dsh-model-switch 0.4.29 → 0.4.30

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## v0.4.30
+
+One live failure class, three fixes: after a provider-group save every tool call in the session died before its body ran with `cannot get required service "sessionProjections" in inactive context`, the settings page sometimes answered a provider-group save with the raw `settings-rejected` sentinel, and the composer's permission selector sometimes disappeared.
+
+- **P0: every tool call failed while the Auto preset was selected (`src/auto-review.ts`).** The official `@deepseek-ai/dsh-experimental-auto-review` gate opens every `tools/pre-execute` waterfall with `permissionPresets.current(session)`. That call resolves the preset service's **own** `sessionProjections` injection, and `sessionProjections` is exactly what `permissionState()` reads; when that fiber has turned inactive the probe throws `cannot get required service "sessionProjections" in inactive context` **outside** the gate's reviewer-error wrapper, so the raw service error becomes the tool result and the body never runs. `reviewScope` now shadows `permissionPresets` next to the already-shadowed `llm` (`defensivePermissionPresets`): a failing `current()` degrades to `custom`, which makes the gate skip review and call `next()` so the tool body still runs; a failing `set()` during teardown is swallowed; a `registerAuto` conflict is reported as one log line instead of failing the gate. The degradation is logged once, not once per tool call.
+- **Auto integration lifecycle (`src/auto-review.ts`).** `registerAuto` is single-registration with an **effect lifetime** — its disposer is what clears the Auto preset, and its absence is what makes `auto` disappear from `permissionPresets.names` (and a restore fail with `cannot restore preset "auto" without its active integration`). A re-applied row now disposes the previously mounted gate fiber and awaits it (`Fiber.dispose` settles after cleanup) before mounting the next gate, so a re-mount cannot hit `preset "auto" is already registered` and leave the catalog without Auto.
+- **Takeover hardening (`src/session-title.ts`).** `isOfficialTitleRow` now keys on the cadence **package name** only, and `reclaim` re-checks that package before `entry.update({ disabled: true })`, logging every disable. The takeover disposes the matched entry's fiber, so an id-only match must never reach a group or another plugin's row.
+- **Provider-group saves are fenced and retried (`src/client/provider-group-save.ts`, `src/client/index.tsx`).** A save now lands as one atomic `mutate(ops, revision)` under the revision it actually read. When the host refuses it (another card, another window, or the runtime's own capture write moved the fence), the save re-reads the snapshot and retries — up to three times — instead of losing the edit, and only then reports failure. The settings page shows a localized "保存被拒绝，请重试" instead of the raw `settings-rejected` sentinel.
+- **Permission selector disappearing.** The official selector renders nothing while the permission catalog has no complete value or the session's permission selection is missing; both states came from the same Auto-integration and preset-service instability above, so the lifecycle fix removes the trigger. `docs/seam-gap.md` records this as official-UI behavior this plugin cannot change, plus the single-registration `registerAuto` seam.
+- **Verification.** `pnpm run check` green (54 test files / 478 tests + pack gate). New coverage: the degraded probe returns `custom` and logs once, a healthy face stays transparent, a registration conflict is reported and its disposer resolves, a failing preset write during teardown is swallowed, the takeover refuses an id-only lookalike and never disables it, and the fenced save writes under the read revision, retries after one refusal, reports `settings-rejected` only after every attempt was refused, and clears the field when the last group is deleted. With the **real published packages** (`@deepseek-ai/dsh-experimental-auto-review` + `@deepseek-ai/dsh-permission-presets` from the 0.2.1 line): the pre-fix shape reproduces the exact live message through the gate's prepended listener, and the shipped shape runs the gate with the same broken preset service while the tool call proceeds.
+- **Residual (honest).** The defensive shadow trades a failed reviewer for a running tool: while the preset service is broken, review is skipped with one explicit log line instead of blocking every call. The single-registration constraint still has no public replace API; the missing seam and the proposed upstream shape are recorded in `docs/seam-gap.md`.
+- **A/B caveat.** The live "plugin off → tools fine" observation was confounded: the permission preset was switched from `auto` to `danger-full-access` in the same minute the plugin was disabled. The controlled matrix (plugin on/off × preset auto/full-access × plan mode on/off × fresh session/resumed session) is the confirmation step after installing this release.
+
 ## v0.4.29
 
