@mars-sea/dsh-commandcode-provider 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-08-19
+
+### Added
+
+- **Multi-account rotation: when one Command Code account exhausts its usage window, requests seamlessly continue on the next account.** A new account pool (`src/accounts.ts`) resolves every configured account's key per request — the top-level `apiKey`/`apiKeyEnv` (plus the CLI auth file) forms the `default` account, and a new `accounts` config/settings list (`[{ label, apiKeyEnv }]`, or `apiKey` literals in composition config) adds more. Rotation is **passive** — zero extra API calls in the steady state: a key is marked only when a request using it is actually rejected pre-stream (429 → exhausted, 401 → disabled), and the adapter retries the same request with the next account's key inside `stream()` (the request body is account-independent and `threadId` is random per request, so the switch is invisible to the model). When every account is marked, the pool probes each key's real five-hour window via `/alpha/billing/credits` (reviving accounts whose window already reset) and otherwise throws a `RATE_LIMIT` error naming **the earliest window reset time**; all-401 throws `INVALID_CREDENTIAL`. Rotation state is keyed by API key, so two slots sharing one credential share one mark.
+- **The settings page gained an "Account rotation" card** (Settings → **Command Code**) to add, label, key, and remove extra accounts — keys are written through the credentials domain under per-account references (`COMMANDCODE_API_KEY_2`, …) exactly like the default key, never through the settings document.
+- **Manual account switching**: a new **Active account** selector on the same card (persisted as the `activeAccount` setting — `default`, or an extra account's credential reference) pins which account serves, effective on the next request after saving. The pinned account serves whenever it is usable; if it is exhausted (or the id is unknown), requests fall back to the first usable account, and automatic rotation still applies. Extra-account slot ids are now the credential reference itself, so a stored selection survives account-list reorders and removals.
+- **Per-account usage everywhere.** The `commandcode/report` Remote result is now `{ accounts: [...] }` (wire schema + descriptor updated; host and client ship in the same bundle), the settings page's account card renders one section per account with **Active / Cooling down / Invalid key** badges, and the `/commandcode` command prints one dashboard section per account with `✅ 当前使用` / `⏳ 限额冷却中` markers. The picker's plan-tier billing cache is now per account as well.
+
+### Changed
+
+- **Synced with the official command-code@1.28.1 CLI** (upstream moved 1.27.1 → 1.27.2 → 1.28.0 → 1.28.1). `COMMAND_CODE_CLI_VERSION` is now `1.28.1`. The only user-visible upstream change is **Qwen 3.8 27B** (added in 1.28.0; 1.28.1 gave it selectable effort levels): it is a Go-tier Vision model with a 262K context, so `KNOWN_PLANS` maps `Qwen/Qwen3.8-27B` to `go`, `KNOWN_IMAGE_MODELS` whitelists it (per the official registry's Vision flag), and `KNOWN_EFFORTS` maps it to `['low', 'medium', 'xhigh']` (per the 1.28.1 bundle's effort map). Re-verified every other snapshot against the official sources with no changes: `KNOWN_THINKING_MODELS` (the new model has efforts, so it is not in the auto-think set), `KNOWN_SUBSCRIPTION_PLANS` (`Nn`/`$n` maps untouched), `KNOWN_DEALS` (same five deals, same terms), and `KNOWN_PEAK_PRICING` (DeepSeek V4 Pro/Flash, 01–04 & 06–10 UTC). Wire protocol, endpoints, headers, and auth flow are byte-identical between the 1.27.1 and 1.28.1 bundles (marker-level diff: same endpoint/request-field/event counts; the ZA model table gained only the new model).
+
+### Fixed
+
+- **Review hardening** (post-implementation review fixes): a failed settings save now stops at the first failed write and reconciles account staging with what actually landed, so a retry can never persist duplicate accounts; the usage card is gated on **any** configured account (not just the default), so a keys-only-on-extra-accounts setup can fetch usage; rotated keys go through the same `assertUsableApiKey` normalization as the first key, keeping the pool's mark identity identical to the wire identity; the probe-revival pass excludes the just-rejected key so a same-request revival cannot re-offer a tried key; a cooldown without a known reset time renders as "cooling down" instead of looking healthy; slots sharing one credential are reported as configured in both usage views; removing the pinned active account also clears the selection; and the pool's dead `activeSlotId()` accessor was removed.
+
 ## [0.4.2] - 2026-08-18
 
 ### Fixed

package/README.md

@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![npm](https://img.shields.io/badge/npm-@mars--sea%2Fdsh--commandcode--provider-blue.svg)](https://www.npmjs.com/package/@mars-sea/dsh-commandcode-provider)
 
-Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harness/) LLM provider plugin for **Command Code**, ported from [pi-commandcode-provider](https://github.com/patlux/pi-commandcode-provider) (MIT). It registers a `commandcode` provider whose requests are translated to Command Code's Provider API (`POST /alpha/generate`, reverse-engineered by the pi plugin, `command-code@1.27.1`).
+Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harness/) LLM provider plugin for **Command Code**, ported from [pi-commandcode-provider](https://github.com/patlux/pi-commandcode-provider) (MIT). It registers a `commandcode` provider whose requests are translated to Command Code's Provider API (`POST /alpha/generate`, reverse-engineered by the pi plugin, `command-code@1.28.1`).
 
