dsh-qoder-connect 0.1.5 → 0.1.9

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as QODER_GLOBAL_AUTH_PATH, B as qoderCredentialIdentity, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_AUTH_FILENAME, G as qoderPluginDataDir, H as QODER_DATA_DIR_ENV, I as QODER_PAT_ENV_CN, K as qoderStateDir, L as QODER_PAT_ENV_GLOBAL, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_STATUS_PATH, R as QoderCredentialStore, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_NAME, V as qoderOwnAuthPath, W as qoderMachineIdPath, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as patTail } from "./variants-BEiQve5M.js";
+import { A as QODER_GLOBAL_AUTH_PATH, B as patTail, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_STATUS_PATH, G as qoderMachineIdPath, H as qoderOwnAuthPath, I as QODER_AUTH_FILENAME, K as qoderPluginDataDir, L as QODER_PAT_ENV_CN, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_SETTINGS_FACE_PATH, R as QODER_PAT_ENV_GLOBAL, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_ENV, V as qoderCredentialIdentity, W as QODER_DATA_DIR_NAME, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as qoderStateDir, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as QoderCredentialStore } from "./variants-C8ezztjV.js";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
@@ -7,8 +7,10 @@ import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { homedir } from "node:os";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import yamlModule from "js-yaml";
 //#region src/loopback.ts
 /**
 * Shared loopback gates for the plugin's local HTTP surfaces: the loopback
@@ -265,6 +267,17 @@ const NO_COST = {
 */
 const RATE_SEPARATOR = " · ";
 /**
+* What the model seat shows in place of a rate the plugin cannot stand behind.
+*
+* The seat has no locale service (the adapter is a host seam), so this is a
+* literal; it matches the settings card's own wording for the same state.
+* Rendering it as WORDS rather than an empty slot: every other model in the
+* seat shows `· x0.3`, so a bare name where the rate should be reads as a
+* rendering bug. This plugin's fallback roster carries no rate at all, so the
+* case is not hypothetical.
+*/
+const RATE_UNAVAILABLE = "价格暂不可用";
+/**
 * Append the billing rate to one model's display name.
 *
 * The rate rides the *name* alone: since DSH 0.1.2 the composer's model seat
@@ -280,6 +293,7 @@ const RATE_SEPARATOR = " · ";
 */
 /** The catalog display suffix: the normalized billing rate, when the row has one. */
 function displaySuffix(info) {
+	if (info.billing?.rateUnknown === true) return RATE_UNAVAILABLE;
 	const rate = normalizeCredits(info.billing?.credits);
 	return rate === void 0 || rate === "" ? void 0 : rate;
 }
@@ -1049,7 +1063,8 @@ async function qoderWebStatus(deps) {
 		...statusWithModels,
 		probe: deps.probe(),
 		...deps.probeKey === void 0 ? {} : { probeKey: deps.probeKey },
-		...deps.useMaximumContextWindow === void 0 ? {} : { useMaximumContextWindow: deps.useMaximumContextWindow() }
+		...deps.useMaximumContextWindow === void 0 ? {} : { useMaximumContextWindow: deps.useMaximumContextWindow() },
+		...deps.disabledModels === void 0 ? {} : { disabledModels: deps.disabledModels() }
 	};
 	const refreshedAt = deps.jobTokenRefreshedAt?.();
 	const withRefreshNotice = refreshedAt === void 0 ? probed : {
@@ -1181,6 +1196,20 @@ function parseAction(text) {
 		action: "set-maximum-context-window",
 		enabled: wrapped["enabled"]
 	} : void 0;
+	if (action === "set-models-enabled") {
+		if (typeof wrapped["enabled"] !== "boolean") return void 0;
+		const rawModels = wrapped["models"];
+		const rawModel = wrapped["model"];
+		let models = [];
+		if (Array.isArray(rawModels)) models = rawModels.filter((m) => typeof m === "string" && m.trim() !== "").map((m) => m.trim());
+		else if (typeof rawModel === "string" && rawModel.trim() !== "") models = [rawModel.trim()];
+		if (models.length === 0) return void 0;
+		return {
+			action: "set-models-enabled",
+			models,
+			enabled: wrapped["enabled"]
+		};
+	}
 	if (action === "probe") {
 		const model = wrapped["model"];
 		if (typeof model !== "string" || model.trim() === "") return void 0;
@@ -1253,6 +1282,17 @@ function qoderProbeHandler(deps, key) {
 				json(res, 200, await deps.setMaximumContextWindow(action.enabled === true));
 				return;
 			}
+			if (action.action === "set-models-enabled") {
+				if (deps.setModelsEnabled === void 0) {
+					json(res, 404, { error: "models-enabled-setting-not-supported" });
+					return;
+				}
+				json(res, 200, await deps.setModelsEnabled({
+					models: action.models ?? (action.model ? [action.model] : []),
+					enabled: action.enabled === true
+				}));
+				return;
+			}
 			json(res, 200, await deps.probe(action.model));
 		} catch (error) {
 			json(res, 500, { error: error instanceof Error ? error.message : String(error) });
@@ -1336,14 +1376,25 @@ function getUtc8DateString(nowMs = Date.now()) {
 	const utc8 = new Date(d.getTime() + (d.getTimezoneOffset() + 480) * 6e4);
 	return `${utc8.getFullYear()}-${String(utc8.getMonth() + 1).padStart(2, "0")}-${String(utc8.getDate()).padStart(2, "0")}`;
 }
+/** Clamp any stored/typed value onto a real minute of the day. */
+function normalizeCheckInMinute(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return 600;
+	const whole = Math.trunc(value);
+	if (whole < 0 || whole > 1439) return 600;
+	return whole;
+}
 /**
-* Calculates milliseconds until the next 10:00:05 AM in UTC+8.
+* Calculates milliseconds until the next occurrence of `minuteOfDay` (UTC+8).
+*
+* Five seconds past the configured minute are used so the request lands after
+* the upstream has flipped the day over rather than on the boundary itself.
 */
-function msUntilNext10amUtc8(nowMs = Date.now()) {
+function msUntilNextCheckIn(minuteOfDay, nowMs = Date.now()) {
+	const minute = normalizeCheckInMinute(minuteOfDay);
 	const d = new Date(nowMs);
 	const utc8Time = new Date(d.getTime() + (d.getTimezoneOffset() + 480) * 6e4);
 	const targetUtc8 = new Date(utc8Time.getTime());
-	targetUtc8.setHours(10, 0, 5, 0);
+	targetUtc8.setHours(Math.floor(minute / 60), minute % 60, 5, 0);
 	let diff = targetUtc8.getTime() - utc8Time.getTime();
 	if (diff <= 0) {
 		targetUtc8.setDate(targetUtc8.getDate() + 1);
@@ -1352,13 +1403,13 @@ function msUntilNext10amUtc8(nowMs = Date.now()) {
 	return diff;
 }
 /**
-* Checks whether catch-up is needed today:
-* Current time is past today's 10:00:00 AM (UTC+8) and today has not yet settled a check-in.
+* Whether today's configured check-in moment (UTC+8) has already passed.
 */
-function shouldCatchUp(today, lastDate, nowMs = Date.now()) {
-	if (lastDate === today) return false;
+function isPastCheckInTime(minuteOfDay, nowMs = Date.now()) {
+	const minute = normalizeCheckInMinute(minuteOfDay);
 	const d = new Date(nowMs);
-	return new Date(d.getTime() + (d.getTimezoneOffset() + 480) * 6e4).getHours() >= 10;
+	const utc8 = new Date(d.getTime() + (d.getTimezoneOffset() + 480) * 6e4);
+	return utc8.getHours() * 60 + utc8.getMinutes() >= minute;
 }
 var CheckInScheduler = class {
 	targets;
@@ -1366,7 +1417,21 @@ var CheckInScheduler = class {
 	store;
 	onResult;
 	now;
-	timer;
+	/**
+	* One timer per enabled variant, keyed by variant id.
+	*
+	* Per-variant rather than one shared timer because the two products may be
+	* configured to different moments; a single timer would have to wake for the
+	* earliest and then decide who was due, which is the same bookkeeping with a
+	* worse failure mode.
+	*/
+	timers = /* @__PURE__ */ new Map();
+	/**
+	* Variants with a sweep in progress, so concurrent callers cannot double-claim.
+	*/
+	inFlight = /* @__PURE__ */ new Set();
+	/** When each variant's timer is next due, epoch ms, for the card to show. */
+	nextRuns = /* @__PURE__ */ new Map();
 	disposed = false;
 	constructor(options) {
 		this.targets = options.targets;
@@ -1378,56 +1443,113 @@ var CheckInScheduler = class {
 	start() {
 		if (this.disposed) return;
 		this.sweepAll(true);
-		this.armNextTimer();
+		this.rearm();
+	}
+	/**
+	* Re-run the startup catch-up once the toggles are actually readable.
+	*
+	* `start()` runs while the plugin is still assembling, before the settings
+	* section that owns these toggles has handed over its stored values, so that
+	* first sweep sees the raw plugin config and skips the day. The host calls
+	* this again from the section's source callback; the sweep is idempotent, so
+	* a day already handled costs nothing.
