dsh-model-think-level 1.0.0 → 1.0.2

package/lib/index.js

@@ -4,6 +4,9 @@ import Schema from "@deepseek-ai/schemastery";
 // src/constants.ts
 var PLUGIN_ID = "dsh-model-think-level";
 var PROBE_PATH = "/dsh-model-think-level/raw-models";
+var DIAG_PATH = "/dsh-model-think-level/header-bridge";
+var PROVIDER_KEY_PATH = "/dsh-model-think-level/provider-key";
+var KEY_INDEX_PATH = "/dsh-model-think-level/key-index";
 var AUTOFILL_CONFIG_PATH = "/dsh-model-think-level/autofill-config";
 var HEADERS_CONFIG_PATH = "/dsh-model-think-level/headers-config";
 var PI_AI_NS = "llm-pi-ai";
@@ -11,6 +14,142 @@ var UNSET_MARKER = "reasoningEffortsUnset";
 var INPUT_UNSET_MARKER = "inputUnset";
 var AUTOFILL_MARKER = "reasoningEffortsAutofilled";
 
+// src/key-refs.ts
+var KEY_ALIAS_MAX_LENGTH = 40;
+function deriveKeyRef(route) {
+  return `${route.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`;
+}
+function nextKeyRef(route, taken) {
+  const used = new Set(taken);
+  const base = deriveKeyRef(route);
+  if (!used.has(base)) return base;
+  for (let suffix = 2; suffix <= 999; suffix += 1) {
+    const candidate = `${base}_${suffix}`;
+    if (!used.has(candidate)) return candidate;
+  }
+  return `${base}_${Date.now()}`;
+}
+function normalizeKeyAlias(value) {
+  if (typeof value !== "string") return void 0;
+  let cleaned = "";
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    if (code < 32 || code === 127) continue;
+    cleaned += char;
+  }
+  cleaned = cleaned.trim();
+  if (cleaned.length === 0) return void 0;
+  return cleaned.slice(0, KEY_ALIAS_MAX_LENGTH);
+}
+function isLegalKeyValue(value) {
+  return typeof value === "string" && /^[\x21-\x7E]+$/.test(value);
+}
+var KEY_MASK_MIN_LENGTH = 12;
+function maskKeyValue(value) {
+  if (value.length === 0) return "";
+  if (value.length < KEY_MASK_MIN_LENGTH) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+
+// src/key-index.ts
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function emptyKeyIndex() {
+  return { version: 1, providers: {} };
+}
+function harnessHome() {
+  const configured = process.env["DSH_HOME"];
+  if (typeof configured === "string" && configured.length > 0) return configured;
+  try {
+    return join(homedir(), ".dsh");
+  } catch {
+    return ".dsh";
+  }
+}
+function keyIndexFilePath(home = harnessHome()) {
+  return join(home, "dsh-model-think-level", "key-index.json");
+}
+function parseKeyIndex(raw) {
+  if (typeof raw !== "object" || raw === null) return emptyKeyIndex();
+  const providers = raw["providers"];
+  if (typeof providers !== "object" || providers === null) return emptyKeyIndex();
+  const out = {};
+  for (const [route, entries] of Object.entries(providers)) {
+    if (route.length === 0 || !Array.isArray(entries)) continue;
+    const list = [];
+    for (const entry of entries) {
+      if (typeof entry !== "object" || entry === null) continue;
+      const record = entry;
+      const ref = record["ref"];
+      if (typeof ref !== "string" || ref.length === 0) continue;
+      if (list.some((existing) => existing.ref === ref)) continue;
+      const alias = normalizeKeyAlias(record["alias"]);
+      list.push(alias === void 0 ? { ref } : { ref, alias });
+    }
+    if (list.length > 0) out[route] = list;
+  }
+  return { version: 1, providers: out };
+}
+function readKeyIndex(file = keyIndexFilePath()) {
+  try {
+    return parseKeyIndex(JSON.parse(readFileSync(file, "utf8")));
+  } catch {
+    return emptyKeyIndex();
+  }
+}
+function writeKeyIndex(document, file = keyIndexFilePath()) {
+  mkdirSync(dirname(file), { recursive: true });
+  const temporary = `${file}.${process.pid}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(document, null, 2)}
+`, "utf8");
+  try {
+    renameSync(temporary, file);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+function updateKeyIndex(mutate, file = keyIndexFilePath()) {
+  const next = mutate(readKeyIndex(file));
+  writeKeyIndex(next, file);
+  return next;
+}
+function keyEntriesOf(document, route) {
+  const entries = document.providers[route];
+  return Array.isArray(entries) ? entries : [];
+}
+function hasKeyEntry(document, route, ref) {
+  return keyEntriesOf(document, route).some((entry) => entry.ref === ref);
+}
+function withKeyEntry(document, route, ref, alias) {
+  const list = [...keyEntriesOf(document, route)];
+  const index = list.findIndex((entry) => entry.ref === ref);
+  const label = normalizeKeyAlias(alias);
