@mars-sea/dsh-commandcode-provider 0.11.10 → 0.11.11

package/lib/index.d.ts

@@ -259,7 +259,7 @@ interface CommandCodePlan {
  * at all, so the degraded per-endpoint view would hide the root cause behind
  * a generic "partial data" note). Undefined for partial failures.
  */
-type UsageBlockReason = 'invalid-key' | 'service-unavailable' | 'network';
+type UsageBlockReason = 'invalid-key' | 'service-unavailable' | 'invalid-response' | 'network';
 /** Everything the usage endpoints report, fetched together. */
 interface CommandCodeUsageReport {
   account?: CommandCodeAccount;
@@ -271,8 +271,9 @@ interface CommandCodeUsageReport {
   /**
    * The single reason every endpoint failed, when they all did: `invalid-key`
    * (every call rejected with 401 — the stored key is wrong or expired),
-   * `service-unavailable` (every call answered 5xx), or `network` (no HTTP
-   * response at all). Undefined when any endpoint succeeded.
+   * `service-unavailable` (every call answered 5xx), `invalid-response`
+   * (every call answered but its body was not usable JSON), or `network`
+   * (no HTTP response at all). Undefined when any endpoint succeeded.
    */
   blocked?: UsageBlockReason;
 }
@@ -348,8 +349,8 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    * Fetch one account endpoint and parse its JSON body. Returns the HTTP
    * status alongside the parsed record so each caller applies its own
    * failure accounting: the billing probe fails open silently, the usage
-   * report books failures per endpoint. Non-2xx and non-record bodies come
-   * back without a record; only a transport throw propagates to the caller.
+   * report books failures per endpoint. Non-2xx and invalid JSON bodies come
+   * back without a record; only a fetch failure propagates to the caller.
    *
    * `timeoutMs` is the caller's budget for this one request. The default is the
    * CATALOG probe's short cap, which fits the picker's fail-open reads; the
@@ -1284,7 +1285,7 @@ declare const loginStatusSchema: TypertSchema<CommandCodeLoginStatus>;
  */
 interface LoginFlowFacade {
   /** Start (or rejoin) an attempt; rejects when it cannot start at all. */
-  begin(): Promise<CommandCodeLoginStatus>;
+  begin(targetRef?: string): Promise<CommandCodeLoginStatus>;
   /** The current attempt's status. */
   status(): CommandCodeLoginStatus;
   /** Cancel a waiting attempt. */
@@ -1361,7 +1362,7 @@ declare class CommandCodeUsageService<C extends CommandCodeConnectionOptions = C
    * (no free loopback port, disposed plugin); the Gateway folds the throw
    * into the failure branch the page renders.
    */
-  loginBegin(): Promise<CommandCodeLoginStatus>;
+  loginBegin(targetRef?: string): Promise<CommandCodeLoginStatus>;
   /** Poll a login attempt's status. */
   loginStatus(): Promise<CommandCodeLoginStatus>;
   /** Cancel a waiting attempt; returns the post-cancel status. */
@@ -1422,7 +1423,9 @@ interface CommandCodeLoginFlowDeps {
    * Receives the validated credentials after a successful login. Rejecting
    * fails the attempt with `unavailable`.
    */
-  storeKey(credentials: CommandCodeLoginCredentials): Promise<void>;
+  storeKey(credentials: CommandCodeLoginCredentials, targetRef?: string): Promise<void>;
+  /** Reject an account target that is not a saved slot before opening Studio. */
+  validateTargetRef?(targetRef: string | undefined): void;
 }
 /** Compose the Studio authorization URL (pure, exported for tests). */
 declare function buildCommandAuthUrl(options: {
@@ -1471,6 +1474,8 @@ declare class CommandCodeLoginFlow {
    * the port window so browser login dies until the Host restarts.
    */
   private starting;
+  /** A live attempt's destination; different rows may not rejoin it. */
+  private targetRef;
   /** A `cancel()` that arrived while a start was still binding (see {@link CommandCodeLoginFlow.cancel}). */
   private cancelPending;
   private disposed;
@@ -1484,7 +1489,7 @@ declare class CommandCodeLoginFlow {
    * `waiting` carrying the Studio URL once the loopback server is up.
    * Rejects only when the flow cannot start at all (no free port, disposed).