+	*/
+	catchUp() {
+		if (this.disposed) return;
+		this.sweepAll(true);
 	}
 	dispose() {
 		this.disposed = true;
-		if (this.timer) {
-			clearTimeout(this.timer);
-			this.timer = void 0;
-		}
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
 	}
-	armNextTimer() {
+	/**
+	* Re-place every variant's timer.
+	*
+	* Called after each fire and whenever configuration lands or changes, so a
+	* user editing the time on the card does not have to restart DSH for it to
+	* take effect.
+	*
+	* A timer is placed for every target, including variants whose toggle is
+	* currently off. `start()` runs while the plugin is still assembling, when
+	* the stored toggles are not readable yet, so gating placement on
+	* `isEnabled` left a variant with NO timer at all — and nothing re-armed it
+	* afterwards, which is precisely how a configured 12:13 check-in never
+	* fired. Whether the work is due is decided inside the sweep, where the
+	* configuration is current; the timer only decides when to look.
+	*/
+	rearm() {
 		if (this.disposed) return;
-		const delay = msUntilNext10amUtc8(this.now());
-		this.timer = setTimeout(() => {
-			this.sweepAll(false);
-			this.armNextTimer();
-		}, delay);
-		this.timer.unref?.();
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+		this.nextRuns.clear();
+		const nowMs = this.now();
+		for (const target of this.targets) {
+			const delay = msUntilNextCheckIn(target.minuteOfDay(), nowMs);
+			this.nextRuns.set(target.variantId, nowMs + delay);
+			const timer = setTimeout(() => {
+				this.timers.delete(target.variantId);
+				this.sweepAll(false, target.variantId).finally(() => {
+					this.rearm();
+				});
+			}, delay);
+			timer.unref?.();
+			this.timers.set(target.variantId, timer);
+		}
 	}
-	async sweepAll(isCatchUp) {
+	/** When this variant's timer is next due, epoch ms; absent before first arm. */
+	nextRunAt(variantId) {
+		return this.nextRuns.get(variantId);
+	}
+	async sweepAll(isCatchUp, only) {
 		if (this.disposed) return;
 		const nowMs = this.now();
 		const today = getUtc8DateString(nowMs);
 		for (const target of this.targets) {
+			if (only !== void 0 && target.variantId !== only) continue;
 			if (!this.isEnabled(target.variantId)) continue;
-			const record = this.store.read(target.variantId);
-			if (isCatchUp && !shouldCatchUp(today, record?.lastDate, nowMs)) continue;
-			if (!isCatchUp && record?.lastDate === today && (record.status === "claimed" || record.status === "already-claimed")) continue;
-			let pat;
+			if (this.inFlight.has(target.variantId)) continue;
+			this.inFlight.add(target.variantId);
 			try {
-				pat = await target.getPat();
-			} catch {
-				continue;
+				await this.sweepOne(target, isCatchUp, nowMs, today);
+			} finally {
+				this.inFlight.delete(target.variantId);
 			}
-			if (!pat) continue;
-			try {
-				const result = await target.service.checkIn(pat);
-				if (result.status !== "error") {
-					this.store.write(target.variantId, {
-						lastDate: result.date,
-						lastAt: result.timestamp,
-						status: result.status,
-						amount: result.amount,
-						message: result.message
-					});
-					if (result.status === "claimed") target.onClaimed?.();
-				}
-				this.onResult?.(result);
-			} catch {}
 		}
 	}
+	async sweepOne(target, isCatchUp, nowMs, today) {
+		const record = this.store.read(target.variantId);
+		if (record?.lastDate === today && (record.status === "claimed" || record.status === "already-claimed")) {
+			if (!isCatchUp) this.store.write(target.variantId, {
+				lastDate: today,
+				lastAt: nowMs,
+				status: "already-claimed",
+				...record.amount === void 0 ? {} : { amount: record.amount },
+				message: "Scheduled check-in ran; today was already claimed"
+			});
+			return;
+		}
+		if (isCatchUp && !isPastCheckInTime(target.minuteOfDay(), nowMs)) return;
+		let result;
+		try {
+			result = await target.checkIn();
+		} catch {
+			return;
+		}
+		try {
+			if (result.status !== "error") {
+				this.store.write(target.variantId, {
+					lastDate: result.date,
+					lastAt: result.timestamp,
+					status: result.status,
+					amount: result.amount,
+					message: result.message
+				});
+				if (result.status === "claimed") target.onClaimed?.();
+			}
+			this.onResult?.(result);
+		} catch {}
+	}
 };
 //#endregion
 //#region src/job-token-hint.ts
@@ -1507,6 +1629,175 @@ function appendHintRow(agent, kind, text) {
 	} catch {}
 }
 //#endregion
+//#region src/settings-store.ts
+/**
+* Plugin-owned settings store — the single source of truth for this plugin's
+* user configuration on every host line.
+*
+* WHY THIS EXISTS
+*
+* A settings write on DSH 0.1.7 goes through the profile patch
+* (`configEditor.edit`), which reconciles the whole loader tree and hot-reloads
+* the plugin's fiber (~1–1.5 s, plus a storm of client mirror refreshes) on
+* EVERY write — one per toggled switch. The plugin's own files (the credential,
+* the catalog cache) have always lived in `<profile>/.dsh-qoder-connect/`, so
+* the settings move there too: a write becomes a small atomic local file write
+* with an in-memory apply, no tree reconcile, no reload.
+*
+* FILE
+*   <plugin data dir>/settings.json   (same directory as the credential)
+*
+* The data directory is resolved by `qoderPluginDataDir()` — the ONE discovery
+* implementation this plugin already has (env override, then the declaring
+* profile, then the installing link). It is deliberately not re-implemented
+* here: a second copy of that logic is how a nested `.dsh-qoder-connect/
+* .dsh-qoder-connect/` path gets shipped.
+*
+* MIGRATION (one time)
+*   the file is absent → seed it from the entry config's own fields → write the
+*   file → delete ONLY this plugin's fields from the entry config (see
+*   ./index.ts), so the profile row returns to its shipped state.
+*
+* @module dsh-qoder-connect/settings-store
+*/
+const yaml = yamlModule;
+const loadYaml = typeof yaml.load === "function" ? yaml.load : yaml.default?.load;
+/** Settings file name inside the plugin data directory. */
+const SETTINGS_FILE_NAME = "settings.json";
+/** This plugin's data directory (shared with the credential and caches). */
+function dataDir() {
+	return qoderPluginDataDir();
+}
+/** Absolute path of the settings file. */
+function settingsFilePath() {
+	return join(dataDir(), SETTINGS_FILE_NAME);
+}
+/** Read + parse the settings file; `undefined` when absent or unreadable. */
+function readFile() {
+	const path = settingsFilePath();
+	if (!existsSync(path)) return void 0;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/** Write the settings file atomically (tmp + rename), creating the directory. */
+function writeSettings(values) {
+	const path = settingsFilePath();
+	mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(values, null, 2)}\n`, "utf8");
+	renameSync(tmp, path);
+}
+/** Resolve `$DSH_HOME` the way the Host does, without importing a Host package. */
+function dshHome() {
+	const fromEnv = process.env.DSH_HOME?.trim() || void 0;
+	if (fromEnv !== void 0) return fromEnv;
+	return join(homedir(), ".dsh");
+}
+/**
+* Read this plugin's sections out of the legacy settings document.
+*
+* The 0.1.5 host kept every plugin's settings in `$DSH_HOME/settings.yaml`;
+* 0.1.7 renames it to `settings.yaml.imported` once, on the first boot, and
+* imports only the sections whose names match a profile entry id. This
+* plugin's 0.1.5 sections were keyed by its SERVED NAMESPACES (`qoder`,
+* `qoder-global`, `qoder-quota`), which name no entry in the profile — the row
+* is `llm-qoder` — so the platform refuses them and their data survives only
+* in the renamed document. Reading it here recovers that data independently of
+* the platform's import, its section-name mapping, and its timing.
+*
+* @param namespaces - the section names the 0.1.5 host keyed this plugin's
+*   settings under (one per served section).
+* @returns the union of those sections' fields, or undefined when the document
+*   is absent, unreadable, or holds none of them.
+*/
+function readLegacySections(namespaces) {
+	let path;
+	for (const name of ["settings.yaml", "settings.yaml.imported"]) {
+		const candidate = join(dshHome(), name);
+		if (existsSync(candidate)) {
+			path = candidate;
+			break;
+		}
+	}
+	if (path === void 0 || loadYaml === void 0) return void 0;
+	let document;
+	try {
+		document = loadYaml(readFileSync(path, "utf8"));
+	} catch {
+		return;
+	}
+	if (document === null || typeof document !== "object") return void 0;
+	const merged = {};
+	let found = false;
+	for (const ns of namespaces) {
+		const section = document[ns];
+		if (section === null || typeof section !== "object" || Array.isArray(section)) continue;
+		Object.assign(merged, section);
+		found = true;
+	}
+	return found ? merged : void 0;
+}
+/**
+* Reserved bookkeeping key: how many writes the settings card has made through
+* this store. Its presence separates "the file holds migration seed" from "the
+* file holds the user's live edits" — see the seed rule in ./index.ts. Field
+* readers address their fields by name and never collide with it.
