@mars-sea/dsh-commandcode-provider 0.15.4 → 0.16.0

package/lib/index.d.ts

@@ -61,7 +61,7 @@ type CommandCodeProtocol = 'cli' | 'openai' | 'messages';
 declare const DEFAULT_MAX_OUTPUT_TOKENS = 131072;
 //#endregion
 //#region src/adapter.d.ts
-declare const COMMAND_CODE_CLI_VERSION = "1.88.0";
+declare const COMMAND_CODE_CLI_VERSION = "1.88.1";
 declare const DEFAULT_API_BASE = "https://api.commandcode.ai";
 /**
  * The output budget this bundle asks for, and the ceiling it will never exceed.
@@ -382,6 +382,25 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
   private readonly surfaceOffload;
   private readonly billingAccess;
   private readonly billingAccessInflight;
+  /**
+   * Successful account-endpoint responses, keyed by gateway + key + exact URL.
+   *
+   * The settings card and the picker's advisory plan filter ask the SAME three
+   * endpoints about the SAME account (`/alpha/whoami`, then credits and
+   * subscriptions in parallel). Here that is four round trips per surface for
+   * two answers — and the card refreshes on a timer, so the picker keeps paying
+   * for rows it already has. Sharing the raw responses removes the duplicate
+   * without either surface having to know about the other: whoever asks second
+   * within {@link ACCOUNT_FACTS_TTL_MS} reads the same record instead of the
+   * wire.
+   *
+   * Only SUCCESSFUL records are kept. A failure must be retried rather than
+   * replayed, or an endpoint that recovered a second ago would keep reporting
+   * yesterday's outage — and the usage report's per-endpoint `failures` and
+   * {@link classifyTotalFailure} verdict would describe a request this process
+   * never made.
+   */
+  private readonly accountJson;
   private readonly protocolCache;
   /** Namespace account-derived facts by gateway without exposing the key. */
   private accountCacheKey;
@@ -488,8 +507,24 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    */
   allowanceTier(): Promise<'go' | 'goat' | 'pro' | undefined>;
   resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
+  /**
+   * Resolve and validate the key one account-endpoint call will use.
+   *
+   * Every account endpoint runs the chat path's own `assertUsableApiKey` check,
+   * or a key carrying a character no HTTP header can hold throws inside `fetch`
+   * BEFORE any I/O — once per endpoint — and the report reads as "the network is
+   * down". The credential reference is read structurally: it belongs to the
+   * host's resolved options, not to this adapter's connection type, and it only
+   * names the key in the rejection message.
+   *
+   * Separate from {@link accountHeadersFor} so a caller that also needs to key a
+   * cache by the same identity does not have to resolve the key twice.
+   */
+  private usableAccountKey;
   /** The headers every authenticated account endpoint shares. */
   private accountHeaders;
+  /** Headers for an already-validated key; see {@link usableAccountKey}. */
+  private accountHeadersFor;
   /**
    * Fetch one JSON GET and return its HTTP status with a parsed record. The
    * catalog, billing probe, and usage report each apply their own failure
@@ -524,6 +559,23 @@ declare class CommandCodeAdapter<C extends CommandCodeConnectionOptions = Comman
    * everything" (fail-open).
    */
   private loadBillingAccessForKey;
+  /**
+   * One account-endpoint GET, served from {@link accountJson} when `share` and
+   * the same URL answered successfully within {@link ACCOUNT_FACTS_TTL_MS}.
+   *
+   * `timeoutMs` is the CALLER's budget; a cache hit spends none of it. Failures
+   * are never cached, so this can only ever save a request that would have
+   * re-read an answer this process already had.
+   *
+   * `share: false` marks a VOLATILE endpoint — one whose answer is the number
+   * the user is actually looking at, and which must therefore never be replayed
+   * from an earlier request. The usage card's summary is exactly that: its
+   * headline counts and cost are the reason the card exists, and stamping a
+   * cached copy with the current time would misreport when they were read.
