**A hand-declared route must not offer a reasoning effort.** The earlier
commit read the create card's missing control as drift and added one. It
is the other way round: such a model has no reasoning capability — pi-ai's
installed catalog is what supplies one, and it ships nothing under the
route — so `resolveModel` throws UNSUPPORTED_REASONING_EFFORT for every
model on it and the whole provider drops out of the picker. Verified
against the adapter, not inferred. The create card no longer offers it and
the editor withholds it on the directory's `declared` bit, which is the
real bug: that control has always been wrong for these routes.
**A blocked composer locked the way out of the block.** Reusing the
no-workspace inert posture disabled the model seat along with everything
else, so the bar asked for a model while preventing the one control that
picks one. A block now rides its own `blocked` owner prop: the textarea,
send, commands, plan seat, and access chip all lock, and the model seat
alone stays live.
**A Provider ID could derive an illegal credential reference.** The card
accepted a digit-leading id, whose derived `123_API_KEY` then failed at
the credential seam with a raw regular expression the user cannot act on.
The id must now start with a letter, and a test pins the relation between
the two rules rather than the regex.
The Agent Note Consequences paragraph (en+zh) now limits the no-API-key
claim to replay/refresh modes, matching the Decision paragraph and the
record-mode key requirement; the test header is rewrapped and the
pairing sidecar re-recorded.
Carries two edits beyond conflict resolution, both forced by what master
brought in:
- `CustomProviderCard`: master added front-end key validation and a
component-level `keyValue` (already trimmed) while still writing
`apiKeyEnv` unconditionally. Kept this branch's blank-key rule and its
committed-profile retry gate, and adopted master's single `keyValue` so
the component has one spelling of the key rather than two.
- `docs/user/guide/providers`: master merged #1810, whose default-model
section still taught overriding the `api-gateway` row in
`$DSH_HOME/config.yaml` — the behavior this branch replaced. Rewritten
for the settings section the picker now writes, plus the review fix from
#1810 replacing the colloquial 挂着 in the opener.
The WebScaffold.close() interface JSDoc now states the replayProvidersOnly
skip (the earlier commit only touched the inline body comment), the
replayProvidersOnly option JSDoc folds both boot-time rejections, and the
test header plus Agent Note (en+zh) scope the no-key claim to
replay/refresh modes; the pairing sidecar is re-recorded.
A default naming a route the Models page has since removed left the
composer saying 选择模型 while the input still accepted a message, which
then failed inside the adapter mid-turn.
`session.prompt` now refuses with `model-unavailable` before opening a
turn. That is the enforcement boundary: the method stays callable no
matter what a client disables. `session.models` reports the same fact as
`routable`, and ui-model pushes a block through the new
`ctx.conversation.blocks` registry so the bar renders the disabled
textarea it already renders without a workspace, carrying the blocker's
own reason. The push direction is forced — ui-model already depends on
ui-conversation, so ui-conversation cannot read it back.
The gate is `routable`, not "matches no advertised group": catalog
membership is advisory, so a route serving a model it stopped advertising
is missing from the groups yet perfectly usable, and `null` before the
first load never blocks so a slow Host cannot lock a working composer.
The scaffold gains a route-only adapter for fixture-less keyless
scenarios. Registering zero providers is a test artifact — every product
composition mounts one — and the goldens that froze the seat's fallback
label now show the model those scenarios actually route to.
The boot guard now fails loud when replayProvidersOnly combines with
replayOverride or replayChildFixtures, closing the bypass where callable
scripts could install with the consumption check skipped. The close()
comment states the providers-only skip, which the master merge had
reverted.
Resolves the scaffold.ts import conflict (keep readFileSync and master's
mkdir) and carries master's notes and tsconfig updates.
--no-verify: merge-commit pre-commit hooks lint all staged files; the
linted tree is verified clean via the repo lint script (tsc -b
tsconfig.host.json, oxlint, verify-translation-pairing all pass) and CI
owns the authoritative run.
The consumption-check skip was wider than needed and left a foot-gun:
a providers-only fixture that recorded model calls would silently go
unconsumed. The option now validates at boot that the fixture derives no
model calls (parseSessionLog scan), so the skip only ever covers a
header-only catalog mount; close() and the replayFixture JSDoc state the
interplay. The test header and Agent Note (en+zh) now say 'no model call'
instead of the contradictory 'no fixture', and the pairing sidecar is
re-recorded.
The option now fails loud without replayFixture instead of silently
mounting nothing, and its JSDoc states the interplay with the
consumption check. The fixture is a non-empty header row (no longer a
0-byte placeholder), and the model-label assertion polls for
DeepSeek-V4-Flash (the directory loads asynchronously) instead of
reading the attribute once.
Master's credential-lifecycle work taught the editor card that a pi-ai
profile names `apiKeyEnv` only when a key is actually stored, so a route
left blank keeps its provider-native auth path. The create card kept
writing the derived reference unconditionally, so a route declared for a
credential chain or ADC was born pointing at a reference nothing sets —
and now rendered a red missing-key dot for it.
Both cards apply one rule. The obsolete assertion moves with the behavior
(the with-key case is covered by the neighbouring test), and the merged
Models e2e golden shows the declared route unmarked rather than flagged.
A bare /plan command never calls a model, so the scaffold's replay row
did not mount and the model directory was empty: the trigger rendered
the short fallback label, which fits beside the chip even on the
pre-fix layout, silently defanging the regression. The scaffold gains a
replayProvidersOnly option (provider catalog without a recorded script,
consumption check skipped), the test mounts it, and asserts the trigger
aria-label contains DeepSeek-V4-Flash before measuring — verified that
removing the wrap fix makes the test fail (click areas disjoint: false).
A row's stored profile could not tell a hand-declared gateway from a
shipped provider whose models someone narrowed — both look identical from
outside the adapter — so the Models page had no way to mark the routes a
deployment added itself.
The directory entry now carries `declared`, answered by the owning adapter
against its own installed catalog, and the page renders a Custom tag from
it. Absence stays "this adapter draws no such distinction" rather than
"shipped", so a route no adapter claims is labelled neither way.
Also records the default-route work's Agent Note and the e2e evidence for
all three changes: the composer switch writing the section, and the Models
page declaring a route with its own reasoning effort.
ChatView's bottom-follow recognized only wheel gestures as reader input,
so touch panning, scrollbar dragging, and keyboard paging could not leave
the bottom of a streaming transcript. Replace the wheel listener with
device-agnostic attribution: a scroll position deviating from the
observed-top ledger of the last delivered or written scrollTop is reader
input. Adds keyboard-paging and touch-style fling e2e scenarios (red under
the old implementation) and the bilingual Agent Note triplet.
The /plan command handler commits plan/mode active immediately on the
live agent (the lifecycle-chrome precedent), so the test drops the
recorded fixture, the record/replay mode split, and the turn-settled
wait. The golden comparison stays in replay/refresh modes; the fixture
file is removed and the note describes the no-model path.
The file header now states the committed golden exactly (three boolean
verdicts; the exit result is an assertion, not golden content). The exit
predicate uses the derived SessionEvent<'plan/mode'> form instead of a
hand-written shape. The Agent Note triplet moves from implemented/feature/
to implemented/bug-fix/ following the composer defect-note precedent, and
the zh side uses the machine-checked ASCII header tokens; the pairing
sidecar is re-recorded for the new paths.
The exit-path assertion now reads the last plan/mode event's data.active
through a typed discriminant filter (event is SessionEvent & ...), so the
commit message and the code agree; the file header comment now describes
the committed three-boolean golden instead of the retired gap/overlap
facts.
imccyu