+*/
+const WRITE_MARK = "__writes";
+/**
+* One store instance: the plugin's own settings file, with the entry config as
+* the fallback layer the caller overlays it on.
+*/
+var SettingsStore = class {
+	/** The user layer exactly as stored (presence marks an override). */
+	user;
+	constructor() {
+		this.user = readFile() ?? {};
+	}
+	/** Whether the store file exists. */
+	exists() {
+		return existsSync(settingsFilePath());
+	}
+	/**
+	* Whether the settings card has ever written through this store.
+	*
+	* False during the migration window — the window where a 0.1.5 settings.yaml
+	* import (which lands only after the Loader settles, i.e. AFTER this plugin's
+	* first apply) can still deliver the user's real values, and where a first
+	* seed may have been taken before that import. While false the entry config
+	* stays authoritative; once the card writes, the file is — a runtime edit
+	* must never be regressed by a stale profile row.
+	*/
+	get edited() {
+		return typeof this.user[WRITE_MARK] === "number" && this.user[WRITE_MARK] > 0;
+	}
+	/**
+	* Apply one patch in memory and persist it.
+	* @param patch - field → value; a `null` value clears the field.
+	* @param fromCard - true when the settings card made this write; marks the
+	*   file as holding live user edits from then on.
+	* @returns the new user layer.
+	*/
+	patch(patch, fromCard = false) {
+		const next = { ...this.user };
+		for (const [field, value] of Object.entries(patch)) if (value === null) delete next[field];
+		else next[field] = value;
+		if (fromCard) next[WRITE_MARK] = (typeof next[WRITE_MARK] === "number" ? next[WRITE_MARK] : 0) + 1;
+		writeSettings(next);
+		for (const key of Object.keys(this.user)) delete this.user[key];
+		Object.assign(this.user, next);
+		return this.user;
+	}
+	/** The current user layer. */
+	values() {
+		return this.user;
+	}
+};
+//#endregion
 //#region src/index.ts
 /** Stable Cordis plugin name. */
 const name = "llm-qoder";
@@ -1586,21 +1877,99 @@ function credentialPollMs() {
 * stay in proportion under the `DSH_QODER_POLL_MS` override.
 */
 const CATALOG_RETRY_SWEEPS = 10;
+/**
+* Mark one configuration field as a live projected setting, when the host has
+* that concept at all.
+*
+* DSH 0.1.7 projects a `.volatile()` field into the profile's settings form and
+* hands the plugin a STABLE REFERENCE instead of the value; a field without the
+* mark never reaches the form — `dsh-settings`' `describe()` skips an entry
+* whose schema has no volatile field (`lib/index.js:411-421`), which is exactly
+* what makes the browser-side `configForms` namespace exist. DSH 0.1.5's
+* schemastery has no `volatile` at all, so calling it there is a `TypeError`
+* that would take the whole plugin down with it. The method is therefore
+* probed, never assumed.
+*
+* Only TOP-LEVEL fields are marked: a volatile field may not sit inside another
+* volatile field, and schemastery rejects a volatile node reached through a
+* collection (`validateVolatileSchema`), while the 0.1.7 client writes a single
+* path segment (`ConfigFormController.set` → `path: [field]`). Every field this
+* plugin exposes is already a top-level member of {@link Config}, so marking
+* the field itself is both legal and the only granularity the write path can
+* address.
+*
+* @param field - the field's schema.
+* @returns the projected schema on a host that supports projection, else the field itself.
+*/
+function volatileField(field) {
+	const probe = field;
+	if (typeof probe.volatile === "function") return probe.volatile();
+	if (typeof probe.extra === "function") return probe.extra("volatile", true);
+	if (probe && typeof probe === "object") {
+		probe.meta = {
+			...probe.meta,
+			volatile: true
+		};
+		return probe;
+	}
+	return field;
+}
+/**
+* Read one configuration field through the volatile indirection.
+*
+* On DSH 0.1.7 a `.volatile()` field arrives as a reference object whose value
+* is read with `.get()` (`@deepseek-ai/dsh-agent-default-model`,
+* `lib/index.js:38-41`); on DSH 0.1.5 the plain value arrives directly. Every
+* read of a projected field goes through here, so both hosts yield the value
+* itself.
+*
+* @param config - the raw plugin configuration, in either host's shape.
+* @param field - field name inside the configuration object.
+* @returns the field's value, or undefined when the field is absent.
+*/
+function readField(config, field) {
+	const value = config?.[field];
+	return value !== null && typeof value === "object" && typeof value.get === "function" ? value.get() : value;
+}
+/**
+* Read one declared field with its declared type.
+*
+* The typed face of {@link readField}, for the few call sites that want a
+* single field rather than a whole {@link readConfig}.
+*
+* @param config - the raw plugin configuration, in either host's shape.
+* @param field - field name inside the configuration object.
+* @returns the field's plain value, or undefined when it is absent.
+*/
+function readConfigField(config, field) {
+	return readField(config, field);
+}
 /** Probe authorization (shared by the plugin schema and the China section). */
-const PROBE_CONSENT_FIELD = z.boolean().default(false).description("Authorize reasoning-effort probes (each probe sends real requests that may consume credit)");
-const MAXIMUM_CONTEXT_WINDOW_FIELD = z.boolean().default(true).description("Use the largest context window declared by Qoder Global when alternatives are available (on by default)");
+const PROBE_CONSENT_FIELD = volatileField(z.boolean().default(false).description("Authorize reasoning-effort probes (each probe sends real requests that may consume credit)"));
+const MAXIMUM_CONTEXT_WINDOW_FIELD = volatileField(z.boolean().default(true).description("Use the largest context window declared by Qoder Global when alternatives are available (on by default)"));
 /** The China variant's own maximum-window preference. */
-const MAXIMUM_CONTEXT_WINDOW_CN_FIELD = z.boolean().default(true).description("Use the largest context window declared by Qoder (China) when alternatives are available (on by default)");
+const MAXIMUM_CONTEXT_WINDOW_CN_FIELD = volatileField(z.boolean().default(true).description("Use the largest context window declared by Qoder (China) when alternatives are available (on by default)"));
 /**
 * Per-model window overrides (model id → tokens). The card writes one entry
 * per selector change; the field is optional so an absent map means "no
 * overrides" rather than a default object the host must keep in sync.
 */
-const MODEL_CONTEXT_WINDOWS_FIELD = z.dict(z.number().min(1), z.string()).description("Per-model context-window overrides for Qoder Global (model id → tokens)");
+const MODEL_CONTEXT_WINDOWS_FIELD = volatileField(z.dict(z.number().min(1), z.string()).description("Per-model context-window overrides for Qoder Global (model id → tokens)"));
+/** Disabled models list (blacklist) */
+const DISABLED_MODELS_FIELD = volatileField(z.array(z.string()).default([]).description("Models hidden from the provider catalog and picker"));
 /** Sidebar quota toggle (one per variant; both live on the shared quota card). */
-const QUOTA_TOGGLE_FIELD = z.boolean().default(false).description("Show this variant’s remaining-credit card in the sidebar footer (off by default)");
+const QUOTA_TOGGLE_FIELD = volatileField(z.boolean().default(false).description("Show this variant’s remaining-credit card in the sidebar footer (off by default)"));
 /** Automatic check-in toggle. */
-const AUTO_CHECK_IN_FIELD = z.boolean().default(false).description("每天 10:00 (UTC+8) 自动签到领取算力额度（默认关闭）");
+const AUTO_CHECK_IN_FIELD = volatileField(z.boolean().default(false).description("每天自动签到领取算力额度（默认关闭）"));
+/**
+* When a variant checks in, as minutes past midnight in UTC+8.
+*
+* Stored as a plain minute count rather than a "HH:mm" string so the schema
+* itself rejects an impossible time: a browser time input yields 0–1439, and
+* anything outside that range fails Host validation instead of silently
+* scheduling a request at a moment that never arrives.
