@goodandready/dsh-opencode-provider 0.5.23 → 0.5.24

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.5.24 — release 1: account safety
+
+- **#89 — managed credential cleanup**: keys saved through Settings or imported from `auth.json` are recorded in `~/.dsh/storages/dsh-opencode/managed-credentials.json` (refs only, never secrets). Removing an account asks for confirmation and deletes only plugin-managed credentials after the settings save succeeds; external environment/`auth.json` references are left intact. Cleanup failures are reported separately from the account removal.
+- **#83 — autoSwitch**: new `autoSwitch` setting (default `true`, preserving prior behavior). When off, the selected/first usable account serves alone; quota/credential failures do not rotate and quota fallback is disabled. Exposed in Settings and TUI.
+- 126 tests.
+
 ## 0.5.23
 
 - **DSH 0.2.2 support**: compatibility now accepts every `0.2.2` prerelease and final release with `>=0.2.1-rc.2 <0.2.3-0`; `0.2.2-rc.1` is recorded as verified. Dev/typecheck dependencies moved to `@deepseek-ai/*@0.2.2-rc.1`, Cordis 4.1.0 and Schemastery 3.19.0; peer ranges admit both the 0.2.1 and 0.2.2 lines.

package/README.md

@@ -132,12 +132,12 @@ npm pack
 Install the **packed tarball** into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.23.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.24.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.23.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.24.tgz
 
 # Or install the published package:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.23
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.24
 ```
 
 Restart dsh (or DSH Desktop), then pick **OpenCode (plugin)** or **OpenCode Go (plugin)** in the model picker.

package/README.ru.md

@@ -131,12 +131,12 @@ npm pack
 Установка из **упакованного tarball**:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.23.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.24.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.23.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.24.tgz
 
 # Либо установка опубликованного пакета из npm:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.23
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.24
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **OpenCode (plugin)** или **OpenCode Go (plugin)** в списке моделей.

package/README.zh.md

@@ -126,12 +126,12 @@ npm pack
 通过**打包文件 (.tgz)**安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.23.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.24.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.23.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.24.tgz
 
 # 或从 npm 安装已发布版本：
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.23
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.24
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型选择器中选择 **OpenCode (plugin)** 或 **OpenCode Go (plugin)** 即可。

package/lib/client.js

@@ -65,6 +65,9 @@ window.__ModuleLoader__.load({
 				dragAccount: "Drag to reorder accounts",
 				accountLimit: "At most 20 accounts are allowed.",
 				removeAccount: "Remove",
+				removeAccountConfirm: "Remove this account and delete its plugin-managed credential {ref}? This cannot be undone.",
+				managedKey: "Managed key",
+				accountCleanupFailed: "Account removed, but credential cleanup failed:",
 				pinAccount: "Pin",
 				activeAccount: "Pinned account",
 				activeAccountNow: "Active account",
@@ -197,6 +200,8 @@ window.__ModuleLoader__.load({
 				routingFailed: "Failed",
 				quotaFallbackModel: "Quota fallback model",
 				quotaFallbackModelHint: "If Go rejects with a quota error, retry once on this free model through Console/Zen.",
+				autoSwitch: "Automatic account failover",
+				autoSwitchHint: "Try the next account before any output when the current account hits quota or a credential failure. Off keeps the selected account only.",
