dsh-model-flatmap 1.0.2 → 1.1.0

package/docs/DETAIL.md

@@ -47,16 +47,23 @@ and the agent teamwork switch are all visible at once.
   `acme-7b` are one `Acme`), and dictionary families are never split by
   generation. A provider prefix does not hide the brand (`codebuddy-hy3` →
   `HY3`).
-- **Family-grouped rows are provider-primary.** A family heading says what the
-  models *are*, so the family name is not repeated in a row. The row's primary
-  text is the provider name — the one thing a heading cannot tell you when a
-  family spans providers. The full model name and description stay in the row
-  tooltip. Only when one provider offers several models in the same family do
-  those rows carry a short secondary variant derived from the id tail (e.g.
-  `hy4free` → `free`, `hy3-x` → `x`); the plain base model carries no tag.
-  Colliding variants fall back to the unique model id. Under *By provider* the
-  heading already is the provider, so the primary text stays the model name and
-  no secondary tag is drawn.
+- **Family-grouped rows are provider-primary, with a model tail.** A family
+  heading says what the models *are*, so the family name is not repeated in a
+  row. The row's primary text is the provider name — the one thing a heading
+  cannot tell you when a family spans providers. The full model name and
+  description stay in the row tooltip. What the heading *and* the provider
+  cannot say — which model of the family this row is, and the catalog's rate
+  multiplier — is drawn as a quieter tail at the END of the row. The tail is
+  the model name with the family heading and the provider's own label removed,
+  so `Qwen3.8-Flash-Next` under `Qwen` reads `3.8-Flash-Next`, `Qwen3.8-27B`
+  reads `3.8-27B`, `Deepseek-V4.1-Flash · x0.00` under `DeepSeek` reads
+  `V4.1-Flash · x0.00`, and `豆包 2.1 Turbo` under provider `豆包(doubao)` reads
+  `2.1 Turbo`. Version numbers are KEPT (they are the型号 the heading lacks),
+  and a multiplier inside the tail is drawn two sizes smaller and bold, exactly
+  as it is inside a model name under *By provider*. Two rows of one provider
+  that still read alike fall back to the unique model id; a model whose name
+  adds nothing draws no tail. Under *By provider* the heading already is the
+  provider, so the primary text stays the model name and no tail is drawn.
 - **Adaptive columns.** The panel measures one group title and one model row,
   subtracts the fixed sections from the 320 px cap, and picks the smallest
   column count from 1 to 3 that fits. If even three columns overflow, it keeps
@@ -97,9 +104,10 @@ and the agent teamwork switch are all visible at once.
   translucent white chip so it stays legible on the blue fill.
 - **Out-of-balance models are struck through.** When a model call fails because
   the account has no usable balance, credit, or quota left, that model's row
-  text is drawn with a `line-through` decoration, and the strike stays until a
+  text is drawn with a `line-through` decoration. The strike stays until a
   later call for the same model returns something other than an
-  insufficient-balance failure. The row is not recoloured, so the strike reads
+  insufficient-balance failure, **or** until it has gone 24 hours without a new
+  attempt — whichever comes first. The row is not recoloured, so the strike reads
   the same on the selected row's blue band and in both themes, and it does not
   compete with the error strip's red. Only the row's text (the name and a
   family variant tag) is struck; the badge chip and the pending spinner are
@@ -137,6 +145,21 @@ and the agent teamwork switch are all visible at once.
     that failed for a different reason. A cancellation (`aborted`), a `blocked`
     turn, and the synthetic `interrupted` / `forked` closers clear nothing —
     the model never answered, so they say nothing about the account.
+  - **How long it is drawn without one.** Every record keeps the wall-clock
+    time of the observation that made it, which is what separates "this model is
+    out of balance" from "this model has not been tried since that verdict". A
+    mark older than 24 hours is not drawn: an exhausted balance gets topped up
+    and a quota resets daily, so a strike nobody refreshed has stopped being
+    information. A retry restamps the record and restarts the window, so the
+    rule is "24 hours since the newest thing we learned about this route", not
+    "24 hours since the row was painted". Retiring a strike is the one transition
+    no event reports, so the store watches the clock itself: on every fold, when
+    a seat subscribes, when the panel is opened, and on a timer set for the
+    soonest deadline (that handle is `unref`'d, so a day-long wait never holds
+    the host process). The record SURVIVES its own expiry, as the watermark for
+    the route — which is why re-folding the very failure that made it, after a
+    reload or when a second Session's older history is walked, cannot put the
+    decoration back.
   - **The marks are global, not per conversation.** Whether a model has quota
     left is a fact about the model route and its account, so the state is NOT
     scoped to the Session a panel happens to render for. One module-level store
@@ -147,8 +170,12 @@ and the agent teamwork switch are all visible at once.
   - **It survives a reload.** The marks are persisted to `localStorage`
     (origin-scoped, like the grouping choice), so a fresh page load starts from
     the last known state instead of an empty one. Reads and writes degrade
-    silently when storage is unavailable, and records older than 7 days are
-    dropped so a stale strike cannot live forever.
+    silently when storage is unavailable. Two lifetimes apply to that record and
+    they are not the same one: a mark stops being DRAWN after 24 hours without a
+    new observation, while the record itself is kept for 7 days, because it is
+    also the watermark that keeps an older replayed failure from restamping the
+    route. So a reload of a day-old verdict restores the row as plain text, and
+    the fold that re-reads the failure that produced it changes nothing.
   - **The newest observation wins.** A Session feed carries no cross-Session
     sequence number, but every durable event keeps the Host's wall-clock `time`.
     Each route keeps the time of its last decision, and an observation older
@@ -168,6 +195,126 @@ and the agent teamwork switch are all visible at once.
   the shared footer line described under *Reasoning levels*, immediately right
   of the reasoning group when both fit on one line.
 
