) ? body.fastModels.filter((m) => typeof m === "string") : [];
 				const tier = body.tier === "fast" ? "fast" : "standard";
 				return {
-					visible: current !== null && current.provider === "dsh-magpie-connector" && fastModels.includes(current.model),
+					visible: current !== null && isMagpieRoute(current.provider) && fastModels.includes(current.model),
 					tier
 				};
 			};

package/lib/host/adapter.d.ts

@@ -22,24 +22,27 @@ export declare class MagpieAdapter extends LlmAdapter {
     readonly attachments?: Pick<AttachmentStore, "readImage" | "imageHostPath"> | undefined;
     readonly isFast: (_session: string) => boolean;
     constructor(runtime: MagpieRuntime, attachments?: Pick<AttachmentStore, "readImage" | "imageHostPath"> | undefined, isFast?: (_session: string) => boolean);
-    providerInfo(): {
+    providerInfo(route: string): {
         id: string;
         name: string;
     };
     providerRetryPolicy(): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy;
-    listModels(): Promise<(import("@deepseek-ai/dsh-llm").LlmResolvedModelInfo & {
-        displayGroup?: {
-            id: string;
-            label: string;
-        };
-    })[]>;
-    resolveModel(_provider: string, id: string): Promise<import("@deepseek-ai/dsh-llm").LlmResolvedModelInfo & {
-        displayGroup?: {
-            id: string;
-            label: string;
-        };
-    }>;
-    prepareCall(_provider: string, id: string, signal?: AbortSignal): Promise<PreparedAdapterCall>;
+    /** Look the model up by id in the whole catalog (route-independent); the returned provider is the requested route. */
+    private entryFor;
+    listModels(route: string): Promise<{
+        provider: string;
+        context?: import("@deepseek-ai/dsh-llm").LlmModelContext;
+        defaultMaxTokens?: number;
+        reasoning?: import("@deepseek-ai/dsh-llm").LlmModelReasoningInfo;
+        systemPromptUpdate?: import("@deepseek-ai/dsh-llm").SystemPromptUpdate;
+        toolUpdate?: import("@deepseek-ai/dsh-llm").ToolUpdate;
+        id: string;
+        name: string;
+        description?: string;
+        inputModalities?: readonly import("@deepseek-ai/dsh-llm").ModelModality[];
+    }[]>;
+    resolveModel(route: string, id: string): Promise<import("@deepseek-ai/dsh-llm").LlmResolvedModelInfo>;
+    prepareCall(route: string, id: string, signal?: AbortSignal): Promise<PreparedAdapterCall>;
     private failure;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
     private context;