+*/
+const CHECK_IN_MINUTE_FIELD = volatileField(z.number().default(600).min(0).max(1439).description("每日自动签到的时刻（自 UTC+8 午夜起的分钟数，600 = 10:00）"));
 /**
 * Quota poll interval: default 5 minutes, floor 1 minute. The status route
 * performs a live upstream billing call per request with no cache, so an
@@ -1610,52 +1979,106 @@ const AUTO_CHECK_IN_FIELD = z.boolean().default(false).description("每天 10:00
 */
 const QUOTA_POLL_DEFAULT_MS = 3e5;
 const QUOTA_POLL_MIN_MS = 6e4;
-const QUOTA_POLL_FIELD = z.number().default(QUOTA_POLL_DEFAULT_MS).min(QUOTA_POLL_MIN_MS).description("Sidebar quota card refresh interval in milliseconds (default 300000, minimum 60000)");
+const QUOTA_POLL_FIELD = volatileField(z.number().default(QUOTA_POLL_DEFAULT_MS).min(QUOTA_POLL_MIN_MS).description("Sidebar quota card refresh interval in milliseconds (default 300000, minimum 60000)"));
 const Config = z.object({
 	probeConsent: PROBE_CONSENT_FIELD,
 	useMaximumContextWindow: MAXIMUM_CONTEXT_WINDOW_FIELD,
 	useMaximumContextWindowCN: MAXIMUM_CONTEXT_WINDOW_CN_FIELD,
 	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD,
 	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD,
+	disabledModels: DISABLED_MODELS_FIELD,
+	disabledModelsCN: DISABLED_MODELS_FIELD,
 	sidebarQuotaCN: QUOTA_TOGGLE_FIELD,
 	sidebarQuotaGlobal: QUOTA_TOGGLE_FIELD,
 	autoCheckInCN: AUTO_CHECK_IN_FIELD,
 	autoCheckInGlobal: AUTO_CHECK_IN_FIELD,
+	checkInMinuteCN: CHECK_IN_MINUTE_FIELD,
+	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
 	quotaPollMs: QUOTA_POLL_FIELD
 });
-/**
-* The China card's settings section: only the fields that card edits.
-*
-* A section is what makes its namespace "served", which is what the Plugins
-* tab dispatches a card by — so the schema and the card must stay split the
-* same way. `probeConsent` lives here because it predates the second variant;
-* it gates no current code path (only manual, per-click-confirmed probes run),
-* so it is left where existing users set it rather than moved and re-asked.
-*/
-const CHINA_SECTION = z.object({
+z.object({
 	probeConsent: PROBE_CONSENT_FIELD,
 	useMaximumContextWindowCN: MAXIMUM_CONTEXT_WINDOW_CN_FIELD,
-	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD
+	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD,
+	disabledModelsCN: DISABLED_MODELS_FIELD
 });
-/** The global card's settings section and its context-window preferences. */
-const GLOBAL_SECTION = z.object({
+z.object({
 	useMaximumContextWindow: MAXIMUM_CONTEXT_WINDOW_FIELD,
-	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD
+	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD,
+	disabledModels: DISABLED_MODELS_FIELD
 });
-/**
-* The shared quota card's section: both sidebar toggles and the poll interval.
-*
-* Only these fields — the card edits nothing else, and the Plugins tab pairs a
-* card with the section whose namespace it names, so a stray field here would
-* render as a control no other surface reads.
-*/
-const QUOTA_SECTION = z.object({
+z.object({
 	sidebarQuotaCN: QUOTA_TOGGLE_FIELD,
 	sidebarQuotaGlobal: QUOTA_TOGGLE_FIELD,
 	autoCheckInCN: AUTO_CHECK_IN_FIELD,
 	autoCheckInGlobal: AUTO_CHECK_IN_FIELD,
+	checkInMinuteCN: CHECK_IN_MINUTE_FIELD,
+	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
 	quotaPollMs: QUOTA_POLL_FIELD
 });
+/**
+* Every field each settings section owns, and therefore every field the live
+* configuration has to carry through.
+*
+* One list per section, shared by the merge and by the test that pins it to
+* the schema. Writing the merge out by hand is what broke auto check-in: the
+* `qoder-quota` section grew four fields (`autoCheckInCN`, `autoCheckInGlobal`,
+* `checkInMinuteCN`, `checkInMinuteGlobal`) while the merge kept copying only
+* the three that predated them, so `current().autoCheckInCN` read `undefined`
+* forever and the scheduler saw the toggle as permanently off. The card saved
+* it, the file held it, and nothing ever acted on it.
+*/
+const CN_SECTION_KEYS = [
+	"probeConsent",
+	"useMaximumContextWindowCN",
+	"modelContextWindowsCN",
+	"disabledModelsCN"
+];
+const GLOBAL_SECTION_KEYS = [
+	"useMaximumContextWindow",
+	"modelContextWindows",
+	"disabledModels"
+];
+const QUOTA_SECTION_KEYS = [
+	"sidebarQuotaCN",
+	"sidebarQuotaGlobal",
+	"autoCheckInCN",
+	"autoCheckInGlobal",
+	"checkInMinuteCN",
+	"checkInMinuteGlobal",
+	"quotaPollMs"
+];
+/** Every declared configuration field, in the order the sections are merged. */
+const CONFIG_KEYS = [
+	...CN_SECTION_KEYS,
+	...GLOBAL_SECTION_KEYS,
+	...QUOTA_SECTION_KEYS
+];
+/** Copy the declared fields off one section's source, skipping absent ones. */
+function pickFields(source, keys) {
+	const value = source();
+	const picked = {};
+	for (const key of keys) {
+		const field = readField(value, key);
+		if (field !== void 0) picked[key] = field;
+	}
+	return picked;
+}
+/**
+* Unwrap a whole configuration object into plain values.
+*
+* The merged configuration is read through {@link pickFields}/{@link readField}
+* everywhere else, but the plugin also reads its initial config directly while
+* it assembles its runtimes — before any settings section has handed over a
+* source. On 0.1.7 those direct reads would otherwise compare a reference
+* object against `true`/`undefined` and silently see "not set" for every field.
+*
+* @param config - the raw plugin configuration, in either host's shape.
+* @returns the same configuration with every declared field read out.
+*/
+function readConfig(config) {
+	return pickFields(() => config, CONFIG_KEYS);
+}
 /** Stable identity key used by credentials, probe records, and catalog entries. */
 const credentialIdentity = qoderCredentialIdentity;
 /** The settings namespace a variant's card and provider directory entry use. */
@@ -1701,10 +2124,23 @@ function createVariantRuntime(ctx, config, variant, current, identityOf) {
 		logger: ctx.logger
 	});
 	let jobTokenRefreshedAt;
+	const resolveAttachmentService = () => {
+		const service = ctx.get("attachments");
+		if (service === void 0) throw new Error("dsh-qoder-connect: no attachment service is available");
+		return service;
+	};
+	const attachments = {
+		get imageLimits() {
+			return resolveAttachmentService().imageLimits;
+		},
+		readImageRequest: async (attachment, policy, signal) => await resolveAttachmentService().readImageRequest(attachment, policy, signal),
+		saveImage: async (request) => await resolveAttachmentService().saveImage(request)
+	};
 	const transport = createQoderTransport({
 		region: variant.region,
 		resolvePat: () => store.patPromise(),
 		resolveMachineId: () => getMachineId([qoderMachineIdPath()]),
+		attachments,
 		onJobTokenRefreshed: (info) => {
 			jobTokenRefreshedAt = info.at;
 			ctx.logger.warn(`dsh-qoder-connect: ${variant.displayName} job token was auto-refreshed after an upstream rejection`);
@@ -1720,18 +2156,18 @@ function createVariantRuntime(ctx, config, variant, current, identityOf) {
 		providerId: variant.id,
 		getPat: () => store.patPromise(),
 		transport,
-		attachments: { saveImage: async (request) => {
-			const service = ctx.get("attachments");
-			if (service === void 0) throw new Error("dsh-qoder-connect: no attachment service is available to store images");
-			return await service.saveImage(request);
-		} }
+		attachments
 	});
 	const fallback = fallbackFor(variant);
 	const catalog = new QoderCatalog(fallback);
-	if (variant.id !== CHINA_VARIANT.id) catalog.setUseMaximumContextWindow(config.useMaximumContextWindow === true);
-	else {
-		catalog.setUseMaximumContextWindow(config.useMaximumContextWindowCN === true);
-		if (config.modelContextWindowsCN !== void 0) catalog.setModelContextWindows(config.modelContextWindowsCN);
+	const initial = current();
+	if (variant.id !== CHINA_VARIANT.id) {
+		catalog.setUseMaximumContextWindow(initial.useMaximumContextWindow === true);
+		if (initial.disabledModels !== void 0) catalog.setDisabledModels(initial.disabledModels);
+	} else {
+		catalog.setUseMaximumContextWindow(initial.useMaximumContextWindowCN === true);
+		if (initial.modelContextWindowsCN !== void 0) catalog.setModelContextWindows(initial.modelContextWindowsCN);
+		if (initial.disabledModelsCN !== void 0) catalog.setDisabledModels(initial.disabledModelsCN);
 	}
 	catalog.setVisible(false);
 	const probeStore = new QoderProbeStore({
@@ -1764,7 +2200,8 @@ function createVariantRuntime(ctx, config, variant, current, identityOf) {
 		inflightFetch: void 0,
 		invalidate: () => {},
 		registered: false,
-		jobTokenRefreshedAt: () => jobTokenRefreshedAt
+		jobTokenRefreshedAt: () => jobTokenRefreshedAt,
+		checkIn: (signal) => transport.checkIn(signal)
 	};
 }
 /** The catalog provenance the card displays. */
@@ -1833,9 +2270,11 @@ function detach(ctx, work, what) {
 * models read the shim origin at construction time. A failure here is
 * contained to this variant: the caller logs it and the other keeps working.