+  const next = label === void 0 ? { ref } : { ref, alias: label };
+  if (index === -1) list.push(next);
+  else list[index] = label === void 0 && list[index]?.alias !== void 0 ? { ref, alias: list[index]?.alias } : next;
+  return { version: 1, providers: { ...document.providers, [route]: list } };
+}
+function withKeyAlias(document, route, ref, alias) {
+  const list = [...keyEntriesOf(document, route)];
+  const index = list.findIndex((entry) => entry.ref === ref);
+  if (index === -1) return document;
+  const label = normalizeKeyAlias(alias);
+  list[index] = label === void 0 ? { ref } : { ref, alias: label };
+  return { version: 1, providers: { ...document.providers, [route]: list } };
+}
+function withoutKeyEntry(document, route, ref) {
+  const list = keyEntriesOf(document, route).filter((entry) => entry.ref !== ref);
+  const providers = { ...document.providers };
+  if (list.length === 0) delete providers[route];
+  else providers[route] = list;
+  return { version: 1, providers };
+}
+
 // src/knowledge.ts
 var INPUT_MODALITIES = ["text", "image"];
 var NEW_COMPAT_KEYS = ["thinkingTokenBudgetField", "vllmPriority", "supportsMaxOutputTokens"];
@@ -1523,6 +1662,9 @@ function selectOverrideFrom(candidates, model) {
   }
   return candidates[0];
 }
+function selectOverride(index, url, model) {
+  return selectOverrideFrom(pathCandidatesOf(index, url), model);
+}
 function requestUrlOf(input) {
   if (typeof input === "string") return input;
   if (typeof URL !== "undefined" && input instanceof URL) return input.href;
@@ -1615,10 +1757,248 @@ function headerOverlayInstalled() {
   return registry !== void 0 && globalThis.fetch === registry.wrapper;
 }
 
+// src/headers-pi-ai.ts
+var PATCH_STATE = /* @__PURE__ */ Symbol.for("dsh-model-think-level.pi-ai-header-transform");
+var REGISTER_PATCH_STATE = /* @__PURE__ */ Symbol.for("dsh-model-think-level.pi-ai-header-register");
+var CORDIS_ORIGINAL = /* @__PURE__ */ Symbol.for("cordis.original");
+function objectOf(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function runtimeObjectOf(value) {
+  const object = objectOf(value);
+  if (object === void 0) return void 0;
+  const original = object[CORDIS_ORIGINAL];
+  return objectOf(original) ?? object;
+}
+function noOpHandle() {
+  return {
+    active: false,
+    dispose() {
+    }
+  };
+}
+function routeOverrideOf(source, model) {
+  try {
+    if (!isRecord(model)) return void 0;
+    const baseURL = model["baseUrl"];
+    if (typeof baseURL !== "string" || baseURL.length === 0) return void 0;
+    const modelId = typeof model["id"] === "string" ? model["id"] : void 0;
+    return selectOverride(source.current, baseURL, modelId);
+  } catch {
+    return void 0;
+  }
+}
+function modelsProxyOf(models, source) {
+  return new Proxy(models, {
+    get(target, property, receiver) {
+      if (property !== "streamSimple") return Reflect.get(target, property, receiver);
+      const streamSimple = Reflect.get(target, property, target);
+      if (typeof streamSimple !== "function") return streamSimple;
+      return (...args) => {
+        const model = args[0];
+        const context = args[1];
+        const options = args[2];
+        const modelObject = isRecord(model) ? model : void 0;
+        if (modelObject === void 0 || typeof modelObject["baseUrl"] !== "string" || !isRecord(options)) {
+          return streamSimple.call(target, model, context, options);
+        }
+        const existing = typeof options["transformHeaders"] === "function" ? options["transformHeaders"] : void 0;
+        const transformHeaders = async (headers) => {
+          const merged = existing === void 0 ? headers : await existing(headers);
+          const override = routeOverrideOf(source, model);
+          return override?.hasHeaders ? { ...merged, ...override.headers } : merged;
+        };
+        return streamSimple.call(target, model, context, {
+          ...options,
+          transformHeaders
+        });
+      };
+    }
+  });
+}
+function snapshotProxyOf(snapshot, source) {
+  const models = snapshot["models"];
+  const modelObject = objectOf(models);
+  if (modelObject === void 0 || typeof modelObject["streamSimple"] !== "function") return snapshot;
+  const proxiedModels = modelsProxyOf(modelObject, source);
+  return new Proxy(snapshot, {
+    get(target, property, receiver) {
+      if (property === "models") return proxiedModels;
+      return Reflect.get(target, property, receiver);
+    }
+  });
+}
