dsh-qoder-connect 0.1.8 → 0.1.9

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as QODER_GLOBAL_AUTH_PATH, B as qoderCredentialIdentity, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_AUTH_FILENAME, G as qoderPluginDataDir, H as QODER_DATA_DIR_ENV, I as QODER_PAT_ENV_CN, K as qoderStateDir, L as QODER_PAT_ENV_GLOBAL, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_STATUS_PATH, R as QoderCredentialStore, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_NAME, V as qoderOwnAuthPath, W as qoderMachineIdPath, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as patTail } from "./variants-DE76gF0Y.js";
+import { A as QODER_GLOBAL_AUTH_PATH, B as patTail, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_STATUS_PATH, G as qoderMachineIdPath, H as qoderOwnAuthPath, I as QODER_AUTH_FILENAME, K as qoderPluginDataDir, L as QODER_PAT_ENV_CN, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_SETTINGS_FACE_PATH, R as QODER_PAT_ENV_GLOBAL, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_ENV, V as qoderCredentialIdentity, W as QODER_DATA_DIR_NAME, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as qoderStateDir, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as QoderCredentialStore } from "./variants-C8ezztjV.js";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
@@ -7,8 +7,10 @@ import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { homedir } from "node:os";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import yamlModule from "js-yaml";
 //#region src/loopback.ts
 /**
 * Shared loopback gates for the plugin's local HTTP surfaces: the loopback
@@ -265,6 +267,17 @@ const NO_COST = {
 */
 const RATE_SEPARATOR = " · ";
 /**
+* What the model seat shows in place of a rate the plugin cannot stand behind.
+*
+* The seat has no locale service (the adapter is a host seam), so this is a
+* literal; it matches the settings card's own wording for the same state.
+* Rendering it as WORDS rather than an empty slot: every other model in the
+* seat shows `· x0.3`, so a bare name where the rate should be reads as a
+* rendering bug. This plugin's fallback roster carries no rate at all, so the
+* case is not hypothetical.
+*/
+const RATE_UNAVAILABLE = "价格暂不可用";
+/**
 * Append the billing rate to one model's display name.
 *
 * The rate rides the *name* alone: since DSH 0.1.2 the composer's model seat
@@ -280,6 +293,7 @@ const RATE_SEPARATOR = " · ";
 */
 /** The catalog display suffix: the normalized billing rate, when the row has one. */
 function displaySuffix(info) {
+	if (info.billing?.rateUnknown === true) return RATE_UNAVAILABLE;
 	const rate = normalizeCredits(info.billing?.credits);
 	return rate === void 0 || rate === "" ? void 0 : rate;
 }
@@ -1615,6 +1629,175 @@ function appendHintRow(agent, kind, text) {
 	} catch {}
 }
 //#endregion
+//#region src/settings-store.ts
+/**
+* Plugin-owned settings store — the single source of truth for this plugin's
+* user configuration on every host line.
+*
+* WHY THIS EXISTS
+*
+* A settings write on DSH 0.1.7 goes through the profile patch
+* (`configEditor.edit`), which reconciles the whole loader tree and hot-reloads
+* the plugin's fiber (~1–1.5 s, plus a storm of client mirror refreshes) on
+* EVERY write — one per toggled switch. The plugin's own files (the credential,
+* the catalog cache) have always lived in `<profile>/.dsh-qoder-connect/`, so
+* the settings move there too: a write becomes a small atomic local file write
+* with an in-memory apply, no tree reconcile, no reload.
+*
+* FILE
+*   <plugin data dir>/settings.json   (same directory as the credential)
+*
+* The data directory is resolved by `qoderPluginDataDir()` — the ONE discovery
+* implementation this plugin already has (env override, then the declaring
+* profile, then the installing link). It is deliberately not re-implemented
+* here: a second copy of that logic is how a nested `.dsh-qoder-connect/
+* .dsh-qoder-connect/` path gets shipped.
+*
+* MIGRATION (one time)
+*   the file is absent → seed it from the entry config's own fields → write the
+*   file → delete ONLY this plugin's fields from the entry config (see
+*   ./index.ts), so the profile row returns to its shipped state.
+*
+* @module dsh-qoder-connect/settings-store
+*/
+const yaml = yamlModule;
+const loadYaml = typeof yaml.load === "function" ? yaml.load : yaml.default?.load;
+/** Settings file name inside the plugin data directory. */
+const SETTINGS_FILE_NAME = "settings.json";
+/** This plugin's data directory (shared with the credential and caches). */
+function dataDir() {
+	return qoderPluginDataDir();
+}
+/** Absolute path of the settings file. */
+function settingsFilePath() {
+	return join(dataDir(), SETTINGS_FILE_NAME);
+}
+/** Read + parse the settings file; `undefined` when absent or unreadable. */
+function readFile() {
+	const path = settingsFilePath();
+	if (!existsSync(path)) return void 0;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/** Write the settings file atomically (tmp + rename), creating the directory. */
+function writeSettings(values) {
+	const path = settingsFilePath();
+	mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(values, null, 2)}\n`, "utf8");
+	renameSync(tmp, path);
+}
+/** Resolve `$DSH_HOME` the way the Host does, without importing a Host package. */
+function dshHome() {
+	const fromEnv = process.env.DSH_HOME?.trim() || void 0;
+	if (fromEnv !== void 0) return fromEnv;
+	return join(homedir(), ".dsh");
+}
+/**
+* Read this plugin's sections out of the legacy settings document.
+*
+* The 0.1.5 host kept every plugin's settings in `$DSH_HOME/settings.yaml`;
+* 0.1.7 renames it to `settings.yaml.imported` once, on the first boot, and
+* imports only the sections whose names match a profile entry id. This
+* plugin's 0.1.5 sections were keyed by its SERVED NAMESPACES (`qoder`,
+* `qoder-global`, `qoder-quota`), which name no entry in the profile — the row
+* is `llm-qoder` — so the platform refuses them and their data survives only
+* in the renamed document. Reading it here recovers that data independently of
+* the platform's import, its section-name mapping, and its timing.
+*
+* @param namespaces - the section names the 0.1.5 host keyed this plugin's
+*   settings under (one per served section).
+* @returns the union of those sections' fields, or undefined when the document
+*   is absent, unreadable, or holds none of them.
