@mars-sea/dsh-commandcode-provider 0.10.6 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.11.0] - 2026-09-15
+
+### Added
+- **A plans & quota card in the sidebar and a dashboard behind it.** The bottom of the sidebar now carries a Command Code card — directly above Settings — showing the serving account's plan and both quota windows (5-hour and weekly) with their spend and limits. Clicking it opens a dashboard in the center column with the plan badge and billing period, the two windows as progress bars with reset times, monthly credit consumption, and the purchased/free credit balances. Both surfaces are driven by the same Host-side usage report the settings page's account card already uses, so no key ever reaches the browser, and the panel refreshes itself in the background on a 2-minute tick while it is on screen. The card is English by construction rather than following the harness language. It needs a harness whose layout can select a center panel — dsh 0.1.5 (rc.1) or newer: on an older engine the card is not registered at all, because a button that opens nothing is worse than no button, and every other screen is unaffected. Ported from [#36](https://github.com/Mars-Sea/dsh-commandcode-provider/pull/36) by [@xer-on](https://github.com/xer-on).
+
+- **The composer now shows a published-rate estimate for the current session.** Under the input, next to the harness's own token counter, a session served by Command Code gains an amount (for example `1.2M tokens · Cache hit 87% · ≈$0.02`), and the token-usage dialog the counter opens gains a price per row (uncached input, completion, cache read). The figures are computed from the session's own token buckets against Command Code's published per-token rates, including the peak/off-peak halves of the hourly-priced DeepSeek models. The readout decorates the harness's counter instead of replacing it, so the existing token/cache-hit/throughput figures and their translations stay exactly as they are. Three rules keep it honest: only Command Code sessions are priced, a model with no published cache-write rate says so rather than guessing a multiplier, and a session with nothing to price (no usage yet, an unknown model) renders no figure at all instead of a misleading `$0.00`. Ported from [#36](https://github.com/Mars-Sea/dsh-commandcode-provider/pull/36) by [@xer-on](https://github.com/xer-on).
+
+### Changed
+- **Synced with the official command-code@1.54.0 CLI** (2026-09-13, one CLI-local item: first-class herdr support — a `/herdr` command plus idle/working/blocked reporting to a herdr pane over its UNIX socket, live only when `HERDR_ENV`/`HERDR_SOCKET_PATH`/`HERDR_PANE_ID` are all set, with `CMD_HERDR=0` to disable). `COMMAND_CODE_CLI_VERSION` is now `1.54.0`. Static inspection of both bundles finds no data or protocol drift: the entire 1.53.1 → 1.54.0 bundle difference is that feature plus the version constant, and the model registry (75 entries), per-model effort map, subscription plan maps, every plan tier, every deal, and the peak/off-peak membership and schedule are byte-identical. The public catalog still serves the same 69 models (`gpt-6-astra` remains a CLI/pricing/docs-only model, absent from the public Provider catalog, as before) and the vendored price table is unchanged (`node scripts/sync-model-prices.mjs --check` reports no drift). No shipped behavior changed: the version rides every request as `x-command-code-version`.
+- **The model price table is served to the browser over a new `commandcode/prices` Remote.** The official per-token rates (input, output, cache-read, cache-write where published, plus the peak-hour override for the hourly-priced models) are vendored Host-side and reach the composer through the existing `commandcodeUsage` service, so the browser bundle carries no copy that could drift and a price row reaches an open page without a rebuild. A price row whose catalog name differs from the pricing page's slug (a vendor prefix, a dated suffix) is matched automatically, and a model the page does not price renders no cost rather than a guess. The table is pinned against the catalog by `tests/model-prices.test.ts`, which fails when a catalog model has no price — the visible decision point when upstream adds a model. It is refreshed with `node scripts/sync-model-prices.mjs`, which re-reads the page, cross-checks the embedded rates against the page's own rendered table and rewrites only the rows (`--check` reports drift without writing).
+
+### Fixed
+- **Free usage mixed with unpriced usage no longer displays a zero subtotal.** Purely free sessions retain `Free`, while partial sessions need positive priced spend before a figure is shown.
+- **The settings usage card also resolves availability from the Host.** Literal and CLI-auth keys can fetch and refresh usage without a browser credential reference. The slash command omits its balance ratio when either input is unreported or the denominator is zero, and displays a single percent sign for known ratios.
+
+- **Session estimates preserve each request's model and time across reloads and model switches.** An optional Host projection replays durable usage, including failed attempts and retry replacement rules; all eight context-tiered price rows retain their bands. Missing history hides the estimate, and unpriced or other-provider usage is labeled as a subtotal. The result uses the installed published-rate snapshot, not the provider invoice.
+- **Quota refresh resolves credentials on the Host**, including literal config keys and CLI-auth fallback. Omitted purchased/free balances remain unknown instead of appearing as zero.
+- **Transient price-table failures retry automatically** three times with bounded backoff. Host rebinds invalidate stale results; manual refresh remains available after retries are exhausted.
+
+- **A session cost on a model with no published cache-write rate no longer shows `$0.00`.** If every billed token was one the price table has no rate for, the total was zero for lack of a rate rather than for lack of spending, and the readout announced a confident `$0.00`. It now renders nothing, exactly as it already did for an unknown model. Relatedly, a cache-write row whose rate IS published is no longer hidden from the usage dialog: its cost was already part of the total above it, so dropping the row left the visible figures unable to explain the amount.
