dsh-webdav-sync 1.0.3 → 1.0.5

package/lib/keys.js

@@ -0,0 +1,168 @@
+/**
+ * The `keys` part: the API keys this computer stores for the providers its
+ * profile names, and putting back the ones a merge brings.
+ *
+ * A DSH profile never holds a key. It holds the *name* of one — `apiKeyEnv` on a
+ * provider route, `secretEnv` on a webhook — and DSH resolves that name through
+ * its credential service, which layers the launch environment over this
+ * computer's own store (`$DSH_HOME/.credentials.yaml`). So a synced setup travels
+ * complete and still cannot reach a single provider: the names arrive, and on the
+ * other computer they resolve to nothing. That is the whole of this part.
+ *
+ * Two things follow from where the values live, and they are the two rules of
+ * this module:
+ *
+ * - The names come from the synced configuration, not from the store. The
+ *   credential service has no way to enumerate references — a configuration
+ *   surface learns which ones exist from its own schema — so this plugin reads the
+ *   names out of the very parts it is about to send, and asks the service for each
+ *   one. That also keeps the two in step for free: a key travels exactly when the
+ *   part that names it travels.
+ * - Nothing here deletes. A key removed on one computer stays on the others, and a
+ *   key that cannot be written is reported rather than skipped silently. See
+ *   `docs/decisions/0054-sync-api-keys.md`.
+ */
+import { message } from './store.js';
+/**
+ * The configuration field names DSH resolves as a credential reference.
+ *
+ * Taken from the schemas the shipped plugins declare: `apiKeyEnv` on the
+ * `llm-pi-ai` provider routes, on `llm-deepseek-api-key` and on
+ * `web-search-deepseek`; `secretEnv` on `webhook-github`. A plugin outside this
+ * list names its credential some other way and its key does not travel — which is
+ * why the list is here, in one place, rather than inline.
+ */
+export const CREDENTIAL_FIELDS = ['apiKeyEnv', 'secretEnv'];
+/**
+ * The credential service in the shape this plugin uses it.
+ *
+ * `set` rejects while a read-only layer shadows the reference, which is exactly
+ * the fact that matters here: a value that would not take effect is not one to
+ * report as stored. {@link applyKeys} therefore asks first and writes second.
+ */
+export function keysPort(service) {
+    return {
+        resolve: (ref) => service.resolve(ref),
+        store: (ref, value) => service.set(ref, value),
+    };
+}
+/**
+ * Every credential-reference name the given parts name, deduplicated and sorted.
+ *
+ * Walks the parts as they are — no schema, no interpretation — because the value
+ * of a reference field is a name wherever it sits, and the shape of a provider
+ * config is the provider plugin's to decide, not this one's.
+ */
+export function credentialRefs(parts) {
+    const found = new Set();
+    for (const part of Object.values(parts))
+        walk(part, found);
+    return [...found].sort();
+}
+function walk(value, into) {
+    if (value === null || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walk(item, into);
+        return;
+    }
+    for (const [key, held] of Object.entries(value)) {
+        if (CREDENTIAL_FIELDS.includes(key)) {
+            const ref = typeof held === 'string' ? held.trim() : '';
+            if (ref !== '')
+                into.add(ref);
+            continue;
+        }
+        walk(held, into);
+    }
+}
+/**
+ * Read the keys this computer holds for the names in hand.
+ *
+ * Only the managed store travels: a name the launching environment supplies is
+ * left out, and so is one that falls through to a `.env`. Two reasons, and they
+ * agree — the store is the one layer this plugin can write back to, and an
+ * environment export belongs to whoever started DSH, not to this computer's
+ * stored setup. The environment-wins rule is the service's own
+ * (`resolve().source` is `'env'` whenever the inherited environment has the name,
+ * and a write is refused while it does), so a name that is both exported and
+ * stored is read as an export and left here; unsetting it in the shell is what
+ * makes the stored value the one in force, and the one that travels.
+ *
+ * A name with no stored value is skipped, not reported: plenty of profiles name a
+ * provider nobody has signed in to, and "this key is not here either" is not a
+ * failure of the sync. A name that cannot be resolved *at all* is different, and
+ * is reported — a store that cannot be read must not look like a store with
+ * nothing in it, or a sync would read it as "this computer has no keys".
