dsh-model-switch 0.4.28 → 0.4.30

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## v0.4.30
+
+One live failure class, three fixes: after a provider-group save every tool call in the session died before its body ran with `cannot get required service "sessionProjections" in inactive context`, the settings page sometimes answered a provider-group save with the raw `settings-rejected` sentinel, and the composer's permission selector sometimes disappeared.
+
+- **P0: every tool call failed while the Auto preset was selected (`src/auto-review.ts`).** The official `@deepseek-ai/dsh-experimental-auto-review` gate opens every `tools/pre-execute` waterfall with `permissionPresets.current(session)`. That call resolves the preset service's **own** `sessionProjections` injection, and `sessionProjections` is exactly what `permissionState()` reads; when that fiber has turned inactive the probe throws `cannot get required service "sessionProjections" in inactive context` **outside** the gate's reviewer-error wrapper, so the raw service error becomes the tool result and the body never runs. `reviewScope` now shadows `permissionPresets` next to the already-shadowed `llm` (`defensivePermissionPresets`): a failing `current()` degrades to `custom`, which makes the gate skip review and call `next()` so the tool body still runs; a failing `set()` during teardown is swallowed; a `registerAuto` conflict is reported as one log line instead of failing the gate. The degradation is logged once, not once per tool call.
+- **Auto integration lifecycle (`src/auto-review.ts`).** `registerAuto` is single-registration with an **effect lifetime** — its disposer is what clears the Auto preset, and its absence is what makes `auto` disappear from `permissionPresets.names` (and a restore fail with `cannot restore preset "auto" without its active integration`). A re-applied row now disposes the previously mounted gate fiber and awaits it (`Fiber.dispose` settles after cleanup) before mounting the next gate, so a re-mount cannot hit `preset "auto" is already registered` and leave the catalog without Auto.
+- **Takeover hardening (`src/session-title.ts`).** `isOfficialTitleRow` now keys on the cadence **package name** only, and `reclaim` re-checks that package before `entry.update({ disabled: true })`, logging every disable. The takeover disposes the matched entry's fiber, so an id-only match must never reach a group or another plugin's row.
+- **Provider-group saves are fenced and retried (`src/client/provider-group-save.ts`, `src/client/index.tsx`).** A save now lands as one atomic `mutate(ops, revision)` under the revision it actually read. When the host refuses it (another card, another window, or the runtime's own capture write moved the fence), the save re-reads the snapshot and retries — up to three times — instead of losing the edit, and only then reports failure. The settings page shows a localized "保存被拒绝，请重试" instead of the raw `settings-rejected` sentinel.
+- **Permission selector disappearing.** The official selector renders nothing while the permission catalog has no complete value or the session's permission selection is missing; both states came from the same Auto-integration and preset-service instability above, so the lifecycle fix removes the trigger. `docs/seam-gap.md` records this as official-UI behavior this plugin cannot change, plus the single-registration `registerAuto` seam.
+- **Verification.** `pnpm run check` green (54 test files / 478 tests + pack gate). New coverage: the degraded probe returns `custom` and logs once, a healthy face stays transparent, a registration conflict is reported and its disposer resolves, a failing preset write during teardown is swallowed, the takeover refuses an id-only lookalike and never disables it, and the fenced save writes under the read revision, retries after one refusal, reports `settings-rejected` only after every attempt was refused, and clears the field when the last group is deleted. With the **real published packages** (`@deepseek-ai/dsh-experimental-auto-review` + `@deepseek-ai/dsh-permission-presets` from the 0.2.1 line): the pre-fix shape reproduces the exact live message through the gate's prepended listener, and the shipped shape runs the gate with the same broken preset service while the tool call proceeds.
+- **Residual (honest).** The defensive shadow trades a failed reviewer for a running tool: while the preset service is broken, review is skipped with one explicit log line instead of blocking every call. The single-registration constraint still has no public replace API; the missing seam and the proposed upstream shape are recorded in `docs/seam-gap.md`.
+- **A/B caveat.** The live "plugin off → tools fine" observation was confounded: the permission preset was switched from `auto` to `danger-full-access` in the same minute the plugin was disabled. The controlled matrix (plugin on/off × preset auto/full-access × plan mode on/off × fresh session/resumed session) is the confirmation step after installing this release.
+
+## v0.4.29
+
+The experimental "随对话更新的标题" bundle (`dsh-experimental-session-titles-bundle`) no longer fails to enable while this plugin is active: the naming row now takes over the single provider slot the bundle's row competes for, mirrors that row's cadence, and keeps the configurable naming route working.
+
+- **What broke.** Enabling the bundle produced `1 entry did not activate optional-session-title-all-prompts (@deepseek-ai/dsh-session-title-all-prompts-llm): session-title provider "session-title-first-prompt-llm" is already registered`. DSH 0.2.1's session-title service accepts exactly one registered provider, and this row already owned that slot with its mirrored first-prompt provider. The bundle's patch inserts its all-prompts row **after** this plugin's patch layer, so the static `- id: optional-session-title-all-prompts` disable this plugin ships can never reach a row that does not exist yet when that layer applies.
+- **Fix: the row now takes the slot over instead of colliding (`src/session-title.ts`).** It mirrors the official row that exists in the tree — all-prompts winning whenever the experimental row is composed, first-prompt otherwise — and it watches `loader/patch-context`, which the loader runs inside the official entry before that entry's plugin `apply`. When an official naming row is about to register, this row yields the slot first (the service lets a registration be replaced once its disposer ran), so the official `register()` **succeeds** and the loader reports no failed activation; it then disables that row through the public `Entry.update({ disabled: true })` (which disposes the row's fiber and closes its registration) and claims the slot back under the row's cadence. A bounded retry absorbs the cases where the loader has not created the row's fiber yet, and an initial sweep handles the reverse composition order (an official row that activated before this row started). Only seams the loader already publishes are used: the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer.
+- **User-visible behavior.** Enabling the bundle: titles now update with every prompt **and** the configured naming model / provider-group route keeps applying (the provider id recorded with each title is `session-title-all-prompts-llm`, matching what the official row would record). Disabling the bundle: the first-prompt cadence comes back with the same route override. A Host that changes activation timing degrades to "the official provider serves naming, one explicit log line" rather than a crash or a wrong route.
+- **Verification.** `pnpm run check` green (53 test files / 466 tests + pack gate). New coverage: the all-prompts row wins the mirror, the takeover yields before the official registration and reclaims the slot with the mirrored cadence, repeat patch-context events are idempotent, an already-active row is swept, and no official row keeps today's single first-prompt registration. Real published packages on `0.2.1-rc.2` (the real `dsh-session-title` service plus the real `dsh-session-title-all-prompts-llm` apply): the official row registers with **no** `already registered` error, the displaced row is disabled through `Entry.update`, the plugin owns the slot again, and the live provider is `session-title-all-prompts-llm` / `all-prompts`.
+- **Residual (honest).** The takeover choreographs released loader seams rather than a dedicated "supersede this provider" API; `docs/seam-gap.md` records the missing seam and the upstream proposal (a decorate/replace registration or a multi-provider slot). The reverse direction — disabling the bundle at runtime without a profile restart — re-claims through `loader/partial-dispose` where the loader emits it, and otherwise needs the restart DSH already asks for on bundle changes.
+
 ## v0.4.28
 
