@mars-sea/dsh-commandcode-provider 0.11.10 → 0.11.12

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.12] - 2026-09-24
+
+### Changed
+
+- **This release supports dsh 0.1.7-rc.1 alone, and the two-generation compatibility code is gone.** The plugin has carried a bridge between two Harness generations — the 0.1.2-0.1.6 line (settings.yaml document, `LegacySettingsSchema`, the pre-0.1.7 ApiProxy credential path, `legacy-credentials.ts`) and the 0.1.7 settings world (schema-derived Config forms, volatile fields, the `remote.settings` client scope) — and every release since 0.11.9 has paid for it twice: two schema registrations, two credential paths, a peer range that admitted nine engines and could pair with none of them exactly. This release drops the older line: every `@deepseek-ai/*` peer, `dsh.compatibility.dsh`, `engines.dsh` and the single `dshReleases` record now name `^0.1.7-rc.1` — a range semver resolves to that one release and nothing else — and `@deepseek-ai/schemastery` is tightened from `^3.18.2` to `~3.18.4`, because the unconditional `.volatile()` marking needs schemastery 3.18.3+ and a profile resolving 3.18.2 would mark nothing and render a blank settings form. The bridge itself is deleted, not disabled: `LegacySettingsSchema` and the duplicated config-fields factory (one schema now — every field volatile except the `apiKey` secret), `src/client/legacy-credentials.ts` and its tests, the deprecated `selectCommandCodeSearchProvider()` export (removed in command-code upstream and long superseded by `applyCommandCodeSearchSelection()`), and the legacy branches of the engine-load and install smoke scripts. **If you run dsh 0.1.2–0.1.6, stay on 0.11.11** (the 0.5.0-era Harness line's last release is 0.9.1); both are installed by exact version and unmaintained. On 0.1.7-rc.1 nothing changes behaviorally — same surfaces, same wire — the bundle is simply smaller and the pairing exact. `npm run test:engine` passes against 0.1.7-rc.1 (the published surface links and evaluates there — the durable request-image policy included — and the adapter is driven with the engine's own message constructors), and `npm run test:install` passes the pnpm 10 marketplace-generation smoke against the new peer metadata.
+
+- **Synced with the official command-code@1.65.0 CLI** (2026-09-24 check of the npm `latest`; the official changelog page and RSS still top out at 1.64.0, so the evidence is the bundle diff, the live catalog and the pricing/docs pages). `COMMAND_CODE_CLI_VERSION` is now `1.65.0`. The release is additive with exactly one change: the CLI registry gains `stealth/space-bunny-alpha` (Space Bunny Alpha) — OpenRouter-served (`chatComplete`), text+image, 1M context, reasoning with the selectable `low`/`medium`/`high` set, available on every plan from Go up, and **free while the stealth preview lasts**. The public catalog serves it too (81 models, 80 + this one), so the picker shows it as `Go · FREE · Image` at $0 rates through the price table's free-model branch — no vendored price row, exactly like the other free models. It is also the **first change to the ZDR exception set since the 1.62.0 check**: the CLI's `modelSupportsZdr`/`knownModelSupportsZdr` negation sets both carry it and the pricing page says it plainly ("Not routed under ZDR"), so `KNOWN_NON_ZDR_MODELS` grows 20 → 21 and `tests/zdr.test.ts` pins the new membership deliberately. Everything else re-verified unchanged: the effort map (one key added, none edited), the Vision set, the plan tiers (no tier moves; the map is 51/58/71/81), the subscription-plan maps, every deal and price, the peak membership and schedule, and the whole wire protocol — every `/alpha/*` and `/provider/v1/*` call site, the `x-command-code-version` / `x-cmd-zdr` header table, the stream vocabulary and the browser-login flow are identical between the 1.64.0 and 1.65.0 bundles apart from minifier renames. The bundle does add a `/alpha/sandbox/*` route family, which belongs to the CLI's own remote-sandbox feature and is never called by this adapter.
+
+## [0.11.11] - 2026-09-23
+
+### Fixed
+
+- **Saving account-rotation edits is visible on a long settings page** ([#60](https://github.com/Mars-Sea/dsh-commandcode-provider/issues/60)). The page's single global Save/Discard bar stays inside the settings panel, attached to the bottom of its scrolling area. A new account can be saved with only a label, then signed in through the same browser authorization flow as the default account; the Host writes the resulting key to that saved account's credential reference. Login attempts for different accounts cannot silently rejoin one another.
+
+- **Command Code responses remain readable when a DSH HTTP dispatcher passes through compressed bytes** ([#59](https://github.com/Mars-Sea/dsh-commandcode-provider/issues/59)). Host-side chat, account usage, catalog, web search, decision, and login requests now ask for `Accept-Encoding: identity`. This also lets a Go account's `403 upgrade_required` body reach the existing CLI-transport fallback. If every usage endpoint answers but its body still cannot be parsed, the account view reports an unreadable response instead of claiming that no request reached the server.
+
 ## [0.11.10] - 2026-09-23
 