+ */
+export async function readKeys(port, parts) {
+    const refs = credentialRefs(parts);
+    if (refs.length === 0)
+        return { problems: [] };
+    if (port === undefined)
+        return { problems: [{ ref: '', message: NO_SERVICE }] };
+    const found = {};
+    const problems = [];
+    for (const ref of refs) {
+        try {
+            const resolved = await port.resolve(ref);
+            if (resolved !== undefined && resolved.source === 'file' && resolved.value !== '')
+                found[ref] = resolved.value;
+        }
+        catch (cause) {
+            problems.push({ ref, message: message(cause) });
+        }
+    }
+    if (Object.keys(found).length === 0)
+        return { problems };
+    return { part: { refs: found }, problems };
+}
+/**
+ * Put the merged keys part into this computer's store, and report what would not
+ * go in.
+ *
+ * A value already in force here is left alone. That is not an optimisation: the
+ * service refuses a write while a read-only layer shadows the reference, and a
+ * value that is already the one in force — the same key, exported and stored —
+ * would be reported as a failure for saying so twice.
+ *
+ * `beforeWrite` is called at most once, just before the first value that really
+ * replaces something. A credential has no copy kept by the caller any other way,
+ * so it is the callback's job to seal one: overwriting a key without keeping the
+ * value it had would leave undo with nothing to put back.
+ *
+ * `null` — the merge's way of saying the part was taken away — writes nothing. No
+ * credential is ever removed by a sync.
+ */
+export async function applyKeys(port, part, beforeWrite = async () => undefined) {
+    if (part === null || part === undefined)
+        return [];
+    const entries = Object.entries(part.refs ?? {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    if (entries.length === 0)
+        return [];
+    if (port === undefined)
+        return [{ ref: '', message: NO_SERVICE }];
+    const problems = [];
+    let kept = false;
+    for (const [ref, value] of entries) {
+        if (typeof value !== 'string' || value === '')
+            continue;
+        try {
+            const current = await port.resolve(ref);
+            if (current !== undefined && current.value === value)
+                continue;
+            if (!kept) {
+                kept = true;
+                await beforeWrite();
+            }
+            await port.store(ref, value);
+        }
+        catch (cause) {
+            problems.push({ ref, message: message(cause) });
+        }
+    }
+    return problems;
+}
+/** Said whenever the host has no credential service to read or write at all. */
+const NO_SERVICE = '这台电脑没有 DSH 的凭据服务，API 密钥不在这里读写';

package/lib/state.js

@@ -38,11 +38,19 @@ export function defaultConfig() {
         passphrase: '',
         autoEvery: AUTO_MANUAL,
         models: true,
-        defaults: true,
         plugins: true,
         patch: true,
+        // On by default: the profile names where its API keys come from, so a setup
+        // that travels without them arrives with every provider unauthenticated. The
+        // switch exists so a person can keep secrets off the server; see
+        // `docs/decisions/0054-sync-api-keys.md`.
+        keys: true,
         dirs: [],
-        dirsEnabled: true,
+        // Off by default: a directory travels whole, and a fresh setup that has not
+        // named one yet has nothing to carry. The list is kept independently, so
+        // switching this on or off never forgets a path — see
+        // `docs/decisions/0056-drop-default-model-part.md`.
+        dirsEnabled: false,
         rememberPassword: true,
         headers: '',
         relayEnabled: false,
@@ -211,13 +219,11 @@ export function syncsPart(config, part) {
     switch (part) {
         case 'models':
             return config.models;
-        case 'defaults':
-            return config.defaults;
         case 'plugins':
             return config.plugins;
         case 'patch':
             return config.patch;
-        // The extra directories carry a switch of their own, like the four parts above:
+        // The extra directories carry a switch of their own, like the three parts above:
         // the list of paths says *which* directories, the switch says whether this
         // computer carries them at all. Off keeps the list — the paths are not
         // forgotten — and changes nothing anywhere else: the part is carried through
@@ -225,6 +231,13 @@ export function syncsPart(config, part) {
         // others.
         case 'dirs':
             return config.dirsEnabled;
+        // The API keys are the one part that is a secret, so they are the one part
+        // whose switch a person may genuinely want off: the server holds the sealed
+        // file, and a sealed file still sits on someone else's disk. Off leaves every
+        // key here and carries the server's copy of the part through untouched, so
+        // nothing is deleted anywhere either.