+*/
+function readLegacySections(namespaces) {
+	let path;
+	for (const name of ["settings.yaml", "settings.yaml.imported"]) {
+		const candidate = join(dshHome(), name);
+		if (existsSync(candidate)) {
+			path = candidate;
+			break;
+		}
+	}
+	if (path === void 0 || loadYaml === void 0) return void 0;
+	let document;
+	try {
+		document = loadYaml(readFileSync(path, "utf8"));
+	} catch {
+		return;
+	}
+	if (document === null || typeof document !== "object") return void 0;
+	const merged = {};
+	let found = false;
+	for (const ns of namespaces) {
+		const section = document[ns];
+		if (section === null || typeof section !== "object" || Array.isArray(section)) continue;
+		Object.assign(merged, section);
+		found = true;
+	}
+	return found ? merged : void 0;
+}
+/**
+* Reserved bookkeeping key: how many writes the settings card has made through
+* this store. Its presence separates "the file holds migration seed" from "the
+* file holds the user's live edits" — see the seed rule in ./index.ts. Field
+* readers address their fields by name and never collide with it.
+*/
+const WRITE_MARK = "__writes";
+/**
+* One store instance: the plugin's own settings file, with the entry config as
+* the fallback layer the caller overlays it on.
+*/
+var SettingsStore = class {
+	/** The user layer exactly as stored (presence marks an override). */
+	user;
+	constructor() {
+		this.user = readFile() ?? {};
+	}
+	/** Whether the store file exists. */
+	exists() {
+		return existsSync(settingsFilePath());
+	}
+	/**
+	* Whether the settings card has ever written through this store.
+	*
+	* False during the migration window — the window where a 0.1.5 settings.yaml
+	* import (which lands only after the Loader settles, i.e. AFTER this plugin's
+	* first apply) can still deliver the user's real values, and where a first
+	* seed may have been taken before that import. While false the entry config
+	* stays authoritative; once the card writes, the file is — a runtime edit
+	* must never be regressed by a stale profile row.
+	*/
+	get edited() {
+		return typeof this.user[WRITE_MARK] === "number" && this.user[WRITE_MARK] > 0;
+	}
+	/**
+	* Apply one patch in memory and persist it.
+	* @param patch - field → value; a `null` value clears the field.
+	* @param fromCard - true when the settings card made this write; marks the
+	*   file as holding live user edits from then on.
+	* @returns the new user layer.
+	*/
+	patch(patch, fromCard = false) {
+		const next = { ...this.user };
+		for (const [field, value] of Object.entries(patch)) if (value === null) delete next[field];
+		else next[field] = value;
+		if (fromCard) next[WRITE_MARK] = (typeof next[WRITE_MARK] === "number" ? next[WRITE_MARK] : 0) + 1;
+		writeSettings(next);
+		for (const key of Object.keys(this.user)) delete this.user[key];
+		Object.assign(this.user, next);
+		return this.user;
+	}
+	/** The current user layer. */
+	values() {
+		return this.user;
+	}
+};
+//#endregion
 //#region src/index.ts
 /** Stable Cordis plugin name. */
 const name = "llm-qoder";
@@ -1694,23 +1877,90 @@ function credentialPollMs() {
 * stay in proportion under the `DSH_QODER_POLL_MS` override.
 */
 const CATALOG_RETRY_SWEEPS = 10;
+/**
+* Mark one configuration field as a live projected setting, when the host has
+* that concept at all.
+*
+* DSH 0.1.7 projects a `.volatile()` field into the profile's settings form and
+* hands the plugin a STABLE REFERENCE instead of the value; a field without the
+* mark never reaches the form — `dsh-settings`' `describe()` skips an entry
+* whose schema has no volatile field (`lib/index.js:411-421`), which is exactly
+* what makes the browser-side `configForms` namespace exist. DSH 0.1.5's
+* schemastery has no `volatile` at all, so calling it there is a `TypeError`
+* that would take the whole plugin down with it. The method is therefore
+* probed, never assumed.
+*
+* Only TOP-LEVEL fields are marked: a volatile field may not sit inside another
+* volatile field, and schemastery rejects a volatile node reached through a
+* collection (`validateVolatileSchema`), while the 0.1.7 client writes a single
+* path segment (`ConfigFormController.set` → `path: [field]`). Every field this
+* plugin exposes is already a top-level member of {@link Config}, so marking
+* the field itself is both legal and the only granularity the write path can
+* address.
+*
+* @param field - the field's schema.
+* @returns the projected schema on a host that supports projection, else the field itself.
+*/
+function volatileField(field) {
+	const probe = field;
+	if (typeof probe.volatile === "function") return probe.volatile();
+	if (typeof probe.extra === "function") return probe.extra("volatile", true);
+	if (probe && typeof probe === "object") {
+		probe.meta = {
+			...probe.meta,
+			volatile: true
+		};
+		return probe;
+	}
+	return field;
+}
+/**
+* Read one configuration field through the volatile indirection.
+*
+* On DSH 0.1.7 a `.volatile()` field arrives as a reference object whose value
+* is read with `.get()` (`@deepseek-ai/dsh-agent-default-model`,
+* `lib/index.js:38-41`); on DSH 0.1.5 the plain value arrives directly. Every
+* read of a projected field goes through here, so both hosts yield the value
+* itself.
+*
+* @param config - the raw plugin configuration, in either host's shape.
+* @param field - field name inside the configuration object.
+* @returns the field's value, or undefined when the field is absent.
+*/
+function readField(config, field) {
+	const value = config?.[field];
+	return value !== null && typeof value === "object" && typeof value.get === "function" ? value.get() : value;
+}
+/**
+* Read one declared field with its declared type.
+*
+* The typed face of {@link readField}, for the few call sites that want a
+* single field rather than a whole {@link readConfig}.
+*
+* @param config - the raw plugin configuration, in either host's shape.
+* @param field - field name inside the configuration object.
+* @returns the field's plain value, or undefined when it is absent.