 Two fixes for the same DSH `0.2.1-rc.2` line: re-enabling the plugin on 0.2.1 made **every tool call fail before its body ran**, and the Subagent routing adapter that 0.4.26 had to fail closed is adapted to the release's activation API.

package/PRODUCT.md

@@ -33,4 +33,4 @@ Official `settings.section` has no icon field. The Settings nav glyph is a label
 
 ## Delivery architecture
 
-The package foundation and pure deep modules remain the policy/test surface. Runtime delivery disables the independent Subagent Loader row with its official name and inserts a uniquely identified replacement; the experimental auto-review row is disabled the same way and replaced by `dsh-model-switch/auto-review`, which mounts the official gate's `apply` unchanged as a plugin under a scoped `llm` shadow — the Host resolves the gate's own `inject` list (including 0.2.1's `workingDirectory`), one `registerAuto` runs, and only when the profile started with the optional auto-review bundle. Official AgentPresets stay mounted so they share the process `dsh-scope` identity. Search uses the released `ctx.web.registerSearchProvider()` seam so official tool ownership is preserved. Image uses a unique tool name and provider-owned authenticated adapters. Self-maintained Codex/Grok plugins register optional adapters through the public Model Switch service when present; standalone provider behavior is unchanged. Vision remains disabled. Replacement modules preserve the official public interfaces and fail closed when compatibility or capability validation fails.
+The package foundation and pure deep modules remain the policy/test surface. Runtime delivery disables the independent Subagent Loader row with its official name and inserts a uniquely identified replacement; the experimental auto-review row is disabled the same way and replaced by `dsh-model-switch/auto-review`, which mounts the official gate's `apply` unchanged as a plugin under a scoped `llm` shadow — the Host resolves the gate's own `inject` list (including 0.2.1's `workingDirectory`), one `registerAuto` runs, and only when the profile started with the optional auto-review bundle. Session naming replaces the official `session-title-llm` row and owns the service's single provider slot; it mirrors the official cadence the profile declares — first-prompt by default, and the all-prompts cadence whenever the experimental session-titles bundle inserts its row — so enabling that bundle keeps both the per-prompt title refresh and this plugin's configurable naming route, while disabling it restores the first-prompt cadence. The takeover only uses released loader seams (the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer) and degrades to the official provider with one explicit log line if a future Host changes activation timing. Official AgentPresets stay mounted so they share the process `dsh-scope` identity. Search uses the released `ctx.web.registerSearchProvider()` seam so official tool ownership is preserved. Image uses a unique tool name and provider-owned authenticated adapters. Self-maintained Codex/Grok plugins register optional adapters through the public Model Switch service when present; standalone provider behavior is unchanged. Vision remains disabled. Replacement modules preserve the official public interfaces and fail closed when compatibility or capability validation fails.

package/README.md

@@ -121,6 +121,11 @@ DSH names new sessions automatically; the profile's official naming row decides
 
 The route is read through on every naming request: a saved change applies to the very next title with no restart, and a naming request already in flight is never interrupted by a save. Each request resolves its route in order — the session's provider group's naming pair, then the card's flat pair, then the session's own model. The request runs through the official naming implementation, which records the exact provider/model in the session's own `session/title-llm-request` event, so the durable record and the real request always agree. The plugin replaces the official `session-title-llm` row instead of forking the naming logic (the seam allows one registered naming provider per context) and mirrors the cadence that row declared; a profile with no official naming row keeps DSH's deterministic fallback title.
 
+Since 0.4.29 the row also coexists with the experimental "titles that update with the conversation" bundle (`dsh-experimental-session-titles-bundle`, which inserts an all-prompts naming row): enabling that bundle keeps this plugin owning the single naming-provider slot, mirrors the all-prompts cadence so titles refresh with every prompt, and keeps the naming-model and provider-group routes in force (the provider id recorded per title is `session-title-all-prompts-llm`, exactly what the official row would record). Disabling the bundle restores the first-prompt cadence with the same route override. The takeover only uses released loader seams — the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer — letting the official row register successfully first and then disabling it, so enabling the bundle no longer raises the `already registered` activation-failure toast.
+
+Since 0.4.30 the Auto review row also survives a degraded permission service. DSH's Auto gate reads `permissionPresets.current(session)` before every tool call, and when that service has gone inactive the read throws `cannot get required service "sessionProjections" in inactive context` outside the gate's own reviewer-error handling — so every tool call died before its body ran. The row now shadows that service inside its review scope: a failed probe reports "not on Auto", the tool call runs normally, and one log line states that review was skipped. A gate re-mounted after a profile reload unloads its previous registration first, so the `auto` preset cannot disappear from the permission picker.
+
+
 ## Provider groups
 
 The "Provider groups" card stores one route group per provider — the compaction, auto-review, session-naming, and subagent routes saved together — and a group saved for provider X applies to the sessions whose own provider is X. Groups are **derived, not written**: switching a session's provider writes nothing, so two sessions on different providers can never overwrite or redirect each other's auxiliary routes.

package/README.zh.md

@@ -119,6 +119,11 @@ DSH 会自动为新会话起名；命名的触发节奏由 profile 的官方命
 
 路由在**每次命名请求时现读**：保存后对下一次起名立即生效、无需重启，且进行中的命名请求不会被保存打断。每次请求按顺序解析路由：该会话供应商组里的命名对，其次卡片的部署级对，其次会话自身的模型。请求经由官方命名实现发出，它会把实际使用的 provider/model 记录到该会话自己的 `session/title-llm-request` 事件里，因此持久记录与真实请求永远一致。本插件替换官方的 `session-title-llm` 行而不分叉命名逻辑（该接缝每个上下文只允许注册一个命名 provider），并镜像该行声明的节奏；profile 没有官方命名行时保持 DSH 的确定性兜底标题。
 