 ### Added

package/README.md

@@ -27,7 +27,7 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 - **Plan-aware picker** — models above your subscription tier are hidden by default (toggleable); an optional **Model allowlist** keeps only your favorites in the picker.
 - **Reasoning-effort support** — models with selectable reasoning effort levels expose them in the picker.
 - **Image input** — Vision-capable models accept images.
-- **Plans & quota panel** — an optional Command Code card at the bottom of the sidebar (directly above Settings) shows the serving account's plan and its 5-hour and weekly windows; clicking it opens a dashboard with the billing period, both windows as progress bars with reset times, monthly credit consumption, and the purchased/free balances. The dashboard's **×** button hands the center column back to your conversation (the current session is untouched). **Off by default** — turn on *"Show the quota card in the sidebar"* under **Settings → Command Code → Advanced** to show it, and the same switch hides it again (a hidden card draws nothing at all and runs no background usage poll); the change lands as soon as you save. The panel follows your harness language (中文 / English) and needs dsh 0.1.5 (rc.1) or newer.
+- **Plans & quota panel** — an optional Command Code card at the bottom of the sidebar (directly above Settings) shows the serving account's plan and its 5-hour and weekly windows; clicking it opens a dashboard with the billing period, both windows as progress bars with reset times, monthly credit consumption, and the purchased/free balances. The dashboard's **×** button hands the center column back to your conversation (the current session is untouched). **Off by default** — turn on *"Show the quota card in the sidebar"* under **Settings → Command Code → Advanced** to show it, and the same switch hides it again (a hidden card draws nothing at all and runs no background usage poll); the change lands as soon as you save. The panel follows your harness language (中文 / English).
 - **Session cost estimate** — published-rate estimates (`≈`) beside the composer token counter and in its usage dialog, using each request's model, request time and context tier from durable session history. Model switches and viewing the session later do not reprice earlier requests. Mixed-provider or unpriced usage shows a labeled subtotal (`≥`); missing history or wholly unpriceable usage stays hidden. These are estimates from the installed price snapshot, not provider invoices. Also English on every harness language.
 - **Web search** — the dsh `web_search` tool is backed by the Command Code Provider API (`/alpha/web-search`) with the same key/endpoint as chat, so no separate search key or base URL is needed. See [Web search](#web-search).
 
@@ -35,26 +35,29 @@ See [Screenshots](#screenshots) below for what the UI looks like.
 
 ## Install
 
-Pick the release line that matches your DeepSeek Harness version:
+This release supports **dsh 0.1.7-rc.1 and nothing else** — the plugin's peer
+range is that one version, and its compatibility record names it alone:
 
-- **dsh 0.1.2-rc.1 or later** (the current 0.1.2 line — what `@latest` installs today):
-
-  ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
-  ```
+```sh
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
+```
 
-- **Older dsh releases** (the 0.5.0 line and earlier, which use the rc-era Host/browser APIs) — the last plugin version supporting them is 0.9.1, installed by exact version. That line is no longer under active maintenance:
+- **Older dsh releases.** The 0.1.2–0.1.6 line is no longer supported: those
+  engines predate the 0.1.7 settings rewrite, the `RequestMessage` envelope, and
+  the durable image-offload contract, and the compatibility code that bridged
+  the two was removed. The last plugin release covering them is 0.11.11; the
+  0.5.0-era Harness line's last release is 0.9.1. Both are installed by exact
+  version and neither is maintained:
 
   ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11   # dsh 0.1.2–0.1.6
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1     # dsh 0.5.0 line
   ```
 
