@mars-sea/dsh-commandcode-provider 0.10.2 → 0.10.4

package/lib/index.js

@@ -220,16 +220,38 @@ var CommandCodeAccountPool = class {
 			until: 0
 		});
 	}
-	/** One account's key: literal → credential seam → auth file (default slot). */
+	/**
+	* One account's key: literal → credential seam → auth file (default slot).
+	*
+	* Every source is normalized here, at the single point where a slot's key
+	* enters the pool. The adapter sends the key through the harness's
+	* `assertUsableApiKey()`, which trims it — a stored key from the credentials
+	* seam, a `.env` line, or a shell export all pick up surrounding whitespace
+	* — and reports that trimmed form back to `markRejected()`. Returning the
+	* raw value would file every 429/401 mark under a key no later lookup can
+	* find: rotation would re-offer the same account, the account card would show
+	* no mark, and the usage endpoints would 401 while chat kept working.
+	* Normalizing once makes resolution, probing, marking, and the request path
+	* agree on one string.
+	*/
 	async resolveSlotKey(slot) {
-		if (slot.literal !== void 0 && slot.literal !== "") return slot.literal;
+		if (slot.literal !== void 0) {
+			const literal = normalizeResolvedKey(slot.literal);
+			if (literal !== void 0) return literal;
+		}
 		if (slot.ref !== void 0) {
 			const hit = await this.deps.resolveRef(slot.ref);
-			if (hit !== void 0 && hit !== "") return hit;
+			if (hit !== void 0) {
+				const resolved = normalizeResolvedKey(hit);
+				if (resolved !== void 0) return resolved;
+			}
 		}
 		if (slot.allowAuthFile) {
 			const fromFile = this.deps.authFileKey();
-			if (fromFile !== void 0 && fromFile !== "") return fromFile;
+			if (fromFile !== void 0) {
+				const fileKey = normalizeResolvedKey(fromFile);
+				if (fileKey !== void 0) return fileKey;
+			}
 		}
 	}
 	/** Hand out the chosen account's key. */
@@ -240,6 +262,16 @@ var CommandCodeAccountPool = class {
 		};
 	}
 };
+/**
+* Normalize one resolved credential to the form every consumer sees. Trim
+* only: a blank-after-trim value means "no key" (the slot is omitted and the
+* caller reports `MISSING_CREDENTIAL`), while characters an HTTP header cannot
+* carry are left for `assertUsableApiKey()` to reject with its own message.
+*/
+function normalizeResolvedKey(value) {
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
 //#endregion
 //#region src/capabilities.ts
 /**
@@ -338,6 +370,11 @@ const KNOWN_EFFORTS = {
 		"high",
 		"max"
 	],
+	"deepseek/deepseek-v4.1-flash": [
+		"low",
+		"high",
+		"max"
+	],
 	"deepseek/deepseek-v4-flash": ["high", "max"],
 	"deepseek/deepseek-v4-flash-vision-exp": ["high", "max"],
 	"deepseek/deepseek-v4-pro": ["high", "max"],
@@ -485,6 +522,11 @@ const KNOWN_EFFORTS = {
 		"high",
 		"xhigh",
 		"max"
+	],
+	"MiniMaxAI/MiniMax-M3": [
+		"low",
+		"medium",
+		"high"
 	]
 };
 /**
@@ -520,6 +562,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"claude-sonnet-4-6",
 	"claude-sonnet-5",
 	"deepseek/deepseek-v4-flash-vision-exp",
+	"deepseek/deepseek-v4.1-flash",
 	"google/gemini-3.1-flash-lite",
 	"google/gemini-3.5-flash",
 	"google/gemini-3.5-flash-lite",
@@ -554,7 +597,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"z-ai/glm-5.3-flash"
 ]);
 /**
-* Models the official CLI's model table (command-code@1.50.0) marks
+* Models the official CLI's model table (command-code@1.53.0) marks
 * `reasoning:!0` but defines no selectable `reasoning_effort` levels — they
 * think automatically, with Command Code driving the depth. This is the
 * authoritative "thinks, effort not adjustable" set: `KNOWN_EFFORTS` (which
@@ -562,7 +605,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * effort levels, and this snapshot is not surfaced in the picker's compact
 * description — it exists for programmatic consumers.
 *
-* Source: the command-code@1.50.0 bundled model table (dist/cli.mjs),
+* Source: the command-code@1.53.0 bundled model table (dist/cli.mjs),
 * cross-checked with https://commandcode.ai/docs/reference/cli/models.