 The experimental "随对话更新的标题" bundle (`dsh-experimental-session-titles-bundle`) no longer fails to enable while this plugin is active: the naming row now takes over the single provider slot the bundle's row competes for, mirrors that row's cadence, and keeps the configurable naming route working.

package/README.md

@@ -121,6 +121,11 @@ DSH names new sessions automatically; the profile's official naming row decides
 
 The route is read through on every naming request: a saved change applies to the very next title with no restart, and a naming request already in flight is never interrupted by a save. Each request resolves its route in order — the session's provider group's naming pair, then the card's flat pair, then the session's own model. The request runs through the official naming implementation, which records the exact provider/model in the session's own `session/title-llm-request` event, so the durable record and the real request always agree. The plugin replaces the official `session-title-llm` row instead of forking the naming logic (the seam allows one registered naming provider per context) and mirrors the cadence that row declared; a profile with no official naming row keeps DSH's deterministic fallback title.
 
+Since 0.4.29 the row also coexists with the experimental "titles that update with the conversation" bundle (`dsh-experimental-session-titles-bundle`, which inserts an all-prompts naming row): enabling that bundle keeps this plugin owning the single naming-provider slot, mirrors the all-prompts cadence so titles refresh with every prompt, and keeps the naming-model and provider-group routes in force (the provider id recorded per title is `session-title-all-prompts-llm`, exactly what the official row would record). Disabling the bundle restores the first-prompt cadence with the same route override. The takeover only uses released loader seams — the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer — letting the official row register successfully first and then disabling it, so enabling the bundle no longer raises the `already registered` activation-failure toast.
+
+Since 0.4.30 the Auto review row also survives a degraded permission service. DSH's Auto gate reads `permissionPresets.current(session)` before every tool call, and when that service has gone inactive the read throws `cannot get required service "sessionProjections" in inactive context` outside the gate's own reviewer-error handling — so every tool call died before its body ran. The row now shadows that service inside its review scope: a failed probe reports "not on Auto", the tool call runs normally, and one log line states that review was skipped. A gate re-mounted after a profile reload unloads its previous registration first, so the `auto` preset cannot disappear from the permission picker.
+
+
 ## Provider groups
 
 The "Provider groups" card stores one route group per provider — the compaction, auto-review, session-naming, and subagent routes saved together — and a group saved for provider X applies to the sessions whose own provider is X. Groups are **derived, not written**: switching a session's provider writes nothing, so two sessions on different providers can never overwrite or redirect each other's auxiliary routes.

package/README.zh.md

@@ -121,6 +121,9 @@ DSH 会自动为新会话起名；命名的触发节奏由 profile 的官方命
 
 0.4.29 起与实验包「随对话更新的标题」（`dsh-experimental-session-titles-bundle`，插入 all-prompts 命名行）兼容：启用该实验包时，本插件接管同一个命名 provider 槽位并镜像 all-prompts 节奏，标题随对话更新，同时命名模型路由与供应商组路由继续生效（`session/title` 记录中的 provider id 为 `session-title-all-prompts-llm`，与官方行一致）；禁用实验包即回到首条提示节奏与同样的路由覆写。实现只使用 loader 已发布的缝（`loader/patch-context` 瀑布、`Entry.update`、`sessionTitle.register` 及其 disposer），让官方行先成功注册、再被停用并由本行重占槽位，因此启用时不再出现 `already registered` 激活失败弹窗。
 
+0.4.30 起 Auto 审查行还能在许可服务降级时保住工具调用：DSH 的 Auto gate 在每次工具调用前读取 `permissionPresets.current(session)`，一旦该服务失活，这次读取会在 gate 自己的审查错误包装之外抛出 `cannot get required service "sessionProjections" in inactive context`，导致每个工具调用都在执行前失败。本行现在在审查作用域内遮蔽该服务：探测失败即按「不在 Auto」处理，工具调用照常执行，并只记一行日志说明审查被跳过。配置重载后重新挂载的 gate 会先卸载上一个注册，因此 `auto` 预设不会再从许可选择器里消失。
+
+
 ## 供应商配置组（Provider groups）
 
