dsh-opendesign-corouter 0.0.0-stage → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KouzakiUmi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,124 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# OpenDesign CoRouter for DSH
+
+**模型接进来，额度看清楚。**
+
+在 DeepSeek Harness 中使用 CoRouter 模型，分开查看套餐赠送窗口与钱包余额；桌面登录态优先，也能独立登录。
+
+[![CI](https://github.com/KouzakiUmi/dsh-opendesign-corouter/actions/workflows/ci.yml/badge.svg)](https://github.com/KouzakiUmi/dsh-opendesign-corouter/actions/workflows/ci.yml)
+[![DSH Core](https://img.shields.io/badge/DSH_Core-0.2.1--rc.3-64748b)](#兼容性)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D24.9-64748b)](#开发与构建)
+
+[快速开始](#快速开始) · [功能预览](#功能预览) · [连接与凭据](docs/usage.md) · [常见问题](docs/troubleshooting.md) · [更新记录](docs/changelog.md)
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/previews/overview-dark.png">
+  <img src="docs/previews/overview-light.png" width="1040" alt="CoRouter 四层额度概览：套餐赠送窗口、套餐余额、充值赠送金额与总额度；模拟数据">
+</picture>
+
+<sub>真实组件 · 模拟数据 · 离线预览，不是运行中的 DSH 或真实账号截图</sub>
+
+</div>
+
+## 快速开始
+
+### 1. 通过 DSH 安装
+
+```console
+dsh plugin --profile web add dsh-opendesign-corouter
+```
+
+也可打开 [Actions → CI](https://github.com/KouzakiUmi/dsh-opendesign-corouter/actions/workflows/ci.yml)，从成功构建下载 **`dsh-opendesign-corouter-build`** artifact。登录 GitHub 后解压 ZIP，取得 `.tgz` 与 `.sha256`，再安装本地包：
+
+```console
+dsh plugin --profile web add /absolute/path/to/dsh-opendesign-corouter-0.1.2.tgz
+```
+
+`web` 只是示例，请替换为目标 Profile。Desktop 使用桌面安装器提供的 `dsh` 入口；独立公共 CLI 不能代管保留的 `desktop` Profile。安装后的启用与重载按目标 DSH 的管理流程进行。
+
+### 2. 配置连接
+
+1. 打开 **设置 → OpenDesign CoRouter → 连接与登录**。
+2. 为推理配置 CoRouter 工作空间 **API Key**，或沿用启动环境中的 `COROUTER_API_KEY`。
+3. 额度默认读取桌面登录态；没有桌面端时，点击 **登录并保存会话**，在官方页面自行完成登录。
+4. 回到模型选择器，选择 **OpenDesign CoRouter · 套餐赠送** 或 **OpenDesign CoRouter · 付费模型**。
+
+**API Key 用于推理，桌面 / 控制台会话用于查额度。两者不能互相代替。** [完整连接说明](docs/usage.md)
+
+## 功能预览
+
+### 两个 Provider，逐模型配置
+
+| Provider | 模型数 | 用途 |
+| --- | ---: | --- |
+| `opendesign-corouter-plan` | 12 | 官网 Design Plan 套餐赠送模型 |
+| `opendesign-corouter-paid` | 21 | 其余公开对话模型 |
+
+上表为内置目录。模型页可从 OpenAI `/models` 端口刷新，逐个启用或停用模型，并配置温度、top-p、默认输出上限、上下文预算及思考深度。停用同时影响模型选择器和直接调用；参数会保存并应用到实际请求。媒体生成接口不在对话目录中，未知能力不按名称猜测。
+
+推理协议可选 **OpenAI Chat Completions、OpenAI Responses、Anthropic Messages**。模型发现始终使用 OpenAI 端口，不随推理协议切换。
+
+> **分组不等于计费隔离。** 赠送额度耗尽后是否转扣套餐余额或钱包，由服务端和账号权益决定。选择“套餐赠送”不能保证绝不消耗钱包余额。
+
+### 四层额度，不重复相加
+
+- **套餐赠送窗口**：各自显示已用、剩余及重置时间。
+- **套餐余额**：订阅池的可用金额。
+- **充值 / 赠送金额**：钱包中对应池的可用金额。
+- **总额度**：接口报告的总余额，不再与分池数字重复相加。
+
+接口缺失或权限不足时显示未知 / 部分可用，不补成 0。窗口重置、订阅账期结束和下次自动刷新分别显示。桌面通道只有部分额度且已有完整独立会话时，会整体切换到独立会话并标明来源，不拼接账号数据。额度身份与推理 Key 的账号 / 工作区仍需保持一致。
+
+### 桌面优先，也能独立登录
+
+不复制或修改桌面配置。独立登录使用临时 Chrome 窗口，用户亲自完成官方登录与人机验证；验证通过才保存到 DSH 凭据服务。支持取消、超时和卸载清理，不触碰日常浏览器。