+        case 'keys':
+            return config.keys;
     }
 }
 /** Fill in defaults and coerce the several fields that come from a browser. */
@@ -249,9 +262,9 @@ export function normaliseConfig(raw) {
         passphrase: text('passphrase'),
         autoEvery,
         models: flag('models'),
-        defaults: flag('defaults'),
         plugins: flag('plugins'),
         patch: flag('patch'),
+        keys: flag('keys'),
         dirs: Array.isArray(raw.dirs) ? normaliseDirs(raw.dirs) : base.dirs,
         dirsEnabled: flag('dirsEnabled'),
         rememberPassword: flag('rememberPassword'),

package/lib/store.d.ts

@@ -8,16 +8,20 @@
  * everything else — MCP servers, permission presets, UI settings, inserts — is
  * the rest of them. `package.json` names the installed plugins.
  *
+ * The default-model row is read here only to be kept out of the sync: it is one of
+ * the rows a sync never carries and never writes, like this plugin's own row. See
+ * `docs/decisions/0056-drop-default-model-part.md`.
+ *
  * Writes go through the `yaml` Document API rather than a stringify of a parsed
  * object, so the file's own comments and layout survive a sync that only meant to
  * change one provider.
  */
 import type { Document } from 'yaml';
-import { type DefaultsPart, type ModelsPart, type PatchEntry, type PatchPart, type PluginsPart } from './wire.js';
+import { type KeysPart, type ModelsPart, type PatchEntry, type PatchPart, type PluginsPart } from './wire.js';
 import type { ResolvedPaths } from './paths.js';
 /** The profile patch row holding the model catalog. */
 export declare const MODELS_ID = "llm-pi-ai";
-/** The profile patch row holding the default model. */
+/** The profile patch row holding the default model; kept out of every part. */
 export declare const DEFAULTS_ID = "agent-default-model";
 /** Package whose patch row the plugin adds for itself; never carried as a part. */
 export declare const SELF_ID = "dsh-webdav-sync";
@@ -50,9 +54,15 @@ export declare function readManifest(paths: ResolvedPaths): Promise<ManifestFile
 /** Every part of a profile this plugin can carry, as collected from disk. */
 export interface Collected {
     models?: ModelsPart;
-    defaults?: DefaultsPart;
     plugins?: PluginsPart;
     patch?: PatchPart;
+    /**
+     * The keys, added by `take` rather than here: they are the one part that does
+     * not come from a profile file. Left out entirely when this computer holds
+     * nothing for any name the profile uses — the same "no opinion" an absent
+     * `models` carries, so the server's copy is carried through untouched.
+     */
+    keys?: KeysPart;
 }
 /**
  * Gather the parts from one profile.
@@ -73,14 +83,14 @@ export declare function missingPlugins(plugins: PluginsPart | undefined, install
 /**
  * Rewrite the profile patch so it holds the merged parts.
  *
- * Model and default rows are replaced in place when they exist and appended when
- * they do not; the remaining rows are replaced wholesale by the merged list, with
- * the model rows kept where they were. A no-op merge leaves the bytes untouched,
- * so a sync that changed nothing does not rewrite the file.
+ * The model row is replaced in place when it exists and appended when it does not;
+ * the remaining rows are replaced wholesale by the merged list, with the model, the
+ * default-model and this plugin's own rows kept where they were. A no-op merge
+ * leaves the bytes untouched, so a sync that changed nothing does not rewrite the
+ * file.
  */
 export declare function applyPatch(patch: PatchFile, parts: {
     models?: ModelsPart | null;
-    defaults?: DefaultsPart | null;
     patch?: PatchPart;
 }): string;
 /**

package/lib/store.js

@@ -8,6 +8,10 @@
  * everything else — MCP servers, permission presets, UI settings, inserts — is
  * the rest of them. `package.json` names the installed plugins.
  *
+ * The default-model row is read here only to be kept out of the sync: it is one of
+ * the rows a sync never carries and never writes, like this plugin's own row. See
+ * `docs/decisions/0056-drop-default-model-part.md`.
