dsh-provider-show 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MosCloud
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,225 @@
-# Temporary Holding Version
+# dsh-provider-show
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![check](https://github.com/MosCloud/dsh-provider-show/actions/workflows/check.yml/badge.svg)](https://github.com/MosCloud/dsh-provider-show/actions/workflows/check.yml)
+
+在 DSH 输入框右下角的「模型 · 推理强度」前面，补上**当前模型所属的供应商**。
+
+已被其他插件接管的供应商（例如 WorkBuddy）保持原样，不重复显示。
+
+---
+
+## 它解决什么问题
+
+DSH 的模型选择器（composer 模型位）自带两项信息：
+
+| 位置 | 内容 | 由谁渲染 |
+|---|---|---|
+| 模型名 | `DeepSeek-V4.1-Flash` | 宿主，经 `conversation.input.model.label` slot |
+| 推理强度 | `Default` / `High` | 宿主，非 slot |
+
+**缺的是第三项：这是哪个供应商的模型。**
+
+第三方插件接管某个供应商后会自己补上这一项（WorkBuddy 画 `WB CN · 2,987`、倍率、促销角标），
+但没有任何插件接管的供应商（例如你在设置里自建的火山方舟路由）就只有「模型 · 推理强度」，
+看不出模型来自哪里。
+
+本插件补齐这个缺口，并遵守一条让位规则：
+
+> **供应商已被第三方插件接管 ⇒ 我方完全不渲染；否则 ⇒ 我方显示供应商名。**
+
+## 效果
+
+```
+未接管（火山方舟）      火山方舟   DeepSeek V4.1 Flash · Default      ← 我方新增「火山方舟」
+已接管（WorkBuddy）                DeepSeek-V4.1-Flash · x0.11 …       ← 我方不出现
+```
+
+芯片挂在模型选择器**左侧、同一条 flex 行**上，只显示供应商名：
+模型名与推理强度宿主已经画了，重复即噪声。
+
+## 安装
+
+```bash
+dsh plugin --profile <你的-profile> add /path/to/dsh-provider-show
+```
+
+或在插件管理页安装该本地目录。安装后**刷新页面**。
+
+卸载同样通过插件管理页，或从 profile 的插件清单移除。
+
+## 判定规则
+
+「是否已被第三方插件接管」由 Host 半读取 LLM 目录后判定，优先级从上到下：
+
+| 顺序 | 规则 | 结果 |
+|---|---|---|
+| 1 | `overrides[providerId]` 显式配置 | `third-party` 让位 / `mine` 显示 / `hide` 不显示 |
+| 2 | `settingsNs` 不在 `coreNamespaces` 内 | 判定为**已被插件接管**，让位 |
+| 3 | 目录里查不到该 provider，或目录不可读 | 判定为**未知**，**照常显示**（fail-open） |
+
+`settingsNs` 是「注册该 provider 的 Loader entry id」：
+
+- `llm-pi-ai` —— 你在设置里自建的 API 路由（火山、OpenRouter、任何 OpenAI 兼容服务）
+- `llm-deepseek` / `llm-deepseek-account` —— 官方 DeepSeek 两条路由
+- 其他任何值 —— 某个插件用**自己的** entry id 注册的，例如 `dsh-connect-workbuddy`
+
+### 为什么探测失败时选择「显示」而不是「隐藏」
+
+漏显只是信息不全，与插件没装时一样；
+误判为「已接管」会让**所有**供应商都不显示，属于明显回归。
+两种错误代价不对等，所以默认显示。
+
+## 配置
+
+写在 profile 的 `cordis.patch.yml`，或插件条目的 `config`。**每一项都有默认值，
+但一处配置会替换整个 `config` 对象，所以只写需要改的键即可，其余键自动取默认。**
+
+```yaml
+- id: dsh-provider-show
+  name: dsh-provider-show
+  config:
+    # 总开关（默认 true）
+    enabled: true
+
+    # 供应商短名，覆盖目录里的显示名
+    shortNames:
+      volcano-api: 火山
+
+    # 强制某个 provider 的处置
+    overrides:
+      some-connector-provider: third-party   # 让位给接管它的插件
+      another-provider: mine                 # 即使探测说被接管，也照常显示
+      noisy-provider: hide                   # 不显示，但不声称它被别人接管
+
+    # 宿主自有的 settings 命名空间；宿主升级新增内置 provider 时可扩展
+    coreNamespaces:
+      - llm-pi-ai
+      - llm-deepseek
+      - llm-deepseek-account
+```
+
+## 架构
+
+```
+lib/ownership.js      纯函数：归属判定 + 文案选择（无任何 import，两侧共用）
+lib/index.js          Host 半：读 LLM 目录 → 决策 → GET /plugins/dsh-provider-show/providers
+lib/client.js         Client 半：注册 conversation.input.right，读宿主文档并渲染
+```
+
+### 三个关键设计取舍
+
+**1. 用 `conversation.input.right`，不用 `conversation.input.model.label`**
+
+`input.model.label` 是 `single` slot：同优先级二次注册会**直接抛错**，
+且 workbuddy 已用 `priority: -0.5` 占位、压制了宿主的 1017 徽标。
+去抢那一格必然与第三方插件冲突。
+
+`input.right` 是 `list` slot（`replaceRisk: "none"`），用独有 id 叠加，
+渲染位置恰好就在模型选择器左边同一条 flex 行（`ui-conversation` 中
+`.standardControls` 的子节点顺序即 `input.right` → `input.model`）。
+
+代价：芯片宽度计入 `.trailing`，会让模型名**更早**折叠成图标，
