@mars-sea/dsh-commandcode-provider 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.1] - 2026-08-22
+
+### Added
+
+- **New model: Ox Alpha (`stealth/ox-alpha`, command-code@1.31.0).** A free 1M-context reasoning model with vision input, included on every plan: it appears in the picker under the Go tier with `FREE` · `Image` · `1M` markers, is whitelisted as vision-capable and auto-thinking (it reasons automatically with no selectable effort levels), and carries a `FREE` deal while the stealth preview lasts.
+- **The settings page now shows the plugin version** as a muted footer line ("Command Code Provider v0.6.1"), read from package.json at build time so it always matches the published release.
+- **Settings-page input polish:** a brief "Saved ✓" confirmation flashes after each accepted save (failures already showed an error); the two millisecond timeout fields now validate their range while typing with specific messages ("must be at least 1" / "above the allowed maximum") instead of a generic save-time failure; and the API-key fields (default + every account) gained a Show/Hide toggle so a pasted key can be spot-checked.
+
+### Changed
+
+- **Retries are now persistent (opencode-style) instead of two attempts.** Transient failures — rate limits, server errors, timeouts, transport drops, empty responses — retry up to 1000 times at the agent-step boundary, with waits doubling from 500 ms and capping at 15 minutes (±10% jitter). Permanent failures (an invalid key, unsupported content, plan rejections) still fail fast on the first attempt. Waits are smart: a 429's `Retry-After` header and the rotation pool's earliest known window-reset time are honored verbatim up to the 15-minute cap, so when every account's usage window is exhausted the session sleeps through the window and recovers in place instead of dying after two quick tries.
+- **Synced with the official command-code@1.31.0 CLI** (upstream moved 1.28.4 → 1.29.0 → 1.30.0 → 1.30.1 → 1.31.0; the intermediate releases shipped BYOK provider support, model-traffic routing, and CLI UI fixes — none touch the Provider API). `COMMAND_CODE_CLI_VERSION` is now `1.31.0`. The only snapshot change across those releases is the new Ox Alpha model above; wire protocol, endpoints, effort map, plan maps, deals, and peak pricing are all unchanged.
+- **Verified compatibility with DeepSeek Harness 0.1.0-rc.7 / 0.1.0-rc.8 / 0.1.1-rc.1**, including rc.8's reworked client boot protocol: the client bundle now declares its module-graph dependency (`dsh.client.external`), so client-module load order no longer relies on the platform seed table. The supported peer range widened to `^0.1.0-rc.6 || ^0.1.1-rc.1`, so 0.1.1 hosts install without unmet-peer-dependency warnings.
+
 ## [0.6.0] - 2026-08-19
 
 ### Changed

package/lib/client.js

@@ -59,8 +59,15 @@ window.__ModuleLoader__.load({
 				}
 			};
 		}
-		/** A whole-number field; an empty draft clears it, anything non-numeric blocks save. */
-		function numberField$1(field) {
+		/**
+		* A numeric field; an empty draft clears it, anything non-numeric blocks
+		* save, and an optional inclusive `bounds` range rejects out-of-range values
+		* with a specific reason (the Host schema would reject them at save time with
+		* only a generic failure — catching it here names the problem while typing).
+		* Decimals pass: the Host schema is `z.number()` too, and a fractional
+		* millisecond value is harmless even if pointless.