package/lib/host/adapter.js

@@ -4,9 +4,10 @@ import { createProvider } from '@earendil-works/pi-ai';
 import { normalizeContext } from '@earendil-works/pi-ai/utils/transcript';
 import * as chat from '@earendil-works/pi-ai/api/openai-completions';
 import * as responses from '@earendil-works/pi-ai/api/openai-responses';
+import { TRANSPORT_ID, isMagpieRoute, ownerLabel, ownerOfRoute } from './catalog.js';
 import { visibleCatalog } from './visibility.js';
 import { withDefaultEffort } from './default-effort.js';
-const provider = createProvider({ id: 'dsh-magpie-connector', auth: { apiKey: { name: 'Gateway key', resolve: async () => undefined } }, models: [], api: { 'openai-completions': chat, 'openai-responses': responses } });
+const provider = createProvider({ id: TRANSPORT_ID, auth: { apiKey: { name: 'Gateway key', resolve: async () => undefined } }, models: [], api: { 'openai-completions': chat, 'openai-responses': responses } });
 const emptyUsage = () => ({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } });
 const record = (value) => typeof value === 'object' && value !== null && !Array.isArray(value) ? value : undefined;
 const blockHash = (block) => createHash('sha256').update(JSON.stringify(block.type === 'text' || block.type === 'reasoning' ? [block.type, block.text] : block.type === 'tool-call' ? [block.type, block.id, block.name, block.arguments] : [block.type])).digest('hex');
@@ -42,10 +43,12 @@ function restoreAssistant(message, model) {
             return [{ type: 'toolCall', id: block.id, name: block.name, arguments: parseArguments(block.arguments) }];
         return [];
     });
-    // Same-route tool ids already belong to DSH content, even when no replay was stored.
-    const fallback = { role: 'assistant', api: message.source.provider === model.provider && message.source.model === model.id ? model.api : 'dsh-foreign', provider: message.source.provider, model: message.source.model, content: content.map(block => block.type === 'thinking' ? { type: 'text', text: block.thinking } : block), usage: emptyUsage(), stopReason: content.some(block => block.type === 'toolCall') ? 'toolUse' : 'stop', timestamp: 0 };
+    // Native replay identity is the fixed transport id, shared by every owner route; only our own routes may claim it.
+    const ours = isMagpieRoute(message.source.provider);
+    // Same-model tool ids already belong to DSH content, even when no replay was stored.
+    const fallback = { role: 'assistant', api: ours && message.source.model === model.id ? model.api : 'dsh-foreign', provider: ours ? TRANSPORT_ID : message.source.provider, model: message.source.model, content: content.map(block => block.type === 'thinking' ? { type: 'text', text: block.thinking } : block), usage: emptyUsage(), stopReason: content.some(block => block.type === 'toolCall') ? 'toolUse' : 'stop', timestamp: 0 };
     const envelope = record(message.source.replayState), response = record(envelope?.response), blocks = envelope?.blocks;
-    if (response?.kind !== 'dsh-magpie-connector-pi' || response.version !== 1 || typeof response.api !== 'string' || !response.api || response.provider !== message.source.provider || response.model !== message.source.model || !['stop', 'length', 'toolUse'].includes(String(response.stopReason)) || !Array.isArray(blocks) || blocks.length !== message.content.length)
+    if (!ours || response?.kind !== 'dsh-magpie-connector-pi' || response.version !== 1 || typeof response.api !== 'string' || !response.api || response.provider !== TRANSPORT_ID || response.model !== message.source.model || !['stop', 'length', 'toolUse'].includes(String(response.stopReason)) || !Array.isArray(blocks) || blocks.length !== message.content.length)
         return fallback;
     for (const key of ['responseId', 'responseModel', 'providerThinkingLevel'])
         if (response[key] !== undefined && typeof response[key] !== 'string')
@@ -135,28 +138,36 @@ export class MagpieAdapter extends LlmAdapter {
         this.attachments = attachments;
         this.isFast = isFast;
     }
-    providerInfo() { return { id: 'dsh-magpie-connector', name: 'Magpie' }; }
+    providerInfo(route) { return { id: route, name: ownerLabel(ownerOfRoute(route)) }; }
     providerRetryPolicy() { return RETRY_POLICY; }
-    async listModels() { const op = await this.runtime.beginOperation(); try {
-        return structuredClone(visibleCatalog(op.gen.catalog, this.runtime.store.value.visibleModels).map(m => withDefaultEffort(m, this.runtime.store.value.defaultEfforts)));
+    /** Look the model up by id in the whole catalog (route-independent); the returned provider is the requested route. */
+    entryFor(op, route, id) {
+        const entry = structuredClone(op.gen.catalog.find(m => m.info.id === id) ?? { info: { provider: route, id, name: id, inputModalities: ['text'] }, provider: id.split('/')[0], owner: ownerOfRoute(route), efforts: [], nativeEndpoints: [], serviceTiers: [] });
+        entry.info = { ...withDefaultEffort(entry, this.runtime.store.value.defaultEfforts), provider: route };
+        return entry;
     }
-    finally {
-        op.release();
-    } }
-    async resolveModel(_provider, id) {
+    async listModels(route) {
+        const op = await this.runtime.beginOperation();
+        try {
+            const owner = ownerOfRoute(route);
+            return visibleCatalog(op.gen.catalog.filter(m => m.owner === owner), this.runtime.store.value.visibleModels).map(m => ({ ...structuredClone(withDefaultEffort(m, this.runtime.store.value.defaultEfforts)), provider: route }));
+        }
+        finally {
+            op.release();
+        }
+    }
+    async resolveModel(route, id) {
         const op = await this.runtime.beginOperation();
         try {
-            const entry = op.gen.catalog.find(m => m.info.id === id);
-            return structuredClone(entry ? withDefaultEffort(entry, this.runtime.store.value.defaultEfforts) : { provider: 'dsh-magpie-connector', id, name: id });
+            return this.entryFor(op, route, id).info;
         }
         finally {
             op.release();
         }
     }
-    async prepareCall(_provider, id, signal) {
+    async prepareCall(route, id, signal) {
         const op = await this.runtime.beginOperation();
-        const entry = structuredClone(op.gen.catalog.find(m => m.info.id === id) ?? { info: { provider: 'dsh-magpie-connector', id, name: id, inputModalities: ['text'] }, provider: id.split('/')[0], efforts: [], nativeEndpoints: [], serviceTiers: [] });
-        entry.info = withDefaultEffort(entry, this.runtime.store.value.defaultEfforts);
+        const entry = this.entryFor(op, route, id);
         // Prepared objects may be abandoned by SDK validation; retain only while dispatched.
         op.release();
         const untrack = this.runtime.trackPrepared(op);
@@ -230,7 +241,7 @@ export class MagpieAdapter extends LlmAdapter {
             if (options.stop?.length)
                 throw new Error('MAGPIE_STOP_UNSUPPORTED');
             const api = entry.nativeEndpoints.includes('/v1/responses') ? 'openai-responses' : 'openai-completions';
-            const model = { id: entry.info.id, name: entry.info.name, provider: 'dsh-magpie-connector', api, baseUrl: op.baseUrl, reasoning: entry.efforts.length > 0, thinkingLevelMap: { off: null, ...Object.fromEntries(entry.efforts.map(e => [e, e])) }, input: entry.info.inputModalities?.includes('image') ? ['text', 'image'] : ['text'], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: entry.info.context?.contextWindow ?? 128000, maxTokens: entry.outputLimit ?? 16384,
+            const model = { id: entry.info.id, name: entry.info.name, provider: TRANSPORT_ID, api, baseUrl: op.baseUrl, reasoning: entry.efforts.length > 0, thinkingLevelMap: { off: null, ...Object.fromEntries(entry.efforts.map(e => [e, e])) }, input: entry.info.inputModalities?.includes('image') ? ['text', 'image'] : ['text'], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: entry.info.context?.contextWindow ?? 128000, maxTokens: entry.outputLimit ?? 16384,
                 compat: { supportsFinishReason: true, thinkingFormat: 'openai', maxTokensField: 'max_completion_tokens', ...(api === 'openai-responses' ? { supportsStrictMode: true } : {}) } };
             const context = await this.context(options, model);
             const fast = !!options.sessionId && this.isFast(options.sessionId) && entry.serviceTiers.includes('priority');

