dsh-molbio-tools 0.22.0 → 0.22.2

package/docs/store-evidence.md

@@ -10,7 +10,7 @@
 
 ```jsonc
 "engines": {
-  "node": ">=26",
+  "node": ">=24",
   "dsh": ">=0.2.1-rc.2 <0.3.0-0"
 },
 "dsh": {
@@ -18,7 +18,9 @@
     "dshReleases": {
       "0.2.1-rc.1": "unknown",
       "0.2.1-rc.2": "compatible",
-      "0.2.1-rc.3": "compatible"
+      "0.2.1-rc.3": "compatible",
+      "0.2.1-rc.4": "unknown",
+      "0.2.1-rc.5": "compatible"
     }
   }
 }
@@ -29,21 +31,23 @@
 `@deepseek-ai/dsh-app-boot` 的 `unmetRequirements`）：带 prerelease 选项时 `<0.3.0`
 会放行 `0.3.0-alpha.1`，而 `-0` 不会。
 
-### 为什么 rc.2 / rc.3 是 compatible、rc.1 是 unknown
+### 为什么 rc.2 / rc.3 / rc.5 是 compatible、rc.1 / rc.4 是 unknown
 
 | 版本 | 记录 | 依据 |
 | --- | --- | --- |
 | 0.2.1-rc.1 | unknown | 早于本包基线（0.20.1 钉 `0.2.0-rc.2`），未在此版本上运行过；同时也不在 `engines.dsh` 范围内 |
 | 0.2.1-rc.2 | compatible | 0.21.0 / 0.21.1 的发布基线；本文件第 3 节的一次性 Profile 流程在 rc.2 上跑过；`contract` / `preset-health` / `smoke` 均通过 |
-| 0.2.1-rc.3 | compatible | 0.22.0 的发布基线（CI 钉该版本）；同一套一次性 Profile 流程在 rc.3 上重跑通过（安装 → 启动 HTTP 200 → 卸载无残留）；`contract` / `preset-health` / `drift-probe` / `benchmark-profile` / `smoke` 在 rc.3 上全绿。上游 `standard` 行清单与 rc.2 **逐字节一致** |
+| 0.2.1-rc.3 | compatible | 0.22.0 的发布基线；同一套一次性 Profile 流程在 rc.3 上重跑通过（安装 → 启动 HTTP 200 → 卸载无残留）；`contract` / `preset-health` / `drift-probe` / `benchmark-profile` / `smoke` 在 rc.3 上全绿。上游 `standard` 行清单与 rc.2 **逐字节一致** |
+| 0.2.1-rc.4 | unknown | 没有在真实安装上跑过；不能因为"补丁号在 `engines.dsh` 范围内"就写成 compatible |
+| 0.2.1-rc.5 | compatible | 0.22.2 的发布基线（CI 钉该版本）。在本机 DSH 桌面版 0.2.1-rc.5 上重跑：安装 → 启动 HTTP 200 → `agentPresets/list` 的 `broken` 为空且 molbio-lab 的 `tool-molbio` 为 `fiberPhase: "active"` → 卸载无残留；`contract` 17 / `preset-health` 30 行 / `drift-probe` 16 / `smoke` 60 工具 / `bench:offline` 61 题全绿。上游 `standard` 与 rc.3 **逐字节一致**（6799 B，同一 sha256） |
 
 ## 2. 环境
 
 | 项 | 值 |
 | --- | --- |
-| DSH | `0.2.1-rc.3` |
-| Node.js | `v26.12.1` |
-| pnpm | `11.22.0` |
+| DSH | `0.2.1-rc.5`（桌面版 `app.asar`，同一份代码也是 CI 的 npm 基线） |
+| Node.js | `v24.21.0`（DSH 桌面版内嵌的 Node，Electron 44.7.0） |
+| pnpm | `11.28.5`（DSH bundle 内） |
 | 平台 | Windows（win32 x64） |
 
 ## 3. 一次性 Profile 的完整流程
@@ -52,9 +56,9 @@
 
 ```bash
 export DSH_HOME=<workspace>/.tmp/dsh-store-check
-npm pack --pack-destination "$DSH_HOME"          # 得到 dsh-molbio-tools-0.22.0.tgz
+npm pack --pack-destination "$DSH_HOME"          # 得到 dsh-molbio-tools-0.22.2.tgz
 dsh --profile molbio-tgz-check --from-default-profile web --dump-config
-dsh plugin --profile molbio-tgz-check add "$DSH_HOME/dsh-molbio-tools-0.22.0.tgz"
+dsh plugin --profile molbio-tgz-check add "$DSH_HOME/dsh-molbio-tools-0.22.2.tgz"
 dsh --profile molbio-tgz-check --dump-config      # 安装后的组合树
 dsh --profile molbio-tgz-check --no-open --port 0 # 启动，打印 URL
 curl "http://127.0.0.1:<port>/?token=<token>"     # 读回页面
@@ -65,18 +69,18 @@ dsh --profile molbio-tgz-check --dump-config      # 卸载后的组合树
 安装用 **tarball** 而不是目录，因为 tarball 就是发布物本身：它能同时证明 `files`
 白名单带全了运行文件（`host.mjs`、`lib/client.js`、单个 `cordis.patch.yml` 的两个 insert、preset）。
 
-tarball 是 **115 个文件 / 约 1.0 MB**（`npm pack` 实测 1,004,017 B，解包约 3.2 MB；再改文档会让字节数
+tarball 是 **115 个文件 / 约 1.02 MB**（`npm pack` 实测约 1,024,000 B，解包约 3.3 MB；再改文档会让字节数
 小幅浮动，文件数不变），且 `package/packages/**` 为 **0**：根包不再内嵌
 `packages/molbio-panel`，一个 tarball 里只有一个插件清单（面板包按自己的地址单独发布）。
 面板本身没有因此消失——根包的 `lib/client.js` 就带着它，第 3.2 节的回读可以作证。
 
-下面这次是在 **0.22.0 的 tarball** 上、用 **dsh 0.2.1-rc.3** 的 CLI 重跑的（2026-10-25），
+下面这次是在 **0.22.2 的 tarball** 上、用 **dsh 0.2.1-rc.5** 的 CLI 重跑的（2026-10-30），
 文件数与发布物一致；更早的记录只差版本号与文件数，流程未变。
 
 ### 3.1 安装
 
 ```
-+ dsh-molbio-tools file:D:/.../dsh-molbio-tools-0.22.0.tgz
++ dsh-molbio-tools file:D:/.../dsh-molbio-tools-0.22.2.tgz
 Packages: +1
 Done in 571ms
 ```
@@ -102,14 +106,19 @@ dsh web: http://127.0.0.1:50071/?token=...
