@mars-sea/dsh-commandcode-provider 0.11.2 → 0.11.3

package/lib/index.d.ts

@@ -327,6 +327,19 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    * wins; otherwise a cached (not network-fetched) billing tier of Go is
    * treated as CLI-only. Unknown accounts default to Provider API and fall
    * back only after an `upgrade_required` rejection.
+   *
+   * Models the Provider API serves ONLY through `/provider/v1/messages` (the
+   * Claude family — `requiresMessagesEndpoint()`) always take the CLI
+   * transport, on any tier and even under a forced `'openai'` preference:
+   * that option is documented as "prefer the Provider API, still fall back",
+   * and the 400 these models answer with is not a preference to be honoured
+   * but a hard refusal. `/alpha/generate` routes every one of them, so this
+   * costs nothing.
+   *
+   * That decision is deliberately NOT written to `protocolCache`. The cache is
+   * keyed by API key alone, so remembering it would pin the whole ACCOUNT to
+   * the CLI transport and drag every other model — DeepSeek, GLM, Qwen, all of
+   * which the Provider API serves correctly — off it until the entry expired.
    */
   private resolveProtocol;
   /**
@@ -1544,6 +1557,18 @@ interface Config {
   requestTimeoutMs?: number;
   /** Milliseconds a stream may stall before being treated as a dead connection; defaults to 300s. */
   streamIdleTimeoutMs?: number;
+  /**
+   * Transport failures one request absorbs before the failure is surfaced;
+   * defaults to 5. The route's retry policy is near-unbounded on purpose (1000
+   * attempts, waits doubling to 15 minutes) because that shape is for the
+   * failures a provider asks to have retried — an exhausted rate-limit window,
+   * a gateway 520. A transport failure is not one of those: the first attempts
+   * recover an ordinary blip (the default 5 retries are scheduled 0.5/1/2/4/8 s
+   * after the failures before them, so ~15.5 s of grace), and after that the
+   * wait is pure stall, so the retries are capped here. Raise it on a genuinely
+   * flaky link; 0 surfaces every transport failure immediately.
+   */
+  transportMaxRetries?: number;
   /**
    * Whether the model picker hides models above the account's subscription
    * tier; defaults to true. The filter fails open (unknown plan, billing

package/lib/index.js

@@ -386,6 +386,48 @@ const KNOWN_THINKING_MODELS = /* @__PURE__ */ new Set([
 	"inclusionai/ling-3.0-flash-sante:free"
 ]);
 /**
+* Catalog models the Provider API serves ONLY through `/provider/v1/messages`
+* (Anthropic Messages shape). Every other model in the catalog answers on
+* `/provider/v1/chat/completions`; these reject it outright with HTTP 400
+* `Model "<id>" must be called via /provider/v1/messages (Anthropic Messages
+* shape)`.
+*
+* Measured 2026-09-16 against the live catalog (command-code@1.54.0): all 69
+* models were posted to `/provider/v1/chat/completions`; exactly these eight
+* — the whole Claude family — refused, and every one of them is routed
+* normally by `/alpha/generate` (a lower-plan key gets the ordinary
+* `MODEL_NOT_IN_PLAN` 403 there, never a routing error). So the CLI transport
+* is a complete fallback and the adapter does not need a Messages transport.
+*
+* Note what this list is NOT: it is not a plan gate. `claude-sonnet-5` is
+* Pro-tier and `claude-opus-4-8` Provider-tier, so the accounts entitled to
+* these models are exactly the non-Go ones, which `resolveProtocol()` sends to
+* the Provider API by default — picking any Claude model there failed every
+* request before this snapshot existed.
+*
+* Keep in sync when models ship (see the dsh-commandcode-upstream skill).
+* `requiresMessagesEndpoint()` additionally treats any `claude-*` id as
+* Messages-only, so a Claude model added upstream is routed correctly by an
+* un-updated plugin instead of hard-failing with the 400 above; the worst case
+* of that rule going stale the other way (upstream teaching
+* `/provider/v1/chat/completions` to serve Claude) is one model riding the CLI
+* transport it already works on.