 *
+* @param seedCatalog - adopt the current credential into this runtime's
+*   catalog immediately; supplied by `apply` (it owns `adoptIdentity`).
 * @returns whether the provider registered.
 */
-async function startVariant(ctx, runtime) {
+async function startVariant(ctx, runtime, seedCatalog) {
 	const { variant, store, client, catalog, probeService } = runtime;
 	const shim = createQoderShim({
 		store,
@@ -1868,10 +2307,19 @@ async function startVariant(ctx, runtime) {
 		let releaseDirectory;
 		try {
 			releaseAdapter = ctx.llm.registerAdapter([variant.id], qoder.adapter);
+			const host017 = (() => {
+				try {
+					return ctx.get?.("configEditor") !== void 0;
+				} catch {
+					return false;
+				}
+			})();
+			const entryId = ctx.fiber?.entry?.options?.id;
+			const settingsNs = host017 && entryId !== void 0 ? entryId : settingsNamespaceFor(variant);
 			releaseDirectory = ctx.llm.registerConfigurableProviders([{
 				provider: variant.id,
 				displayName: variant.displayName,
-				settingsNs: settingsNamespaceFor(variant),
+				settingsNs,
 				settingsPath: [],
 				declared: false
 			}]);
@@ -1893,6 +2341,7 @@ async function startVariant(ctx, runtime) {
 			detach(ctx, shim.close(), "loopback endpoint close");
 		}
 		runtime.registered = true;
+		detach(ctx, seedCatalog(), `${variant.id} catalog seed`);
 		return true;
 	} catch (error) {
 		ctx.logger.error(`dsh-qoder-connect: ${variant.displayName} provider registration failed`, error);
@@ -1901,6 +2350,305 @@ async function startVariant(ctx, runtime) {
 	}
 }
 /**
+* State that MUST survive a fiber reload, module-level on purpose.
+*
+* DSH 0.1.7's configuration write (`configEditor.edit`) reconciles the profile
+* tree, which hot-reloads the entry's fiber — `apply()` runs again with a fresh
+* closure. Anything re-minted per apply is therefore invalidated by every
+* settings write: the browser cards hold the keys the status document handed
+* them, so a per-apply key turns each write into a wave of 403s ("刷新失败"),
+* and a per-apply identity map makes the sweep re-fetch the catalog from
+* upstream on every write (the burst of requests and most of the latency).
+*
+* Keys and identity/fetch bookkeeping are per-PROCESS secrets and caches, not
+* per-instance state, so they live here once. A reload keeps the same keys (no
+* 403 storm) and a same-account, freshly-fetched sweep (no refetch burst).
+*/
+/** The in-process control keys, minted once per process. */
+let processKeys;
+function controlKeys() {
+	processKeys ??= {
+		probe: createProbeKey(),
+		auth: createAuthKey()
+	};
+	return processKeys;
+}
+/** The loopback guard the probe and status routes use, restated for settings. */
+function trustedSettingsRequest(req) {
+	const host = req.headers.host ?? "";
+	const origin = req.headers.origin;
+	if (!/^(localhost|127(?:\.\d{1,3}){3}|\[::1\])(?::\d+)?$/i.test(String(host))) return false;
+	return origin === void 0 || /^https?:\/\/(localhost|127(?:\.\d{1,3}){3}|\[::1\])(?::\d+)?$/i.test(String(origin));
+}
+/**
+* The schema defaults, READ off each field's own `meta.default`.
+*
+* Two ways this was got wrong before, both silent and both destructive: a
+* hand-written table drifted from the schema (so the schema's own defaults
+* were classified as real overrides and the legacy settings document could
+* never win), and `validate({})` was then tried instead — which on this
+* schemastery answers with hollow `{}` per field instead of applying the
+* defaults, which is worse than nothing because it looks like it worked.
+* Walking `Config.dict` for `meta.default` is the only honest source: it is
+* the value schemastery itself substituted during validation.
+*/
+const DEFAULT_FOR_FIELD = (() => {
+	const out = {};
+	try {
+		for (const [key, field] of Object.entries(Config.dict ?? {})) {
+			const fallback = field?.meta?.default;
+			if (fallback !== void 0) out[key] = fallback;
+		}
+	} catch {}
+	if (Object.keys(out).length === 0) return {
+		probeConsent: false,
+		useMaximumContextWindow: true,
+		useMaximumContextWindowCN: true,
+		modelContextWindows: {},
+		modelContextWindowsCN: {},
+		disabledModels: [],
+		disabledModelsCN: [],
+		sidebarQuotaCN: false,
+		sidebarQuotaGlobal: false,
+		autoCheckInCN: false,
+		autoCheckInGlobal: false,
+		checkInMinuteCN: 600,
+		checkInMinuteGlobal: 600,
+		quotaPollMs: 3e5
+	};
+	return out;
+})();
+/**
+* Register the settings face (GET/POST) the browser cards read and write
+* through, answering the whole entry configuration as three layers.
+*
+* `value` carries every declared field, so a card rendering the quota section
+* sees the same merged view the host itself reads; `user` is the settings file
+* exactly as stored (presence marks an override), which is what the staged-edit
+* form's "written/reset" display needs. A POST validates the fields it is
+* allowed to touch, writes the file, applies the new view in memory, and
+* re-arms the check-in scheduler (the old 0.1.5 section `onChange` behaviour).
+*/
+function registerQoderSettingsFace(ctx, deps) {
+	const { store, config, current, apply, rearm } = deps;
+	const key = controlKeys().probe;
+	/** The document both routes answer with. */
+	const view = () => {
+		const merged = current();
+		const value = {};
+		const base = {};
+		for (const field of CONFIG_KEYS) {
+			if (merged[field] !== void 0) value[field] = merged[field];
+			base[field] = readConfig(config)[field] ?? DEFAULT_FOR_FIELD[field];
+		}
+		return {
+			key,
+			value,
+			base,
+			user: store.values()
+		};
+	};
+	ctx.effect(() => {
+		const dispose = ctx.webServer.register({
+			kind: "exact",
+			path: QODER_SETTINGS_FACE_PATH,
+			handler: async (req, res) => {
+				if (!trustedSettingsRequest(req)) {
+					jsonFace(res, 403, { error: "request-not-trusted" });
+					return;
+				}
+				if (req.method === "GET") {
+					jsonFace(res, 200, view());
+					return;
+				}
+				if (req.method !== "POST") {
+					jsonFace(res, 405, { error: "method not allowed" });
+					return;
+				}
+				if (req.headers["x-qoder-settings-key"] !== key) {
+					jsonFace(res, 403, { error: "invalid-key" });
+					return;
+				}
+				const body = await readFaceBody(req);
+				if (body === void 0) {
+					jsonFace(res, 413, { error: "body too large" });
+					return;
+				}
+				let patch;
+				try {
+					patch = JSON.parse(body || "{}");
+				} catch {
+					jsonFace(res, 400, { error: "invalid json" });
+					return;
+				}
+				if (patch === null || typeof patch !== "object" || Array.isArray(patch)) {
+					jsonFace(res, 400, { error: "invalid patch" });
+					return;
+				}
+				const invalid = validateSettingsPatch(patch);
+				if (invalid !== void 0) {
+					jsonFace(res, 400, { error: invalid });
+					return;
+				}
+				store.patch(patch, true);
+				apply(current());
+				rearm();
+				jsonFace(res, 200, view());
+			}
+		});
+		return () => {
+			dispose();
+		};
+	}, "dsh-qoder-connect: settings face");
+}
+/** JSON response helper for the settings face. */
+function jsonFace(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, { "Content-Type": "application/json" });
+	res.end(payload);
+}
+/** Read the request body, or undefined when absent or oversized. */
+function readFaceBody(req) {
+	return new Promise((resolve) => {
+		let body = "";
+		req.on("data", (chunk) => {
+			body += String(chunk);
+			if (body.length > 1e6) resolve(void 0);
+		});
+		req.on("end", () => resolve(body));
+		req.on("error", () => resolve(void 0));
+	});
+}
+/** Schema-level validation of one settings patch; the reason, or undefined. */
+function validateSettingsPatch(patch) {
+	for (const [field, value] of Object.entries(patch)) {
+		if (!CONFIG_KEYS.includes(field)) return `unknown field ${field}`;
+		if (value === null) continue;
+		switch (field) {
+			case "probeConsent":
+			case "useMaximumContextWindow":
+			case "useMaximumContextWindowCN":
+			case "sidebarQuotaCN":
+			case "sidebarQuotaGlobal":
+			case "autoCheckInCN":
+			case "autoCheckInGlobal":
+				if (typeof value !== "boolean") return `${field} must be a boolean`;
+				break;
+			case "disabledModels":
+			case "disabledModelsCN":
+				if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) return `${field} must be an array of strings`;
+				break;
+			case "checkInMinuteCN":
+			case "checkInMinuteGlobal":
+				if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 1439) return `${field} must be an integer minute 0..1439`;
+				break;
+			case "quotaPollMs":
+				if (typeof value !== "number" || !Number.isInteger(value) || value < 6e4) return `${field} must be an integer of at least 60000 ms`;
+				break;
+			case "modelContextWindows":
+			case "modelContextWindowsCN": if (typeof value !== "object" || value === null || Array.isArray(value)) return `${field} must be an object`;
+		}
+	}
+}
+/**
+* When the profile tree last recomposed, module-level so every apply sees it.