 ```
 
 读回结果：`HTTP 200`、38180 字节；页面里的 `window.__DSH_BOOT__` 图包含
-`dsh-molbio-tools/client.js&rev=a25c3919676b`，即浏览器半被宿主 Loader 发现并进了客户端图——
+`dsh-molbio-tools/client.js&rev=…`（rev 是内容哈希，随产物变化），即浏览器半被宿主 Loader 发现并进了客户端图——
 这是"启动成功"的可观察证据，而不只是进程没退出。（先用 token 换 cookie，再带 cookie 读 `/`，
 否则第一跳是 303。）
 
+再用同一 cookie POST `/api/agentPresets/list` 与 `/api/pluginInventory/list`（envelope 见
+[rules.md](rules.md) 规则 1）：`broken` 为空（空数组时服务端直接省略该键），molbio-lab 的
+`tool-molbio` 为 `fiberPhase: "active"`——preset 里的 60 个工具**真的挂上了**，
+而不只是组合树正确。
+
 ### 3.3 卸载
 
 ```
-- dsh-molbio-tools file:D:/.../dsh-molbio-tools-0.22.0.tgz
+- dsh-molbio-tools file:D:/.../dsh-molbio-tools-0.22.2.tgz
 Done in 421ms
 ```
 
@@ -132,13 +141,15 @@ pnpm 的 hoisted linker 会在 `node_modules/` 留下一个指向仓库目录的
 ## 5. 仓库内验证（同一基线）
 
 ```
-node test/contract.mjs       → 16 checks passed（host 契约、client 产物、tarball 覆盖）
-node test/preset-health.mjs  → all 30 rows load on dsh 0.2.1-rc.3
+node test/contract.mjs       → 17 checks passed（host 契约、client 产物、tarball 覆盖、声明回退的突变自检）
+node test/preset-health.mjs  → all 30 rows load on dsh 0.2.1-rc.5
 node test/smoke.mjs          → registered 60 tools, all smoke tests passed
+node test/drift-probe.mjs    → 16/16（14 个突变全部被抓到）
+node benchmark/run.mjs --offline → 61 tasks checked against the shipped tools
 ```
 
-`test/release.mjs` 的 manifest 一致性断言通过；该文件末尾的 npm 版本探测在受限沙箱里
-会拿到 `EPERM`（Node 以管道捕获子进程输出被拒绝），属环境限制，不是插件问题。
+`test/release.mjs` 在完整权限的本地会话里整套通过（包括末尾的 npm 版本探测）；
+在受限沙箱里该探测会拿到 `EPERM`（Node 以管道捕获子进程输出被拒绝），属环境限制，不是插件问题。
 
 ## 6. 上架路径
 

package/docs/workflow.md

@@ -456,7 +456,7 @@ git status --short           # lib/client.js 与 packages/molbio-panel/lib/clien
 ### DSH 升级后：preset 组合的维护（必做）
 
 `preset/molbio-lab/agent.cordis.yml` 是官方 `standard` 预设的**行清单**副本 + 末尾一行
-`tool-molbio`（当前基线：**dsh 0.2.1-rc.3**）。它不会自动跟随 DSH 升级，因此每次升级
+`tool-molbio`（当前基线：**dsh 0.2.1-rc.5**）。它不会自动跟随 DSH 升级，因此每次升级
 DSH 后：
 
 1. 取新版的 shipped `standard`：

package/index.mjs

@@ -6914,15 +6914,46 @@ async function eutilsRequest(web, url, signal, label) {
   }
 }
 
+/** Credential-store references tried, in order, before the process environment. */
+const PUBMED_KEY_REFS = ['NCBI_API_KEY', 'MOLBIO_NCBI_API_KEY'];
+
+/**
+ * Resolve the NCBI API key from (1) the call argument, (2) the harness
+ * credential store, (3) the process environment.
+ *
+ * The store is the recommended channel: a stored value is not injected into the
+ * environment, so the agent's own shell children cannot read it by accident, and
+ * `ctx.credentials.resolve` itself falls back through the launch environment and
+ * the .env files. A provider that refuses this ref (a composition without a
+ * credential store, a name outside its grammar) must degrade to the environment
+ * rather than break the tool, hence the per-ref catch.
