dsh-model-think-level 1.0.0 → 1.0.2

package/lib/client/injection/key-reveal.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The eye on a provider's API-key field.
+ *
+ * Two jobs, one control. The official input is `<input type="password">` whose
+ * value is React's own draft state (`keyDraft`), and a SAVED key is never part
+ * of it: a configured provider shows a placeholder instead, because the harness
+ * keeps provider keys write-only (the settings document carries only the
+ * profile's `apiKeyEnv` reference, and the credential service reports
+ * `{ configured }` — never the value). So on a settled card the eye has nothing
+ * to unmask, and the plugin asks its own host for the stored value
+ * ({@link loadProviderKey}, the `PROVIDER_KEY_PATH` route) when — and only
+ * when — the user clicks it with an empty field. A field holding a draft the
+ * user just typed is never touched: the fetch is skipped and the click only
+ * swaps the mask.
+ *
+ * The read is deliberately constrained:
+ *
+ *   - it happens on an explicit click, never on render, and answers `undefined`
+ *     for every failure (no route, refused fence, reference-free profile,
+ *     unconfigured credential), which leaves the field masked;
+ *   - it is never cached (the request says `no-store` and the route answers
+ *     with the same header) and never logged;
+ *   - hiding the field again takes the borrowed value back out — the draft
+ *     returns to empty, which the official form reads as "keep the stored key",
+ *     so revealing can never overwrite the credential by accident. A value the
+ *     user edits after revealing is theirs, and is left alone.
+ *
+ * The button is the one node this plugin inserts into official DOM, and it is
+ * inserted deliberately: the affordance only reads as an eye at the END of the
+ * input if it sits inside the input's own box, and the official field has no
+ * wrapper to hang it on. The trade is contained —
+ *
+ *   - the field itself is never restructured, and nothing official is moved or
+ *     removed: the button is an absolutely positioned LEAF appended last;
+ *   - React ignores trailing foreign children when it reconciles the field's
+ *     known children, so the node survives every re-render (each keystroke
+ *     re-renders this field);
+ *   - React never writes the input's `type` back (its props do not change), so
+ *     the revealed state survives too;
+ *   - the pass removes the button, the marker and the class on cleanup, and
+ *     restores the mask, so a withdrawn takeover leaves nothing behind.
+ *
+ * @module dsh-model-think-level/client/injection/key-reveal
+ */
+/** Set on the field that carries the key input. */
+export declare const KEY_FIELD_CLASS = "bre-key-field";
+/** The eye button inside that field. */
+export declare const KEY_EYE_CLASS = "bre-key-eye";
+/** The repo's inline translator shape (see `HeadersEditor`, `ComposerSlider`). */
+export type Translator = (key: string, params?: Record<string, string | number>) => string;
+/** What a reconcile tells the field's eye. */
+export interface KeyRevealDeps {
+    /** Copy for the button's labels and its failure tooltip. */
+    readonly t: Translator;
+    /**
+     * The provider route this card edits, when the card announces one. Absent on
+     * the add-provider form (no route exists yet), which is what keeps the eye
+     * there a plain mask toggle.
+     */
+    readonly route?: string | undefined;
+    /** How to resolve the stored credential; injectable for tests. */
+    readonly loadKey?: ((route: string) => Promise<string | undefined>) | undefined;
+}
+/**
+ * Give an editor field an eye at the end of its input, if it holds the API key.
+ *
+ * Runs on every reconcile of the card, so it only ever writes what differs; a
+ * field with no key input is handed to {@link resetKeyField} instead, which is
+ * how a takeover that has moved on (a provider whose key field is gone) drops
+ * the affordance it no longer needs.
+ */
+export declare function revealKeyField(field: HTMLElement, deps: KeyRevealDeps): void;
+/** Undo {@link revealKeyField}: drop the button, the class, the marker, and
+ * re-mask the input, leaving the official field exactly as it was rendered. */
+export declare function resetKeyField(field: HTMLElement): void;
+/**
+ * Ask the host for the credential a provider profile names.
+ *
+ * Fails closed by design: every refusal — an unknown route, a profile with no
+ * reference, a credential that is not configured, a refused trust fence, a
+ * network error — is `undefined`, and the caller leaves the field masked rather
+ * than uncovering an empty box.
+ */
+export declare function loadProviderKey(route: string): Promise<string | undefined>;