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/previews/theme-dark.png">
+  <img src="docs/previews/theme-light.png" width="1040" alt="连接与登录页，展示桌面优先开关、独立登录按钮和不回填的 API Key 输入框；模拟数据">
+</picture>
+
+### 空轮监控，只作用于赠送模型
+
+独立开关，默认开启。参考 [dsh-empty-turn-guard](https://github.com/FYTXY/dsh-empty-turn-guard)，将“正常 stop、没有工具调用、答案为空或只剩协议残渣”的工具对话标成 `EMPTY_RESPONSE`。
+
+监控不注入提示、不修改正文、不重放工具、不自动重启；实际重试交给宿主策略，**可能额外消耗额度**。付费 Provider 和无工具后台请求不启用这项附加监控。
+
+## 使用前先知道
+
+- **数字不是账单**：部分读取接口属于桌面 / 控制台私有协议，可能随上游变化。
+- **凭据不是加密承诺**：插件使用 DSH 凭据服务，不把 Key / Cookie 放进普通设置或回填网页；落盘保护仍取决于宿主凭据实现和本机权限。
+- **验证有范围**：已做类型检查、隔离 Loader 装载 / 卸载 / 重载、离线界面与主题检查；尚未完成本插件的真实账号登录、推理及生产 Profile 联调。
+
+## 兼容性
+
+| 项目 | 要求 / 证据 |
+| --- | --- |
+| 目标 DSH Core | `0.2.1-rc.3`，以官方同版本发布包验证 |
+| Core 声明范围 | `>=0.2.1-rc.3 <0.3.0-0`，范围内其他版本不代表已实测 |
+| Node.js | `>=24.9.0` |
+| 独立登录 | 本机 Google Chrome；插件不会自动下载 |
+| 默认推理接口 | `https://amr-link.open-design.ai/v1/chat/completions` |
+
+CI 在 Windows 与 Ubuntu 执行构建、类型检查及隔离测试；Ubuntu 另执行四页签浏览器和亮暗主题检查。通过 CI 不等于已安装或已通过真实账号验收。[开发与验证范围](docs/development.md)
+
+## 开发与构建
+
+```console
+git clone https://github.com/KouzakiUmi/dsh-opendesign-corouter.git
+cd dsh-opendesign-corouter
+npm ci --ignore-scripts
+npm run check
+npm run test:ui
+```
+
+本地 UI 测试需要 Chrome，页面使用模拟数据并阻断联网。源码 checkout 不包含预构建 `lib`；需要安装本地目录时，先运行构建。[开发与 CI](docs/development.md)
+
+## 文档与反馈
+
+[使用指南](docs/usage.md) · [排障](docs/troubleshooting.md) · [更新记录](docs/changelog.md) · [安全边界](SECURITY.md) · [第三方声明](THIRD_PARTY_NOTICES.md)
+
+通过 [Issues](https://github.com/KouzakiUmi/dsh-opendesign-corouter/issues) 反馈时，请附插件版本、DSH **Core** 版本和已脱敏的错误说明。不要贴 API Key、Cookie、凭据文件或含秘密的 URL。
+
+本项目采用 [MIT 许可](LICENSE)，上游版权声明见 [第三方声明](THIRD_PARTY_NOTICES.md)。版本标签通过 GitHub OIDC trusted publishing 发布到 npm，流程见 [发布说明](docs/publishing.md)。本项目与 OpenDesign、DeepSeek 无官方隶属关系。

package/SECURITY.md

@@ -0,0 +1,14 @@
+# 安全边界
+
+- 推理、桌面控制面和控制台 Cookie 分属独立通道，不互相替代鉴权材料。
+- API Key 与独立登录 Cookie 仅经 DSH 凭据服务写入插件专属记录；设置页只读取存在性和状态，不回填秘密。
+- 桌面配置只读。仅支持已核实的生产环境，控制令牌只能发送到 `https://amr-api.open-design.ai`。控制台和推理请求禁止自动跟随重定向。
+- 推理自定义地址由用户显式配置；除本机回环外要求 HTTPS，拒绝 URL 内嵌凭据、查询串与片段。
+- 额度分池不跨身份混合。桌面认证失效时，可回退到单独保存的控制台登录；权限不足和未知额度不伪装成 0。
+- 独立登录使用临时浏览器上下文。用户自行完成登录和验证；取消、超时和卸载关闭插件拥有的窗口。持久化成功是不可撤回的提交边界，之后取消不会假称已撤回。
+- `OPENDESIGN_VELA_PATH` 是用户信任的本地程序路径。插件仅以固定 argv 执行只读查询，不通过 shell；不校验该程序的签名或下载它。不要将此变量指向来源不明的程序。
+- RPC 使用严格白名单解析；原始错误正文、Cookie、请求头、Key 和桌面本地路径不进入状态返回。并发保存有版本冲突检测。
+- 请求、流空闲、额度接口、CLI、登录和 RPC 均有有界超时。停用插件会撤销 Provider / RPC 并中止自身请求。
+- 空轮守卫不发起自己的重试、不注入消息、不执行工具。宿主重试可能额外计费；该开关不能阻止上游自身的余额回退规则。
+
+依赖的控制台及桌面私有协议可能变化。遇到未识别响应时显示失败或部分未知，不推测登录成功、套餐不存在或额度已清零。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,39 @@
+# 第三方代码与资料
+