+ */
+async function pubmedKey(args, ctx) {
+  const explicit = typeof args.api_key === 'string' ? args.api_key.trim() : '';
+  if (explicit !== '') return explicit;
+  const credentials = ctx.get('credentials');
+  if (credentials !== undefined && typeof credentials.resolve === 'function') {
+    for (const ref of PUBMED_KEY_REFS) {
+      try {
+        const hit = await credentials.resolve(ref);
+        if (typeof hit?.value === 'string' && hit.value.trim() !== '') return hit.value.trim();
+      } catch {
+        /* fall through to the environment */
+      }
+    }
+  }
+  return pubmedApiKey(args);
+}
+
 const pubmedAbstractTool = (ctx) => define({
   name: 'molbio_pubmed_abstract',
-  description: 'Fetch PubMed abstracts for PMIDs via NCBI E-utilities (efetch). Requires the deployment to provide the web fetch capability; otherwise it reports that clearly. Pass api_key (or set NCBI_API_KEY / MOLBIO_NCBI_API_KEY) to attribute the request to your NCBI key and raise the rate limit. Use it to pull abstracts for papers found by molbio_pubmed_search before adding them to the library.',
+  description: 'Fetch PubMed abstracts for PMIDs via NCBI E-utilities (efetch). Requires the deployment to provide the web fetch capability; otherwise it reports that clearly. Provide an NCBI API key through the harness credential store (NCBI_API_KEY), the api_key argument, or the environment to attribute the request to your NCBI key and raise the rate limit. Use it to pull abstracts for papers found by molbio_pubmed_search before adding them to the library.',
   parameters: {
     type: 'object',
     required: ['pmids'],
     properties: {
       pmids: { type: 'array', items: { type: 'string' }, description: 'PubMed IDs, e.g. ["37607951"].' },
-      api_key: { type: 'string', description: 'Optional NCBI API key for E-utilities. Prefer setting NCBI_API_KEY in the environment: an inline key appears in the conversation transcript.' },
+      api_key: { type: 'string', description: 'Optional NCBI API key for E-utilities. Resolution order: this argument, the harness credential store (NCBI_API_KEY / MOLBIO_NCBI_API_KEY), then the environment. Prefer the credential store: an inline key appears in the conversation transcript.' },
     },
   },
   outputSchema: {
@@ -6966,7 +6997,7 @@ const pubmedAbstractTool = (ctx) => define({
     if (web === undefined || typeof web.fetch !== 'function') {
       throw new MolbioInputError('this deployment provides no web fetch capability, so PubMed abstracts cannot be retrieved; molbio_pubmed_search still works for titles and snippets');
     }
-    const apiKey = pubmedApiKey(args);
+    const apiKey = await pubmedKey(args, ctx);
     const url = pubmedFetchUrl(pmids, apiKey);
     const result = await web.fetch({ url }, exec?.signal);
     const body = result?.body?.content;
@@ -7318,14 +7349,14 @@ function paperServiceDeps(ctx, exec, args) {
 
 const pubmedSearchTool = (ctx) => define({
   name: 'molbio_pubmed_search',
-  description: 'Search PubMed for literature. With an NCBI API key (the api_key argument, or NCBI_API_KEY / MOLBIO_NCBI_API_KEY in the environment) it queries the official E-utilities API and returns PubMed records with PMIDs, titles, journal/year, authors and DOI; without a key it falls back to the harness web-search service. Add the papers you keep to the reading library with molbio_paper_add.',
+  description: 'Search PubMed for literature. With an NCBI API key (the api_key argument, the harness credential store under NCBI_API_KEY / MOLBIO_NCBI_API_KEY, or the environment) it queries the official E-utilities API and returns PubMed records with PMIDs, titles, journal/year, authors and DOI; without a key it falls back to the harness web-search service. Add the papers you keep to the reading library with molbio_paper_add.',
   parameters: {
     type: 'object',
     required: ['query'],
     properties: {
       query: requiredString('Search query, e.g. "CRISPR base editing review 2024" or "site:pubmed.ncbi.nlm.nih.gov KRAS G12D".'),
       max_results: { type: 'integer', description: 'Maximum results (1-20, default 8).' },
-      api_key: { type: 'string', description: 'Optional NCBI API key for the official PubMed E-utilities API. Prefer setting NCBI_API_KEY in the environment: an inline key appears in the conversation transcript.' },
+      api_key: { type: 'string', description: 'Optional NCBI API key for the official PubMed E-utilities API. Resolution order: this argument, the harness credential store (NCBI_API_KEY / MOLBIO_NCBI_API_KEY), then the environment. Prefer the credential store: an inline key appears in the conversation transcript.' },
     },
   },
   outputSchema: {
@@ -7378,7 +7409,7 @@ const pubmedSearchTool = (ctx) => define({
       throw new MolbioInputError('max_results must be an integer between 1 and 20');
     }
     const web = ctx.get('web');
-    const apiKey = pubmedApiKey(args);
+    const apiKey = await pubmedKey(args, ctx);
     if (apiKey !== undefined) {
       if (web === undefined || typeof web.fetch !== 'function') {
         throw new MolbioInputError('an NCBI API key was provided, but this deployment provides no web fetch capability; the official PubMed API needs ctx.web.fetch');
@@ -7574,9 +7605,9 @@ const PROMPT_SECTION = `Molecular-biology tools (dsh-molbio-tools) are available
 - Sequences & files: molbio_align (local alignment with a readable match line), molbio_msa_align (progressive multiple sequence alignment — pass an array of sequences or a workspace FASTA), molbio_conservation (consensus + per-column identity/conservation + variable positions; accepts aligned rows or raw sequences it aligns first), molbio_sequence_logo (draws the same alignment as a sequence logo SVG — pass the molbio_msa_align output rows as the alignment argument; letters are sized by per-position information content), molbio_fasta_fastq (FASTA/FASTQ stats/extract/convert/QC on workspace files), molbio_batch_analyze (run one summary/ORF/enzyme analysis over every matching FASTA/FASTQ/GenBank/.dna file in a directory and write one CSV/TSV table), molbio_extract_region (pull a CDS/promoter/region from a plasmid file by feature label or coordinates).