+## The trigger
+
+The trigger is the same chip the shipped picker draws (13/20 regular, 28 px,
+rounded-sm), and it shows the same *content* — which is more than a model name.
+
+**The name is a slot, not a string.** The shipped `ModelSelect` does not paint
+`model.name` on its trigger: it renders `conversation.input.model.label` with
+`placement: 'trigger'` and lets the winning contributor decorate the name. That
+is where a connection plugin puts things the catalog does not carry: a promotion
+chip (`夜间折扣`), a rate, a "new on this machine" marker, and — in the case of
+`dsh-connect-workbuddy` — a load mark: one, two or three queued people, or a
+rocket when nothing is waiting. A bare name therefore shows strictly less than
+the native trigger, which is what this plugin used to do.
+
+**This plugin renders that slot's winner.** It cannot *declare* the child slot
+(the shipped entry already did, and a second declaration throws
+`already declared`) — but declaring is not needed to read it. The declaration
+outlives the shadowing entry, so `slots.entriesOfSlot('conversation.input.model.label')`
+still names the winning entry, and its `component` can be rendered with the
+seats the renderer would have supplied:
+
+- `t` — bound from the entry's own `locale` namespace through `locale.bind(ns)`;
+- the business face — `entry.inject(sessionId)`, the renderer's own contract for
+  a session-scoped entry;
+- the owner props — `{ provider, model, placement: 'trigger', selected: true }`,
+  exactly the share the shipped picker passes.
+
+**The occupant is third-party code, so it is contained.** It runs without the
+renderer's per-entry error boundary, so a separate `LabelBoundary` wraps it. A
+crash costs the decoration and never the seat: the boundary answers `undefined`
+and the trigger falls through to the catalog name. The failure is logged once.
+
+**No occupant still gets the catalog badge.** When the cell is empty — or the
+occupant is absent, crashed, or on a Host without `entriesOfSlot` — the trigger
+draws the shipped fallback: the model's own `model.badge` as a chip before the
+name. This is reproduced rather than imported (the host's `Tag` lives in a
+primitives package this plugin does not depend on), and it matters even with an
+occupant installed: an occupant that does not reproduce a sibling's `model.badge`
+would otherwise lose the promotion marker.
+
+**Registrations that land late still appear.** The trigger subscribes to the
+slot through `slots.subscribe(key, fn)` / `slots.getVersion(key)`, so a
+connection plugin that registers a moment after boot gets its chip on the
+trigger without a page reload. A Host without those accessors keeps the first
+read and never notifies.
+
+Because native mode (below) hands the seat to the Host, which renders the same
+slot, the trigger is now *one* implementation in both modes — the consistency
+this feature exists for.
+
+## Native mode
+
+The footer's trailing `默认样式` / `Default style` button hands the composer's model seat
+back to whatever the Host ships in `conversation.input.model`, and back again.
+
+**How the switch works.** The plugin does NOT render the host's control — it
+stops shadowing it. This entry registers at a negative priority, so it wins the
+`single` slot; a `single` slot keeps every registration and renders only the
+highest-priority live one. Native mode therefore `dispose()`s this plugin's
+entry, which elects the shipped one underneath: the host mounts its own
+`ModelSelect`, whatever that is in the installed version. Nothing is imported,
+copied, or re-mounted, so an upgraded DSH shows its own newest picker and this
+mode structurally cannot drift out of date.
+
+The alternative — pulling the shipped component into our own tree — is not
+available: the `model-selection` package exports no component, and every
+`renderSlot` child (`conversation.input.model.label` / `.options`) is bound to
+the entry that declares it, so another entry calling it throws
+`StaleAuthorizationError` / `SlotOwnershipError`. See DEC-027.
+
+**Stepping aside is verified, never assumed.** Before disposing, the plugin asks
+`slots.entries('conversation.input.model')` for the registrations other than its
+own. If there is none — the shipped package disabled, uninstalled, or a Host too
+old to enumerate entries — the panel stays mounted and the button reads disabled
+with a tooltip explaining why. A persisted `native` mode from a previous install
+therefore lands on the flat panel instead of an empty composer.
+
+**The way back.** Native mode disposes the entry that owns the footer button, so
+the button cannot switch back. The return trip instead rides the HOST picker's
+own panel: `conversation.input.model.options` is the list child slot the shipped
+`ModelSelect` declares and renders directly after its Model / Effort rows, so our
+control appears at the bottom of the native menu itself. It belongs to the
+shipped entry, not to ours, so it outlives the disposal; and it renders `null` in
+flat mode, so the shipped menu looks exactly as shipped while the panel is on
+screen. Clicking it dismisses the host menu first (the entry that owns the menu
+is about to be disposed) and then flips the mode back.
+
+**It does not look like a menu row.** Every row above it answers "which value?";
+this one performs an action. So it is drawn as a separated bottom band — a 1px
+`--dsw-alias-border-l2` rule above, then a full-width 30 px outlined button
+(`--dsw-alias-border-l3`, `--dsw-radius-sm`, 12/18 medium label, 14 px icon) with
+a hover fill and a focus ring. The slot gives occupants only a `display: contents`
+anchor, so that whole box is ours; nothing about the host menu's own rows has to
+be imitated. The distinction is pinned by a test that asserts the button carries
+no `role="menuitem"`.
+
+Nothing here is a copy of the host control: the row is one entry in a slot the
+installed package publicly declares. The former placement — a chip in
+`conversation.input.right`, beside the native
+trigger — was dropped because it read as a toolbar control belonging to nothing
+in particular, and because it forced the mode control to sit outside the panel
+it acts on.
+
+**One shared store.** Both controls read one page-wide mode store, so a flip made
+from either is what the other sees. The store persists the choice to
+`localStorage` (`dshmf:mode`, the same origin-scoped mechanism as the grouping
+choice) and degrades to `flat` whenever storage is unavailable — a missing store
+must never leave the composer without a model control.
+
+**Reported state is the visible state.** The panel only renders while it owns the
+cell, so the stored mode and the on-screen mode can disagree in exactly one case:
+`native` persisted with nothing to inherit the cell. The button's `aria-pressed`
+then reports flat, because it describes what is on screen, not what is in
+storage.
+
+**What changes across a switch.** Coming back from native mode remounts the
+panel, so it opens closed with an empty query. Focus follows the disposed
+button down to the document; cross-plugin DOM queries for focus are not allowed,
+so it is not chased.
+
 ## Data and interaction
 