-> The `latest` tag points at the current 0.1.2-line plugin release. Users on the old 0.5.0-era Harness line must pin `@0.9.1` explicitly.
-
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.9
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -66,14 +69,14 @@ Fresh pnpm 10 marketplace generations are supported directly. Do not add a separ
 Update with the same tag you installed with:
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.2-rc.1+
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # older dsh (0.5.0 line, unmaintained)
 ```
 
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.9
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -102,7 +105,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.9
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -140,7 +143,7 @@ cmd login                               # writes ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**Engine version.** The plugin needs a dsh engine that exports `ToolCallId` from `@deepseek-ai/dsh-llm` — **dsh 0.1.2-alpha.3 or later**. That includes the engine dsh-TUI recommends (0.1.2-rc.1) and every later release, but *not* the oldest engines its peer range nominally allows: on dsh 0.1.0-rc.6 or 0.1.1-rc.2 the plugin's module import fails and the TUI will not start. Upgrade the engine, or use the web profile.
+**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.1**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.1` (semver resolves that to 0.1.7-rc.1 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
 
 ## Usage dashboard
 
@@ -156,7 +159,7 @@ The command's user-facing copy follows the shell's locale: explicit `lang: 'en'
 
 With several Command Code subscriptions, the plugin **switches to the next account automatically** when one hits its usage limit:
 
-- **Setup** — use the **Account rotation** card at Settings → **Command Code** to add accounts with a label and API key; the top-level key always serves first as the `default` account.
+- **Setup** — use the **Account rotation** card at Settings → **Command Code** to add an account and label it. Paste its API key, or use the page's global **Save** button, then **Sign in to Command Code** and open the authorization link shown on that account's row in a new browser tab. The global Save/Discard bar stays inside the settings panel, attached to the bottom of its scrolling area. The top-level key always serves first as the `default` account.
 - **Manual switching** — the **Active account** dropdown pins a preferred account; if it is exhausted, requests fall back to other accounts and return once its window resets.
 - **Route models to accounts** — the **Route models to accounts** card picks catalog models (multi-select, fetched from the live catalog) and routes them to an account. A request whose model is in a rule serves from that account while it is usable; an exhausted or invalid routed account falls back to the normal rotation. Rules match in list order — the first hit wins.
 - **Show only favorite models** — the **Model allowlist** card keeps only the checked models in the model picker; unchecked shows all (the default).

package/README.zh-CN.md

@@ -27,32 +27,29 @@
 - **按套餐过滤**：默认隐藏超出订阅套餐的模型，可一键关闭；「模型白名单」可进一步只保留常用模型。
 - **推理强度支持**：支持推理强度的模型可在选择器中选择档位。
 - **图片输入**：Vision 模型支持发送图片。
-- **套餐与配额面板**：可选的 Command Code 卡片位于侧边栏底部（Settings 正上方），显示当前服务账号的套餐与 5 小时 / 每周两个配额窗口；点击后在中间栏打开面板，包含计费周期、两个窗口的进度条与重置时间、月度额度消耗，以及已购买 / 赠送余额。面板右上角的 **×** 按钮可随时把中间栏交还给会话（不会切换当前会话）。**默认关闭**——在 **设置 → Command Code → 高级设置** 中打开「在侧边栏显示额度卡片」即可显示，同一开关也能随时隐藏（隐藏时左侧不渲染任何内容，也不会为其后台刷新用量）。面板文案跟随 Harness 显示语言（中文 / English），需要 dsh 0.1.5（rc.1）或更高版本。
+- **套餐与配额面板**：可选的 Command Code 卡片位于侧边栏底部（Settings 正上方），显示当前服务账号的套餐与 5 小时 / 每周两个配额窗口；点击后在中间栏打开面板，包含计费周期、两个窗口的进度条与重置时间、月度额度消耗，以及已购买 / 赠送余额。面板右上角的 **×** 按钮可随时把中间栏交还给会话（不会切换当前会话）。**默认关闭**——在 **设置 → Command Code → 高级设置** 中打开「在侧边栏显示额度卡片」即可显示，同一开关也能随时隐藏（隐藏时左侧不渲染任何内容，也不会为其后台刷新用量）。面板文案跟随 Harness 显示语言（中文 / English）。
 - **会话费用估算**：在输入框下方的 token 计数旁及用量对话框中显示估算金额（`≈`），根据持久化历史中每次请求的模型、请求时间和上下文阶梯分别计价。切换模型或稍后查看不会重新定价之前的请求。混合供应商或缺少费率时显示已定价部分的小计（`≥`）；缺少历史事实或完全无法定价时不显示金额。结果基于插件内的价格快照，不等同于供应商账单。同样固定为英文。
 - **联网搜索**：dsh 的 `web_search` 工具由 Command Code Provider API（`/alpha/web-search`）承载，复用聊天同一个 key 与端点，无需单独配置搜索 key 或地址。详见[联网搜索](#联网搜索)。
 
 ## 安装
 
-按你的 DeepSeek Harness 版本选择对应的发布线：
+本版本**只支持 dsh 0.1.7-rc.1**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
 
-- **dsh 0.1.2-rc.1 或更高版本**（当前 0.1.2 线，即 `@latest` 现在安装的版本）：
-
-  ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
-  ```
+```sh
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
+```
 