+0.4.29 起与实验包「随对话更新的标题」（`dsh-experimental-session-titles-bundle`，插入 all-prompts 命名行）兼容：启用该实验包时，本插件接管同一个命名 provider 槽位并镜像 all-prompts 节奏，标题随对话更新，同时命名模型路由与供应商组路由继续生效（`session/title` 记录中的 provider id 为 `session-title-all-prompts-llm`，与官方行一致）；禁用实验包即回到首条提示节奏与同样的路由覆写。实现只使用 loader 已发布的缝（`loader/patch-context` 瀑布、`Entry.update`、`sessionTitle.register` 及其 disposer），让官方行先成功注册、再被停用并由本行重占槽位，因此启用时不再出现 `already registered` 激活失败弹窗。
+
+0.4.30 起 Auto 审查行还能在许可服务降级时保住工具调用：DSH 的 Auto gate 在每次工具调用前读取 `permissionPresets.current(session)`，一旦该服务失活，这次读取会在 gate 自己的审查错误包装之外抛出 `cannot get required service "sessionProjections" in inactive context`，导致每个工具调用都在执行前失败。本行现在在审查作用域内遮蔽该服务：探测失败即按「不在 Auto」处理，工具调用照常执行，并只记一行日志说明审查被跳过。配置重载后重新挂载的 gate 会先卸载上一个注册，因此 `auto` 预设不会再从许可选择器里消失。
+
+
 ## 供应商配置组（Provider groups）
 
 「供应商配置组」卡片为每个供应商保存一组路由——压缩、自动审查、会话命名与子代理四条路由一起存；为供应商 X 保存的组，作用于自身供应商就是 X 的会话。组是**推导出来的，而不是写进去的**：切换某个会话的供应商不写任何东西，因此不同供应商上的多个会话并行时再也不会互相覆盖、互相改写对方的辅助路由。

package/lib/auto-review.js

@@ -123,10 +123,77 @@ function bindAutoReviewSessionCorrelation(scope, activeSession) {
 * Build the scoped context the official gate runs under.
 * @param ctx - host context whose modelSwitch settings pin the reviewer route.
 * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
-* @returns A child context shadowing only the llm service.
+* @returns A child context shadowing the llm service and, when the permission
+* preset service is reachable, that service too.
 */
 function reviewScope(ctx, activeSession = new AsyncLocalStorage()) {
-	return ctx.extend({ llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())) });
+	const permissionPresets = permissionPresetsOf(ctx);
+	const shadows = { llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())) };
+	if (permissionPresets !== void 0) shadows.permissionPresets = defensivePermissionPresets(permissionPresets, ctx.logger);
+	return ctx.extend(shadows);
+}
+/** The preset name the service reports when no configured preset matches. */
+const CUSTOM_PRESET = "custom";
+/** Read the live permission-preset service without requiring an injection. */
+function permissionPresetsOf(ctx) {
+	try {
+		const face = ctx.get("permissionPresets", false);
+		return face !== null && typeof face === "object" ? face : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Wrap the permission-preset service so the official gate's per-call probe can
+* never fail a tool call.
+*
+* DSH's Auto gate starts every `tools/pre-execute` with
+* `permissionPresets.current(session)`, and that method resolves the presets
+* service's own `sessionProjections` injection. When the presets fiber has
+* turned inactive the probe throws `cannot get required service
+* "sessionProjections" in inactive context` outside the gate's reviewer error
+* wrapper, so every tool call dies. This wrapper degrades the probe to
+* `custom` (the gate then skips review and calls `next()`), reports the lost
+* capability once, and keeps the tool backend alive; the registration and
+* teardown paths degrade the same way instead of throwing.
+*
+* @param real - the host's permission-preset service.
+* @param log - the row logger used for the single degradation report.
+* @returns A structurally compatible preset face.
+*/
+function defensivePermissionPresets(real, log) {
+	let reported = false;
+	const degrade = (operation, error) => {
+		if (reported) return;
+		reported = true;
+		log.warn(`model-switch: the permission-preset service refused ${operation} (${String(error)}); the Auto reviewer passes tool calls through instead of blocking them`);
+	};
+	return {
+		current(session) {
+			try {
+				return real.current(session);
+			} catch (error) {
+				degrade("current()", error);
+				return CUSTOM_PRESET;
+			}
+		},
+		set(session, preset) {
+			try {
+				return real.set(session, preset);
+			} catch (error) {
+				degrade("set()", error);
+				return;
+			}
+		},
+		registerAuto(admit) {
+			try {
+				return real.registerAuto(admit);
+			} catch (error) {
+				log.warn(`model-switch: the Auto preset integration was not registered (${String(error)}); review keeps the existing integration`);
+				return () => Promise.resolve();
+			}
+		}
+	};
 }
 /** Structural read of launcher-provided profile facts (the app-boot seam). */
 function autoReviewBundleActive(ctx) {
@@ -170,6 +237,16 @@ function autoReviewGate(gate, hooks = {}) {
 	};
 }
 /**
+* The gate fiber mounted by the current row instance.
+*
+* `registerAuto` is a single live registration owned by the gate's effect
+* lifetime, and its disposer is what clears the Auto preset. A re-applied row
+* must await the previous gate's unloading before the next registration runs,
+* otherwise the new `registerAuto` throws `already registered` and its effect
+* cleanup leaves the catalog without Auto.
+*/
+let lastGateFiber;
+/**
 * Mount the official gate under the reviewer-route scope.
 *
 * A profile that never enabled the optional bundle keeps no Auto preset and no
@@ -189,6 +266,14 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
+	const previous = lastGateFiber;
+	lastGateFiber = void 0;
+	if (previous !== void 0) try {
+		await previous.dispose();
+	} catch (cause) {
+		ctx.logger.info("model-switch: the previous auto-review gate had already unloaded; continuing with the new one");
+		ctx.logger.info(String(cause));
+	}
 	const activeSession = new AsyncLocalStorage();
 	const scope = reviewScope(ctx, activeSession);
 	let failure;
@@ -215,7 +300,8 @@ async function apply(ctx) {
 		ctx.logger.info("model-switch: the official auto-review gate is waiting for its host services; the reviewer route override is not bound yet");
 		return;
 	}
+	lastGateFiber = fiber;
 	bindAutoReviewSessionCorrelation(scope, activeSession);
 }
 //#endregion
-export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };
+export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/client.js