package/lib/host/catalog.d.ts

@@ -1,14 +1,19 @@
 import type { LlmResolvedModelInfo } from '@deepseek-ai/dsh-llm';
-type DisplayModelInfo = LlmResolvedModelInfo & {
-    displayGroup?: {
-        id: string;
-        label: string;
-    };
-};
+/** Fixed pi-ai/replay transport identity. It is NOT a registered LLM route. */
+export declare const TRANSPORT_ID = "dsh-magpie-connector";
+/** Owner key of a gateway `owned_by` (untrusted): valid lower-cased value, else `other`. */
+export declare function ownerKey(ownedBy: unknown): string;
+/** Display name depends on the owner key alone, never on catalog content. */
+export declare const ownerLabel: (key: string) => string;
+export declare const routeOf: (key: string) => string;
+export declare const isMagpieRoute: (id: string) => boolean;
+/** Owner key of one of our routes; anything else (direct adapter calls) reads as `other`. */
+export declare const ownerOfRoute: (route: string) => string;
 /** The gateway's `max_output_tokens`, the model's reply capacity; `info.defaultMaxTokens` is the smaller per-request budget. */
 export interface CatalogModel {
-    info: DisplayModelInfo;
-    provider: string;
+    info: LlmResolvedModelInfo; /** Visibility key: raw `owned_by`, else the id's first segment. */
+    provider: string; /** Owner key that selects the route. */
+    owner: string;
     efforts: string[];
     nativeEndpoints: string[];
     serviceTiers: string[];
@@ -23,4 +28,3 @@ export declare const COMPACTION_HEADROOM_TOKENS = 65536;
 export declare const defaultOutputBudget: (contextWindow: number | undefined, outputLimit: number) => number;
 export declare const strings: (value: unknown) => string[];
 export declare function mapCatalog(body: unknown): CatalogModel[];
-export {};

package/lib/host/catalog.js

@@ -1,3 +1,21 @@
+/** Fixed pi-ai/replay transport identity. It is NOT a registered LLM route. */
+export const TRANSPORT_ID = 'dsh-magpie-connector';
+const ROUTE_PREFIX = `${TRANSPORT_ID}-`;
+const OWNER_KEY = /^[a-z0-9][a-z0-9._-]*$/;
+const ROUTE = /^dsh-magpie-connector-[a-z0-9][a-z0-9._-]{0,47}$/;
+/** Owner key of a gateway `owned_by` (untrusted): valid lower-cased value, else `other`. */
+export function ownerKey(ownedBy) {
+    if (typeof ownedBy !== 'string')
+        return 'other';
+    const key = ownedBy.trim().toLowerCase();
+    return key.length >= 1 && key.length <= 48 && OWNER_KEY.test(key) ? key : 'other';
+}
+/** Display name depends on the owner key alone, never on catalog content. */
+export const ownerLabel = (key) => key === 'other' ? 'Magpie (Other)' : `Magpie (${key.charAt(0).toUpperCase()}${key.slice(1)})`;
+export const routeOf = (key) => `${ROUTE_PREFIX}${key}`;
+export const isMagpieRoute = (id) => ROUTE.test(id);
+/** Owner key of one of our routes; anything else (direct adapter calls) reads as `other`. */
+export const ownerOfRoute = (route) => isMagpieRoute(route) ? route.slice(ROUTE_PREFIX.length) : 'other';
 /**
  * DSH compaction-basic's default `headroomTokens` (DSH 0.2.0-rc.2, lib/index.js) and Magpie's `dshHeadroom`.
  * Re-check on every DSH upgrade: DSH reserves `defaultMaxTokens` plus this headroom out of the window before compacting.
@@ -18,16 +36,13 @@ export function mapCatalog(body) {
         const ownedBy = typeof raw.owned_by === 'string' && raw.owned_by ? raw.owned_by : undefined;
         const contextWindow = positive(raw.context_window), outputLimit = positive(raw.max_output_tokens);
         const info = {
-            provider: 'dsh-magpie-connector', id: raw.id, name: typeof raw.display_name === 'string' && raw.display_name ? raw.display_name : raw.id,
-            // Namespace raw owners so a real 'other' cannot collide with missing ownership.
-            displayGroup: ownedBy === undefined ? { id: 'other', label: 'Magpie (Other)' }
-                : { id: ownedBy === 'claude' || ownedBy === 'codex' ? ownedBy : `owned-by:${ownedBy}`, label: `Magpie (${ownedBy === 'claude' ? 'Claude' : ownedBy === 'codex' ? 'GPT' : ownedBy})` },
+            provider: TRANSPORT_ID, id: raw.id, name: typeof raw.display_name === 'string' && raw.display_name ? raw.display_name : raw.id,
             inputModalities: strings(raw.modalities?.input).includes('image') ? ['text', 'image'] : ['text'],
             ...(contextWindow !== undefined ? { context: { contextWindow } } : {}),
             ...(outputLimit !== undefined ? { defaultMaxTokens: defaultOutputBudget(contextWindow, outputLimit) } : {}),
             ...(efforts.length ? { reasoning: { efforts: efforts.map(id => ({ id: id, name: id })) } } : {}),
         };
-        return [{ info, provider: ownedBy ?? raw.id.split('/')[0], efforts, ...(outputLimit !== undefined ? { outputLimit } : {}),
+        return [{ info, provider: ownedBy ?? raw.id.split('/')[0], owner: ownerKey(raw.owned_by), efforts, ...(outputLimit !== undefined ? { outputLimit } : {}),
                 nativeEndpoints: strings(raw.native_endpoints), serviceTiers: Array.isArray(raw.service_tiers) ? raw.service_tiers.flatMap((t) => typeof t?.id === 'string' ? [t.id] : []) : [] }];
     });
 }