 				stickySession: "Sticky account per conversation",
 				stickySessionHint: "Prefer the last successful account for the same conversation; explicit model rules and pinned accounts win.",
 				off: "Off",
@@ -278,6 +283,9 @@ window.__ModuleLoader__.load({
 				dragAccount: "拖动以调整账户顺序",
 				accountLimit: "最多允许 20 个账户。",
 				removeAccount: "移除",
+				removeAccountConfirm: "移除此账户并删除插件管理的凭据 {ref}？此操作无法撤销。",
+				managedKey: "插件管理的密钥",
+				accountCleanupFailed: "账户已移除，但凭据清理失败：",
 				pinAccount: "固定",
 				activeAccount: "固定账户",
 				activeAccountNow: "当前账户",
@@ -410,6 +418,8 @@ window.__ModuleLoader__.load({
 				routingFailed: "失败",
 				quotaFallbackModel: "配额回退模型",
 				quotaFallbackModelHint: "Go 返回配额错误时，通过 Console/Zen 用此免费模型重试一次。",
+				autoSwitch: "自动切换账户",
+				autoSwitchHint: "当前账户额度耗尽或凭据失败时，在输出前尝试下一个账户。关闭后只使用选定账户。",
 				stickySession: "每个会话固定账户",
 				stickySessionHint: "同一会话优先使用上次成功的账户；显式模型规则和固定账户优先。",
 				off: "关闭",
@@ -1653,6 +1663,7 @@ window.__ModuleLoader__.load({
 				accounts: state.config.accounts.map((account) => ({ ...account })),
 				modelAccountRules: state.config.modelAccountRules.map((rule) => ({ ...rule })),
 				quotaFallbackModel: state.config.quotaFallbackModel,
+				autoSwitch: state.config.autoSwitch !== false,
 				stickySession: state.config.stickySession,
 				visibleModels: state.config.visibleModels.length === 0 ? allIds : [...state.config.visibleModels],
 				filterModelsByPlan: state.config.filterModelsByPlan,
@@ -1704,6 +1715,7 @@ window.__ModuleLoader__.load({
 					account: rule.account.trim()
 				})).filter((rule) => rule.pattern !== "" && rule.account !== ""),
 				quotaFallbackModel: draft.quotaFallbackModel.trim(),
+				autoSwitch: draft.autoSwitch,
 				stickySession: draft.stickySession,
 				visibleModels: draft.showAll ? [] : draft.visibleModels,
 				filterModelsByPlan: draft.filterModelsByPlan,
@@ -1935,6 +1947,7 @@ window.__ModuleLoader__.load({
 			const [importing, setImporting] = (0, react.useState)(false);
 			const [checking, setChecking] = (0, react.useState)(null);
 			const [dragFrom, setDragFrom] = (0, react.useState)(null);
+			const [pendingCleanup, setPendingCleanup] = (0, react.useState)([]);
 			const load = (0, react.useCallback)(async () => {
 				setLoading(true);
 				try {
@@ -1964,12 +1977,25 @@ window.__ModuleLoader__.load({
 				setSaving(true);
 				setError(null);
 				try {
-					await saveConfig(patchOf(draft), draft.revision);
+					const patch = patchOf(draft);
+					await saveConfig(patch, draft.revision);
+					const stillUsed = new Set(patch.accounts.map((account) => account.apiKeyEnv?.trim() ?? "").filter((ref) => ref !== ""));
+					let cleanupError = null;
+					for (const ref of pendingCleanup) {
+						if (stillUsed.has(ref)) continue;
+						try {
+							await clearKey(ref);
+						} catch (caught) {
+							cleanupError = caught instanceof Error ? caught.message : String(caught);
+						}
+					}
+					setPendingCleanup([]);
 					window.dispatchEvent(new CustomEvent(CONFIG_CHANGED_EVENT));
 					setNotice(t("saved"));
 					setState(null);
 					setDraft(null);
 					await load();
+					if (cleanupError !== null) setError(`${t("accountCleanupFailed")} ${cleanupError}`);
 				} catch (caught) {
 					setError(caught instanceof Error ? caught.message : t("saveFailed"));
 				} finally {
@@ -2592,7 +2618,11 @@ window.__ModuleLoader__.load({
 												known === void 0 || known.mark === "" ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 													className: "oc-badge oc-badge-bad",
 													children: accountMark(known, t)
-												})
+												}),
+												known?.managed === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "oc-badge",
+													children: t("managedKey")
+												}) : null
 											]
 										}),