@@ -87,109 +87,6 @@ window.__ModuleLoader__.load({
 			return route !== void 0 && (route.provider ?? "").trim() !== "" && (route.model ?? "").trim() !== "";
 		}
 		//#endregion
-		//#region src/provider-group.ts
-		const ROUTE_FIELDS = Object.freeze([
-			"compactProvider",
-			"compactModel",
-			"autoReviewProvider",
-			"autoReviewModel",
-			"subagentProvider",
-			"subagentModel",
-			"subagentReasoningEffort",
-			"titleProvider",
-			"titleModel"
-		]);
-		/** Own data property, so a literal '__proto__' provider id can never touch a prototype. */
-		function setKey(target, key, value) {
-			Object.defineProperty(target, key, {
-				value,
-				enumerable: true,
-				writable: true,
-				configurable: true
-			});
-		}
-		/** A non-blank string. Blank values behave exactly like an absent field. */
-		function present(value) {
-			return typeof value === "string" && value.trim() !== "";
-		}
-		/** Normalize one raw entry to its owning provider and route view; undefined for non-object junk. */
-		function normalizeEntry(value) {
-			if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
-			const source = value;
-			const group = {};
-			for (const field of ROUTE_FIELDS) {
-				const item = source[field];
-				if (present(item)) group[field] = item;
-			}
-			return {
-				provider: present(source.provider) ? source.provider : "",
-				group
-			};
-		}
-		/**
-		* Strip a raw stored value to well-formed groups; never throws. Both storage
-		* shapes are accepted: the stored entry array (keys live in each entry's
-		* `provider` field) and a hand-written provider → routes map (keys are the
-		* providers). All-empty entries stay: they pin a provider to every default.
-		*/
-		function normalizeProviderGroups(raw) {
-			const groups = {};
-			if (Array.isArray(raw)) {
-				for (const entry of raw) {
-					const view = normalizeEntry(entry);
-					if (view === void 0 || view.provider === "") continue;
-					setKey(groups, view.provider, view.group);
-				}
-				return groups;
-			}
-			if (raw !== null && typeof raw === "object") for (const [key, value] of Object.entries(raw)) {
-				if (key.trim() === "") continue;
-				const view = normalizeEntry(value);
-				if (view === void 0) continue;
-				setKey(groups, key, view.group);
-			}
-			return groups;
-		}
-		/**
-		* The saved group for a provider.
-		* @returns the normalized group, or undefined when the provider has no group —
-		* which is what leaves the live routes untouched during a switch.
-		*/
-		function groupOf(groups, provider) {
-			if (groups === void 0 || provider.trim() === "") return void 0;
-			if (!Object.prototype.hasOwnProperty.call(groups, provider)) return void 0;
-			return groups[provider];
-		}
-		/** Storage entry for one provider's group; absent or blank route fields become ''. */
-		function entryOf(provider, group) {
-			return {
-				provider,
-				compactProvider: group.compactProvider ?? "",
-				compactModel: group.compactModel ?? "",
-				autoReviewProvider: group.autoReviewProvider ?? "",
-				autoReviewModel: group.autoReviewModel ?? "",
-				subagentProvider: group.subagentProvider ?? "",
-				subagentModel: group.subagentModel ?? "",
-				subagentReasoningEffort: group.subagentReasoningEffort ?? "",
-				titleProvider: group.titleProvider ?? "",
-				titleModel: group.titleModel ?? ""
-			};
-		}
-		/**
-		* The stored entry list with one provider's group replaced (an entry) or
-		* removed (undefined). Every entry is re-normalized and de-duplicated so a
-		* save can never write junk back; the input is never mutated. A blank
-		* provider only normalizes.
-		*/
-		function withProviderGroup(storage, provider, group) {
-			const groups = { ...normalizeProviderGroups(storage) };
-			if (provider.trim() !== "") {
-				if (group === void 0) delete groups[provider];
-				else setKey(groups, provider, group);
-			}
-			return Object.entries(groups).map(([key, value]) => entryOf(key, value));
-		}
-		//#endregion
 		//#region src/client/derived-config-form.ts
 		function deriveConfigForm(source, project, fields) {
 			let sourceSnapshot;
@@ -348,6 +245,109 @@ window.__ModuleLoader__.load({
 			}));
 		}
 		//#endregion
+		//#region src/provider-group.ts
+		const ROUTE_FIELDS = Object.freeze([
+			"compactProvider",
+			"compactModel",
+			"autoReviewProvider",
+			"autoReviewModel",
+			"subagentProvider",
+			"subagentModel",
+			"subagentReasoningEffort",
+			"titleProvider",
+			"titleModel"
+		]);
+		/** Own data property, so a literal '__proto__' provider id can never touch a prototype. */
+		function setKey(target, key, value) {
+			Object.defineProperty(target, key, {
+				value,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+		}
+		/** A non-blank string. Blank values behave exactly like an absent field. */
+		function present(value) {
+			return typeof value === "string" && value.trim() !== "";
+		}
+		/** Normalize one raw entry to its owning provider and route view; undefined for non-object junk. */
+		function normalizeEntry(value) {
+			if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+			const source = value;
+			const group = {};
+			for (const field of ROUTE_FIELDS) {
+				const item = source[field];
+				if (present(item)) group[field] = item;
+			}
+			return {
+				provider: present(source.provider) ? source.provider : "",
+				group
+			};
+		}
+		/**
+		* Strip a raw stored value to well-formed groups; never throws. Both storage
+		* shapes are accepted: the stored entry array (keys live in each entry's
+		* `provider` field) and a hand-written provider → routes map (keys are the
+		* providers). All-empty entries stay: they pin a provider to every default.
+		*/
+		function normalizeProviderGroups(raw) {
+			const groups = {};
+			if (Array.isArray(raw)) {
+				for (const entry of raw) {
+					const view = normalizeEntry(entry);
+					if (view === void 0 || view.provider === "") continue;
+					setKey(groups, view.provider, view.group);
