@mars-sea/dsh-commandcode-provider 0.10.3 → 0.10.5

package/lib/index.js

@@ -220,16 +220,38 @@ var CommandCodeAccountPool = class {
 			until: 0
 		});
 	}
-	/** One account's key: literal → credential seam → auth file (default slot). */
+	/**
+	* One account's key: literal → credential seam → auth file (default slot).
+	*
+	* Every source is normalized here, at the single point where a slot's key
+	* enters the pool. The adapter sends the key through the harness's
+	* `assertUsableApiKey()`, which trims it — a stored key from the credentials
+	* seam, a `.env` line, or a shell export all pick up surrounding whitespace
+	* — and reports that trimmed form back to `markRejected()`. Returning the
+	* raw value would file every 429/401 mark under a key no later lookup can
+	* find: rotation would re-offer the same account, the account card would show
+	* no mark, and the usage endpoints would 401 while chat kept working.
+	* Normalizing once makes resolution, probing, marking, and the request path
+	* agree on one string.
+	*/
 	async resolveSlotKey(slot) {
-		if (slot.literal !== void 0 && slot.literal !== "") return slot.literal;
+		if (slot.literal !== void 0) {
+			const literal = normalizeResolvedKey(slot.literal);
+			if (literal !== void 0) return literal;
+		}
 		if (slot.ref !== void 0) {
 			const hit = await this.deps.resolveRef(slot.ref);
-			if (hit !== void 0 && hit !== "") return hit;
+			if (hit !== void 0) {
+				const resolved = normalizeResolvedKey(hit);
+				if (resolved !== void 0) return resolved;
+			}
 		}
 		if (slot.allowAuthFile) {
 			const fromFile = this.deps.authFileKey();
-			if (fromFile !== void 0 && fromFile !== "") return fromFile;
+			if (fromFile !== void 0) {
+				const fileKey = normalizeResolvedKey(fromFile);
+				if (fileKey !== void 0) return fileKey;
+			}
 		}
 	}
 	/** Hand out the chosen account's key. */
@@ -240,6 +262,16 @@ var CommandCodeAccountPool = class {
 		};
 	}
 };
+/**
+* Normalize one resolved credential to the form every consumer sees. Trim
+* only: a blank-after-trim value means "no key" (the slot is omitted and the
+* caller reports `MISSING_CREDENTIAL`), while characters an HTTP header cannot
+* carry are left for `assertUsableApiKey()` to reject with its own message.
+*/
+function normalizeResolvedKey(value) {
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
 //#endregion
 //#region src/capabilities.ts
 /**
@@ -1207,8 +1239,65 @@ function wireToolCallIds(paired) {
 function blockText(block) {
 	return block.type === "text" || block.type === "reasoning" ? block.text : "";
 }
-function toolResultText(block) {
-	return block.content.map(blockText).filter(Boolean).join("\n");
+/**
+* Collect text and nested images of one tool result. The harness `read_image`
+* tool returns both, so dropping the image half is what made a tool-read image
+* invisible to a Vision model (issue #30). Deduplication keeps a result that
+* repeats one attachment from paying for the same pixels twice.
+*/
+function toolResultMedia(block) {
+	const chunks = [];
+	const images = [];
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (blocks) => {
+		for (const nested of blocks) {
+			if (nested.type === "text" || nested.type === "reasoning") {
+				if (nested.text) chunks.push(nested.text);
+				continue;
+			}
+			if (nested.type === "image") {
+				if (!seen.has(nested.attachment.attachmentId)) {
+					seen.add(nested.attachment.attachmentId);
+					images.push(nested.attachment);
+				}
+				continue;
+			}
+			if (nested.type === "tool-result") walk(nested.content);
+		}
+	};
+	walk(block.content);
+	return {
+		text: chunks.join("\n"),
+		images
+	};
+}
+/**
+* Result text for the wire's `role: 'tool'` message. A tool that returned only
+* an image (and possibly a nested image-only tool result) has no text at all,
+* and neither transport accepts an empty tool content string, so it gets a
+* descriptor pointing at the user message that follows with the pixels.
