@hystudio/dsh-quota-pill 0.2.2 → 0.2.4

package/AGENTS.md

@@ -33,6 +33,7 @@ There are **two credential families**, and this matters for every step:
 | DSH Platform sign-in | `deepseek` | **nothing** — works if they are signed in to DeepSeek Platform in DSH |
 | API key | `kimi`, `opencode`, `commandcode` | a key pasted into `~/.dsh/.credentials.yaml` |
 | OAuth via CLIProxyAPI | `xai`, `codex`, `agy` | **CLIProxyAPI installed and logged in once** |
+| Console session cookie | `opendesign` | the `__Secure-better-auth.session_token` cookie from the Open Design cloud dashboard |
 
 **Check DeepSeek first.** It is the official account and needs no setup beyond a
 DSH Platform sign-in, so it is usually the one the user actually wants. If it

package/README.md

@@ -22,6 +22,7 @@ into the live number.
 | **xAI (Grok)** | OAuth token from [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) |
 | **Codex (ChatGPT Plus)** | same — and CLIProxyAPI must be **running** |
 | **Antigravity** | same |
+| **Open Design** (optional) | `refs.OPENDESIGN_SESSION_COOKIE` — the cloud console's session cookie |
 
 **DeepSeek works with no setup at all** if you are signed in to DeepSeek Platform
 in DSH — that is the official account, and it is the one most users care about.
@@ -30,8 +31,10 @@ The three API-key providers need nothing but the key. The three OAuth providers
 need CLIProxyAPI installed and logged in, because that is what holds the tokens;
 this plugin only reads them and never runs an OAuth flow itself.
 
-Every provider is optional. Unconfigured ones say exactly what is missing instead
-of showing a fake zero.
+Every provider is optional, and **only the ones you actually have are listed**:
+the pill reads DSH's `session/modelCatalog` to learn which providers the app can
+route to, so removing a provider from DSH removes it from the pill too. A provider
+that is present but has no credential is skipped rather than shown as an empty row.
 
 ## Install
 
@@ -190,6 +193,14 @@ would flicker between models you do not even have configured.
 `monthlyCap = weekly.cap × 2`, an identity verified against two different plans
 (31.6 + 38.4 = 70 with `weekly.cap` 35; 0.225 + 9.775 = 10 with `weekly.cap` 6).
 
+**Open Design** keeps its allowance in the cloud console, not in the API key you
+use for inference. The `amr-link.open-design.ai/v1` gateway has no balance
+endpoint at all; the console's own `amr-api` does, and it authenticates with a
+`__Secure-better-auth.session_token` cookie. That cookie is HttpOnly, so grab it
+from devtools → Application → Cookies. The workspace id is discovered
+automatically. The request goes through system curl because Cloudflare rejects
+Node's TLS fingerprint on that host with `error code: 1010`.
+
 **DeepSeek** is a prepaid CNY wallet, so there is no percentage to show — the pill
 shows the balance and, separately, any bonus credit. Two traps worth recording:
 the stored credential is a *Platform login grant*, not an `api.deepseek.com` API

package/client.js

@@ -1,5 +1,5 @@
 window.__ModuleLoader__.load({
-  id: '@local/quota-pill',
+  id: '@hystudio/dsh-quota-pill',
   factory(require) {
     const React = require('react');
     const ReactDOM = require('react-dom');
@@ -1365,10 +1365,10 @@ window.__ModuleLoader__.load({
       inject: ['slots'],
       apply(ctx) {
         ctx.inject(['slots', 'modelDirectories'], (scope) => {
-          const styleId = '@local/quota-pill/order';
+          const styleId = '@hystudio/dsh-quota-pill/order';
           if (!document.querySelector(`style[data-plugin-css="${styleId}"]`)) {
             const tag = document.createElement('style');
-            tag.dataset.plugin = '@local/quota-pill';
+            tag.dataset.plugin = '@hystudio/dsh-quota-pill';
             tag.dataset.pluginCss = styleId;
             // Context meter is the last sibling; push the quota ring immediately after it.
             tag.textContent = [