+				}
+				return groups;
+			}
+			if (raw !== null && typeof raw === "object") for (const [key, value] of Object.entries(raw)) {
+				if (key.trim() === "") continue;
+				const view = normalizeEntry(value);
+				if (view === void 0) continue;
+				setKey(groups, key, view.group);
+			}
+			return groups;
+		}
+		/**
+		* The saved group for a provider.
+		* @returns the normalized group, or undefined when the provider has no group —
+		* which is what leaves the live routes untouched during a switch.
+		*/
+		function groupOf(groups, provider) {
+			if (groups === void 0 || provider.trim() === "") return void 0;
+			if (!Object.prototype.hasOwnProperty.call(groups, provider)) return void 0;
+			return groups[provider];
+		}
+		/** Storage entry for one provider's group; absent or blank route fields become ''. */
+		function entryOf(provider, group) {
+			return {
+				provider,
+				compactProvider: group.compactProvider ?? "",
+				compactModel: group.compactModel ?? "",
+				autoReviewProvider: group.autoReviewProvider ?? "",
+				autoReviewModel: group.autoReviewModel ?? "",
+				subagentProvider: group.subagentProvider ?? "",
+				subagentModel: group.subagentModel ?? "",
+				subagentReasoningEffort: group.subagentReasoningEffort ?? "",
+				titleProvider: group.titleProvider ?? "",
+				titleModel: group.titleModel ?? ""
+			};
+		}
+		/**
+		* The stored entry list with one provider's group replaced (an entry) or
+		* removed (undefined). Every entry is re-normalized and de-duplicated so a
+		* save can never write junk back; the input is never mutated. A blank
+		* provider only normalizes.
+		*/
+		function withProviderGroup(storage, provider, group) {
+			const groups = { ...normalizeProviderGroups(storage) };
+			if (provider.trim() !== "") {
+				if (group === void 0) delete groups[provider];
+				else setKey(groups, provider, group);
+			}
+			return Object.entries(groups).map(([key, value]) => entryOf(key, value));
+		}
+		//#endregion
 		//#region src/client/plugin-rpc.ts
 		function callPluginRpc(rpc, method, endpoint, payload, signal) {
 			return rpc.call("/api", method, {
@@ -1233,9 +1233,10 @@ window.__ModuleLoader__.load({
 					});
 					return true;
 				} catch (error) {
+					const raw = error instanceof Error ? error.message : String(error);
 					setMessage({
 						route,
-						text: error instanceof Error ? error.message : props.t("requestFailed")
+						text: raw === "settings-rejected" ? props.t("saveRejected") : raw
 					});
 					return false;
 				} finally {
@@ -2300,6 +2301,7 @@ window.__ModuleLoader__.load({
 			providerGroupPick: "选择供应商以编辑其配置组。",
 			providerGroupDelete: "删除该组",
 			saveTimeout: "保存超时，请重试",
+			saveRejected: "保存被拒绝，请重试",
 			"reason.central-subagent-routing": "Alpha.4 没有全局子代理启动路由接口。",
 			"reason.packaged-preset-roots": "Alpha.4 不支持插件提供额外 preset root。",
 			"reason.tool-owner-suppression": "Alpha.4 没有工具所有者或来源抑制接口。",
@@ -2357,6 +2359,7 @@ window.__ModuleLoader__.load({
 			providerGroupPick: "Pick a provider to edit its group.",
 			providerGroupDelete: "Delete group",
 			saveTimeout: "The save timed out; try again",
+			saveRejected: "The save was rejected; try again",
 			"reason.central-subagent-routing": "Alpha.4 exposes no global Subagent start-routing seam.",
 			"reason.packaged-preset-roots": "Alpha.4 exposes no plugin-owned preset root.",
 			"reason.tool-owner-suppression": "Alpha.4 exposes no tool owner or provenance suppression seam.",
@@ -4722,6 +4725,40 @@ window.__ModuleLoader__.load({
 				}, PlanReviewCard));
 			});
 		}
+		/**
+		* Save one provider group through the revision fence, retrying a refusal.
+		*
+		* Every attempt re-reads the form snapshot: another card, another window, or
+		* the runtime's own capture write can move the fence between the read and the
+		* write, and a refused write must cost one retry instead of a lost save. The
+		* whole update therefore lands as one atomic `set`/`unset` op under the
+		* revision that was actually read.
+		* @param form - the settings form the provider groups live in.
+		* @param provider - provider key whose group is being edited.
+		* @param group - replacement group, or undefined to drop the provider's group.
+		* @returns nothing; rejects with `settings-rejected` after every attempt is refused.
+		*/
+		async function saveProviderGroupFenced(form, provider, group) {
+			for (let attempt = 0; attempt < 3; attempt += 1) {
+				const snapshot = form.getSnapshot();
+				const current = snapshot.value?.providerGroups;
+				const next = withProviderGroup(current, provider, group);
+				if (next.length === 0) {
+					if (current === void 0) return;
+					if (await form.mutate([{
+						op: "unset",
+						path: ["providerGroups"]
+					}], snapshot.revision)) return;
+					continue;
+				}
+				if (await form.mutate([{
+					op: "set",
+					path: ["providerGroups"],
+					value: next
+				}], snapshot.revision)) return;
+			}
+			throw new Error("settings-rejected");
+		}
 		//#endregion
 		//#region src/client/nav-icon.ts
 		/** Official settings.section has no icon field. Swap the default gear for a model-switch glyph. */
@@ -4853,14 +4890,7 @@ window.__ModuleLoader__.load({
 						return (route === "search" ? search : route === "image" ? image : route === "compaction" ? compaction : route === "title" ? sessionTitle : autoReview).mutate(ops);
 					},
 					saveProviderGroup: async (provider, group) => {
-						const current = owned.getSnapshot().value?.providerGroups;
-						const next = withProviderGroup(current, provider, group);
-						if (next.length === 0) {
-							if (current === void 0) return;
-							if (!await owned.unset("providerGroups")) throw new Error("settings-rejected");
-							return;
-						}
-						if (!await owned.set("providerGroups", next)) throw new Error("settings-rejected");
+						await saveProviderGroupFenced(owned, provider, group);
 					},
 					providerRoleOf,
 					loadCatalog: async () => {