+所以芯片有 `max-width: 140px` 与省略号截断，并用 `margin-inline-end:-10px`
+抵消宿主的 12px 栅格间距。
+
+**排版对齐：靠"同度量"，不靠位移**（由 `scripts/verify.mjs` 守住）
+
+| 约束 | 原因 |
+|---|---|
+| `font-size:13px` + `font-weight:400` + `line-height:20px` + `height:28px` + `align-items:center`，且**不声明 `font-family`** | 与模型触发器 `.htuFrW_trigger` 完全同一套度量。行盒内基线位置是 `half-leading + ascent`，**由字号与字体决定、与 `line-height` 无关**；度量相同 ⇒ 基线自动重合，不需要任何对齐技巧。 |
+| `margin-inline-end:-10px`、自身 `padding:0` | 宿主 `.standardControls` 有 12px `gap`，模型触发器又有 8px 左内边距；不补偿则两标签相距约 20px，补偿后约 10px，读作一行。 |
+| **禁止 `translateY`** | 见下节。任何人再想加中文补偿，`verify.mjs` 会直接判红。 |
+
+### 中文曾经"不居中"的真相（有实测数据）
+
+早期我在 12px 字号下看到中文偏高，推断是"汉字占满 em 框、无下伸部"导致的，于是加了位移补偿。
+**这个推断在字号不一致的前提下才成立，字号对齐后就不成立了。**
+
+从 2 倍截图里量每个文字块的墨迹质心（1 CSS px = 2 图像 px）：
+
+| 文字块 | 墨迹行范围 | 质心 |
+|---|---|---|
+| `火山` | 19..43 | **33.12** |
+| `DeepSeek` | 19..42 | 29.80 |
+| `Flash` | 19..38 | 28.90 |
+| `×0.20` | 19..38 | 28.76 |
+| `High` | 19..42 | 30.02 |
+
+拉丁质心均值约 **29.4**。加上 `+2px` 补偿后汉字质心 33.12，比拉丁**低 3.7 图像 px ≈ 1.85 CSS px**；
+去掉补偿正好落到 29.1，与拉丁齐平。**所以 13px 下的最优补偿是 0。**
+
+这也解释了为什么纯拉丁标签一直正常：它们的位移恒为 0，从未被补偿影响。
+
+### 为什么层级靠颜色而不是字号
+
+宿主自己就是这么做的：模型名 `label-secondary`、推理强度 `label-caption`，**两者都是 13px**。
+供应商作为第三层用 `label-tertiary`、同为 13px，于是整行读作「供应商 · 模型 · 强度」一个视觉单位。
+
+**2. 归属判定只在 Host 侧做一次**
+
+浏览器看不到 `settingsNs`：模型目录的 provider group 只有 `{ id, name, models }`，
+`prepareRoutes` 在进入目录前就把适配器元数据裁掉了。
+所以规则放在 Host，客户端只做查表 —— 一处实现，不会自我漂移。
+
+**3. Host 半不 import 任何 Harness 包**
+
+本地目录安装会把本仓库链接进 profile，其模块解析走 profile 的 `node_modules`，
+而那里**没有**内置 Harness 包。一个 `import Schema from '@deepseek-ai/schemastery'`
+就会让整个 Host 半加载失败。
+因此配置用纯数据描述（`CONFIG_KEYS` / `effectiveConfig`），不导出 `Config`；
+Loader 在没有 `Config` 时原样透传配置，默认值由本插件自己补。
+
+## 开发
+
+```bash
+npm test     # 27 项单元 + 行为测试（纯 Node，不需要 DSH 运行时）
+npm run check # 语法检查 + 19 项静态校验 + 全部测试
+```
+
+`scripts/verify.mjs` 的 19 项检查各自对应一条「否则只会在运行时才暴露」的规则：
+manifest 完整性、图标合法性与体积、locale 非占位文案、客户端只通过
+`__ModuleLoader__` 注册且不 import Harness Client 包、样式只用主题 token 且有宽度上界、
+路由是只读 GET 且在 `ctx.effect` 内注册、归属规则只有一份实现等。
+
+## 已知限制
+
+- 需要 Host 半的只读路由（`GET /plugins/dsh-provider-show/providers`）可用；
+  该路由仅接受本页同源请求。该路径是 `/plugins/` 下的 **exact** 路由，
+  优先级高于 `/plugins` 前缀路由（webserver 先查 exact 表），因此不与客户端模块路由冲突。
+- 芯片会让模型名更早折叠为图标（见上文取舍 1）。
+- 当 `conversation.input.activity` 展开整行时，宿主会隐藏整组 `standardControls`，
+  芯片随之隐藏 —— 这是宿主行为。
+- 供应商显示名默认取目录里的 `displayName`（即你在设置里填的名字）；
+  想更短就配 `shortNames`。
+- 归属判定的可靠性取决于第三方插件是否用自有 `settingsNs` 注册 provider。
+  若某插件复用核心命名空间，请用 `overrides` 显式标注。
+
+## 状态
+
+**已完成：安装 → 运行 → 视觉验收。全部验收项通过。**
+
+| 项 | 结果 |
+|---|---|
+| 安装 | 进入 profile bundles 与依赖（本地目录 `link:`） |
+| Host 行 | `fiberPhase: active` |
+| 只读路由 | `GET /plugins/dsh-provider-show/providers` 实测 200，决策正确 |
+| 真实判定 | `火山API` → 显示；`workbuddy` / `workbuddy-global` → 让位 |
+| 视觉验收 | 供应商与模型/强度齐平、间距合适、纯拉丁与中文均正常 |
+| 测试 | 38 项（归属规则、Host 路由行为、Client 渲染） |
+| 静态校验 | 23 项，逐条做过反证测试 |
+| CI | GitHub Actions 在 Node 22 / 24 上跑同一套检查 |
+
+### 卸载
+
+插件管理页禁用该 bundle，或从 profile 依赖里移除 `dsh-provider-show`。
+
+## 文档
+
+| 文件 | 内容 |
+|---|---|
+| [docs/design.md](docs/design.md) | 需求确认、架构决策（ADR）、边界约束、验收标准、返工记录 |
+| [docs/research.md](docs/research.md) | 技术考据：槽位拓扑、归属判定信号、排版实测数据，均带源码文件与行号 |
+
+## 许可
+
+[MIT](LICENSE)

package/cordis.patch.yml

@@ -0,0 +1,24 @@
+# dsh-provider-show — bundle patch.
