dsh-webdav-sync 1.0.3 → 1.0.4

package/lib/state.js

@@ -38,11 +38,19 @@ export function defaultConfig() {
         passphrase: '',
         autoEvery: AUTO_MANUAL,
         models: true,
-        defaults: true,
         plugins: true,
         patch: true,
+        // On by default: the profile names where its API keys come from, so a setup
+        // that travels without them arrives with every provider unauthenticated. The
+        // switch exists so a person can keep secrets off the server; see
+        // `docs/decisions/0054-sync-api-keys.md`.
+        keys: true,
         dirs: [],
-        dirsEnabled: true,
+        // Off by default: a directory travels whole, and a fresh setup that has not
+        // named one yet has nothing to carry. The list is kept independently, so
+        // switching this on or off never forgets a path — see
+        // `docs/decisions/0056-drop-default-model-part.md`.
+        dirsEnabled: false,
         rememberPassword: true,
         headers: '',
         relayEnabled: false,
@@ -211,13 +219,11 @@ export function syncsPart(config, part) {
     switch (part) {
         case 'models':
             return config.models;
-        case 'defaults':
-            return config.defaults;
         case 'plugins':
             return config.plugins;
         case 'patch':
             return config.patch;
-        // The extra directories carry a switch of their own, like the four parts above:
+        // The extra directories carry a switch of their own, like the three parts above:
         // the list of paths says *which* directories, the switch says whether this
         // computer carries them at all. Off keeps the list — the paths are not
         // forgotten — and changes nothing anywhere else: the part is carried through
@@ -225,6 +231,13 @@ export function syncsPart(config, part) {
         // others.
         case 'dirs':
             return config.dirsEnabled;
+        // The API keys are the one part that is a secret, so they are the one part
+        // whose switch a person may genuinely want off: the server holds the sealed
+        // file, and a sealed file still sits on someone else's disk. Off leaves every
+        // key here and carries the server's copy of the part through untouched, so
+        // nothing is deleted anywhere either.
+        case 'keys':
+            return config.keys;
     }
 }
 /** Fill in defaults and coerce the several fields that come from a browser. */
@@ -249,9 +262,9 @@ export function normaliseConfig(raw) {
         passphrase: text('passphrase'),
         autoEvery,
         models: flag('models'),
-        defaults: flag('defaults'),
         plugins: flag('plugins'),
         patch: flag('patch'),
+        keys: flag('keys'),
         dirs: Array.isArray(raw.dirs) ? normaliseDirs(raw.dirs) : base.dirs,
         dirsEnabled: flag('dirsEnabled'),
         rememberPassword: flag('rememberPassword'),

package/lib/store.d.ts

@@ -8,16 +8,20 @@
  * everything else — MCP servers, permission presets, UI settings, inserts — is
  * the rest of them. `package.json` names the installed plugins.
  *
+ * The default-model row is read here only to be kept out of the sync: it is one of
+ * the rows a sync never carries and never writes, like this plugin's own row. See
+ * `docs/decisions/0056-drop-default-model-part.md`.
+ *
  * Writes go through the `yaml` Document API rather than a stringify of a parsed
  * object, so the file's own comments and layout survive a sync that only meant to
  * change one provider.
  */
 import type { Document } from 'yaml';
-import { type DefaultsPart, type ModelsPart, type PatchEntry, type PatchPart, type PluginsPart } from './wire.js';
+import { type KeysPart, type ModelsPart, type PatchEntry, type PatchPart, type PluginsPart } from './wire.js';
 import type { ResolvedPaths } from './paths.js';
 /** The profile patch row holding the model catalog. */
 export declare const MODELS_ID = "llm-pi-ai";
-/** The profile patch row holding the default model. */
+/** The profile patch row holding the default model; kept out of every part. */
 export declare const DEFAULTS_ID = "agent-default-model";
 /** Package whose patch row the plugin adds for itself; never carried as a part. */
 export declare const SELF_ID = "dsh-webdav-sync";
@@ -50,9 +54,15 @@ export declare function readManifest(paths: ResolvedPaths): Promise<ManifestFile
 /** Every part of a profile this plugin can carry, as collected from disk. */
 export interface Collected {
     models?: ModelsPart;
-    defaults?: DefaultsPart;
     plugins?: PluginsPart;
     patch?: PatchPart;
+    /**
+     * The keys, added by `take` rather than here: they are the one part that does
+     * not come from a profile file. Left out entirely when this computer holds
+     * nothing for any name the profile uses — the same "no opinion" an absent
+     * `models` carries, so the server's copy is carried through untouched.
+     */
+    keys?: KeysPart;
 }
 /**
  * Gather the parts from one profile.
@@ -73,14 +83,14 @@ export declare function missingPlugins(plugins: PluginsPart | undefined, install
 /**
  * Rewrite the profile patch so it holds the merged parts.
  *
- * Model and default rows are replaced in place when they exist and appended when
- * they do not; the remaining rows are replaced wholesale by the merged list, with
- * the model rows kept where they were. A no-op merge leaves the bytes untouched,
- * so a sync that changed nothing does not rewrite the file.
+ * The model row is replaced in place when it exists and appended when it does not;
+ * the remaining rows are replaced wholesale by the merged list, with the model, the
+ * default-model and this plugin's own rows kept where they were. A no-op merge
+ * leaves the bytes untouched, so a sync that changed nothing does not rewrite the
+ * file.
  */
 export declare function applyPatch(patch: PatchFile, parts: {
     models?: ModelsPart | null;
-    defaults?: DefaultsPart | null;
     patch?: PatchPart;
 }): string;
 /**