package/lib/session-title.js

@@ -148,19 +148,32 @@ function selectTitleMessages(messages, firstPromptOnly) {
 	if (first === void 0) throw new Error("first-prompt title provider requires one human message");
 	return [first];
 }
+/** The id the experimental session-titles bundle inserts for all-prompts naming. */
+const ALL_PROMPTS_ROW = "optional-session-title-all-prompts";
 /**
 * Locate the official session-title provider row in the loader tree.
+*
 * Disabled entries stay in the tree, so a name-matched disable still matches.
+* The all-prompts row wins when it is present: that row only exists while the
+* experimental session-titles bundle is composed, and its presence is exactly
+* the user's choice to update titles with every prompt. The default
+* first-prompt row is the fallback when that bundle is off.
 * @param loader - the host loader, when one is reachable.
-* @returns The official entry, or undefined when this profile has no such row.
+* @returns The official entry to mirror, or undefined when this profile has no such row.
 */
 function officialTitleEntry(loader) {
 	if (!loader) return void 0;
+	const allPrompts = TITLE_CADENCES[1];
+	const firstPrompt = TITLE_CADENCES[0];
+	let fallback;
 	for (const entry of loader.entries()) {
-		if (entry.id === OFFICIAL_TITLE_ROW) return entry;
+		if (entry.id === ALL_PROMPTS_ROW) return entry;
 		const pkg = entry.options?.name;
-		if (typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg)) return entry;
+		if (typeof pkg === "string" && allPrompts !== void 0 && pkg === allPrompts.pkg) return entry;
+		if (fallback === void 0 && entry.id === OFFICIAL_TITLE_ROW) fallback = entry;
+		else if (fallback === void 0 && firstPrompt !== void 0 && pkg === firstPrompt.pkg) fallback = entry;
 	}
+	return fallback;
 }
 /**
 * Copy the official row's stored config, ignoring non-object payloads.
@@ -517,6 +530,225 @@ function currentSettings(ctx) {
 		return;
 	}
 }
+/** Resolve the naming plan for one official row, or the shipped defaults when no row exists. */
+function planFor(ctx, module, entry) {
+	const cadence = titleCadence(entry === void 0 ? void 0 : officialTitlePackage(entry)) ?? TITLE_CADENCES[0];
+	if (cadence === void 0) return void 0;
+	const forwarded = entry === void 0 ? {} : forwardedConfig(entry);
+	let policy;
+	try {
+		policy = resolveNamingPolicy(module, forwarded);
+	} catch (cause) {
+		ctx.logger.error("model-switch: the official session-title row has no valid naming policy; naming keeps the deterministic fallback");
+		ctx.logger.error(cause);
+		return;
+	}
+	return {
+		cadence,
+		config: policy.config,
+		targets: policy.targets
+	};
+}
+/** One naming plan bound to a live route resolver. */
+function providerOf(ctx, module, plan) {
+	return {
+		id: plan.cadence.id,
+		automatic: plan.cadence.automatic,
+		generate: (request) => generateTitle(ctx, module, plan, request)
+	};
+}
+/** Timing knobs for the takeover choreography (exported for tests). */
+const TAKEOVER_RETRY_DELAY_MS = 10;
+/** How many times the takeover re-checks after disabling the official row. */
+const TAKEOVER_MAX_ATTEMPTS = 20;
+/**
+* The single naming-provider slot this row serves.
+*
+* DSH's session-title service accepts exactly one registered provider, and the
+* official rows (`session-title-llm`, and the experimental row the
+* `dsh-experimental-session-titles-bundle` inserts) compete for the same slot.
+* This row therefore mirrors one official row and owns the slot; when another
+* official row activates anyway (the experimental bundle inserts its row after
+* this plugin's patch layer, so a static `disabled` cannot reach it), it yields
+* the slot so that row's own registration succeeds — no activation warning —
+* and then disables that row and takes the slot back with its cadence mirrored.
+* Every step uses released seams: the `loader/patch-context` waterfall, the
+* public `Entry.update`, and `sessionTitle.register` plus its disposer.
+*/
+var NamingSeam = class {
+	ctx;
+	module;
+	disposer;
+	plan;
+	constructor(ctx, module, plan) {
+		this.ctx = ctx;
+		this.module = module;
+		this.plan = plan;
+	}
+	/** The cadence currently registered. */
+	get cadence() {
+		return this.plan.cadence;
+	}
+	/** Whether this row currently owns the slot. */
+	get claimed() {
+		return this.disposer !== void 0;
+	}
+	/**
+	* Register this row's provider with the given plan.
+	* @param plan - the naming plan to serve (defaults to the current one).
+	* @returns true when the slot is ours, false when another provider holds it.
+	*/
+	claim(plan = this.plan) {
+		this.plan = plan;
+		if (this.disposer !== void 0) return true;
+		try {
+			this.disposer = this.ctx.sessionTitle.register(providerOf(this.ctx, this.module, plan));
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/** Release the slot (the service lets the next registration replace a closing one). */
+	yieldSlot() {
+		const disposer = this.disposer;
+		this.disposer = void 0;
+		if (disposer === void 0) return;
+		try {
+			disposer();
+		} catch (cause) {
+			this.ctx.logger.error("model-switch: releasing the session-title provider failed");
+			this.ctx.logger.error(cause);
+		}
+	}
+	/** Swap the served plan, re-registering only when the slot is already ours. */
+	retarget(plan) {
+		if (!this.claimed) {
+			this.plan = plan;
+			return;
+		}
+		this.yieldSlot();
+		this.claim(plan);
+	}
+};
+/**
+* Whether one loader entry declares an official naming provider this row supersedes.
+*
+* The package name is the authoritative identity: the takeover disables the
+* matched entry, which disposes its fiber, so an id-only match could reach a
+* group or an unrelated plugin's row with a recycled id.
+*/
+function isOfficialTitleRow(entry) {
+	if (entry === void 0) return false;
+	const pkg = entry.options?.name;
+	return typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg);
+}
+/** The id one entry is known by (the loader's leaf id, not a nested path). */
+function leafId(entry) {
+	const raw = entry.options?.id;
+	return typeof raw === "string" ? raw : void 0;
+}
+/**
+* Install the takeover choreography for naming rows that activate after this one.
+*
+* `loader/patch-context` runs inside the official entry's own `_init`, before its
+* plugin's `apply`, and it receives that entry. At that point the entry's
+* `options` are final, so this row can yield the slot first — the official
+* `register()` then succeeds instead of throwing the "already registered"
+* activation warning — and afterwards disable that row through the public
+* `Entry.update` and take the slot back with its cadence mirrored.
+* @param ctx - this row's context.
+* @param module - the auxiliary-LLM package.
+* @param seam - the slot owner.
+* @returns Nothing; the listeners are effects of this row's fiber.
+*/
+function installTakeover(ctx, module, seam) {