+function installPiAiHeaderTransform(adapter, source) {
+  const target = objectOf(adapter);
+  if (target === void 0 || typeof target["current"] !== "function") return noOpHandle();
+  const current = target["current"];
+  const stored = target[PATCH_STATE];
+  if (stored !== void 0 && current === stored.wrappedCurrent) {
+    stored.source = source;
+    stored.users += 1;
+    let active2 = true;
+    return {
+      get active() {
+        return active2 && stored.users > 0;
+      },
+      dispose() {
+        if (!active2) return;
+        active2 = false;
+        stored.users -= 1;
+        if (stored.users > 0) return;
+        if (target["current"] === stored.wrappedCurrent) target["current"] = stored.originalCurrent;
+        if (target[PATCH_STATE] === stored) delete target[PATCH_STATE];
+      }
+    };
+  }
+  const originalCurrent = current;
+  const wrappedCurrent = function(...args) {
+    const snapshot = originalCurrent.apply(this, args);
+    const snapshotObject = objectOf(snapshot);
+    return snapshotObject === void 0 ? snapshot : snapshotProxyOf(snapshotObject, state.source);
+  };
+  const state = { originalCurrent, wrappedCurrent, source, users: 1 };
+  target["current"] = wrappedCurrent;
+  Object.defineProperty(target, PATCH_STATE, { configurable: true, value: state });
+  let active = true;
+  return {
+    get active() {
+      return active && state.users > 0;
+    },
+    dispose() {
+      if (!active) return;
+      active = false;
+      state.users -= 1;
+      if (state.users > 0) return;
+      if (target["current"] === state.wrappedCurrent) target["current"] = state.originalCurrent;
+      if (target[PATCH_STATE] === state) delete target[PATCH_STATE];
+    }
+  };
+}
+function describePiAiHeaderState(llm, source) {
+  const runtime = runtimeObjectOf(llm);
+  const adapters = runtime?.["adapters"];
+  const names = [];
+  let total = 0;
+  let patched = 0;
+  if (adapters instanceof Map) {
+    for (const registration of adapters.values()) {
+      const adapter = objectOf(objectOf(registration)?.["adapter"]);
+      if (adapter === void 0 || typeof adapter["current"] !== "function") continue;
+      total += 1;
+      const state = adapter[PATCH_STATE];
+      const isPatched = state !== void 0 && adapter["current"] === state.wrappedCurrent;
+      if (isPatched) patched += 1;
+      const name2 = typeof adapter["constructor"] === "function" ? adapter["constructor"].name : "unknown";
+      names.push(`${name2}${isPatched ? "+" : "-"}`);
+    }
+  }
+  const registerState = runtime?.[REGISTER_PATCH_STATE];
+  return {
+    runtimeFound: runtime !== void 0,
+    registerPatched: registerState !== void 0 && runtime?.["registerAdapter"] === registerState.wrappedRegister,
+    adaptersInRuntime: total,
+    adaptersPatched: patched,
+    adapters: names,
+    routes: source.current.routes.length,
+    overrides: source.current.overrides.length
+  };
+}
+function installPiAiHeaderTransforms(llm, source) {
+  const installed = /* @__PURE__ */ new Map();
+  const runtime = runtimeObjectOf(llm);
+  let disposed = false;
+  const install = (adapter) => {
+    if (disposed) return;
+    const adapterObject = objectOf(adapter);
+    if (adapterObject === void 0 || typeof adapterObject["current"] !== "function") return;
+    if (!installed.has(adapterObject)) installed.set(adapterObject, installPiAiHeaderTransform(adapterObject, source));
+  };
+  const refresh = () => {
+    if (disposed) return;
+    const adapters = runtime?.["adapters"];
+    if (!(adapters instanceof Map)) return;
+    const seen = /* @__PURE__ */ new Set();
+    for (const registration of adapters.values()) {
+      const registrationObject = objectOf(registration);
+      const adapterObject = objectOf(registrationObject?.["adapter"]);
+      if (adapterObject === void 0 || typeof adapterObject["current"] !== "function") continue;
+      seen.add(adapterObject);
+      install(adapterObject);
+    }
+    for (const [adapter, handle] of installed) {
+      if (seen.has(adapter)) continue;
+      handle.dispose();
+      installed.delete(adapter);
+    }
+  };
+  let registerHandle;
+  const originalRegister = runtime?.["registerAdapter"];
+  if (runtime !== void 0 && typeof originalRegister === "function") {
+    const registerState = runtime[REGISTER_PATCH_STATE];
+    if (registerState !== void 0 && runtime["registerAdapter"] === registerState.wrappedRegister) {
+      registerState.users += 1;
+      registerHandle = {