+#
+# Inserts one plugin row. The row's id is also the settings namespace the Host
+# half's route is namespaced under, and the `provider` namespaces it treats as
+# core by default come from the shipped dsh-base patch, not from this row.
+#
+# Configuration (optional; every key has a default, and this patch replaces the
+# whole `config` object when it names one):
+#
+#   - id: dsh-provider-show
+#     name: dsh-provider-show
+#     config:
+#       enabled: true
+#       shortNames:
+#         volcano-api: 火山
+#       overrides:
+#         some-connector-provider: third-party
+#       coreNamespaces:
+#         - llm-pi-ai
+#         - llm-deepseek
+#         - llm-deepseek-account
+- insert:
+    - id: dsh-provider-show
+      name: dsh-provider-show

package/icon.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Provider Label">
+  <title>Provider Label</title>
+  <!-- A tag/label silhouette: the chip this plugin draws beside the model seat.
+       Two tags, the smaller behind, read as "the model, and the provider it
+       came from". Rendered in the product's brand blue and a muted second tier
+       so it stays legible on both the light and dark plugin panels, which have
+       their own surface colours rather than the page's. -->
+  <rect x="6" y="18" width="34" height="24" rx="6" fill="#5686fe" opacity="0.35"/>
+  <path d="M24 12h22a6 6 0 0 1 6 6v14a6 6 0 0 1-6 6H34l-10-8 10-8z" fill="#5686fe"/>
+  <circle cx="46" cy="21" r="3" fill="#ffffff"/>
+  <rect x="24" y="30" width="20" height="3" rx="1.5" fill="#ffffff" opacity="0.85"/>
+</svg>

package/lib/client.js

@@ -0,0 +1,222 @@
+window.__ModuleLoader__.load({
+  id: 'dsh-provider-show',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+    const { useState, useEffect } = React
+
+    const NS = 'dsh-provider-show'
+    const SLOT = 'conversation.input.right'
+    const ENTRY_ID = 'dsh-provider-show-provider'
+
+    /**
+     * The Host half's read-only document.
+     *
+     * Every ownership decision is already made there — this half performs a
+     * lookup, never a rule. That asymmetry is deliberate: the rule needs the
+     * Host's LLM directory (`settingsNs`), which the browser cannot see, and
+     * one authoritative copy cannot drift from itself.
+     */
+    const PROVIDERS_PATH = '/plugins/dsh-provider-show/providers'
+
+    /** How long one document is reused, in milliseconds. */
+    const CACHE_MS = 5000
+
+    const zh = {
+      'chip.aria': '当前供应商：{provider}',
+      'meta.title': '供应商信息补全',
+      'meta.description': '在输入框右下角补全当前模型所属的供应商；已被其他插件接管的供应商不再重复显示。',
+    }
+    const en = {
+      'chip.aria': 'Current provider: {provider}',
+      'meta.title': 'Provider Label',
+      'meta.description': 'Shows which provider the selected model belongs to in the composer row, and stays silent for a provider another plugin already presents.',
+    }
+
+    /** The chip's own stylesheet; theme tokens only, so light/dark both work. */
+    const CSS = [
+      // 13px / 400 / 20px / 28px are the model trigger's own metrics
+      // (`.htuFrW_trigger`), reproduced exactly and with no `font-family` of our
+      // own so both inherit one stack. That is the whole alignment mechanism:
+      // inside a 20px line box the baseline sits at `half-leading + ascent`,
+      // which is fixed by font-size and font — NOT by line-height — so equal
+      // metrics put both labels on one baseline with no nudging.
+      //
+      // Nothing else is needed, and a `translateY` for Han labels was measured
+      // out of the design: with the size matched, a screenshot showed the Han
+      // ink centroid sitting 1.85 CSS px LOW once nudged, and level with the
+      // Latin centroid at zero. Han glyphs extending above the Latin cap line is
+      // normal mixed-script typesetting, not a misalignment.
+      //
+      // The host separates tiers by COLOUR, not size: the model name is
+      // label-secondary and the effort is label-caption, both 13px. The provider
+      // is the third tier, label-tertiary at the same size.
+      '.dpsp-root{display:inline-flex;align-items:center;box-sizing:border-box;',
+      'height:28px;min-width:0;max-width:140px;padding:0;',
+      // The row spaces its children 12px apart, and the model trigger carries
+      // 8px of its own leading padding, so an unpadded chip would sit ~20px from
+      // the model text. Pulling the pair together makes them read as one line.
+      'margin-inline-end:-10px;',
+      'font-size:13px;font-weight:400;line-height:20px;',
+      'color:var(--dsw-alias-label-tertiary);white-space:nowrap;user-select:none}',
+      '.dpsp-name{min-width:0;overflow:hidden;text-overflow:ellipsis}',
+    ].join('')
+
+    /**
+     * Mount the stylesheet once.
+     *
+     * @returns {() => void} the disposer that removes it on unload.