+   * Identity and billing facts are the opposite: a plan tier or an org id that
+   * is 30 s old is still the truth, and those are what the picker duplicates.
+   */
+  private accountJsonGet;
   /**
    * The billing facts behind the picker's plan filter, mirroring the CLI's
    * `createBilling` flow: whoami yields the org id, then the subscriptions
@@ -879,6 +931,21 @@ declare class CommandCodeAccountPool {
    * keeps its window unknown on purpose, so a probe can still find out.
    */
   markRejected(apiKey: string, rejection: AccountRejection, resetAtMs?: number): void;
+  /**
+   * 用量报告读到的窗口结论（设置页账号卡片、`/commandcode` 拉取的
+   * `/alpha/billing/credits`）：某个窗口已超限，就按探测的同一口径给这个密钥
+   * 打标记——有可信重置时刻记为到期自动恢复的 `cooldown`，否则为 `unknown`。
+   *
+   * 为什么需要（issue #105）：轮转原本只认真实请求的拒绝，进程重启或冷却过早
+   * 到期后，卡片明明显示「每周 100%」，自动模式和「当前使用」徽标仍选列表第一个
+   * 账号，下一个请求白撞一次拒绝才换号。报告本来就要拉这个接口，把结论记进池里
+   * 不增加任何请求。
+   *
+   * 只加不减：窗口未超限时不清除已有标记。限流（throttle）或消费上限这类拒绝
+   * 在窗口数据里看不到（issue #54），据此清标记会让每次刷新卡片都换来一次注定
+   * 被拒的请求；清除仍只走有节流的探测路径。401 禁用的密钥不改。
+   */
+  noteWindowReport(apiKey: string, verdict: AccountWindowProbe | undefined): void;
   /**
    * Record a model-scoped `unavailable` rejection (no credits, or a model
    * outside this account's plan) as a SHORT-LIVED PREFERENCE demotion.
@@ -1165,10 +1232,9 @@ declare const KNOWN_THINKING_MODELS: ReadonlySet<string>;
  * `/docs/plans/max` and `/docs/resources/pricing-limits`). Each plan's model
  * list is a superset of the one below it: Go ⊂ GOAT ⊂ Pro ⊂ Provider/Max.
  * Models absent from every plan list (Claude Opus/Fable, Fugu Ultra) are
- * Provider-tier. Re-verified at command-code@1.88.0 (2026-10-24) against the
- * live `?view=client` catalog: 105 ids, still a strict superset chain. Mistral
- * Large 4
- * (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
+ * Provider-tier. Re-verified at command-code@1.88.1 (2026-10-28) against the
+ * live `?view=client` catalog: 106 ids, still a strict superset chain. Mistral
+ * Large 4 (1.75.0) was the only addition at the 1.77.0 check; the 1.78.0/1.79.0 pair
  * added Claude Haiku 5.5 at Pro and the free Glyph Cluster preview at Go.
  * 1.79.2 lowers Haiku 5.5's minimum plan to GOAT; 1.80.0 adds Muse Wonder at
  * Max; 1.82.0 adds Gemini 4 Argon at Pro and nothing else moves. The 1.82.4
@@ -1177,7 +1243,8 @@ declare const KNOWN_THINKING_MODELS: ReadonlySet<string>;
  * which left the live catalog. Every other
  * tier is unchanged. The 1.86.1 sync (2026-10-21) adds only the Ornith 1.5 122B
  * launch pair at Go; the 1.87.1 check (2026-10-22) adds no model and moves no
- * tier, and the 2026-10-24 check adds only Kimi K3.1 Pro at Go.
+ * tier, the 2026-10-24 check adds only Kimi K3.1 Pro at Go, and the 2026-10-27
+ * check adds only GPT-6.1 Terra at Pro.
  * The only removals since 1.49.0 are the two retired stealth previews (Pixel
  * Canary at 1.73.1, Space Bunny Alpha at 1.74.3), Ling 3.0 Flash Sante
  * (2026-10-16) and the retired Cat Jam preview (2026-10-20). Per-entry tags