package/index.js

@@ -1,8 +1,19 @@
 /**
  * Host half of the quota-pill bundle.
  *
- * Rendering lives in client.js (loaded into the DSH web GUI). This half is
- * intentionally empty: the plugin only paints a pill, it does not register any
- * host-side service or RPC.
+ * Rendering lives in client.js, which the web GUI loads separately. This half
+ * registers nothing: the plugin only paints a pill, exposes no host service and
+ * no RPC.
+ *
+ * It still has to be a well-formed Cordis plugin, which means exporting `name`.
+ * Omitting it makes the loader reject the bundle at import time with
+ * "@hystudio/dsh-quota-pill: import failed" — and because the failure happens
+ * before activation, nothing in the UI says why. That is how 0.2.2 shipped.
  */
+export const name = 'quota-pill';
+
+/** No host-side services are required. */
+export const inject = [];
+
+/** Nothing to set up on the host; the client half does all the work. */
 export function apply() {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hystudio/dsh-quota-pill",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "private": false,
   "type": "module",
   "description": "Quota pill for DeepSeek Harness: remaining quota for every LLM subscription you have, in one collapsible pill",

package/src/adapters-deepseek.js

@@ -19,109 +19,8 @@
  *   value = "v1." + base64url(JSON payload) + "." + base64url(HMAC-SHA256(secret, body))
  *   payload = { version: 1, authority, issuedAt, expiresAt }   ← milliseconds
  */
-import crypto from 'node:crypto';
-import { execFileSync } from 'node:child_process';
-import { URL } from 'node:url';
-import { deepseekGrant, browserSessionSecret } from './credentials.js';
-
-const RPC_PORT_GUESSES = [8319, 8080, 3000];
-const DSH_BASE_ENV = process.env.DSH_RPC_BASE || process.env.QUOTA_PILL_DSH_BASE || null;
-
-const b64u = (buf) => Buffer.from(buf).toString('base64url');
-
-/** Find the DSH web server port. macOS/Linux: ask lsof; otherwise try env then guesses. */
-function findDshBase() {
-  if (DSH_BASE_ENV) return DSH_BASE_ENV.replace(/\/$/, '');
-  if (process.env.QUOTA_PILL_DSH_PORT) {
-    return `http://127.0.0.1:${process.env.QUOTA_PILL_DSH_PORT}`;
-  }
-  try {
-    const out = execFileSync('lsof', ['-nP', '-iTCP', '-sTCP:LISTEN'], {
-      encoding: 'utf8',
-      timeout: 4000,
-    });
-    for (const line of out.split('\n')) {
-      // The DSH process shows up under its app name; match on the command column.
-      if (!/DeepSeek|dsh/i.test(line)) continue;
-      const m = /127\.0\.0\.1:(\d+)/.exec(line);
-      if (m) return `http://127.0.0.1:${m[1]}`;
-    }
-  } catch {
-    /* lsof missing or blocked — fall through */
-  }
-  return null;
-}
-
-/** Build the signed session cookie DSH expects. */
-function signCookie(base, secretB64) {
-  const authority = new URL(base).host;
-  let raw;
-  try {
-    raw = Buffer.from(secretB64, 'base64url');
-  } catch {
-    raw = Buffer.from(secretB64, 'utf8');
-  }
-  const name = 'dsh-auth-' + b64u(crypto.createHash('sha256').update(authority).digest());
-  const now = Date.now();
-  const payload = {
-    version: 1,
-    authority,
-    issuedAt: now,
-    expiresAt: now + 3600 * 1000,
-  };
-  const body = b64u(JSON.stringify(payload));
-  const sig = b64u(crypto.createHmac('sha256', raw).update(body).digest());
-  return { name, value: `v1.${body}.${sig}` };
-}
-
-/** POST one RPC to DSH and return its result payload. */
-async function dshRpc(method, args, base) {
-  const secret = browserSessionSecret();
-  if (!secret) return { ok: false, error: 'no browser-session secret in credentials' };
-
-  const { name, value } = signCookie(base, secret);
-  const body = JSON.stringify({
-    type: 'client-request',
-    rpcId: 'quota-pill-' + method,
-    method,
-    payload: { args },
-  });
-
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 15000);
-  try {
-    const res = await fetch(base + '/api/' + method.replace(/\./g, '/'), {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-        Cookie: `${name}=${value}`,
-      },
-      body,
-      signal: controller.signal,
-    });
-    const text = await res.text();
-    if (!res.ok) {
-      return { ok: false, status: res.status, error: `dsh rpc http ${res.status}: ${text.slice(0, 120)}` };
-    }
-    let env;
-    try {
-      env = JSON.parse(text);
-    } catch {
-      return { ok: false, error: 'dsh rpc returned unparsable json' };
-    }
-    const result = (env && env.result) || {};
-    if (result.ok === false) {
-      const e = result.error || {};
-      return { ok: false, error: `${e.code || 'rpc-failed'}: ${e.message || ''}`.trim() };
-    }
-    return { ok: true, value: result.value };
-  } catch (e) {
-    return { ok: false, error: String((e && e.message) || e) };
-  } finally {
-    clearTimeout(timer);
-  }
-}
+import { deepseekGrant } from './credentials.js';
+import { dshRpc } from './dsh.js';
 