+     */
+    function installStyles() {
+      if (typeof document === 'undefined') return () => {}
+      const tagId = 'dsh-provider-show/chip.css'
+      if (document.querySelector(`style[data-plugin-css=${JSON.stringify(tagId)}]`) !== null) return () => {}
+      const tag = document.createElement('style')
+      tag.dataset.plugin = 'dsh-provider-show'
+      tag.dataset.pluginCss = tagId
+      tag.textContent = CSS
+      document.head.appendChild(tag)
+      return () => {
+        tag.remove()
+      }
+    }
+
+    /**
+     * Last document read from the Host, shared by every mounted composer so a
+     * session switch reuses one answer instead of re-asking.
+     */
+    const cache = { value: undefined, at: 0, inflight: undefined }
+
+    /**
+     * Read the Host's provider document, at most once per cache window.
+     *
+     * Any failure returns `undefined`, which the component renders as "draw
+     * nothing": a missing label is a smaller fault than a wrong one, and this
+     * path only runs when the Host is unreachable anyway.
+     *
+     * @returns {Promise<{ providers: Array<object>, enabled: boolean } | undefined>} the document.
+     */
+    async function readDocument() {
+      const now = Date.now()
+      if (cache.value !== undefined && now - cache.at < CACHE_MS) return cache.value
+      if (cache.inflight !== undefined) return cache.inflight
+      const operation = (async () => {
+        try {
+          const response = await fetch(PROVIDERS_PATH, {
+            headers: { accept: 'application/json' },
+            credentials: 'same-origin',
+          })
+          if (!response.ok) return undefined
+          const body = await response.json()
+          if (body?.ok !== true) return undefined
+          const value = body.value
+          if (value === null || typeof value !== 'object' || !Array.isArray(value.providers)) return undefined
+          cache.value = value
+          cache.at = Date.now()
+          return value
+        } catch {
+          return undefined
+        }
+      })()
+      cache.inflight = operation
+      try {
+        return await operation
+      } finally {
+        if (cache.inflight === operation) cache.inflight = undefined
+      }
+    }
+
+    /**
+     * One provider's decided row, or undefined when the Host has no opinion.
+     *
+     * @param {{ providers: Array<object> } | undefined} document - Host document.
+     * @param {string} providerId - the selected provider route.
+     * @returns {{ label?: string, visible?: boolean } | undefined} the row.
+     */
+    function rowFor(document, providerId) {
+      if (document === undefined || providerId === '') return undefined
+      for (const row of document.providers) {
+        if (row !== null && typeof row === 'object' && row.provider === providerId) return row
+      }
+      return undefined
+    }
+
+    /**
+     * The provider label beside the model seat.
+     *
+     * Reads the session's durable `modelSelection` projection — the same value
+     * the Host stamps on outgoing requests — so the label cannot disagree with
+     * the model seat about which provider is selected. It renders nothing while
+     * the document is in flight, because showing a label that is about to be
+     * suppressed (the provider belongs to another plugin) would flash.
+     *
+     * @param {object} props - slot props; `useProjection` and `t` are supplied by the slot.
+     * @returns {import('react').ReactElement | null} the label, or null.
+     */
+    function ProviderLabel(props) {
+      const { useProjection, sessionId, t } = props
+      const selection = useProjection('modelSelection')
+      const providerId = selection?.next?.provider ?? selection?.lastUsed?.provider ?? ''
+      const [document, setDocument] = useState(undefined)
+
+      useEffect(() => {
+        if (providerId === '') {
+          setDocument(undefined)
+          return undefined
+        }
+        let live = true
+        readDocument().then((next) => {
+          if (live) setDocument(next)
+        })
+        return () => {
+          live = false
+        }
+      }, [providerId, sessionId])
+
+      if (providerId === '') return null
+      const row = rowFor(document, providerId)
+      // `visible` is decided by the Host: it carries the plugin switch, the
+      // user's overrides, and the third-party check in one boolean.
+      if (row === undefined || row.visible !== true) return null
+      const label = typeof row.label === 'string' ? row.label.trim() : ''
+      if (label === '') return null
+
+      return h(
+        'span',
+        {
+          className: 'dpsp-root',
+          title: t('chip.aria', { provider: label }),
+          'aria-label': t('chip.aria', { provider: label }),
+        },
+        h('span', { className: 'dpsp-name' }, label),
+      )
+    }
+
+    return {
+      // Only what the component actually needs. `remote` is deliberately absent:
+      // this half reads its own Host route, which works in every composition and
+      // keeps the ownership rule on the side that can evaluate it.
+      // Only what the component actually needs, spelled the way the cordis
+      // Loader expects (a plain array of REQUIRED service keys — the Loader has
+      // no "optional" inject form, and a key listed here parks the plugin until
+      // that service exists). `remote` is deliberately absent: this half reads
+      // its own Host route, which works in every composition and keeps the
+      // ownership rule on the side that can evaluate it.
+      inject: ['slots', 'locale'],
+      apply(ctx) {
+        ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-provider-show: dictionaries')
+        ctx.effect(installStyles, 'dsh-provider-show: stylesheet')
+        ctx.slots.inject(SLOT, () => ctx.slots.register({
+          name: SLOT,
+          id: ENTRY_ID,
+          // `input.right` is a list slot rendered immediately before the model
+          // seat. Order only matters if another plugin also occupies this slot;
+          // a connector that draws its own supplier chip suppresses ours for its
+          // providers, so in practice the two never render together.
+          order: 6,
+          locale: NS,
+        }, ProviderLabel))
+      },
+    }
+  },
+})

package/lib/index.js

@@ -0,0 +1,314 @@
+/**
+ * Host half of dsh-provider-show.