 「供应商配置组」卡片为每个供应商保存一组路由——压缩、自动审查、会话命名与子代理四条路由一起存；为供应商 X 保存的组，作用于自身供应商就是 X 的会话。组是**推导出来的，而不是写进去的**：切换某个会话的供应商不写任何东西，因此不同供应商上的多个会话并行时再也不会互相覆盖、互相改写对方的辅助路由。

package/lib/auto-review.js

@@ -123,10 +123,77 @@ function bindAutoReviewSessionCorrelation(scope, activeSession) {
 * Build the scoped context the official gate runs under.
 * @param ctx - host context whose modelSwitch settings pin the reviewer route.
 * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
-* @returns A child context shadowing only the llm service.
+* @returns A child context shadowing the llm service and, when the permission
+* preset service is reachable, that service too.
 */
 function reviewScope(ctx, activeSession = new AsyncLocalStorage()) {
-	return ctx.extend({ llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())) });
+	const permissionPresets = permissionPresetsOf(ctx);
+	const shadows = { llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())) };
+	if (permissionPresets !== void 0) shadows.permissionPresets = defensivePermissionPresets(permissionPresets, ctx.logger);
+	return ctx.extend(shadows);
+}
+/** The preset name the service reports when no configured preset matches. */
+const CUSTOM_PRESET = "custom";
+/** Read the live permission-preset service without requiring an injection. */
+function permissionPresetsOf(ctx) {
+	try {
+		const face = ctx.get("permissionPresets", false);
+		return face !== null && typeof face === "object" ? face : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Wrap the permission-preset service so the official gate's per-call probe can
+* never fail a tool call.
+*
+* DSH's Auto gate starts every `tools/pre-execute` with
+* `permissionPresets.current(session)`, and that method resolves the presets
+* service's own `sessionProjections` injection. When the presets fiber has
+* turned inactive the probe throws `cannot get required service
+* "sessionProjections" in inactive context` outside the gate's reviewer error
+* wrapper, so every tool call dies. This wrapper degrades the probe to
+* `custom` (the gate then skips review and calls `next()`), reports the lost
+* capability once, and keeps the tool backend alive; the registration and
+* teardown paths degrade the same way instead of throwing.
+*
+* @param real - the host's permission-preset service.
+* @param log - the row logger used for the single degradation report.
+* @returns A structurally compatible preset face.
+*/
+function defensivePermissionPresets(real, log) {
+	let reported = false;
+	const degrade = (operation, error) => {
+		if (reported) return;
+		reported = true;
+		log.warn(`model-switch: the permission-preset service refused ${operation} (${String(error)}); the Auto reviewer passes tool calls through instead of blocking them`);
+	};
+	return {
+		current(session) {
+			try {
+				return real.current(session);
+			} catch (error) {
+				degrade("current()", error);
+				return CUSTOM_PRESET;
+			}
+		},
+		set(session, preset) {
+			try {
+				return real.set(session, preset);
+			} catch (error) {
+				degrade("set()", error);
+				return;
+			}
+		},
+		registerAuto(admit) {
+			try {
+				return real.registerAuto(admit);
+			} catch (error) {
+				log.warn(`model-switch: the Auto preset integration was not registered (${String(error)}); review keeps the existing integration`);
+				return () => Promise.resolve();
+			}
+		}
+	};
 }
 /** Structural read of launcher-provided profile facts (the app-boot seam). */
 function autoReviewBundleActive(ctx) {
@@ -170,6 +237,16 @@ function autoReviewGate(gate, hooks = {}) {
 	};
 }
 /**
+* The gate fiber mounted by the current row instance.
+*
+* `registerAuto` is a single live registration owned by the gate's effect
+* lifetime, and its disposer is what clears the Auto preset. A re-applied row
+* must await the previous gate's unloading before the next registration runs,
+* otherwise the new `registerAuto` throws `already registered` and its effect
+* cleanup leaves the catalog without Auto.
+*/
+let lastGateFiber;
+/**
 * Mount the official gate under the reviewer-route scope.
 *
 * A profile that never enabled the optional bundle keeps no Auto preset and no
@@ -189,6 +266,14 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
+	const previous = lastGateFiber;
+	lastGateFiber = void 0;
+	if (previous !== void 0) try {
+		await previous.dispose();
+	} catch (cause) {
+		ctx.logger.info("model-switch: the previous auto-review gate had already unloaded; continuing with the new one");
+		ctx.logger.info(String(cause));
+	}
 	const activeSession = new AsyncLocalStorage();
 	const scope = reviewScope(ctx, activeSession);
 	let failure;
@@ -215,7 +300,8 @@ async function apply(ctx) {
 		ctx.logger.info("model-switch: the official auto-review gate is waiting for its host services; the reviewer route override is not bound yet");
 		return;
 	}
+	lastGateFiber = fiber;
 	bindAutoReviewSessionCorrelation(scope, activeSession);
 }
 //#endregion
-export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };
+export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/client.js