+*
+* The legacy settings.yaml import writes the profile patch one section at a
+* time for seconds after the Loader settles, emitting this event on every
+* write. Cleaning up our row in that window is futile — the import's next
+* section simply writes it back — so the cleanup waits for the tree to fall
+* quiet first.
+*/
+let lastConfigReloadAt = Date.now();
+/** Wait until the profile tree has been quiet (the legacy import finished). */
+async function waitForProfileQuiet() {
+	const deadline = Date.now() + 12e4;
+	for (;;) {
+		if (Date.now() - lastConfigReloadAt >= 5e3) return;
+		if (Date.now() >= deadline) return;
+		await new Promise((resolve) => setTimeout(resolve, 1e3));
+	}
+}
+/**
+* Delete this plugin's own fields from the profile entry config, leaving every
+* other key of the row untouched.
+*
+* One-time, right after the settings file has been seeded: the entry returns to
+* its shipped state, so no second source of truth remains. Both write APIs are
+* probed — `configEditor` (0.1.7) first, then the settings service's namespace
+* `replace` (0.1.5), which rebuilds each of this plugin's three sections from
+* the foreign keys alone.
+*
+* @param ctx - plugin context.
+* @param ownKeys - this plugin's declared config fields.
+* @param namespaces - the 0.1.5 section namespaces this plugin owns.
+*/
+async function cleanupEntryConfig(ctx, ownKeys, namespaces) {
+	const attempts = 10;
+	for (let attempt = 0; attempt < attempts; attempt++) try {
+		if (attempt === 0) await waitForProfileQuiet();
+		else await new Promise((resolve) => setTimeout(resolve, 2e3 + Math.random() * 1e3));
+		const probe = ctx;
+		const editor = (typeof probe.get === "function" ? (() => {
+			try {
+				return probe.get.call(ctx, "configEditor");
+			} catch {
+				return;
+			}
+		})() : void 0) ?? await new Promise((resolve) => {
+			ctx.inject(["settings"], (settingsCtx) => {
+				const owner = settingsCtx.settings?.ownerContext;
+				resolve(typeof owner?.get === "function" ? (() => {
+					try {
+						return owner.get.call(owner, "configEditor");
+					} catch {
+						return;
+					}
+				})() : void 0);
+			});
+		});
+		const entry = probe.fiber?.entry;
+		if (editor !== void 0 && entry !== void 0) {
+			await editor.edit(entry, (raw, inherited) => {
+				const next = { ...inherited ?? {} };
+				for (const [key, value] of Object.entries(raw ?? {})) {
+					if (ownKeys.includes(key)) continue;
+					if (!Object.hasOwn(next, key)) next[key] = value;
+				}
+				return next;
+			});
+			return;
+		}
+		await new Promise((resolve) => {
+			ctx.inject(["settings"], (settingsCtx) => {
+				const settings = settingsCtx.settings;
+				if (typeof settings?.replace !== "function" || typeof settings.installSection !== "function") {
+					resolve(void 0);
+					return;
+				}
+				Promise.all(namespaces.map((ns) => Promise.resolve(settings.replace(ns, {})).catch(() => void 0))).then(() => resolve(void 0));
+			});
+		});
+		return;
+	} catch (error) {
+		if (attempt === 9) {
+			ctx.logger?.warn?.("dsh-qoder-connect: entry config cleanup failed", error);
+			return;
+		}
+		await new Promise((resolve) => setTimeout(resolve, 500 * (attempt + 1) + Math.random() * 500));
+	}
+}
+/** The account identity each variant last published a catalog for, across reloads. */
+const lastIdentities = /* @__PURE__ */ new Map();
+/**
+* When a variant's catalog was last fetched LIVE from upstream, per identity.
+*
+* A reload reseeds the catalog from the saved file; without this record the
+* sweep's retry rule (`stale && due`) sees `lastFetchAtMs = 0` and re-fetches
+* immediately — one upstream round trip per variant per settings write.
+*/
+const lastLiveFetchAt = /* @__PURE__ */ new Map();
+/**
 * Start both variants: their loopback endpoints, the `qoder` and
 * `qoder-global` providers, their configuration cards, and their
 * credential-driven catalog lifecycles.
@@ -1911,23 +2659,82 @@ async function startVariant(ctx, runtime) {
 * without re-registering the provider.
 */
 function apply(ctx, config) {
-	let current = () => config;
+	const store = new SettingsStore();
+	let current = () => ({
+		...readConfig(config),
+		...store.values()
+	});
+	/**
+	* One-time migration: per field — the file never held it → take the entry;
+	* the card HAS written this file → keep the file; the entry carries a
+	* NON-DEFAULT value → take the entry (the legacy settings.yaml import lands
+	* only after the Loader settles, i.e. after this plugin's first apply, and a
+	* seed taken inside that window can hold a stale or mis-encoded value); the
+	* entry only carries the schema default → keep the file.
+	*
+	* That last clause is load-bearing: a bundle layer's insert config does NOT
+	* reach the composition (verified with `dsh --dump-config`), so once the
+	* one-time cleanup has emptied the entry row the entry answers pure defaults —
+	* treating those as authoritative would erase the user's values on the next
+	* boot. Re-checked on every apply, which is also what closes the legacy
+	* import's timing window.
+	*
+	* When the entry is authoritative, its own fields are then deleted from the
+	* profile row, so no second source of truth remains.
+	*/
+	const migrateOwnSettings = () => {
+		const legacy = readLegacySections([
+			QODER_SETTINGS_NS,
+			QODER_GLOBAL_SETTINGS_NS,
+			QODER_QUOTA_SETTINGS_NS
+		]);
+		const seeded = {};
+		for (const key of CONFIG_KEYS) {
+			const entryValue = readField(config, key);
+			const legacyValue = legacy === void 0 ? void 0 : legacy[key];
+			if (!Object.hasOwn(store.user, key)) {
+				if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = entryValue;
+				else if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
+				else if (entryValue !== void 0) seeded[key] = entryValue;
+				else if (legacyValue !== void 0) seeded[key] = legacyValue;
+				continue;
+			}
+			if (store.edited) continue;
+			if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) {
+				seeded[key] = entryValue;
+				continue;
+			}
+			if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
+		}
+		if (Object.keys(seeded).length === 0) return;
+		store.patch(seeded);
+		cleanupEntryConfig(ctx, CONFIG_KEYS, [
+			QODER_SETTINGS_NS,
+			QODER_GLOBAL_SETTINGS_NS,
+			QODER_QUOTA_SETTINGS_NS
+		]);
+	};
+	migrateOwnSettings();
+	const eventSink = ctx;
+	eventSink.on("loader/volatile-update", () => {
+		migrateOwnSettings();
+	});
+	eventSink.on("app-boot/config-reload", () => {
+		lastConfigReloadAt = Date.now();
+	});
 	/** Timers and in-flight work belonging to this plugin instance. */
 	let stopped = false;
 	const timers = [];
-	/**
-	* The account identity each variant last published a catalog for. Keeps a
-	* same-token sweep from re-fetching, and lets a late response from a
-	* previous identity be discarded instead of overwriting a newer one.
-	*/
-	const lastIdentities = /* @__PURE__ */ new Map();
 	const runtimes = QODER_VARIANTS.map((variant) => createVariantRuntime(ctx, config, variant, () => current(), (id) => lastIdentities.get(id)));
 	const checkInStore = new JsonFileCheckInStore();
 	const checkInScheduler = new CheckInScheduler({
 		targets: runtimes.map((runtime) => ({
 			variantId: runtime.variant.id,
-			service: runtime.transport.checkInService,
-			getPat: async () => runtime.store.patPromise(),
+			checkIn: (signal) => runtime.checkIn(signal),
+			minuteOfDay: () => {
+				const cfg = current();
+				return normalizeCheckInMinute((runtime.variant.id === CHINA_VARIANT.id ? cfg.checkInMinuteCN : cfg.checkInMinuteGlobal) ?? 600);
+			},
 			onClaimed: () => {
 				runtime.client.fetchCredits().catch(() => void 0);
 			}
@@ -1940,20 +2747,26 @@ function apply(ctx, config) {
 		store: checkInStore
 	});
 	checkInScheduler.start();
-	installJobTokenHint(ctx);
-	const probeKey = createProbeKey();
 	/**
-	* The in-process key authorizing PAT writes, minted separately from the
-	* probe key.
+	* The startup catch-up, run once more from the settings source callback.
 	*
-	* Separate keys rather than one shared secret because the two authorize
-	* different powers: one spends credit on a probe, the other stores a
-	* credential. A single key handed to both would let a defect in either card
-	* reach the other's authority.