 - CRISPR: molbio_grna_design (family-aware guide RNAs over a sequence or plasmid file: cas_family spcas9/sacas9/cas12a/cas13a/cas13b/cas13d selects the PAM side, crRNA length, seed and target type — Cas12a uses a 5' TTTV PAM and 23 nt crRNA; Cas13 targets RNA and reports a PFS preference rather than a PAM. Both strands are scanned for DNA families, the sense strand by default for Cas13; guides are filtered on GC/poly-T/self-complementarity and ranked, with a mismatch-tolerant off-target search over the same sequence — reaching a whole genome simply means passing it as the target). Pass the top candidates on for ordering with save_path (CSV) or map_path (SVG map); the ranking is a heuristic and says so, so present it as candidate ranking, never as a validated efficiency prediction.
 - Map extras: pass gc_skew: true for the GC skew ring, show_unique_cutters: true to mark single-cutting enzymes on the map.
-- Literature & records: molbio_pubmed_abstract (fetch abstracts by PMID — needs web fetch; pass api_key or set NCBI_API_KEY to use your NCBI key), molbio_paper_export_bibtex (papers.json → .bib), molbio_protocol_add / molbio_protocol_list / molbio_protocol_update (protocols.json), molbio_experiment_log / molbio_experiment_list (experiments.json).
+- Literature & records: molbio_pubmed_abstract (fetch abstracts by PMID — needs web fetch; an NCBI key comes from the api_key argument, the credential store's NCBI_API_KEY, or the environment), molbio_paper_export_bibtex (papers.json → .bib), molbio_protocol_add / molbio_protocol_list / molbio_protocol_update (protocols.json), molbio_experiment_log / molbio_experiment_list (experiments.json).
 - Bench analysis (v19): molbio_fastq_qc (read-level QC for a FASTQ file: per-base quality with quartiles, per-read quality, base content, GC distribution, length, exact duplication, over-represented sequences, adapter screen, plus a report SVG — use it for "is this run good"), molbio_codon_usage (CAI/RSCU/Nc/GC3, rare-codon list and CDS CpG against E. coli/yeast/human — use it for "will this gene express"; it explains, molbio_codon_optimize rewrites), molbio_phylogenetic_tree (distance method: p-distance/JC/K2P/Tamura-Nei, UPGMA or neighbour-joining, bootstrap support, consensus, Newick file and an SVG tree — it is NOT a maximum-likelihood or Bayesian analysis, and bootstrap percentages are not p-values), molbio_pcr_simulate (where a primer pair amplifies: product sizes and coordinates on both strands, mismatch detail, the 3'-end exact-match requirement, circular templates, screening other templates, and an expected gel — use it for "what band will I see"), molbio_gc_composition (sliding-window GC, CpG islands under the Gardiner-Garden or Takai criteria, GC/AT skew with the cumulative-skew origin/terminus indication, dinucleotide obs/exp, entropy, complexity, N50/L50, plus a figure — use it for "is this a promoter or an origin").
-- Literature: molbio_pubmed_search — with an NCBI API key (api_key argument, or NCBI_API_KEY / MOLBIO_NCBI_API_KEY in the environment) it uses the official PubMed E-utilities API and returns PMIDs, titles, journal/year, authors and DOI; without a key it falls back to the harness web search. The reading library is molbio_paper_add / molbio_paper_list / molbio_paper_update / molbio_paper_remove (papers.json in the workspace).
+- Literature: molbio_pubmed_search — with an NCBI API key (api_key argument, the credential store under NCBI_API_KEY / MOLBIO_NCBI_API_KEY, or the environment) it uses the official PubMed E-utilities API and returns PMIDs, titles, journal/year, authors and DOI; without a key it falls back to the harness web search. The reading library is molbio_paper_add / molbio_paper_list / molbio_paper_update / molbio_paper_remove (papers.json in the workspace).
 
 Cloning workflow rules (follow them to avoid slow re-derivation):
 - To clone a sequence into a plasmid, call molbio_clone_simulate FIRST — pass the BARE insert with add_flanks: true and the tool adds the enzyme recognition sites itself. The tool also validates single cutting, insert orientation, and internal sites itself: never pre-verify enzymes, cutting counts, or flank construction by thinking. Its output already contains final_sequence AND the remapped feature coordinates (features field). NEVER recompute feature coordinates or insert positions by reasoning — always take them from the tool output.

package/lib/client.js

@@ -8517,6 +8517,44 @@ window.__ModuleLoader__.load({
 			  return undefined;
 			}
 
+			/** The credential reference the PubMed tools read first. */
+			const NCBI_KEY_REF = 'NCBI_API_KEY';
+
+			/**
+			 * Whether a Plugins-page detail subject is this package's own entry.