package/lib/host/registrar.d.ts

@@ -0,0 +1,36 @@
+import type { LlmAdapter } from '@deepseek-ai/dsh-llm';
+/** Outcome of one host call; the registrar applies host semantics only, never owner policy. */
+export type PublishResult = {
+    ok: true;
+} | {
+    ok: false;
+    phase: 'initial' | 'replace';
+    code: string;
+    route?: string;
+};
+export interface RouteRegistrar {
+    /** Make `next` the full route set: first call registers, later calls `replace`. */
+    publish(next: string[]): PublishResult;
+    /** Routes the host currently holds for this plugin (as far as the plugin can know). */
+    current(): string[];
+    /** Set once the initial registration threw; the plugin must then never call the host again. */
+    fatal(): undefined | {
+        code: string;
+        route?: string;
+    };
+    /** Release the registration handle. May throw (host `INVARIANT`); callers isolate it. */
+    dispose(): void;
+}
+type Registry = {
+    registerAdapter(providers: string[], adapter: LlmAdapter): unknown;
+};
+/**
+ * D6 host-call semantics:
+ * - initial `registerAdapter`: any throw is a fatal start-up state (the host may have committed routes without
+ *   returning a handle, so nothing can be retried or undone) and the host is never called again;
+ * - `replace`: DUPLICATE_ADAPTER / INVALID_ADAPTER left the registry unchanged and are reported; INVARIANT means
+ *   the host already committed the new set, so it counts as success;
+ * - after dispose every call is a no-op.
+ */
+export declare function createRouteRegistrar(llm: Registry, adapter: LlmAdapter): RouteRegistrar;
+export {};

package/lib/host/registrar.js

@@ -0,0 +1,57 @@
+const codeOf = (error) => String(error?.code ?? 'UNKNOWN');
+const routeIn = (error) => /provider "([^"]+)"/.exec(String(error?.message ?? ''))?.[1];
+/**
+ * D6 host-call semantics:
+ * - initial `registerAdapter`: any throw is a fatal start-up state (the host may have committed routes without
+ *   returning a handle, so nothing can be retried or undone) and the host is never called again;
+ * - `replace`: DUPLICATE_ADAPTER / INVALID_ADAPTER left the registry unchanged and are reported; INVARIANT means
+ *   the host already committed the new set, so it counts as success;
+ * - after dispose every call is a no-op.
+ */
+export function createRouteRegistrar(llm, adapter) {
+    let handle, held = [], fatal, disposed = false;
+    return {
+        publish(next) {
+            if (disposed)
+                return { ok: true };
+            if (fatal)
+                return { ok: false, phase: 'initial', ...fatal };
+            if (!handle) {
+                if (!next.length)
+                    return { ok: true };
+                try {
+                    handle = llm.registerAdapter(next, adapter);
+                    held = [...next];
+                    return { ok: true };
+                }
+                catch (error) {
+                    const route = routeIn(error);
+                    fatal = { code: codeOf(error), ...(route ? { route } : {}) };
+                    return { ok: false, phase: 'initial', ...fatal };
+                }
+            }
+            try {
+                handle.replace(next);
+                held = [...next];
+                return { ok: true };
+            }
+            catch (error) {
+                const code = codeOf(error);
+                if (code === 'INVARIANT') {
+                    held = [...next];
+                    return { ok: true };
+                }
+                const route = routeIn(error);
+                return { ok: false, phase: 'replace', code, ...(route ? { route } : {}) };
+            }
+        },
+        current: () => [...held],
+        fatal: () => fatal,
+        dispose() {
+            disposed = true;
+            const release = handle;
+            handle = undefined;
+            release?.();
+        },
+    };
+}