 										known?.usage?.report === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -2661,6 +2691,10 @@ window.__ModuleLoader__.load({
 													type: "button",
 													className: "oc-button oc-button-danger",
 													onClick: () => {
+														const ref = account.apiKeyEnv.trim();
+														const managed = known?.managed === true && ref !== "";
+														if (managed && !window.confirm(t("removeAccountConfirm").replace("{ref}", ref))) return;
+														if (managed) setPendingCleanup((current) => current.includes(ref) ? current : [...current, ref]);
 														setKeyDrafts({});
 														update({ accounts: draft.accounts.filter((_, i) => i !== index) });
 													},
@@ -2796,6 +2830,18 @@ window.__ModuleLoader__.load({
 								className: "oc-hint",
 								children: t("routingHint")
 							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								className: "oc-row",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									type: "checkbox",
+									checked: draft.autoSwitch,
+									onChange: (event) => update({ autoSwitch: event.target.checked })
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("autoSwitch") })]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "oc-hint",
+								children: t("autoSwitchHint")
+							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 								className: "oc-row",
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {

package/lib/index.d.ts

@@ -60,6 +60,8 @@ interface Config {
   modelAccountRules?: ModelAccountRule[];
   /** Free model used once when the Go quota rejects a request; empty disables it. */
   quotaFallbackModel?: string;
+  /** Try the next account after a pre-stream quota/credential failure. */
+  autoSwitch?: boolean;
   /** Prefer the last successful account for a conversation. */
   stickySession?: boolean;
   /** Pinned account id; empty means automatic. */
@@ -92,6 +94,7 @@ interface ResolvedConfig {
   accounts: readonly AccountConfig[];
   modelAccountRules: readonly ModelAccountRule[];
   quotaFallbackModel: string;
+  autoSwitch: boolean;
   stickySession: boolean;
   activeAccount: string;
   showSidebarQuota: boolean;
@@ -373,6 +376,8 @@ interface RouteDeps {
   readonly analytics?: (days: number) => Promise<AnalyticsReport>;
   readonly heatmap?: (days: number) => Promise<RequestHeatmap>;
   readonly refreshTui?: () => void;
+  /** Test seam; defaults to the local managed-credentials registry. */
+  readonly managedPath?: string;
 }
 /** Register the Host HTTP surface consumed by the browser settings page. */
 declare function applyRoutes(ctx: Context, web: WebServer, deps: RouteDeps): void;

package/lib/index.js

@@ -81,7 +81,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.23";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.24";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 32768;
@@ -123,6 +123,7 @@ const Config = z.object({
 		account: z.string()
 	})).default([])),
 	quotaFallbackModel: markVolatile(z.string().default("")),
+	autoSwitch: markVolatile(z.boolean().default(true)),
 	stickySession: markVolatile(z.boolean().default(true)),
 	activeAccount: markVolatile(z.string().default("")),
 	showSidebarQuota: markVolatile(z.boolean().default(false)),
@@ -218,6 +219,7 @@ function resolveConfig(config) {
 		accounts: Array.isArray(config.accounts) ? config.accounts : [],
 		modelAccountRules: modelAccountRuleList(config.modelAccountRules),
 		quotaFallbackModel: typeof config.quotaFallbackModel === "string" ? config.quotaFallbackModel.trim() : "",
+		autoSwitch: config.autoSwitch !== false,
 		stickySession: config.stickySession !== false,
 		activeAccount: typeof config.activeAccount === "string" ? config.activeAccount : "",
 		showSidebarQuota: config.showSidebarQuota === true,
@@ -3327,8 +3329,9 @@ var OpenCodeAdapter = class extends LlmAdapter {
 		}
 		const eligible = fallback ? keys : keys.filter((entry) => !this.coolingDown(entry.key) && !this.modelCoolingDown(entry.key, options.model));