+本项目的消息/图片兼容处理、套餐模型元数据参考 [dsh-opendesign-go 0.1.9](https://github.com/EliteOtaku/dsh-opendesign-go)。额度归一化和临时浏览器登录流程改编自 [dsh-subusage 0.16.2](https://github.com/KouzakiUmi/dsh-subusage)。空轮判定参考 [dsh-empty-turn-guard 0.4.0](https://github.com/FYTXY/dsh-empty-turn-guard)。设置布局参考 [dsh-code-pill](https://github.com/KouzakiUmi/dsh-code-pill)。
+
+离线主题夹具使用 [DeepSeek Harness 官方主题令牌](https://github.com/deepseek-ai/deepseek-harness/blob/22ddee3792402c3e70ec5f86a63c3e3e895a2f60/packages/client/ui-theme/src/styles/design-platform.css)，仅供测试，不随插件安装包分发。
+
+Client bundle 内含 [Zod 4.6.6](https://github.com/colinhacks/zod) 与 DSH 协议辅助代码，分别保留 Colin McDonnell 与 DeepSeek 的 MIT 声明。
+
+以上项目为 MIT 许可。保留如下版权和许可声明，适用于相应移植与改编部分：
+
+```text
+MIT License
+
+Copyright (c) 2026 EliteOtaku
+Copyright (c) 2026 KouzakiUmi
+Copyright (c) 2026 FYTXY
+Copyright (c) 2026 DeepSeek
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+模型 ID / 分组来自 [CoRouter 官方目录](https://corouter.open-design.ai/zh/models/) 与 [官方套餐页](https://corouter.open-design.ai/zh/)，观察日期 2026-10-26。仅使用接入所需事实，不分发 OpenDesign 客户端代码、资源或账号数据。

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+- insert:
+    - id: llm-opendesign-corouter
+      name: dsh-opendesign-corouter
+      config: {}

package/lib/adapter.d.ts

@@ -0,0 +1,27 @@
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmResolvedModelInfo, type PreparedAdapterCall, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment';
+import { type CatalogModel } from './catalog.js';
+import { type RuntimeConfig } from './config.js';
+export interface AdapterOptions {
+    config(): RuntimeConfig;
+    models?(): readonly CatalogModel[];
+    apiKey(ref: string): Promise<string | undefined>;
+    imageDataUrl?(image: ImageAttachmentRef, signal: AbortSignal): Promise<string | undefined>;
+    onEmptyTurn?(): void;
+    fetch?: typeof fetch;
+}
+export declare class CoRouterAdapter extends LlmAdapter {
+    #private;
+    readonly options: AdapterOptions;
+    constructor(options: AdapterOptions);
+    dispose(): void;
+    providerInfo(provider: string): {
+        id: string;
+        name: string;
+    };
+    private modelOf;
+    listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
+    prepareCall(provider: string, model: string, signal?: AbortSignal): Promise<PreparedAdapterCall>;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+}

package/lib/auth.d.ts

@@ -0,0 +1,132 @@
+import type { Session, SessionSource } from './quota.js';
+/** Control-plane origin the desktop build ships with (open-design-config.json / daemon default). */
+export declare const DEFAULT_API_URL = "https://amr-api.open-design.ai";
+/** The one host this plugin is willing to send an account token to. */
+export declare const API_HOST = "amr-api.open-design.ai";
+/** Profiles the official client recognizes; anything else falls back to `prod`. */