@@ -87,109 +87,6 @@ window.__ModuleLoader__.load({
 			return route !== void 0 && (route.provider ?? "").trim() !== "" && (route.model ?? "").trim() !== "";
 		}
 		//#endregion
-		//#region src/provider-group.ts
-		const ROUTE_FIELDS = Object.freeze([
-			"compactProvider",
-			"compactModel",
-			"autoReviewProvider",
-			"autoReviewModel",
-			"subagentProvider",
-			"subagentModel",
-			"subagentReasoningEffort",
-			"titleProvider",
-			"titleModel"
-		]);
-		/** Own data property, so a literal '__proto__' provider id can never touch a prototype. */
-		function setKey(target, key, value) {
-			Object.defineProperty(target, key, {
-				value,
-				enumerable: true,
-				writable: true,
-				configurable: true
-			});
-		}
-		/** A non-blank string. Blank values behave exactly like an absent field. */
-		function present(value) {
-			return typeof value === "string" && value.trim() !== "";
-		}
-		/** Normalize one raw entry to its owning provider and route view; undefined for non-object junk. */
-		function normalizeEntry(value) {
-			if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
-			const source = value;
-			const group = {};
-			for (const field of ROUTE_FIELDS) {
-				const item = source[field];
-				if (present(item)) group[field] = item;
-			}
-			return {
-				provider: present(source.provider) ? source.provider : "",
-				group
-			};
-		}
-		/**
-		* Strip a raw stored value to well-formed groups; never throws. Both storage
-		* shapes are accepted: the stored entry array (keys live in each entry's
-		* `provider` field) and a hand-written provider → routes map (keys are the
-		* providers). All-empty entries stay: they pin a provider to every default.
-		*/
-		function normalizeProviderGroups(raw) {
-			const groups = {};
-			if (Array.isArray(raw)) {
-				for (const entry of raw) {
-					const view = normalizeEntry(entry);
-					if (view === void 0 || view.provider === "") continue;
-					setKey(groups, view.provider, view.group);
-				}
-				return groups;
-			}
-			if (raw !== null && typeof raw === "object") for (const [key, value] of Object.entries(raw)) {
-				if (key.trim() === "") continue;
-				const view = normalizeEntry(value);
-				if (view === void 0) continue;
-				setKey(groups, key, view.group);
-			}
-			return groups;
-		}
-		/**
-		* The saved group for a provider.
-		* @returns the normalized group, or undefined when the provider has no group —
-		* which is what leaves the live routes untouched during a switch.
-		*/
-		function groupOf(groups, provider) {
-			if (groups === void 0 || provider.trim() === "") return void 0;
-			if (!Object.prototype.hasOwnProperty.call(groups, provider)) return void 0;
-			return groups[provider];
-		}
-		/** Storage entry for one provider's group; absent or blank route fields become ''. */
-		function entryOf(provider, group) {
-			return {
-				provider,
-				compactProvider: group.compactProvider ?? "",
-				compactModel: group.compactModel ?? "",
-				autoReviewProvider: group.autoReviewProvider ?? "",
-				autoReviewModel: group.autoReviewModel ?? "",
-				subagentProvider: group.subagentProvider ?? "",
-				subagentModel: group.subagentModel ?? "",
-				subagentReasoningEffort: group.subagentReasoningEffort ?? "",
-				titleProvider: group.titleProvider ?? "",
-				titleModel: group.titleModel ?? ""
-			};
-		}
-		/**
-		* The stored entry list with one provider's group replaced (an entry) or
-		* removed (undefined). Every entry is re-normalized and de-duplicated so a
-		* save can never write junk back; the input is never mutated. A blank
-		* provider only normalizes.
-		*/
-		function withProviderGroup(storage, provider, group) {
-			const groups = { ...normalizeProviderGroups(storage) };
-			if (provider.trim() !== "") {
-				if (group === void 0) delete groups[provider];
-				else setKey(groups, provider, group);
-			}
-			return Object.entries(groups).map(([key, value]) => entryOf(key, value));
-		}
-		//#endregion