+*/
+const MESSAGES_ONLY_MODELS = /* @__PURE__ */ new Set([
+	"claude-sonnet-5",
+	"claude-sonnet-4-6",
+	"claude-fable-5-1",
+	"claude-fable-5",
+	"claude-opus-5",
+	"claude-opus-4-8",
+	"claude-opus-4-7",
+	"claude-haiku-4-5-20251001"
+]);
+/** True when the Provider API will only serve `modelId` via `/provider/v1/messages`. */
+function requiresMessagesEndpoint(modelId) {
+	return MESSAGES_ONLY_MODELS.has(modelId) || modelId.startsWith("claude-");
+}
+/**
 * The minimum subscription plan a model is included in, per the official plan
 * pages (`/docs/plans/go`, `/docs/plans/goat`, `/docs/plans/pro`, `/docs/plans/max`
 * and `/docs/resources/pricing-limits`). Each plan's model list is a superset of
@@ -2361,6 +2403,28 @@ function numberValue(value) {
 function booleanValue(value) {
 	return typeof value === "boolean" ? value : void 0;
 }
+/**
+* Thinking text carried by an OpenRouter-shaped `reasoning_details` array
+* (`[{ type: 'reasoning.text', text, format, index }]`), concatenated in the
+* order the gateway sent it.
+*
+* Entries are read by their `text` member alone rather than filtered on
+* `type === 'reasoning.text'`: the sibling shapes in that protocol carry
+* `summary` or an encrypted blob instead of `text`, so a plain read already
+* ignores them, while a type filter would silently drop a text-bearing variant
+* added later — and losing thinking is the failure this exists to prevent.
+* Returns undefined when the array yields nothing, so the caller's `??` chain
+* keeps falling through instead of treating "no text" as a reasoning delta.
+*/
+function reasoningDetailsText(value) {
+	if (!Array.isArray(value)) return void 0;
+	let text = "";
+	for (const entry of value) {
+		if (!isRecord(entry)) continue;
+		text += stringValue(entry.text) ?? "";
+	}
+	return text === "" ? void 0 : text;
+}
 /** Parse a billing-period timestamp (ISO string or millis) into millis; 0 when absent/invalid. */
 function periodEndValue(value) {
 	const asNumber = numberValue(value);
@@ -2640,6 +2704,44 @@ async function writeModelsCache(cachePath, models) {
 	}
 }
 /**
+* Whether an inbound message is a tool RESULT — a `user`-role message the
+* producer tagged with `source: { kind: 'tool' }`.
+*
+* The tag is read defensively because it is PRODUCER-supplied and nothing
+* validates it: dsh-llm's `Message` type declares `source` required, but the
+* runtime never checks it and every adapter shipped before this one ignored the
+* field outright (`dsh-llm-deepseek` never reads it). A third-party plugin that
+* assembles its own history can therefore omit it and run correctly everywhere
+* else — dsh-mneme's memory pipeline did — which made this adapter, the first
+* to actually read the field, the first to crash on such a message with
+* `TypeError: Cannot read properties of undefined (reading 'kind')` in the
+* serialization phase, 0–8 ms in, before any request left the machine and with
+* nothing in the error naming the message or the producer (issue #47).
+*
+* Two rules keep an untagged message from costing the turn:
+*
+*  - A PRESENT tag is authoritative. `kind: 'user'`, `'model'`, `'plugin'` or
+*    any producer-added kind means "not a tool result", whatever the content
+*    looks like — the tag answers *who produced this*.
+*  - An ABSENT tag falls back to the content shape. A `user` message whose
+*    first block is a `tool-result` is a tool result by the harness's own
+*    definition (`ToolResultMessage` is exactly that shape with a
+*    `ToolMessageSource`), and the fallback is not cosmetic: `pairedToolCalls()`
+*    counts a `tool-result` block from ANY message, so classifying such a
+*    message as a plain user message would drop it at emission while its call
+*    still counted as paired — leaving the assistant's tool call unanswered on
+*    the wire, which the gateway rejects outright. FIRST block, not "any block":
+*    the tool-result branch reads `content[0]` and skips anything else, so
+*    claiming a mixed message as a tool result would discard its other blocks
+*    instead of sending them.
