Yichen Jiang
9f996be8e3
Five findings from the #939 review, each reproduced before being fixed. **Configuration reads are as privileged as writes.** `settings.describe` returns every exposed namespace's configuration and `credentials.describe` reports whether an arbitrary environment-variable name is configured and from where — reconnaissance no anonymous caller should have. Both join PRIVILEGED_METHODS, so the whole configuration plane is loopback-only until real authentication exists; `trustedHosts` was never authentication. The model catalog stays reachable: it carries no endpoints or key state, and a LAN client's model picker legitimately needs it. Asserted over a real HTTP server, because the Host header a browser actually sends is what decides this. **The proxy serves only namespaces a registered model provider addresses.** The settings seam is general — any plugin may register one — but the Web configuration plane is the model-provider surface. Without the gate, every future `settings.register()` would silently become remotely readable and writable configuration. An unregistered namespace and an unexposed one answer identically, so no caller can enumerate the registry one probe at a time. **Path-addressed writes replace the redacted-document rebuild.** The editor reads the REDACTED descriptor, so rebuilding a section from it and replacing wholesale deleted every literal secret the wire never returned — reproduced as `{baseURL, reasoning}` in, stored `apiKey` gone out. `settings.mutate` applies set/unset ops to the section as it stands at the front of the seam's write queue, and the client names only fields it can see, so an unseen secret is untouched by construction rather than by care. P2s in the same pass: `llm/adapters-updated` now contains async listener rejections (an uncontained one escaped as unhandledRejection, contradicting the documented "observer failures are contained"); llm-deepseek's retry-policy swap uses the atomic `registration.replace` instead of dispose-then-register, which published `[]` then `["deepseek-official"]` so an observer saw the provider disappear and come back; and a transport rejection no longer strands the page in `loading` or a card in `busy`, with removal failures surfaced on the page banner instead of swallowed.
settings/ — user-settings capability family
English | 中文
The user-settings seam and its providers. The interface package owns the abstract Settings service — namespace registration, layered resolution, and change commits; providers implement raw-document storage and push external edits through the seam. All product packages.
| Package | Role | ctx key |
|---|---|---|
settings/ |
Settings seam: namespace registry, layered resolution, commit events | ctx.settings |
settings-local/ |
File-backed provider (settings.yaml/.json) with hot reload and comment-preserving write-back |
(registers ctx.settings) |
The interface lives at settings/settings/; providers are flat siblings. A network configuration-center provider (for example a nacos-style backend) joins here and registers on ctx.settings. Composition config stays in cordis.yml: a settings namespace carries only the user-editable subset, resolved as schema defaults, then the registrant's composition base, then the user document.