package/lib/client/injection/model-menu.d.ts

@@ -1,26 +1,50 @@
 /**
- * Locating the official composer model menu — the seat root's open popover.
+ * Locating the official composer model seat — the ONE surface this plugin may
+ * decorate with a provider prefix.
+ *
+ * Everything in this module is scoped to the composer card
+ * (`[data-composer-card]`, owned by InputBar) and, inside it, to the model
+ * seat's own slot anchor. That scope is not a convenience: the shell renders
+ * several `button[aria-haspopup="menu"]` elements (the settings sidebar's
+ * account button, the composer's permission selector, …), so a document-wide
+ * search hands back a button this plugin does not own and paints the provider
+ * prefix on a host surface's label. When the seat cannot be identified the
+ * finders return undefined — the prefix is simply not shown, never stamped on
+ * someone else's control.
  *
  * @module dsh-model-think-level/client/injection/model-menu
  */
 /**
  * The official composer model menu: the seat root's open popover.
  *
- * Shape-tolerant across kernels: 0.1.5 portals the menu to document.body
- * and links it from the seat trigger via aria-controls, while older kernels
- * render it inline right after the trigger. Both shapes keep
+ * Shape-tolerant across kernels: newer kernels portal the menu to
+ * document.body and link it from the seat trigger via aria-controls, while
+ * older kernels render it inline right after the trigger. Both shapes keep
  * aria-haspopup="menu" on the trigger and role="menu" on the menu, so the
- * controls link is the primary route and the sibling check stays as the
- * fallback. Trigger search stays scoped to the composer card, so other
- * seats' menus never match; no copy text is read, so every locale matches.
+ * controls link is the primary route and the sibling check stays the fallback.
+ *
+ * The search NEVER leaves the composer card. When no card is mounted there is
+ * no model seat, and answering with some other surface's menu is exactly the
+ * cross-surface confusion this scoping exists to prevent.
+ *
+ * @param doc - the document to search.
+ * @returns the open model menu, or undefined while it is closed.
  */
 export declare function findModelMenu(doc?: Document): HTMLElement | undefined;
 /**
  * The official composer model trigger.
  *
- * The trigger remains in the composer card while its menu is closed, so this
- * finder keeps the menu lookup's linked and inline checks for an open menu but
- * falls back to the card's model-menu trigger when the popover is absent.
+ * The trigger stays in the card while its menu is closed, so this finder keeps
+ * the menu lookup's linked and inline checks and then falls back to the seat
+ * the closed card still renders:
+ *
+ *   - inside the seat's anchor, every candidate IS the seat;
+ *   - without an anchor, the seat is the LAST menu trigger of the card, since
+ *     the shell renders it at the end of the composer's trailing control row
+ *     (after the tools row that hosts the permission selector).
+ *
+ * @param doc - the document to search.
+ * @returns the composer's model trigger, or undefined while no composer exists.
  */
 export declare function findModelTrigger(doc?: Document): HTMLButtonElement | undefined;
 /** The official composer model menu: the seat root's open popover. */

package/lib/client/injection/models-page-editor.d.ts

@@ -212,6 +212,13 @@ export interface ScanState {
      * dismissed without saving is dropped, exactly like the card's own fields.
      */
     committing: Set<string>;
+    /**
+     * Routes with a provider-wide adapt in flight (the auto-adapt seat's click).
+     * Nothing debounces that click: a second one arriving while the first pass is
+     * still describing and suggesting would re-ask every model and re-commit the
+     * same bytes, so the route is simply not re-entered until its pass ends.
+     */
+    adapting: Set<string>;
     /**
      * Whether the official action row has failed to yield usable buttons for
      * every card seen so far. When it has, the landing decision degrades to
@@ -374,6 +381,29 @@ export interface AutofillFootprint {
  * position (the label's trailing number IS the position).
  */
 export declare function inputValueByLabel(card: HTMLElement, labels: readonly string[]): string;
+/**
+ * Adapt every model of one provider, the rows the user never unfolded
+ * included.
+ *
+ * The seat's click reaches the per-row editors through a document event, but
+ * an editor only exists for a row with a disclosure container, and a collapsed
+ * row renders none — so the visible answer is structurally incomplete. This
+ * routine answers from the settings DOCUMENT instead of the DOM: every model
+ * the provider declares goes through the same suggestion the row's own
+ * auto-adapt would have asked for, is mapped by the same pure functions
+ * ({@link ladderIntent}, {@link compatDraftOf}, {@link pendingWriteOf}) so both
+ * paths write identical bytes, and lands by the same rule — nothing is written
+ * while an official card holds the document; the write is held on the route
+ * and the card's own Save commits it (issue #7 / C2).
+ *
+ * The rows that ARE on screen keep answering for themselves: their editors
+ * hold the user's unsaved draft, which this document walk cannot see, and two
+ * writers for one row would let whichever ran last overwrite the other.
+ * @param state - mutable scan state: the adapting guard and the held ledger.
+ * @param deps - the injection dependencies.
+ * @param route - the provider route whose models are adapted.
+ */
+export declare function adaptEveryModel(state: ScanState, deps: InjectorDeps, route: string): Promise<void>;
 /**
  * Scan the settings DOM for official model rows and reconcile the injected
  * editors. Idempotent: existing editors are left alone, new disclosures get

