[AuhNijGnahz]

Summary

• add a setup-only System One (classifier) format to Custom Endpoint without creating a chat provider or exposing the classifier in Composer, default-chat, or subagent model lists
• persist a non-secret Jev endpoint/model binding while preserving the official TypeSafe endpoint and jev-latest as the legacy default
• pass the exact endpoint/model through probe, Main, sidecar, and Agent runtime while continuing to use pi-ai's native System One adapter
• enforce probe-before-save, fail closed on corrupt explicit bindings, apply the user-endpoint network policy, and refuse credential-bearing cross-origin redirects
• show the active endpoint/model in Settings and update all shipped locales, in-app changelogs, English/Chinese specs, and the Jev E2E scenario

Compatibility and security

• existing installations with only jevEnabled plus secret:app:typesafe-jev keep the official TypeSafe behavior
• legacy string probe input and the internal jevApiKey runtime input remain supported as official-default compatibility paths
• API-root and complete /systemone inputs normalize to one operation URL; /systemone is appended exactly once
• an explicit invalid binding disables Jev instead of silently sending data to the official endpoint
• the API key remains in the existing Host secure-storage slot; only baseUrl and modelId are persisted in settings

Validation

Task candidate: c5ff001d7e8467bb36439ed0aa876450c1e6c279
Base main: e219a3e4c0e4cc73ddacde78005987a85d5977d6

Passed:

• pnpm build:js
• pnpm --filter @pi-desktop/desktop typecheck
• pnpm --filter @pi-desktop/shared test — 100 files / 1,282 tests
• pnpm lint
• pnpm test:e2e:jev — 21 Desktop tests plus 7 Agent Runtime Jev tests
• pnpm test:e2e:provider-api-style — 26 scenarios; run twice after stabilizing observable UI synchronization
• i18n Vitest — 3 files / 30 tests
• targeted Desktop settings/config/layout tests — 52 tests
• cargo test -p host-core --locked rpc::tests::jev_classifier_binding_round_trips_clears_and_validates -- --exact
• cargo clippy -p host-core --all-targets --locked (one pre-existing warning in transcripts.rs)
• cargo fmt --check
• git diff --check
• pnpm check:pr-base
• GitHub PR checks — 6/6 successful, including JS build/typecheck/lint/architecture/test

Additional broad suites attempted on Windows:

• Desktop full suite: 3,984 passed, 81 failed, 7 cancelled, 11 skipped. The failures are dominated by existing Windows symlink privilege (EPERM), shell/SSH fixture execution, macOS-only shell-path assumptions, and existing catalog-value baselines. The Jev Electron path emitted all expected true assertions but its child process was signalled after reporting under full-suite contention; the same path passes in the dedicated Jev E2E suite.
• host-core full suite: 934 passed, 18 failed, 1 ignored. Failures are existing Windows CRLF/path/environment cases; the new Jev settings round-trip test passes independently.

No real TypeSafe/OpenRouter key, paid API, or live provider endpoint was used.