+*/
+function toolResultTextForWire(media) {
+	return media.text || (media.images.length > 0 ? "(image returned; see the attached image)" : "");
+}
+/** Leading line of the user message that carries a tool result's images. */
+const TOOL_RESULT_IMAGE_TEXT = "Attached image(s) from tool result:";
+/**
+* The model-visible note introducing the images carried out of one tool
+* result. Neither transport merges them back into the tool result, so this
+* line is what tells the model the image it is about to see belongs to the
+* tool it just ran rather than to the user; it also leads the part list,
+* because an image-first content array is what some gateways reject. Count and
+* pixel dimensions are appended when the tool's own text does not already
+* state them (a result that returns the image and nothing else).
+*/
+function toolResultImageNote(media) {
+	const first = media.images[0];
+	if (first === void 0) return TOOL_RESULT_IMAGE_TEXT;
+	const dimensions = `${first.width}x${first.height} px`;
+	if (first.width <= 0 || first.height <= 0 || media.text.includes(dimensions)) return TOOL_RESULT_IMAGE_TEXT;
+	const count = media.images.length > 1 ? `${media.images.length} images, ` : "";
+	return `${TOOL_RESULT_IMAGE_TEXT} ${count}${dimensions}`;
 }
 function hasImageContent(message) {
 	const check = (blocks) => blocks.some((b) => b.type === "image" || b.type === "tool-result" && check(b.content));
@@ -1276,6 +1365,7 @@ async function messagesToCC(messages, readImage) {
 		if (message.role === "user" && message.source.kind === "tool") {
 			const block = message.content[0];
 			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
+			const media = toolResultMedia(block);
 			out.push({
 				role: "tool",
 				content: [{
@@ -1284,13 +1374,25 @@ async function messagesToCC(messages, readImage) {
 					toolName: toolNames.get(block.toolCallId) || "unknown",
 					output: block.isError ? {
 						type: "error-text",
-						value: toolResultText(block)
+						value: toolResultTextForWire(media)
 					} : {
 						type: "text",
-						value: toolResultText(block)
+						value: toolResultTextForWire(media)
 					}
 				}]
 			});
+			if (media.images.length > 0) {
+				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+				const carried = [{
+					type: "text",
+					text: toolResultImageNote(media)
+				}];
+				for (const attachment of media.images) carried.push(await imageToCommandCode(attachment, readImage));
+				out.push({
+					role: "user",
+					content: carried
+				});
+			}
 		}
 	}
 	return out;
@@ -1369,11 +1471,24 @@ async function messagesToOpenAI(messages, readImage) {
 		if (message.role === "user" && message.source.kind === "tool") {
 			const block = message.content[0];
 			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
+			const media = toolResultMedia(block);
 			out.push({
 				role: "tool",
 				tool_call_id: wireIds.get(block.toolCallId) ?? block.toolCallId,
-				content: toolResultText(block)
+				content: toolResultTextForWire(media)
 			});
+			if (media.images.length > 0) {
+				if (!readImage) throw new LlmError("Image input requires the durable attachment service", "UNSUPPORTED_CONTENT");
+				const carried = [{
+					type: "text",
+					text: toolResultImageNote(media)
+				}];
+				for (const attachment of media.images) carried.push(await imageToOpenAI(attachment, readImage));
+				out.push({
+					role: "user",
+					content: carried
+				});
+			}
 		}
 	}
 	return out;
@@ -1760,7 +1875,12 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const access = this.deps.options().filterModelsByPlan === false ? void 0 : await this.loadBillingAccess();
 		const visible = this.deps.options().visibleModels;
 		const allow = Array.isArray(visible) && visible.length > 0 ? new Set(visible.filter((id) => typeof id === "string" && id !== "")) : void 0;
-		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).filter((model) => allow === void 0 || allow.has(model.id)).map(toInfo).sort(compareByPlan);
+		const overrides = this.deps.options().modelVisibility;
+		return catalog.filter((model) => modelVisibleInPlan(model.id, access)).filter((model) => {
+			const override = overrides?.[model.id];
+			if (typeof override === "boolean") return override;
+			return allow === void 0 || allow.has(model.id);
+		}).map(toInfo).sort(compareByPlan);
 	}
 	async resolveModel(provider, model, signal) {
 		const entry = this.catalog.find((m) => m.id === model) ?? (await this.loadCatalog(signal)).find((m) => m.id === model);
@@ -3122,6 +3242,14 @@ var CommandCodeLoginFlow = class {
 	timer;
 	/** Settle hooks of the live attempt's callback promise. */
 	settle;
+	/**
+	* Attempt generation. A delivered callback keeps validating the key
+	* asynchronously (`complete()`), and that window is open to a cancel or a
+	* fresh `begin()`; the generation lets a late completion recognize that it
+	* no longer owns the status face and stop instead of storing a credential
+	* the user cancelled and flipping the page back to success.