package/lib/client/injection/provider-card-slot.d.ts

@@ -13,6 +13,11 @@
  * its directory row as owner props, so the route arrives on the component at
  * render time and one registration serves every card.
  *
+ * The mount also hosts the editor's tab bar ({@link EditorTabBar}) and is the
+ * element the editor-tabs pass resolves its card from, so the plugin's own
+ * subtree is what carries both the takeover's control and the state the
+ * stylesheet reveals the section on.
+ *
  * @module dsh-model-think-level/client/injection/provider-card-slot
  */
 import type { ReactNode } from 'react';
@@ -36,10 +41,10 @@ export type ProviderCardSlotProps = ProviderCardOccurrence & {
     t: Translate;
 };
 /**
- * The occurrence component: resolve this card's route, render the editor, and
- * publish the card's open/closed state so the section reveals itself with the
- * official editor. Exported for its own tests (the registration below is the
- * production path).
+ * The occurrence component: resolve this card's route, render the editor with
+ * its tab bar, and publish the card's open/closed state so the section reveals
+ * itself with the official editor. Exported for its own tests (the registration
+ * below is the production path).
  */
 export declare function ProviderCardSlot({ provider, api, t }: ProviderCardSlotProps): ReactNode;
 /**

package/lib/client/injection/provider-delete-seat.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The reserved delete seat on a provider row of the official Models page.
+ *
+ * The official row renders its destructive button only for a provider the host
+ * still considers removable (`row.removable`); a built-in provider such as
+ * deepseek renders nothing there at all. The action group is `margin-left: auto`,
+ * so the rows that keep the button are wider than the rows that do not and the
+ * whole column of buttons lines up raggedly against the card's right edge.
+ *
+ * The seat is therefore kept warm: a row the host left without a delete button
+ * gets a disabled one of the same metrics, which is enough for every row's
+ * actions to start at the same place. It is `disabled`, so it takes no click,
+ * no focus and no keyboard activation — the button is the alignment, not an
+ * action — and it still owns its gesture as far as the drag engine is concerned,
+ * because that engine refuses a drag beginning on any `button`.
+ *
+ * Its word is the host's own: the label is read off a delete button the page
+ * still renders, so the odd row out is not the one row written in another
+ * language. A page that renders none at all (every provider built in) falls back
+ * to this plugin's dictionary.
+ *
+ * @module dsh-model-think-level/client/injection/provider-delete-seat
+ */
+import type { HostLabels } from './models-page-editor.js';
+export interface ProviderDeleteDeps {
+    /** The plugin's own translator, for the tooltip and the fallback label. */
+    t: (key: string, params?: Record<string, string | number>) => string;
+    /** The official `settings.models` label sets, resolved fresh on every scan. */
+    labels: () => HostLabels;
+}
+/**
+ * Give every provider row the delete seat the host left out. Idempotent: a row
+ * that already has one is only relabelled, and a row whose provider became
+ * removable hands the seat back to the host's own button.
+ */
+export declare function reconcileProviderDeleteSeat(root: HTMLElement, deps: ProviderDeleteDeps): void;
+/** Take every seat out again (plugin dispose, HMR teardown). */
+export declare function teardownProviderDeleteSeats(): void;