+			 *
+			 * Bundles and rows both expose `pkg.name`; the key section is offered on the
+			 * bundle page and on every row page the bundle declares, and on nothing else.
+			 */
+			function isMolbioDetailSubject(subject) {
+			  if (subject === null || typeof subject !== 'object') return false;
+			  if (subject.kind !== 'bundle' && subject.kind !== 'row') return false;
+			  const pkg = subject.pkg;
+			  return pkg !== null && typeof pkg === 'object' && pkg.name === 'dsh-molbio-tools';
+			}
+
+			/**
+			 * The host failure message carried by a Remote result, or '' on success.
+			 * Remote calls answer `{ ok: true, value }` or `{ ok: false, error }`.
+			 */
+			function remoteFailure(response) {
+			  if (response === null || typeof response !== 'object' || response.ok !== false) return '';
+			  const message = response.error?.message;
+			  return typeof message === 'string' && message !== '' ? message : 'the host refused the request';
+			}
+
+			/** One reference's view from a `credentials.describe` response (never the value). */
+			function credentialInfo(response, ref) {
+			  const view = response !== null && typeof response === 'object' && response.ok !== false
+			    ? response.value?.[ref]
+			    : undefined;
+			  return {
+			    configured: view?.configured === true,
+			    writable: view?.writable !== false,
+			    ...typeof view?.source === 'string' && view.source !== '' ? { source: view.source } : {},
+			  };
+			}
+
 			exports.PLASMID_EXTENSIONS = PLASMID_EXTENSIONS;
 			exports.ALIGNMENT_EXTENSIONS = ALIGNMENT_EXTENSIONS;
 			exports.extensionOf = extensionOf;
@@ -8541,6 +8579,10 @@ window.__ModuleLoader__.load({
 			exports.paperFields = paperFields;
 			exports.paperSummary = paperSummary;
 			exports.paperLink = paperLink;
+			exports.NCBI_KEY_REF = NCBI_KEY_REF;
+			exports.isMolbioDetailSubject = isMolbioDetailSubject;
+			exports.remoteFailure = remoteFailure;
+			exports.credentialInfo = credentialInfo;
 			return exports;
 		};
 		__molbio_modules["build/client-entry.mjs"] = () => {
@@ -8577,7 +8619,7 @@ window.__ModuleLoader__.load({
 			 * inside the factory would also have to be torn down by hand on unload.
 			 */
 			const { createElement: h, useEffect, useMemo, useRef, useState } = __ext0;
-			const { LIBRARY_FILE, childPath, classifyEntry, decodeWorkspaceBytes, filterPapers, isOpenable, libraryTags, logoSvg, mapCardSummary, mapCardView, paperFields, paperLink, paperSummary, parseAlignmentFile, parseLibrary, parsePlasmidFile, plasmidSvg, readWorkspaceText, sortEntries } = __molbio_require("build/panel-core.mjs");
+			const { LIBRARY_FILE, NCBI_KEY_REF, childPath, classifyEntry, credentialInfo, isMolbioDetailSubject, remoteFailure, decodeWorkspaceBytes, filterPapers, isOpenable, libraryTags, logoSvg, mapCardSummary, mapCardView, paperFields, paperLink, paperSummary, parseAlignmentFile, parseLibrary, parsePlasmidFile, plasmidSvg, readWorkspaceText, sortEntries } = __molbio_require("build/panel-core.mjs");
 			/** This implementation's identity, and the key its body/title register under. */
 			const PANEL_ID = 'dsh-molbio-tools';
 			/** Type discriminator the tab is opened by. */
@@ -9015,6 +9057,142 @@ window.__ModuleLoader__.load({
 			    h('div', { style: styles.main }, ...detail));
 			}
 
+			/** The state of the PubMed key, read from the host's credential store. */
+			async function readNcbiKey(remote) {
+			  if (remote?.credentials === undefined || typeof remote.credentials.describe !== 'function') {
+			    return { phase: 'error', configured: false, writable: false, message: 'This deployment exposes no credentials Remote (the settings controller is not mounted).' };
+			  }
+			  let response;
+			  try {
+			    response = await remote.credentials.describe([NCBI_KEY_REF]);
+			  } catch (error) {
+			    response = { ok: false, error: { message: error instanceof Error ? error.message : String(error) } };
+			  }
+			  const failure = remoteFailure(response);
+			  if (failure !== '') return { phase: 'error', configured: false, writable: false, message: failure };
+			  return { phase: 'ready', ...credentialInfo(response, NCBI_KEY_REF), message: '' };
+			}
+
+			const keyStyles = {
+			  section: { borderTop: '1px solid rgba(127, 127, 127, 0.28)', marginTop: 16, paddingTop: 12, display: 'grid', gap: 8 },
+			  title: { margin: 0, fontSize: 14 },
+			  note: { margin: 0, fontSize: 12, opacity: 0.75, lineHeight: 1.5 },
+			  status: { margin: 0, fontSize: 12 },
+			  row: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' },
+			  input: { flex: '1 1 240px', minWidth: 200, padding: '4px 8px' },
+			  message: { margin: 0, fontSize: 12 },
+			};
+
+			/**
+			 * The Plugins → installed plugin → detail section that stores the NCBI key.