 /**
  * Official DeepSeek balance.
@@ -142,21 +41,11 @@ export async function deepseek() {
     };
   }
 
-  const base = findDshBase();
-  if (!base) {
-    return {
-      kind: 'none',
-      provider: 'deepseek',
-      error: 'cannot locate the DSH web server (needed to read Platform balance)',
-      setup: { kind: 'dsh-account', hint: 'Set QUOTA_PILL_DSH_PORT or DSH_RPC_BASE.' },
-    };
-  }
-
   // The client metadata identifies the calling UI. `version` is a string here,
   // not a number — the strict wire codec rejects a numeric version.
   const res = await dshRpc('account/getBalance', {
     client: { version: '1', locale: 'zh-CN', timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60 },
-  }, base);
+  });
 
   if (!res.ok) {
     return {

package/src/adapters-opendesign.js

@@ -0,0 +1,141 @@
+/**
+ * Open Design (open-design.ai) — Cloud coding-plan allowance.
+ *
+ * Optional provider. Unlike the others it does **not** read an API key: the
+ * allowance lives in the cloud console's own API and is authenticated with the
+ * console's session cookie. Set it once:
+ *
+ *   ~/.dsh/.credentials.yaml
+ *     refs:
+ *       OPENDESIGN_SESSION_COOKIE: <__Secure-better-auth.session_token value>
+ *
+ * To get that value: open https://open-design.ai/cloud/dashboard while signed in,
+ * then in the browser's devtools read the `__Secure-better-auth.session_token`
+ * cookie (it is HttpOnly, so `document.cookie` will not show it).
+ *
+ * Two traps, both verified:
+ *   · The inference gateway at amr-link.open-design.ai/v1 has NO balance
+ *     endpoint — it is a chat proxy only. Probing it for quota always 404s.
+ *   · amr-api sits behind Cloudflare, which rejects Node's TLS fingerprint with
+ *     `error code: 1010`. The request therefore goes through system curl.
+ *     That is the same request over a different TLS stack, not an auth bypass.
+ */
+import { readRef } from './credentials.js';
+import { getJsonViaCurl } from './http.js';
+
+const API = process.env.OPENDESIGN_API_BASE || 'https://amr-api.open-design.ai/api/v1';
+
+const round2 = (n) => Math.round(n * 100) / 100;
+
+function headers(cookie) {
+  return {
+    Cookie: '__Secure-better-auth.session_token=' + cookie,
+    Origin: 'https://open-design.ai',
+    Referer: 'https://open-design.ai/',
+  };
+}
+
+/** Window label from its length: 18000s is the 5h cap, 604800s the weekly one. */
+function windowKey(seconds) {
+  const s = Number(seconds) || 0;
+  if (s > 0 && s <= 6 * 3600) return '5h';
+  if (s > 0 && s <= 8 * 86400) return 'weekly';
+  if (s > 0) return 'monthly';
+  return 'credits-all';
+}
+
+/**
+ * The workspace id is discoverable, so the user only supplies a cookie.
+ * `/workspaces/current` already resolves to the default workspace.
+ */
+async function currentWorkspace(cookie) {
+  const res = await getJsonViaCurl(`${API}/workspaces/current`, { headers: headers(cookie) });
+  if (!res.ok) return { error: res.error };
+  const id = res.data && res.data.workspaceId;
+  return id ? { id } : { error: 'no workspaceId in response' };
+}
+
+export async function opendesign() {
+  const cookie = readRef('OPENDESIGN_SESSION_COOKIE');
+  if (!cookie) {
+    return {
+      kind: 'none',
+      provider: 'opendesign',
+      error: 'no OPENDESIGN_SESSION_COOKIE in ~/.dsh/.credentials.yaml',
+      setup: {
+        kind: 'session-cookie',
+        ref: 'OPENDESIGN_SESSION_COOKIE',
+        hint: 'Copy the __Secure-better-auth.session_token cookie from the Open Design cloud dashboard.',
+      },
+    };
+  }
+
+  const ws = await currentWorkspace(cookie);
+  if (ws.error) {
+    return {
+      kind: 'probe-failed',
+      provider: 'opendesign',
+      error: `workspace lookup failed: ${ws.error}`,
+      hint: 'The console session cookie has probably expired — copy a fresh one.',
+    };
+  }
+
+  const res = await getJsonViaCurl(
+    `${API}/workspaces/${ws.id}/billing/coding-plan-usage`,
+    { headers: headers(cookie), timeoutMs: 25000 },
+  );
+  if (!res.ok) {
+    return {
+      kind: 'probe-failed',
+      provider: 'opendesign',
+      error: `coding-plan-usage failed: ${res.error}`,
+      hint: res.error && res.error.includes('40')
+        ? 'The console session cookie has probably expired — copy a fresh one.'
+        : undefined,
+    };
+  }
+
+  const body = res.data || {};
+  const windows = [];
+  for (const w of body.windows || []) {
+    const limit = Number(w.limitCredits);
+    const remain = Number(w.remainingCredits);
+    if (!Number.isFinite(limit) || limit <= 0 || !Number.isFinite(remain)) continue;
+    windows.push({
+      key: windowKey(w.durationSeconds),
+      remainPct: round2((remain / limit) * 100),
+      resetAt: w.resetsAt || null,
+      credits: { remain: round2(remain), total: round2(limit), unit: 'credits' },
+    });
+  }
+
+  if (!windows.length) {
+    return {
+      kind: 'none',
+      provider: 'opendesign',
+      error: `coding-plan-usage returned no windows (tier ${body.tier || 'unknown'})`,
+    };
+  }
+
+  // The tightest window is what blocks the next request, but the list itself
+  // stays in canonical order (5h before weekly) so rows match every other
+  // provider instead of reshuffling as the numbers move.
+  const tight = windows.reduce((a, b) => (a.remainPct <= b.remainPct ? a : b));
+  const ORDER = { '5h': 0, weekly: 1, monthly: 2, 'credits-all': 3 };
+  windows.sort((a, b) => (ORDER[a.key] ?? 9) - (ORDER[b.key] ?? 9));
+  const products = {};
+  for (const w of windows) products[w.key] = round2(100 - w.remainPct);
+
+  return {
+    kind: 'subscription-quota',
+    provider: 'opendesign',
+    account: body.tier || null,
+    remainingPct: tight.remainPct,
+    usedPct: round2(100 - tight.remainPct),
+    window: tight.key,
+    resetAt: tight.resetAt,
+    products,
+    windows,
+    raw: { source: 'coding-plan-usage (console session)', tier: body.tier },
+  };
+}