 * (`stealth/ox-alpha` left this set in command-code@1.32.1, which gave it
 * selectable `['low', 'high', 'max']` efforts; the preview then ended in
@@ -575,11 +618,16 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * to `KNOWN_EFFORTS`. command-code@1.42.0 added `meituan/LongCat-2.0:free`
 * (reasoning:!0, no efforts). command-code@1.45.0 gave the Muse Spark family
 * (1.1, 1.2, 1.2-contributor, 1.3, 1.3-contributor) selectable
-* `['low', 'medium', 'high', 'xhigh']` efforts — they moved to `KNOWN_EFFORTS`.)
+* `['low', 'medium', 'high', 'xhigh']` efforts — they moved to `KNOWN_EFFORTS`.
+* command-code@1.51.3 gave `MiniMaxAI/MiniMax-M3` selectable
+* `['low', 'medium', 'high']` efforts — it moved to `KNOWN_EFFORTS` too.
+* command-code@1.52.0 added `inclusionai/ling-3.0-flash-sante:free`
+* (reasoning:!0, no efforts).)
+* command-code@1.53.0 added `deepseek/deepseek-v4.1-flash` with selectable
+* ['low', 'high', 'max'] efforts, so it lives in `KNOWN_EFFORTS`, not here.)
 * Keep in sync via the dsh-commandcode-upstream skill.
 */
 const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
-	"MiniMaxAI/MiniMax-M3",
 	"Qwen/Qwen3.6-Max-Preview",
 	"Qwen/Qwen3.6-Plus",
 	"Qwen/Qwen3.7-Flash",
@@ -594,7 +642,8 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"thinkingmachines/inkling",
 	"thinkingmachines/inkling-small",
 	"poolside/laguna-s-2.1-free",
-	"meituan/LongCat-2.0:free"
+	"meituan/LongCat-2.0:free",
+	"inclusionai/ling-3.0-flash-sante:free"
 ]);
 /**
 * The minimum subscription plan a model is included in, per the official plan
@@ -609,7 +658,9 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 * command-code@1.41.0 added `Qwen/Qwen3.8-Max-0902` (Go) and 1.42.0 added
 * `meituan/LongCat-2.0:free` (Go, free promo); command-code@1.43.0 added
 * `google/gemini-3.8-flash` (GOAT) and 1.44.0 added `meta/muse-spark-1.3`
-* (GOAT) plus its Contributor sibling (Go).
+* (GOAT) plus its Contributor sibling (Go); command-code@1.52.0 added the
+* free `inclusionai/ling-3.0-flash-sante:free` (Go); command-code@1.53.0
+* added `deepseek/deepseek-v4.1-flash` (Go).
 *
 * The Provider API exposes no plan metadata, so this snapshot is the source of
 * truth for the picker's plan annotation — it answers "which plan do I need to
@@ -633,11 +684,13 @@ const KNOWN_PLANS = {
 	"Qwen/Qwen3.8-Max": "go",
 	"Qwen/Qwen3.8-Max-0902": "go",
 	"deepseek/deepseek-v4-flash-fast": "go",
+	"deepseek/deepseek-v4.1-flash": "go",
 	"deepseek/deepseek-v4-flash": "go",
 	"deepseek/deepseek-v4-flash-vision-exp": "go",
 	"deepseek/deepseek-v4-pro": "go",
 	"gpt-5.6-luna": "go",
 	"meituan/LongCat-2.0:free": "go",
+	"inclusionai/ling-3.0-flash-sante:free": "go",
 	"meta/muse-spark-1.2-contributor": "go",
 	"meta/muse-spark-1.3-contributor": "go",
 	"moonshotai/Kimi-K2.5": "go",
@@ -734,8 +787,8 @@ function compareByPlan(a, b) {
 }
 /**
 * Subscription plan table, synced from the official CLI bundle's plan maps
-* (located by the `"individual-go"` key in command-code@1.50.0 `dist/cli.mjs`,
-* re-verified unchanged through 1.50.0): subscription `planId`
+* (located by the `"individual-go"` key in command-code@1.53.0 `dist/cli.mjs`,
+* re-verified unchanged through 1.53.0): subscription `planId`
 * prefix → display name and the plan's monthly credit total. This is the
 * account's own subscription (from `/alpha/billing/subscriptions`) — distinct
 * from {@link KNOWN_PLANS}, which maps catalog models to their minimum tier.