+*/
+function readConfigField(config, field) {
+	return readField(config, field);
+}
 /** Probe authorization (shared by the plugin schema and the China section). */
-const PROBE_CONSENT_FIELD = z.boolean().default(false).description("Authorize reasoning-effort probes (each probe sends real requests that may consume credit)");
-const MAXIMUM_CONTEXT_WINDOW_FIELD = z.boolean().default(true).description("Use the largest context window declared by Qoder Global when alternatives are available (on by default)");
+const PROBE_CONSENT_FIELD = volatileField(z.boolean().default(false).description("Authorize reasoning-effort probes (each probe sends real requests that may consume credit)"));
+const MAXIMUM_CONTEXT_WINDOW_FIELD = volatileField(z.boolean().default(true).description("Use the largest context window declared by Qoder Global when alternatives are available (on by default)"));
 /** The China variant's own maximum-window preference. */
-const MAXIMUM_CONTEXT_WINDOW_CN_FIELD = z.boolean().default(true).description("Use the largest context window declared by Qoder (China) when alternatives are available (on by default)");
+const MAXIMUM_CONTEXT_WINDOW_CN_FIELD = volatileField(z.boolean().default(true).description("Use the largest context window declared by Qoder (China) when alternatives are available (on by default)"));
 /**
 * Per-model window overrides (model id → tokens). The card writes one entry
 * per selector change; the field is optional so an absent map means "no
 * overrides" rather than a default object the host must keep in sync.
 */
-const MODEL_CONTEXT_WINDOWS_FIELD = z.dict(z.number().min(1), z.string()).description("Per-model context-window overrides for Qoder Global (model id → tokens)");
+const MODEL_CONTEXT_WINDOWS_FIELD = volatileField(z.dict(z.number().min(1), z.string()).description("Per-model context-window overrides for Qoder Global (model id → tokens)"));
 /** Disabled models list (blacklist) */
-const DISABLED_MODELS_FIELD = z.array(z.string()).default([]).description("Models hidden from the provider catalog and picker");
+const DISABLED_MODELS_FIELD = volatileField(z.array(z.string()).default([]).description("Models hidden from the provider catalog and picker"));
 /** Sidebar quota toggle (one per variant; both live on the shared quota card). */
-const QUOTA_TOGGLE_FIELD = z.boolean().default(false).description("Show this variant’s remaining-credit card in the sidebar footer (off by default)");
+const QUOTA_TOGGLE_FIELD = volatileField(z.boolean().default(false).description("Show this variant’s remaining-credit card in the sidebar footer (off by default)"));
 /** Automatic check-in toggle. */
-const AUTO_CHECK_IN_FIELD = z.boolean().default(false).description("每天自动签到领取算力额度（默认关闭）");
+const AUTO_CHECK_IN_FIELD = volatileField(z.boolean().default(false).description("每天自动签到领取算力额度（默认关闭）"));
 /**
 * When a variant checks in, as minutes past midnight in UTC+8.
 *
@@ -1719,7 +1969,7 @@ const AUTO_CHECK_IN_FIELD = z.boolean().default(false).description("每天自动
 * anything outside that range fails Host validation instead of silently
 * scheduling a request at a moment that never arrives.
 */
-const CHECK_IN_MINUTE_FIELD = z.number().default(600).min(0).max(1439).description("每日自动签到的时刻（自 UTC+8 午夜起的分钟数，600 = 10:00）");
+const CHECK_IN_MINUTE_FIELD = volatileField(z.number().default(600).min(0).max(1439).description("每日自动签到的时刻（自 UTC+8 午夜起的分钟数，600 = 10:00）"));
 /**
 * Quota poll interval: default 5 minutes, floor 1 minute. The status route
 * performs a live upstream billing call per request with no cache, so an
@@ -1729,13 +1979,15 @@ const CHECK_IN_MINUTE_FIELD = z.number().default(600).min(0).max(1439).descripti
 */
 const QUOTA_POLL_DEFAULT_MS = 3e5;
 const QUOTA_POLL_MIN_MS = 6e4;
-const QUOTA_POLL_FIELD = z.number().default(QUOTA_POLL_DEFAULT_MS).min(QUOTA_POLL_MIN_MS).description("Sidebar quota card refresh interval in milliseconds (default 300000, minimum 60000)");
+const QUOTA_POLL_FIELD = volatileField(z.number().default(QUOTA_POLL_DEFAULT_MS).min(QUOTA_POLL_MIN_MS).description("Sidebar quota card refresh interval in milliseconds (default 300000, minimum 60000)"));
 const Config = z.object({
 	probeConsent: PROBE_CONSENT_FIELD,
 	useMaximumContextWindow: MAXIMUM_CONTEXT_WINDOW_FIELD,
 	useMaximumContextWindowCN: MAXIMUM_CONTEXT_WINDOW_CN_FIELD,
 	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD,
 	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD,
+	disabledModels: DISABLED_MODELS_FIELD,
+	disabledModelsCN: DISABLED_MODELS_FIELD,
 	sidebarQuotaCN: QUOTA_TOGGLE_FIELD,
 	sidebarQuotaGlobal: QUOTA_TOGGLE_FIELD,
 	autoCheckInCN: AUTO_CHECK_IN_FIELD,
@@ -1744,35 +1996,18 @@ const Config = z.object({
 	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
 	quotaPollMs: QUOTA_POLL_FIELD
 });
-/**
-* The China card's settings section: only the fields that card edits.
-*
-* A section is what makes its namespace "served", which is what the Plugins
-* tab dispatches a card by — so the schema and the card must stay split the
-* same way. `probeConsent` lives here because it predates the second variant;
-* it gates no current code path (only manual, per-click-confirmed probes run),
-* so it is left where existing users set it rather than moved and re-asked.
-*/
-const CHINA_SECTION = z.object({
+z.object({
 	probeConsent: PROBE_CONSENT_FIELD,
 	useMaximumContextWindowCN: MAXIMUM_CONTEXT_WINDOW_CN_FIELD,
 	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD,
 	disabledModelsCN: DISABLED_MODELS_FIELD
 });
-/** The global card's settings section and its context-window preferences. */
-const GLOBAL_SECTION = z.object({
+z.object({
 	useMaximumContextWindow: MAXIMUM_CONTEXT_WINDOW_FIELD,
 	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD,
 	disabledModels: DISABLED_MODELS_FIELD
 });
-/**
-* The shared quota card's section: both sidebar toggles and the poll interval.