+	/** Entries already handled, so a repeated patch-context does not loop. */
+	const handled = /* @__PURE__ */ new Set();
+	/** Entries with a reclaim cycle in flight, so two triggers cannot race. */
+	const reclaiming = /* @__PURE__ */ new Set();
+	/** After the yield, disable the official row and take the slot back. */
+	const reclaim = async (entry, plan) => {
+		const pkg = entry.options?.name;
+		if (!(typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg))) {
+			ctx.logger.info(`model-switch: skipped a naming-row candidate without an official cadence package (${String(leafId(entry) ?? "unknown")})`);
+			return;
+		}
+		if (reclaiming.has(entry)) return;
+		reclaiming.add(entry);
+		try {
+			for (let attempt = 0; attempt < 20; attempt += 1) {
+				await new Promise((resolve) => setTimeout(resolve, attempt === 0 ? 0 : 10));
+				try {
+					await entry.update({ disabled: true });
+					ctx.logger.info(`model-switch: disabled the official naming row ${String(leafId(entry) ?? "unknown")} (${pkg}) so the naming provider slot stays configurable`);
+				} catch (cause) {
+					ctx.logger.info("model-switch: the displaced naming row could not be persisted as disabled; the takeover repeats next startup");
+					ctx.logger.info(String(cause));
+				}
+				if (seam.claim(plan)) {
+					ctx.logger.info(`model-switch: displaced the official naming row ${String(leafId(entry) ?? "unknown")}; its ${plan.cadence.automatic} cadence and policy are mirrored by the configurable naming route`);
+					return;
+				}
+			}
+			ctx.logger.error(`model-switch: the official naming row ${String(leafId(entry) ?? "unknown")} kept the session-title provider slot; the configurable naming route is unavailable this session`);
+		} finally {
+			reclaiming.delete(entry);
+		}
+	};
+	/**
+	* The row an event names.
+	*
+	* The loader hands the emitting entry as the event's `this`, but cordis does
+	* not rebind `this` for listeners added through `ctx.on`, so a listener can
+	* also receive the payload as its first argument. Both shapes are accepted;
+	* the real Host always provides one of them.
+	*/
+	const entryOfEvent = (self, first) => {
+		const candidate = self ?? first;
+		return candidate !== null && typeof candidate === "object" && "options" in candidate ? candidate : void 0;
+	};
+	const listeners = [];
+	const listen = (event, listener) => {
+		const dispose = ctx.on?.(event, listener);
+		if (dispose !== void 0) listeners.push(dispose);
+	};
+	listen("loader/patch-context", function(first, second) {
+		const nextFn = typeof first === "function" ? first : second;
+		const entry = entryOfEvent(this, typeof first === "function" ? void 0 : first);
+		if (entry === void 0 || typeof nextFn !== "function" || !isOfficialTitleRow(entry) || handled.has(entry)) return nextFn === void 0 ? void 0 : nextFn();
+		handled.add(entry);
+		const plan = planFor(ctx, module, entry);
+		if (plan !== void 0) {
+			seam.yieldSlot();
+			reclaim(entry, plan);
+		}
+		return nextFn();
+	});
+	listen("loader/partial-dispose", function(first) {
+		const entry = entryOfEvent(this, first);
+		if (entry === void 0 || !isOfficialTitleRow(entry)) return;
+		handled.delete(entry);
+		if (seam.claimed) return;
+		const plan = planFor(ctx, module, officialTitleEntry(ctx.get("loader", false)));
+		if (plan !== void 0) seam.claim(plan);
+	});
+	const loader = ctx.get("loader", false);
+	if (typeof loader?.entries === "function") for (const candidate of loader.entries()) {
+		if (!isOfficialTitleRow(candidate)) continue;
+		if (candidate.disabled === true) continue;
+		const plan = planFor(ctx, module, candidate);
+		if (plan !== void 0) reclaim(candidate, plan);
+	}
+	const disposable = () => {
+		for (const dispose of listeners.splice(0)) dispose();
+	};
+	const effect = ctx.effect;
+	if (effect === void 0) return;
+	const registration = effect(function* () {
+		yield disposable;
+	}, "model-switch: session-title takeover");
+	if (typeof registration === "function") listeners.push(registration);
+}
 /**
 * Mount the Model Switch session-naming row for this profile.
 *
@@ -529,11 +761,7 @@ function currentSettings(ctx) {
 */
 async function apply(ctx) {
 	const entry = officialTitleEntry(ctx.get("loader", false));
-	const cadence = titleCadence(entry === void 0 ? void 0 : officialTitlePackage(entry)) ?? TITLE_CADENCES[0];
-	if (cadence === void 0) return;
 	if (entry === void 0) ctx.logger.info("model-switch: no instantiated official session-title row to mirror; naming uses the first-prompt cadence");
-	/** The displaced row's naming policy, or the shipped defaults when it is absent. */
-	const forwarded = entry === void 0 ? {} : forwardedConfig(entry);
 	let module;
 	try {
 		module = await import(__rewriteRelativeImportExtension(TITLE_LLM_PACKAGE));
@@ -542,29 +770,11 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
-	let policy;
-	try {
-		policy = resolveNamingPolicy(module, forwarded);
-	} catch (cause) {
-		ctx.logger.error("model-switch: the official session-title row has no valid naming policy; naming keeps the deterministic fallback");
-		ctx.logger.error(cause);
-		return;
-	}
-	const plan = {
-		cadence,
-		config: policy.config,
-		targets: policy.targets
-	};
-	try {
-		ctx.sessionTitle.register({
-			id: cadence.id,
-			automatic: cadence.automatic,
-			generate: (request) => generateTitle(ctx, module, plan, request)
-		});
-	} catch (cause) {
-		ctx.logger.error("model-switch: another session-title provider is already registered; the configurable naming route is unavailable");
-		ctx.logger.error(cause);
-	}
+	const plan = planFor(ctx, module, entry);
+	if (plan === void 0) return;
+	const seam = new NamingSeam(ctx, module, plan);
+	if (!seam.claim()) ctx.logger.info("model-switch: another session-title provider already owns the seam; naming follows it while it is active");
+	installTakeover(ctx, module, seam);
 }
 //#endregion
-export { TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, frameTitleInput, inject, isMaxTokensFailure, isModernTitleModule, name, normalizeTitleText, officialTitleEntry, officialTitlePackage, resolveNamingPolicy, selectTitleMessages, selectTitleReasoningEffort, shouldTryNextCandidate, splitTitlePolicy, titleCadence, titleFromOutput, titleFromResponse, titleRouteCandidates, titleSystemPrompt, widerTitleBudget };
+export { TAKEOVER_MAX_ATTEMPTS, TAKEOVER_RETRY_DELAY_MS, TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, frameTitleInput, inject, isMaxTokensFailure, isModernTitleModule, isOfficialTitleRow, name, normalizeTitleText, officialTitleEntry, officialTitlePackage, resolveNamingPolicy, selectTitleMessages, selectTitleReasoningEffort, shouldTryNextCandidate, splitTitlePolicy, titleCadence, titleFromOutput, titleFromResponse, titleRouteCandidates, titleSystemPrompt, widerTitleBudget };