+
+- **The plans panel no longer reports a failed billing call as a fully consumed quota.** The credits endpoint is fetched in parallel with the plan and can fail on its own; the monthly balance then arrived as an absent number, which the panel read as `0` and turned into "100% used, quota exhausted" — with purchased/free tiles showing balances that were never fetched. Unreported figures now render as a dash, and the quota bar is simply not drawn until both halves of the ratio are known. Only the quota windows the endpoint actually reported get a row, so an unlimited plan no longer shows two fabricated 0%-of-limit meters.
+
+- **The hourly-priced DeepSeek V4 Flash Vision (exp) is priced at its published rate.** The table carried `$0.22 / $0.66 / $0.003`, which is ~47% above the official `$0.15 / $0.60 / $0.003` (peak `$0.30 / $1.20`). Every session cost and per-row price for that model was overstated; the row now matches the page and `scripts/sync-model-prices.mjs` cross-checks the table against the page's rendered rates so the same class of error is caught at sync time.
+- **A transient provider failure no longer ends the turn without a retry.** Command Code's gateway reports a temporarily unavailable upstream *before* the response stream starts: a 520 whose body is only `{"error":{"message":"Upstream model provider is temporarily unavailable. Please try again in a moment.","type":"server_error"}}` — no machine-readable `error.code`. Every status other than 401/413/429 was mapped to `PROVIDER_HTTP_ERROR`, and the route's retry policy whitelists only `EMPTY_RESPONSE`/`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT` (dsh-llm-retry matches the failure code and nothing else), so the one class of failure that explicitly asks to be retried was the only one that never was — while the identical status arriving as an in-band stream `error` event was already classified as retryable `SERVER`. Pre-stream 5xx now maps to `SERVER` and 408 to `TIMEOUT`, so a 520 waits out the blip (500 ms doubling to the 15-minute cap) instead of failing the turn; 4xx stays permanent, because resending a plan or model rejection byte-for-byte cannot succeed.
+- **A long session no longer dies with HTTP 413 once its images outgrow the request cap** ([#37](https://github.com/Mars-Sea/dsh-commandcode-provider/issues/37)). Both transports inline every historical image as base64, and nothing ever reclaims that history, so a session that accumulated enough screenshots — the report's example is a vision self-check loop reading back 57 of them — crossed the gateway's request-body limit (measured at ≈50.17 MB; Command Code documents no 413 at all) and from then on failed **every** request on this route, permanently for that conversation, while the same history worked on any other provider. The adapter now sends a budgeted projection of the history instead of the raw one: the oldest images past the budget travel as model-visible placeholders that name the attachment (the harness's own `offloadRequestImagesWithPolicy` + `offloadedImageText` mechanism, the same one `dsh-llm-deepseek` and `dsh-llm-pi-ai` use) and the newest keep their pixels, so the session continues instead of ending. The standing budget is 32 MiB of base64 images and 60 images, evicted in 16 MiB / 30-image steps so the removed prefix stays stable between requests. A tool-returned image dropped this way becomes the placeholder text of its own tool result, so the model reads why the image is missing instead of a result that points at pixels that never arrive.
+- **A 413 now repairs itself once, and explains itself when it cannot.** The cap also covers text and tool bytes, so a budget alone cannot be exact: when the gateway actually answers 413, the request is rebuilt with a much tighter image budget (8 MiB / 12 images) and resent on the same account before anything has streamed — invisible to the caller, and bounded to that single retry. When even that is refused, or when the history carries no images to drop, the failure is now reported as the request-size limit it is, in both languages, instead of a bare `HTTP 413` indistinguishable from a generic provider error.
+- **A request that outgrew the model's context window no longer retries forever** ([#39](https://github.com/Mars-Sea/dsh-commandcode-provider/issues/39)). In a long session (the report measures roughly 500k tokens) Command Code rejects the request, and that rejection reached the adapter in a shape it did not recognize: delivered in-band it became a retryable `SERVER`, so the byte-identical oversized request was resent up to the 1000-attempt cap with waits doubling to 15 minutes and the session could never continue — `/compact` only appeared to fix it because it shrank the request. A context-window rejection is now reported as the harness's own `CONTEXT_WINDOW_EXCEEDED`, whichever way it arrives (a pre-stream 400/403/413/422 body that names the window, or an in-band `error` event on either transport), so the harness's context-overflow recovery compacts the session and retries the reduced surface — the same recovery the official CLI performs for this wording (its non-retryable `truncated` kind, which it answers with "Compacting and retrying"). The wording decides before the status does, so a 5xx that carries this message is not retried unchanged either, and a pre-stream 413 whose body does *not* name the context window keeps the request-size diagnosis above.
+- **The Provider API transport no longer loses a mid-stream error.** The OpenAI-format SSE reports a failure as an `error` member of a chunk rather than as an event type of its own, and the handler ignored anything without `choices` — so the stream simply ended and the caller saw a generic, retryable `EMPTY_RESPONSE` while the real cause (a context-window rejection, an exhausted balance, a plan error) was discarded. Both transports now share one classifier, so the same failure cannot be classified two different ways depending on which endpoint served it.
+
 ## [0.10.6] - 2026-09-12
 