+	*/
+	attemptSeq = 0;
 	disposed = false;
 	constructor(deps) {
 		this.deps = deps;
@@ -3142,8 +3270,9 @@ var CommandCodeLoginFlow = class {
 	*/
 	async begin() {
 		if (this.disposed) throw new Error("login flow has been disposed");
-		if (this.statusValue.state === "waiting") return this.statusValue;
+		if (this.statusValue.state === "waiting" && this.server !== void 0) return this.statusValue;
 		this.teardown();
+		const attempt = ++this.attemptSeq;
 		const port = await this.findPort();
 		const expectedState = this.deps.randomToken?.(32) ?? randomBytes(32).toString("base64url");
 		const settled = new Promise((resolve, reject) => {
@@ -3171,7 +3300,7 @@ var CommandCodeLoginFlow = class {
 			});
 		}, this.deps.timeoutMs ?? 12e4);
 		this.timer.unref?.();
-		settled.then((credentials) => this.complete(credentials), (failure) => this.failFrom(failure));
+		settled.then((credentials) => this.complete(attempt, credentials), (failure) => this.failFrom(attempt, failure));
 		return this.statusValue;
 	}
 	/** Cancel a waiting attempt; terminal states are untouched. */
@@ -3288,6 +3417,13 @@ var CommandCodeLoginFlow = class {
 			}
 			if (typeof payload === "object" && payload !== null && "error" in payload) {
 				const denial = payload;
+				if (denial.state !== expectedState) {
+					json(403, {
+						success: false,
+						error: "Invalid state token"
+					});
+					return;
+				}
 				const description = denial.error_description ?? denial.error;
 				this.settleAttempt(json, 200, { success: true }, new LoginSettleError(denial.error === "access_denied" ? "denied" : "error", typeof description === "string" && description !== "" ? description : "Authorization failed"));
 				return;
@@ -3319,10 +3455,20 @@ var CommandCodeLoginFlow = class {
 		if (failure !== void 0) settle.reject(failure);
 		else if (credentials !== void 0) settle.resolve(credentials);
 	}
-	/** Post-validation completion: whoami check, then hand-off to storage. */
-	async complete(credentials) {
-		if (this.disposed || this.statusValue.state !== "waiting") return;
+	/**
+	* Post-validation completion: whoami check, then hand-off to storage.
+	*
+	* Every step re-checks {@link ownsAttempt} first: the whoami round-trip and
+	* the credential write are awaits, and the user may cancel (or start another
+	* attempt) while one is in flight. A completion that no longer owns the
+	* attempt must not write the key or publish a status — otherwise cancel
+	* would report "cancelled" while the credential landed anyway, and the page
+	* would silently flip to success.
+	*/
+	async complete(attempt, credentials) {
+		if (!this.ownsAttempt(attempt)) return;
 		const validation = await validateCommandApiKey(this.deps.fetchImpl ?? fetch, this.readApiBase(), credentials.apiKey);
+		if (!this.ownsAttempt(attempt)) return;
 		if (!validation.valid) {
 			const reason = validation.error === "invalid_key" ? "invalid-key" : validation.error === "network_error" ? "network" : "error";
 			this.setStatus({
@@ -3332,9 +3478,11 @@ var CommandCodeLoginFlow = class {
 			});
 			return;
 		}
+		if (!this.ownsAttempt(attempt)) return;
 		try {
 			await this.deps.storeKey(credentials);
 		} catch (error) {
+			if (!this.ownsAttempt(attempt)) return;
 			this.setStatus({
 				state: "failed",
 				reason: "unavailable",
@@ -3342,7 +3490,7 @@ var CommandCodeLoginFlow = class {
 			});
 			return;
 		}
-		if (this.disposed) return;
+		if (!this.ownsAttempt(attempt)) return;
 		this.clearTimer();
 		this.setStatus({
 			state: "success",
@@ -3350,10 +3498,14 @@ var CommandCodeLoginFlow = class {
 			keyName: credentials.keyName
 		});
 	}
+	/** Whether one attempt still owns the status face (not cancelled, replaced, or disposed). */
+	ownsAttempt(attempt) {
+		return !this.disposed && this.attemptSeq === attempt && this.statusValue.state === "waiting";
+	}
 	/** Map a tagged settle rejection onto the status face. */
-	failFrom(failure) {
+	failFrom(attempt, failure) {
 		if (!(failure instanceof LoginSettleError)) return;
-		if (this.disposed || this.statusValue.state !== "waiting") return;