 		//#region src/client/derived-config-form.ts
 		function deriveConfigForm(source, project, fields) {
 			let sourceSnapshot;
@@ -348,6 +245,109 @@ window.__ModuleLoader__.load({
 			}));
 		}
 		//#endregion
+		//#region src/provider-group.ts
+		const ROUTE_FIELDS = Object.freeze([
+			"compactProvider",
+			"compactModel",
+			"autoReviewProvider",
+			"autoReviewModel",
+			"subagentProvider",
+			"subagentModel",
+			"subagentReasoningEffort",
+			"titleProvider",
+			"titleModel"
+		]);
+		/** Own data property, so a literal '__proto__' provider id can never touch a prototype. */
+		function setKey(target, key, value) {
+			Object.defineProperty(target, key, {
+				value,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+		}
+		/** A non-blank string. Blank values behave exactly like an absent field. */
+		function present(value) {
+			return typeof value === "string" && value.trim() !== "";
+		}
+		/** Normalize one raw entry to its owning provider and route view; undefined for non-object junk. */
+		function normalizeEntry(value) {
+			if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+			const source = value;
+			const group = {};
+			for (const field of ROUTE_FIELDS) {
+				const item = source[field];
+				if (present(item)) group[field] = item;
+			}
+			return {
+				provider: present(source.provider) ? source.provider : "",
+				group
+			};
+		}
+		/**
+		* Strip a raw stored value to well-formed groups; never throws. Both storage
+		* shapes are accepted: the stored entry array (keys live in each entry's
+		* `provider` field) and a hand-written provider → routes map (keys are the
+		* providers). All-empty entries stay: they pin a provider to every default.
+		*/
+		function normalizeProviderGroups(raw) {
+			const groups = {};
+			if (Array.isArray(raw)) {
+				for (const entry of raw) {
+					const view = normalizeEntry(entry);
+					if (view === void 0 || view.provider === "") continue;
+					setKey(groups, view.provider, view.group);
+				}
+				return groups;
+			}
+			if (raw !== null && typeof raw === "object") for (const [key, value] of Object.entries(raw)) {
+				if (key.trim() === "") continue;
+				const view = normalizeEntry(value);
+				if (view === void 0) continue;
+				setKey(groups, key, view.group);
+			}
+			return groups;
+		}
+		/**
+		* The saved group for a provider.
+		* @returns the normalized group, or undefined when the provider has no group —
+		* which is what leaves the live routes untouched during a switch.
+		*/
+		function groupOf(groups, provider) {
+			if (groups === void 0 || provider.trim() === "") return void 0;
+			if (!Object.prototype.hasOwnProperty.call(groups, provider)) return void 0;
+			return groups[provider];
+		}
+		/** Storage entry for one provider's group; absent or blank route fields become ''. */
+		function entryOf(provider, group) {
+			return {
+				provider,
+				compactProvider: group.compactProvider ?? "",
+				compactModel: group.compactModel ?? "",
+				autoReviewProvider: group.autoReviewProvider ?? "",
+				autoReviewModel: group.autoReviewModel ?? "",
+				subagentProvider: group.subagentProvider ?? "",
+				subagentModel: group.subagentModel ?? "",
+				subagentReasoningEffort: group.subagentReasoningEffort ?? "",
+				titleProvider: group.titleProvider ?? "",
+				titleModel: group.titleModel ?? ""
+			};
+		}
+		/**
+		* The stored entry list with one provider's group replaced (an entry) or
+		* removed (undefined). Every entry is re-normalized and de-duplicated so a
+		* save can never write junk back; the input is never mutated. A blank
+		* provider only normalizes.
+		*/
+		function withProviderGroup(storage, provider, group) {
+			const groups = { ...normalizeProviderGroups(storage) };
+			if (provider.trim() !== "") {
+				if (group === void 0) delete groups[provider];
+				else setKey(groups, provider, group);
+			}
+			return Object.entries(groups).map(([key, value]) => entryOf(key, value));
+		}
+		//#endregion