+ *
  * Writes go through the `yaml` Document API rather than a stringify of a parsed
  * object, so the file's own comments and layout survive a sync that only meant to
  * change one provider.
@@ -20,7 +24,7 @@ import { hashJson } from './crypto.js';
 import { BACKUP_EXT, } from './wire.js';
 /** The profile patch row holding the model catalog. */
 export const MODELS_ID = 'llm-pi-ai';
-/** The profile patch row holding the default model. */
+/** The profile patch row holding the default model; kept out of every part. */
 export const DEFAULTS_ID = 'agent-default-model';
 /** Package whose patch row the plugin adds for itself; never carried as a part. */
 export const SELF_ID = 'dsh-webdav-sync';
@@ -97,11 +101,6 @@ export function collect(patch, manifest) {
         const config = modelsRow.value.config;
         out.models = { config: isPlainObject(config) ? config : {} };
     }
-    const defaultsRow = patch.rows.find((row) => row.key === `id:${DEFAULTS_ID}`);
-    if (defaultsRow !== undefined) {
-        const config = defaultsRow.value.config;
-        out.defaults = { config: isPlainObject(config) ? config : {} };
-    }
     const dependencies = manifest.value.dependencies;
     const bundles = readBundles(manifest.value);
     if (isPlainObject(dependencies) || bundles.length > 0) {
@@ -152,10 +151,11 @@ export function missingPlugins(plugins, installed) {
 /**
  * Rewrite the profile patch so it holds the merged parts.
  *
- * Model and default rows are replaced in place when they exist and appended when
- * they do not; the remaining rows are replaced wholesale by the merged list, with
- * the model rows kept where they were. A no-op merge leaves the bytes untouched,
- * so a sync that changed nothing does not rewrite the file.
+ * The model row is replaced in place when it exists and appended when it does not;
+ * the remaining rows are replaced wholesale by the merged list, with the model, the
+ * default-model and this plugin's own rows kept where they were. A no-op merge
+ * leaves the bytes untouched, so a sync that changed nothing does not rewrite the
+ * file.
  */
 export function applyPatch(patch, parts) {
     const document = patch.document;
@@ -165,9 +165,6 @@ export function applyPatch(patch, parts) {
         if (parts.models !== undefined && parts.models !== null) {
             rows.push({ id: MODELS_ID, name: '@deepseek-ai/dsh-llm-pi-ai', config: parts.models.config });
         }
-        if (parts.defaults !== undefined && parts.defaults !== null) {
-            rows.push({ id: DEFAULTS_ID, name: '@deepseek-ai/dsh-agent-default-model', config: parts.defaults.config });
-        }
         if (parts.patch !== undefined)
             rows.push(...parts.patch.entries);
         const replacement = document.createNode(rows);
@@ -187,15 +184,13 @@ export function applyPatch(patch, parts) {
         const value = item.toJSON();
         byKey.set(keyOf(value), { node: item, index });
     });
-    // 1. Replace or append the two id-targeted model rows.
-    for (const [id, part] of [
-        [MODELS_ID, parts.models],
-        [DEFAULTS_ID, parts.defaults],
-    ]) {
-        if (part === undefined)
-            continue;
-        const existing = byKey.get(`id:${id}`);
-        if (part === null) {
+    // 1. Replace or append the model row. It is the one row with a part of its own;
+    //    the default-model row that sits beside it is left exactly as it is, since
+    //    it is not carried at all.
+    const modelPart = parts.models;
+    if (modelPart !== undefined) {
+        const existing = byKey.get(`id:${MODELS_ID}`);
+        if (modelPart === null) {
             // The other computer took the row away, and that is the merge: a part that
             // was removed there has to leave here, or the two never converge.
             if (existing !== undefined) {
@@ -203,9 +198,8 @@ export function applyPatch(patch, parts) {
                 if (at !== -1)
                     contents.items.splice(at, 1);
             }
-            continue;
         }
-        if (existing !== undefined) {
+        else if (existing !== undefined) {
             // Replace the config node only when it actually differs, and then merge
             // into it rather than rebuilding: the catalog holds the user's own
             // comments about their providers. `keepScalar` keeps the node itself.