+		if (!this.ownsAttempt(attempt)) return;
 		this.setStatus({
 			state: "failed",
 			reason: failure.reason,
@@ -3634,6 +3786,338 @@ var CommandCodeSearchProvider = class {
 	}
 };
 //#endregion
+//#region src/tui-settings.ts
+/** The selector value meaning "no pinned account — follow rotation order". */
+const ACTIVE_ACCOUNT_AUTO = "auto";
+/** The selector value meaning "no language override — follow the shell locale". */
+const LANG_AUTO = "auto";
+/** Tier display names, mirroring the web dropdown's headings (`model-select.ts`). */
+const TIER_TITLES = {
+	go: "Go",
+	goat: "GOAT",
+	pro: "Pro",
+	provider: "Provider",
+	max: "Max"
+};
+/** Tiers in picker order; a model outside this set joins the "Other" group. */
+const TIER_ORDER = [
+	"go",
+	"goat",
+	"pro",
+	"provider",
+	"max"
+];
+/** The group holding models this build's catalog does not know. */
+const OTHER_GROUP_ID = "models-other";
+/**
+* Every model this build knows, in checkbox order: plan tier (Go first), then
+* free before paid inside a tier, then by id.
+*
+* The list is the static capability snapshot rather than a live catalog read
+* on purpose — a settings page must draw synchronously, and the snapshot is
+* synced from the same upstream table the picker's tier headings come from.
+* A model added upstream after this build still reaches the user: an empty
+* allowlist shows everything, and a model named in the allowlist but absent
+* here is rendered by the "Other" group instead of disappearing.
+*/
+function commandCodeTuiModelChoices() {
+	return Object.keys(KNOWN_PLANS).map((id) => ({
+		id,
+		tier: KNOWN_PLANS[id] ?? "",
+		free: isFreeModel(id),
+		hint: capabilityDescription(id)
+	})).sort((a, b) => {
+		const tierDelta = tierRank(a.tier) - tierRank(b.tier);
+		if (tierDelta !== 0) return tierDelta;
+		if (a.free !== b.free) return a.free ? -1 : 1;
+		return a.id.localeCompare(b.id);
+	});
+}
+/** Sort rank of a tier key; unknown tiers trail every known one. */
+function tierRank(tier) {
+	const rank = TIER_ORDER.indexOf(tier);
+	return rank === -1 ? TIER_ORDER.length : rank;
+}
+/** The stored allowlist as a clean id list (non-strings and blanks dropped). */
+function storedIds(value) {
+	return Array.isArray(value) ? value.filter((id) => typeof id === "string" && id !== "") : [];
+}
+/**
+* Build the section descriptor. Pure, so tests can pin the exact fields
+* without a dsh-TUI host.
+*
+* Field choices worth keeping: the two option-bearing fields (`activeAccount`,
+* `lang`) are `text` + `options` rather than `select`, because a `select`
+* cannot express "unset" — cycling only ever lands on a declared option, so a
+* `select` would strand the user on a pinned value with no way back to
+* automatic. The `auto` sentinel plus a `parse` that clears the path keeps the
+* unset state reachable. `filterModelsByPlan` formats its EFFECTIVE default
+* (unset means true at the adapter), so a fresh install reads true instead of
+* the screen's "(empty)".
+*/
+function buildCommandCodeTuiSection(deps) {
+	const ref = deps.apiKeyRef();
+	const slots = deps.accountSlots();
+	const choices = (deps.modelChoices ?? commandCodeTuiModelChoices)();
+	const catalogIds = choices.map((choice) => choice.id);
+	const known = new Set(catalogIds);
+	const stored = storedIds(deps.visibleModels());
+	const overrides = deps.modelVisibility?.() ?? {};
+	const extras = [.../* @__PURE__ */ new Set([...stored, ...Object.keys(overrides)])].filter((id) => !known.has(id));
+	const tierGroups = TIER_ORDER.filter((tier) => choices.some((choice) => choice.tier === tier)).map((tier) => ({
+		id: `models-${tier}`,
+		title: `${TIER_TITLES[tier] ?? tier} models`,
+		descriptions: { zh: `${TIER_TITLES[tier] ?? tier} 模型` }
+	}));
+	const unranked = choices.filter((choice) => tierRank(choice.tier) === TIER_ORDER.length);
+	const otherGroup = unranked.length > 0 || extras.length > 0 ? [{
+		id: OTHER_GROUP_ID,
+		title: "Other models",
+		descriptions: { zh: "其他模型" }
+	}] : [];
+	/**
+	* One checkbox: a boolean at a path of its OWN (`modelVisibility.<id>`).