package/lib/types/auto-review.d.ts

@@ -100,9 +100,37 @@ export declare function bindAutoReviewSessionCorrelation(scope: Context, activeS
  * Build the scoped context the official gate runs under.
  * @param ctx - host context whose modelSwitch settings pin the reviewer route.
  * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
- * @returns A child context shadowing only the llm service.
+ * @returns A child context shadowing the llm service and, when the permission
+ * preset service is reachable, that service too.
  */
 export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>): Context;
+/** The permission-preset face the official gate reads; structural so a missing package never breaks a build. */
+export interface PermissionPresetsFace {
+    current(session: Session): string;
+    set(session: Session, preset: string): unknown;
+    registerAuto(admit: () => void): unknown;
+}
+/**
+ * Wrap the permission-preset service so the official gate's per-call probe can
+ * never fail a tool call.
+ *
+ * DSH's Auto gate starts every `tools/pre-execute` with
+ * `permissionPresets.current(session)`, and that method resolves the presets
+ * service's own `sessionProjections` injection. When the presets fiber has
+ * turned inactive the probe throws `cannot get required service
+ * "sessionProjections" in inactive context` outside the gate's reviewer error
+ * wrapper, so every tool call dies. This wrapper degrades the probe to
+ * `custom` (the gate then skips review and calls `next()`), reports the lost
+ * capability once, and keeps the tool backend alive; the registration and
+ * teardown paths degrade the same way instead of throwing.
+ *
+ * @param real - the host's permission-preset service.
+ * @param log - the row logger used for the single degradation report.
+ * @returns A structurally compatible preset face.
+ */
+export declare function defensivePermissionPresets(real: PermissionPresetsFace, log: {
+    warn(line: string): void;
+}): PermissionPresetsFace;
 /**
  * Structural view of the official gate's plugin face.
  *

package/lib/types/client/locales.d.ts

@@ -48,6 +48,7 @@ export declare const zh: {
     readonly providerGroupPick: "选择供应商以编辑其配置组。";
     readonly providerGroupDelete: "删除该组";
     readonly saveTimeout: "保存超时，请重试";
+    readonly saveRejected: "保存被拒绝，请重试";
     readonly 'reason.central-subagent-routing': "Alpha.4 没有全局子代理启动路由接口。";
     readonly 'reason.packaged-preset-roots': "Alpha.4 不支持插件提供额外 preset root。";
     readonly 'reason.tool-owner-suppression': "Alpha.4 没有工具所有者或来源抑制接口。";

package/lib/types/client/provider-group-save.d.ts

@@ -0,0 +1,28 @@
+import type { SettingsPathOpView } from '@deepseek-ai/dsh-api-remotes/client';
+import { type ProviderGroupConfig } from '../provider-group.js';
+/** The revision-fenced settings form one provider-group save writes through. */
+export interface ProviderGroupForm {
+    getSnapshot(): {
+        readonly revision: number | undefined;
+        readonly value: {
+            readonly providerGroups?: readonly ProviderGroupConfig[];
+        } | undefined;
+    };
+    mutate(ops: readonly SettingsPathOpView[], expectedRevision?: number): Promise<boolean>;
+}
+/** How many times one save re-reads and retries after a refused write. */
+export declare const PROVIDER_GROUP_SAVE_ATTEMPTS = 3;
+/**
+ * Save one provider group through the revision fence, retrying a refusal.
+ *
+ * Every attempt re-reads the form snapshot: another card, another window, or
+ * the runtime's own capture write can move the fence between the read and the
+ * write, and a refused write must cost one retry instead of a lost save. The
+ * whole update therefore lands as one atomic `set`/`unset` op under the
+ * revision that was actually read.
+ * @param form - the settings form the provider groups live in.
+ * @param provider - provider key whose group is being edited.
+ * @param group - replacement group, or undefined to drop the provider's group.
+ * @returns nothing; rejects with `settings-rejected` after every attempt is refused.
+ */
+export declare function saveProviderGroupFenced(form: ProviderGroupForm, provider: string, group: ProviderGroupConfig | undefined): Promise<void>;

package/lib/types/session-title.d.ts

@@ -138,9 +138,14 @@ export declare function composeTitleRoute(config: TitleLlmPolicy, route: Capabil
 export declare function selectTitleMessages(messages: readonly SessionTitleUserMessage[], firstPromptOnly: boolean): readonly SessionTitleUserMessage[];
 /**
  * Locate the official session-title provider row in the loader tree.
+ *
  * Disabled entries stay in the tree, so a name-matched disable still matches.
+ * The all-prompts row wins when it is present: that row only exists while the
+ * experimental session-titles bundle is composed, and its presence is exactly
+ * the user's choice to update titles with every prompt. The default
+ * first-prompt row is the fallback when that bundle is off.
  * @param loader - the host loader, when one is reachable.
- * @returns The official entry, or undefined when this profile has no such row.
+ * @returns The official entry to mirror, or undefined when this profile has no such row.
  */
 export declare function officialTitleEntry(loader: Loader | undefined): Entry | undefined;
 /**
@@ -270,6 +275,18 @@ export declare function titleSystemPrompt(targets: TitleLengthTargets, hasCurren
  * @returns The framed user input.
  */
 export declare function frameTitleInput(messages: readonly SessionTitleUserMessage[], currentTitle: string | undefined): string;
+/** Timing knobs for the takeover choreography (exported for tests). */
+export declare const TAKEOVER_RETRY_DELAY_MS = 10;
+/** How many times the takeover re-checks after disabling the official row. */
+export declare const TAKEOVER_MAX_ATTEMPTS = 20;
+/**
+ * Whether one loader entry declares an official naming provider this row supersedes.
+ *
+ * The package name is the authoritative identity: the takeover disables the
+ * matched entry, which disposes its fiber, so an id-only match could reach a
+ * group or an unrelated plugin's row with a recycled id.
+ */
+export declare function isOfficialTitleRow(entry: Entry | undefined): boolean;
 /**
  * Mount the Model Switch session-naming row for this profile.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.28",
+  "version": "0.4.30",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",