@@ -217,16 +211,16 @@ export function applyPatch(patch, parts) {
             // lacked the key does not gain an empty one.
             const config = existing.node.has('config') ? existing.node.get('config', true) : undefined;
             if (config === undefined) {
-                if (Object.keys(part.config).length > 0) {
-                    existing.node.set('config', document.createNode(part.config));
+                if (Object.keys(modelPart.config).length > 0) {
+                    existing.node.set('config', document.createNode(modelPart.config));
                 }
             }
-            else if (!sameJson(config, part.config)) {
-                existing.node.set('config', mergeInto(document, config, part.config));
+            else if (!sameJson(config, modelPart.config)) {
+                existing.node.set('config', mergeInto(document, config, modelPart.config));
             }
         }
         else {
-            const row = document.createNode({ id, name: defaultNameFor(id), config: part.config });
+            const row = document.createNode({ id: MODELS_ID, name: '@deepseek-ai/dsh-llm-pi-ai', config: modelPart.config });
             contents.items.push(row);
         }
     }
@@ -275,10 +269,6 @@ export function applyPatch(patch, parts) {
         return patch.text;
     return document.toString();
 }
-/** The loader `name` a row carries when this plugin has to create it. */
-function defaultNameFor(id) {
-    return id === MODELS_ID ? '@deepseek-ai/dsh-llm-pi-ai' : '@deepseek-ai/dsh-agent-default-model';
-}
 /**
  * Rewrite the profile manifest with merged plugin declarations, two-space
  * indented.

package/lib/wire.d.ts

@@ -62,8 +62,19 @@ export declare const LEGACY_REMOTE_FILE = "dsh-profile.dshsync";
  * second computer gets both the path and what is under it. Its empty value is a
  * real value (`{ dirs: [] }`), not an absent part, because "the list is now
  * empty" is a change that has to travel like any other.
+ *
+ * `keys` is the one part whose content is a secret, and the one part that lives
+ * outside the profile: the API keys this computer's credential store holds for its
+ * providers. It is on by default, because a setup that travels without its keys
+ * arrives with every provider unauthenticated, and it can be switched off on its
+ * own; see {@link KeysPart}.
+ *
+ * The default model is deliberately *not* a part: which model a new session starts
+ * on is changed several times a day, and every change would push a file for
+ * something a person sets on each computer anyway. Its row stays out of `patch`
+ * too, like this plugin's own row. See `docs/decisions/0056-drop-default-model-part.md`.
  */
-export declare const PARTS: readonly ["models", "defaults", "plugins", "patch", "dirs"];
+export declare const PARTS: readonly ["models", "plugins", "patch", "dirs", "keys"];
 export type Part = (typeof PARTS)[number];
 /**
  * Most extra directories one configuration may name.
@@ -91,11 +102,6 @@ export interface ModelsPart {
     /** The whole `llm-pi-ai` entry config, so fields beyond `providers` travel too. */
     config: Record<string, unknown>;
 }
-/** The `defaults` part: which provider/model new sessions start on. */
-export interface DefaultsPart {
-    /** The whole `agent-default-model` entry config. */
-    config: Record<string, unknown>;
-}
 /** One other top-level row of the profile patch, carried by the `patch` part. */
 export interface PatchEntry {
     /** `id` of an id-targeted row, or `insert` for an insert block. */
@@ -150,6 +156,20 @@ export interface DirSpec {
 export interface DirsPart {
     dirs: DirSpec[];
 }
+/**
+ * A credential this computer could not read or write, and why not.
+ *
+ * A store that cannot be read must not look like a store with nothing in it: an
+ * empty read would say "this computer has no keys", which is a real answer a sync
+ * acts on. This is how the two are told apart, the same way {@link DirProblem}
+ * keeps an unreadable directory from looking like an empty one.
+ */
+export interface KeyProblem {
+    /** The reference name, as the profile asks for it; '' when the store itself failed. */
+    ref: string;
+    /** What went wrong, in a sentence the card can show. */
+    message: string;
+}
 /** A configured directory this computer could not read, and why not. */
 export interface DirProblem {
     /** The configured path, as it is stored. */
@@ -167,6 +187,33 @@ export interface DirProblem {
      */
     missing?: boolean;
 }
+/**
+ * The `keys` part: the API keys this computer holds for its providers.