+export declare const DESKTOP_PROFILES: readonly ["prod", "test", "feature-test", "local"];
+export type DesktopProfile = (typeof DESKTOP_PROFILES)[number];
+export declare const DEFAULT_PROFILE: DesktopProfile;
+/** Reference names holding a console session cookie, read through the credential seam. */
+export declare const COOKIE_ENV_REFS: readonly ["OPEN_DESIGN_COOKIE", "OPEN_DESIGN_SESSION"];
+/**
+ * Exactly one accepted origin. `apiUrl` comes from a file this plugin does not own, so an
+ * edited or attacker-supplied value must never receive the account token: without this gate,
+ * pointing `apiUrl` anywhere would exfiltrate the desktop `controlKey`. A sibling subdomain is
+ * not accepted either — no widening "just in case" (`*.open-design.ai` would already be wrong).
+ */
+export declare function isOfficialApiUrl(raw: string): boolean;
+/** Canonical `https://host` form, or `undefined` when the value is not an official origin. */
+export declare function normalizeApiUrl(raw: string | undefined): string | undefined;
+/** Profile selection matches the client: `OPEN_DESIGN_AMR_PROFILE` wins over `VELA_PROFILE`. */
+export declare function resolveProfile(env?: NodeJS.ProcessEnv): DesktopProfile;
+/** `AMR_HOME` (with `~` / `~/x` expansion), else `<home>/.amr` — the client's `configDir()`. */
+export declare function desktopConfigDir(env?: NodeJS.ProcessEnv, home?: string): string;
+/** Full path of the desktop credential file. */
+export declare function desktopConfigPath(env?: NodeJS.ProcessEnv, home?: string): string;
+/** What the desktop file says about one profile. Values are held in memory only. */
+export interface DesktopCredential {
+    profile: DesktopProfile;
+    controlKey: string;
+    /** Present only when the profile carries an official origin. */
+    apiUrl?: string;
+    plan?: string;
+    /** `runtimeKey` present means the desktop considers itself signed in. */
+    signedIn: boolean;
+}
+export type DesktopRead = {
+    state: 'missing';
+} | {
+    state: 'unreadable';
+} | {
+    state: 'invalid';
+} | {
+    state: 'incomplete';
+    profile: DesktopProfile;
+}
+/** The profile's `apiUrl` is not the one accepted origin: never used, and never retried elsewhere. */
+ | {
+    state: 'unsafe-api-url';
+    profile: DesktopProfile;
+}
+/** A non-`prod` profile: its token belongs to another environment, so it is not sent to prod. */
+ | {
+    state: 'unsupported-profile';
+    profile: DesktopProfile;
+} | {
+    state: 'credential';
+    credential: DesktopCredential;
+};
+/**
+ * Parse `config.json` text. Never throws and never returns the raw text, so callers can
+ * treat a hostile file as "absent" without risking a leak. `state: 'invalid'` means the
+ * JSON or its shape was not what the client writes.