+		*/
+		function numberField$1(field, bounds) {
 			return {
 				field,
 				format: (value) => typeof value === "number" ? String(value) : "",
@@ -68,10 +75,22 @@ window.__ModuleLoader__.load({
 					const trimmed = text.trim();
 					if (trimmed === "") return { kind: "clear" };
 					const parsed = Number(trimmed);
-					return Number.isFinite(parsed) ? {
+					if (!Number.isFinite(parsed)) return {
+						kind: "invalid",
+						reason: "format"
+					};
+					if (bounds?.min !== void 0 && parsed < bounds.min) return {
+						kind: "invalid",
+						reason: "tooSmall"
+					};
+					if (bounds?.max !== void 0 && parsed > bounds.max) return {
+						kind: "invalid",
+						reason: "tooLarge"
+					};
+					return {
 						kind: "set",
 						value: parsed
-					} : { kind: "invalid" };
+					};
 				}
 			};
 		}
@@ -95,16 +114,26 @@ window.__ModuleLoader__.load({
 						kind: "set",
 						value: false
 					};
-					return { kind: "invalid" };
+					return {
+						kind: "invalid",
+						reason: "format"
+					};
 				}
 			};
 		}
+		const MAX_TIMEOUT_MS = 2147483647;
 		/** The fields this page edits inside the `llm-commandcode` namespace. */
 		const SECTION_FIELDS = [
 			textField("apiBase"),
 			textField("workingDir"),
-			numberField$1("requestTimeoutMs"),
-			numberField$1("streamIdleTimeoutMs"),
+			numberField$1("requestTimeoutMs", {
+				min: 1,
+				max: MAX_TIMEOUT_MS
+			}),
+			numberField$1("streamIdleTimeoutMs", {
+				min: 1,
+				max: MAX_TIMEOUT_MS
+			}),
 			booleanField$1("filterModelsByPlan"),
 			textField("activeAccount")
 		];
@@ -136,6 +165,7 @@ window.__ModuleLoader__.load({
 			keyDrafts = /* @__PURE__ */ new Map();
 			saving = false;
 			failed = false;
+			savedCount = 0;
 			/**
 			* @param scope - bound scope for the `llm-commandcode` namespace.
 			* @param api - credentials wire face.
@@ -206,7 +236,8 @@ window.__ModuleLoader__.load({
 						text: this.staged.get("apiKey")?.text ?? "",
 						clear: false,
 						overridden: false,
-						invalid: false
+						invalid: false,
+						invalidReason: void 0
 					},
 					apiBase: this.field("apiBase"),
 					workingDir: this.field("workingDir"),
@@ -220,7 +251,8 @@ window.__ModuleLoader__.load({
 					dirty: plan.length > 0 || this.accountsDirty(),
 					invalid: plan.some((item) => item.run === void 0),
 					saving: this.saving,
-					failed: this.failed
+					failed: this.failed,
+					savedCount: this.savedCount
 				};
 			}
 			/** Stage a new extra account (saved on the next `save()`). */
@@ -322,6 +354,7 @@ window.__ModuleLoader__.load({
 				this.saving = false;
 				this.failed = !landed;
 				if (landed) {
+					this.savedCount += 1;
 					this.staged.clear();
 					this.clearAccountStaging();
 				} else this.reconcileAccountStaging();
@@ -356,14 +389,16 @@ window.__ModuleLoader__.load({
 					text: spec.format(this.sectionValue(field)),
 					clear: false,
 					overridden: this.stored(field),
-					invalid: false
+					invalid: false,
+					invalidReason: void 0
 				};
 				const parsed = staged.clear ? { kind: "clear" } : spec.parse(staged.text);
 				return {
 					text: staged.text,
 					clear: staged.clear,
 					overridden: parsed.kind === "set",
-					invalid: parsed.kind === "invalid"
+					invalid: parsed.kind === "invalid",
+					invalidReason: parsed.kind === "invalid" ? parsed.reason : void 0
 				};
 			}
 			sectionValue(field) {
@@ -809,6 +844,21 @@ window.__ModuleLoader__.load({
 			}]
 		};
 		//#endregion
+		//#region src/client/version.ts
+		/**
+		* The plugin's own version, read from package.json at build time.
+		*
+		* The client bundle inlines the JSON import (rolldown resolves it during the
+		* tsdown build; node tests read it through tsx), so the rendered value always
+		* matches the published package version with no second constant to keep in
+		* sync. Rendered as a muted footer line on the settings page so a user can
+		* report the exact build they run.