@@ -828,45 +881,69 @@ const KNOWN_DEALS = {
 	"meituan/LongCat-2.0:free": {
 		label: "FREE",
 		free: true
+	},
+	"inclusionai/ling-3.0-flash-sante:free": {
+		label: "FREE",
+		free: true
 	}
 };
 /**
 * Models with time-of-day (peak/off-peak) pricing, per the official pricing
 * page (`/docs/resources/pricing-limits`). Since 2026-08-16 16:00 UTC, DeepSeek
-* charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h/day,
-* full price); the other 17 hours are off-peak at half price. The V4 Flash
-* Vision (exp) variant (command-code@1.32.0) shares the V4 Flash windows and
-* peak prices ($0.44/$1.32) — each row's hover annotation states exactly 2×
-* that row's displayed off-peak prices. The picker shows the
+* charges by the hour: peak hours are 01:00–04:00 and 06:00–10:00 UTC (7h per
+* weekday, full price) **Monday to Friday only**; the other 17 hours of a
+* weekday and every hour of Saturday/Sunday (UTC) are off-peak at half price.
+* The V4 Flash Vision (exp) variant (command-code@1.32.0) shares the V4 Flash
+* windows and peak prices ($0.44/$1.32) — each row's hover annotation states
+* exactly 2× that row's displayed off-peak prices. The picker shows the
 * *current* state as a compact
 * label (`Peak`/`Half`) matching the English noun style of the other markers
 * (`Image`, `FREE`), so a developer can tell at a glance whether calling the
 * model right now is cheap or expensive.
 *
-* Extraction caution: in the page's HTML each annotation div sits inside its
-* OWN row's container, immediately before the NEXT row starts — flattening
-* the page to text makes every annotation look like it belongs to the model
-* printed after it. Verify membership against the enclosing row and the 2×
-* price relation, not the flat-text neighbor.
+* Authoritative extraction: the pricing page embeds a model JSON array whose
+* hourly-priced entries carry a `timeOfDay` block
+* (`{ windows: "01–04 & 06–10 UTC, Mon–Fri", peakHoursPerDay: 7,
+* offPeakHoursPerDay: 17, peak: {...}, offPeak: {...} }`). Exactly four models
+* carry it: V4 Pro, V4 Flash, V4 Flash Vision (exp), and V4.1 Flash (added in
+* command-code@1.53.0 at $0.15/$0.60 off-peak, $0.30/$1.20 peak — the same
+* schedule as the other three).
+*
+* Extraction caution: the rendered HTML rows are a trap. Each annotation div
+* sits inside its OWN row's container, immediately before the NEXT row starts,
+* so flattening the page to text makes every annotation look like it belongs
+* to the model printed after it — that is how `deepseek/deepseek-v4-flash-fast`
+* was wrongly added here (its row is flat-priced at $0.28/$0.56/$0.07 and has
+* no `timeOfDay` block). Trust the embedded JSON's `timeOfDay` membership and
+* the 2× price relation, never the flat-text neighbor.
 *
-* Keep in sync with the official pricing page when the model set or the peak
-* windows change (see the dsh-commandcode-upstream skill).
+* Keep in sync with the official pricing page when the model set, the peak
+* windows, or the weekday rule change (see the dsh-commandcode-upstream skill).
 */
 const KNOWN_PEAK_PRICING = /* @__PURE__ */ new Set([
 	"deepseek/deepseek-v4-pro",
 	"deepseek/deepseek-v4-flash",
 	"deepseek/deepseek-v4-flash-vision-exp",
-	"deepseek/deepseek-v4-flash-fast"
+	"deepseek/deepseek-v4.1-flash"
 ]);
-/** Peak hours (UTC, hour-of-day range end-exclusive): 01–03 and 06–09. */
+/**
+* Peak hours (UTC, hour-of-day range end-exclusive): 01–03 and 06–09.
+* Weekday-only — see `peakPricingState()`; weekends are fully off-peak.
+*/
 const PEAK_HOUR_RANGES = [[1, 4], [6, 10]];
 /**
-* Whether `now` (defaults to `Date.now()`) falls in a peak-pricing hour for
-* time-of-day-priced models. `undefined` for models outside the snapshot.
+* Whether `now` (defaults to `Date.now()`) falls in a peak-pricing window for
+* time-of-day-priced models. Peak rates apply Monday–Friday (UTC) only: the
+* official rule charges Saturday and Sunday completely off-peak for all 24
+* hours, so a weekend timestamp is off-peak even inside `PEAK_HOUR_RANGES`.
+* `undefined` for models outside the snapshot.
 */
 function peakPricingState(modelId, now = Date.now()) {
 	if (!KNOWN_PEAK_PRICING.has(modelId)) return void 0;
-	const hour = new Date(now).getUTCHours();
+	const at = new Date(now);
+	const day = at.getUTCDay();
+	if (day === 0 || day === 6) return "off-peak";
+	const hour = at.getUTCHours();
 	return PEAK_HOUR_RANGES.some(([start, end]) => hour >= start && hour < end) ? "peak" : "off-peak";
 }
 /**
@@ -947,7 +1024,7 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 * and API key or subscription, and Command Code's terms apply.