+ *
+ * The browser can see the model catalog, but it cannot see WHO registered a
+ * provider route: the catalog group carries only `{ id, name, models }`, and the
+ * registry strips adapter metadata before it reaches the page. That answer
+ * lives in the Host's LLM directory, so this half reads it and publishes one
+ * small, already-decided document:
+ *
+ *     GET /plugins/dsh-provider-show/providers
+ *     { ok: true, value: { providers: [{ provider, displayName, label, owner, reason }] } }
+ *
+ * Each row is decided HERE by the shared pure resolver, so the ownership rule
+ * has exactly one implementation and the client half stays a lookup. No Client
+ * package, no `remote.llm` dependency, and no second copy of the rule that could
+ * drift from this one.
+ *
+ * A Host-only bundle would need the route's consumer to exist; the Client half
+ * is what consumes it, so the two ship together in one bundle.
+ *
+ * @module dsh-provider-show
+ */
+
+import {
+  DEFAULT_CORE_NAMESPACES,
+  providerLabel,
+  resolveOwnership,
+  shouldRender,
+} from './ownership.js'
+
+/** Route this plugin owns, namespaced under `/plugins/` like other bundles. */
+const PROVIDERS_PATH = '/plugins/dsh-provider-show/providers'
+
+/** How long one directory snapshot is reused, in milliseconds. */
+const CACHE_MS = 5000
+
+/**
+ * The plugin's configuration shape, described once as plain data.
+ *
+ * Deliberately NOT a Schemastery schema. A bundle installed by linking this
+ * directory resolves its imports through the profile's `node_modules`, and the
+ * shipped Harness packages are NOT there for a bundle that declares no
+ * dependency on them — so importing a schema library from the Harness tree
+ * would make the whole Host half fail to load. The Loader treats a missing
+ * `Config` export as "no schema" and passes the row's config through
+ * (`resolveConfig` returns early when `runtime.Config` is absent), so the
+ * defaults are applied here instead, in {@link effectiveConfig}, where they cost
+ * no import.
+ *
+ * The shapes below are documented for the patch author and validated at use.
+ */
+export const CONFIG_KEYS = Object.freeze({
+  enabled: 'boolean — draw the label (default true)',
+  shortNames: 'Record<providerId, string> — a shorter label than the catalog name',
+  overrides: 'Record<providerId, "mine" | "third-party" | "hide"> — force one decision',
+  coreNamespaces: 'string[] — settings namespaces the Harness itself owns',
+})
+
+/** The ownership decision values `overrides` accepts. */
+const OVERRIDE_VALUES = Object.freeze(['mine', 'third-party', 'hide'])
+
+/**
+ * Coerce one unknown value to a string record.
+ *
+ * Configuration arrives from YAML, so a value can be a number, a list, or
+ * absent. Anything unusable is dropped rather than throwing inside a request.
+ *
+ * @param {unknown} value - raw configured value.
+ * @returns {Record<string, string>} only the string-valued entries.
+ */
+function stringRecord(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return {}
+  const out = {}
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof key !== 'string' || key === '') continue
+    if (typeof entry !== 'string') continue
+    out[key] = entry
+  }
+  return out
+}
+
+/**
+ * Resolve the row's configuration into the struct the rest of this file uses.
+ *
+ * Every field falls back to a defined behaviour, because `cordis.patch.yml`
+ * replaces the WHOLE `config` object when it names one key: a user overriding
+ * `shortNames` must not thereby disable the default core namespace list.
+ *
+ * @param {unknown} raw - the row's config as the Loader supplied it.
+ * @returns {{ enabled: boolean, shortNames: Record<string,string>, overrides: Record<string,string>, coreNamespaces: string[] }}
+ *          effective configuration.
+ */
+export function effectiveConfig(raw) {
+  const base = raw !== null && typeof raw === 'object' && !Array.isArray(raw) ? raw : {}
+  const shortNames = stringRecord(base.shortNames)
+  const overrides = {}
+  for (const [key, value] of Object.entries(stringRecord(base.overrides))) {
+    // An unrecognised override would silently do nothing; dropping it keeps the
+    // resolver's single authority intact and the behaviour predictable.
+    if (OVERRIDE_VALUES.includes(value)) overrides[key] = value
+  }
+  const coreNamespaces = Array.isArray(base.coreNamespaces)
+    ? base.coreNamespaces.filter((entry) => typeof entry === 'string' && entry.trim() !== '').map((entry) => entry.trim())
+    : []
+  return {
+    enabled: base.enabled !== false,
+    shortNames,
+    overrides,
+    coreNamespaces: coreNamespaces.length > 0 ? coreNamespaces : [...DEFAULT_CORE_NAMESPACES],
+  }
+}
+
+/**
+ * Read the live LLM registry into the raw rows the resolver consumes.
+ *
+ * Both calls are optional in a composition. A profile without an LLM service
+ * simply produces no rows, which the resolver reports as `unknown` — ours.
+ *
+ * @param {import('@deepseek-ai/cordis').Context} ctx - host context.
+ * @returns {{ rows: unknown[], providers: unknown[] }} directory rows and registered routes.
+ */
+function readDirectory(ctx) {
+  const llm = ctx.get('llm')
+  if (llm === undefined || llm === null) return { rows: [], providers: [] }
+  const rows = read(() => llm.listConfigurableProviders?.())
+  const providers = read(() => llm.listProviders?.())
+  return {
+    rows: Array.isArray(rows) ? rows : [],
+    providers: Array.isArray(providers) ? providers : [],
+  }
+}
+
+/**
+ * Call one optional registry method, treating any failure as "not available".
+ *
+ * @param {() => unknown} read - the call.
+ * @returns {unknown} its result, or undefined.
+ */
+function read(call) {
+  try {
+    return call()
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Build the document the client half reads.