    */
-  begin(): Promise<CommandCodeLoginStatus>;
+  begin(targetRef?: string): Promise<CommandCodeLoginStatus>;
   /**
    * The binding half of {@link CommandCodeLoginFlow.begin}: one attempt, one
    * server, one published `waiting` status. Callers reach it only through

package/lib/index.js

@@ -2135,6 +2135,14 @@ function installCostProjection(ctx) {
 	});
 }
 //#endregion
+//#region src/response-encoding.ts
+/**
+* Ask Command Code for plain response bodies. A DSH host using an incompatible
+* undici global dispatcher can lose response headers and leave compressed
+* JSON, SSE, and pre-stream error bodies undecoded.
+*/
+const IDENTITY_ENCODING_HEADER = { "accept-encoding": "identity" };
+//#endregion
 //#region src/accounts.ts
 /**
 * Multi-account pool for the Command Code provider (host side).
@@ -3993,17 +4001,12 @@ function parseAccountIdentity(whoami) {
 		orgId: orgData === void 0 ? void 0 : stringValue(orgData.id)
 	};
 }
-/**
-* Classify a TOTAL failure: when every endpoint failed with one class of
-* error, the degraded per-endpoint view would hide the root cause behind
-* a generic "partial data" note — name it instead.
-*/
-function classifyTotalFailure(failures, failedStatuses) {
+function classifyTotalFailure(failures, failed) {
 	if (failures.length !== USAGE_ENDPOINT_COUNT) return void 0;
-	const codes = failedStatuses.filter((status) => status !== void 0);
-	if (codes.length === USAGE_ENDPOINT_COUNT && codes.every((code) => code === 401)) return "invalid-key";
-	if (codes.length === USAGE_ENDPOINT_COUNT && codes.every((code) => code >= 500)) return "service-unavailable";
-	if (codes.length === 0) return "network";
+	if (failed.every((item) => item.kind === "http" && item.status === 401)) return "invalid-key";
+	if (failed.every((item) => item.kind === "http" && item.status >= 500)) return "service-unavailable";
+	if (failed.every((item) => item.kind === "invalid-response")) return "invalid-response";
+	if (failed.every((item) => item.kind === "transport")) return "network";
 }
 /** Build the legacy CLI (`/alpha/generate`) request body for one call. */
 async function buildCliBody(options, connection, facts) {
@@ -4097,6 +4100,7 @@ async function connectGenerate(deps, key, protocol, body) {
 	const zdr = connection.zdr === true;
 	const headers = protocol === "cli" ? {
 		"Content-Type": "application/json",
+		...IDENTITY_ENCODING_HEADER,
 		Authorization: `Bearer ${key}`,
 		"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 		"x-cli-environment": "production",
@@ -4107,6 +4111,7 @@ async function connectGenerate(deps, key, protocol, body) {
 		...attributionHeaders()
 	} : {
 		"Content-Type": "application/json",
+		...IDENTITY_ENCODING_HEADER,
 		Authorization: `Bearer ${key}`,
 		Accept: "text/event-stream",
 		...zdr ? { "x-cmd-zdr": "1" } : {},
@@ -4314,6 +4319,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			const response = await this.fetchImpl(`${apiBase}/provider/v1/models`, {
 				headers: {
 					accept: "application/json",
+					...IDENTITY_ENCODING_HEADER,
 					...attributionHeaders()
 				},
 				signal: signal ?? AbortSignal.timeout(1e4)
@@ -4377,6 +4383,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const named = connection.apiKeyEnv;
 		return {
 			Authorization: `Bearer ${assertUsableApiKey(raw, "llm-commandcode", typeof named === "string" && named !== "" ? named : "the stored credential")}`,
+			...IDENTITY_ENCODING_HEADER,
 			"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 			"x-cli-environment": "production",
 			...attributionHeaders()
@@ -4386,8 +4393,8 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* Fetch one account endpoint and parse its JSON body. Returns the HTTP
 	* status alongside the parsed record so each caller applies its own
 	* failure accounting: the billing probe fails open silently, the usage
-	* report books failures per endpoint. Non-2xx and non-record bodies come
-	* back without a record; only a transport throw propagates to the caller.
+	* report books failures per endpoint. Non-2xx and invalid JSON bodies come
+	* back without a record; only a fetch failure propagates to the caller.