 Everything goes through public Client APIs:
@@ -182,10 +329,20 @@ Everything goes through public Client APIs:
   Session the Session list names (`ctx.sessions.list`) to derive the global
   per-model insufficient-balance marks, persists them to `localStorage`, and
   every seat subscribes through `useSyncExternalStore` so a mark transition
-  repaints the panel while every other event stays quiet.
+  repaints the panel while every other event stays quiet. The same store also
+  re-reads the clock on subscribe, on panel open and on a self-armed timer,
+  because a strike reaching its 24-hour age is a transition no feed will ever
+  report. A snapshot is replaced only when the set of drawn marks actually
+  changed, so those extra reads cannot churn the panel.
 - `ctx.get('remote').agentTeams.setEnabled()` writes the teamwork selection.
 - `ctx.locale` supplies the copy, resolves catalog badge text, and prefers the
   host's own `agent-team` wording when that namespace is registered.
+- `slots.register()` / its disposer and `slots.entries()` / `slots.subscribe()`
+  drive native mode: disposing this plugin's `conversation.input.model` entry
+  elects whatever the Host registered underneath, and `entries()` is what makes
+  that verifiable before the switch. `slots.subscribe()` re-runs the reconcile,
+  so a shipped picker that appears (or disappears) later enables or disables the
+  button without a reload.
 