package/lib/host/runtime.d.ts

@@ -1,5 +1,5 @@
 import { type CredentialProvider, type CredentialRef } from '@deepseek-ai/dsh-credentials';
-import { SettingsStore, type AccessMode, type CredentialField, type LineSettings } from './settings.js';
+import { SettingsStore, type AccessMode, type CredentialField, type LineSettings, type Settings } from './settings.js';
 import { GatewayTransport, type ConnectionIdentity } from './transport.js';
 import { LineSelector, type Probe } from './selection.js';
 import { type CatalogModel } from './catalog.js';
@@ -42,7 +42,7 @@ export interface RuntimeOptions {
 export declare class MagpieRuntime {
     readonly credentials: Credentials;
     readonly store: SettingsStore;
-    readonly publish: () => void;
+    readonly publish: (routes?: string[]) => void;
     current: Generation;
     readonly transport: GatewayTransport;
     readonly selector: LineSelector;
@@ -54,12 +54,29 @@ export declare class MagpieRuntime {
     private updating;
     private disposed;
     private saving;
+    /** Validated `knownOwners`; the route set is derived from it. */
+    private owners;
+    private knownOwnersReset;
+    private rejectedOwners;
+    /** Set once the initial route registration failed: no further owner admission or publishing (needs a Host restart). */
+    private registrationError;
     private readonly newId;
     selectedLineId: string | null;
-    constructor(credentials: Credentials, store?: SettingsStore, publish?: () => void, options?: RuntimeOptions);
+    constructor(credentials: Credentials, store?: SettingsStore, publish?: (routes?: string[]) => void, options?: RuntimeOptions);
+    /** Route ids of the persisted owners: the full set the adapter should own. */
+    routeSet(): string[];
+    private emit;
+    /**
+     * The only settings write path. Synchronous (no await inside), so two writes can never interleave;
+     * the base is the in-memory known fields AT CALL TIME (never a snapshot from before an await) and
+     * unknown fields (e.g. the legacy `baseUrl`) are not written back. Throws when the disk write fails,
+     * leaving the in-memory value unchanged.
+     */
+    writeSettings(patch: {
+        [K in keyof Settings]?: Settings[K] | undefined;
+    }): void;
     /** Strict load: any invalid persisted line/pending makes the whole connection read as empty. */
     private loadConfig;
-    private cleanSettings;
     start(): Promise<void>;
     trackPrepared(op: Operation): () => void;
     private resolveLine;
@@ -79,6 +96,8 @@ export declare class MagpieRuntime {
     formatErrorBody(text: string): string;
     syncCatalog(): Promise<void>;
     private syncGeneration;
+    /** D6 owner admission + publish for one successfully mapped catalog (synchronous: no await between the checks and the effects). */
+    private commitOwners;
     settings(body?: unknown): Promise<Response>;
     /** Structured line-list update: the only settings write path (BREAKING schema). */
     private updateLines;