 	*
 	* `timeoutMs` is the caller's budget for this one request. The default is the
 	* CATALOG probe's short cap, which fits the picker's fail-open reads; the
@@ -4400,10 +4407,21 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			signal: AbortSignal.timeout(timeoutMs)
 		});
 		if (!response.ok) return { status: response.status };
-		const parsed = await response.json();
-		return {
+		let parsed;
+		try {
+			parsed = await response.json();
+		} catch {
+			return {
+				status: response.status,
+				invalidResponse: true
+			};
+		}
+		return isRecord(parsed) ? {
+			status: response.status,
+			record: parsed
+		} : {
 			status: response.status,
-			...isRecord(parsed) ? { record: parsed } : {}
+			invalidResponse: true
 		};
 	}
 	/**
@@ -4584,19 +4602,25 @@ var CommandCodeAdapter = class extends LlmAdapter {
 			throw error;
 		}
 		const failures = [];
-		const failedStatuses = [];
+		const failed = [];
 		const getJson = async (path) => {
 			try {
-				const { status, record } = await this.fetchEndpointJson(`${base}${path}`, headers, connection.requestTimeoutMs);
+				const { status, record, invalidResponse } = await this.fetchEndpointJson(`${base}${path}`, headers, connection.requestTimeoutMs);
 				if (record === void 0) {
-					failures.push(`${path}: HTTP ${status}`);
-					failedStatuses.push(status);
+					failures.push(`${path}: HTTP ${status}${invalidResponse ? " returned an unreadable or invalid JSON body" : ""}`);
+					failed.push(invalidResponse ? {
+						kind: "invalid-response",
+						status
+					} : {
+						kind: "http",
+						status
+					});
 					return;
 				}
 				return record;
 			} catch (error) {
 				failures.push(`${path}: ${error instanceof Error ? error.message : String(error)}`);
-				failedStatuses.push(void 0);
+				failed.push({ kind: "transport" });
 				return;
 			}
 		};
@@ -4625,7 +4649,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				currentPeriodEnd: periodEndValue(subData?.currentPeriodEnd)
 			};
 		}
-		const blocked = classifyTotalFailure(failures, failedStatuses);
+		const blocked = classifyTotalFailure(failures, failed);
 		if (blocked !== void 0) report.blocked = blocked;
 		return report;
 	}
@@ -5438,6 +5462,7 @@ const commandcodeCommand = {
 		unconfigured: "  (未配置 API 密钥)",
 		blockedInvalidKey: "⛔ API 密钥无效或已过期 — 服务端拒绝了全部请求（401），请检查该账户的密钥配置",
 		blockedServiceUnavailable: "⚠️ Command Code 服务暂时不可用（5xx），稍后重试",
+		blockedInvalidResponse: "⚠️ Command Code 返回了无法读取的响应 — 请检查宿主的 HTTP 代理或响应解压配置",
 		blockedNetwork: "⚠️ 无法连接 Command Code 服务 — 请检查网络或 API 地址",
 		planLine: "  📦 套餐    {name}{status}{period}",
 		planPeriodSuffix: " · 账期截止 {date}",
@@ -5469,6 +5494,7 @@ const commandcodeCommand = {
 		unconfigured: "  (no API key configured)",
 		blockedInvalidKey: "⛔ API key invalid or expired — the server rejected every request (401); check the key configured for this account",
 		blockedServiceUnavailable: "⚠️ Command Code service temporarily unavailable (5xx); try again later",
+		blockedInvalidResponse: "⚠️ Command Code returned an unreadable response — check the host HTTP proxy or response decoding",
 		blockedNetwork: "⚠️ could not reach the Command Code service — check your network or the API base setting",
 		planLine: "  📦 Plan     {name}{status}{period}",
 		planPeriodSuffix: " · period ends {date}",
@@ -5567,6 +5593,7 @@ function renderReport(report, locale, title) {
 	lines.push(title ?? commandCopy(locale, "title").replace("{account}", account), "");
 	if (report.blocked === "invalid-key") lines.push(commandCopy(locale, "blockedInvalidKey"), "");
 	else if (report.blocked === "service-unavailable") lines.push(commandCopy(locale, "blockedServiceUnavailable"), "");
+	else if (report.blocked === "invalid-response") lines.push(commandCopy(locale, "blockedInvalidResponse"), "");
 	else if (report.blocked === "network") lines.push(commandCopy(locale, "blockedNetwork"), "");
 	if (report.plan && report.plan.name !== "") {
 		const p = report.plan;
@@ -5668,6 +5695,15 @@ function makeBoundaryValidator(prefix) {
 		booleanField
 	};
 }
+/** Use the same strict-codec shape for invocation parameters and results. */
+function makeStrictCodec(typeSymbol, schema) {
+	return {
+		mode: "strict",
+		typeSymbol,
+		schema,
+		create: () => schema
+	};
+}
 /**
 * Build one strict invocation descriptor. Every Command Code Remote shares the
 * `commandcode` namespace, the `commandcodeUsage` service, and a strict
@@ -5676,12 +5712,7 @@ function makeBoundaryValidator(prefix) {
 * only its own facts.