-- **更早的 dsh 版本**（0.5.0 线及更早，使用 rc 时代的 Host/浏览器 API）——支持它们的最后一个插件版本是 0.9.1，按精确版本安装。该线不再积极维护：
+- **更早的 dsh 版本。** 0.1.2–0.1.6 线已不再支持：那些引擎早于 0.1.7 的设置重写、`RequestMessage` 消息封装和持久化图片卸载契约，用来桥接两代引擎的兼容代码已经删除。覆盖它们的最后一个插件版本是 0.11.11；0.5.0 时代 Harness 线的最后一个版本是 0.9.1。两者都按精确版本安装，且都不再维护：
 
   ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11   # dsh 0.1.2–0.1.6
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1     # dsh 0.5.0 线
   ```
 
-> `latest` tag 指向当前 0.1.2 线的插件版本。旧 0.5.0 时代的 Harness 用户必须显式钉住 `@0.9.1`。
-
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.9
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -64,14 +61,14 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.9
 用与安装时相同的 tag 更新：
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.2-rc.1 及以上
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # 更早的 dsh（0.5.0 线，不再维护）
 ```
 
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.9
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -100,7 +97,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.9
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -138,7 +135,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**引擎版本要求。** 插件需要导出了 `ToolCallId` 的 dsh 引擎，即 **dsh 0.1.2-alpha.3 或更高**。这覆盖了 dsh-TUI 推荐的引擎（0.1.2-rc.1）以及之后的所有版本，但不包含它 peer 范围里名义上允许的最老引擎：在 dsh 0.1.0-rc.6 / 0.1.1-rc.2 上，插件的模块导入会失败，TUI 无法启动。请升级引擎，或改用 web profile。
+**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.1**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.1`（按 semver，这只会解析到 0.1.7-rc.1），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
 
 ## 用量面板
 
@@ -154,7 +151,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
 
 有多个 Command Code 订阅时，插件可以在一个账户达到用量限额后**自动切换到下一个账户**：
 
-- **配置**：在 **设置 → Command Code** 的「多账户轮换」卡片添加账户并填写备注名与 API key；顶层 key 始终是第一顺位的 `default` 账户。
+- **配置**：在 **设置 → Command Code** 的「多账户轮换」卡片添加账户并填写备注名。可直接填写 API key，或先点击页面底部的全局「保存」，再在该账户行点击「登录 Command Code」并打开出现的授权链接，在新网页授权获取 key；全局「放弃 / 保存」操作栏在设置面板内部随滚动吸附于底部。顶层 key 始终是第一顺位的 `default` 账户。
 - **手动切换**：卡片上的「当前使用账户」下拉框可指定优先账户；所选账户耗尽时自动回落到其他账户，窗口重置后自动恢复。
 - **按模型切换账户**：在「按模型切换账户」卡片从实时模型目录**多选**模型并固定到某个账户。请求的模型在规则列表中且该账户可用时使用该账户；账户耗尽或密钥失效时自动回落到常规轮换。规则按列表顺序匹配，第一条命中生效。
 - **只显示常用模型**：在「模型白名单」卡片勾选要保留的模型，模型选择器只列出这些；不勾选则显示全部（默认行为不变）。