+        get active() {
+          return !disposed && registerState.users > 0;
+        },
+        dispose() {
+          if (registerState.users <= 0) return;
+          registerState.users -= 1;
+          if (registerState.users > 0) return;
+          if (runtime["registerAdapter"] === registerState.wrappedRegister) runtime["registerAdapter"] = registerState.originalRegister;
+          if (runtime[REGISTER_PATCH_STATE] === registerState) delete runtime[REGISTER_PATCH_STATE];
+        }
+      };
+    } else {
+      const original = originalRegister;
+      const wrappedRegister = function(...args) {
+        const adapter = args[1];
+        install(adapter);
+        try {
+          return original.apply(this, args);
+        } finally {
+          refresh();
+        }
+      };
+      const state = {
+        originalRegister: original,
+        wrappedRegister,
+        users: 1
+      };
+      runtime["registerAdapter"] = wrappedRegister;
+      Object.defineProperty(runtime, REGISTER_PATCH_STATE, { configurable: true, value: state });
+      registerHandle = {
+        get active() {
+          return !disposed && state.users > 0;
+        },
+        dispose() {
+          if (state.users <= 0) return;
+          state.users -= 1;
+          if (state.users > 0) return;
+          if (runtime["registerAdapter"] === state.wrappedRegister) runtime["registerAdapter"] = state.originalRegister;
+          if (runtime[REGISTER_PATCH_STATE] === state) delete runtime[REGISTER_PATCH_STATE];
+        }
+      };
+    }
+  }
+  refresh();
+  return {
+    refresh,
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      registerHandle?.dispose();
+      for (const handle of installed.values()) handle.dispose();
+      installed.clear();
+    }
+  };
+}
+
 // src/headers-conflict.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname, join, resolve } from "node:path";
+import { dirname as dirname2, join as join2, resolve } from "node:path";
 var SIBLING_PACKAGES = [
   "dsh-client-masquerade",
   "dsh-llm-headers",
@@ -1630,20 +2010,20 @@ function searchRoots() {
   const roots = /* @__PURE__ */ new Set();
   const entry = process.argv[1];
   if (typeof entry === "string" && entry.length > 0) {
-    let dir = dirname(resolve(entry));
+    let dir = dirname2(resolve(entry));
     for (let depth = 0; depth < 8; depth += 1) {
-      roots.add(join(dir, "node_modules"));
-      const parent = dirname(dir);
+      roots.add(join2(dir, "node_modules"));
+      const parent = dirname2(dir);
       if (parent === dir) break;
       dir = parent;
     }
   }
-  roots.add(join(process.cwd(), "node_modules"));
+  roots.add(join2(process.cwd(), "node_modules"));
   try {
     const require2 = createRequire(import.meta.url);
     for (const name2 of SIBLING_PACKAGES) {
       try {
-        roots.add(join(dirname(dirname(dirname(require2.resolve(`${name2}/package.json`)))), "node_modules"));
+        roots.add(join2(dirname2(dirname2(dirname2(require2.resolve(`${name2}/package.json`)))), "node_modules"));
       } catch {
       }
     }
@@ -1652,14 +2032,14 @@ function searchRoots() {
   return [...roots];
 }
 function findAdapterFile() {
-  const relative = join("@deepseek-ai", "dsh-llm-pi-ai", "lib", "index.js");
+  const relative = join2("@deepseek-ai", "dsh-llm-pi-ai", "lib", "index.js");
   const candidates = [];
   try {
     const require2 = createRequire(import.meta.url);
     candidates.push(require2.resolve("@deepseek-ai/dsh-llm-pi-ai"));
   } catch {
   }
-  for (const root of searchRoots()) candidates.push(join(root, relative));
+  for (const root of searchRoots()) candidates.push(join2(root, relative));
   for (const candidate of candidates) {
     if (existsSync(candidate)) return candidate;
   }
@@ -1670,7 +2050,7 @@ function adapterSourcePatched(source) {
 }
 function adapterPatchState(path) {
   try {
-    return adapterSourcePatched(readFileSync(path, "utf8")) ? "patched" : "stock";
+    return adapterSourcePatched(readFileSync2(path, "utf8")) ? "patched" : "stock";
   } catch {
     return "unknown";
   }
@@ -1681,8 +2061,8 @@ function findSiblings() {
   for (const root of searchRoots()) {
     for (const name2 of SIBLING_PACKAGES) {
       if (seen.has(name2)) continue;
-      const dir = join(root, name2);
-      const manifest = join(dir, "package.json");
+      const dir = join2(root, name2);
+      const manifest = join2(dir, "package.json");
       if (!existsSync(manifest)) continue;