 *
 * Wire protocol (reverse-engineered by the pi plugin, command-code@1.28.4;
-* re-verified against command-code@1.50.0 — endpoints, request shape, and
+* re-verified against command-code@1.53.0 — endpoints, request shape, and
 * stream events unchanged):
 *   POST {apiBase}/alpha/generate
 *   body: { config, memory, taste, skills, params: { model, messages, tools,
@@ -960,7 +1037,7 @@ function capabilityDescription(modelId, contextWindow, now = Date.now()) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.50.0";
+const COMMAND_CODE_CLI_VERSION = "1.53.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -1162,8 +1239,65 @@ function wireToolCallIds(paired) {
 function blockText(block) {
 	return block.type === "text" || block.type === "reasoning" ? block.text : "";
 }
-function toolResultText(block) {
-	return block.content.map(blockText).filter(Boolean).join("\n");
+/**
+* Collect text and nested images of one tool result. The harness `read_image`
+* tool returns both, so dropping the image half is what made a tool-read image
+* invisible to a Vision model (issue #30). Deduplication keeps a result that
+* repeats one attachment from paying for the same pixels twice.
+*/
+function toolResultMedia(block) {
+	const chunks = [];
+	const images = [];
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (blocks) => {
+		for (const nested of blocks) {
+			if (nested.type === "text" || nested.type === "reasoning") {
+				if (nested.text) chunks.push(nested.text);
+				continue;
+			}
+			if (nested.type === "image") {
+				if (!seen.has(nested.attachment.attachmentId)) {
+					seen.add(nested.attachment.attachmentId);
+					images.push(nested.attachment);
+				}
+				continue;
+			}
+			if (nested.type === "tool-result") walk(nested.content);
+		}
+	};
+	walk(block.content);
+	return {
+		text: chunks.join("\n"),
+		images
+	};
+}
+/**
+* Result text for the wire's `role: 'tool'` message. A tool that returned only
+* an image (and possibly a nested image-only tool result) has no text at all,
+* and neither transport accepts an empty tool content string, so it gets a
+* descriptor pointing at the user message that follows with the pixels.
+*/
+function toolResultTextForWire(media) {
+	return media.text || (media.images.length > 0 ? "(image returned; see the attached image)" : "");
+}
+/** Leading line of the user message that carries a tool result's images. */
+const TOOL_RESULT_IMAGE_TEXT = "Attached image(s) from tool result:";
+/**
+* The model-visible note introducing the images carried out of one tool
+* result. Neither transport merges them back into the tool result, so this
+* line is what tells the model the image it is about to see belongs to the
+* tool it just ran rather than to the user; it also leads the part list,
+* because an image-first content array is what some gateways reject. Count and
+* pixel dimensions are appended when the tool's own text does not already
+* state them (a result that returns the image and nothing else).
+*/
+function toolResultImageNote(media) {
+	const first = media.images[0];
+	if (first === void 0) return TOOL_RESULT_IMAGE_TEXT;
+	const dimensions = `${first.width}x${first.height} px`;
+	if (first.width <= 0 || first.height <= 0 || media.text.includes(dimensions)) return TOOL_RESULT_IMAGE_TEXT;
+	const count = media.images.length > 1 ? `${media.images.length} images, ` : "";
+	return `${TOOL_RESULT_IMAGE_TEXT} ${count}${dimensions}`;
 }
 function hasImageContent(message) {
 	const check = (blocks) => blocks.some((b) => b.type === "image" || b.type === "tool-result" && check(b.content));
@@ -1231,6 +1365,7 @@ async function messagesToCC(messages, readImage) {
 		if (message.role === "user" && message.source.kind === "tool") {
 			const block = message.content[0];
 			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
+			const media = toolResultMedia(block);
 			out.push({
 				role: "tool",
 				content: [{
@@ -1239,13 +1374,25 @@ async function messagesToCC(messages, readImage) {
 					toolName: toolNames.get(block.toolCallId) || "unknown",
 					output: block.isError ? {
 						type: "error-text",
-						value: toolResultText(block)
+						value: toolResultTextForWire(media)
 					} : {
 						type: "text",
-						value: toolResultText(block)
+						value: toolResultTextForWire(media)
 					}
 				}]
 			});
+			if (media.images.length > 0) {
+				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+				const carried = [{
+					type: "text",
+					text: toolResultImageNote(media)
+				}];
+				for (const attachment of media.images) carried.push(await imageToCommandCode(attachment, readImage));
+				out.push({
+					role: "user",
+					content: carried
+				});
+			}
 		}
 	}
 	return out;
@@ -1324,11 +1471,24 @@ async function messagesToOpenAI(messages, readImage) {
 		if (message.role === "user" && message.source.kind === "tool") {
 			const block = message.content[0];
 			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
+			const media = toolResultMedia(block);
 			out.push({
 				role: "tool",
 				tool_call_id: wireIds.get(block.toolCallId) ?? block.toolCallId,
-				content: toolResultText(block)
+				content: toolResultTextForWire(media)
 			});
+			if (media.images.length > 0) {
+				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+				const carried = [{
+					type: "text",
+					text: toolResultImageNote(media)
+				}];
+				for (const attachment of media.images) carried.push(await imageToOpenAI(attachment, readImage));
+				out.push({
+					role: "user",
+					content: carried
+				});
+			}
 		}
 	}
 	return out;
@@ -2514,6 +2674,14 @@ function tokensCompact(value) {
 	if (value >= 1e3) return `${(value / 1e3).toFixed(1)}K`;
 	return String(value);
 }
+/**
+* Format a success-rate percentage (already in percent units): at most two
+* decimals, trailing zeros trimmed — mirrors `formatSuccessRate` in
+* `./client/usage.ts`, which the settings card uses.