 > This is a community integration. You need your own Command Code account and API key or subscription, and Command Code's terms apply. This project is not affiliated with Command Code, Inc.
 
@@ -18,10 +18,11 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 
 - **Plugin bundle** installable into any dsh profile with `dsh plugin add`, plus a **`commandcode` provider route** with a live catalog (`GET {apiBase}/provider/v1/models`, cached at `~/.commandcode/models-cache.json`).
 - **Dedicated "Command Code" settings page** (Settings → **Command Code**) with an **API-key field**, connection knobs (API base, working directory, request/stream timeouts), a **live "Account usage" card** (stats, credits, window-limit bars, subscription plan badge) and a **Hide out-of-plan models** toggle. The key is stored through the dsh credentials service; connection fields land in the `llm-commandcode` section and apply to the very next request, no restart.
+- **Multi-account rotation**: when one account's usage window (e.g. the Go plan's 5-hour limit) is exhausted, requests **seamlessly switch to the next account** — passive switching on 429/401, invisible to the model (the request body is account-independent and `threadId` is random per request); when every account is exhausted the error names **the earliest window reset**. The settings page's **Account rotation** card adds/labels/removes accounts, and `/commandcode` plus the usage card report per-account state. See [Account rotation](#account-rotation).
 - **API key resolution order**: `config.apiKey` → credential ref `apiKeyEnv` (default `COMMANDCODE_API_KEY`) → launch environment → the official CLI auth file (`~/.commandcode/auth.json`, from `command-code login`).
 - **Model-picker annotations**: every model shows the **minimum plan** that includes it (`KNOWN_PLANS`), an **active deal** or `FREE` badge (`KNOWN_DEALS`, expiry-aware so lapsed discounts hide themselves), the **current peak/off-peak state** (`Peak`/`Half`) for time-of-day-priced models, an **`Image`** marker for Vision models, and the **context window** (`1M` / `256K` / `262K`) — e.g. *"Go · 50% off · Image · 1M"*, *"Go · Half · 1M"*. The list is **sorted by plan tier** (Go → GOAT → Pro → Provider/Max), so the models your plan can use lead the picker.
 - **Plan-aware picker filtering**: the picker **hides models above your subscription tier** outright (resolved live from your account's billing state). It fails open — an unreachable billing endpoint, an unknown plan, or a positive on-demand credit balance (which the official CLI treats as unlocking every model) all keep the full catalog visible — and the server stays the final gate. Set **Hide out-of-plan models** off on the settings page (or `filterModelsByPlan: false` in the `llm-commandcode` settings section) to always list every model.
-- **Reasoning-effort support** for models the official catalog marks as such (`KNOWN_EFFORTS`, matching `command-code@1.27.1`); reasoning models without effort levels still think automatically, exactly like the official CLI.
+- **Reasoning-effort support** for models the official catalog marks as such (`KNOWN_EFFORTS`, matching `command-code@1.28.1`); reasoning models without effort levels still think automatically, exactly like the official CLI.
 - **Image input for Vision-capable models** (sent in the official wire format via the dsh attachment service); text-only models refuse images loudly (`UNSUPPORTED_CONTENT`) rather than dropping them.
 
 <img src="assets/screenshots/model-picker.png" alt="Model picker with plan, deal, image and context annotations" width="250">
@@ -139,6 +140,31 @@ The plugin registers a `/commandcode` slash command (requires the dsh `commands`
 
 Each endpoint degrades independently — a temporary failure of one leaves the rest visible and notes the failure inline.
 