+		*
+		* @module dsh-commandcode-provider/client/version
+		*/
+		/** The published package version (e.g. `'0.6.0'`). */
+		const PLUGIN_VERSION = "0.6.1";
+		//#endregion
 		//#region src/client/section.tsx
 		/**
 		* React component for the "Command Code" settings page (browser half).
@@ -861,11 +911,17 @@ window.__ModuleLoader__.load({
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						className: state.invalid ? "cc-invalid" : "cc-hint",
-						children: state.invalid ? t("invalidNumber") : hint
+						children: state.invalid ? invalidCopy(state.invalidReason, t) : hint
 					})
 				]
 			});
 		}
+		/** The per-field error copy for a staged draft's failure reason. */
+		function invalidCopy(reason, t) {
+			if (reason === "tooSmall") return t("numberTooSmall");
+			if (reason === "tooLarge") return t("numberTooLarge");
+			return t("invalidNumber");
+		}
 		/**
 		* One boolean field row rendered as a toggle. The staged text is `'true'` /
 		* `'false'` / `''` (unset → `defaultChecked`); toggling stages the string the
@@ -911,8 +967,13 @@ window.__ModuleLoader__.load({
 				})]
 			});
 		}
-		/** The API-key control: write-only, reports configured state, never echoes the key. */
-		function SecretKeyField({ label, hint, state, disabled, configured, configuredLabel, unconfiguredLabel, onEdit }) {
+		/**
+		* The API-key control: write-only, reports configured state, never echoes the
+		* key. The input is masked by default with a Show/Hide toggle so a pasted key
+		* can be spot-checked without leaving the field.
+		*/
+		function SecretKeyField({ label, hint, state, disabled, configured, configuredLabel, unconfiguredLabel, showLabel, hideLabel, onEdit }) {
+			const [visible, setVisible] = (0, react.useState)(false);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "cc-field",
 				children: [
@@ -922,19 +983,26 @@ window.__ModuleLoader__.load({
 							className: "cc-label",
 							htmlFor: "cc-api-key",
 							children: label
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 							className: "cc-badges",
-							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: configured ? "cc-badge" : "cc-badgeMuted",
 								children: configured ? configuredLabel : unconfiguredLabel
-							})
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "cc-reset",
+								disabled,
+								onClick: () => setVisible((value) => !value),
+								children: visible ? hideLabel : showLabel
+							})]
 						})]
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 						id: "cc-api-key",
 						className: "cc-input",
-						type: "password",
+						type: visible ? "text" : "password",
 						autoComplete: "off",
+						spellCheck: false,
 						value: state.text,
 						disabled,
 						onChange: (event) => onEdit(event.target.value)
@@ -1287,6 +1355,7 @@ window.__ModuleLoader__.load({
 		*/
 		function AccountRow({ account, disabled, t, onLabel, onKey, onRemove }) {
 			const locked = !account.writable;
+			const [keyVisible, setKeyVisible] = (0, react.useState)(false);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "cc-field",
 				children: [
@@ -1307,6 +1376,13 @@ window.__ModuleLoader__.load({
 									className: account.configured ? "cc-badge" : "cc-badgeMuted",
 									children: account.configured ? t("apiKeySet") : t("apiKeyUnset")
 								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "cc-reset",
+									disabled,
+									onClick: () => setKeyVisible((value) => !value),
+									children: keyVisible ? t("hide") : t("show")
+								}),
 								account.added ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									type: "button",
 									className: "cc-reset",
@@ -1328,8 +1404,9 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 						id: `cc-account-key-${account.id}`,
 						className: "cc-input",
-						type: "password",
+						type: keyVisible ? "text" : "password",
 						autoComplete: "off",
+						spellCheck: false,
 						placeholder: t("accountKey"),
 						value: account.keyText,
 						disabled: disabled || locked,
@@ -1432,6 +1509,21 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		/**
+		* Show the "Saved ✓" affordance for a short window after each accepted save.
+		* The controller only counts saves (`savedCount`); the flash timing lives
+		* here so the state machine stays timer-free.