+ *
+ * The profile names a credential instead of holding it — `apiKeyEnv: OFOX_API_KEY`
+ * on a provider route, `secretEnv` on a GitHub webhook — and the value behind that
+ * name lives in this computer's credential store (`$DSH_HOME/.credentials.yaml`).
+ * That is why a setup synced without this part arrives complete and still cannot
+ * talk to a single provider: it carries the names, and the names resolve to
+ * nothing here.
+ *
+ * A name is the whole address of a secret, so this part is a map and not a list:
+ * applying it puts each value back under the name the profile already asks for.
+ * Nothing here is ever deleted — a key removed on one computer stays on the others,
+ * because a credential a person stored by hand is not this plugin's to throw away.
+ * See `docs/decisions/0054-sync-api-keys.md`.
+ */
+export interface KeysPart {
+    /**
+     * Secret values by the reference name that resolves them, exactly as the
+     * credential store holds them (`apiKeyEnv`/`secretEnv` values, verbatim).
+     *
+     * Only names this computer actually has a stored value for appear; a name that
+     * falls through to the environment is left out, since the environment is the
+     * other computer's own business.
+     */
+    refs: Record<string, string>;
+}
 /** Everything one sealed backup carries. Field names are the wire format. */
 export interface Bundle {
     format: 'dsh-webdav-sync-backup';
@@ -176,10 +223,10 @@ export interface Bundle {
     /** Which app sealed it, for a file several tools might share a folder with. */
     app: string;
     models?: ModelsPart;
-    defaults?: DefaultsPart;
     plugins?: PluginsPart;
     patch?: PatchPart;
     dirs?: DirsPart;
+    keys?: KeysPart;
 }
 /** The format word in the envelope; anything else on the server is not ours. */
 export declare const BUNDLE_FORMAT = "dsh-webdav-sync-backup";
@@ -209,10 +256,10 @@ export interface Notice {
 /** One side of the last completed sync, per part. */
 export interface PartHashes {
     models?: string;
-    defaults?: string;
     plugins?: string;
     patch?: string;
     dirs?: string;
+    keys?: string;
 }
 /**
  * The variable half of the state: everything a completed sync records.
@@ -245,6 +292,8 @@ export interface StoredState extends SyncRecord {
     key?: string | undefined;
     /** Last sync attempt, ISO-8601. */
     last?: string | undefined;
+    /** True once keys have a trustworthy local comparison baseline. */
+    keysBaseline?: boolean | undefined;
     /**
      * Last attempt that actually moved something, ISO-8601: a push, a part taken
      * from the server, or a restore. Absent until one has. This is the difference
@@ -276,12 +325,20 @@ export interface SyncConfig {
     autoEvery: number;
     /** Whether the model catalog travels. */
     models: boolean;
-    /** Whether the default-model row travels. */
-    defaults: boolean;
     /** Whether the installed-plugin list travels. */
     plugins: boolean;
     /** Whether the remaining profile-patch rows travel. */
     patch: boolean;
+    /**
+     * Whether this computer's stored API keys travel.
+     *
+     * On by default: a provider route names its credential, so a setup synced
+     * without the keys arrives with every provider unauthenticated. Turning it off
+     * keeps this computer's keys off the server entirely — nothing is deleted
+     * anywhere, and the server's copy of the part is carried through untouched,
+     * exactly as for the three parts above.
+     */
+    keys: boolean;
     /**
      * Absolute paths of the extra directories that travel with the setup, in the
      * order the user added them. The list itself is the `dirs` part, so what is
@@ -292,10 +349,11 @@ export interface SyncConfig {
     /**
      * Whether the extra directories travel with this setup.
      *
-     * The list above is kept either way: switching this off says "this computer does
-     * not carry them", not "forget them". Nothing is deleted anywhere by turning it
-     * off — the server's copy of the part is carried through untouched, exactly as
-     * for the four parts above.
+     * Off is the resting state: a configuration that has not said otherwise carries
+     * no directory. The list above is kept either way: switching this off says "this
+     * computer does not carry them", not "forget them". Nothing is deleted anywhere
+     * by turning it off — the server's copy of the part is carried through
+     * untouched, exactly as for the other parts.