package/lib/store.js

@@ -8,6 +8,10 @@
  * everything else — MCP servers, permission presets, UI settings, inserts — is
  * the rest of them. `package.json` names the installed plugins.
  *
+ * The default-model row is read here only to be kept out of the sync: it is one of
+ * the rows a sync never carries and never writes, like this plugin's own row. See
+ * `docs/decisions/0056-drop-default-model-part.md`.
+ *
  * Writes go through the `yaml` Document API rather than a stringify of a parsed
  * object, so the file's own comments and layout survive a sync that only meant to
  * change one provider.
@@ -20,7 +24,7 @@ import { hashJson } from './crypto.js';
 import { BACKUP_EXT, } from './wire.js';
 /** The profile patch row holding the model catalog. */
 export const MODELS_ID = 'llm-pi-ai';
-/** The profile patch row holding the default model. */
+/** The profile patch row holding the default model; kept out of every part. */
 export const DEFAULTS_ID = 'agent-default-model';
 /** Package whose patch row the plugin adds for itself; never carried as a part. */
 export const SELF_ID = 'dsh-webdav-sync';
@@ -97,11 +101,6 @@ export function collect(patch, manifest) {
         const config = modelsRow.value.config;
         out.models = { config: isPlainObject(config) ? config : {} };
     }
-    const defaultsRow = patch.rows.find((row) => row.key === `id:${DEFAULTS_ID}`);
-    if (defaultsRow !== undefined) {
-        const config = defaultsRow.value.config;
-        out.defaults = { config: isPlainObject(config) ? config : {} };
-    }
     const dependencies = manifest.value.dependencies;
     const bundles = readBundles(manifest.value);
     if (isPlainObject(dependencies) || bundles.length > 0) {
@@ -152,10 +151,11 @@ export function missingPlugins(plugins, installed) {
 /**
  * Rewrite the profile patch so it holds the merged parts.
  *
- * Model and default rows are replaced in place when they exist and appended when
- * they do not; the remaining rows are replaced wholesale by the merged list, with
- * the model rows kept where they were. A no-op merge leaves the bytes untouched,
- * so a sync that changed nothing does not rewrite the file.
+ * The model row is replaced in place when it exists and appended when it does not;
+ * the remaining rows are replaced wholesale by the merged list, with the model, the
+ * default-model and this plugin's own rows kept where they were. A no-op merge
+ * leaves the bytes untouched, so a sync that changed nothing does not rewrite the
+ * file.
  */
 export function applyPatch(patch, parts) {
     const document = patch.document;
@@ -165,9 +165,6 @@ export function applyPatch(patch, parts) {
         if (parts.models !== undefined && parts.models !== null) {
             rows.push({ id: MODELS_ID, name: '@deepseek-ai/dsh-llm-pi-ai', config: parts.models.config });
         }
-        if (parts.defaults !== undefined && parts.defaults !== null) {
-            rows.push({ id: DEFAULTS_ID, name: '@deepseek-ai/dsh-agent-default-model', config: parts.defaults.config });
-        }
         if (parts.patch !== undefined)
             rows.push(...parts.patch.entries);
         const replacement = document.createNode(rows);
@@ -187,15 +184,13 @@ export function applyPatch(patch, parts) {
         const value = item.toJSON();
         byKey.set(keyOf(value), { node: item, index });
     });
-    // 1. Replace or append the two id-targeted model rows.
-    for (const [id, part] of [
-        [MODELS_ID, parts.models],
-        [DEFAULTS_ID, parts.defaults],
-    ]) {
-        if (part === undefined)
-            continue;
-        const existing = byKey.get(`id:${id}`);
-        if (part === null) {
+    // 1. Replace or append the model row. It is the one row with a part of its own;
+    //    the default-model row that sits beside it is left exactly as it is, since
+    //    it is not carried at all.
+    const modelPart = parts.models;
+    if (modelPart !== undefined) {
+        const existing = byKey.get(`id:${MODELS_ID}`);
+        if (modelPart === null) {
             // The other computer took the row away, and that is the merge: a part that
             // was removed there has to leave here, or the two never converge.
             if (existing !== undefined) {
@@ -203,9 +198,8 @@ export function applyPatch(patch, parts) {
                 if (at !== -1)
                     contents.items.splice(at, 1);
             }
-            continue;
         }
-        if (existing !== undefined) {
+        else if (existing !== undefined) {
             // Replace the config node only when it actually differs, and then merge
             // into it rather than rebuilding: the catalog holds the user's own
             // comments about their providers. `keepScalar` keeps the node itself.
@@ -217,16 +211,16 @@ export function applyPatch(patch, parts) {
             // lacked the key does not gain an empty one.
             const config = existing.node.has('config') ? existing.node.get('config', true) : undefined;
             if (config === undefined) {
-                if (Object.keys(part.config).length > 0) {
-                    existing.node.set('config', document.createNode(part.config));
+                if (Object.keys(modelPart.config).length > 0) {
+                    existing.node.set('config', document.createNode(modelPart.config));
                 }
             }
-            else if (!sameJson(config, part.config)) {
-                existing.node.set('config', mergeInto(document, config, part.config));
+            else if (!sameJson(config, modelPart.config)) {
+                existing.node.set('config', mergeInto(document, config, modelPart.config));
             }
         }
         else {
-            const row = document.createNode({ id, name: defaultNameFor(id), config: part.config });
+            const row = document.createNode({ id: MODELS_ID, name: '@deepseek-ai/dsh-llm-pi-ai', config: modelPart.config });
             contents.items.push(row);
         }
     }
@@ -275,10 +269,6 @@ export function applyPatch(patch, parts) {
         return patch.text;
     return document.toString();
 }
-/** The loader `name` a row carries when this plugin has to create it. */
-function defaultNameFor(id) {
-    return id === MODELS_ID ? '@deepseek-ai/dsh-llm-pi-ai' : '@deepseek-ai/dsh-agent-default-model';
-}
 /**
  * Rewrite the profile manifest with merged plugin declarations, two-space
  * indented.