       seen.add(name2);
       found.push({ name: name2, path: dir });
@@ -1823,7 +2203,7 @@ function backfillRolePin(model, providers, route) {
 
 // src/index.ts
 var name = PLUGIN_ID;
-var inject = ["settings"];
+var inject = ["settings", "llm"];
 var PI_NS = PI_AI_NS;
 var BOOT_RETRY_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 16e3, 3e4];
 var PROBE_TIMEOUT_MS = 15e3;
@@ -1835,6 +2215,116 @@ var Config = Schema.object({
   defaultGuard: Schema.boolean().default(true),
   uaOverride: Schema.boolean().default(true)
 });
+function providerProfileOf(section, route) {
+  if (!isRecord(section)) return void 0;
+  const providers = section["providers"];
+  if (!isRecord(providers)) return void 0;
+  const profile = providers[route];
+  return isRecord(profile) ? profile : void 0;
+}
+function enabledRefOf(profile) {
+  const ref = profile?.["apiKeyEnv"];
+  return typeof ref === "string" && ref.length > 0 ? ref : void 0;
+}
+function isRefusal(answer) {
+  return isRecord(answer) && answer["ok"] === false;
+}
+function refusalMessage(answer) {
+  if (!isRecord(answer)) return void 0;
+  const error = answer["error"];
+  if (typeof error === "string") return error;
+  if (isRecord(error) && typeof error["message"] === "string") return error["message"];
+  return typeof answer["message"] === "string" ? answer["message"] : void 0;
+}
+function describeRecords(answer) {
+  const candidate = isRecord(answer) && answer["value"] !== void 0 ? answer["value"] : answer;
+  return isRecord(candidate) ? candidate : void 0;
+}
+async function storeCredential(credentials, ref, value) {
+  const set = credentials?.set;
+  if (credentials === void 0 || typeof set !== "function") {
+    return "this deployment cannot write the credential store";
+  }
+  try {
+    const answer = await set.call(credentials, ref, value);
+    if (!isRefusal(answer)) return void 0;
+    return refusalMessage(answer) ?? `the credential store refused ${ref}`;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+async function forgetCredential(credentials, ref) {
+  const unset = credentials?.unset;
+  if (credentials === void 0 || typeof unset !== "function") {
+    return "this deployment cannot write the credential store";
+  }
+  try {
+    const answer = await unset.call(credentials, ref);
+    if (!isRefusal(answer)) return void 0;
+    return refusalMessage(answer) ?? `the credential store refused to forget ${ref}`;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+async function credentialFacts(credentials, refs) {
+  const out = {};
+  if (credentials === void 0 || refs.length === 0) return out;
+  const describe = credentials.describe;
+  if (typeof describe === "function") {
+    try {
+      const records = describeRecords(await describe.call(credentials, [...refs]));
+      for (const ref of refs) {
+        const info = records?.[ref];
+        if (isRecord(info) && typeof info["configured"] === "boolean") {
+          out[ref] = { configured: info["configured"] };
+        }
+      }
+    } catch {
+    }
+  }
+  const resolve2 = credentials.resolve;
+  for (const ref of refs) {
+    try {
+      const hit = await resolve2.call(credentials, ref);
+      const value = hit !== void 0 && typeof hit.value === "string" ? hit.value : void 0;
+      const configured = out[ref]?.configured ?? (value !== void 0 && value.length > 0);
+      const masked = value === void 0 ? void 0 : maskKeyValue(value);
+      out[ref] = masked === void 0 || masked.length === 0 ? { configured } : { configured, masked };
+    } catch {
+    }
+  }
+  return out;
+}
+async function credentialConfigured(credentials, refs) {
+  const facts = await credentialFacts(credentials, refs);
+  const out = {};
+  for (const ref of refs) {
+    const configured = facts[ref]?.configured;
+    if (configured !== void 0) out[ref] = configured;
+  }
+  return out;
+}
+function isConflictError(error) {
+  return isRecord(error) && error["code"] === "SETTINGS_CONFLICT";
+}
+async function readJsonBody(req, limit = 8192) {
+  const decoder = new TextDecoder();
+  let text = "";
+  try {
+    for await (const chunk of req) {
+      text += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+      if (text.length > limit) return void 0;
+    }
+  } catch {
+    return void 0;
+  }
+  if (text.length === 0) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }
@@ -2114,6 +2604,23 @@ function apply(ctx, config = {}) {
   ctx.effect(() => () => {
     overlay.dispose();
