@mars-sea/dsh-commandcode-provider 0.11.14 → 0.11.16

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.16] - 2026-09-25
+
+### Changed
+
+- **Synced with the official command-code@1.65.2 CLI.** `COMMAND_CODE_CLI_VERSION` and the `x-command-code-version` header now report `1.65.2`. The public catalog already exposed Step 3.5 Flash's corrected 262,144-token context, so no picker or price row moves; the full effort, Vision, automatic-reasoning, plan, subscription, deal, peak-pricing and ZDR snapshots remain unchanged.
+
+- **Updated the exact DeepSeek Harness pairing from `0.1.7-rc.1` to `0.1.7-rc.2`.** Every Harness peer and development range, `dsh.compatibility.dsh`, `engines.dsh`, and the single `dshReleases` record now name rc.2 together. The rc.2 client graph no longer carries the obsolete `dsh-client-connection` edge or peer; the browser bundle still exports only the live `slots`, `locale`, and `remote` service face. `npm run test:engine` is the compatibility proof for this exact pairing.
+
+### Added
+
+- **Command Code models can receive newly enabled tools during an existing conversation.** The adapter advertises rc.2's `toolUpdate: 'addition-only'` capability. Both Command Code transports already send the complete active tool declaration list, so the harness can project a tool addition into the current request without a new conversation; tool removals are represented by omission from that active list. This is deliberately not advertised as `in-history`, because the provider wire has no native tool-removal event.
+
+- **The browser follows rc.2 credential updates and safer API-key autofill.** The client now refreshes key state for both `credentials/reference-updated` and rc.2's `credentials/record-updated`, and both Command Code API-key inputs use `autocomplete="new-password"` so browsers are less likely to fill a saved login password into a secret field.
+
+### Fixed
+
+- **CLI-stream cache writes are no longer under-reported.** command-code@1.65.2 added a standalone `cache-write-tokens` JSONL event for requests whose finish usage reports zero or omits `cacheWriteTokens`. The adapter now retains the last finite non-negative reading and uses it under the same zero/missing fallback as the official CLI, including when the finish event carries no `totalUsage`. Positive finish usage still wins, so the event cannot double-count cache writes.
+
 ## [0.11.14] - 2026-09-24
 
 ### Fixed

package/README.md

@@ -35,7 +35,7 @@ See [Screenshots](#screenshots) below for what the UI looks like.
 
 ## Install
 
-This release supports **dsh 0.1.7-rc.1 and nothing else** — the plugin's peer
+This release supports **dsh 0.1.7-rc.2 and nothing else** — the plugin's peer
 range is that one version, and its compatibility record names it alone:
 
 ```sh
@@ -57,7 +57,7 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -69,14 +69,14 @@ Fresh pnpm 10 marketplace generations are supported directly. Do not add a separ
 Update with the same tag you installed with:
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.2
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # older dsh (0.5.0 line, unmaintained)
 ```
 
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -105,7 +105,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -143,7 +143,7 @@ cmd login                               # writes ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.1**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.1` (semver resolves that to 0.1.7-rc.1 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
+**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.2**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.2` (semver resolves that to 0.1.7-rc.2 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
 
 ## Usage dashboard
 

package/README.zh-CN.md

@@ -33,7 +33,7 @@
 
 ## 安装
 
-本版本**只支持 dsh 0.1.7-rc.1**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
+本版本**只支持 dsh 0.1.7-rc.2**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
 
 ```sh
 dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
@@ -49,7 +49,7 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -61,14 +61,14 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
 用与安装时相同的 tag 更新：
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.2
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # 更早的 dsh（0.5.0 线，不再维护）
 ```
 
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -97,7 +97,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -135,7 +135,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.1**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.1`（按 semver，这只会解析到 0.1.7-rc.1），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
+**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.2**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.2`（按 semver，这只会解析到 0.1.7-rc.2），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
 
 ## 用量面板
 

package/lib/client.js

@@ -2313,7 +2313,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region package.json
-		var version = "0.11.14";
+		var version = "0.11.16";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -3424,7 +3424,7 @@ window.__ModuleLoader__.load({
 					className: "cc-input",
 					type: secret && !visible ? "password" : "text",
 					"aria-label": label,
-					autoComplete: "off",
+					autoComplete: "new-password",
 					spellCheck: false,
 					autoFocus: true,
 					placeholder,
@@ -4392,7 +4392,7 @@ window.__ModuleLoader__.load({
 						id: "cc-card-api-key",
 						className: "cc-input",
 						type: visible ? "text" : "password",
-						autoComplete: "off",
+						autoComplete: "new-password",
 						spellCheck: false,
 						value: state.text,
 						disabled,
@@ -7212,9 +7212,19 @@ window.__ModuleLoader__.load({
 			ctx.effect(() => () => controller.dispose(), "dsh-commandcode-provider: settings controller");
 			const store = createSnapshotStore(controller.state());
 			controller.subscribe(() => store.set(controller.state()));
-			ctx.effect(() => ctx.remote.$on("credentials/reference-updated", () => {
-				controller.refreshCredentials();
-			}), "dsh-commandcode-provider: credential invalidations");
+			ctx.effect(() => {
+				const remote = ctx.remote;
+				const unregisterReference = remote.$on("credentials/reference-updated", () => {
+					controller.refreshCredentials();
+				});
+				const unregisterRecord = remote.$on("credentials/record-updated", () => {
+					controller.refreshCredentials();
+				});
+				return () => {
+					unregisterReference();
+					unregisterRecord();
+				};
+			}, "dsh-commandcode-provider: credential invalidations");
 			let usageNamespace;
 			let usageMountError;
 			let pricesController;