package/lib/client/key-manager-client.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The browser half's client for the host's API-key manager.
+ *
+ * Every key fact — which references a provider lists, which label each carries,
+ * which one is in use, and whether the credential store actually holds a value
+ * — is host state: the list is the plugin's own index file, the value lives in
+ * the credential store, and the "in use" seat is the profile's `apiKeyEnv`
+ * field. All six operations therefore ride ONE same-origin route
+ * ({@link KEY_INDEX_PATH}), and the browser half only ever handles references,
+ * labels, booleans and masked previews. It never sees a secret it did not
+ * explicitly ask for: a key value is fetched one reference at a time through the
+ * existing reveal route, on a click, and is never cached.
+ *
+ * Fails closed. A refused fence, a route that is not in the settings document,
+ * a store that cannot be written, a network error — each answers `{ ok: false }`
+ * (with the host's own wording when it sent one) and the panel says so; nothing
+ * here invents success, and nothing here invents an error message either.
+ *
+ * @module dsh-model-think-level/client/key-manager-client
+ */
+/** One key row as the host reports it. */
+export interface KeyRow {
+    /** Credential reference holding the value. */
+    readonly ref: string;
+    /** Stored label; absent means "show the reference itself". */
+    readonly alias?: string;
+    /** Whether this is the reference the profile currently names. */
+    readonly enabled: boolean;
+    /** Whether the credential store holds a value; null when it could not say. */
+    readonly configured: boolean | null;
+    /**
+     * The stored value in the host's display form — a head, an ellipsis and a
+     * tail. Absent when the store would not let the value be read, so a row shows
+     * nothing rather than a made-up preview.
+     */
+    readonly masked?: string;
+}
+/** A successful answer: the whole list, in the host's order. */
+export interface KeyState {
+    readonly ok: true;
+    readonly route: string;
+    /** The reference in use, or null when the provider names none. */
+    readonly enabledRef: string | null;
+    readonly entries: readonly KeyRow[];
+}
+/** A refused answer, carrying the host's own words when it sent any. */
+export interface KeyFailure {
+    readonly ok: false;
+    readonly error?: string;
+}
+/** What one call to the key route answers. */
+export type KeyAnswer = KeyState | KeyFailure;
+/** The manager's transport, injectable so the panel can be tested without one. */
+export interface KeyManagerClient {
+    /** Read the provider's whole key list. */
+    list(route: string): Promise<KeyAnswer>;
+    /** Store a new key and list it, returning the list it produced. */
+    add(route: string, value: string, alias: string | undefined): Promise<KeyAnswer>;
+    /** Make one listed reference the key in use. */
+    enable(route: string, ref: string): Promise<KeyAnswer>;
+    /** Relabel one listed reference (undefined clears the label). */
+    rename(route: string, ref: string, alias: string | undefined): Promise<KeyAnswer>;
+    /** Replace the stored secret of one listed reference, keeping its name. */
+    replace(route: string, ref: string, value: string): Promise<KeyAnswer>;
+    /** Forget one listed reference and its value. */
+    remove(route: string, ref: string): Promise<KeyAnswer>;
+    /** The stored value of one listed reference, or undefined. */
+    reveal(route: string, ref: string): Promise<string | undefined>;
+}
+/** The live client: same-origin fetch against the host's route. */
+export declare const httpKeyManagerClient: KeyManagerClient;

package/lib/client/locales.d.ts

@@ -5,6 +5,8 @@ export declare const en: {
     thinkingMode: string;
     thinkingModeOff: string;
     autoAdapt: string;
+    autoAdaptAll: string;
+    autoAdaptAllHint: string;
     apply: string;
     reset: string;
     pendingSave: string;
@@ -79,6 +81,37 @@ export declare const en: {
     modelSearchNoMatches: string;
     modelSearchClear: string;
     modelSearchFailed: string;
+    editorTabsLabel: string;
+    editorTabProvider: string;
+    editorTabModels: string;
+    editorTabAdvanced: string;
+    keyRevealShow: string;
+    keyRevealHide: string;
+    keyRevealFailed: string;
+    keysLoading: string;
+    keysAdd: string;
+    keysAddConfirm: string;
+    keysEnable: string;
+    keysEnabled: string;
+    keysMissing: string;
+    keysEdit: string;
+    keysRemove: string;
+    keysConfirmRemove: string;
+    keysCancel: string;
+    keysSave: string;
+    keysAlias: string;
+    keysAliasPlaceholder: string;
+    keysValue: string;
+    keysValuePlaceholder: string;
+    keysNewValuePlaceholder: string;
+    keysAddIllegal: string;
+    keysAdded: string;
+    keysRenamed: string;
+    keysReplaced: string;
+    keysRemoved: string;
+    keysEnabledNote: string;
+    keysUnreachable: string;
+    keysPanelFailed: string;
     headersTitle: string;
     headersHint: string;
     headersEmpty: string;
@@ -106,6 +139,8 @@ export declare const en: {
     providerReorderHint: string;
     providerToggleAria: string;
     providerToggleHint: string;
+    providerRemoveDisabled: string;
+    providerRemoveLocked: string;
     modelReorderAria: string;
     modelReorderHint: string;
 };