+*/
+function successRateText(value) {
+	return String(Number(value.toFixed(2)));
+}
 /** Format a millis timestamp as a local date; `n/a` when unset. */
 function resetLabel(ms) {
 	if (ms <= 0) return "n/a";
@@ -2552,7 +2720,7 @@ function renderReport(report, locale, title) {
 	}
 	if (report.usage) {
 		const u = report.usage;
-		lines.push(commandCopy(locale, "usageHeader"), commandCopy(locale, "requestsLine").replace("{n}", String(u.completedCount)).replace("{f}", String(u.failedCount)).replace("{r}", String(u.successRate)), commandCopy(locale, "costLine").replace("{money}", money(u.totalCost)).replace("{credits}", moneyShort(u.totalCredits)), commandCopy(locale, "tokensLine").replace("{in}", tokensCompact(u.totalTokensIn)).replace("{out}", tokensCompact(u.totalTokensOut)), "");
+		lines.push(commandCopy(locale, "usageHeader"), commandCopy(locale, "requestsLine").replace("{n}", String(u.completedCount)).replace("{f}", String(u.failedCount)).replace("{r}", successRateText(u.successRate)), commandCopy(locale, "costLine").replace("{money}", money(u.totalCost)).replace("{credits}", moneyShort(u.totalCredits)), commandCopy(locale, "tokensLine").replace("{in}", tokensCompact(u.totalTokensIn)).replace("{out}", tokensCompact(u.totalTokensOut)), "");
 	}
 	if (report.credits) {
 		const c = report.credits;
@@ -3069,6 +3237,14 @@ var CommandCodeLoginFlow = class {
 	timer;
 	/** Settle hooks of the live attempt's callback promise. */
 	settle;
+	/**
+	* Attempt generation. A delivered callback keeps validating the key
+	* asynchronously (`complete()`), and that window is open to a cancel or a
+	* fresh `begin()`; the generation lets a late completion recognize that it
+	* no longer owns the status face and stop instead of storing a credential
+	* the user cancelled and flipping the page back to success.
+	*/
+	attemptSeq = 0;
 	disposed = false;
 	constructor(deps) {
 		this.deps = deps;
@@ -3089,8 +3265,9 @@ var CommandCodeLoginFlow = class {
 	*/
 	async begin() {
 		if (this.disposed) throw new Error("login flow has been disposed");
-		if (this.statusValue.state === "waiting") return this.statusValue;
+		if (this.statusValue.state === "waiting" && this.server !== void 0) return this.statusValue;
 		this.teardown();
+		const attempt = ++this.attemptSeq;
 		const port = await this.findPort();
 		const expectedState = this.deps.randomToken?.(32) ?? randomBytes(32).toString("base64url");
 		const settled = new Promise((resolve, reject) => {
@@ -3118,7 +3295,7 @@ var CommandCodeLoginFlow = class {
 			});
 		}, this.deps.timeoutMs ?? 12e4);
 		this.timer.unref?.();
-		settled.then((credentials) => this.complete(credentials), (failure) => this.failFrom(failure));
+		settled.then((credentials) => this.complete(attempt, credentials), (failure) => this.failFrom(attempt, failure));
 		return this.statusValue;
 	}
 	/** Cancel a waiting attempt; terminal states are untouched. */
@@ -3235,6 +3412,13 @@ var CommandCodeLoginFlow = class {
 			}
 			if (typeof payload === "object" && payload !== null && "error" in payload) {
 				const denial = payload;
+				if (denial.state !== expectedState) {
+					json(403, {
+						success: false,
+						error: "Invalid state token"
+					});
+					return;
+				}
 				const description = denial.error_description ?? denial.error;
 				this.settleAttempt(json, 200, { success: true }, new LoginSettleError(denial.error === "access_denied" ? "denied" : "error", typeof description === "string" && description !== "" ? description : "Authorization failed"));
 				return;
@@ -3266,10 +3450,20 @@ var CommandCodeLoginFlow = class {
 		if (failure !== void 0) settle.reject(failure);
 		else if (credentials !== void 0) settle.resolve(credentials);
 	}
-	/** Post-validation completion: whoami check, then hand-off to storage. */
-	async complete(credentials) {
-		if (this.disposed || this.statusValue.state !== "waiting") return;
+	/**
+	* Post-validation completion: whoami check, then hand-off to storage.