-*
-* Only these fields — the card edits nothing else, and the Plugins tab pairs a
-* card with the section whose namespace it names, so a stray field here would
-* render as a control no other surface reads.
-*/
-const QUOTA_SECTION = z.object({
+z.object({
 	sidebarQuotaCN: QUOTA_TOGGLE_FIELD,
 	sidebarQuotaGlobal: QUOTA_TOGGLE_FIELD,
 	autoCheckInCN: AUTO_CHECK_IN_FIELD,
@@ -1813,13 +2048,37 @@ const QUOTA_SECTION_KEYS = [
 	"checkInMinuteGlobal",
 	"quotaPollMs"
 ];
+/** Every declared configuration field, in the order the sections are merged. */
+const CONFIG_KEYS = [
+	...CN_SECTION_KEYS,
+	...GLOBAL_SECTION_KEYS,
+	...QUOTA_SECTION_KEYS
+];
 /** Copy the declared fields off one section's source, skipping absent ones. */
 function pickFields(source, keys) {
 	const value = source();
 	const picked = {};
-	for (const key of keys) if (value[key] !== void 0) picked[key] = value[key];
+	for (const key of keys) {
+		const field = readField(value, key);
+		if (field !== void 0) picked[key] = field;
+	}
 	return picked;
 }
+/**
+* Unwrap a whole configuration object into plain values.
+*
+* The merged configuration is read through {@link pickFields}/{@link readField}
+* everywhere else, but the plugin also reads its initial config directly while
+* it assembles its runtimes — before any settings section has handed over a
+* source. On 0.1.7 those direct reads would otherwise compare a reference
+* object against `true`/`undefined` and silently see "not set" for every field.
+*
+* @param config - the raw plugin configuration, in either host's shape.
+* @returns the same configuration with every declared field read out.
+*/
+function readConfig(config) {
+	return pickFields(() => config, CONFIG_KEYS);
+}
 /** Stable identity key used by credentials, probe records, and catalog entries. */
 const credentialIdentity = qoderCredentialIdentity;
 /** The settings namespace a variant's card and provider directory entry use. */
@@ -1901,13 +2160,14 @@ function createVariantRuntime(ctx, config, variant, current, identityOf) {
 	});
 	const fallback = fallbackFor(variant);
 	const catalog = new QoderCatalog(fallback);
+	const initial = current();
 	if (variant.id !== CHINA_VARIANT.id) {
-		catalog.setUseMaximumContextWindow(config.useMaximumContextWindow === true);
-		if (config.disabledModels !== void 0) catalog.setDisabledModels(config.disabledModels);
+		catalog.setUseMaximumContextWindow(initial.useMaximumContextWindow === true);
+		if (initial.disabledModels !== void 0) catalog.setDisabledModels(initial.disabledModels);
 	} else {
-		catalog.setUseMaximumContextWindow(config.useMaximumContextWindowCN === true);
-		if (config.modelContextWindowsCN !== void 0) catalog.setModelContextWindows(config.modelContextWindowsCN);
-		if (config.disabledModelsCN !== void 0) catalog.setDisabledModels(config.disabledModelsCN);
+		catalog.setUseMaximumContextWindow(initial.useMaximumContextWindowCN === true);
+		if (initial.modelContextWindowsCN !== void 0) catalog.setModelContextWindows(initial.modelContextWindowsCN);
+		if (initial.disabledModelsCN !== void 0) catalog.setDisabledModels(initial.disabledModelsCN);
 	}
 	catalog.setVisible(false);
 	const probeStore = new QoderProbeStore({
@@ -2010,9 +2270,11 @@ function detach(ctx, work, what) {
 * models read the shim origin at construction time. A failure here is
 * contained to this variant: the caller logs it and the other keeps working.
 *
+* @param seedCatalog - adopt the current credential into this runtime's
+*   catalog immediately; supplied by `apply` (it owns `adoptIdentity`).
 * @returns whether the provider registered.
 */
-async function startVariant(ctx, runtime) {
+async function startVariant(ctx, runtime, seedCatalog) {
 	const { variant, store, client, catalog, probeService } = runtime;
 	const shim = createQoderShim({
 		store,
@@ -2045,10 +2307,19 @@ async function startVariant(ctx, runtime) {
 		let releaseDirectory;
 		try {
 			releaseAdapter = ctx.llm.registerAdapter([variant.id], qoder.adapter);
+			const host017 = (() => {
+				try {
+					return ctx.get?.("configEditor") !== void 0;
+				} catch {
+					return false;
+				}
+			})();
+			const entryId = ctx.fiber?.entry?.options?.id;
+			const settingsNs = host017 && entryId !== void 0 ? entryId : settingsNamespaceFor(variant);
 			releaseDirectory = ctx.llm.registerConfigurableProviders([{
 				provider: variant.id,
 				displayName: variant.displayName,
-				settingsNs: settingsNamespaceFor(variant),
+				settingsNs,
 				settingsPath: [],
 				declared: false
 			}]);
@@ -2070,6 +2341,7 @@ async function startVariant(ctx, runtime) {
 			detach(ctx, shim.close(), "loopback endpoint close");
 		}
 		runtime.registered = true;
+		detach(ctx, seedCatalog(), `${variant.id} catalog seed`);
 		return true;
 	} catch (error) {
 		ctx.logger.error(`dsh-qoder-connect: ${variant.displayName} provider registration failed`, error);
@@ -2078,6 +2350,305 @@ async function startVariant(ctx, runtime) {
 	}
 }
 /**
+* State that MUST survive a fiber reload, module-level on purpose.
+*
+* DSH 0.1.7's configuration write (`configEditor.edit`) reconciles the profile
+* tree, which hot-reloads the entry's fiber — `apply()` runs again with a fresh
+* closure. Anything re-minted per apply is therefore invalidated by every
+* settings write: the browser cards hold the keys the status document handed
+* them, so a per-apply key turns each write into a wave of 403s ("刷新失败"),
+* and a per-apply identity map makes the sweep re-fetch the catalog from
+* upstream on every write (the burst of requests and most of the latency).
+*
+* Keys and identity/fetch bookkeeping are per-PROCESS secrets and caches, not
+* per-instance state, so they live here once. A reload keeps the same keys (no
+* 403 storm) and a same-account, freshly-fetched sweep (no refetch burst).