+ *
+ * Registered routes decide WHICH providers exist; the configurable directory
+ * decides WHO registers each one. The two can legitimately differ — a route
+ * may be registered without a directory entry and vice versa — so they are
+ * unioned, and a route with no directory row resolves to `unknown`, which
+ * renders our label.
+ *
+ * @param {import('@deepseek-ai/cordis').Context} ctx - host context.
+ * @param {ReturnType<typeof effectiveConfig>} config - effective configuration.
+ * @returns {{ providers: Array<{provider: string, displayName: string, label: string, owner: string, reason: string}>, coreNamespaces: string[] }}
+ *          one decided row per provider route.
+ */
+export function describeProviders(ctx, config) {
+  const { rows, providers } = readDirectory(ctx)
+  const coreNamespaces = config.coreNamespaces
+
+  const ids = []
+  const seen = new Set()
+  const claim = (id) => {
+    if (typeof id !== 'string' || id === '' || seen.has(id)) return
+    seen.add(id)
+    ids.push(id)
+  }
+  for (const provider of providers) claim(provider?.id)
+  for (const row of rows) claim(row?.provider)
+
+  const out = []
+  for (const providerId of ids) {
+    const decision = resolveOwnership({
+      providerId,
+      directoryRows: rows,
+      coreNamespaces,
+      overrides: config.overrides,
+    })
+    const label = providerLabel({
+      providerId,
+      displayName: decision.displayName,
+      shortNames: config.shortNames,
+    })
+    out.push({
+      provider: providerId,
+      displayName: decision.displayName ?? providerId,
+      label,
+      // The client draws the label only when `visible`. Both decisions — who
+      // owns the provider, and whether to draw anything — are made here so the
+      // page never has to re-derive them.
+      visible: label !== '' && shouldRender(decision, config),
+      owner: decision.owner,
+      reason: decision.reason,
+    })
+  }
+  return { providers: out, coreNamespaces }
+}
+
+/**
+ * Send one JSON reply that no cache should reuse.
+ *
+ * @param {import('node:http').ServerResponse} res - response to write.
+ * @param {number} status - HTTP status code.
+ * @param {unknown} body - JSON-serialisable payload.
+ * @returns {void}
+ */
+function json(res, status, body) {
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  res.end(JSON.stringify(body))
+}
+
+/**
+ * Accept only requests issued by the page this Host itself serves.
+ *
+ * The document exposes provider topology, so the route is held to the loopback
+ * rule other plugin routes use: the Host header must name this listener, and a
+ * present Origin must be loopback too. A same-origin `fetch` from the served
+ * page satisfies both.
+ *
+ * @param {import('node:http').IncomingMessage} req - incoming request.
+ * @returns {boolean} whether the request may be served.
+ */
+function fromThisPage(req) {
+  const local = req.socket?.localAddress
+  const host = req.headers.host
+  if (typeof host === 'string' && local !== undefined) {
+    const address = host.replace(/:\d+$/, '').replace(/^\[|\]$/g, '')
+    if (!(address === local || address === 'localhost' || address === '127.0.0.1' || address === '::1')) {
+      return false
+    }
+  }
+  const origin = req.headers.origin
+  if (typeof origin === 'string' && origin !== '') {
+    try {
+      const { hostname } = new URL(origin)
+      if (!(hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === local)) {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+  return true
+}
+
+/**
+ * Host entry point: register the read-only provider directory route.
+ *
+ * The route is registered inside `ctx.effect`, so unloading the plugin removes
+ * it and drops the snapshot with it.
+ *
+ * @param {import('@deepseek-ai/cordis').Context} ctx - host context.
+ * @param {unknown} [rawConfig] - the row's configuration.
+ * @returns {void}
+ */
+export function apply(ctx, rawConfig) {
+  const config = effectiveConfig(rawConfig)
+  let snapshot
+  let snapshotAt = 0
+
+  // `ctx.inject` — not `ctx.get` — because the web server is an ordinary service
+  // in the composition: at plugin activation it may not exist yet, and a
+  // one-shot `get` would silently leave the route unregistered forever.
+  //
+  // `scope.effect` — not a returned value — because a plugin's return value is
+  // DISCARDED by the Loader; only an effect disposer is run on unload. Returning
+  // the route disposer would register the route and then leak it forever.
+  ctx.inject(['webServer'], (scope) => {
+    const webServer = scope.webServer
+    if (webServer === undefined || typeof webServer.register !== 'function') return
+    scope.effect(() => webServer.register({
+      kind: 'exact',
+      path: PROVIDERS_PATH,
+      handler: async (req, res) => {
+        if (req.method !== 'GET') {
+          json(res, 405, { ok: false, error: 'method-not-allowed' })
+          return
+        }
+        if (!fromThisPage(req)) {
+          json(res, 403, { ok: false, error: 'not-this-page' })
+          return
+        }
+        const now = Date.now()
+        if (snapshot === undefined || now - snapshotAt >= CACHE_MS) {
+          try {
+            snapshot = describeProviders(ctx, config)
+            snapshotAt = now
+          } catch (error) {
+            // A failed read is not a failed route: the client treats an absent
+            // answer as "draw nothing", and the reason is reported rather than
+            // thrown into the request lifecycle.
+            json(res, 200, {
+              ok: false,
+              error: 'directory-unavailable',
+              message: error instanceof Error ? error.message : String(error),
+            })
+            return
+          }
+        }
+        json(res, 200, {
+          ok: true,
+          value: { ...snapshot, enabled: config.enabled },
+        })
+      },
+    }), 'dsh-provider-show: provider directory route')
+  })
+}

package/lib/ownership.js

@@ -0,0 +1,216 @@
+/**
+ * Ownership resolution for the composer's provider chip.