package/src/catalog.js

@@ -0,0 +1,35 @@
+/**
+ * Which providers this user actually has.
+ *
+ * A hardcoded adapter list is wrong in both directions: it lists providers that
+ * were removed or never configured, and it cannot know about new ones. DSH's own
+ * `session/modelCatalog` is the authoritative answer — it is literally the set of
+ * providers the app can route to right now.
+ *
+ * If the catalog is unavailable (DSH not running), callers fall back to showing
+ * whatever the adapters can read, so the pill degrades rather than going blank.
+ */
+import { dshRpc } from './dsh.js';
+
+const TTL_MS = 120 * 1000;
+let cache = { at: 0, ids: null };
+
+/** Provider ids DSH currently exposes, or null when unknown. */
+export async function catalogProviderIds() {
+  if (cache.ids && Date.now() - cache.at < TTL_MS) return cache.ids;
+
+  const res = await dshRpc('session/modelCatalog', {});
+  if (!res.ok) return cache.ids; // keep the last good answer, if any
+
+  const groups = (res.value && res.value.groups) || [];
+  const ids = groups.map((g) => g && g.id).filter(Boolean);
+  if (!ids.length) return cache.ids;
+
+  cache = { at: Date.now(), ids };
+  return ids;
+}
+
+/** Drop the cached catalog (tests, or after installing a provider). */
+export function forgetCatalog() {
+  cache = { at: 0, ids: null };
+}

