@mars-sea/dsh-commandcode-provider 0.11.13 → 0.11.16

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.16] - 2026-09-25
+
+### Changed
+
+- **Synced with the official command-code@1.65.2 CLI.** `COMMAND_CODE_CLI_VERSION` and the `x-command-code-version` header now report `1.65.2`. The public catalog already exposed Step 3.5 Flash's corrected 262,144-token context, so no picker or price row moves; the full effort, Vision, automatic-reasoning, plan, subscription, deal, peak-pricing and ZDR snapshots remain unchanged.
+
+- **Updated the exact DeepSeek Harness pairing from `0.1.7-rc.1` to `0.1.7-rc.2`.** Every Harness peer and development range, `dsh.compatibility.dsh`, `engines.dsh`, and the single `dshReleases` record now name rc.2 together. The rc.2 client graph no longer carries the obsolete `dsh-client-connection` edge or peer; the browser bundle still exports only the live `slots`, `locale`, and `remote` service face. `npm run test:engine` is the compatibility proof for this exact pairing.
+
+### Added
+
+- **Command Code models can receive newly enabled tools during an existing conversation.** The adapter advertises rc.2's `toolUpdate: 'addition-only'` capability. Both Command Code transports already send the complete active tool declaration list, so the harness can project a tool addition into the current request without a new conversation; tool removals are represented by omission from that active list. This is deliberately not advertised as `in-history`, because the provider wire has no native tool-removal event.
+
+- **The browser follows rc.2 credential updates and safer API-key autofill.** The client now refreshes key state for both `credentials/reference-updated` and rc.2's `credentials/record-updated`, and both Command Code API-key inputs use `autocomplete="new-password"` so browsers are less likely to fill a saved login password into a secret field.
+
+### Fixed
+
+- **CLI-stream cache writes are no longer under-reported.** command-code@1.65.2 added a standalone `cache-write-tokens` JSONL event for requests whose finish usage reports zero or omits `cacheWriteTokens`. The adapter now retains the last finite non-negative reading and uses it under the same zero/missing fallback as the official CLI, including when the finish event carries no `totalUsage`. Positive finish usage still wins, so the event cannot double-count cache writes.
+
+## [0.11.14] - 2026-09-24
+
+### Fixed
+
+- The settings page now delegates remote settings persistence to the DSH Host/gateway instead of silently switching non-loopback pages to a process-local read-only scope. The client always reads `settings.describe` and submits `settings.mutate`; the Host's `writable` fact and the gateway's authenticated write policy remain the authority. This allows an authenticated reverse-proxy deployment to edit settings while keeping unauthorized or Host-locked deployments read-only.
+
 ## [0.11.13] - 2026-09-24
 
 ### Changed

package/README.md

@@ -35,7 +35,7 @@ See [Screenshots](#screenshots) below for what the UI looks like.
 
 ## Install
 
-This release supports **dsh 0.1.7-rc.1 and nothing else** — the plugin's peer
+This release supports **dsh 0.1.7-rc.2 and nothing else** — the plugin's peer
 range is that one version, and its compatibility record names it alone:
 
 ```sh
@@ -57,7 +57,7 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -69,14 +69,14 @@ Fresh pnpm 10 marketplace generations are supported directly. Do not add a separ
 Update with the same tag you installed with:
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.2
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # older dsh (0.5.0 line, unmaintained)
 ```
 
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -105,7 +105,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -143,7 +143,7 @@ cmd login                               # writes ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.1**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.1` (semver resolves that to 0.1.7-rc.1 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
+**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.2**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.2` (semver resolves that to 0.1.7-rc.2 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
 
 ## Usage dashboard
 

package/README.zh-CN.md

@@ -33,7 +33,7 @@
 
 ## 安装
 
-本版本**只支持 dsh 0.1.7-rc.1**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
+本版本**只支持 dsh 0.1.7-rc.2**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
 
 ```sh
 dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
@@ -49,7 +49,7 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -61,14 +61,14 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
 用与安装时相同的 tag 更新：
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.2
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # 更早的 dsh（0.5.0 线，不再维护）
 ```
 