+## Account rotation
+
+With several Command Code subscriptions, the plugin **switches to the next account automatically** when one hits its usage limit:
+
+- **Passive switching, zero extra cost**: rotation happens only when a request is actually rejected pre-stream — a 429 (window exhausted) marks the account exhausted, a 401 marks its key disabled, and the adapter immediately re-sends the same request with the next account's key (the request body is account-independent and `threadId` is random per request, so the switch is invisible to the model).
+- **Precise revival**: once every account is marked, the plugin probes each key's real five-hour window via `/alpha/billing/credits` — accounts whose window already reset come back immediately; if all are still exhausted the request fails with a `RATE_LIMIT` error naming **the earliest reset time** (all-401 throws `INVALID_CREDENTIAL`).
+- **Configuration surface**: the **Account rotation** card at Settings → **Command Code** — **Add account**, then give each a label and API key (every key is stored through the credentials service under its own reference `COMMANDCODE_API_KEY_2`, …, write-only like the default key). The top-level key always serves first as the `default` account.
+- **Manual switching**: the **Active account** dropdown on the same card pins the preferred account (persisted as the `activeAccount` setting) — effective on the next request after saving. If the pinned account is exhausted, requests still rotate to another usable account, and once its window resets the pinned account serves again.
+- **Per-account reporting**: the settings page's **Account usage** card renders one section per account with **Active / Cooling down / Invalid key** badges; `/commandcode` prints one dashboard section per account.
+
+The equivalent YAML (`$DSH_HOME/settings.yaml` or composition config):
+
+```yaml
+llm-commandcode:
+  apiKeyEnv: COMMANDCODE_API_KEY        # first (default) account
+  activeAccount: COMMANDCODE_API_KEY_2   # optional: pin the active account (`default` or an account's credential ref)
+  accounts:                              # rotation order after it
+    - label: Go #2
+      apiKeyEnv: COMMANDCODE_API_KEY_2
+    - label: Go #3
+      apiKeyEnv: COMMANDCODE_API_KEY_3
+```
+
+Each account may also carry a literal `apiKey` in composition config (winning over its `apiKeyEnv`); key literals are never stored in the settings document.
+
 ## Configure
 
 **Settings → Command Code** is the primary surface: an **API-key** field (stored in `$DSH_HOME/.credentials.yaml` via the credentials service; write-only, reports whether a key is set), plus **API base URL**, **working directory**, and **request/stream timeout** fields, all written to the `llm-commandcode` section. The catalog is browsable without a key. The **working directory** is optional — leave it blank and the placeholder shows the process cwd it resolves to.

package/README.zh-CN.md

@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![npm](https://img.shields.io/badge/npm-@mars--sea%2Fdsh--commandcode--provider-blue.svg)](https://www.npmjs.com/package/@mars-sea/dsh-commandcode-provider)
 
-非官方 [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harness/) 的 LLM provider 插件，用于 **Command Code**，移植自 [pi-commandcode-provider](https://github.com/patlux/pi-commandcode-provider)（MIT 协议）。它注册了一个 `commandcode` provider，将请求转换为 Command Code 的 Provider API（`POST /alpha/generate`，由 pi 插件逆向工程，对应 `command-code@1.27.1`）。
+非官方 [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harness/) 的 LLM provider 插件，用于 **Command Code**，移植自 [pi-commandcode-provider](https://github.com/patlux/pi-commandcode-provider)（MIT 协议）。它注册了一个 `commandcode` provider，将请求转换为 Command Code 的 Provider API（`POST /alpha/generate`，由 pi 插件逆向工程，对应 `command-code@1.28.1`）。
 
 > 这是一个社区集成。你需要自己的 Command Code 账号、API key 或订阅，并遵守 Command Code 的服务条款。本项目与 Command Code, Inc. 无关。
 
@@ -18,10 +18,11 @@
 
 - **插件包**：可通过 `dsh plugin add` 安装到任意 dsh 配置，并提供 **`commandcode` provider 路由**，带实时模型目录（`GET {apiBase}/provider/v1/models`，缓存于 `~/.commandcode/models-cache.json`）。
 - **专属"Command Code"设置页**（设置 → **Command Code**），带 **API key 输入框**、连接参数（API 地址、工作目录、请求/流超时）、**实时「账户用量」卡片**（统计、额度、窗口进度条、订阅套餐徽章）以及**「隐藏套餐外模型」开关**。密钥通过 dsh 凭据服务存储；连接参数写入 `llm-commandcode` 设置段，对下一次请求即刻生效，无需重启。
+- **多账户轮换**：一个账户的用量窗口（如 Go 套餐的 5 小时限额）打满后，请求**无缝切换到下一个账户**——429/401 触发被动切换，请求体与账户无关（`threadId` 每次随机），模型完全无感；全部耗尽时报错并提示**最早的重置时间**。设置页的「多账户轮换」卡片可添加/命名/移除账户，`/commandcode` 与用量卡片按账户分别展示状态。详见[多账户轮换](#多账户轮换)。
 - **API key 解析顺序**：`config.apiKey` → 凭据引用 `apiKeyEnv`（默认 `COMMANDCODE_API_KEY`）→ 启动环境变量 → 官方 CLI 认证文件（`~/.commandcode/auth.json`，由 `command-code login` 写入）。
 - **模型选择器标注**：每个模型显示包含它的**最低套餐**（`KNOWN_PLANS`）、**活动折扣**或 `FREE` 徽章（`KNOWN_DEALS`，到期自动隐藏已失效折扣）、峰谷定价模型的**当前时段状态**（`Peak`/`Half`，按当前 UTC 小时动态判断）、Vision 模型的 **`Image`** 标记，以及**上下文长度**（`1M` / `256K` / `262K`）——例如 *"Go · 50% off · Image · 1M"*、*"Go · Half · 1M"*。列表**按套餐排序**（Go → GOAT → Pro → Provider/Max），你当前套餐能用的模型总是排在最前。
 - **按套餐过滤选择器**：选择器会**直接隐藏超出你订阅套餐的模型**（根据账户账单状态实时判断）。全程失败开放——账单接口不可用、套餐未知，或账户持有按需余额（官方 CLI 视为解锁全部模型）时都显示完整目录——服务端仍是最终闸门。在设置页关闭「隐藏套餐外模型」开关（或在 `llm-commandcode` 设置段中设 `filterModelsByPlan: false`）可始终列出全部模型。
-- **推理强度（reasoning-effort）支持**：针对官方目录标为推理模型的模型（`KNOWN_EFFORTS`，与 `command-code@1.27.1` 一致）；没有可选档位但仍支持思考的模型会自动思考，与官方 CLI 行为完全一致。
+- **推理强度（reasoning-effort）支持**：针对官方目录标为推理模型的模型（`KNOWN_EFFORTS`，与 `command-code@1.28.1` 一致）；没有可选档位但仍支持思考的模型会自动思考，与官方 CLI 行为完全一致。
 - **支持视觉模型的图片输入**（通过 dsh 附件服务、以官方 wire 格式发送）；纯文本模型会明确拒绝图片（`UNSUPPORTED_CONTENT`）而非静默丢弃。
 