package/src/dsh.js

@@ -0,0 +1,138 @@
+/**
+ * Talking to the running DSH instance.
+ *
+ * Two things need it:
+ *   · the DeepSeek balance, which only DSH can read (it holds the Platform grant)
+ *   · the provider catalog, which says which providers this user actually has
+ *
+ * Both go through DSH's own RPC, authenticated with a signed session cookie:
+ *   name  = "dsh-auth-" + base64url(sha256(authority))
+ *   value = "v1." + base64url({version, authority, issuedAt, expiresAt}) + "." + sig
+ * `issuedAt` / `expiresAt` are milliseconds and `version` must be the number 1 —
+ * the wire codec rejects anything else, and a bad payload fails as 401 even
+ * though the signature itself verifies.
+ */
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { URL } from 'node:url';
+import { browserSessionSecret } from './credentials.js';
+
+const b64u = (buf) => Buffer.from(buf).toString('base64url');
+
+/**
+ * Every loopback port a DSH-named process is listening on.
+ *
+ * A single guess is not enough: DSH's helper processes also open debugging
+ * ports, and picking one of those makes every RPC fail with 404.
+ */
+function candidatePorts() {
+  const out = [];
+  const explicit = process.env.DSH_RPC_BASE || process.env.QUOTA_PILL_DSH_BASE;
+  if (explicit) out.push(explicit.replace(/\/$/, ''));
+  if (process.env.QUOTA_PILL_DSH_PORT) out.push(`http://127.0.0.1:${process.env.QUOTA_PILL_DSH_PORT}`);
+  try {
+    const text = execFileSync('lsof', ['-nP', '-iTCP', '-sTCP:LISTEN'], {
+      encoding: 'utf8',
+      timeout: 4000,
+    });
+    for (const line of text.split('\n')) {
+      if (!/DeepSeek|dsh/i.test(line)) continue;
+      const m = /127\.0\.0\.1:(\d+)/.exec(line);
+      if (!m) continue;
+      const base = `http://127.0.0.1:${m[1]}`;
+      if (!out.includes(base)) out.push(base);
+    }
+  } catch {
+    /* lsof unavailable — env vars are the only path */
+  }
+  return out;
+}
+
+function signCookie(base, secretB64) {
+  const authority = new URL(base).host;
+  let raw;
+  try {
+    raw = Buffer.from(secretB64, 'base64url');
+  } catch {
+    raw = Buffer.from(secretB64, 'utf8');
+  }
+  const name = 'dsh-auth-' + b64u(crypto.createHash('sha256').update(authority).digest());
+  const now = Date.now();
+  const payload = { version: 1, authority, issuedAt: now, expiresAt: now + 3600 * 1000 };
+  const body = b64u(JSON.stringify(payload));
+  const sig = b64u(crypto.createHmac('sha256', raw).update(body).digest());
+  return `${name}=v1.${body}.${sig}`;
+}
+
+/** POST one RPC to a specific base. */
+async function rpcAt(base, method, args, cookie, timeoutMs = 12000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(base + '/api/' + method.replace(/\./g, '/'), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json', Cookie: cookie },
+      body: JSON.stringify({
+        type: 'client-request',
+        rpcId: 'quota-pill-' + method,
+        method,
+        payload: { args },
+      }),
+      signal: controller.signal,
+    });
+    const text = await res.text();
+    if (!res.ok) return { ok: false, status: res.status, error: `http ${res.status}` };
+    let env;
+    try {
+      env = JSON.parse(text);
+    } catch {
+      return { ok: false, error: 'unparsable json' };
+    }
+    const result = (env && env.result) || {};
+    if (result.ok === false) {
+      const e = result.error || {};
+      return { ok: false, error: `${e.code || 'rpc-failed'}: ${e.message || ''}`.trim() };
+    }
+    return { ok: true, value: result.value };
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Call one RPC against whichever candidate port actually answers.
+ *
+ * Ports are probed with a cheap, always-present RPC rather than trusted by
+ * order, and the winner is remembered so we do not re-probe every call.
+ */
+let knownBase = null;
+
+export async function dshRpc(method, args) {
+  const secret = browserSessionSecret();
+  if (!secret) return { ok: false, error: 'no browser-session secret in credentials' };
+
+  const bases = [];
+  if (knownBase) bases.push(knownBase);
+  for (const b of candidatePorts()) if (!bases.includes(b)) bases.push(b);
+
+  let lastError = 'no DSH port responded';
+  for (const base of bases) {
+    const cookie = signCookie(base, secret);
+    const res = await rpcAt(base, method, args, cookie);
+    // A 404 means this port is a different HTTP surface (a helper's debug port):
+    // remember only ports that actually serve the RPC routes.
+    if (res.ok || (res.status && res.status !== 404)) {
+      knownBase = base;
+      return res;
+    }
+    lastError = res.error || lastError;
+  }
+  return { ok: false, error: lastError };
+}
+
+/** Reset the remembered port (tests, or after DSH restarts on a new port). */
+export function forgetDshBase() {
+  knownBase = null;
+}