 */
 function makeRemoteDescriptor(endpoint, method, typeSymbol, schema) {
-	const result = {
-		mode: "strict",
-		typeSymbol,
-		schema,
-		create: () => schema
-	};
+	const result = makeStrictCodec(typeSymbol, schema);
 	return {
 		id: `${REMOTE_PACKAGE}#${endpoint}`,
 		service: REMOTE_SERVICE,
@@ -5734,7 +5765,7 @@ function parseUsageReport(value) {
 	const report = { failures };
 	if (source.blocked !== void 0) {
 		const blocked = source.blocked;
-		if (blocked === "invalid-key" || blocked === "service-unavailable" || blocked === "network") report.blocked = blocked;
+		if (blocked === "invalid-key" || blocked === "service-unavailable" || blocked === "invalid-response" || blocked === "network") report.blocked = blocked;
 		else reject$1("blocked");
 	}
 	if (source.account !== void 0) {
@@ -5963,9 +5994,24 @@ function parseLoginStatus(value) {
 }
 /** The strict result codec shared by all three login endpoints. */
 const loginStatusSchema = { parse: parseLoginStatus };
-/** Build one login invocation descriptor (uniform result, no parameters). */
+/** Optional account target; the Host still checks it against saved slots. */
+const loginTargetSchema = { parse(value) {
+	if (value === void 0 || typeof value === "string") return value;
+	return reject("targetRef");
+} };
+/** Build one login invocation descriptor. Only begin accepts an account ref. */
 function loginDescriptor(endpoint, method) {
-	return makeRemoteDescriptor(endpoint, method, `${REMOTE_PACKAGE}#CommandCodeLoginStatus`, loginStatusSchema);
+	const descriptor = makeRemoteDescriptor(endpoint, method, `${REMOTE_PACKAGE}#CommandCodeLoginStatus`, loginStatusSchema);
+	return method === "loginBegin" ? {
+		...descriptor,
+		parameters: [{
+			name: "targetRef",
+			wire: "targetRef",
+			source: "json",
+			codec: makeStrictCodec(`${REMOTE_PACKAGE}#CommandCodeLoginTargetRef`, loginTargetSchema),
+			acceptsUndefined: true
+		}]
+	} : descriptor;
 }
 /** The three login descriptors, shared verbatim by Host registration and Client mount. */
 const LOGIN_DESCRIPTORS = [
@@ -6033,8 +6079,8 @@ var CommandCodeUsageService = class extends TypertRemoteService {
 	* (no free loopback port, disposed plugin); the Gateway folds the throw
 	* into the failure branch the page renders.
 	*/
-	async loginBegin() {
-		return this.requireLogin().begin();
+	async loginBegin(targetRef) {
+		return this.requireLogin().begin(targetRef);
 	}
 	/** Poll a login attempt's status. */
 	async loginStatus() {
@@ -6121,6 +6167,12 @@ const LOGIN_ALLOWED_ORIGINS = [
 ];
 /** The Studio route that performs the browser-side login. */
 const STUDIO_AUTH_PATH = "/studio/auth/cli";
+/** Resolve a browser-login destination without allowing arbitrary credential writes. */
+function loginCredentialRef(targetRef, defaultRef, accounts) {
+	if (targetRef === void 0) return defaultRef;
+	if (targetRef === defaultRef || !accounts.some((account) => account.apiKeyEnv === targetRef)) throw new Error("the target account must be saved before browser sign-in");
+	return targetRef;
+}
 /** Compose the Studio authorization URL (pure, exported for tests). */
 function buildCommandAuthUrl(options) {
 	const callback = `http://localhost:${options.port}/callback`;
@@ -6143,6 +6195,7 @@ async function validateCommandApiKey(fetchImpl, apiBase, apiKey) {
 			method: "GET",
 			headers: {
 				"Content-Type": "application/json",
+				...IDENTITY_ENCODING_HEADER,
 				Authorization: `Bearer ${apiKey}`
 			}
 		});
@@ -6210,6 +6263,8 @@ var CommandCodeLoginFlow = class {
 	* the port window so browser login dies until the Host restarts.
 	*/
 	starting;
+	/** A live attempt's destination; different rows may not rejoin it. */
+	targetRef;
 	/** A `cancel()` that arrived while a start was still binding (see {@link CommandCodeLoginFlow.cancel}). */
 	cancelPending = false;
 	disposed = false;
@@ -6230,12 +6285,20 @@ var CommandCodeLoginFlow = class {
 	* `waiting` carrying the Studio URL once the loopback server is up.