 		const ordered = eligible.length > 0 ? eligible : keys;
+		const candidates = config.autoSwitch ? ordered : ordered.slice(0, 1);
 		const forced = !fallback && eligible.length === 0;
-		const initial = ordered[0];
+		const initial = candidates[0];
 		const url = endpointFor(options.provider, model.transport, options.model, config);
 		let images;
 		if (hasImages(options)) {
@@ -3352,7 +3355,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 		let lastError;
 		let lastAccount = initial?.label ?? "default";
 		let loggedAny = false;
-		for (const [index, entry] of ordered.entries()) {
+		for (const [index, entry] of candidates.entries()) {
 			if (!fallback && !forced && (this.coolingDown(entry.key) || this.modelCoolingDown(entry.key, options.model))) continue;
 			lastAccount = entry.label ?? "default";
 			const attemptReason = index === 0 ? reason : "rotation";
@@ -3380,7 +3383,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 					const error = classifyResponseError(response.status, text, response.headers);
 					lastError = error;
 					logAttempt(false, error.code);
-					const canRotate = index < ordered.length - 1;
+					const canRotate = index < candidates.length - 1;
 					if (error.code === "INVALID_CREDENTIAL" || error.code === "RATE_LIMIT" || error.code === "QUOTA") {
 						if (!fallback) this.markRejection(entry.key, options.model, response.status, response.headers, error.code);
 						responseFailure = true;
@@ -3425,8 +3428,8 @@ var OpenCodeAdapter = class extends LlmAdapter {
 				lastError = classified;
 				const transient = this.isTransient(classified);
 				if (transient && !responseFailure && !fallback) this.markRejection(entry.key, options.model, 0, void 0, classified.code);
-				if (!(index < ordered.length - 1 && transient)) {
-					if (!fallback && config.quotaFallbackModel !== "" && isGoProvider(options.provider) && classified.code === "QUOTA") break;
+				if (!(index < candidates.length - 1 && transient)) {
+					if (!fallback && config.autoSwitch && config.quotaFallbackModel !== "" && isGoProvider(options.provider) && classified.code === "QUOTA") break;
 					throw classified;
 				}
 			}
@@ -3448,7 +3451,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 			ok: false,
 			error: finalError.code
 		});
-		if (!fallback && config.quotaFallbackModel !== "" && isGoProvider(options.provider) && (lastError === void 0 || lastError.code === "QUOTA")) try {
+		if (!fallback && config.autoSwitch && config.quotaFallbackModel !== "" && isGoProvider(options.provider) && (lastError === void 0 || lastError.code === "QUOTA")) try {
 			yield* this.run({
 				...options,
 				provider: CONSOLE_PROVIDER,
@@ -4661,6 +4664,44 @@ async function readModelAnalytics(days = 30) {
 	});
 	return report;
 }
+// src/managed-credentials.ts
+const REF_LIMIT = 128;
+function managedCredentialsPath() {
+	const home = process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+	return join(home, "storages", "dsh-opencode", "managed-credentials.json");
+}
+function validRef(value) {
+	return typeof value === "string" && value !== "" && value.length <= REF_LIMIT;
+}
+async function readRefs(path) {
+	try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		if (!Array.isArray(parsed.refs)) return /* @__PURE__ */ new Set();
+		return new Set(parsed.refs.filter(validRef));
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
+async function writeRefs(path, refs) {
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, JSON.stringify({ refs: [...refs].sort() }), "utf8");
+}
+async function readManagedCredentialRefs(path = managedCredentialsPath()) {
+	return readRefs(path);
+}
+async function mutate(path, ref, add) {
+	if (!validRef(ref)) return;
+	const refs = await readRefs(path);
+	if (add) refs.add(ref);
+	else refs.delete(ref);
+	await writeRefs(path, refs);
+}