+	*
+	* Every step re-checks {@link ownsAttempt} first: the whoami round-trip and
+	* the credential write are awaits, and the user may cancel (or start another
+	* attempt) while one is in flight. A completion that no longer owns the
+	* attempt must not write the key or publish a status — otherwise cancel
+	* would report "cancelled" while the credential landed anyway, and the page
+	* would silently flip to success.
+	*/
+	async complete(attempt, credentials) {
+		if (!this.ownsAttempt(attempt)) return;
 		const validation = await validateCommandApiKey(this.deps.fetchImpl ?? fetch, this.readApiBase(), credentials.apiKey);
+		if (!this.ownsAttempt(attempt)) return;
 		if (!validation.valid) {
 			const reason = validation.error === "invalid_key" ? "invalid-key" : validation.error === "network_error" ? "network" : "error";
 			this.setStatus({
@@ -3279,9 +3473,11 @@ var CommandCodeLoginFlow = class {
 			});
 			return;
 		}
+		if (!this.ownsAttempt(attempt)) return;
 		try {
 			await this.deps.storeKey(credentials);
 		} catch (error) {
+			if (!this.ownsAttempt(attempt)) return;
 			this.setStatus({
 				state: "failed",
 				reason: "unavailable",
@@ -3289,7 +3485,7 @@ var CommandCodeLoginFlow = class {
 			});
 			return;
 		}
-		if (this.disposed) return;
+		if (!this.ownsAttempt(attempt)) return;
 		this.clearTimer();
 		this.setStatus({
 			state: "success",
@@ -3297,10 +3493,14 @@ var CommandCodeLoginFlow = class {
 			keyName: credentials.keyName
 		});
 	}
+	/** Whether one attempt still owns the status face (not cancelled, replaced, or disposed). */
+	ownsAttempt(attempt) {
+		return !this.disposed && this.attemptSeq === attempt && this.statusValue.state === "waiting";
+	}
 	/** Map a tagged settle rejection onto the status face. */
-	failFrom(failure) {
+	failFrom(attempt, failure) {
 		if (!(failure instanceof LoginSettleError)) return;
-		if (this.disposed || this.statusValue.state !== "waiting") return;
+		if (!this.ownsAttempt(attempt)) return;
 		this.setStatus({
 			state: "failed",
 			reason: failure.reason,
@@ -3581,6 +3781,244 @@ var CommandCodeSearchProvider = class {
 	}
 };
 //#endregion
+//#region src/tui-settings.ts
+/** The selector value meaning "no pinned account — follow rotation order". */
+const ACTIVE_ACCOUNT_AUTO = "auto";
+/** The selector value meaning "no language override — follow the shell locale". */
+const LANG_AUTO = "auto";
+/**
+* Build the section descriptor. Pure, so tests can pin the exact fields
+* without a dsh-TUI host.
+*
+* Field choices worth keeping: the two option-bearing fields (`activeAccount`,
+* `lang`) are `text` + `options` rather than `select`, because a `select`
+* cannot express "unset" — cycling only ever lands on a declared option, so a
+* `select` would strand the user on a pinned value with no way back to
+* automatic. The `auto` sentinel plus a `parse` that clears the path keeps the
+* unset state reachable. The two booleans format their EFFECTIVE default
+* (`filterModelsByPlan` unset means true at the adapter), so a fresh install
+* reads true instead of the screen's "(empty)".