+*/
+/** The in-process control keys, minted once per process. */
+let processKeys;
+function controlKeys() {
+	processKeys ??= {
+		probe: createProbeKey(),
+		auth: createAuthKey()
+	};
+	return processKeys;
+}
+/** The loopback guard the probe and status routes use, restated for settings. */
+function trustedSettingsRequest(req) {
+	const host = req.headers.host ?? "";
+	const origin = req.headers.origin;
+	if (!/^(localhost|127(?:\.\d{1,3}){3}|\[::1\])(?::\d+)?$/i.test(String(host))) return false;
+	return origin === void 0 || /^https?:\/\/(localhost|127(?:\.\d{1,3}){3}|\[::1\])(?::\d+)?$/i.test(String(origin));
+}
+/**
+* The schema defaults, READ off each field's own `meta.default`.
+*
+* Two ways this was got wrong before, both silent and both destructive: a
+* hand-written table drifted from the schema (so the schema's own defaults
+* were classified as real overrides and the legacy settings document could
+* never win), and `validate({})` was then tried instead — which on this
+* schemastery answers with hollow `{}` per field instead of applying the
+* defaults, which is worse than nothing because it looks like it worked.
+* Walking `Config.dict` for `meta.default` is the only honest source: it is
+* the value schemastery itself substituted during validation.
+*/
+const DEFAULT_FOR_FIELD = (() => {
+	const out = {};
+	try {
+		for (const [key, field] of Object.entries(Config.dict ?? {})) {
+			const fallback = field?.meta?.default;
+			if (fallback !== void 0) out[key] = fallback;
+		}
+	} catch {}
+	if (Object.keys(out).length === 0) return {
+		probeConsent: false,
+		useMaximumContextWindow: true,
+		useMaximumContextWindowCN: true,
+		modelContextWindows: {},
+		modelContextWindowsCN: {},
+		disabledModels: [],
+		disabledModelsCN: [],
+		sidebarQuotaCN: false,
+		sidebarQuotaGlobal: false,
+		autoCheckInCN: false,
+		autoCheckInGlobal: false,
+		checkInMinuteCN: 600,
+		checkInMinuteGlobal: 600,
+		quotaPollMs: 3e5
+	};
+	return out;
+})();
+/**
+* Register the settings face (GET/POST) the browser cards read and write
+* through, answering the whole entry configuration as three layers.
+*
+* `value` carries every declared field, so a card rendering the quota section
+* sees the same merged view the host itself reads; `user` is the settings file
+* exactly as stored (presence marks an override), which is what the staged-edit
+* form's "written/reset" display needs. A POST validates the fields it is
+* allowed to touch, writes the file, applies the new view in memory, and
+* re-arms the check-in scheduler (the old 0.1.5 section `onChange` behaviour).
+*/
+function registerQoderSettingsFace(ctx, deps) {
+	const { store, config, current, apply, rearm } = deps;
+	const key = controlKeys().probe;
+	/** The document both routes answer with. */
+	const view = () => {
+		const merged = current();
+		const value = {};
+		const base = {};
+		for (const field of CONFIG_KEYS) {
+			if (merged[field] !== void 0) value[field] = merged[field];
+			base[field] = readConfig(config)[field] ?? DEFAULT_FOR_FIELD[field];
+		}
+		return {
+			key,
+			value,
+			base,
+			user: store.values()
+		};
+	};
+	ctx.effect(() => {
+		const dispose = ctx.webServer.register({
+			kind: "exact",
+			path: QODER_SETTINGS_FACE_PATH,
+			handler: async (req, res) => {
+				if (!trustedSettingsRequest(req)) {
+					jsonFace(res, 403, { error: "request-not-trusted" });
+					return;
+				}
+				if (req.method === "GET") {
+					jsonFace(res, 200, view());
+					return;
+				}
+				if (req.method !== "POST") {
+					jsonFace(res, 405, { error: "method not allowed" });
+					return;
+				}
+				if (req.headers["x-qoder-settings-key"] !== key) {
+					jsonFace(res, 403, { error: "invalid-key" });
+					return;
+				}
+				const body = await readFaceBody(req);
+				if (body === void 0) {
+					jsonFace(res, 413, { error: "body too large" });
+					return;
+				}
+				let patch;
+				try {
+					patch = JSON.parse(body || "{}");
+				} catch {
+					jsonFace(res, 400, { error: "invalid json" });
+					return;
+				}
+				if (patch === null || typeof patch !== "object" || Array.isArray(patch)) {
+					jsonFace(res, 400, { error: "invalid patch" });
+					return;
+				}
+				const invalid = validateSettingsPatch(patch);
+				if (invalid !== void 0) {
+					jsonFace(res, 400, { error: invalid });
+					return;
+				}
+				store.patch(patch, true);
+				apply(current());
+				rearm();
+				jsonFace(res, 200, view());
+			}
+		});
+		return () => {
+			dispose();
+		};
+	}, "dsh-qoder-connect: settings face");
+}
+/** JSON response helper for the settings face. */
+function jsonFace(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, { "Content-Type": "application/json" });
+	res.end(payload);
+}
+/** Read the request body, or undefined when absent or oversized. */
+function readFaceBody(req) {
+	return new Promise((resolve) => {
+		let body = "";
+		req.on("data", (chunk) => {
+			body += String(chunk);
+			if (body.length > 1e6) resolve(void 0);
+		});
+		req.on("end", () => resolve(body));
+		req.on("error", () => resolve(void 0));
+	});
+}
+/** Schema-level validation of one settings patch; the reason, or undefined. */
+function validateSettingsPatch(patch) {
+	for (const [field, value] of Object.entries(patch)) {
+		if (!CONFIG_KEYS.includes(field)) return `unknown field ${field}`;
+		if (value === null) continue;
+		switch (field) {
+			case "probeConsent":
+			case "useMaximumContextWindow":
+			case "useMaximumContextWindowCN":
+			case "sidebarQuotaCN":
+			case "sidebarQuotaGlobal":
+			case "autoCheckInCN":
+			case "autoCheckInGlobal":
+				if (typeof value !== "boolean") return `${field} must be a boolean`;
+				break;
+			case "disabledModels":
+			case "disabledModelsCN":
+				if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) return `${field} must be an array of strings`;
+				break;
+			case "checkInMinuteCN":
+			case "checkInMinuteGlobal":
+				if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 1439) return `${field} must be an integer minute 0..1439`;
+				break;
+			case "quotaPollMs":
+				if (typeof value !== "number" || !Number.isInteger(value) || value < 6e4) return `${field} must be an integer of at least 60000 ms`;
+				break;
+			case "modelContextWindows":
+			case "modelContextWindowsCN": if (typeof value !== "object" || value === null || Array.isArray(value)) return `${field} must be an object`;
+		}
+	}
+}
+/**
+* When the profile tree last recomposed, module-level so every apply sees it.