+	*
+	* The path must be unique per model. dsh-TUI keys a staged draft by the
+	* field's path (`fieldKey`), so N checkboxes sharing `visibleModels` share
+	* ONE draft: every one of them then parses that same draft on save, all N
+	* write ops address the same path, and only the LAST field's op survives —
+	* which silently rewrote the allowlist from the last catalog model instead
+	* of the one that was toggled. A per-model key is what makes a checkbox
+	* express one model's state.
+	*
+	* An override equal to what the array already says is written as a CLEAR, so
+	* toggling a model back to its inherited state leaves no residue and the
+	* document stays minimal.
+	*/
+	const modelField = (id, hint, group) => ({
+		path: ["modelVisibility", id],
+		group,
+		kind: "boolean",
+		label: id,
+		...hint === "" ? {} : { hint },
+		format: (value) => {
+			if (typeof value === "boolean") return String(value);
+			const listed = storedIds(deps.visibleModels());
+			return String(listed.length === 0 || listed.includes(id));
+		},
+		parse: (text) => {
+			const on = text.trim() === "true";
+			const listed = storedIds(deps.visibleModels());
+			return on === (listed.length === 0 || listed.includes(id)) ? { kind: "clear" } : {
+				kind: "set",
+				value: on
+			};
+		}
+	});
+	return {
+		ns: deps.ns,
+		title: deps.title ?? "Command Code",
+		descriptions: { zh: "Command Code（非官方）" },
+		groups: [
+			{
+				id: "connection",
+				title: "Connection",
+				descriptions: { zh: "连接" }
+			},
+			{
+				id: "models",
+				title: "Models",
+				descriptions: { zh: "模型" }
+			},
+			...tierGroups,
+			...otherGroup,
+			{
+				id: "advanced",
+				title: "Advanced",
+				descriptions: { zh: "高级" }
+			}
+		],
+		fields: [
+			{
+				path: ["apiKey"],
+				group: "connection",
+				kind: "text",
+				label: "API key",
+				descriptions: { zh: "API 密钥" },
+				secret: { ref },
+				hint: `Stored in the credential store as ${ref}, never in settings.yaml.`,
+				hintDescriptions: { zh: `保存在凭据库（${ref}），不会写入 settings.yaml。` }
+			},
+			{
+				path: ["apiBase"],
+				group: "connection",
+				kind: "text",
+				label: "API base",
+				descriptions: { zh: "API 地址" },
+				placeholder: "https://api.commandcode.ai",
+				hint: "Leave empty for the public Command Code Provider API.",
+				hintDescriptions: { zh: "留空即使用官方 Command Code Provider API。" },
+				parse: (text) => {
+					const trimmed = text.trim();
+					return trimmed === "" ? { kind: "clear" } : {
+						kind: "set",
+						value: trimmed
+					};
+				}
+			},
+			{
+				path: ["filterModelsByPlan"],
+				group: "models",
+				kind: "boolean",
+				label: "Hide out-of-plan models",
+				descriptions: { zh: "隐藏套餐外的模型" },
+				hint: "Keeps models above your subscription tier out of the picker. Fails open.",
+				hintDescriptions: { zh: "在选择器里隐藏超出当前订阅档位的模型；判断不出来时全部显示。" },
+				format: (value) => value === false ? "false" : "true",
+				parse: (text) => ({
+					kind: "set",
+					value: text.trim() === "true"
+				})
+			},
+			...choices.filter((choice) => tierRank(choice.tier) !== TIER_ORDER.length).map((choice) => modelField(choice.id, choice.hint, `models-${choice.tier}`)),
+			...unranked.map((choice) => modelField(choice.id, choice.hint, OTHER_GROUP_ID)),
+			...extras.map((id) => modelField(id, capabilityDescription(id), OTHER_GROUP_ID)),
+			{
+				path: ["activeAccount"],
+				group: "advanced",
+				kind: "text",
+				label: "Active account",
+				descriptions: { zh: "当前账号" },
+				hint: "A pinned account id, or auto to follow the rotation order.",
+				hintDescriptions: { zh: "固定使用某个账号的 id；auto 表示按轮换顺序自动选择。" },
+				options: [{