 		//#region src/client/plugin-rpc.ts
 		function callPluginRpc(rpc, method, endpoint, payload, signal) {
 			return rpc.call("/api", method, {
@@ -1233,9 +1233,10 @@ window.__ModuleLoader__.load({
 					});
 					return true;
 				} catch (error) {
+					const raw = error instanceof Error ? error.message : String(error);
 					setMessage({
 						route,
-						text: error instanceof Error ? error.message : props.t("requestFailed")
+						text: raw === "settings-rejected" ? props.t("saveRejected") : raw
 					});
 					return false;
 				} finally {
@@ -2300,6 +2301,7 @@ window.__ModuleLoader__.load({
 			providerGroupPick: "选择供应商以编辑其配置组。",
 			providerGroupDelete: "删除该组",
 			saveTimeout: "保存超时，请重试",
+			saveRejected: "保存被拒绝，请重试",
 			"reason.central-subagent-routing": "Alpha.4 没有全局子代理启动路由接口。",
 			"reason.packaged-preset-roots": "Alpha.4 不支持插件提供额外 preset root。",
 			"reason.tool-owner-suppression": "Alpha.4 没有工具所有者或来源抑制接口。",
@@ -2357,6 +2359,7 @@ window.__ModuleLoader__.load({
 			providerGroupPick: "Pick a provider to edit its group.",
 			providerGroupDelete: "Delete group",
 			saveTimeout: "The save timed out; try again",
+			saveRejected: "The save was rejected; try again",
 			"reason.central-subagent-routing": "Alpha.4 exposes no global Subagent start-routing seam.",
 			"reason.packaged-preset-roots": "Alpha.4 exposes no plugin-owned preset root.",
 			"reason.tool-owner-suppression": "Alpha.4 exposes no tool owner or provenance suppression seam.",
@@ -4722,6 +4725,40 @@ window.__ModuleLoader__.load({
 				}, PlanReviewCard));
 			});
 		}
+		/**
+		* Save one provider group through the revision fence, retrying a refusal.
+		*
+		* Every attempt re-reads the form snapshot: another card, another window, or
+		* the runtime's own capture write can move the fence between the read and the
+		* write, and a refused write must cost one retry instead of a lost save. The
+		* whole update therefore lands as one atomic `set`/`unset` op under the
+		* revision that was actually read.
+		* @param form - the settings form the provider groups live in.
+		* @param provider - provider key whose group is being edited.
+		* @param group - replacement group, or undefined to drop the provider's group.
+		* @returns nothing; rejects with `settings-rejected` after every attempt is refused.
+		*/
+		async function saveProviderGroupFenced(form, provider, group) {
+			for (let attempt = 0; attempt < 3; attempt += 1) {
+				const snapshot = form.getSnapshot();
+				const current = snapshot.value?.providerGroups;
+				const next = withProviderGroup(current, provider, group);
+				if (next.length === 0) {
+					if (current === void 0) return;
+					if (await form.mutate([{
+						op: "unset",
+						path: ["providerGroups"]
+					}], snapshot.revision)) return;
+					continue;
+				}
+				if (await form.mutate([{
+					op: "set",
+					path: ["providerGroups"],
+					value: next
+				}], snapshot.revision)) return;
+			}
+			throw new Error("settings-rejected");
+		}
 		//#endregion
 		//#region src/client/nav-icon.ts
 		/** Official settings.section has no icon field. Swap the default gear for a model-switch glyph. */
@@ -4853,14 +4890,7 @@ window.__ModuleLoader__.load({
 						return (route === "search" ? search : route === "image" ? image : route === "compaction" ? compaction : route === "title" ? sessionTitle : autoReview).mutate(ops);
 					},
 					saveProviderGroup: async (provider, group) => {
-						const current = owned.getSnapshot().value?.providerGroups;
-						const next = withProviderGroup(current, provider, group);
-						if (next.length === 0) {
-							if (current === void 0) return;
-							if (!await owned.unset("providerGroups")) throw new Error("settings-rejected");
-							return;
-						}
-						if (!await owned.set("providerGroups", next)) throw new Error("settings-rejected");
+						await saveProviderGroupFenced(owned, provider, group);
 					},
 					providerRoleOf,
 					loadCatalog: async () => {