 <img src="assets/screenshots/model-picker.png" alt="带套餐、折扣、图片与上下文标注的模型选择器" width="250">
@@ -139,6 +140,31 @@ dsh web
 
 每个端点独立降级——某个端点临时失败不会影响其他数据，并会在末尾内联提示失败。
 
+## 多账户轮换
+
+有多个 Command Code 订阅时，插件可以在一个账户达到用量限额后**自动切换到下一个账户**：
+
+- **被动切换，零额外开销**：只有请求真正被 pre-stream 拒绝时才轮换——429（窗口打满）标记该账户耗尽、401 标记其密钥失效，adapter 随即用下一个账户的 key 重发同一请求（请求体与账户无关、`threadId` 每次随机，模型完全无感）。
+- **精确复活**：当所有账户都被标记时，插件会用每个 key 查询 `/alpha/billing/credits` 的真实 5 小时窗口——已重置的账户立即复活；仍全部耗尽则抛出 `RATE_LIMIT` 错误并注明**最早的重置时间**（全部为 401 则抛 `INVALID_CREDENTIAL`）。
+- **配置入口**：**设置 → Command Code** 的「多账户轮换」卡片——**添加账户**后为每个账户填备注名和 API key（每个 key 通过凭据服务存于独立引用 `COMMANDCODE_API_KEY_2`…，与默认 key 一样只写不回显）。顶层的 key 始终是第一顺位的 `default` 账户。
+- **手动切换**：同一张卡片上的「当前使用账户」下拉框可以**手动指定优先账户**（持久化为 `activeAccount` 设置项），保存后下次请求即生效；所选账户耗尽时仍自动回落到其他可用账户，窗口重置后自动回到所选账户。
+- **按账户展示**：设置页的「账户用量」卡片按账户分区显示，带「当前使用 / 限额冷却中 / 密钥无效」徽章；`/commandcode` 命令同样按账户输出。
+
+等价的 YAML（`$DSH_HOME/settings.yaml` 或组合配置）：
+
+```yaml
+llm-commandcode:
+  apiKeyEnv: COMMANDCODE_API_KEY        # 第一顺位（default）账户
+  activeAccount: COMMANDCODE_API_KEY_2   # 可选：手动指定当前账户（default 或某账户的凭据引用）
+  accounts:                              # 之后的轮换顺序
+    - label: Go #2
+      apiKeyEnv: COMMANDCODE_API_KEY_2
+    - label: Go #3
+      apiKeyEnv: COMMANDCODE_API_KEY_3
+```
+
+组合配置里每个账户也可写字面量 `apiKey`（优先于其 `apiKeyEnv`）；设置文档中永不存储密钥字面量。
+
 ## 配置
 
 **设置 → Command Code** 是主要配置入口：**API key** 输入框（通过凭据服务存储在 `$DSH_HOME/.credentials.yaml`，只写不回显，并显示是否已配置），以及 **API 地址**、**工作目录**、**请求/流超时**字段，全部写入 `llm-commandcode` 设置段。没有 key 也可以浏览模型目录。**工作目录可选**——留空即可，占位符会显示它实际使用的进程 cwd。