+*/
+function buildCommandCodeTuiSection(deps) {
+	const ref = deps.apiKeyRef();
+	const slots = deps.accountSlots();
+	return {
+		ns: deps.ns,
+		title: deps.title ?? "Command Code",
+		descriptions: { zh: "Command Code（非官方）" },
+		groups: [
+			{
+				id: "connection",
+				title: "Connection",
+				descriptions: { zh: "连接" }
+			},
+			{
+				id: "models",
+				title: "Models",
+				descriptions: { zh: "模型" }
+			},
+			{
+				id: "advanced",
+				title: "Advanced",
+				descriptions: { zh: "高级" }
+			}
+		],
+		fields: [
+			{
+				path: ["apiKey"],
+				group: "connection",
+				kind: "text",
+				label: "API key",
+				descriptions: { zh: "API 密钥" },
+				secret: { ref },
+				hint: `Stored in the credential store as ${ref}, never in settings.yaml.`,
+				hintDescriptions: { zh: `保存在凭据库（${ref}），不会写入 settings.yaml。` }
+			},
+			{
+				path: ["apiBase"],
+				group: "connection",
+				kind: "text",
+				label: "API base",
+				descriptions: { zh: "API 地址" },
+				placeholder: "https://api.commandcode.ai",
+				hint: "Leave empty for the public Command Code Provider API.",
+				hintDescriptions: { zh: "留空即使用官方 Command Code Provider API。" },
+				parse: (text) => {
+					const trimmed = text.trim();
+					return trimmed === "" ? { kind: "clear" } : {
+						kind: "set",
+						value: trimmed
+					};
+				}
+			},
+			{
+				path: ["filterModelsByPlan"],
+				group: "models",
+				kind: "boolean",
+				label: "Hide out-of-plan models",
+				descriptions: { zh: "隐藏套餐外的模型" },
+				hint: "Keeps models above your subscription tier out of the picker. Fails open.",
+				hintDescriptions: { zh: "在选择器里隐藏超出当前订阅档位的模型；判断不出来时全部显示。" },
+				format: (value) => value === false ? "false" : "true",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
+			{
+				path: ["visibleModels"],
+				group: "models",
+				kind: "text",
+				label: "Visible models",
+				descriptions: { zh: "显示的模型" },
+				hint: "Comma-separated catalog ids; empty shows every model.",
+				hintDescriptions: { zh: "以逗号分隔的模型 id；留空表示显示全部模型。" },
+				format: (value) => (Array.isArray(value) ? value.filter((id) => typeof id === "string" && id !== "") : []).join(", "),
+				parse: (text) => {
+					const ids = text.split(",").map((id) => id.trim()).filter((id) => id !== "");
+					return ids.length === 0 ? { kind: "clear" } : {
+						kind: "set",
+						value: ids
+					};
+				}
+			},
+			{
+				path: ["activeAccount"],
+				group: "advanced",
+				kind: "text",
+				label: "Active account",
+				descriptions: { zh: "当前账号" },
+				hint: "A pinned account id, or auto to follow the rotation order.",
+				hintDescriptions: { zh: "固定使用某个账号的 id；auto 表示按轮换顺序自动选择。" },
+				options: [{
+					value: ACTIVE_ACCOUNT_AUTO,
+					label: "Automatic (rotation order)",
+					descriptions: { zh: "自动（按轮换顺序）" }
+				}, ...slots.map((slot) => ({
+					value: slot.id,
+					label: slot.label,
+					descriptions: { zh: slot.label }
+				}))],
+				format: (value) => typeof value === "string" && value.trim() !== "" ? value : ACTIVE_ACCOUNT_AUTO,
+				parse: (text) => {
+					const trimmed = text.trim();
+					return trimmed === "" || trimmed === "auto" ? { kind: "clear" } : {
+						kind: "set",
+						value: trimmed
+					};
+				}
+			},
+			{
+				path: ["lang"],
+				group: "advanced",
+				kind: "text",
+				label: "Command language",
+				descriptions: { zh: "命令语言" },
+				hint: "Language of the /commandcode dashboard; auto follows the shell locale.",
+				hintDescriptions: { zh: "/commandcode 用量面板的语言；auto 跟随终端 locale。" },
+				options: [
+					{
+						value: LANG_AUTO,
+						label: "Automatic (shell locale)",
+						descriptions: { zh: "自动（跟随终端 locale）" }
+					},
+					{
+						value: "zh",
+						label: "中文"
+					},
+					{
+						value: "en",
+						label: "English"
+					}
+				],
+				format: (value) => value === "zh" || value === "en" ? value : LANG_AUTO,
+				parse: (text) => {
+					const trimmed = text.trim();
+					return trimmed === "" || trimmed === "auto" ? { kind: "clear" } : {
+						kind: "set",
+						value: trimmed
+					};
+				}
+			}
+		]
+	};
+}
+/**
+* The `tuiSettingsSections` service, read defensively.
+*
+* The service name is declared by dsh-TUI's own module augmentation, which
+* this package deliberately does not import, so the typed `Context` has no
+* such property. The read goes through the REFLECTIVE `ctx.get` rather than a
+* bare property access: cordis refuses a property read for a service the fiber
+* never declared in `inject` (`cannot get property … without inject`), and an
+* unmeet seam must degrade to "no section" instead of throwing out of the
+* plugin's boot.