+ */
+export declare function parseDesktopConfigText(text: string, profile?: DesktopProfile): DesktopRead;
+export interface DesktopDeps {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    profile?: DesktopProfile;
+    readFile?: (path: string) => Promise<string>;
+}
+/**
+ * Read the desktop credential, distinguishing "no desktop installed or signed out"
+ * (`missing` / `incomplete`) from "there is a file but it cannot be used"
+ * (`unreadable` / `invalid`). The two must not be conflated: the first is normal for
+ * users without the desktop app, the second deserves a different hint.
+ */
+export declare function readDesktopCredential(deps?: DesktopDeps): Promise<DesktopRead>;
+/** Cookie payload persisted through the credential seam as a `grant` record. */
+export interface LoginGrant {
+    cookie: string;
+    /** Epoch ms; `0`/absent means the console declared no expiry. */
+    expiresAt?: number;
+}
+export type AuthSource = 'desktop' | 'login' | 'environment';
+export interface AuthSession extends Session {
+    source: SessionSource;
+    via: AuthSource;
+    apiUrl: string;
+    /** Desktop profile name, when the session came from the desktop file. */
+    profile?: string;
+    plan?: string;
+}
+export type AuthReason = 'no-credential' | 'desktop-incomplete' | 'desktop-unreadable' | 'unsafe-api-url' | 'unsupported-profile';
+export type AuthOutcome = {
+    state: 'ready';
+    session: AuthSession;
+    warnings: AuthReason[];
+} | {
+    state: 'need-login';
+    reason: AuthReason;
+    warnings: AuthReason[];
+};
+export interface AuthDeps extends DesktopDeps {
+    /** Allow reading the desktop login state; `false` for users who only use this plugin's login. */
+    useDesktop?: boolean;
+    /** Read the persisted login grant (Host-owned credential store). */
+    readGrant?: () => Promise<LoginGrant | undefined>;
+    /** Resolve an environment-variable reference (Host-owned credential seam). */
+    resolveRef?: (ref: string) => Promise<string | undefined>;
+    now?: () => number;
+}
+/** Desktop `controlKey` as a Bearer header (daemon evidence: `/api/v1/wallet/balance`). */
+export declare function desktopSession(credential: DesktopCredential, apiUrl?: string): AuthSession;
+/** A persisted or environment-supplied console cookie as a `cookie` header. */
+export declare function cookieSession(cookie: string, source: SessionSource, apiUrl?: string): AuthSession | undefined;
+/**
+ * Resolve the session in the order the user asked for: **desktop first**, then the
+ * cookie saved by this plugin's own login, then environment references.
+ *
+ * A desktop config whose `apiUrl` is not an official origin is *skipped*, not used: the
+ * token must not travel to a host the plugin cannot vouch for. The skip is reported as a
+ * warning so a UI can explain why the desktop session was ignored.