package/lib/wire.d.ts

@@ -62,8 +62,19 @@ export declare const LEGACY_REMOTE_FILE = "dsh-profile.dshsync";
  * second computer gets both the path and what is under it. Its empty value is a
  * real value (`{ dirs: [] }`), not an absent part, because "the list is now
  * empty" is a change that has to travel like any other.
+ *
+ * `keys` is the one part whose content is a secret, and the one part that lives
+ * outside the profile: the API keys this computer's credential store holds for its
+ * providers. It is on by default, because a setup that travels without its keys
+ * arrives with every provider unauthenticated, and it can be switched off on its
+ * own; see {@link KeysPart}.
+ *
+ * The default model is deliberately *not* a part: which model a new session starts
+ * on is changed several times a day, and every change would push a file for
+ * something a person sets on each computer anyway. Its row stays out of `patch`
+ * too, like this plugin's own row. See `docs/decisions/0056-drop-default-model-part.md`.
  */
-export declare const PARTS: readonly ["models", "defaults", "plugins", "patch", "dirs"];
+export declare const PARTS: readonly ["models", "plugins", "patch", "dirs", "keys"];
 export type Part = (typeof PARTS)[number];
 /**
  * Most extra directories one configuration may name.
@@ -91,11 +102,6 @@ export interface ModelsPart {
     /** The whole `llm-pi-ai` entry config, so fields beyond `providers` travel too. */
     config: Record<string, unknown>;
 }
-/** The `defaults` part: which provider/model new sessions start on. */
-export interface DefaultsPart {
-    /** The whole `agent-default-model` entry config. */
-    config: Record<string, unknown>;
-}
 /** One other top-level row of the profile patch, carried by the `patch` part. */
 export interface PatchEntry {
     /** `id` of an id-targeted row, or `insert` for an insert block. */
@@ -150,6 +156,20 @@ export interface DirSpec {
 export interface DirsPart {
     dirs: DirSpec[];
 }
+/**
+ * A credential this computer could not read or write, and why not.
+ *
+ * A store that cannot be read must not look like a store with nothing in it: an
+ * empty read would say "this computer has no keys", which is a real answer a sync
+ * acts on. This is how the two are told apart, the same way {@link DirProblem}
+ * keeps an unreadable directory from looking like an empty one.
+ */
+export interface KeyProblem {
+    /** The reference name, as the profile asks for it; '' when the store itself failed. */
+    ref: string;
+    /** What went wrong, in a sentence the card can show. */
+    message: string;
+}
 /** A configured directory this computer could not read, and why not. */
 export interface DirProblem {
     /** The configured path, as it is stored. */
@@ -167,6 +187,33 @@ export interface DirProblem {
      */
     missing?: boolean;
 }
+/**
+ * The `keys` part: the API keys this computer holds for its providers.
+ *
+ * The profile names a credential instead of holding it — `apiKeyEnv: OFOX_API_KEY`
+ * on a provider route, `secretEnv` on a GitHub webhook — and the value behind that
+ * name lives in this computer's credential store (`$DSH_HOME/.credentials.yaml`).
+ * That is why a setup synced without this part arrives complete and still cannot
+ * talk to a single provider: it carries the names, and the names resolve to
+ * nothing here.
+ *
+ * A name is the whole address of a secret, so this part is a map and not a list:
+ * applying it puts each value back under the name the profile already asks for.
+ * Nothing here is ever deleted — a key removed on one computer stays on the others,
+ * because a credential a person stored by hand is not this plugin's to throw away.
+ * See `docs/decisions/0054-sync-api-keys.md`.
+ */
+export interface KeysPart {
+    /**
+     * Secret values by the reference name that resolves them, exactly as the
+     * credential store holds them (`apiKeyEnv`/`secretEnv` values, verbatim).
+     *
+     * Only names this computer actually has a stored value for appear; a name that
+     * falls through to the environment is left out, since the environment is the
+     * other computer's own business.
+     */
+    refs: Record<string, string>;
+}
 /** Everything one sealed backup carries. Field names are the wire format. */
 export interface Bundle {
     format: 'dsh-webdav-sync-backup';
@@ -176,10 +223,10 @@ export interface Bundle {
     /** Which app sealed it, for a file several tools might share a folder with. */
     app: string;
     models?: ModelsPart;
-    defaults?: DefaultsPart;
     plugins?: PluginsPart;
     patch?: PatchPart;
     dirs?: DirsPart;
+    keys?: KeysPart;