+async function addManagedCredentialRef(ref, path = managedCredentialsPath()) {
+	await mutate(path, ref, true);
+}
+async function removeManagedCredentialRef(ref, path = managedCredentialsPath()) {
+	await mutate(path, ref, false);
+}
 // src/routes-public.ts
 function publicConfig(config) {
 	return {
@@ -4690,6 +4731,7 @@ function publicConfig(config) {
 			account: rule.account
 		})),
 		quotaFallbackModel: config.quotaFallbackModel,
+		autoSwitch: config.autoSwitch,
 		stickySession: config.stickySession,
 		activeAccount: config.activeAccount,
 		showSidebarQuota: config.showSidebarQuota,
@@ -4878,6 +4920,7 @@ function configOps(patch) {
 	if ("accounts" in patch) set("accounts", cleanAccounts(patch.accounts));
 	if ("modelAccountRules" in patch) set("modelAccountRules", cleanModelAccountRules(patch.modelAccountRules));
 	if ("quotaFallbackModel" in patch) set("quotaFallbackModel", patch.quotaFallbackModel);
+	if ("autoSwitch" in patch) set("autoSwitch", patch.autoSwitch === true);
 	if ("stickySession" in patch) set("stickySession", patch.stickySession === true);
 	if ("activeAccount" in patch) set("activeAccount", patch.activeAccount);
 	if ("showSidebarQuota" in patch) set("showSidebarQuota", patch.showSidebarQuota === true);
@@ -4911,6 +4954,7 @@ async function buildState(ctx, deps) {
 	}));
 	const usageByLabel = /* @__PURE__ */ new Map();
 	for (const entry of resolved) usageByLabel.set(entry.label ?? "default", usageByKey.get(entry.key) ?? null);
+	const managedRefs = await readManagedCredentialRefs(deps.managedPath);
 	const slots = [{
 		label: "default",
 		ref: config.apiKeyEnv,
@@ -4951,7 +4995,8 @@ async function buildState(ctx, deps) {
 			coolingUntil: health?.coolingUntil ?? 0,
 			mark: health?.reason ?? "",
 			keyStatus,
-			usage
+			usage,
+			managed: slot.ref !== "" && managedRefs.has(slot.ref)
 		});
 	}
 	let models = [];
@@ -5125,6 +5170,7 @@ function applyRoutes(ctx, web, deps) {
 				return;
 			}
 			await credentials.set(credentialRef(refName), key);
+			await addManagedCredentialRef(refName, deps.managedPath);
 			json(res, 200, {
 				ok: true,
 				ref: refName
@@ -5144,6 +5190,7 @@ function applyRoutes(ctx, web, deps) {
 			const body = await readJson(req);
 			const refName = typeof body.ref === "string" && body.ref.trim() !== "" ? body.ref.trim() : deps.config().apiKeyEnv;
 			await credentials.unset(credentialRef(refName));
+			await removeManagedCredentialRef(refName, deps.managedPath);
 			json(res, 200, {
 				ok: true,
 				ref: refName
@@ -5169,6 +5216,7 @@ function applyRoutes(ctx, web, deps) {
 				return;
 			}
 			await credentials.set(credentialRef(ref), key);
+			await addManagedCredentialRef(ref, deps.managedPath);
 			json(res, 200, {
 				ok: true,
 				entry,
@@ -5404,6 +5452,18 @@ function buildOpenCodeTuiSection(deps) {
 				format: () => deps.quotaFallbackModel(),
 				parse: setOrClear
 			},
+			{
+				path: ["autoSwitch"],
+				group: "advanced",
+				kind: "boolean",
+				label: "Automatic account failover",
+				hint: "Try the next account before output on quota or credential failure.",
+				format: (value) => String(value === void 0 ? deps.autoSwitch() : value !== false),
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
 			{
 				path: ["stickySession"],
 				group: "advanced",
@@ -5711,6 +5771,7 @@ function apply(ctx, config) {
 			activeAccount: () => current().activeAccount,
 			filterModelsByPlan: () => current().filterModelsByPlan,
 			quotaFallbackModel: () => current().quotaFallbackModel,
+			autoSwitch: () => current().autoSwitch,
 			stickySession: () => current().stickySession,
 			showSidebarQuota: () => current().showSidebarQuota
 		});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-opencode-provider",
-  "version": "0.5.23",
+  "version": "0.5.24",
   "description": "OpenCode / OpenCode Go LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",