package/lib/session-title.js

@@ -630,10 +630,15 @@ var NamingSeam = class {
 		this.claim(plan);
 	}
 };
-/** Whether one loader entry declares an official naming provider this row supersedes. */
+/**
+* Whether one loader entry declares an official naming provider this row supersedes.
+*
+* The package name is the authoritative identity: the takeover disables the
+* matched entry, which disposes its fiber, so an id-only match could reach a
+* group or an unrelated plugin's row with a recycled id.
+*/
 function isOfficialTitleRow(entry) {
 	if (entry === void 0) return false;
-	if (entry.id === OFFICIAL_TITLE_ROW || entry.id === ALL_PROMPTS_ROW) return true;
 	const pkg = entry.options?.name;
 	return typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg);
 }
@@ -663,6 +668,11 @@ function installTakeover(ctx, module, seam) {
 	const reclaiming = /* @__PURE__ */ new Set();
 	/** After the yield, disable the official row and take the slot back. */
 	const reclaim = async (entry, plan) => {
+		const pkg = entry.options?.name;
+		if (!(typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg))) {
+			ctx.logger.info(`model-switch: skipped a naming-row candidate without an official cadence package (${String(leafId(entry) ?? "unknown")})`);
+			return;
+		}
 		if (reclaiming.has(entry)) return;
 		reclaiming.add(entry);
 		try {
@@ -670,6 +680,7 @@ function installTakeover(ctx, module, seam) {
 				await new Promise((resolve) => setTimeout(resolve, attempt === 0 ? 0 : 10));
 				try {
 					await entry.update({ disabled: true });
+					ctx.logger.info(`model-switch: disabled the official naming row ${String(leafId(entry) ?? "unknown")} (${pkg}) so the naming provider slot stays configurable`);
 				} catch (cause) {
 					ctx.logger.info("model-switch: the displaced naming row could not be persisted as disabled; the takeover repeats next startup");
 					ctx.logger.info(String(cause));