+			 *
+			 * It renders only for this package's own subject (bundle page, or one of the
+			 * row pages the bundle declares) and returns null everywhere else, which is the
+			 * contract `plugins.detail.section` asks a contribution to honour. The value is
+			 * write-only from here: `credentials.describe` answers whether a key is
+			 * configured and where it came from, never the key itself.
+			 */
+			function NcbiKeySection({ subject, remote }) {
+			  const [draft, setDraft] = useState('');
+			  const [state, setState] = useState({ phase: 'loading', configured: false, writable: true, message: '' });
+			  const subjectToken = isMolbioDetailSubject(subject)
+			    ? `${subject.kind}:${subject.pkg.name}:${subject.row?.rowId ?? ''}`
+			    : '';
+			  useEffect(() => {
+			    if (subjectToken === '') return undefined;
+			    let live = true;
+			    const load = () => readNcbiKey(remote).then((next) => { if (live) setState(next); });
+			    load();
+			    // Another surface may rotate or clear the same reference (Settings, the
+			    // file watcher); follow the host event instead of showing a stale badge.
+			    const off = typeof remote?.$on === 'function'
+			      ? remote.$on('credentials/reference-updated', (ref) => { if (ref === NCBI_KEY_REF) load(); })
+			      : undefined;
+			    return () => {
+			      live = false;
+			      if (typeof off === 'function') off();
+			    };
+			  }, [remote, subjectToken]);
+			  if (!isMolbioDetailSubject(subject)) return null;
+			  const busy = state.phase === 'saving';
+			  const save = async () => {
+			    const value = draft.trim();
+			    if (value === '') return;
+			    if (remote?.credentials === undefined || typeof remote.credentials.set !== 'function') {
+			      setState((previous) => ({ ...previous, phase: 'error', message: 'This deployment exposes no credentials Remote (the settings controller is not mounted).' }));
+			      return;
+			    }
+			    setState((previous) => ({ ...previous, phase: 'saving', message: '' }));
+			    let response;
+			    try {
+			      response = await remote.credentials.set(NCBI_KEY_REF, value);
+			    } catch (error) {
+			      response = { ok: false, error: { message: error instanceof Error ? error.message : String(error) } };
+			    }
+			    const failure = remoteFailure(response);
+			    setDraft('');
+			    const next = await readNcbiKey(remote);
+			    setState(failure !== ''
+			      ? { ...next, phase: 'error', message: failure }
+			      : next.phase === 'error'
+			        ? next
+			        : next.configured === true
+			          ? { ...next, message: 'Saved. The next PubMed call uses this key.' }
+			          : { ...next, phase: 'error', message: 'The host accepted the write but still reports no key configured. Restart the profile and try again.' });
+			  };
+			  const remove = async () => {
+			    if (remote?.credentials === undefined || typeof remote.credentials.unset !== 'function') {
+			      setState((previous) => ({ ...previous, phase: 'error', message: 'This deployment exposes no credentials Remote (the settings controller is not mounted).' }));
+			      return;
+			    }
+			    setState((previous) => ({ ...previous, phase: 'saving', message: '' }));
+			    let response;
+			    try {
+			      response = await remote.credentials.unset(NCBI_KEY_REF);
+			    } catch (error) {
+			      response = { ok: false, error: { message: error instanceof Error ? error.message : String(error) } };
+			    }
+			    const failure = remoteFailure(response);
+			    const next = await readNcbiKey(remote);
+			    setState(failure !== ''
+			      ? { ...next, phase: 'error', message: failure }
+			      : next.phase === 'error'
+			        ? next
+			        : next.configured === false
+			          ? { ...next, message: 'Removed. PubMed search falls back to web search.' }
+			          : { ...next, phase: 'error', message: 'The host still reports a key configured after Remove.' });
+			  };
+			  const status = state.phase === 'loading'
+			    ? 'Checking the credential store…'
+			    : state.phase === 'error'
+			      ? 'Unavailable'
+			      : state.configured
+			        ? `Configured${state.source === undefined ? '' : ` (source: ${state.source})`}`
+			        : 'Not configured';
+			  return h('section', { 'data-molbio-ncbi-key': '', style: keyStyles.section },
+			    h('h4', { style: keyStyles.title }, 'PubMed API key'),
+			    h('p', { style: keyStyles.note }, 
+			      'Stored in the harness credential store. molbio_pubmed_search and molbio_pubmed_abstract use it for the official PubMed E-utilities API; without it they fall back to web search.'),
+			    h('p', { 'data-molbio-key-status': state.phase, style: keyStyles.status }, status),
+			    h('div', { style: keyStyles.row },
+			      h('input', {
+			        type: 'password',
+			        value: draft,
+			        placeholder: 'NCBI API key (36 characters)',
+			        autoComplete: 'off',
+			        spellCheck: false,
+			        'aria-label': 'NCBI API key',
+			        style: keyStyles.input,
+			        onChange: (event) => setDraft(event.target.value),
+			      }),
+			      h('button', { type: 'button', disabled: busy || state.writable === false || draft.trim() === '', onClick: save },
+			        busy ? 'Saving…' : 'Save'),
+			      h('button', { type: 'button', disabled: busy || state.writable === false || state.configured !== true, onClick: remove }, 'Remove')),
+			    state.message === '' ? null : h('p', { 'data-molbio-key-message': '', role: 'status', style: keyStyles.message }, state.message),
+			    h('p', { style: keyStyles.note },
+			      'Create a key under NCBI → Account Settings → API Key Management. Prefer this over an environment variable: the store is not inherited by shell commands.'));
+			}
+
 			/** Required browser services. */
 			const inject = ['slots', 'sidebarRightTabs', 'remote'];
 
@@ -9098,6 +9276,25 @@ window.__ModuleLoader__.load({
 			      key: toolName,
 			    }, MolbioMapCard)), `molbio panel: ${toolName} card`);
 			  }
+			  // Plugins -> the installed plugin's detail page: the one place a user can
+			  // store the NCBI key without editing a YAML file or exporting a variable.