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -97,7 +97,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -135,7 +135,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.1**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.1`（按 semver，这只会解析到 0.1.7-rc.1），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
+**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.2**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.2`（按 semver，这只会解析到 0.1.7-rc.2），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
 
 ## 用量面板
 

package/lib/client.js

@@ -37,7 +37,6 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/client/settings-scope.ts
-		const MEMORY_STATUS = "unavailable";
 		/**
 		* Backoff before re-reading a directory whose FIRST read failed, in millis.
 		*
@@ -89,7 +88,6 @@ window.__ModuleLoader__.load({
 			resolveRemote;
 			timer;
 			store;
-			persistence;
 			inFlight;
 			rerun = false;
 			generation = 0;
@@ -99,15 +97,13 @@ window.__ModuleLoader__.load({
 			disposed = false;
 			/**
 			* @param resolveRemote - Reads the inject-captured `remote.settings` namespace.
-			* @param persistence - Client-selected Host persistence; non-loopback pages may stay process-local.
 			* @param timer - Retry timer seam (see {@link SETTINGS_DESCRIBE_RETRY_MS}).
 			*/
-			constructor(resolveRemote, persistence, timer = REAL_SETTINGS_TIMER) {
+			constructor(resolveRemote, timer = REAL_SETTINGS_TIMER) {
 				this.resolveRemote = resolveRemote;
 				this.timer = timer;
-				this.persistence = persistence;
 				this.store = createSnapshotStore({
-					status: persistence === "host" ? "idle" : MEMORY_STATUS,
+					status: "idle",
 					view: null,
 					error: null
 				});
@@ -118,7 +114,7 @@ window.__ModuleLoader__.load({
 			subscribe(listener) {
 				return this.store.subscribe(listener);
 			}
-			/** The cheap idempotent entry: kick a first read (a no-op on memory persistence). */
+			/** The cheap idempotent entry: kick a first read. */
 			ensure() {
 				this.load();
 			}
@@ -128,7 +124,7 @@ window.__ModuleLoader__.load({
 			* @returns settlement after this call's freshness is reflected.
 			*/
 			load() {
-				if (this.disposed || this.persistence === "memory") return Promise.resolve();
+				if (this.disposed) return Promise.resolve();
 				this.clearRetry();
 				if (this.inFlight !== void 0) {
 					this.rerun = true;
@@ -242,33 +238,29 @@ window.__ModuleLoader__.load({
 			store;
 			mirror;
 			namespace;
-			persistence;
 			tail = Promise.resolve();
 			writeGeneration = 0;
 			disposed = false;
 			unsubscribe;
 			/** Revision answered by a superseded write still ahead of the mirror. */
 			pendingRevision;
-			constructor(resolveRemote, mirror, namespace, persistence) {
+			constructor(resolveRemote, mirror, namespace) {
 				this.resolveRemote = resolveRemote;
 				this.mirror = mirror;
 				this.namespace = namespace;
-				this.persistence = persistence;
 				this.store = createSnapshotStore({
-					status: persistence === "host" ? "loading" : "unavailable",
+					status: "loading",
 					value: void 0,
 					base: void 0,
 					user: void 0,
 					revision: void 0,
 					writable: false,
-					mode: persistence
+					mode: "host"
 				});
-				if (persistence === "host") {
-					this.unsubscribe = mirror.subscribe(() => {
-						this.derive();
-					});
+				this.unsubscribe = mirror.subscribe(() => {
 					this.derive();
-				}
+				});
+				this.derive();
 			}
 			getSnapshot() {
 				return this.store.getSnapshot();
@@ -377,9 +369,9 @@ window.__ModuleLoader__.load({
 				if (sameSnapshot(candidate, current)) return;
 				this.store.set(candidate);
 			}
-			/** Queue operations one at a time; memory persistence and disposal are no-ops. */
+			/** Queue operations one at a time; disposal makes the queue inert. */