package/src/server.js

@@ -24,6 +24,8 @@ import { kimi, opencode, commandcode } from './adapters-apikey.js';
 import { xai, codex, agy } from './adapters-cliproxy.js';
 import { deepseek } from './adapters-deepseek.js';
 import { credentialSource, hasCliProxy, CLI_PROXY_DIR, CREDENTIALS_FILE } from './credentials.js';
+import { catalogProviderIds } from './catalog.js';
+import { opendesign } from './adapters-opendesign.js';
 
 const PORT = Number(process.env.QUOTA_PILL_PORT || 8319);
 const HOST = process.env.QUOTA_PILL_HOST || '127.0.0.1';
@@ -31,7 +33,7 @@ const CACHE_TTL_MS = Number(process.env.QUOTA_PILL_CACHE_TTL || 60) * 1000;
 
 // Order matters: the pill lists providers in this order, and the official
 // DeepSeek account is the one most people look for first.
-const ADAPTERS = { deepseek, kimi, opencode, commandcode, xai, codex, agy };
+const ADAPTERS = { deepseek, kimi, opencode, commandcode, xai, codex, agy, opendesign };
 
 /** Display names. Deliberately small: the table stays in sync with ADAPTERS. */
 const DISPLAY_NAMES = {
@@ -42,6 +44,7 @@ const DISPLAY_NAMES = {
   xai: 'xAI (Grok)',
   codex: 'Codex (ChatGPT Plus)',
   agy: 'Antigravity',
+  opendesign: 'Open Design',
 };
 
 /** Which DSH model prefixes map to which adapter. */
@@ -57,6 +60,7 @@ const PREFIX_ALIASES = {
   antigravity: 'agy',
   agy: 'agy',
   deepseek: 'deepseek',
+  opendesign: 'opendesign',
 };
 
 /** provider|model → { at, payload }. Keyed by model because readings differ per model. */
@@ -101,11 +105,51 @@ async function readOne(provider, model, { fresh = false } = {}) {
   return { ...payload, cached: false, at: now };
 }
 
+/**
+ * Which DSH catalog ids count as "this adapter".
+ *
+ * DSH names providers after the upstream (`antigravity`, `deepseek-account`,
+ * `opencode-go`); the adapters use the short keys the pill has always used.
+ */
+const CATALOG_ALIASES = {
+  agy: ['antigravity', 'agy'],
+  deepseek: ['deepseek-account', 'deepseek'],
+  opencode: ['opencode-go', 'opencode'],
+  kimi: ['kimi-coding', 'kimi'],
+  xai: ['xai'],
+  codex: ['codex'],
+  commandcode: ['commandcode'],
+  opendesign: ['opendesign'],
+};
+
+function inCatalog(provider, ids) {
+  if (!ids) return true; // catalog unknown: do not hide anything
+  const names = CATALOG_ALIASES[provider] || [provider];
+  return names.some((n) => ids.includes(n));
+}
+
+/**
+ * Every provider worth showing: present in DSH's catalog AND actually readable.
+ *
+ * Two filters, for two different complaints:
+ *   · catalog — a provider removed from DSH must disappear from the pill, even
+ *     though its adapter still exists in this package
+ *   · kind 'none' — a provider with no credential has nothing to show; listing
+ *     it as "no data source" is noise, and new users mistake it for breakage
+ *
+ * `probe-failed` deliberately still shows: the provider *is* configured, so a
+ * failure is information the user needs.
+ */
 async function readAll({ fresh = false } = {}) {
+  const ids = await catalogProviderIds();
+  const wanted = Object.keys(ADAPTERS).filter((p) => inCatalog(p, ids));
+
   const entries = await Promise.all(
-    Object.keys(ADAPTERS).map(async (p) => [p, await readOne(p, null, { fresh })]),
+    wanted.map(async (p) => [p, await readOne(p, null, { fresh })]),
+  );
+  return Object.fromEntries(
+    entries.filter(([, v]) => v && v.kind !== 'none'),
   );
-  return Object.fromEntries(entries);
 }
 
 /** What is configured and what is missing — powers the agent-driven setup. */