+		*/
+		function useSavedFlash(tick) {
+			const [visible, setVisible] = (0, react.useState)(false);
+			(0, react.useEffect)(() => {
+				if (tick === 0) return;
+				setVisible(true);
+				const timer = setTimeout(() => setVisible(false), 2500);
+				return () => clearTimeout(timer);
+			}, [tick]);
+			return visible;
+		}
 		/** The settings page body: connection facts for the Command Code provider. */
 		function CommandCodeSettingsPage(props) {
 			const { t } = props;
@@ -1439,6 +1531,7 @@ window.__ModuleLoader__.load({
 			const usage = props.useCommandCodeUsage((snapshot) => snapshot);
 			const disabled = !state.writable;
 			const keyLocked = !state.apiKeyWritable;
+			const savedVisible = useSavedFlash(state.savedCount);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: "cc-section",
 				"aria-label": t("title"),
@@ -1488,6 +1581,8 @@ window.__ModuleLoader__.load({
 								configured: state.apiKeyConfigured,
 								configuredLabel: t("apiKeySet"),
 								unconfiguredLabel: t("apiKeyUnset"),
+								showLabel: t("show"),
+								hideLabel: t("hide"),
 								onEdit: (text) => props.edit("apiKey", text)
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
@@ -1554,6 +1649,11 @@ window.__ModuleLoader__.load({
 								role: "status",
 								children: t("saveFailed")
 							}) : null,
+							savedVisible ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "cc-saved",
+								role: "status",
+								children: t("saved")
+							}) : null,
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 								variant: "ghost",
 								size: "sm",
@@ -1569,6 +1669,10 @@ window.__ModuleLoader__.load({
 								children: t(state.saving ? "saving" : "save")
 							})
 						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+						className: "cc-version",
+						children: ["Command Code Provider v", PLUGIN_VERSION]
 					})
 				]
 			});
@@ -1608,13 +1712,18 @@ window.__ModuleLoader__.load({
 			overridden: "已覆盖",
 			reset: "重置",
 			invalidNumber: "无效数字",
+			numberTooSmall: "不能小于 1（毫秒）",
+			numberTooLarge: "超出允许上限（2147483647 毫秒）",
 			readOnly: "当前配置为只读。",
 			unsaved: "未保存",
 			save: "保存",
 			saving: "保存中",
+			saved: "已保存 ✓",
 			saveFailed: "保存失败，请重试。",
 			discard: "放弃",
 			cancel: "取消",
+			show: "显示",
+			hide: "隐藏",
 			usageTitle: "账户用量",
 			usageRefresh: "刷新",
 			usageRefreshing: "刷新中…",
@@ -1676,13 +1785,18 @@ window.__ModuleLoader__.load({
 			overridden: "Overridden",
 			reset: "Reset",
 			invalidNumber: "Invalid number",
+			numberTooSmall: "Must be at least 1 (ms)",
+			numberTooLarge: "Above the allowed maximum (2147483647 ms)",
 			readOnly: "Settings are read-only.",
 			unsaved: "Unsaved",
 			save: "Save",
 			saving: "Saving",
+			saved: "Saved ✓",
 			saveFailed: "Save failed, please retry.",
 			discard: "Discard",
 			cancel: "Cancel",
+			show: "Show",
+			hide: "Hide",
 			usageTitle: "Account usage",
 			usageRefresh: "Refresh",
 			usageRefreshing: "Refreshing…",
@@ -1783,6 +1897,8 @@ window.__ModuleLoader__.load({
 .cc-usageMetaSpacer{flex:1}
 .cc-usageUpdated{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:1.5}
 .cc-usagePartial{color:var(--dsw-alias-label-error);margin:0;font-size:11px;line-height:1.5}
+.cc-version{margin:4px 0 0;text-align:center;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}
+.cc-saved{color:var(--dsw-alias-state-success-primary,var(--dsw-alias-label-secondary));margin:0;font-size:12px;font-weight:500;line-height:1.5}
 `;
 		/** Inject the page stylesheet once (idempotent per tag). */
 		function injectPageCss() {