 			enqueue(operation) {
-				if (this.persistence === "memory" || this.disposed) return Promise.resolve();
+				if (this.disposed) return Promise.resolve();
 				const task = this.tail.then(async () => {
 					if (this.disposed) return;
 					await operation();
@@ -418,26 +410,22 @@ window.__ModuleLoader__.load({
 		* @returns The scope plus the refresh/dispose handles the entry wires into its fiber.
 		*/
 		function createSettingsScope(context, namespace, resolveRemote, timer = REAL_SETTINGS_TIMER) {
-			const loopback = context.remote.$host?.isLoopback === true;
-			const persistence = loopback ? "host" : "memory";
-			const mirror = new SettingsDescribeMirror(resolveRemote, persistence, timer);
-			const scope = new RemoteSettingsScope(resolveRemote, mirror, namespace, persistence);
+			const mirror = new SettingsDescribeMirror(resolveRemote, timer);
+			const scope = new RemoteSettingsScope(resolveRemote, mirror, namespace);
 			const disposers = [];
-			if (loopback) {
-				if (typeof context.remote.$on === "function") {
-					const off = context.remote.$on("settings/document-updated", () => {
-						mirror.ensure();
-					});
-					if (typeof off === "function") disposers.push(off);
-				}
-				if (typeof context.on === "function") {
-					const off = context.on("connection/reset", () => {
-						mirror.load();
-					});
-					if (typeof off === "function") disposers.push(off);
-				}
-				mirror.ensure();
+			if (typeof context.remote.$on === "function") {
+				const off = context.remote.$on("settings/document-updated", () => {
+					mirror.ensure();
+				});
+				if (typeof off === "function") disposers.push(off);
 			}
+			if (typeof context.on === "function") {
+				const off = context.on("connection/reset", () => {
+					mirror.load();
+				});
+				if (typeof off === "function") disposers.push(off);
+			}
+			mirror.ensure();
 			return {
 				getSnapshot: () => scope.getSnapshot(),
 				subscribe: (listener) => scope.subscribe(listener),
@@ -2325,7 +2313,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region package.json
-		var version = "0.11.13";
+		var version = "0.11.16";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -3436,7 +3424,7 @@ window.__ModuleLoader__.load({
 					className: "cc-input",
 					type: secret && !visible ? "password" : "text",
 					"aria-label": label,
-					autoComplete: "off",
+					autoComplete: "new-password",
 					spellCheck: false,
 					autoFocus: true,
 					placeholder,
@@ -4404,7 +4392,7 @@ window.__ModuleLoader__.load({
 						id: "cc-card-api-key",
 						className: "cc-input",
 						type: visible ? "text" : "password",
-						autoComplete: "off",
+						autoComplete: "new-password",
 						spellCheck: false,
 						value: state.text,
 						disabled,
@@ -7224,9 +7212,19 @@ window.__ModuleLoader__.load({
 			ctx.effect(() => () => controller.dispose(), "dsh-commandcode-provider: settings controller");
 			const store = createSnapshotStore(controller.state());
 			controller.subscribe(() => store.set(controller.state()));
-			ctx.effect(() => ctx.remote.$on("credentials/reference-updated", () => {
-				controller.refreshCredentials();
-			}), "dsh-commandcode-provider: credential invalidations");
+			ctx.effect(() => {
+				const remote = ctx.remote;
+				const unregisterReference = remote.$on("credentials/reference-updated", () => {
+					controller.refreshCredentials();
+				});
+				const unregisterRecord = remote.$on("credentials/record-updated", () => {
+					controller.refreshCredentials();
+				});
+				return () => {
+					unregisterReference();
+					unregisterRecord();
+				};
+			}, "dsh-commandcode-provider: credential invalidations");
 			let usageNamespace;
 			let usageMountError;
 			let pricesController;