+	* `start()` above runs while the plugin is still assembling: the section
+	* that stores these toggles has not handed over its values yet, so that
+	* sweep reads the raw plugin config, sees no toggle, and skips the day. The
+	* retry is what makes "boot after 10:00" actually claim.
 	*/
-	const authKey = createAuthKey();
+	let startupCatchUpDone = false;
+	const runStartupCatchUpOnce = () => {
+		if (startupCatchUpDone) return;
+		startupCatchUpDone = true;
+		checkInScheduler.catchUp();
+	};
+	installJobTokenHint(ctx);
+	const { probe: probeKey, auth: authKey } = controlKeys();
 	let setMaximumContextWindow;
 	let setMaximumContextWindowCN;
+	let setModelsEnabled;
+	let setModelsEnabledCN;
 	/**
 	* Point a variant at an account identity, invalidating whatever the previous
 	* one left behind.
@@ -1977,7 +2790,7 @@ function apply(ctx, config) {
 	const adoptIdentity = (runtime, identity) => {
 		const id = runtime.variant.id;
 		const known = lastIdentities.get(id);
-		if (known === identity) return;
+		if (known === identity && runtime.catalog.isVisible()) return;
 		const hadCredential = known !== void 0;
 		if (identity === void 0) lastIdentities.delete(id);
 		else lastIdentities.set(id, identity);
@@ -2011,20 +2824,54 @@ function apply(ctx, config) {
 		runtime.catalog.setVisible(true);
 		runtime.invalidate();
 	};
+	/**
+	* Apply catalog preferences from a configuration view, in memory.
+	*
+	* Shared by the probe-route setters and the settings face's POST: both write
+	* the plugin-owned settings file and then land the new view here, which is
+	* what the cards see on their next status read.
+	*/
+	const applyCatalogSettings = (next) => {
+		let changed = false;
+		for (const runtime of runtimes) {
+			const isChina = runtime.variant.id === CHINA_VARIANT.id;
+			const preference = isChina ? next.useMaximumContextWindowCN : next.useMaximumContextWindow;
+			if (runtime.catalog.setUseMaximumContextWindow(preference === true)) changed = true;
+			const overrides = isChina ? next.modelContextWindowsCN : next.modelContextWindows;
+			if (overrides !== void 0 && runtime.catalog.setModelContextWindows(overrides)) changed = true;
+			const disabled = isChina ? next.disabledModelsCN : next.disabledModels;
+			if (runtime.catalog.setDisabledModels(disabled ?? [])) changed = true;
+		}
+		if (changed) for (const runtime of runtimes) runtime.invalidate();
+	};
 	ctx.inject(["webServer"], (webCtx) => {
 		for (const runtime of runtimes) {
 			registerQoderStatusRoute(webCtx, {
 				path: runtime.variant.statusPath,
 				store: runtime.store,
 				client: runtime.client,
-				models: () => runtime.catalog.current(),
+				models: () => runtime.catalog.all(),
 				catalog: () => catalogSection(runtime),
 				probe: () => probeSection(runtime, current().probeConsent === true),
 				probeKey,
 				authKey,
-				...runtime.variant.id === CHINA_VARIANT.id ? { useMaximumContextWindow: () => current().useMaximumContextWindowCN === true } : { useMaximumContextWindow: () => current().useMaximumContextWindow === true },
+				...runtime.variant.id === CHINA_VARIANT.id ? {
+					useMaximumContextWindow: () => current().useMaximumContextWindowCN === true,
+					disabledModels: () => current().disabledModelsCN ?? []
+				} : {
+					useMaximumContextWindow: () => current().useMaximumContextWindow === true,
+					disabledModels: () => current().disabledModels ?? []
+				},
 				jobTokenRefreshedAt: runtime.jobTokenRefreshedAt,
-				checkIn: () => checkInStore.read(runtime.variant.id)
+				checkIn: () => {
+					const record = checkInStore.read(runtime.variant.id);
+					if (record === void 0) return void 0;
+					const nextRunAt = checkInScheduler.nextRunAt(runtime.variant.id);
+					return {
+						...record,
+						...nextRunAt === void 0 ? {} : { nextRunAt }
+					};
+				}
 			});
 			registerQoderAuthRoute(webCtx, {
 				path: runtime.variant.authPath,
@@ -2091,16 +2938,7 @@ function apply(ctx, config) {
 					checkInStore.clearLogs(runtime.variant.id);
 				},
 				checkIn: async () => {
-					let pat;
-					try {
-						pat = await runtime.store.patPromise();
-					} catch {
-						return {
-							state: "failed",
-							reason: "No PAT available"
-						};
-					}
-					const result = await runtime.transport.checkInService.checkIn(pat);
+					const result = await runtime.checkIn();
 					if (result.status !== "error") {
 						checkInStore.write(runtime.variant.id, {
 							lastDate: result.date,
@@ -2117,81 +2955,98 @@ function apply(ctx, config) {
 						...result.message === void 0 ? {} : { reason: result.message }
 					};
 				},
-				...runtime.variant.id === CHINA_VARIANT.id ? { setMaximumContextWindow: async (enabled) => {
-					if (setMaximumContextWindowCN === void 0) return {
-						state: "failed",
-						reason: "settings are unavailable"
-					};
-					return setMaximumContextWindowCN(enabled);
-				} } : { setMaximumContextWindow: async (enabled) => {
-					if (setMaximumContextWindow === void 0) return {
-						state: "failed",
-						reason: "settings are unavailable"
-					};
-					return setMaximumContextWindow(enabled);
-				} }
+				...runtime.variant.id === CHINA_VARIANT.id ? {
+					setMaximumContextWindow: async (enabled) => {
+						if (setMaximumContextWindowCN === void 0) return {
+							state: "failed",
+							reason: "settings are unavailable"
+						};
+						return setMaximumContextWindowCN(enabled);
+					},
+					setModelsEnabled: async (opts) => {
+						if (setModelsEnabledCN === void 0) return {
+							state: "failed",
+							reason: "settings are unavailable"
+						};
+						return setModelsEnabledCN(opts);
+					}
+				} : {
+					setMaximumContextWindow: async (enabled) => {
+						if (setMaximumContextWindow === void 0) return {
+							state: "failed",
+							reason: "settings are unavailable"
+						};
+						return setMaximumContextWindow(enabled);
+					},
+					setModelsEnabled: async (opts) => {
+						if (setModelsEnabled === void 0) return {
+							state: "failed",
+							reason: "settings are unavailable"
+						};
+						return setModelsEnabled(opts);
+					}
+				}
 			}, probeKey);
 		}
+		registerQoderSettingsFace(webCtx, {
+			store,
+			config,
+			current,
+			apply: applyCatalogSettings,
+			rearm: () => {
+				runStartupCatchUpOnce();
+				checkInScheduler.rearm();
+			}
+		});
 	});
 	ctx.inject(["settings"], (settingsCtx) => {
-		/** Section sources; each falls back to its own slice when its side unloads. */
-		const sources = {
-			cn: () => config,
-			global: () => config,
-			quota: () => config
-		};
-		/** Merge all sections into the whole config the rest of the plugin reads. */
-		const merged = () => ({
-			...sources.cn().probeConsent === void 0 ? {} : { probeConsent: sources.cn().probeConsent },
-			...sources.cn().useMaximumContextWindowCN === void 0 ? {} : { useMaximumContextWindowCN: sources.cn().useMaximumContextWindowCN },
-			...sources.cn().modelContextWindowsCN === void 0 ? {} : { modelContextWindowsCN: sources.cn().modelContextWindowsCN },
-			...sources.global().useMaximumContextWindow === void 0 ? {} : { useMaximumContextWindow: sources.global().useMaximumContextWindow },
-			...sources.global().modelContextWindows === void 0 ? {} : { modelContextWindows: sources.global().modelContextWindows },
-			...sources.quota().sidebarQuotaCN === void 0 ? {} : { sidebarQuotaCN: sources.quota().sidebarQuotaCN },
-			...sources.quota().sidebarQuotaGlobal === void 0 ? {} : { sidebarQuotaGlobal: sources.quota().sidebarQuotaGlobal },
-			...sources.quota().quotaPollMs === void 0 ? {} : { quotaPollMs: sources.quota().quotaPollMs }
-		});
-		const applyMaximumContextWindow = (next) => {
-			let changed = false;
-			for (const runtime of runtimes) {
-				const isChina = runtime.variant.id === CHINA_VARIANT.id;
-				const preference = isChina ? next.useMaximumContextWindowCN : next.useMaximumContextWindow;
-				if (runtime.catalog.setUseMaximumContextWindow(preference === true)) changed = true;
-				const overrides = isChina ? next.modelContextWindowsCN : next.modelContextWindows;
-				if (overrides !== void 0 && runtime.catalog.setModelContextWindows(overrides)) changed = true;
-			}
-			if (changed) for (const runtime of runtimes) runtime.invalidate();
-		};
-		const repointStores = () => {
-			applyMaximumContextWindow(merged());
+		/**
+		* `auto: false` turns OFF the host's generated form page for this entry —
+		* the plugin ships its own card, which is now the only editor. It must be
+		* called as a METHOD: on 0.1.7 `configure` is a SettingsForms class method
+		* (it reads `this.presentations`), and extracting it as a free function
+		* throws a TypeError that used to kill the whole settings callback.