package/lib/host/runtime.js

@@ -1,9 +1,9 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { credentialRef } from '@deepseek-ai/dsh-credentials';
-import { MAX_LINES, SettingsStore, isAccessMode, normalizeBaseUrl, validateLoadedLines, validatePendingCredentials, } from './settings.js';
+import { MAX_LINES, MAX_OWNERS, SettingsStore, isAccessMode, normalizeBaseUrl, validateLoadedLines, validateKnownOwners, validatePendingCredentials, } from './settings.js';
 import { GatewayTransport, validateIdentity } from './transport.js';
 import { LineSelector } from './selection.js';
-import { mapCatalog } from './catalog.js';
+import { mapCatalog, routeOf } from './catalog.js';
 /** Credential references bound to a line's stable random id. */
 export function lineCredentialRefs(lineId) {
     const upper = lineId.toUpperCase();
@@ -51,6 +51,12 @@ export class MagpieRuntime {
     updating = false;
     disposed = false;
     saving = false;
+    /** Validated `knownOwners`; the route set is derived from it. */
+    owners = [];
+    knownOwnersReset = false;
+    rejectedOwners = [];
+    /** Set once the initial route registration failed: no further owner admission or publishing (needs a Host restart). */
+    registrationError;
     newId;
     selectedLineId = null;
     constructor(credentials, store = new SettingsStore(), publish = () => { }, options = {}) {
@@ -61,6 +67,46 @@ export class MagpieRuntime {
         this.transport.onConnectionFailure = lineId => this.selector.invalidate(lineId);
         this.newId = options.newId ?? randomHexId;
         this.failedFields = this.loadConfig().pending;
+        try {
+            this.owners = validateKnownOwners(this.store.value.knownOwners);
+        }
+        catch {
+            this.owners = [];
+            this.knownOwnersReset = true;
+        }
+    }
+    /** Route ids of the persisted owners: the full set the adapter should own. */
+    routeSet() { return this.owners.map(routeOf); }
+    emit(routes) {
+        if (this.disposed)
+            return undefined;
+        const result = this.publish(routes);
+        if (result && !result.ok && result.phase === 'initial')
+            this.registrationError ??= { code: result.code, ...(result.route ? { route: result.route } : {}) };
+        return result;
+    }
+    /**
+     * The only settings write path. Synchronous (no await inside), so two writes can never interleave;
+     * the base is the in-memory known fields AT CALL TIME (never a snapshot from before an await) and
+     * unknown fields (e.g. the legacy `baseUrl`) are not written back. Throws when the disk write fails,
+     * leaving the in-memory value unchanged.
+     */
+    writeSettings(patch) {
+        const value = this.store.value;
+        const next = {
+            lines: value.lines ?? [], visibleModels: value.visibleModels ?? {}, defaultEfforts: value.defaultEfforts ?? {},
+            ...(value.credentialUpdatePending ? { credentialUpdatePending: value.credentialUpdatePending } : {}),
+            ...(this.owners.length ? { knownOwners: this.owners } : {}),
+        };
+        for (const [key, field] of Object.entries(patch)) {
+            if (field === undefined)
+                delete next[key];
+            else
+                next[key] = field;
+        }
+        this.store.save(next);
+        if (patch.knownOwners)
+            this.knownOwnersReset = false;
     }
     /** Strict load: any invalid persisted line/pending makes the whole connection read as empty. */
     loadConfig() {
@@ -71,10 +117,7 @@ export class MagpieRuntime {
             return { lines: [], pending: [] };
         }
     }
-    cleanSettings(lines, pending) {
-        return { lines, visibleModels: this.store.value.visibleModels ?? {}, defaultEfforts: this.store.value.defaultEfforts ?? {}, ...(pending ? { credentialUpdatePending: pending } : {}) };
-    }
-    async start() { await this.syncCatalog(); }
+    async start() { this.emit(this.routeSet()); await this.syncCatalog(); }
     trackPrepared(op) {
         const ref = new WeakRef(op);
         this.prepared.add(ref);
@@ -107,7 +150,7 @@ export class MagpieRuntime {
             catalog: carry?.catalog ? [...carry.catalog] : [], bgAbort: new AbortController(),
             ...(carry?.lastSyncAt ? { lastSyncAt: carry.lastSyncAt } : {}),
         };
-        this.publish();
+        this.emit();
     }
     identityOf(resolved) {
         if (!resolved)
@@ -266,7 +309,7 @@ export class MagpieRuntime {
                 gen.lastSyncAt = new Date().toISOString();
                 delete gen.lastSyncError;
                 delete gen.lastSyncErrorKind;
-                this.publish();
+                this.commitOwners(gen, catalog);
             }
             catch (error) {
                 if (!this.isCurrent(gen))
@@ -283,6 +326,47 @@ export class MagpieRuntime {
         })();
         return gen.syncPromise;
     }
+    /** D6 owner admission + publish for one successfully mapped catalog (synchronous: no await between the checks and the effects). */
+    commitOwners(gen, catalog) {
+        if (this.disposed || !this.isCurrent(gen))
+            return;
+        const fresh = [...new Set(catalog.map(m => m.owner))].filter(owner => !this.owners.includes(owner));
+        const admit = fresh.slice(0, Math.max(0, MAX_OWNERS - this.owners.length));
+        this.rejectedOwners = fresh.slice(admit.length);
+        if (this.registrationError)
+            return;
+        const previous = this.owners;
+        let added = false;
+        if (admit.length) {
+            try {
+                this.writeSettings({ knownOwners: [...previous, ...admit] });
+                this.owners = [...previous, ...admit];
+                added = true;
+            }
+            catch {
+                gen.lastSyncErrorKind = 'settings';
+                gen.lastSyncError = 'MAGPIE_SETTINGS_WRITE_FAILED: could not save known owners';
+            }
+        }
+        const result = this.emit(this.routeSet());
+        if (!result || result.ok)
+            return;
+        const rollback = () => {
+            if (!added)
+                return;
+            this.owners = previous;
+            try {
+                this.writeSettings({ knownOwners: previous.length ? previous : undefined });
+            }
+            catch { /* reported below; memory stays rolled back */ }
+        };
+        rollback();
+        if (result.phase === 'initial')
+            return;
+        gen.lastSyncErrorKind = 'registration';
+        gen.lastSyncError = `MAGPIE_ROUTE_REGISTRATION_FAILED: ${result.code}${result.route ? ` ${result.route}` : ''}`;
+        this.emit(this.routeSet());
+    }
     // ---- settings surface ---------------------------------------------------
     async settings(body) {
         if (body !== undefined) {
@@ -425,7 +509,7 @@ export class MagpieRuntime {
         try {
             // Marker saves keep the committed line list; a failed write must not apply the new lines.
             if (pending.length)
-                this.store.save(this.cleanSettings(existing, pending));
+                this.writeSettings({ lines: existing, credentialUpdatePending: pending });
             for (const write of writes) {
                 const ref = lineCredentialRefs(write.lineId)[write.field];
                 if (write.value === null)
@@ -445,7 +529,7 @@ export class MagpieRuntime {
                 await this.credentials.unset(ref);
             }
             this.retained = retained;
-            this.store.save(this.cleanSettings(nextLines));
+            this.writeSettings({ lines: nextLines, credentialUpdatePending: undefined });
             this.failedFields = [];
         }
         catch {
@@ -505,16 +589,18 @@ export class MagpieRuntime {
             lastSyncAt: gen.lastSyncAt, lastSyncError: gen.lastSyncError, lastSyncErrorKind: gen.lastSyncErrorKind,
             groups: [...new Set(gen.catalog.map(m => m.provider))].map(provider => ({ provider, models: gen.catalog.filter(m => m.provider === provider).map(m => ({ id: m.info.id, name: m.info.name, efforts: m.efforts })) })),
             visibleModels: this.store.value.visibleModels, defaultEfforts: this.store.value.defaultEfforts,
+            knownOwnersReset: this.knownOwnersReset, ownerLimitReached: this.rejectedOwners.length > 0, rejectedOwners: this.rejectedOwners,
+            ...(this.registrationError ? { routeRegistrationError: this.registrationError } : {}),
         }));
     }
     /** Preference-only writes also persist the single clean schema (drops legacy fields). */
     savePreferences(patch) {
         const config = this.loadConfig();
-        this.store.save({
+        this.writeSettings({
             lines: config.lines,
             visibleModels: patch.visibleModels ?? this.store.value.visibleModels ?? {},
             defaultEfforts: patch.defaultEfforts ?? this.store.value.defaultEfforts ?? {},
-            ...(this.failedFields.length ? { credentialUpdatePending: this.failedFields } : {}),
+            credentialUpdatePending: this.failedFields.length ? this.failedFields : undefined,
         });
     }
     config() { return this.loadConfig().lines; }