+*/
+function isToolResultMessage(message) {
+	if (message.role !== "user") return false;
+	const kind = message.source?.kind;
+	if (kind !== void 0) return kind === "tool";
+	return message.content?.[0]?.type === "tool-result";
+}
+/**
 * Collect the tool calls that have a paired tool result, plus each call's
 * name. The name map feeds the `toolName` of replayed tool results: some
 * backends (e.g. Google Gemini `functionResponse`) reject a result whose
@@ -2963,7 +3065,7 @@ async function messagesToCC(messages, readImage) {
 	};
 	for (const message of messages) {
 		if (message.role === "system") continue;
-		if (message.role === "user" && message.source.kind !== "tool") {
+		if (message.role === "user" && !isToolResultMessage(message)) {
 			flushPendingImages();
 			const parts = [];
 			for (const block of message.content) {
@@ -3006,7 +3108,7 @@ async function messagesToCC(messages, readImage) {
 			});
 			continue;
 		}
-		if (message.role === "user" && message.source.kind === "tool") {
+		if (isToolResultMessage(message)) {
 			const block = message.content[0];
 			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
 			const media = toolResultMedia(block);
@@ -3075,7 +3177,7 @@ async function messagesToOpenAI(messages, readImage) {
 	};
 	for (const message of messages) {
 		if (message.role === "system") continue;
-		if (message.role === "user" && message.source.kind !== "tool") {
+		if (message.role === "user" && !isToolResultMessage(message)) {
 			flushPendingImages();
 			const parts = [];
 			for (const block of message.content) {
@@ -3121,7 +3223,7 @@ async function messagesToOpenAI(messages, readImage) {
 			out.push(assistant);
 			continue;
 		}
-		if (message.role === "user" && message.source.kind === "tool") {
+		if (isToolResultMessage(message)) {
 			const block = message.content[0];
 			if (!block || block.type !== "tool-result" || !paired.has(block.toolCallId)) continue;
 			const media = toolResultMedia(block);
@@ -3717,10 +3819,25 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	* wins; otherwise a cached (not network-fetched) billing tier of Go is
 	* treated as CLI-only. Unknown accounts default to Provider API and fall
 	* back only after an `upgrade_required` rejection.
+	*
+	* Models the Provider API serves ONLY through `/provider/v1/messages` (the
+	* Claude family — `requiresMessagesEndpoint()`) always take the CLI
+	* transport, on any tier and even under a forced `'openai'` preference:
+	* that option is documented as "prefer the Provider API, still fall back",
+	* and the 400 these models answer with is not a preference to be honoured
+	* but a hard refusal. `/alpha/generate` routes every one of them, so this
+	* costs nothing.
+	*
+	* That decision is deliberately NOT written to `protocolCache`. The cache is
+	* keyed by API key alone, so remembering it would pin the whole ACCOUNT to
+	* the CLI transport and drag every other model — DeepSeek, GLM, Qwen, all of
+	* which the Provider API serves correctly — off it until the entry expired.
 	*/
-	resolveProtocol(apiKey) {
+	resolveProtocol(apiKey, model) {
 		const forced = this.deps.options().protocol;
-		if (forced === "cli" || forced === "openai") return forced;
+		if (forced === "cli") return forced;
+		if (requiresMessagesEndpoint(model)) return "cli";
+		if (forced === "openai") return forced;
 		const cached = this.cachedProtocolUseCli(apiKey);
 		if (cached !== void 0) return cached ? "cli" : "openai";
 		if (this.cachedBillingTierWeight(apiKey) === GO_TIER_WEIGHT) {
@@ -3835,7 +3952,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const supported = KNOWN_EFFORTS[options.model];
 		const reasoningEffort = effort && effort !== "off" && supported?.includes(effort) ? effort : void 0;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
-		let protocol = this.resolveProtocol(apiKey);
+		let protocol = this.resolveProtocol(apiKey, options.model);
 		let requestOptions = this.surfaceOffload === void 0 ? withImageBudget(options, REQUEST_IMAGE_BUDGETS[0], this.imagePolicy) : withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
 		let imageBudgetIndex = 0;
 		const buildBody = async (target) => target === "cli" ? buildCliBody(requestOptions, connection, {
@@ -4167,7 +4284,7 @@ function handleOpenAIEvent(asm, event) {
 	}
 	const choice = isRecord(choices[0]) ? choices[0] : {};
 	const delta = isRecord(choice.delta) ? choice.delta : {};
-	const reasoningDelta = stringValue(delta.reasoning) ?? stringValue(delta.reasoning_content) ?? "";
+	const reasoningDelta = stringValue(delta.reasoning) ?? stringValue(delta.reasoning_content) ?? reasoningDetailsText(delta.reasoning_details) ?? "";
 	if (reasoningDelta !== "") {
 		chunks.push(...closeText(asm));
 		if (asm.reasoningIndex < 0) {
@@ -5961,6 +6078,108 @@ function applyCommandCodeTuiSettings(ctx, deps) {
 	return refresh;
 }
 //#endregion
+//#region src/transport-retry.ts
+/**
+* A bounded retry budget for `TRANSPORT` failures (issue #39, second report).
