feat(web): mount the config plane in dsh web and pin the Models page keyless

apps/cli/cordis.yml gains settings-local, credentials-local, and the bare
dormant llm-pi-ai row (manifest deps added for the resolver contract);
llm-deepseek drops its !!js apiKey inline for per-request credential
resolution. Both adapters tag apiKeyEnv role('credential-ref') so the
form mounts the credential control. The web e2e scaffold isolates a
harness home per run — an in-process boot must never touch the
developer's real ~/.dsh — and the new models-settings scenario pins the
whole loop through the shipped app: dormant directory as add vocabulary,
schema-driven editor apply landing in settings.yaml, the route
registering live (topology frame), and a write-only key landing in the
temp .env with the configured badge converging. A hermetic test-owned
reference name keeps a developer's real provider keys from flipping the
badge. schema-form joins the platform module table (seed + externals)
so client bundles share one instance.

packages/client/schema-form/tsdown.config.ts

@@ -0,0 +1,29 @@
+import { defineConfig } from 'tsdown'
+
+/**
+ * schema-form is browser-only, but its lib bundle is imported under plain
+ * Node through consumer lib chains (same posture as ui-primitives). CSS
+ * imports are stubbed to empty modules: the hashed class maps only matter in
+ * bundler contexts, which compile src directly and never read lib.
+ */
+export default defineConfig({
+  entry: ['lib/types/index.js', 'lib/types/invariant.js'],
+  outDir: 'lib',
+  format: ['esm'],
+  platform: 'neutral',
+  target: 'es2024',
+  fixedExtension: false,
+  dts: false,
+  clean: false,
+  plugins: [{
+    name: 'dsh-css-stub',
+    resolveId(source: string) {
+      if (!source.endsWith('.css')) return null
+      return `\0dsh-css-stub:${source}.mjs`
+    },
+    load(id: string) {
+      if (!id.startsWith('\0dsh-css-stub:')) return null
+      return 'export default {};'
+    },
+  }],
+})

packages/client/ui-models/src/client/ModelsSection.tsx

@@ -28,10 +28,11 @@ export interface ModelsSectionInjected {
   t: (key: keyof typeof en) => string
 }
 
-/** Props delivered by the slot outlet. */
-export interface ModelsSectionProps {
-  injected?: ModelsSectionInjected
-}
+/**
+ * Props delivered by the slot outlet: the inject face spread flat (the
+ * renderer erases the share boundary at the render call).
+ */
+export type ModelsSectionProps = Partial<ModelsSectionInjected>
 
 /** The editor target: an existing row or a dormant directory entry. */
 interface EditorTarget {
@@ -80,9 +81,9 @@ function StatusBadges({ row, t }: { row: ProviderRow; t: ModelsSectionInjected['
  * @returns the section, or null while the shell has not injected yet.
  */
 export function ModelsSection(props: ModelsSectionProps): ReactNode {
-  const injected = props.injected
-  if (injected === undefined) return null
-  return <Loaded injected={injected} />
+  const { controller, useSnapshot, api, t } = props
+  if (controller === undefined || useSnapshot === undefined || api === undefined || t === undefined) return null
+  return <Loaded injected={{ controller, useSnapshot, api, t }} />
 }
 
 function Loaded({ injected }: { injected: ModelsSectionInjected }): ReactNode {

packages/client/ui-models/tests/components.spec.tsx

@@ -104,9 +104,11 @@ function scriptedFace(overrides: {
   return { face, update, replace, set }
 }
 
+type WireFace = ConstructorParameters<typeof ModelsSettingsStore>[0]
+
 async function mountSection(overrides: Parameters<typeof scriptedFace>[0] = {}) {
   const { face, update, replace, set } = scriptedFace(overrides)
-  const controller = new ModelsSettingsStore(face as never)
+  const controller = new ModelsSettingsStore(face as unknown as WireFace)
   await controller.load()
   const injected: ModelsSectionInjected = {
     controller,
@@ -114,7 +116,7 @@ async function mountSection(overrides: Parameters<typeof scriptedFace>[0] = {})
     api: face as never,
     t,
   }
-  const view = render(<ModelsSection injected={injected} />)
+  const view = render(<ModelsSection {...injected} />)
   return { view, face, update, replace, set, controller }
 }
 