+					value: ACTIVE_ACCOUNT_AUTO,
+					label: "Automatic (rotation order)",
+					descriptions: { zh: "自动（按轮换顺序）" }
+				}, ...slots.map((slot) => ({
+					value: slot.id,
+					label: slot.label,
+					descriptions: { zh: slot.label }
+				}))],
+				format: (value) => typeof value === "string" && value.trim() !== "" ? value : ACTIVE_ACCOUNT_AUTO,
+				parse: (text) => {
+					const trimmed = text.trim();
+					return trimmed === "" || trimmed === "auto" ? { kind: "clear" } : {
+						kind: "set",
+						value: trimmed
+					};
+				}
+			},
+			{
+				path: ["lang"],
+				group: "advanced",
+				kind: "text",
+				label: "Command language",
+				descriptions: { zh: "命令语言" },
+				hint: "Language of the /commandcode dashboard; auto follows the shell locale.",
+				hintDescriptions: { zh: "/commandcode 用量面板的语言；auto 跟随终端 locale。" },
+				options: [
+					{
+						value: LANG_AUTO,
+						label: "Automatic (shell locale)",
+						descriptions: { zh: "自动（跟随终端 locale）" }
+					},
+					{
+						value: "zh",
+						label: "中文"
+					},
+					{
+						value: "en",
+						label: "English"
+					}
+				],
+				format: (value) => value === "zh" || value === "en" ? value : LANG_AUTO,
+				parse: (text) => {
+					const trimmed = text.trim();
+					return trimmed === "" || trimmed === "auto" ? { kind: "clear" } : {
+						kind: "set",
+						value: trimmed
+					};
+				}
+			}
+		]
+	};
+}
+/**
+* The `tuiSettingsSections` service, read defensively.
+*
+* The service name is declared by dsh-TUI's own module augmentation, which
+* this package deliberately does not import, so the typed `Context` has no
+* such property. The read goes through the REFLECTIVE `ctx.get` rather than a
+* bare property access: cordis refuses a property read for a service the fiber
+* never declared in `inject` (`cannot get property … without inject`), and an
+* unmeet seam must degrade to "no section" instead of throwing out of the
+* plugin's boot.
+*/
+function tuiSettingsService(ctx) {
+	let candidate;
+	try {
+		candidate = ctx.get("tuiSettingsSections");
+	} catch {
+		return;
+	}
+	if (typeof candidate !== "object" || candidate === null) return void 0;
+	const register = candidate.register;
+	if (typeof register !== "function") return void 0;
+	return { register: register.bind(candidate) };
+}
+/**
+* Identity of everything in the section that can change at runtime: the
+* credential reference behind the API-key field, the account slots behind the
+* active-account selector, and the stored-but-unknown allowlist entries that
+* get a checkbox of their own. Re-registration is skipped while this matches,
+* so ordinary settings writes never churn the screen's section list — the
+* checkboxes themselves read their state live and need no re-declaration.
+*/
+function sectionSignature(section) {
+	const active = section.fields.find((field) => field.path.join(".") === "activeAccount");
+	return JSON.stringify({
+		secret: section.fields.find((field) => field.secret !== void 0)?.secret?.ref ?? "",
+		options: active?.options?.map((option) => option.value) ?? [],
+		other: section.fields.filter((field) => field.group === OTHER_GROUP_ID).map((field) => field.label)
+	});
+}
+/**
+* Register the Command Code section on a dsh-TUI host.
+*
+* @param ctx - the context of an activated `tuiSettingsSections` injection.
+* @param deps - plugin-owned facts the section reads.
+* @returns a refresh function that re-registers the section when a fact it
+*   renders changed (the plugin entry calls it from its settings `onChange`
+*   hook), or `undefined` when the seam is unusable. The returned function is
+*   inert after the fiber is torn down.