+*
+* The route's retry policy (`providerRetryPolicy` in `./adapter.ts`) is
+* deliberately near-unbounded: 1000 attempts with waits doubling to a 15-minute
+* cap. That shape exists for the failures a provider ASKS to have retried — an
+* exhausted 5-hour window, a Cloudflare 520 — where the wait is the point.
+*
+* A transport failure is not that. The reporter's second event at ~710k
+* context was `Connect Timeout Error ... timeout: 10000ms` (undici's own
+* connect timeout; this plugin's `requestTimeoutMs` is 60s) and, on another
+* attempt, `read ECONNRESET` against `/alpha/generate`. Because `TRANSPORT` is
+* in the whitelist, each of those entered the same 1000-attempt loop: with
+* `initialDelayMs: 500` doubling, the wait before attempt 11 alone is 512 s and
+* the cumulative wait before it is ~500 s — the "模型请求重试已取消（11/1000）·
+* 482s" the reporter photographed is that 512 s countdown, 30 s into it — and
+* those waits are counted BEFORE each retry attempt, not after it.
+*
+* A connection that cannot be established is either a sub-second blip (the
+* first few attempts recover it, invisibly) or an outage that no amount of
+* waiting inside one request will fix. So transport failures get their own
+* budget, and when it is exhausted the failure is surfaced with the diagnosis
+* instead of manufacturing a multi-minute stall. Waiting out a real outage is
+* the user's call — the next send starts a fresh budget — and
+* `dsh-llm-retry`'s window for rate limits is untouched.
+*
+* Deliberately NOT counted here: the pre-stream recovery the ADAPTER performs
+* inside one `stream()` call (account rotation on 429/401, the 413 image-budget
+* step-down, the Provider-API → CLI protocol switch). Those are invisible to
+* the caller and bounded on their own; this budget caps only the harness's
+* retry loop.
+*
+* Reset rule: the budget clears at each new STEP — one step is exactly one
+* model request (`step/start` is appended immediately before the call) — so the
+* cap is per logical request and the next step of the same turn gets its own
+* grace. `agent/status` → `idle` is NOT the reset signal even though it looks
+* like the natural one: the agent loop's `setPhase` emits it only on a status
+* CHANGE, and a turn's steps all run inside one `running` phase, so it never
+* fires between them — a budget reset only there would be per-turn, and an
+* outage would fail every later step of that turn immediately instead of
+* retrying each. `assistant/attempt` is wrong for the opposite reason: the loop
+* appends it for the FAILED attempt itself, *before* dispatching
+* `agent/request-error`, so resetting on it would clear the budget on every
+* failure and restore the very loop this module exists to stop.
+*
+* @module
+*/
+/** Failure code this budget covers. */
+const TRANSPORT_FAILURE_CODE = "TRANSPORT";
+/** One agent's live transport-failure count, keyed weakly so a dropped agent cannot leak. */
+const counts = /* @__PURE__ */ new WeakMap();
+/**
+* Count one attempt's outcome against the transport budget.
+*
+* @param agent - the identity the budget is scoped to (the agent object).
+* @param failureCode - the failed attempt's `LlmFailure.code`.
+* @param maxRetries - transport retries to absorb before the failure surfaces.
+* @returns `'ignored'` for any non-transport code (the route policy decides
+*   those, unchanged), `'retry'` while the budget has room, `'exhausted'` once
+*   it does not.
+*/
+function absorbTransportFailure(agent, failureCode, maxRetries) {
+	if (failureCode !== "TRANSPORT") return "ignored";
+	const used = counts.get(agent) ?? 0;
+	if (used >= maxRetries) return "exhausted";
+	counts.set(agent, used + 1);
+	return "retry";
+}
+/** Clear one agent's transport budget (a new step starts, or the turn ended). */
+function resetTransportFailures(agent) {
+	counts.delete(agent);
+}
+/**
+* What one session event means for the transport budget.