+ */
+export declare function resolveSession(deps?: AuthDeps): Promise<AuthOutcome>;
+/** Endpoint builders for a resolved origin, mirroring `quota.ts` for non-default hosts. */
+export declare function endpoints(apiUrl: string): {
+    base: string;
+    current: string;
+    summary: string;
+    usage: (workspaceId: string) => string;
+};

package/lib/catalog.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CoRouter 模型目录（仅对话模型，供 llm 适配器的模型选择器使用）。
+ *
+ * 取证来源：
+ * - 模型 ID / 显示名 / 供应商 / 单价：`https://corouter.open-design.ai/zh/models/<slug>/`
+ *   详情页内联 `data-model="{...}"` JSON（公开页面，2026-10-26）。
+ * - group：官网首页套餐卡 `https://corouter.open-design.ai/zh/` 的
+ *   `data-model-module="design-plan"` 12 款归 `plan`；其余在售对话模型归 `paid`。
+ * - `plan` 12 款的 contextWindow / maxOutputTokens / inputModalities / reasoningEfforts
+ *   来自 Go 侧 `dsh-opendesign-go` 0.1.9 的 MODEL_DEFAULTS（同一 `amr-link` endpoint 部署资料），
+ *   由父会话移植，**未经官网独立复核**；只用于 plan 通道。
+ * - 客户端桌面安装（Open Design 0.26.1）不内联 CoRouter 目录；其
+ *   `vela model preset --format json` 只有 11 个旧预设 id（见 docs/client-evidence.md），
+ *   与本表不同代，故不用于本目录。
+ *
+ * 分组语义（重要）：`plan`/`paid` 是**本插件本地目录分类**，用于把“套餐赠送通道”与
+ * “其余付费通道”拆成两个 Provider，不是上游强制计费契约。最终可用性、扣哪个额度池、
+ * 是否先扣 Design Plan 额度再用套餐模型/钱包额度，全部由服务端按账号套餐决定。
+ * `paid` 21 款里只有 8 款出现在官网套餐可抵扣名单，其余 13 款同样可经钱包/按量付费调用，
+ * 因此 `paid` 收录 21 款而不是 13 款。
+ *
+ * 未收录（证据不足，不猜测）：
+ * - 套餐模型组中尚未公开精确 ID 的 `Muse Spark 1.3`、`Gemini 4 Argon`：
+ *   前者详情页没有 `data-model`/模型 ID，后者在模型目录里没有详情页。
+ * - 媒体模型 `GPT Image 2`、`Nano Banana 2`、`Seedream 5 Lite / Pro`：
+ *   走 `/api/v1/media/*`，不应出现在对话模型列表里，避免选中后 chat 请求必败。
+ *
+ * `paid` 21 款的能力字段一律缺省：既没有官网数值，也没有可信默认表，
+ * 不按名称推断图像能力，也不给未知项填 `['text']` 谎称不支持图像。
+ */
+export interface CatalogModel {
+    id: string;
+    name: string;
+    group: 'plan' | 'paid';
+    contextWindow?: number;
+    maxOutputTokens?: number;
+    inputModalities?: readonly ('text' | 'image')[];
+    reasoningEfforts?: readonly string[];
+}
+/**
+ * 顺序按供应商分组（与官网模型目录导航一致）；`plan` 为 Design Plan 额度覆盖的 12 款，
+ * 其余 21 款公开对话模型归 `paid`。
+ */
+export declare const MODELS: readonly CatalogModel[];
+export declare function modelsFor(group: 'plan' | 'paid'): readonly CatalogModel[];
+export declare function findModel(id: string): CatalogModel | undefined;

package/lib/client.d.ts

@@ -0,0 +1,192 @@
+import * as React from 'react';
+import openDesignCoRouterRemote, { type CoRouterRemote } from './generated/typert.remote-client.js';
+import type { TypertClientRemote } from '@deepseek-ai/dsh-typert-protocol';
+import { type Status, type StatusModel } from './remote.js';
+import type { QuotaSnapshot, QuotaWindow } from './quota.js';
+import { type ApiProtocol } from './protocol-options.js';
+import type { ModelSettings, ModelSettingsMap } from './model-settings.js';
+declare const TABS: readonly [{
+    readonly id: "overview";
+    readonly label: "概览";
+}, {
+    readonly id: "models";
+    readonly label: "模型";
+}, {
+    readonly id: "connection";
+    readonly label: "连接与登录";
+}, {
+    readonly id: "advanced";
+    readonly label: "高级";
+}];
+type TabId = typeof TABS[number]['id'];
+export type RpcCaller = <T>(method: keyof CoRouterRemote, request?: unknown) => Promise<T>;
+export interface FormValues {
+    emptyTurnGuard?: boolean;
+    useDesktopCredential?: boolean;
+    baseURL?: string;
+    apiKeyEnv?: string;
+    apiProtocol?: ApiProtocol;
+    modelSettings?: ModelSettingsMap;