+*/
+function applyCommandCodeTuiSettings(ctx, deps) {
+	const service = tuiSettingsService(ctx);
+	if (service === void 0) return void 0;
+	let disposed = false;
+	let current;
+	const refresh = () => {
+		if (disposed) return;
+		const section = buildCommandCodeTuiSection(deps);
+		const signature = sectionSignature(section);
+		if (current?.signature === signature) return;
+		current?.dispose();
+		current = void 0;
+		try {
+			current = {
+				signature,
+				dispose: service.register(section)
+			};
+		} catch (error) {
+			ctx.logger?.warn(`llm-commandcode: could not register the dsh-TUI settings section: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	};
+	refresh();
+	ctx.effect(() => () => {
+		disposed = true;
+		current?.dispose();
+		current = void 0;
+	}, "dsh-commandcode-provider: tui settings section");
+	return refresh;
+}
+//#endregion
 //#region src/index.ts
 /**
 * dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
@@ -3672,7 +4156,7 @@ const PROVIDER = "commandcode";
 const DEFAULT_MODELS_CACHE_PATH = join(homedir(), ".commandcode", "models-cache.json");
 const Config = z.object({
 	apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
-	apiKey: z.string(),
+	apiKey: z.string().role("secret"),
 	apiBase: z.string(),
 	workingDir: z.string(),
 	modelsCachePath: z.string(),
@@ -3680,11 +4164,21 @@ const Config = z.object({
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	filterModelsByPlan: z.boolean(),
 	visibleModels: z.array(z.string()),
+	/**
+	* Per-model visibility overrides for the terminal settings page's checkbox
+	* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
+	* PATH, so two checkboxes sharing one path would overwrite each other's
+	* draft and the section's last model would decide every write; a map gives
+	* each checkbox a path of its own. An id listed here wins over
+	* {@link visibleModels}; ids absent here keep following it.
+	*/
+	modelVisibility: z.dict(z.boolean()),
 	webSearch: z.boolean().default(true),
 	accounts: z.array(z.object({
 		label: z.string(),
 		apiKeyEnv: z.string().role("credential-ref"),
-		apiKey: z.string()
+		/** Literal key for one extra slot; see the top-level `apiKey` secret note. */
+		apiKey: z.string().role("secret")
 	})),
 	activeAccount: z.string(),
 	modelAccountRules: z.array(z.object({
@@ -3708,9 +4202,22 @@ function resolveAdapterOptions(config) {
 		requestTimeoutMs: config.requestTimeoutMs ?? 6e4,
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs ?? 3e5,
 		filterModelsByPlan: config.filterModelsByPlan ?? true,
-		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0
+		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : void 0,
+		modelVisibility: readModelVisibility(config.modelVisibility)
 	};
 }
+/**
+* Per-model visibility overrides, cleaned for the adapter. Programmatic
+* construction may bypass Schemastery normalization, so a non-object or a
+* non-boolean entry is dropped here instead of reaching the picker filter.
+* @param raw - The `modelVisibility` value from any config source.
+* @returns A frozen id → boolean map, or undefined when nothing is set.
+*/
+function readModelVisibility(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+	const entries = Object.entries(raw).filter((entry) => entry[0] !== "" && typeof entry[1] === "boolean");
+	return entries.length === 0 ? void 0 : Object.fromEntries(entries);
+}
 function apply(ctx, config) {
 	let current = () => config;
 	let lastRaw;
@@ -3874,6 +4381,22 @@ function apply(ctx, config) {
 			applyCommandCodeSearchSelection(webCtx.web, searchSelection, false);
 		}, "dsh-commandcode-provider: web search selection");
 	});
+	let refreshTuiSettings;
+	ctx.inject(["tuiSettingsSections"], (tuiCtx) => {
+		refreshTuiSettings = applyCommandCodeTuiSettings(tuiCtx, {
+			ns: NS,
+			apiKeyRef: () => current().apiKeyEnv ?? DEFAULT_API_KEY_ENV,
+			accountSlots: () => slots().map((slot) => ({
+				id: slot.id,
+				label: slot.label
+			})),
+			visibleModels: () => options().visibleModels ?? [],
+			modelVisibility: () => options().modelVisibility
+		});
+		tuiCtx.effect(() => () => {
+			refreshTuiSettings = void 0;
+		}, "dsh-commandcode-provider: tui settings handle");
+	});
 	ctx.inject(["settings"], (settingsCtx) => {
 		settingsCtx.settings.installSection(ctx, NS, Config, config, {
 			setSource: (source) => {
@@ -3881,11 +4404,12 @@ function apply(ctx, config) {
 			},
 			onChange: () => {
 				applySearchSelection(current().webSearch ?? true);
+				refreshTuiSettings?.();
 			}
 		});
 	});
 }
 //#endregion
-export { BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommands, applyUsageRemote, buildCommandAuthUrl, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map