+*
+* The legacy settings.yaml import writes the profile patch one section at a
+* time for seconds after the Loader settles, emitting this event on every
+* write. Cleaning up our row in that window is futile — the import's next
+* section simply writes it back — so the cleanup waits for the tree to fall
+* quiet first.
+*/
+let lastConfigReloadAt = Date.now();
+/** Wait until the profile tree has been quiet (the legacy import finished). */
+async function waitForProfileQuiet() {
+	const deadline = Date.now() + 12e4;
+	for (;;) {
+		if (Date.now() - lastConfigReloadAt >= 5e3) return;
+		if (Date.now() >= deadline) return;
+		await new Promise((resolve) => setTimeout(resolve, 1e3));
+	}
+}
+/**
+* Delete this plugin's own fields from the profile entry config, leaving every
+* other key of the row untouched.
+*
+* One-time, right after the settings file has been seeded: the entry returns to
+* its shipped state, so no second source of truth remains. Both write APIs are
+* probed — `configEditor` (0.1.7) first, then the settings service's namespace
+* `replace` (0.1.5), which rebuilds each of this plugin's three sections from
+* the foreign keys alone.
+*
+* @param ctx - plugin context.
+* @param ownKeys - this plugin's declared config fields.
+* @param namespaces - the 0.1.5 section namespaces this plugin owns.
+*/
+async function cleanupEntryConfig(ctx, ownKeys, namespaces) {
+	const attempts = 10;
+	for (let attempt = 0; attempt < attempts; attempt++) try {
+		if (attempt === 0) await waitForProfileQuiet();
+		else await new Promise((resolve) => setTimeout(resolve, 2e3 + Math.random() * 1e3));
+		const probe = ctx;
+		const editor = (typeof probe.get === "function" ? (() => {
+			try {
+				return probe.get.call(ctx, "configEditor");
+			} catch {
+				return;
+			}
+		})() : void 0) ?? await new Promise((resolve) => {
+			ctx.inject(["settings"], (settingsCtx) => {
+				const owner = settingsCtx.settings?.ownerContext;
+				resolve(typeof owner?.get === "function" ? (() => {
+					try {
+						return owner.get.call(owner, "configEditor");
+					} catch {
+						return;
+					}
+				})() : void 0);
+			});
+		});
+		const entry = probe.fiber?.entry;
+		if (editor !== void 0 && entry !== void 0) {
+			await editor.edit(entry, (raw, inherited) => {
+				const next = { ...inherited ?? {} };
+				for (const [key, value] of Object.entries(raw ?? {})) {
+					if (ownKeys.includes(key)) continue;
+					if (!Object.hasOwn(next, key)) next[key] = value;
+				}
+				return next;
+			});
+			return;
+		}
+		await new Promise((resolve) => {
+			ctx.inject(["settings"], (settingsCtx) => {
+				const settings = settingsCtx.settings;
+				if (typeof settings?.replace !== "function" || typeof settings.installSection !== "function") {
+					resolve(void 0);
+					return;
+				}
+				Promise.all(namespaces.map((ns) => Promise.resolve(settings.replace(ns, {})).catch(() => void 0))).then(() => resolve(void 0));
+			});
+		});
+		return;
+	} catch (error) {
+		if (attempt === 9) {
+			ctx.logger?.warn?.("dsh-qoder-connect: entry config cleanup failed", error);
+			return;
+		}
+		await new Promise((resolve) => setTimeout(resolve, 500 * (attempt + 1) + Math.random() * 500));
+	}
+}
+/** The account identity each variant last published a catalog for, across reloads. */
+const lastIdentities = /* @__PURE__ */ new Map();
+/**
+* When a variant's catalog was last fetched LIVE from upstream, per identity.
+*
+* A reload reseeds the catalog from the saved file; without this record the
+* sweep's retry rule (`stale && due`) sees `lastFetchAtMs = 0` and re-fetches
+* immediately — one upstream round trip per variant per settings write.
+*/
+const lastLiveFetchAt = /* @__PURE__ */ new Map();
+/**
 * Start both variants: their loopback endpoints, the `qoder` and
 * `qoder-global` providers, their configuration cards, and their
 * credential-driven catalog lifecycles.
@@ -2088,16 +2659,72 @@ async function startVariant(ctx, runtime) {
 * without re-registering the provider.
 */
 function apply(ctx, config) {
-	let current = () => config;
+	const store = new SettingsStore();
+	let current = () => ({
+		...readConfig(config),
+		...store.values()
+	});
+	/**
+	* One-time migration: per field — the file never held it → take the entry;
+	* the card HAS written this file → keep the file; the entry carries a
+	* NON-DEFAULT value → take the entry (the legacy settings.yaml import lands
+	* only after the Loader settles, i.e. after this plugin's first apply, and a
+	* seed taken inside that window can hold a stale or mis-encoded value); the
+	* entry only carries the schema default → keep the file.
+	*
+	* That last clause is load-bearing: a bundle layer's insert config does NOT
+	* reach the composition (verified with `dsh --dump-config`), so once the
+	* one-time cleanup has emptied the entry row the entry answers pure defaults —
+	* treating those as authoritative would erase the user's values on the next
+	* boot. Re-checked on every apply, which is also what closes the legacy
+	* import's timing window.
+	*
+	* When the entry is authoritative, its own fields are then deleted from the
+	* profile row, so no second source of truth remains.