+    quotaRefreshSeconds?: number;
+    requestTimeoutMs?: number;
+    streamIdleTimeoutMs?: number;
+}
+export interface FormSnapshot {
+    status: 'loading' | 'ready' | 'unavailable';
+    value: FormValues | undefined;
+    writable: boolean;
+}
+export interface ConfigForm {
+    getSnapshot(): FormSnapshot;
+    subscribe(listener: () => void): () => void;
+    set(field: string, value: unknown): Promise<boolean>;
+}
+export interface ConfigForms {
+    get(namespace: string): ConfigForm;
+}
+export interface SlotDescriptor<P> {
+    name: 'settings.section';
+    id: string;
+    order: number;
+    label: () => string;
+    inject: () => P;
+}
+export interface Slots {
+    inject(name: 'settings.section', register: () => void | (() => void)): void | (() => void);
+    register<P>(descriptor: SlotDescriptor<P>, component: React.ComponentType<P>): void | (() => void);
+}
+export interface ClientContext {
+    remote: TypertClientRemote & {
+        $mount(contribution: typeof openDesignCoRouterRemote): Promise<() => void>;
+    };
+    effect(effect: () => void | (() => void) | Promise<void | (() => void)>, label?: string): void;
+    inject(services: ['configForms'], apply: (ctx: ConfigScope) => void): void;
+    inject(services: ['remote.openDesignCoRouter'], apply: (ctx: RemoteScope) => void): void;
+}
+export interface RemoteScope {
+    remote: TypertClientRemote;
+    effect(effect: () => void | (() => void), label?: string): void;
+}
+export interface ConfigScope {
+    configForms: ConfigForms;
+    slots: Slots;
+    effect(effect: () => void | (() => void), label?: string): void;
+}
+export interface SettingsProps {
+    caller: RpcCaller;
+    form: ConfigForm;
+}
+interface Notice {
+    kind: 'status' | 'error';
+    text: string;
+}
+export declare function formatUsd(value: number | undefined): string;
+export declare function formatTime(value: string | undefined): string;
+/** Token capacities use the same zh-CN grouping as amounts so large windows stay readable. */
+export declare function formatTokens(value: number | undefined): string;
+export interface QuotaViewProps {
+    quota: QuotaSnapshot | undefined;
+    nextAutoRefreshAt?: string | undefined;
+    refreshIntervalSeconds?: number | undefined;
+}
+/** Earliest still-future window reset; quota recovery comes only from `windows[].resetsAt`. */
+export declare function nextWindowResetAt(windows: readonly QuotaWindow[], now: number): string | undefined;
+export declare function QuotaView({ quota, nextAutoRefreshAt, refreshIntervalSeconds }: QuotaViewProps): React.DetailedReactHTMLElement<{
+    className: string;
+    role: "status";
+}, HTMLElement> | React.FunctionComponentElement<{
+    children?: React.ReactNode | undefined;
+}>;
+/** Whole-map model settings writer: absent entry means "inherit every default". */
+export declare function writeModelSettings(map: ModelSettingsMap | undefined, id: string, next: ModelSettings | undefined): ModelSettingsMap;
+/** One model's explicit settings; unknown ids read as "no overrides". */
+export declare function modelSettingsEntry(map: ModelSettingsMap | undefined, id: string): ModelSettings;
+/**
+ * Explicit settings always win. When the settings map is authoritative (a ready form snapshot or
+ * the Host's mirror), an absent entry means "enabled"; only a non-authoritative view falls back to
+ * `Status.models[].enabled`, which can lag one refresh behind a reset.
