feat(web): mount the config plane in dsh web and pin the Models page keyless

apps/cli/cordis.yml gains settings-local, credentials-local, and the bare
dormant llm-pi-ai row (manifest deps added for the resolver contract);
llm-deepseek drops its !!js apiKey inline for per-request credential
resolution. Both adapters tag apiKeyEnv role('credential-ref') so the
form mounts the credential control. The web e2e scaffold isolates a
harness home per run — an in-process boot must never touch the
developer's real ~/.dsh — and the new models-settings scenario pins the
whole loop through the shipped app: dormant directory as add vocabulary,
schema-driven editor apply landing in settings.yaml, the route
registering live (topology frame), and a write-only key landing in the
temp .env with the configured badge converging. A hermetic test-owned
reference name keeps a developer's real provider keys from flipping the
badge. schema-form joins the platform module table (seed + externals)
so client bundles share one instance.

packages/client/ui-models/src/client/ModelsSection.tsx

@@ -28,10 +28,11 @@ export interface ModelsSectionInjected {
   t: (key: keyof typeof en) => string
 }
 
-/** Props delivered by the slot outlet. */
-export interface ModelsSectionProps {
-  injected?: ModelsSectionInjected
-}
+/**
+ * Props delivered by the slot outlet: the inject face spread flat (the
+ * renderer erases the share boundary at the render call).
+ */
+export type ModelsSectionProps = Partial<ModelsSectionInjected>
 
 /** The editor target: an existing row or a dormant directory entry. */
 interface EditorTarget {
@@ -80,9 +81,9 @@ function StatusBadges({ row, t }: { row: ProviderRow; t: ModelsSectionInjected['
  * @returns the section, or null while the shell has not injected yet.
  */
 export function ModelsSection(props: ModelsSectionProps): ReactNode {
-  const injected = props.injected
-  if (injected === undefined) return null
-  return <Loaded injected={injected} />
+  const { controller, useSnapshot, api, t } = props
+  if (controller === undefined || useSnapshot === undefined || api === undefined || t === undefined) return null
+  return <Loaded injected={{ controller, useSnapshot, api, t }} />
 }
 
 function Loaded({ injected }: { injected: ModelsSectionInjected }): ReactNode {

packages/client/ui-models/tests/components.spec.tsx

@@ -104,9 +104,11 @@ function scriptedFace(overrides: {
   return { face, update, replace, set }
 }
 
+type WireFace = ConstructorParameters<typeof ModelsSettingsStore>[0]
+
 async function mountSection(overrides: Parameters<typeof scriptedFace>[0] = {}) {
   const { face, update, replace, set } = scriptedFace(overrides)
-  const controller = new ModelsSettingsStore(face as never)
+  const controller = new ModelsSettingsStore(face as unknown as WireFace)
   await controller.load()
   const injected: ModelsSectionInjected = {
     controller,
@@ -114,7 +116,7 @@ async function mountSection(overrides: Parameters<typeof scriptedFace>[0] = {})
     api: face as never,
     t,
   }
-  const view = render(<ModelsSection injected={injected} />)
+  const view = render(<ModelsSection {...injected} />)
   return { view, face, update, replace, set, controller }
 }
 
@@ -275,14 +277,14 @@ describe('ModelsSection', () => {
   it('renders the load failure with a retry control', async () => {
     const face = scriptedFace()
     face.face.llm.providers = vi.fn(() => Promise.resolve(fail('directory down', 'internal'))) as never
-    const controller = new ModelsSettingsStore(face.face as never)
+    const controller = new ModelsSettingsStore(face.face as unknown as WireFace)
     await controller.load()
-    render(<ModelsSection injected={{
-      controller,
-      useSnapshot: bindSnapshotSelector(controller.store),
-      api: face.face as never,
-      t,
-    }} />)
+    render(<ModelsSection
+      controller={controller}
+      useSnapshot={bindSnapshotSelector(controller.store)}
+      api={face.face as never}
+      t={t}
+    />)
     expect(screen.getByText(/directory down/)).toBeTruthy()
     fireEvent.click(screen.getByText(en.retry))
     await waitFor(() => { expect(screen.queryByText(/directory down/)).toBeNull() })
@@ -294,15 +296,15 @@ describe('ModelsSection', () => {
       writable: false,
       namespaces: wireNamespaces(),
     })))
-    const controller = new ModelsSettingsStore(face as never)
+    const controller = new ModelsSettingsStore(face as unknown as WireFace)
     await controller.load()
     cleanup()
-    render(<ModelsSection injected={{
-      controller,
-      useSnapshot: bindSnapshotSelector(controller.store),
-      api: face as never,
-      t,
-    }} />)
+    render(<ModelsSection
+      controller={controller}
+      useSnapshot={bindSnapshotSelector(controller.store)}
+      api={face as never}
+      t={t}
+    />)
     expect(screen.getByText(en.readOnly)).toBeTruthy()
     expect(screen.getAllByText<HTMLButtonElement>(en.remove).every(button => button.disabled)).toBe(true)
   })
@@ -359,13 +361,13 @@ describe('ModelsSection', () => {
 
   it('loads on first render of an idle controller', async () => {
     const { face } = scriptedFace()
-    const controller = new ModelsSettingsStore(face as never)
-    render(<ModelsSection injected={{
-      controller,
-      useSnapshot: bindSnapshotSelector(controller.store),
-      api: face as never,
-      t,
-    }} />)
+    const controller = new ModelsSettingsStore(face as unknown as WireFace)
+    render(<ModelsSection
+      controller={controller}
+      useSnapshot={bindSnapshotSelector(controller.store)}
+      api={face as never}
+      t={t}
+    />)
     await screen.findByText('DeepSeek')
   })