+	*/
+	const migrateOwnSettings = () => {
+		const legacy = readLegacySections([
+			QODER_SETTINGS_NS,
+			QODER_GLOBAL_SETTINGS_NS,
+			QODER_QUOTA_SETTINGS_NS
+		]);
+		const seeded = {};
+		for (const key of CONFIG_KEYS) {
+			const entryValue = readField(config, key);
+			const legacyValue = legacy === void 0 ? void 0 : legacy[key];
+			if (!Object.hasOwn(store.user, key)) {
+				if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = entryValue;
+				else if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
+				else if (entryValue !== void 0) seeded[key] = entryValue;
+				else if (legacyValue !== void 0) seeded[key] = legacyValue;
+				continue;
+			}
+			if (store.edited) continue;
+			if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) {
+				seeded[key] = entryValue;
+				continue;
+			}
+			if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
+		}
+		if (Object.keys(seeded).length === 0) return;
+		store.patch(seeded);
+		cleanupEntryConfig(ctx, CONFIG_KEYS, [
+			QODER_SETTINGS_NS,
+			QODER_GLOBAL_SETTINGS_NS,
+			QODER_QUOTA_SETTINGS_NS
+		]);
+	};
+	migrateOwnSettings();
+	const eventSink = ctx;
+	eventSink.on("loader/volatile-update", () => {
+		migrateOwnSettings();
+	});
+	eventSink.on("app-boot/config-reload", () => {
+		lastConfigReloadAt = Date.now();
+	});
 	/** Timers and in-flight work belonging to this plugin instance. */
 	let stopped = false;
 	const timers = [];
-	/**
-	* The account identity each variant last published a catalog for. Keeps a
-	* same-token sweep from re-fetching, and lets a late response from a
-	* previous identity be discarded instead of overwriting a newer one.
-	*/
-	const lastIdentities = /* @__PURE__ */ new Map();
 	const runtimes = QODER_VARIANTS.map((variant) => createVariantRuntime(ctx, config, variant, () => current(), (id) => lastIdentities.get(id)));
 	const checkInStore = new JsonFileCheckInStore();
 	const checkInScheduler = new CheckInScheduler({
@@ -2135,17 +2762,7 @@ function apply(ctx, config) {
 		checkInScheduler.catchUp();
 	};
 	installJobTokenHint(ctx);
-	const probeKey = createProbeKey();
-	/**
-	* The in-process key authorizing PAT writes, minted separately from the
-	* probe key.
-	*
-	* Separate keys rather than one shared secret because the two authorize
-	* different powers: one spends credit on a probe, the other stores a
-	* credential. A single key handed to both would let a defect in either card
-	* reach the other's authority.
-	*/
-	const authKey = createAuthKey();
+	const { probe: probeKey, auth: authKey } = controlKeys();
 	let setMaximumContextWindow;
 	let setMaximumContextWindowCN;
 	let setModelsEnabled;
@@ -2173,7 +2790,7 @@ function apply(ctx, config) {
 	const adoptIdentity = (runtime, identity) => {
 		const id = runtime.variant.id;
 		const known = lastIdentities.get(id);
-		if (known === identity) return;
+		if (known === identity && runtime.catalog.isVisible()) return;
 		const hadCredential = known !== void 0;
 		if (identity === void 0) lastIdentities.delete(id);
 		else lastIdentities.set(id, identity);
@@ -2207,6 +2824,26 @@ function apply(ctx, config) {
 		runtime.catalog.setVisible(true);
 		runtime.invalidate();
 	};
+	/**
+	* Apply catalog preferences from a configuration view, in memory.
+	*
+	* Shared by the probe-route setters and the settings face's POST: both write
+	* the plugin-owned settings file and then land the new view here, which is
+	* what the cards see on their next status read.
+	*/
+	const applyCatalogSettings = (next) => {
+		let changed = false;
+		for (const runtime of runtimes) {
+			const isChina = runtime.variant.id === CHINA_VARIANT.id;
+			const preference = isChina ? next.useMaximumContextWindowCN : next.useMaximumContextWindow;
+			if (runtime.catalog.setUseMaximumContextWindow(preference === true)) changed = true;
+			const overrides = isChina ? next.modelContextWindowsCN : next.modelContextWindows;
+			if (overrides !== void 0 && runtime.catalog.setModelContextWindows(overrides)) changed = true;
+			const disabled = isChina ? next.disabledModelsCN : next.disabledModels;
+			if (runtime.catalog.setDisabledModels(disabled ?? [])) changed = true;
+		}
+		if (changed) for (const runtime of runtimes) runtime.invalidate();
+	};
 	ctx.inject(["webServer"], (webCtx) => {
 		for (const runtime of runtimes) {
 			registerQoderStatusRoute(webCtx, {
@@ -2351,82 +2988,65 @@ function apply(ctx, config) {
 				}
 			}, probeKey);
 		}
-	});
-	ctx.inject(["settings"], (settingsCtx) => {
-		/** Section sources; each falls back to its own slice when its side unloads. */
-		const sources = {
-			cn: () => config,
-			global: () => config,
-			quota: () => config
-		};
-		/** Merge all sections into the whole config the rest of the plugin reads. */
-		const merged = () => ({
-			...pickFields(sources.cn, CN_SECTION_KEYS),
-			...pickFields(sources.global, GLOBAL_SECTION_KEYS),
-			...pickFields(sources.quota, QUOTA_SECTION_KEYS)
-		});
-		const applyCatalogSettings = (next) => {
-			let changed = false;
-			for (const runtime of runtimes) {
-				const isChina = runtime.variant.id === CHINA_VARIANT.id;
-				const preference = isChina ? next.useMaximumContextWindowCN : next.useMaximumContextWindow;
-				if (runtime.catalog.setUseMaximumContextWindow(preference === true)) changed = true;
-				const overrides = isChina ? next.modelContextWindowsCN : next.modelContextWindows;
-				if (overrides !== void 0 && runtime.catalog.setModelContextWindows(overrides)) changed = true;
-				const disabled = isChina ? next.disabledModelsCN : next.disabledModels;
-				if (runtime.catalog.setDisabledModels(disabled ?? [])) changed = true;
-			}
-			if (changed) for (const runtime of runtimes) runtime.invalidate();
-		};
-		const repointStores = () => {
-			applyCatalogSettings(merged());
-		};
-		settingsCtx.settings.installSection(ctx, QODER_SETTINGS_NS, CHINA_SECTION, config, {
-			setSource(source) {
-				sources.cn = source;
-				current = merged;
-			},
-			onChange: repointStores
-		});
-		settingsCtx.settings.installSection(ctx, QODER_GLOBAL_SETTINGS_NS, GLOBAL_SECTION, config, {
-			setSource(source) {
-				sources.global = source;
-				current = merged;
-			},
-			onChange: repointStores
-		});
-		settingsCtx.settings.installSection(ctx, QODER_QUOTA_SETTINGS_NS, QUOTA_SECTION, config, {
-			setSource(source) {
-				sources.quota = source;
-				current = merged;
-				checkInScheduler.rearm();
+		registerQoderSettingsFace(webCtx, {
+			store,
+			config,
+			current,
+			apply: applyCatalogSettings,
+			rearm: () => {
 				runStartupCatchUpOnce();
-			},
-			onChange: () => {
 				checkInScheduler.rearm();
-				checkInScheduler.sweepAll(true);
 			}
 		});
+	});
+	ctx.inject(["settings"], (settingsCtx) => {
+		/**
+		* `auto: false` turns OFF the host's generated form page for this entry —
+		* the plugin ships its own card, which is now the only editor. It must be
+		* called as a METHOD: on 0.1.7 `configure` is a SettingsForms class method
+		* (it reads `this.presentations`), and extracting it as a free function
+		* throws a TypeError that used to kill the whole settings callback.