 	* Rejects only when the flow cannot start at all (no free port, disposed).
 	*/
-	async begin() {
+	async begin(targetRef) {
 		if (this.disposed) throw new Error("login flow has been disposed");
-		if (this.statusValue.state === "waiting" && this.server !== void 0) return this.statusValue;
-		if (this.starting !== void 0) return this.starting;
+		this.deps.validateTargetRef?.(targetRef);
+		if (this.statusValue.state === "waiting" && this.server !== void 0) {
+			if (this.targetRef !== targetRef) throw new Error("another account login is already in progress");
+			return this.statusValue;
+		}
+		if (this.starting !== void 0) {
+			if (this.targetRef !== targetRef) throw new Error("another account login is already in progress");
+			return this.starting;
+		}
 		this.cancelPending = false;
-		const starting = this.startAttempt();
+		this.targetRef = targetRef;
+		const starting = this.startAttempt(targetRef);
 		this.starting = starting;
 		try {
 			return await starting;
@@ -6248,7 +6311,7 @@ var CommandCodeLoginFlow = class {
 	* server, one published `waiting` status. Callers reach it only through
 	* `begin()`'s single-flight fence.
 	*/
-	async startAttempt() {
+	async startAttempt(targetRef) {
 		this.teardown();
 		const attempt = ++this.attemptSeq;
 		const port = await this.findPort();
@@ -6288,7 +6351,7 @@ var CommandCodeLoginFlow = class {
 			});
 		}, this.deps.timeoutMs ?? 12e4);
 		this.timer.unref?.();
-		settled.then((credentials) => this.complete(attempt, credentials), (failure) => this.failFrom(attempt, failure));
+		settled.then((credentials) => this.complete(attempt, credentials, targetRef), (failure) => this.failFrom(attempt, failure));
 		return this.statusValue;
 	}
 	/**
@@ -6467,7 +6530,7 @@ var CommandCodeLoginFlow = class {
 	* would report "cancelled" while the credential landed anyway, and the page
 	* would silently flip to success.
 	*/
-	async complete(attempt, credentials) {
+	async complete(attempt, credentials, targetRef) {
 		if (!this.ownsAttempt(attempt)) return;
 		const validation = await validateCommandApiKey(this.deps.fetchImpl ?? fetch, this.readApiBase(), credentials.apiKey);
 		if (!this.ownsAttempt(attempt)) return;
@@ -6482,7 +6545,8 @@ var CommandCodeLoginFlow = class {
 		}
 		if (!this.ownsAttempt(attempt)) return;
 		try {
-			await this.deps.storeKey(credentials);
+			this.deps.validateTargetRef?.(targetRef);
+			await this.deps.storeKey(credentials, targetRef);
 		} catch (error) {
 			if (!this.ownsAttempt(attempt)) return;
 			this.setStatus({
@@ -6732,6 +6796,7 @@ var CommandCodeSearchProvider = class {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
+					...IDENTITY_ENCODING_HEADER,
 					Authorization: `Bearer ${key}`,
 					"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 					"x-cli-environment": "production",
@@ -7572,6 +7637,7 @@ async function runSystemOne(deps, request, options = {}) {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
+					...IDENTITY_ENCODING_HEADER,
 					Authorization: `Bearer ${key}`,
 					"x-command-code-version": COMMAND_CODE_CLI_VERSION,
 					...attributionHeaders()
@@ -8398,8 +8464,11 @@ function apply(ctx, config) {
 	});
 	const loginFlow = new CommandCodeLoginFlow({
 		apiBase: () => options().apiBase,
-		storeKey: async ({ apiKey }) => {
-			const ref = credentialRef(current().apiKeyEnv ?? DEFAULT_API_KEY_ENV);
+		validateTargetRef: (targetRef) => {
+			loginCredentialRef(targetRef, current().apiKeyEnv ?? DEFAULT_API_KEY_ENV, current().accounts ?? []);
+		},
+		storeKey: async ({ apiKey }, targetRef) => {
+			const ref = credentialRef(loginCredentialRef(targetRef, current().apiKeyEnv ?? DEFAULT_API_KEY_ENV, current().accounts ?? []));
 			const credentials = ctx.get("credentials");
 			if (credentials === void 0) throw new Error("the credentials service is unavailable in this profile; paste the key manually");
 			await credentials.set(ref, apiKey);