 }
 /** The format word in the envelope; anything else on the server is not ours. */
 export declare const BUNDLE_FORMAT = "dsh-webdav-sync-backup";
@@ -209,10 +256,10 @@ export interface Notice {
 /** One side of the last completed sync, per part. */
 export interface PartHashes {
     models?: string;
-    defaults?: string;
     plugins?: string;
     patch?: string;
     dirs?: string;
+    keys?: string;
 }
 /**
  * The variable half of the state: everything a completed sync records.
@@ -276,12 +323,20 @@ export interface SyncConfig {
     autoEvery: number;
     /** Whether the model catalog travels. */
     models: boolean;
-    /** Whether the default-model row travels. */
-    defaults: boolean;
     /** Whether the installed-plugin list travels. */
     plugins: boolean;
     /** Whether the remaining profile-patch rows travel. */
     patch: boolean;
+    /**
+     * Whether this computer's stored API keys travel.
+     *
+     * On by default: a provider route names its credential, so a setup synced
+     * without the keys arrives with every provider unauthenticated. Turning it off
+     * keeps this computer's keys off the server entirely — nothing is deleted
+     * anywhere, and the server's copy of the part is carried through untouched,
+     * exactly as for the three parts above.
+     */
+    keys: boolean;
     /**
      * Absolute paths of the extra directories that travel with the setup, in the
      * order the user added them. The list itself is the `dirs` part, so what is
@@ -292,10 +347,11 @@ export interface SyncConfig {
     /**
      * Whether the extra directories travel with this setup.
      *
-     * The list above is kept either way: switching this off says "this computer does
-     * not carry them", not "forget them". Nothing is deleted anywhere by turning it
-     * off — the server's copy of the part is carried through untouched, exactly as
-     * for the four parts above.
+     * Off is the resting state: a configuration that has not said otherwise carries
+     * no directory. The list above is kept either way: switching this off says "this
+     * computer does not carry them", not "forget them". Nothing is deleted anywhere
+     * by turning it off — the server's copy of the part is carried through
+     * untouched, exactly as for the other parts.
      */
     dirsEnabled: boolean;
     /** Whether the plugin's own address, user and password are kept for next time. */
@@ -339,9 +395,10 @@ export interface ConfigView {
     passphraseSet: boolean;
     autoEvery: number;
     models: boolean;
-    defaults: boolean;
     plugins: boolean;
     patch: boolean;
+    /** Whether this computer's stored API keys travel. */
+    keys: boolean;
     /** The extra directories that travel, as stored. Not a secret. */
     dirs: string[];
     /** Whether the extra directories travel with the current configuration. */
@@ -412,6 +469,13 @@ export interface StatusResult {
      * this is how the card is able to say so.
      */
     dirProblems?: DirProblem[];
+    /**
+     * Credentials the configuration names that could not be read here, with the
+     * reason. Present exactly when there is at least one, for the same reason as
+     * {@link StatusResult.dirProblems}: a store that cannot be read is left as the
+     * server has it for this sync rather than read as empty.
+     */
+    keysProblems?: KeyProblem[];
     /** The profile declares plugins the installed tree does not have yet. */
     pendingInstall: boolean;
     /** Which plugins those are, present exactly when {@link pendingInstall} is true. */
@@ -427,9 +491,10 @@ export interface ConfigureBody {
     passphrase?: string;
     autoEvery?: number;
     models?: boolean;
-    defaults?: boolean;
     plugins?: boolean;
     patch?: boolean;
+    /** Whether this computer's stored API keys travel. */
+    keys?: boolean;
     /** The whole list of extra directories, replacing the stored one. */
     dirs?: string[];
     /** Whether the extra directories travel with this setup. */
@@ -471,6 +536,13 @@ export interface SyncResult {
     pendingNames?: string[];
     /** The profile has to be reloaded for the applied configuration to take effect. */
     reloadNeeded: boolean;
+    /**
+     * Keys the merge brought here that this computer's credential store would not
+     * take, with the reason. Present exactly when there is at least one: a key that
+     * could not be stored leaves that provider unauthenticated, and a sync that
+     * reported success would hide it.
+     */
+    keysProblems?: KeyProblem[];
 }
 /** POST {@link ROUTE_CHECK} result. */
 export interface CheckResult {