+		*/
+		const settingsService = settingsCtx.settings;
+		if (typeof settingsService.configure === "function") try {
+			settingsCtx.effect(() => {
+				const dispose = settingsService.configure({ auto: false }, ctx.fiber);
+				return typeof dispose === "function" ? dispose : () => {};
+			});
+		} catch (error) {
+			console.error("[dsh-qoder-connect] settings.configure failed (own settings file still serves):", error);
+		}
+		/**
+		* The four setters, now one implementation on both hosts: write the
+		* plugin-owned settings file, then apply the new view in memory. No
+		* profile-patch write means no tree reconcile, no fiber reload, and no
+		* client-mirror storm per toggle.
+		*/
+		const write = (patch) => {
+			store.patch(patch, true);
+			applyCatalogSettings(current());
+			checkInScheduler.rearm();
+		};
 		setMaximumContextWindow = async (enabled) => {
-			await settingsCtx.settings.update(QODER_GLOBAL_SETTINGS_NS, { useMaximumContextWindow: enabled });
+			write({ useMaximumContextWindow: enabled });
 			return { state: "updated" };
 		};
 		setMaximumContextWindowCN = async (enabled) => {
-			await settingsCtx.settings.update(QODER_SETTINGS_NS, { useMaximumContextWindowCN: enabled });
+			write({ useMaximumContextWindowCN: enabled });
 			return { state: "updated" };
 		};
 		setModelsEnabled = async ({ models, enabled }) => {
-			const currentDisabled = new Set(sources.global().disabledModels ?? []);
+			const currentDisabled = new Set(readConfigField(current(), "disabledModels") ?? []);
 			for (const m of models) if (enabled) currentDisabled.delete(m);
 			else currentDisabled.add(m);
-			await settingsCtx.settings.update(QODER_GLOBAL_SETTINGS_NS, { disabledModels: Array.from(currentDisabled) });
+			write({ disabledModels: Array.from(currentDisabled) });
 			return { state: "updated" };
 		};
 		setModelsEnabledCN = async ({ models, enabled }) => {
-			const currentDisabled = new Set(sources.cn().disabledModelsCN ?? []);
+			const currentDisabled = new Set(readConfigField(current(), "disabledModelsCN") ?? []);
 			for (const m of models) if (enabled) currentDisabled.delete(m);
 			else currentDisabled.add(m);
-			await settingsCtx.settings.update(QODER_SETTINGS_NS, { disabledModelsCN: Array.from(currentDisabled) });
+			write({ disabledModelsCN: Array.from(currentDisabled) });
 			return { state: "updated" };
 		};
 	});
@@ -2492,6 +3112,7 @@ function apply(ctx, config) {
 			}
 			if (stopped || runtime.catalogGeneration !== generation) return;
 			runtime.lastFetchAtMs = Date.now();
+			lastLiveFetchAt.set(identity, runtime.lastFetchAtMs);
 			runtime.catalog.set([...models]);
 			runtime.catalogSource = "live";
 			runtime.catalogFetchedAtMs = runtime.client.lastCatalog?.fetchedAtMs ?? Date.now();
@@ -2544,7 +3165,8 @@ function apply(ctx, config) {
 		const identity = credentialIdentity(credential);
 		if (lastIdentities.get(runtime.variant.id) === identity && runtime.catalog.isVisible()) {
 			const stale = runtime.catalogSource !== "live";
-			const due = Date.now() - runtime.lastFetchAtMs >= credentialPollMs() * CATALOG_RETRY_SWEEPS;
+			const fetchedAt = lastLiveFetchAt.get(identity) ?? 0;
+			const due = Date.now() - fetchedAt >= credentialPollMs() * CATALOG_RETRY_SWEEPS;
 			if (stale && due) await fetchCatalog(runtime, identity);
 			return;
 		}
@@ -2562,7 +3184,18 @@ function apply(ctx, config) {
 	* would be an unhandled rejection — which Node turns into process
 	* termination, taking the whole Harness down over one plugin's startup.
 	*/
-	detach(ctx, Promise.all(runtimes.map(async (runtime) => startVariant(ctx, runtime))).then(() => {
+	detach(ctx, Promise.all(runtimes.map(async (runtime) => startVariant(ctx, runtime, async () => {
+		if (stopped) return;
+		let credential;
+		try {
+			credential = await runtime.store.current();
+		} catch {
+			return;
+		}
+		if (credential === void 0) return;
+		const identity = credentialIdentity(credential);
+		if (lastIdentities.get(runtime.variant.id) !== identity || !runtime.catalog.isVisible()) adoptIdentity(runtime, identity);
+	}))).then(() => {
 		if (stopped) return;
 		if (runtimes.some((runtime) => runtime.registered)) detach(ctx, writeHostHeartbeat(), "host heartbeat write");
 		detach(ctx, syncAll(), "credential sweep");