 ### Fixed

package/README.md

@@ -27,6 +27,8 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 - **Plan-aware picker** — models above your subscription tier are hidden by default (toggleable); an optional **Model allowlist** keeps only your favorites in the picker.
 - **Reasoning-effort support** — models with selectable reasoning effort levels expose them in the picker.
 - **Image input** — Vision-capable models accept images.
+- **Plans & quota panel** — a Command Code card at the bottom of the sidebar (directly above Settings) shows the serving account's plan and its 5-hour and weekly windows; clicking it opens a dashboard with the billing period, both windows as progress bars with reset times, monthly credit consumption, and the purchased/free balances. Needs dsh 0.1.5 (rc.1) or newer, and reads in English on every harness language.
+- **Session cost estimate** — published-rate estimates (`≈`) beside the composer token counter and in its usage dialog, using each request's model, request time and context tier from durable session history. Model switches and viewing the session later do not reprice earlier requests. Mixed-provider or unpriced usage shows a labeled subtotal (`≥`); missing history or wholly unpriceable usage stays hidden. These are estimates from the installed price snapshot, not provider invoices. Also English on every harness language.
 - **Web search** — the dsh `web_search` tool is backed by the Command Code Provider API (`/alpha/web-search`) with the same key/endpoint as chat, so no separate search key or base URL is needed. See [Web search](#web-search).
 