package/lib/wire.js

@@ -64,8 +64,19 @@ export const LEGACY_REMOTE_FILE = 'dsh-profile.dshsync';
  * second computer gets both the path and what is under it. Its empty value is a
  * real value (`{ dirs: [] }`), not an absent part, because "the list is now
  * empty" is a change that has to travel like any other.
+ *
+ * `keys` is the one part whose content is a secret, and the one part that lives
+ * outside the profile: the API keys this computer's credential store holds for its
+ * providers. It is on by default, because a setup that travels without its keys
+ * arrives with every provider unauthenticated, and it can be switched off on its
+ * own; see {@link KeysPart}.
+ *
+ * The default model is deliberately *not* a part: which model a new session starts
+ * on is changed several times a day, and every change would push a file for
+ * something a person sets on each computer anyway. Its row stays out of `patch`
+ * too, like this plugin's own row. See `docs/decisions/0056-drop-default-model-part.md`.
  */
-export const PARTS = ['models', 'defaults', 'plugins', 'patch', 'dirs'];
+export const PARTS = ['models', 'plugins', 'patch', 'dirs', 'keys'];
 /**
  * Most extra directories one configuration may name.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-webdav-sync",
-  "version": "1.0.3",
-  "description": "用 WebDAV 在多台电脑之间同步 DSH 的配置：模型供应商与模型、默认模型、已安装插件。整个备份在离开本机前用口令加密（AES-256-GCM + PBKDF2），以分片三方合并的方式在服务端保留一个加密文件。",
+  "version": "1.0.4",
+  "description": "用 WebDAV 在多台电脑之间同步 DSH 的配置：模型供应商与模型、已安装插件、其余 profile 配置、附加目录与 API 密钥。整个备份在离开本机前用口令加密（AES-256-GCM + PBKDF2），以分片三方合并的方式在服务端保留一个加密文件。",
   "keywords": [
     "dsh",
     "deepseek",