+ *
+ * The composer's model seat already renders "model name · reasoning effort"
+ * itself. What it cannot show is WHICH PROVIDER the selection belongs to,
+ * because the catalog name is the only provider-derived text it draws. A
+ * third-party plugin may already own a provider's whole presentation (the
+ * WorkBuddy connector draws its own supplier chip, credit readout, promotion
+ * badge and effort marker in the same row), and duplicating that is worse than
+ * staying silent.
+ *
+ * This module answers exactly one question, as a pure function of directory
+ * rows and configuration:
+ *
+ *     Is this provider's presentation already owned elsewhere?
+ *
+ * It is deliberately free of DSH imports so it can be unit-tested with plain
+ * Node: the Host and Client halves both consume this same function.
+ *
+ * @module dsh-provider-show/ownership
+ */
+
+/**
+ * Provider routes the Harness itself registers, keyed by the settings namespace
+ * that configures each one.
+ *
+ * These come from the shipped `dsh-base` bundle patch, where a Loader row's id
+ * is also the settings namespace its provider directory entry names:
+ * `llm-pi-ai` (user-configured API-key routes), and the two official DeepSeek
+ * routes. A provider whose `settingsNs` is one of these is core; anything else
+ * means some plugin registered the route under its own namespace.
+ *
+ * Kept as data rather than a switch so a deployment can extend it through the
+ * plugin's Config when a future Harness release adds another built-in route.
+ */
+export const DEFAULT_CORE_NAMESPACES = Object.freeze([
+  'llm-pi-ai',
+  'llm-deepseek',
+  'llm-deepseek-account',
+])
+
+/** The three answers {@link resolveOwnership} can give. */
+export const OWNERSHIP = Object.freeze({
+  /** Core Harness route: no third-party plugin presents it, so show our chip. */
+  CORE: 'core',
+  /** Another plugin registered this route and presents it; we stay silent. */
+  THIRD_PARTY: 'third-party',
+  /** No directory row for this route: treat it as ours (fail-open). */
+  UNKNOWN: 'unknown',
+})
+
+/**
+ * Normalise a configuration list of namespaces.
+ *
+ * Configuration arrives from YAML, so a missing field, `null`, a scalar, or a
+ * list with non-string members must all degrade to the default rather than
+ * throwing inside a render path. Duplicates and empty strings are dropped
+ * because a namespace is compared by equality.
+ *
+ * @param {unknown} value - raw configured value.
+ * @param {readonly string[]} fallback - list used when nothing usable was given.
+ * @returns {string[]} a usable namespace list.
+ */
+export function normalizeNamespaces(value, fallback = DEFAULT_CORE_NAMESPACES) {
+  if (!Array.isArray(value)) return [...fallback]
+  const seen = new Set()
+  const out = []
+  for (const entry of value) {
+    if (typeof entry !== 'string') continue
+    const name = entry.trim()
+    if (name === '' || seen.has(name)) continue
+    seen.add(name)
+    out.push(name)
+  }
+  return out.length === 0 ? [...fallback] : out
+}
+
+/**
+ * Read one provider's directory row out of a `listConfigurableProviders()` reply.
+ *
+ * The remote reply is untrusted JSON (a Host generation may have changed shape),
+ * so every field is checked before use.
+ *
+ * @param {unknown} rows - raw reply.
+ * @param {string} providerId - provider route to find.
+ * @returns {{ provider: string, displayName?: string, settingsNs?: string, settingsPath?: readonly string[] } | undefined}
+ *          the matching row, or undefined when the reply is unusable.
+ */
+export function findProviderRow(rows, providerId) {
+  if (!Array.isArray(rows) || typeof providerId !== 'string' || providerId === '') return undefined
+  for (const row of rows) {
+    if (row === null || typeof row !== 'object') continue
+    if (row.provider !== providerId) continue
+    return {
+      provider: providerId,
+      ...(typeof row.displayName === 'string' && row.displayName !== ''
+        ? { displayName: row.displayName }
+        : {}),
+      ...(typeof row.settingsNs === 'string' && row.settingsNs !== ''
+        ? { settingsNs: row.settingsNs }
+        : {}),
+      ...(Array.isArray(row.settingsPath) ? { settingsPath: row.settingsPath } : {}),
+    }
+  }
+  return undefined
+}
+
+/**
+ * Decide who presents one provider route.
+ *
+ * Order of authority, strongest first:
+ *
+ * 1. The user's explicit override. A person who has looked at the composer and
+ *    said "this one is somebody else's" outranks every inference below, because
+ *    it is the only signal that cannot be wrong about intent.
+ * 2. The directory row's `settingsNs`. A namespace outside the core list means
+ *    a plugin registered the route under its own Loader entry id.
+ * 3. Fail-open. A route with no row — or a directory that could not be read —
+ *    is treated as ours. The asymmetry is deliberate: showing a provider that
+ *    was in fact owned elsewhere costs a duplicate label, while hiding one that
+ *    was not owned costs the entire feature, silently, for every provider.
+ *
+ * @param {object} input - resolution input.
+ * @param {string} input.providerId - selected provider route.
+ * @param {unknown} [input.directoryRows] - `listConfigurableProviders()` reply.
+ * @param {readonly string[]} [input.coreNamespaces] - namespaces the Harness owns.
+ * @param {Record<string, string>} [input.overrides] - provider id → decision.
+ * @returns {{ owner: string, reason: string, settingsNs?: string, displayName?: string }}
+ *          the decision plus the evidence that produced it.