+		*/
+		const settingsService = settingsCtx.settings;
+		if (typeof settingsService.configure === "function") try {
+			settingsCtx.effect(() => {
+				const dispose = settingsService.configure({ auto: false }, ctx.fiber);
+				return typeof dispose === "function" ? dispose : () => {};
+			});
+		} catch (error) {
+			console.error("[dsh-qoder-connect] settings.configure failed (own settings file still serves):", error);
+		}
+		/**
+		* The four setters, now one implementation on both hosts: write the
+		* plugin-owned settings file, then apply the new view in memory. No
+		* profile-patch write means no tree reconcile, no fiber reload, and no
+		* client-mirror storm per toggle.
+		*/
+		const write = (patch) => {
+			store.patch(patch, true);
+			applyCatalogSettings(current());
+			checkInScheduler.rearm();
 		};
-		settingsCtx.settings.installSection(ctx, QODER_SETTINGS_NS, CHINA_SECTION, config, {
-			setSource(source) {
-				sources.cn = source;
-				current = merged;
-			},
-			onChange: repointStores
-		});
-		settingsCtx.settings.installSection(ctx, QODER_GLOBAL_SETTINGS_NS, GLOBAL_SECTION, config, {
-			setSource(source) {
-				sources.global = source;
-				current = merged;
-			},
-			onChange: repointStores
-		});
-		settingsCtx.settings.installSection(ctx, QODER_QUOTA_SETTINGS_NS, QUOTA_SECTION, config, {
-			setSource(source) {
-				sources.quota = source;
-				current = merged;
-			},
-			onChange: () => {}
-		});
 		setMaximumContextWindow = async (enabled) => {
-			await settingsCtx.settings.update(QODER_GLOBAL_SETTINGS_NS, { useMaximumContextWindow: enabled });
+			write({ useMaximumContextWindow: enabled });
 			return { state: "updated" };
 		};
 		setMaximumContextWindowCN = async (enabled) => {
-			await settingsCtx.settings.update(QODER_SETTINGS_NS, { useMaximumContextWindowCN: enabled });
+			write({ useMaximumContextWindowCN: enabled });
+			return { state: "updated" };
+		};
+		setModelsEnabled = async ({ models, enabled }) => {
+			const currentDisabled = new Set(readConfigField(current(), "disabledModels") ?? []);
+			for (const m of models) if (enabled) currentDisabled.delete(m);
+			else currentDisabled.add(m);
+			write({ disabledModels: Array.from(currentDisabled) });
+			return { state: "updated" };
+		};
+		setModelsEnabledCN = async ({ models, enabled }) => {
+			const currentDisabled = new Set(readConfigField(current(), "disabledModelsCN") ?? []);
+			for (const m of models) if (enabled) currentDisabled.delete(m);
+			else currentDisabled.add(m);
+			write({ disabledModelsCN: Array.from(currentDisabled) });
 			return { state: "updated" };
 		};
 	});
@@ -2257,6 +3112,7 @@ function apply(ctx, config) {
 			}
 			if (stopped || runtime.catalogGeneration !== generation) return;
 			runtime.lastFetchAtMs = Date.now();
+			lastLiveFetchAt.set(identity, runtime.lastFetchAtMs);
 			runtime.catalog.set([...models]);
 			runtime.catalogSource = "live";
 			runtime.catalogFetchedAtMs = runtime.client.lastCatalog?.fetchedAtMs ?? Date.now();
@@ -2309,7 +3165,8 @@ function apply(ctx, config) {
 		const identity = credentialIdentity(credential);
 		if (lastIdentities.get(runtime.variant.id) === identity && runtime.catalog.isVisible()) {
 			const stale = runtime.catalogSource !== "live";
-			const due = Date.now() - runtime.lastFetchAtMs >= credentialPollMs() * CATALOG_RETRY_SWEEPS;
+			const fetchedAt = lastLiveFetchAt.get(identity) ?? 0;
+			const due = Date.now() - fetchedAt >= credentialPollMs() * CATALOG_RETRY_SWEEPS;
 			if (stale && due) await fetchCatalog(runtime, identity);
 			return;
 		}
@@ -2327,7 +3184,18 @@ function apply(ctx, config) {
 	* would be an unhandled rejection — which Node turns into process
 	* termination, taking the whole Harness down over one plugin's startup.
 	*/
-	detach(ctx, Promise.all(runtimes.map(async (runtime) => startVariant(ctx, runtime))).then(() => {
+	detach(ctx, Promise.all(runtimes.map(async (runtime) => startVariant(ctx, runtime, async () => {
+		if (stopped) return;
+		let credential;
+		try {
+			credential = await runtime.store.current();
+		} catch {
+			return;
+		}
+		if (credential === void 0) return;
+		const identity = credentialIdentity(credential);
+		if (lastIdentities.get(runtime.variant.id) !== identity || !runtime.catalog.isVisible()) adoptIdentity(runtime, identity);
+	}))).then(() => {
 		if (stopped) return;
 		if (runtimes.some((runtime) => runtime.registered)) detach(ctx, writeHostHeartbeat(), "host heartbeat write");
 		detach(ctx, syncAll(), "credential sweep");
@@ -2339,4 +3207,4 @@ function apply(ctx, config) {
 	}), "variant startup");
 }
 //#endregion
-export { CHINA_VARIANT, Config, FALLBACK_QODER_MODELS, GLOBAL_VARIANT, KIND_STATUS, PROBE_EFFORT_CANDIDATES, QODER_AUTH_FILENAME, QODER_AUTH_PATH, QODER_DATA_DIR_ENV, QODER_DATA_DIR_NAME, QODER_GLOBAL_AUTH_PATH, QODER_GLOBAL_PROBE_PATH, QODER_GLOBAL_SETTINGS_NS, QODER_GLOBAL_STATUS_PATH, QODER_HOST_HEARTBEAT_FILENAME, QODER_PAT_ENV_CN, QODER_PAT_ENV_GLOBAL, QODER_PROBE_FILENAME, QODER_PROBE_PATH, QODER_PROVIDER, QODER_QUOTA_SETTINGS_NS, QODER_SETTINGS_NS, QODER_STATUS_PATH, QODER_STREAM_IDLE_TIMEOUT_MS, QODER_VARIANTS, QUOTA_POLL_DEFAULT_MS, QUOTA_POLL_MIN_MS, QoderCatalog, QoderCatalogStore, QoderCredentialStore, QoderProbeService, QoderProbeStore, QoderUpstreamClient, apply, classifyUpstreamError, clearHostHeartbeat, createAuthKey, createQoderAdapter, createQoderShim, fingerprintModel, inject, isHeartbeatProcessAlive, kindFromQoderFailure, modelInfoOf, name, normalizeCredits, patTail, probeModel, processStartTimeMs, qoderAuthHandler, qoderCatalogPath, qoderCredentialIdentity, qoderHostHeartbeatPath, qoderOwnAuthPath, qoderPluginDataDir, qoderProbePath, randomSentinel, readHostHeartbeat, registerQoderAuthRoute, variantFor };
+export { CHINA_VARIANT, CN_SECTION_KEYS, Config, FALLBACK_QODER_MODELS, GLOBAL_SECTION_KEYS, GLOBAL_VARIANT, KIND_STATUS, PROBE_EFFORT_CANDIDATES, QODER_AUTH_FILENAME, QODER_AUTH_PATH, QODER_DATA_DIR_ENV, QODER_DATA_DIR_NAME, QODER_GLOBAL_AUTH_PATH, QODER_GLOBAL_PROBE_PATH, QODER_GLOBAL_SETTINGS_NS, QODER_GLOBAL_STATUS_PATH, QODER_HOST_HEARTBEAT_FILENAME, QODER_PAT_ENV_CN, QODER_PAT_ENV_GLOBAL, QODER_PROBE_FILENAME, QODER_PROBE_PATH, QODER_PROVIDER, QODER_QUOTA_SETTINGS_NS, QODER_SETTINGS_NS, QODER_STATUS_PATH, QODER_STREAM_IDLE_TIMEOUT_MS, QODER_VARIANTS, QUOTA_POLL_DEFAULT_MS, QUOTA_POLL_MIN_MS, QUOTA_SECTION_KEYS, QoderCatalog, QoderCatalogStore, QoderCredentialStore, QoderProbeService, QoderProbeStore, QoderUpstreamClient, apply, classifyUpstreamError, clearHostHeartbeat, createAuthKey, createQoderAdapter, createQoderShim, fingerprintModel, inject, isHeartbeatProcessAlive, kindFromQoderFailure, modelInfoOf, name, normalizeCredits, patTail, probeModel, processStartTimeMs, qoderAuthHandler, qoderCatalogPath, qoderCredentialIdentity, qoderHostHeartbeatPath, qoderOwnAuthPath, qoderPluginDataDir, qoderProbePath, randomSentinel, readHostHeartbeat, registerQoderAuthRoute, variantFor };