+			  //
+			  // `remote.credentials` is a FIBER INJECTION, not merely a property on the
+			  // Remote carrier: the shipped settings pages declare it in `inject` for the
+			  // same reason. Without the declaration `ctx.remote.credentials` is undefined,
+			  // which is exactly how the first build of this section made Save a no-op.
+			  // The gate keeps the panel working in deployments that expose no credentials
+			  // namespace: the section simply never registers there.
+			  ctx.effect(() => {
+			    const gate = ctx.inject(['remote.credentials'], (keyCtx) => {
+			      keyCtx.effect(() => keyCtx.slots.inject('plugins.detail.section', () => keyCtx.slots.register({
+			        name: 'plugins.detail.section',
+			        id: 'molbio-ncbi-key',
+			        order: 100,
+			      }, (props) => h(NcbiKeySection, { ...props, remote: keyCtx.remote }))), 'molbio panel: NCBI key section');
+			    });
+			    return () => { gate.dispose(); };
+			  }, 'molbio panel: NCBI key section gate');
 			}
 
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "dsh-molbio-tools",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "Zero-dependency molecular-biology plugin bundle for the DeepSeek Harness: sequence analysis, primer design (incl. cross-intron qPCR primers, TaqMan hydrolysis/MGB probes with ordering CSV and multiplex compatibility), in-silico PCR, cloning simulation, SnapGene .dna parsing and plasmid maps, Sanger verification, protein tools (incl. helical wheel and hydropathy plots), methylation-aware restriction analysis with double-digest buffer checks, qPCR analysis and plotting, multiple sequence alignment that conserves every input residue, conservation analysis, sequence logos, codon-usage analysis, phylogenetic trees with bootstrap support, Newick I/O and long-name label wrapping, CpG-island/GC-skew composition analysis, read-level FASTQ QC, batch file analysis with CSV export, silent restriction-site mutagenesis, family-aware CRISPR gRNA design (SpCas9/SaCas9/Cas12a/Cas13) with off-target search, an opt-in hand-off that shows a generated plot to the model as an attached image, plus a browser-side right-sidebar panel (plasmid maps and sequence logos drawn in the Web GUI) and a literature/protocol/experiment record system.",
   "type": "module",
   "main": "index.mjs",
   "engines": {
-    "node": ">=26",
+    "node": ">=24",
     "dsh": ">=0.2.1-rc.2 <0.3.0-0"
   },
   "exports": {
@@ -96,7 +96,9 @@
       "dshReleases": {
         "0.2.1-rc.1": "unknown",
         "0.2.1-rc.2": "compatible",
-        "0.2.1-rc.3": "compatible"
+        "0.2.1-rc.3": "compatible",
+        "0.2.1-rc.4": "unknown",
+        "0.2.1-rc.5": "compatible"
       }
     },
     "bundle": {

package/test/client.mjs

@@ -101,6 +101,7 @@ assert.deepEqual([...module.inject], ['slots', 'sidebarRightTabs', 'remote'], 't
 
 const effects = [];
 const tabTypes = [];
+const injectedDeps = [];
 const slots = createSlotsStub();
 const ctx = {
   remote: {
@@ -122,9 +123,16 @@ const ctx = {
     effects.push(label);
     return factory();
   },
+  inject(deps, callback) {
+    injectedDeps.push([...deps]);
+    const child = Object.create(ctx);
+    child.remote = { ...ctx.remote, credentials: {} };
+    return { dispose() {}, value: callback(child) };
+  },
   sidebarRightTabs: { register(definition) { tabTypes.push(definition); return () => undefined; } },
   slots,
 };
+assert.deepEqual(injectedDeps, [], 'no dependency gate has run yet');
 assert.doesNotThrow(() => module.apply(ctx), 'apply() must not require any seat to be declared yet');
 
 assert.deepEqual(effects, [
@@ -136,7 +144,10 @@ assert.deepEqual(effects, [
   'molbio panel: papers tab title',
   'molbio panel: molbio_plasmid_map card',
   'molbio panel: molbio_plasmid_map_file card',
+  'molbio panel: NCBI key section gate',
+  'molbio panel: NCBI key section',
 ]);
+assert.deepEqual(injectedDeps, [['remote.credentials']], 'the key section waits for the credentials Remote namespace');
 assert.equal(tabTypes.length, 2, 'the package contributes two page tab types');
 assert.deepEqual(
   tabTypes.map((type) => [type.id, type.kind, type.title()]),
@@ -153,7 +164,7 @@ assert.deepEqual(tabTypes.map((type) => type.guide[0].order), [40, 41], 'the gui
 assert.equal(slots.registrations.length, 0, 'nothing registers before its seat exists');
 assert.deepEqual(
   slots.injectedSeats,
-  ['sidebar.right.pane.tab', 'sidebar.right.pane.tab.title', 'tool.call.toolview'],
+  ['sidebar.right.pane.tab', 'sidebar.right.pane.tab.title', 'tool.call.toolview', 'plugins.detail.section'],
   'each seat is claimed by waiting for its declaration, not by registering blindly',
 );
 // The shell's guard, reproduced on the stub: this is the exact exception a bare
@@ -169,8 +180,8 @@ slots.declare('sidebar.right.pane.tab');
 slots.declare('sidebar.right.pane.tab.title');
 assert.deepEqual(
   slots.pendingSeats,
-  ['tool.call.toolview'],
-  'the transcript card is still waiting for the seat ui-tool declares',
+  ['tool.call.toolview', 'plugins.detail.section'],
+  'the transcript card and the plugin-detail section wait for the seats their owners declare',
 );
 assert.equal(slots.registrations.length, 4, 'both tab bodies and titles land as soon as their seat exists');
 slots.declare('tool.call.toolview');
@@ -211,6 +222,39 @@ assert.equal(claim('tool.call.toolview', 'molbio_plasmid_map').registration.inje
 slots.declare('tool.call.toolview');
 assert.equal(slots.registrations.length, 6, 're-declaring the seat re-installs both cards instead of duplicating them');
 
+// The Plugins page's detail seat belongs to the plugin manager. The section
+// lands when that seat is declared, and the component itself decides whether
+// the open subject is this package.