   }, "dsh-model-think-level: fetch header overlay");
+  let headerBridgeState = () => ({ stage: "not-installed" });
+  const installPiAiBridge = (llm) => {
+    const transforms = installPiAiHeaderTransforms(llm, overlaySource);
+    transforms.refresh();
+    headerBridgeState = () => describePiAiHeaderState(llm, overlaySource);
+    ctx.on("llm/adapters-updated", () => transforms.refresh());
+    ctx.effect(() => () => transforms.dispose(), "dsh-model-think-level: pi-ai request headers");
+  };
+  const availableLlm = ctx.llm;
+  if (availableLlm === void 0) {
+    ctx.inject(["llm"], (llmCtx) => {
+      const llm = llmCtx.llm;
+      if (llm !== void 0) installPiAiBridge(llm);
+    });
+  } else {
+    installPiAiBridge(availableLlm);
+  }
   const headerConflicts = detectHeaderConflicts();
   ctx.inject(["webServer"], (webServerCtx) => {
     ctx.effect(
@@ -2130,6 +2637,17 @@ function apply(ctx, config = {}) {
             return;
           }
           const url = new URL(req.url ?? "/", "http://x");
+          if (url.searchParams.get("diag") === "1") {
+            sendJson(res, 200, {
+              ok: true,
+              bridge: headerBridgeState(),
+              overlay: {
+                routes: overlaySource.current.routes.length,
+                overrides: overlaySource.current.overrides.length
+              }
+            });
+            return;
+          }
           const route = url.searchParams.get("route") ?? "";
           const section = piSection();
           const profile = isRecord(section) && isRecord(section["providers"]) ? section["providers"][route] : void 0;
@@ -2224,6 +2742,260 @@ function apply(ctx, config = {}) {
       }),
       "dsh-model-think-level: raw-models probe route"
     );
+    ctx.effect(
+      () => webServerCtx.webServer.register({
+        kind: "exact",
+        path: DIAG_PATH,
+        handler: (req, res) => {
+          if (!isTrustedRequest(req)) {
+            sendJson(res, 403, { ok: false, error: "forbidden" });
+            return;
+          }
+          sendJson(res, 200, {
+            ok: true,
+            uaOverride: resolved.uaOverride,
+            bridge: headerBridgeState(),
+            overlay: {
+              routes: overlaySource.current.routes.length,
+              overrides: overlaySource.current.overrides.length
+            }
+          });
+        }
+      }),
+      "dsh-model-think-level: header diagnostics route"
+    );
+    ctx.effect(
+      () => webServerCtx.webServer.register({
+        kind: "exact",
+        path: PROVIDER_KEY_PATH,
+        handler: async (req, res) => {
+          res.setHeader("cache-control", "no-store");
+          if (!isTrustedRequest(req)) {
+            sendJson(res, 403, { ok: false, error: "forbidden" });
+            return;
+          }
+          if (req.method !== "GET") {
+            sendJson(res, 405, { ok: false, error: "method not allowed" });
+            return;
+          }
+          const url = new URL(req.url ?? "/", "http://x");
+          const route = url.searchParams.get("route") ?? "";
+          const section = piSection();
+          const profile = isRecord(section) && isRecord(section["providers"]) ? section["providers"][route] : void 0;
+          if (!isRecord(profile)) {
+            sendJson(res, 400, { ok: false, error: `no llm-pi-ai provider route "${route}"` });
+            return;
+          }
+          const apiKeyEnv = typeof profile["apiKeyEnv"] === "string" ? profile["apiKeyEnv"] : void 0;
+          const named = url.searchParams.get("ref") ?? "";
+          const ref = named.length > 0 ? named === apiKeyEnv || hasKeyEntry(readKeyIndex(keyIndexFilePath()), route, named) ? named : void 0 : apiKeyEnv;
+          if (ref === void 0) {
+            sendJson(res, 404, {
+              ok: false,
+              error: named.length > 0 ? `provider route "${route}" lists no key "${named}"` : `provider route "${route}" stores no credential reference`
+            });
+            return;
+          }
+          let value;
+          try {
+            const credentials = ctx.get("credentials");
+            const hit = credentials === void 0 ? void 0 : await credentials.resolve(ref);
+            value = hit !== void 0 && typeof hit.value === "string" && hit.value.length > 0 ? hit.value : void 0;
+          } catch {
+            value = void 0;
+          }
+          if (value === void 0) {
+            sendJson(res, 404, { ok: false, error: `no credential is configured for ${ref}` });