+ */
+export function resolveOwnership(input) {
+  const providerId = input?.providerId
+  if (typeof providerId !== 'string' || providerId === '') {
+    return { owner: OWNERSHIP.UNKNOWN, reason: 'no-provider' }
+  }
+
+  const overrides = input.overrides
+  const override = overrides !== null && typeof overrides === 'object' && !Array.isArray(overrides)
+    ? overrides[providerId]
+    : undefined
+  if (override === 'third-party') return { owner: OWNERSHIP.THIRD_PARTY, reason: 'override' }
+  if (override === 'mine') return { owner: OWNERSHIP.CORE, reason: 'override' }
+  // `hide` is not an ownership claim: it says "draw nothing" without asserting
+  // that somebody else owns the provider. It rides along on the decision so
+  // there is still exactly ONE reader of the overrides table.
+  if (override === 'hide') return { owner: OWNERSHIP.CORE, reason: 'override-hidden', hidden: true }
+
+  const row = findProviderRow(input.directoryRows, providerId)
+  if (row === undefined) return { owner: OWNERSHIP.UNKNOWN, reason: 'no-directory-row' }
+
+  const core = normalizeNamespaces(input.coreNamespaces)
+  const settingsNs = row.settingsNs
+  const carries = {
+    ...(settingsNs === undefined ? {} : { settingsNs }),
+    ...(row.displayName === undefined ? {} : { displayName: row.displayName }),
+  }
+  if (settingsNs === undefined) {
+    return { owner: OWNERSHIP.UNKNOWN, reason: 'no-settings-namespace', ...carries }
+  }
+  if (core.includes(settingsNs)) {
+    return { owner: OWNERSHIP.CORE, reason: 'core-namespace', ...carries }
+  }
+  return { owner: OWNERSHIP.THIRD_PARTY, reason: 'plugin-namespace', ...carries }
+}
+
+/**
+ * Whether our chip should render at all for one selection.
+ *
+ * Three things suppress it, and only three: the plugin switch, an explicit
+ * `hide` override, and a confirmed third-party owner. `UNKNOWN` renders, for the
+ * reason given on {@link resolveOwnership}: a duplicate label is a cosmetic
+ * fault, a missing feature is the whole request.
+ *
+ * This function deliberately does NOT re-read `overrides`. Every decision that
+ * needs that table is made once, inside {@link resolveOwnership}, and arrives
+ * here on the decision object — two readers of one table could disagree after an
+ * edit, and the disagreement would be invisible until a user saw it.
+ *
+ * @param {{ owner: string, hidden?: boolean }} decision - result of {@link resolveOwnership}.
+ * @param {{ enabled?: boolean }} [config] - plugin configuration.
+ * @returns {boolean} whether to draw the chip.
+ */
+export function shouldRender(decision, config = {}) {
+  if (config?.enabled === false) return false
+  if (decision?.hidden === true) return false
+  return decision?.owner !== OWNERSHIP.THIRD_PARTY
+}
+
+/**
+ * The text our chip shows for one provider.
+ *
+ * Model name and reasoning effort are already drawn by the composer's own model
+ * seat, so repeating them here would print each fact twice in one row. The chip
+ * therefore carries the one missing fact: the provider.
+ *
+ * @param {object} input - label input.
+ * @param {string} input.providerId - selected provider route.
+ * @param {string} [input.displayName] - provider name from the directory row.
+ * @param {Record<string, string>} [input.shortNames] - configured short names.
+ * @returns {string} the label, or an empty string when nothing usable exists.
+ */
+export function providerLabel(input) {
+  const providerId = input?.providerId
+  const shortNames = input?.shortNames
+  if (shortNames !== null && typeof shortNames === 'object' && !Array.isArray(shortNames)) {
+    const short = typeof providerId === 'string' ? shortNames[providerId] : undefined
+    if (typeof short === 'string' && short.trim() !== '') return short.trim()
+  }
+  const displayName = input?.displayName
+  if (typeof displayName === 'string' && displayName.trim() !== '') return displayName.trim()
+  // A provider id is the last resort: it is always present and always accurate,
+  // and showing `volcano-cn` beats showing an empty chip. Callers that would
+  // rather show nothing pass fallbackToId: false.
+  if (input?.fallbackToId === false) return ''
+  return typeof providerId === 'string' ? providerId : ''
+}

package/locale/en.json

@@ -0,0 +1,9 @@
+{
+  "meta": {
+    "title": "Provider Label",
+    "description": "Shows which provider the selected model belongs to in the composer row, and stays silent for a provider another plugin already presents."
+  },
+  "chip": {
+    "aria": "Current provider: {provider}"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,9 @@
+{
+  "meta": {
+    "title": "供应商信息补全",
+    "description": "在输入框右下角补全当前模型所属的供应商；已被其他插件接管的供应商不再重复显示。"
+  },
+  "chip": {
+    "aria": "当前供应商：{provider}"
+  }
+}

package/package.json

@@ -1,6 +1,66 @@
 {
   "name": "dsh-provider-show",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Shows which provider the selected model belongs to in the composer row, and stays silent for providers another plugin already presents.",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
+    "./ownership": "./lib/ownership.js",
+    "./icon": "./icon.svg",
+    "./package.json": "./package.json"
+  },
+  "icon": "./icon.svg",
+  "files": [
+    "lib",
+    "locale",
+    "icon.svg",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-locale"
+      ]
+    }
+  },
+  "scripts": {
+    "test": "node --test",
+    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/ownership.js && node scripts/verify.mjs && node --test"
+  },
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "provider",
+    "composer"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "author": {
+    "name": "MosCloud"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MosCloud/dsh-provider-show.git"
+  },
+  "homepage": "https://github.com/MosCloud/dsh-provider-show#readme",
+  "bugs": {
+    "url": "https://github.com/MosCloud/dsh-provider-show/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}