 See [Screenshots](#screenshots) below for what the UI looks like.
@@ -52,7 +54,7 @@ Pick the release line that matches your DeepSeek Harness version:
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.10.6
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.0
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -71,7 +73,7 @@ dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      #
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.10.6
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.0
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -100,7 +102,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.10.6
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.0
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -216,6 +218,7 @@ When your deployment's dsh shell mounts the web capability (`@deepseek-ai/dsh-we
 
 - **Image input is model-gated** — only Vision models accept images; text-only models refuse them.
 - Switching to a text-only model in an image-bearing session is rejected by dsh — pick a model marked *`Image`* or remove the images first.
+- **Long image-heavy sessions keep working** — the provider caps the size of a single request (around 50 MB, and it is undocumented), so a session that accumulates many screenshots would otherwise start failing every request once it grew past that. The oldest images beyond the budget are replaced by a short "image omitted" note that names the attachment, the newest ones are sent as usual, and a request the provider still rejects as too large is retried once with a much smaller image budget before failing.
 - **No `stop` sequences** — requests carrying one fail.
 - Historical reasoning is replayed on both transports so a tool-calling loop keeps its chain of thought: `/provider/v1/chat/completions` passes it back as `reasoning_content`, and `/alpha/generate` carries it as a `reasoning` block inside the rebuilt assistant turn (the shape the official CLI sends) — a DeepSeek thinking-mode tool loop is rejected without it. Only tool calls with a paired tool result are replayed on either transport.
 - Every tool's parameter schema is normalized to the object root the provider requires, so a tool declared without one (a third-party plugin's hand-written schema, an MCP server's own `inputSchema`, a generated root `$ref`) no longer fails the whole turn with `schema must be a JSON Schema of 'type: "object"'`.

package/README.zh-CN.md

@@ -27,6 +27,8 @@
 - **按套餐过滤**：默认隐藏超出订阅套餐的模型，可一键关闭；「模型白名单」可进一步只保留常用模型。
 - **推理强度支持**：支持推理强度的模型可在选择器中选择档位。
 - **图片输入**：Vision 模型支持发送图片。
+- **套餐与配额面板**：侧边栏底部（Settings 正上方）新增 Command Code 卡片，显示当前服务账号的套餐与 5 小时 / 每周两个配额窗口；点击后在中间栏打开面板，包含计费周期、两个窗口的进度条与重置时间、月度额度消耗，以及已购买 / 赠送余额。需要 dsh 0.1.5（rc.1）或更高版本；无论 Harness 语言如何，该面板固定为英文。
+- **会话费用估算**：在输入框下方的 token 计数旁及用量对话框中显示估算金额（`≈`），根据持久化历史中每次请求的模型、请求时间和上下文阶梯分别计价。切换模型或稍后查看不会重新定价之前的请求。混合供应商或缺少费率时显示已定价部分的小计（`≥`）；缺少历史事实或完全无法定价时不显示金额。结果基于插件内的价格快照，不等同于供应商账单。同样固定为英文。
 - **联网搜索**：dsh 的 `web_search` 工具由 Command Code Provider API（`/alpha/web-search`）承载，复用聊天同一个 key 与端点，无需单独配置搜索 key 或地址。详见[联网搜索](#联网搜索)。
 
 ## 安装
@@ -50,7 +52,7 @@
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.10.6
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.0
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -69,7 +71,7 @@ dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      #
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.10.6
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.0
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -98,7 +100,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.10.6
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.0
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -214,6 +216,7 @@ llm-commandcode:
 
 - **图片输入按模型能力限制**：仅 Vision 模型接受图片，纯文本模型会直接拒绝。
 - 含图片的会话切换到纯文本模型会被 dsh 拒绝——请改选带 *`Image`* 标记的模型，或先移除图片。
+- **图片很多的长会话不会中途失效**：服务端对单次请求体有大小上限（约 50 MB，官方未公开），会话累积大量截图后，原本会在此后每一次请求都失败。现在超出预算的最旧图片会被替换成一段标明附件的"图片已省略"文字，较新的图片照常发送；若请求仍被判为过大，会先以更小的图片预算重试一次，再报错。
 - **不支持 `stop` 序列**：携带它的请求会报错。
 - 在旧版 `/alpha/generate` 传输中，推理块不会重放到后续轮次；在 `/provider/v1/chat/completions` 传输中，历史推理会以 `reasoning_content` 回传，以便工具调用循环保留思维链。两种传输都只重放带配对工具结果的工具调用。
 - 模型目录无需 key 即可浏览；对话请求需要 key。