+ */
+export declare function modelEnabled(model: StatusModel, settings: ModelSettings | undefined, authoritative?: boolean): boolean;
+export interface NumberInputSpec {
+    label: string;
+    min: number;
+    max: number;
+    integer?: boolean;
+    allowEmpty?: boolean;
+}
+export type NumberInputResult = {
+    ok: true;
+    value: number | undefined;
+} | {
+    ok: false;
+    message: string;
+};
+/** Parse a label-bound numeric setting; an empty string means "inherit" when allowed. */
+export declare function parseNumberInput(raw: string, spec: NumberInputSpec): NumberInputResult;
+/** Absolute endpoint of the selected protocol; the gateway itself stays read-only. */
+export declare function protocolEndpoint(baseURL: string, protocol: ApiProtocol): string;
+export declare function normaliseQuotaRefreshSeconds(value: number | undefined): number | undefined;
+export interface QuotaAutoRefresh {
+    delayMs: number;
+    at: string;
+    intervalSeconds: number;
+}
+/**
+ * Schedule the next quota refresh: the automatic interval normally, or earlier when the Host's
+ * cache policy reports its next planned read (`nextRefreshAt`, which is never a quota reset).
+ * During failure backoff the host plan wins, even when the normal interval is shorter.
+ * A timestamp that is already past must not create a 0 ms retry loop, so it falls back to the
+ * regular interval instead of hammering the console.
+ */
+export declare function quotaAutoRefresh(secondsRaw: number | undefined, nextRefreshAt: string | undefined, now: number, backingOff?: boolean): QuotaAutoRefresh | undefined;
+export interface OverviewProps {
+    status: Status | undefined;
+    busy: boolean;
+    onRefresh: () => void;
+    nextAutoRefreshAt?: string | undefined;
+    refreshIntervalSeconds?: number | undefined;
+}
+export declare function Overview({ status, busy, onRefresh, nextAutoRefreshAt, refreshIntervalSeconds }: OverviewProps): React.FunctionComponentElement<{
+    children?: React.ReactNode | undefined;
+}>;
+export interface ModelRowProps {
+    model: StatusModel;
+    settings: ModelSettings;
+    /** Whether an absent settings entry means enabled rather than the host catalog flag. */
+    authoritative: boolean;
+    writable: boolean;
+    pending: boolean;
+    onCommit: (next: ModelSettings | undefined) => Promise<boolean>;
+}
+export declare function ModelRow({ model, settings, authoritative, writable, pending, onCommit }: ModelRowProps): React.DetailedReactHTMLElement<{
+    className: string;
+}, HTMLElement>;
+export interface ModelsProps {
+    status: Status | undefined;
+    formSnapshot: FormSnapshot;
+    setFormField: (field: string, value: unknown) => Promise<boolean>;
+    pendingField: string | null;
+    onRefreshModels: () => void;
+    refreshingModels: boolean;
+    notice: Notice | null;
+}
+export declare function Models({ status, formSnapshot, setFormField, pendingField, onRefreshModels, refreshingModels, notice }: ModelsProps): React.FunctionComponentElement<{
+    children?: React.ReactNode | undefined;
+}>;
+export interface AdvancedProps {
+    status: Status | undefined;
+    formSnapshot: FormSnapshot;
+    setFormField: (field: string, value: unknown) => Promise<boolean>;
+    pendingField: string | null;
+}
+export declare function Advanced({ status, formSnapshot, setFormField, pendingField }: AdvancedProps): React.FunctionComponentElement<{
+    children?: React.ReactNode | undefined;
+}>;
+export declare function tabAfter(current: TabId, key: string): TabId | undefined;
+export declare function SettingsPage({ caller, form }: SettingsProps): React.DetailedReactHTMLElement<{
+    className: string;
+}, HTMLElement>;
+export declare const name = "dsh-opendesign-corouter";
+export declare const inject: string[];
+export declare function apply(ctx: ClientContext): void;
+export {};