 No host component, stylesheet, or DOM is read or restyled.
 
@@ -231,13 +388,38 @@ The band also carries a low-key frame: a hairline border
 group start clearly without boxing the group's rows — a group's rows may flow
 across columns, so only its label is framed (see DEC-003).
 
+### Long text: one-pass hover marquee
+
+A model name, or a group heading, that does not fit its column is ellipsised.
+Resting the pointer on it for 0.5 s starts a single, eased, leftward pass that
+stops when the last glyph reaches the window's right edge; leaving resets it
+immediately with no animation. The pass runs ONCE, is `ease-in-out` rather than
+`linear`, and honours `prefers-reduced-motion: reduce` by not running at all.
+
+Both a model row and a group title use the same structure, so only the text
+slides and the frame never does: a clipped **window** (`overflow: hidden` +
+`text-overflow: ellipsis`) wraps a **track** (`width: max-content`) that is
+allowed to be wider than the window. For a row the frame is the row itself, so
+the right-aligned tail, badge (`限时免费`, `x0.1`) and spinner never move; for a
+title the frame is the band, so its fill, frame, radius and elevation stay put.
+One state machine drives both — keyed by the row's route or the title's block
+key — so only one thing in the panel scrolls at a time. The travel distance is
+the measured overflow, and the duration is that distance divided by 50 px/s
+(see DEC-021, DEC-022, DEC-023).
+
 ## Limitations
 
 - The panel replaces the composer seat only; the `/model` popup is untouched.
-- The panel does not host the `conversation.input.model.label` and
-  `conversation.input.model.options` child slots. The shipped registration keeps
-  those declarations alive, so other plugins' contributions stay valid; their
-  content simply is not drawn inside this panel.
+- The panel's GRID does not host the `conversation.input.model.label` child
+  slot: rows draw the catalog name plus `model.badge`. Only the TRIGGER renders
+  that slot's winner, because that is what the native trigger does. The
+  `conversation.input.model.options` slot is not drawn anywhere in the panel.
+  The shipped registration keeps both declarations alive, so other plugins'
+  contributions stay valid either way.
+- The trigger's label cell renders ANOTHER PLUGIN'S component. It is written
+  against the documented `ModelLabelOwner` props, but nothing guarantees every
+  future contributor stays compatible; `LabelBoundary` degrades a crash to the
+  catalog name, which is the same fallback the host uses for an empty cell.
 - Addressed subagent sessions hide the seat, matching the shipped selector.
 - The badge comes from the catalog entry, so a provider that publishes no badge
   shows none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-flatmap",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Flat, two-level-free model picker for the DSH composer: every model and reasoning level on one surface.",
   "type": "module",
   "exports": {