package/lib/host/settings.d.ts

@@ -20,6 +20,8 @@ export interface Settings {
     visibleModels: Record<string, string[]>;
     defaultEfforts: Record<string, string>;
     credentialUpdatePending?: PendingCredential[];
+    /** Owner keys seen so far (first-seen order, max {@link MAX_OWNERS}); each owns one registered LLM route. */
+    knownOwners?: string[];
 }
 export declare class SettingsStore {
     readonly path?: string | undefined;
@@ -29,6 +31,7 @@ export declare class SettingsStore {
 }
 export declare function normalizeBaseUrl(value: unknown): string;
 export declare const MAX_LINES = 5;
+export declare const MAX_OWNERS = 32;
 export declare const LINE_ID_PATTERN: RegExp;
 export declare const isAccessMode: (value: unknown) => value is AccessMode;
 export declare const isCredentialField: (value: unknown) => value is CredentialField;
@@ -43,3 +46,8 @@ export declare function validateLoadedLines(value: unknown): LineSettings[];
 export declare function validatePendingCredentials(value: unknown): PendingCredential[];
 /** Host-generated opaque stable line id: 8 lowercase hex, unique within the supplied set. */
 export declare function randomLineId(existing: Iterable<string>): string;
+/**
+ * Load-time check of `knownOwners`: missing = empty; anything else invalid (not an array, bad key,
+ * duplicate, more than {@link MAX_OWNERS}) throws so the caller resets the WHOLE array (no partial repair).
+ */
+export declare function validateKnownOwners(value: unknown): string[];

package/lib/host/settings.js

@@ -28,6 +28,8 @@ export function normalizeBaseUrl(value) {
     return url.href.replace(/\/+$/, '');
 }
 export const MAX_LINES = 5;
+export const MAX_OWNERS = 32;
+const OWNER_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 export const LINE_ID_PATTERN = /^[0-9a-f]{8}$/;
 export const isAccessMode = (value) => value === 'direct' || value === 'cloudflare';
 export const isCredentialField = (value) => value === 'key' || value === 'accessClientId' || value === 'accessClientSecret';
@@ -95,3 +97,19 @@ export function randomLineId(existing) {
             return id;
     }
 }
+/**
+ * Load-time check of `knownOwners`: missing = empty; anything else invalid (not an array, bad key,
+ * duplicate, more than {@link MAX_OWNERS}) throws so the caller resets the WHOLE array (no partial repair).
+ */
+export function validateKnownOwners(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_OWNERS)
+        throw new Error('Invalid knownOwners');
+    for (const key of value)
+        if (typeof key !== 'string' || key.length < 1 || key.length > 48 || !OWNER_KEY.test(key))
+            throw new Error('Invalid knownOwners');
+    if (new Set(value).size !== value.length)
+        throw new Error('Invalid knownOwners');
+    return [...value];
+}

package/lib/host/transport.js

@@ -18,7 +18,8 @@ export class GatewayTransport {
     signal = new AbortController();
     /** Called when a request fails before the connection was established. */
     onConnectionFailure;
-    agent = new Agent();
+    // undici's default 10s connect timeout fails cold TLS handshakes to the Cloudflare ingress.
+    agent = new Agent({ connect: { timeout: 25_000 } });
     async request(identity, method, path, init = {}) {
         validateIdentity(identity);
         const base = new URL(identity.baseUrl);