package/lib/types/auto-review.d.ts

@@ -100,9 +100,37 @@ export declare function bindAutoReviewSessionCorrelation(scope: Context, activeS
  * Build the scoped context the official gate runs under.
  * @param ctx - host context whose modelSwitch settings pin the reviewer route.
  * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
- * @returns A child context shadowing only the llm service.
+ * @returns A child context shadowing the llm service and, when the permission
+ * preset service is reachable, that service too.
  */
 export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>): Context;
+/** The permission-preset face the official gate reads; structural so a missing package never breaks a build. */
+export interface PermissionPresetsFace {
+    current(session: Session): string;
+    set(session: Session, preset: string): unknown;
+    registerAuto(admit: () => void): unknown;
+}
+/**
+ * Wrap the permission-preset service so the official gate's per-call probe can
+ * never fail a tool call.
+ *
+ * DSH's Auto gate starts every `tools/pre-execute` with
+ * `permissionPresets.current(session)`, and that method resolves the presets
+ * service's own `sessionProjections` injection. When the presets fiber has
+ * turned inactive the probe throws `cannot get required service
+ * "sessionProjections" in inactive context` outside the gate's reviewer error
+ * wrapper, so every tool call dies. This wrapper degrades the probe to
+ * `custom` (the gate then skips review and calls `next()`), reports the lost
+ * capability once, and keeps the tool backend alive; the registration and
+ * teardown paths degrade the same way instead of throwing.
+ *
+ * @param real - the host's permission-preset service.
+ * @param log - the row logger used for the single degradation report.
+ * @returns A structurally compatible preset face.
+ */
+export declare function defensivePermissionPresets(real: PermissionPresetsFace, log: {
+    warn(line: string): void;
+}): PermissionPresetsFace;
 /**
  * Structural view of the official gate's plugin face.
  *

package/lib/types/client/locales.d.ts

@@ -48,6 +48,7 @@ export declare const zh: {
     readonly providerGroupPick: "选择供应商以编辑其配置组。";
     readonly providerGroupDelete: "删除该组";
     readonly saveTimeout: "保存超时，请重试";
+    readonly saveRejected: "保存被拒绝，请重试";
     readonly 'reason.central-subagent-routing': "Alpha.4 没有全局子代理启动路由接口。";
     readonly 'reason.packaged-preset-roots': "Alpha.4 不支持插件提供额外 preset root。";
     readonly 'reason.tool-owner-suppression': "Alpha.4 没有工具所有者或来源抑制接口。";

package/lib/types/client/provider-group-save.d.ts

@@ -0,0 +1,28 @@
+import type { SettingsPathOpView } from '@deepseek-ai/dsh-api-remotes/client';
+import { type ProviderGroupConfig } from '../provider-group.js';
+/** The revision-fenced settings form one provider-group save writes through. */
+export interface ProviderGroupForm {
+    getSnapshot(): {
+        readonly revision: number | undefined;
+        readonly value: {
+            readonly providerGroups?: readonly ProviderGroupConfig[];
+        } | undefined;
+    };
+    mutate(ops: readonly SettingsPathOpView[], expectedRevision?: number): Promise<boolean>;
+}
+/** How many times one save re-reads and retries after a refused write. */
+export declare const PROVIDER_GROUP_SAVE_ATTEMPTS = 3;
+/**
+ * Save one provider group through the revision fence, retrying a refusal.
+ *
+ * Every attempt re-reads the form snapshot: another card, another window, or
+ * the runtime's own capture write can move the fence between the read and the
+ * write, and a refused write must cost one retry instead of a lost save. The
+ * whole update therefore lands as one atomic `set`/`unset` op under the
+ * revision that was actually read.
+ * @param form - the settings form the provider groups live in.
+ * @param provider - provider key whose group is being edited.
+ * @param group - replacement group, or undefined to drop the provider's group.
+ * @returns nothing; rejects with `settings-rejected` after every attempt is refused.
+ */
+export declare function saveProviderGroupFenced(form: ProviderGroupForm, provider: string, group: ProviderGroupConfig | undefined): Promise<void>;

package/lib/types/session-title.d.ts

@@ -279,7 +279,13 @@ export declare function frameTitleInput(messages: readonly SessionTitleUserMessa
 export declare const TAKEOVER_RETRY_DELAY_MS = 10;
 /** How many times the takeover re-checks after disabling the official row. */
 export declare const TAKEOVER_MAX_ATTEMPTS = 20;
-/** Whether one loader entry declares an official naming provider this row supersedes. */
+/**
+ * Whether one loader entry declares an official naming provider this row supersedes.
+ *
+ * The package name is the authoritative identity: the takeover disables the
+ * matched entry, which disposes its fiber, so an id-only match could reach a
+ * group or an unrelated plugin's row with a recycled id.
+ */
 export declare function isOfficialTitleRow(entry: Entry | undefined): boolean;
 /**
  * Mount the Model Switch session-naming row for this profile.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.29",
+  "version": "0.4.30",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",