+            return;
+          }
+          sendJson(res, 200, { ok: true, key: value });
+        }
+      }),
+      "dsh-model-think-level: provider-key route"
+    );
+    ctx.effect(
+      () => webServerCtx.webServer.register({
+        kind: "exact",
+        path: KEY_INDEX_PATH,
+        handler: async (req, res) => {
+          res.setHeader("cache-control", "no-store");
+          if (!isTrustedRequest(req)) {
+            sendJson(res, 403, { ok: false, error: "forbidden" });
+            return;
+          }
+          if (req.method !== "GET" && req.method !== "POST") {
+            sendJson(res, 405, { ok: false, error: "method not allowed" });
+            return;
+          }
+          const url = new URL(req.url ?? "/", "http://x");
+          const route = url.searchParams.get("route") ?? "";
+          const entryOf = () => {
+            try {
+              const found = settings.describe().find((candidate) => candidate.ns === PI_NS);
+              return found === void 0 ? void 0 : { value: found.value, revision: found.revision };
+            } catch {
+              return void 0;
+            }
+          };
+          if (route.length === 0 || providerProfileOf(entryOf()?.value, route) === void 0) {
+            sendJson(res, 400, { ok: false, error: `no llm-pi-ai provider route "${route}"` });
+            return;
+          }
+          const credentials = ctx.get("credentials");
+          const indexFile = keyIndexFilePath();
+          const enabledNow = () => enabledRefOf(providerProfileOf(entryOf()?.value, route));
+          const setEnabledKey = async (ref2) => {
+            for (let attempt = 0; attempt < 2; attempt += 1) {
+              const entry = entryOf();
+              if (entry === void 0) return "the llm-pi-ai settings entry is unavailable";
+              try {
+                await settings.mutate(
+                  PI_NS,
+                  ref2 === void 0 ? [{ op: "unset", path: ["providers", route, "apiKeyEnv"] }] : [{ op: "set", path: ["providers", route, "apiKeyEnv"], value: ref2 }],
+                  entry.revision
+                );
+                return void 0;
+              } catch (error) {
+                if (attempt === 0 && isConflictError(error)) continue;
+                return error instanceof Error ? error.message : String(error);
+              }
+            }
+            return "the settings document kept changing; try again";
+          };
+          const payload = async () => {
+            const enabledRef = enabledNow();
+            const listed = keyEntriesOf(readKeyIndex(indexFile), route);
+            const refs = listed.map((entry) => entry.ref);
+            if (enabledRef !== void 0 && !refs.includes(enabledRef)) refs.push(enabledRef);
+            const facts = await credentialFacts(credentials, refs);
+            const entries = refs.map((ref2) => {
+              const fact = facts[ref2];
+              const view = {
+                ref: ref2,
+                enabled: ref2 === enabledRef,
+                configured: fact?.configured ?? null
+              };
+              if (fact?.masked !== void 0) view.masked = fact.masked;
+              const stored = listed.find((candidate) => candidate.ref === ref2);
+              if (stored?.alias !== void 0) view.alias = stored.alias;
+              return view;
+            });
+            return { ok: true, route, enabledRef: enabledRef ?? null, entries };
+          };
+          if (req.method === "GET") {
+            sendJson(res, 200, await payload());
+            return;
+          }
+          const body = await readJsonBody(req);
+          const op = isRecord(body) && typeof body["op"] === "string" ? body["op"] : "";
+          const ref = isRecord(body) && typeof body["ref"] === "string" ? body["ref"] : void 0;
+          const alias = isRecord(body) ? normalizeKeyAlias(body["alias"]) : void 0;
+          const value = isRecord(body) && typeof body["value"] === "string" ? body["value"] : void 0;
+          const refuse = (error) => sendJson(res, 400, { ok: false, error });
+          try {
+            if (op === "add") {
+              if (!isLegalKeyValue(value)) {
+                refuse("a key must be printable ASCII without spaces");
+                return;
+              }
+              const taken = keyEntriesOf(readKeyIndex(indexFile), route).map((candidate) => candidate.ref);
+              const active = enabledNow();