+slots.declare('plugins.detail.section');
+assert.equal(slots.registrations.length, 7, 'the key section lands when the plugin manager declares its seat');
+const keyClaim = slots.registrations.find((entry) => entry.registration.name === 'plugins.detail.section');
+assert.ok(keyClaim, 'the key section is claimed in plugins.detail.section');
+assert.equal(keyClaim.registration.id, 'molbio-ncbi-key', 'the list seat is addressed by an id of our own');
+assert.equal(typeof keyClaim.component, 'function', 'the section is a component');
+// The registered component binds `remote`; invoking its element type is how a
+// test renders it without React (the hooks are stubbed by this file's reactStub).
+const ours = keyClaim.component({ subject: { kind: 'bundle', pkg: { name: 'dsh-molbio-tools' } } });
+assert.equal(typeof ours.type, 'function', 'the wrapper renders this package\'s section');
+const sectionTree = ours.type(ours.props);
+assert.equal(sectionTree.type, 'section');
+assert.equal(sectionTree.props['data-molbio-ncbi-key'], '');
+const flat = [];
+const walk = (node) => {
+  if (node === null || typeof node !== 'object') return;
+  flat.push(node);
+  for (const child of Array.isArray(node.children) ? node.children : []) walk(child);
+};
+walk(sectionTree);
+assert.ok(flat.some((node) => node.type === 'h4' && node.children.join('') === 'PubMed API key'), 'the section is titled');
+assert.ok(flat.some((node) => node.type === 'input' && node.props.type === 'password'), 'the section offers a password input');
+assert.ok(flat.some((node) => node.type === 'button' && node.children.join('') === 'Save'), 'the section offers a save control');
+const renderFor = (subject) => {
+  const wrapper = keyClaim.component({ subject });
+  return wrapper.type(wrapper.props);
+};
+assert.equal(renderFor({ kind: 'bundle', pkg: { name: 'another-plugin' } }), null, 'another package gets no section');
+assert.equal(renderFor({ kind: 'item', id: 'web-search' }), null, 'an official-plugin page gets no section');
+
 // ── 3. the panel's data path, against the real fixture ──────────────────────
 
 assert.equal(panelCore.extensionOf('pUC118.dna'), 'dna');
@@ -231,6 +275,21 @@ const sorted = panelCore.sortEntries([
 ]);
 assert.deepEqual(sorted.map((entry) => entry.name), ['a.dna', 'z.dna', 'a.fasta', 'notes.md']);
 
+// The plugin-detail key section's pure helpers: which subject it belongs to,
+// how a credential view is read, and how a refused Remote call is surfaced.
+assert.equal(panelCore.isMolbioDetailSubject({ kind: 'bundle', pkg: { name: 'dsh-molbio-tools' } }), true);
+assert.equal(panelCore.isMolbioDetailSubject({ kind: 'row', pkg: { name: 'dsh-molbio-tools' }, row: { rowId: 'molbio-client' } }), true);
+assert.equal(panelCore.isMolbioDetailSubject({ kind: 'bundle', pkg: { name: 'another-plugin' } }), false);
+assert.equal(panelCore.isMolbioDetailSubject({ kind: 'item', id: 'dsh-molbio-tools' }), false, 'official-plugin pages are not ours');
+assert.equal(panelCore.isMolbioDetailSubject(null), false);
+assert.deepEqual(
+  panelCore.credentialInfo({ ok: true, value: { NCBI_API_KEY: { configured: true, source: 'file', writable: true } } }, 'NCBI_API_KEY'),
+  { configured: true, writable: true, source: 'file' },
+);
+assert.deepEqual(panelCore.credentialInfo({ ok: true, value: {} }, 'NCBI_API_KEY'), { configured: false, writable: true });
+assert.equal(panelCore.remoteFailure({ ok: false, error: { message: 'credential/rejected: the store is unreadable' } }), 'credential/rejected: the store is unreadable');
+assert.equal(panelCore.remoteFailure({ ok: true, value: {} }), '', 'a successful result carries no failure');
+
 assert.equal(panelCore.childPath('D:\\work', 'a.dna'), 'D:\\work/a.dna');
 assert.equal(panelCore.childPath('', 'a.dna'), 'a.dna');