+*/
+function tuiSettingsService(ctx) {
+	let candidate;
+	try {
+		candidate = ctx.get("tuiSettingsSections");
+	} catch {
+		return;
+	}
+	if (typeof candidate !== "object" || candidate === null) return void 0;
+	const register = candidate.register;
+	if (typeof register !== "function") return void 0;
+	return { register: register.bind(candidate) };
+}
+/**
+* Identity of everything in the section that can change at runtime: the
+* credential reference behind the API-key field and the account slots behind
+* the active-account selector. Re-registration is skipped while this matches,
+* so ordinary settings writes never churn the screen's section list.
+*/
+function sectionSignature(section) {
+	const active = section.fields.find((field) => field.path.join(".") === "activeAccount");
+	return JSON.stringify({
+		secret: section.fields.find((field) => field.secret !== void 0)?.secret?.ref ?? "",
+		options: active?.options?.map((option) => option.value) ?? []
+	});
+}
+/**
+* Register the Command Code section on a dsh-TUI host.
+*
+* @param ctx - the context of an activated `tuiSettingsSections` injection.
+* @param deps - plugin-owned facts the section reads.
+* @returns a refresh function that re-registers the section when a fact it
+*   renders changed (the plugin entry calls it from its settings `onChange`
+*   hook), or `undefined` when the seam is unusable. The returned function is
+*   inert after the fiber is torn down.
+*/
+function applyCommandCodeTuiSettings(ctx, deps) {
+	const service = tuiSettingsService(ctx);
+	if (service === void 0) return void 0;
+	let disposed = false;
+	let current;
+	const refresh = () => {
+		if (disposed) return;
+		const section = buildCommandCodeTuiSection(deps);
+		const signature = sectionSignature(section);
+		if (current?.signature === signature) return;
+		current?.dispose();
+		current = void 0;
+		try {
+			current = {
+				signature,
+				dispose: service.register(section)
+			};
+		} catch (error) {
+			ctx.logger?.warn(`llm-commandcode: could not register the dsh-TUI settings section: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	};
+	refresh();
+	ctx.effect(() => () => {
+		disposed = true;
+		current?.dispose();
+		current = void 0;
+	}, "dsh-commandcode-provider: tui settings section");
+	return refresh;
+}
+//#endregion
 //#region src/index.ts
 /**
 * dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
@@ -3619,7 +4057,7 @@ const PROVIDER = "commandcode";
 const DEFAULT_MODELS_CACHE_PATH = join(homedir(), ".commandcode", "models-cache.json");
 const Config = z.object({
 	apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
-	apiKey: z.string(),
+	apiKey: z.string().role("secret"),
 	apiBase: z.string(),
 	workingDir: z.string(),
 	modelsCachePath: z.string(),
@@ -3631,7 +4069,8 @@ const Config = z.object({
 	accounts: z.array(z.object({
 		label: z.string(),
 		apiKeyEnv: z.string().role("credential-ref"),
-		apiKey: z.string()
+		/** Literal key for one extra slot; see the top-level `apiKey` secret note. */
+		apiKey: z.string().role("secret")
 	})),
 	activeAccount: z.string(),
 	modelAccountRules: z.array(z.object({
@@ -3821,6 +4260,20 @@ function apply(ctx, config) {
 			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
 		}, "dsh-commandcode-provider: web search selection");
 	});
+	let refreshTuiSettings;
+	ctx.inject(["tuiSettingsSections"], (tuiCtx) => {
+		refreshTuiSettings = applyCommandCodeTuiSettings(tuiCtx, {
+			ns: NS,
+			apiKeyRef: () => current().apiKeyEnv ?? DEFAULT_API_KEY_ENV,
+			accountSlots: () => slots().map((slot) => ({
+				id: slot.id,
+				label: slot.label
+			}))
+		});
+		tuiCtx.effect(() => () => {
+			refreshTuiSettings = void 0;
+		}, "dsh-commandcode-provider: tui settings handle");
+	});
 	ctx.inject(["settings"], (settingsCtx) => {
 		settingsCtx.settings.installSection(ctx, NS, Config, config, {
 			setSource: (source) => {
@@ -3828,11 +4281,12 @@ function apply(ctx, config) {
 			},
 			onChange: () => {
 				applySearchSelection(current().webSearch ?? true);
+				refreshTuiSettings?.();
 			}
 		});
 	});
 }
 //#endregion
-export { BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommands, applyUsageRemote, buildCommandAuthUrl, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map