The provider-card seat's keyConfigured now derives from the reference the
page would use — the profile's apiKeyEnv, or the page's derived
<ROUTE>_API_KEY while the profile names none — so the add-provider draft
agrees with its own editor about an existing conventional credential (the
store joins the derived describe in the same batched call, as
ProviderRow.derivedCredential). ModelsSectionProps makes the renderSlot seat
required so a direct render that forgets it fails to compile; the one such
render in provider-form.client.spec regained a real mount and the test
boilerplate collapsed to renderSlot={() => null}. The extension-slots Agent
Note now states the keyed cell's real override rule (same priority throws,
a different priority shadows), and docs/subsystems/slots.md carries the two
new seats in its hierarchy, both languages.
pi-ai credentials carry optional members as explicit undefined (a github.com
Copilot grant holds enterpriseUrl: undefined), and the store bridge committed
the object verbatim, so the credential store's strict validator refused the
write and sign-in failed after the provider had already authorized it.
toRecord now drops explicitly-undefined members and renders undefined array
entries null, exactly as JSON.stringify would; everything else passes through
untouched so genuinely unstorable values still fail loud at the store.
The Models section now declares two SlotMap seats for out-of-tree plugins:
settings.models.provider-card (keyed by the row's settingsNs, dispatched on
saved cards, the first-run setup posture, and the add-provider draft, with
the row view, configured join, and confirmed api-key state as owner props)
and settings.models.footer (ordered list after the rows and add controls).
Without registrants both seats render nothing. First consumer: the
llm-pi-ai-oauth companion plugin's sign-in surface.
The self-hosted Windows coverage pool (16 shards x 12 workers on 192
threads) pushes real subprocess boots past their vitest deadlines: the
tool-pwsh Loader smoke reaches ~40s against a 30s process cap, and the
tool-ralph worker-thread cases exceed the 5s default. Give the pwsh
smoke a 90s process deadline (the subprocess keeps the assembled boot,
the vitest deadline stays at 120s), and give the two un-budgeted ralph
cases 30s each, matching the existing 20s quiescence case.
On Linux, pwsh may trap SIGTERM and exit cleanly when the subprocess service
is disposed, so the handle status is 'completed' rather than 'killed'. The
test already proved the process tree is gone via kill(pid,0); both statuses
satisfy the contract.
Yichen Jiang