@@ -275,14 +277,14 @@ describe('ModelsSection', () => {
   it('renders the load failure with a retry control', async () => {
     const face = scriptedFace()
     face.face.llm.providers = vi.fn(() => Promise.resolve(fail('directory down', 'internal'))) as never
-    const controller = new ModelsSettingsStore(face.face as never)
+    const controller = new ModelsSettingsStore(face.face as unknown as WireFace)
     await controller.load()
-    render(<ModelsSection injected={{
-      controller,
-      useSnapshot: bindSnapshotSelector(controller.store),
-      api: face.face as never,
-      t,
-    }} />)
+    render(<ModelsSection
+      controller={controller}
+      useSnapshot={bindSnapshotSelector(controller.store)}
+      api={face.face as never}
+      t={t}
+    />)
     expect(screen.getByText(/directory down/)).toBeTruthy()
     fireEvent.click(screen.getByText(en.retry))
     await waitFor(() => { expect(screen.queryByText(/directory down/)).toBeNull() })
@@ -294,15 +296,15 @@ describe('ModelsSection', () => {
       writable: false,
       namespaces: wireNamespaces(),
     })))
-    const controller = new ModelsSettingsStore(face as never)
+    const controller = new ModelsSettingsStore(face as unknown as WireFace)
     await controller.load()
     cleanup()
-    render(<ModelsSection injected={{
-      controller,
-      useSnapshot: bindSnapshotSelector(controller.store),
-      api: face as never,
-      t,
-    }} />)
+    render(<ModelsSection
+      controller={controller}
+      useSnapshot={bindSnapshotSelector(controller.store)}
+      api={face as never}
+      t={t}
+    />)
     expect(screen.getByText(en.readOnly)).toBeTruthy()
     expect(screen.getAllByText<HTMLButtonElement>(en.remove).every(button => button.disabled)).toBe(true)
   })
@@ -359,13 +361,13 @@ describe('ModelsSection', () => {
 
   it('loads on first render of an idle controller', async () => {
     const { face } = scriptedFace()
-    const controller = new ModelsSettingsStore(face as never)
-    render(<ModelsSection injected={{
-      controller,
-      useSnapshot: bindSnapshotSelector(controller.store),
-      api: face as never,
-      t,
-    }} />)
+    const controller = new ModelsSettingsStore(face as unknown as WireFace)
+    render(<ModelsSection
+      controller={controller}
+      useSnapshot={bindSnapshotSelector(controller.store)}
+      api={face as never}
+      t={t}
+    />)
     await screen.findByText('DeepSeek')
   })
 

packages/client/web/package.json

@@ -21,6 +21,7 @@
   "license": "BSD-3-Clause",
   "dependencies": {
     "@deepseek-ai/dsh-client-modules": "workspace:^",
+    "@deepseek-ai/dsh-client-schema-form": "workspace:^",
     "@deepseek-ai/dsh-client-ui-primitives": "workspace:^",
     "@deepseek-ai/dsh-client-ui-slots": "workspace:^",
     "@deepseek-ai/dsh-client-ui-theme": "workspace:^",

packages/client/web/src/platform.ts

@@ -10,6 +10,7 @@ export const PLATFORM_MODULES = [
   '@deepseek-ai/dsh-client-ui-slots',
   '@deepseek-ai/dsh-client-web-react',
   '@deepseek-ai/dsh-client-ui-primitives',
+  '@deepseek-ai/dsh-client-schema-form',
 ] as const
 
 /** One platform module specifier (a seed-table key). */

packages/client/web/src/seed.ts

@@ -14,6 +14,7 @@ import * as Cordis from 'cordis'
 import * as UiSlots from '@deepseek-ai/dsh-client-ui-slots'
 import * as WebReact from '@deepseek-ai/dsh-client-web-react'
 import * as UiPrimitives from '@deepseek-ai/dsh-client-ui-primitives'
+import * as SchemaForm from '@deepseek-ai/dsh-client-schema-form'
 import type { PlatformModule } from './platform.ts'
 
 /**
@@ -33,5 +34,6 @@ export function getStaticModules(): Record<string, unknown> {
     '@deepseek-ai/dsh-client-ui-slots': UiSlots,
     '@deepseek-ai/dsh-client-web-react': WebReact,
     '@deepseek-ai/dsh-client-ui-primitives': UiPrimitives,
+    '@deepseek-ai/dsh-client-schema-form': SchemaForm,
   } satisfies Record<PlatformModule, unknown>
 }

packages/client/web/tsconfig.json

@@ -23,6 +23,9 @@
     {
       "path": "../ui-primitives"
     },
+    {
+      "path": "../schema-form"
+    },
     {
       "path": "../web-react"
     },