package/lib/index.d.ts

@@ -1,10 +1,13 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { MagpieRuntime } from './host/runtime.js';
 import { MagpieAdapter } from './host/adapter.js';
+import { type RouteRegistrar } from './host/registrar.js';
 export { MagpieRuntime, lineCredentialRefs, lineIdOfCredentialRef } from './host/runtime.js';
 export { MagpieAdapter, mapUsage } from './host/adapter.js';
 export { SettingsStore } from './host/settings.js';
 export { GatewayTransport } from './host/transport.js';
+export { createRouteRegistrar, type RouteRegistrar, type PublishResult } from './host/registrar.js';
+export { TRANSPORT_ID, ownerKey, ownerLabel, routeOf, isMagpieRoute } from './host/catalog.js';
 export declare const name = "dsh-magpie-connector";
 export declare const inject: string[];
 export interface Config {
@@ -13,4 +16,5 @@ export interface Config {
 export declare function apply(ctx: Context, config?: Config): {
     runtime: MagpieRuntime;
     adapter: MagpieAdapter;
+    routes: RouteRegistrar;
 };

package/lib/index.js

@@ -5,24 +5,31 @@ import { MagpieAdapter } from './host/adapter.js';
 import { SettingsStore } from './host/settings.js';
 import { registerRoutes } from './host/routes.js';
 import { SpeedController } from './host/speed.js';
+import { createDisposer } from './host/dispose.js';
+import { createRouteRegistrar } from './host/registrar.js';
 export { MagpieRuntime, lineCredentialRefs, lineIdOfCredentialRef } from './host/runtime.js';
 export { MagpieAdapter, mapUsage } from './host/adapter.js';
 export { SettingsStore } from './host/settings.js';
 export { GatewayTransport } from './host/transport.js';
+export { createRouteRegistrar } from './host/registrar.js';
+export { TRANSPORT_ID, ownerKey, ownerLabel, routeOf, isMagpieRoute } from './host/catalog.js';
 export const name = 'dsh-magpie-connector';
 export const inject = ['llm', 'credentials'];
 export function apply(ctx, config = {}) {
     const home = config.home ?? process.env.DSH_HOME ?? resolve(homedir(), '.dsh');
-    let registration;
-    const runtime = new MagpieRuntime(ctx.credentials, new SettingsStore(resolve(home, 'plugins/dsh-magpie-connector/settings.json')), () => registration?.replace(['dsh-magpie-connector']));
+    // Declared first, assigned below: the runtime's publish callback and the adapter reference each other.
+    let adapter;
+    let registrar;
+    const runtime = new MagpieRuntime(ctx.credentials, new SettingsStore(resolve(home, 'plugins/dsh-magpie-connector/settings.json')), routes => registrar.publish(routes ?? runtime.routeSet()));
     const speed = new SpeedController();
-    const adapter = new MagpieAdapter(runtime, ctx.get('attachments'), session => speed.get(session).tier === 'fast');
-    registration = ctx.llm.registerAdapter(['dsh-magpie-connector'], adapter);
+    adapter = new MagpieAdapter(runtime, ctx.get('attachments'), session => speed.get(session).tier === 'fast');
+    registrar = createRouteRegistrar(ctx.llm, adapter);
     ctx.on('credentials/reference-updated', ref => runtime.invalidateCredential(ref));
     ctx.inject(['connection'], child => {
         child.effect(() => registerRoutes(child.connection.fetch, runtime, speed).dispose);
     });
-    ctx.effect(() => async () => { registration?.(); registration = undefined; await runtime.dispose(); });
+    const dispose = createDisposer(runtime, [() => registrar.dispose()]);
+    ctx.effect(() => dispose);
     void runtime.start().catch(() => { });
-    return { runtime, adapter };
+    return { runtime, adapter, routes: registrar };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-magpie-connector",
-  "version": "0.2.0",
-  "description": "DeepSeek Harness plugin: connect a self-hosted Magpie gateway as one LLM provider with models grouped by upstream provider, read-only usage cards, model visibility, default effort and per-session fast mode",
+  "version": "0.3.1",
+  "description": "DeepSeek Harness plugin: connect a self-hosted Magpie gateway with one real provider route per upstream owner (grouped model picker on stock DSH), automatic multi-line failover, read-only usage cards, model visibility, default effort and per-session fast mode",
   "license": "MIT",
   "author": "prgrmrwy",
   "repository": {
@@ -71,6 +71,7 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-api-session-controller": "^0.2.0-rc.2",
     "@deepseek-ai/dsh-attachment": "^0.2.0-rc.2",
     "@deepseek-ai/dsh-client-connection": "^0.2.0-rc.2",
     "@deepseek-ai/dsh-client-ui-renderer": "^0.2.0-rc.2",

package/screenshots.json

@@ -1,3 +1,4 @@
 [
-  "docs/model-picker.gif"
+  "docs/model-picker.png",
+  "docs/settings.png"
 ]