      */
     dirsEnabled: boolean;
     /** Whether the plugin's own address, user and password are kept for next time. */
@@ -339,9 +397,10 @@ export interface ConfigView {
     passphraseSet: boolean;
     autoEvery: number;
     models: boolean;
-    defaults: boolean;
     plugins: boolean;
     patch: boolean;
+    /** Whether this computer's stored API keys travel. */
+    keys: boolean;
     /** The extra directories that travel, as stored. Not a secret. */
     dirs: string[];
     /** Whether the extra directories travel with the current configuration. */
@@ -412,6 +471,13 @@ export interface StatusResult {
      * this is how the card is able to say so.
      */
     dirProblems?: DirProblem[];
+    /**
+     * Credentials the configuration names that could not be read here, with the
+     * reason. Present exactly when there is at least one, for the same reason as
+     * {@link StatusResult.dirProblems}: a store that cannot be read is left as the
+     * server has it for this sync rather than read as empty.
+     */
+    keysProblems?: KeyProblem[];
     /** The profile declares plugins the installed tree does not have yet. */
     pendingInstall: boolean;
     /** Which plugins those are, present exactly when {@link pendingInstall} is true. */
@@ -427,9 +493,10 @@ export interface ConfigureBody {
     passphrase?: string;
     autoEvery?: number;
     models?: boolean;
-    defaults?: boolean;
     plugins?: boolean;
     patch?: boolean;
+    /** Whether this computer's stored API keys travel. */
+    keys?: boolean;
     /** The whole list of extra directories, replacing the stored one. */
     dirs?: string[];
     /** Whether the extra directories travel with this setup. */
@@ -471,6 +538,13 @@ export interface SyncResult {
     pendingNames?: string[];
     /** The profile has to be reloaded for the applied configuration to take effect. */
     reloadNeeded: boolean;
+    /**
+     * Keys the merge brought here that this computer's credential store would not
+     * take, with the reason. Present exactly when there is at least one: a key that
+     * could not be stored leaves that provider unauthenticated, and a sync that
+     * reported success would hide it.
+     */
+    keysProblems?: KeyProblem[];
 }
 /** POST {@link ROUTE_CHECK} result. */
 export interface CheckResult {

package/lib/wire.js

@@ -64,8 +64,19 @@ export const LEGACY_REMOTE_FILE = 'dsh-profile.dshsync';
  * second computer gets both the path and what is under it. Its empty value is a
  * real value (`{ dirs: [] }`), not an absent part, because "the list is now
  * empty" is a change that has to travel like any other.
+ *
+ * `keys` is the one part whose content is a secret, and the one part that lives
+ * outside the profile: the API keys this computer's credential store holds for its
+ * providers. It is on by default, because a setup that travels without its keys
+ * arrives with every provider unauthenticated, and it can be switched off on its
+ * own; see {@link KeysPart}.
+ *
+ * The default model is deliberately *not* a part: which model a new session starts
+ * on is changed several times a day, and every change would push a file for
+ * something a person sets on each computer anyway. Its row stays out of `patch`
+ * too, like this plugin's own row. See `docs/decisions/0056-drop-default-model-part.md`.
  */
-export const PARTS = ['models', 'defaults', 'plugins', 'patch', 'dirs'];
+export const PARTS = ['models', 'plugins', 'patch', 'dirs', 'keys'];
 /**
  * Most extra directories one configuration may name.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-webdav-sync",
-  "version": "1.0.3",
-  "description": "用 WebDAV 在多台电脑之间同步 DSH 的配置：模型供应商与模型、默认模型、已安装插件。整个备份在离开本机前用口令加密（AES-256-GCM + PBKDF2），以分片三方合并的方式在服务端保留一个加密文件。",
+  "version": "1.0.5",
+  "description": "用 WebDAV 在多台电脑之间同步 DSH 的配置：模型供应商与模型、已安装插件、其余 profile 配置、附加目录与 API 密钥。整个备份在离开本机前用口令加密（AES-256-GCM + PBKDF2），以分片三方合并的方式在服务端保留一个加密文件。",
   "keywords": [
     "dsh",
     "deepseek",