+              if (active !== void 0 && !taken.includes(active)) taken.push(active);
+              const created = nextKeyRef(route, taken);
+              const refused = await storeCredential(credentials, created, value);
+              if (refused !== void 0) {
+                refuse(refused);
+                return;
+              }
+              updateKeyIndex((document) => withKeyEntry(document, route, created, alias), indexFile);
+              if (enabledNow() === void 0) {
+                const failed = await setEnabledKey(created);
+                if (failed !== void 0) {
+                  refuse(failed);
+                  return;
+                }
+              }
+            } else if (op === "enable") {
+              const listed = readKeyIndex(indexFile);
+              if (ref === void 0 || !hasKeyEntry(listed, route, ref)) {
+                refuse("that key is not listed for this provider");
+                return;
+              }
+              const previous = enabledNow();
+              if (previous !== void 0 && previous !== ref && !hasKeyEntry(listed, route, previous)) {
+                const leaving = previous;
+                updateKeyIndex(
+                  (document) => hasKeyEntry(document, route, leaving) ? document : withKeyEntry(document, route, leaving, void 0),
+                  indexFile
+                );
+              }
+              const failed = await setEnabledKey(ref);
+              if (failed !== void 0) {
+                refuse(failed);
+                return;
+              }
+            } else if (op === "rename") {
+              const known = ref !== void 0 && (hasKeyEntry(readKeyIndex(indexFile), route, ref) || ref === enabledNow());
+              if (ref === void 0 || !known) {
+                refuse("that key is not listed for this provider");
+                return;
+              }
+              const target = ref;
+              updateKeyIndex(
+                (document) => hasKeyEntry(document, route, target) ? withKeyAlias(document, route, target, alias) : withKeyEntry(document, route, target, alias),
+                indexFile
+              );
+            } else if (op === "value") {
+              const known = ref !== void 0 && (hasKeyEntry(readKeyIndex(indexFile), route, ref) || ref === enabledNow());
+              if (ref === void 0 || !known) {
+                refuse("that key is not listed for this provider");
+                return;
+              }
+              if (!isLegalKeyValue(value)) {
+                refuse("a key must be printable ASCII without spaces");
+                return;
+              }
+              const refused = await storeCredential(credentials, ref, value);
+              if (refused !== void 0) {
+                refuse(refused);
+                return;
+              }
+            } else if (op === "remove") {
+              const document = readKeyIndex(indexFile);
+              if (ref === void 0 || !hasKeyEntry(document, route, ref) && ref !== enabledNow()) {
+                refuse("that key is not listed for this provider");
+                return;
+              }
+              if (ref === enabledNow()) {
+                const remaining = keyEntriesOf(document, route).map((candidate) => candidate.ref).filter((candidate) => candidate !== ref);
+                const failed = await setEnabledKey(remaining[0]);
+                if (failed !== void 0) {
+                  refuse(failed);
+                  return;
+                }
+              }
+              const configured = (await credentialConfigured(credentials, [ref]))[ref];
+              if (configured !== false) {
+                const refused = await forgetCredential(credentials, ref);
+                if (refused !== void 0) {
+                  refuse(refused);
+                  return;
+                }
+              }
+              updateKeyIndex((document2) => withoutKeyEntry(document2, route, ref), indexFile);
+            } else {
+              refuse(`unknown key operation "${op}"`);
+              return;
+            }
+          } catch (error) {
+            sendJson(res, 500, { ok: false, error: error instanceof Error ? error.message : String(error) });
+            return;
+          }
+          sendJson(res, 200, await payload());
+        }
+      }),
+      "dsh-model-think-level: key index route"
+    );
     ctx.effect(
       () => webServerCtx.webServer.register({
         kind: "exact",