+*
+* Exported and pure on purpose: the choice of event is the part of this design
+* that is easy to get plausibly wrong (`agent/status` → `idle` looks like the
+* natural reset and is not one — see the module comment), so it is stated once,
+* here, where a test can pin it, instead of being implied by a listener body.
+*
+* @param type - the appended session event's type.
+* @returns `'reset'` for a new step (one model request), `'forget'` when the
+*   turn ended and the session → agent mapping is no longer needed, otherwise
+*   `'none'`.
+*/
+function transportResetAction(type) {
+	if (type === "step/start") return "reset";
+	if (type === "turn/end") return "forget";
+	return "none";
+}
+/**
+* The diagnosis a capped turn ends with. Bilingual, because the harness renders
+* a failed turn's message verbatim and this plugin's other user-facing failures
+* are bilingual too (see the adapter's error builders). It names the retry
+* budget and the checks that actually help, instead of the bare "fetch failed"
+* chain the retry chrome would otherwise show.
+*/
+function transportBudgetMessage(failureMessage, maxRetries) {
+	return `${failureMessage}；Command Code API 连接在连续重试后仍失败——已停止重试以免整轮卡死。插件已自动重试 ${maxRetries} 次。通常说明当前网络到 api.commandcode.ai 的连接不通，常见原因是代理未生效：DSH 只读取环境变量 HTTPS_PROXY/HTTP_PROXY（系统代理/PAC 不会被读取），请确认启动 DSH 的终端里已导出代理，或先关闭代理直连后重试。网络恢复后直接重发即可 — Command Code API transport still failed after ${maxRetries} automatic retries, which were stopped so the turn could not stall for minutes. This is a connectivity problem between this machine and api.commandcode.ai, not a context-window or request-size rejection. Common cause: the proxy is not reaching the harness — DSH reads HTTPS_PROXY/HTTP_PROXY from the environment only (a Windows system proxy/PAC setting is not consulted), so export it in the launching shell, or turn the proxy off and retry. Resend when the network recovers; the budget is per request and has been reset`;
+}
+//#endregion
 //#region src/index.ts
 /**
 * dsh-commandcode-provider — DeepSeek Harness LLM provider plugin for Command
@@ -6005,6 +6224,7 @@ const Config = z.object({
 	modelsCachePath: z.string(),
 	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
 	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+	transportMaxRetries: z.number().min(0).max(50),
 	filterModelsByPlan: z.boolean(),
 	visibleModels: z.array(z.string()),
 	/**
@@ -6146,6 +6366,36 @@ function apply(ctx, config) {
 		settingsPath: []
 	}]);
 	ctx.llm.registerAdapter([PROVIDER], adapter);
+	const transportMaxRetries = () => {
+		const value = current().transportMaxRetries;
+		if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return 5;
+		return Math.min(Math.trunc(value), 50);
+	};
+	const sessionAgents = /* @__PURE__ */ new WeakMap();
+	ctx.on("agent/request-error", async ({ agent, failure, signal }, next) => {
+		if (signal.aborted) return next();
+		const session = Reflect.get(agent, "session");
+		if (typeof session === "object" && session !== null) sessionAgents.set(session, agent);
+		const decision = absorbTransportFailure(agent, failure.code, transportMaxRetries());
+		if (decision === "ignored") return next();
+		if (decision === "retry") return { kind: "retry" };
+		const message = transportBudgetMessage(failure.message, transportMaxRetries());
+		ctx.logger.warn(`llm-commandcode: transport retry budget exhausted for ${PROVIDER} (${TRANSPORT_FAILURE_CODE})`);
+		throw new Error(message);
+	});
+	ctx.on("session/event", (session, event) => {
+		const action = transportResetAction(event.type);
+		if (action === "forget") {
+			sessionAgents.delete(session);
+			return;
+		}
+		if (action !== "reset") return;
+		const agent = sessionAgents.get(session);
+		if (agent !== void 0) resetTransportFailures(agent);
+	});
+	ctx.on("agent/status", ({ agent, status }) => {
+		if (status === "idle") resetTransportFailures(agent);
+	});
 	const usageReports = async () => {
 		const described = await pool.describeAccounts();
 		const byId = new Map(described.map((account) => [account.slot.id, account]));