@mars-sea/dsh-commandcode-provider 0.9.1 → 0.10.0-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.10.0-alpha.1] - 2026-09-01
+
+> **Alpha channel for dsh 0.1.2-alpha.2.** This release requires **dsh 0.1.2-alpha.2 or later** and is published under the `alpha` npm tag, so `@latest` stays on 0.9.1 for older Harness releases. Install it explicitly with `@alpha`.
+
+### Changed
+
+- **Raised the minimum supported DeepSeek Harness version to 0.1.2-alpha.2.** Every Harness peer and development package now starts at the alpha.2 line; earlier RC/alpha builds use incompatible Host and browser APIs and are no longer advertised as supported.
+- **Adapted the provider to the 0.1.2-alpha.2 Host and browser contracts.** Tool-call IDs use `ToolCallId`, settings register through the optional `SettingsProvider` service, credential operations use Typert Remotes, and the browser client consumes the current settings/models surfaces without the removed `dsh-client-runtime` package.
+
+### Fixed
+
+- **Restored fresh plugin-marketplace installs under pnpm 10.** The package declares `@deepseek-ai/dsh-invariants` as an explicit alpha.2 Host peer instead of bundling a second Harness core package; a pnpm 10.34.5 tarball-install smoke test pins the isolated-generation path.
+- **Kept the Web client enabled on alpha.2.** The client no longer requests the removed `dsh-client-runtime/client` module, while its React, slot, store, and primitive dependencies match the official alpha.2 platform module table; settings and Models pages therefore remain available instead of disabling the entire client bundle.
+- **Isolated snapshot subscriber failures.** The client-local `getSnapshot`/`subscribe`/`set` store now continues notifying remaining UI consumers when one subscriber throws.
+- **Prevented the friendly image-session error wrapper from blocking alpha.2 client startup.** Alpha.2 no longer exposes `connection.api.sessions`, so the optional copy rewrite safely skips itself when that legacy façade is absent.
+
 ## [0.9.1] - 2026-08-28
 
 ### Added

package/README.md

@@ -18,7 +18,7 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 
 - **Plugin bundle** — install into any dsh profile with `dsh plugin add`; registers a `commandcode` provider route with a live model catalog.
 - **Dedicated settings page** — API key, connection options, a live account-usage card, and a "Hide out-of-plan models" toggle.
-- **Models-page key card** — on dsh 0.1.2-alpha.1 and later, the **Settings → Models → Command Code** card carries the key status, a paste field, and the sign-in button inline; on older dsh builds it is simply absent and the dedicated page remains the surface.
+- **Models-page key card** — the **Settings → Models → Command Code** card carries the key status, a paste field, and the sign-in button inline.
 - **In-browser sign-in for keys** — start the official authorization flow (the same one `cmd login` runs) from the settings page; the approved key lands in the local credential service automatically. Manual paste remains the fallback.
 - **Multi-account rotation** — when one account hits its usage limit, requests switch to the next account automatically. See [Account rotation](#account-rotation).
 - **Flexible API key setup** — via the settings page, an environment variable, or the official CLI login file.
@@ -31,14 +31,31 @@ See [Screenshots](#screenshots) below for what the UI looks like.
 
 ## Install
 
-```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
-```
+Pick the release line that matches your DeepSeek Harness version:
+
+- **dsh 0.1.2-alpha.2 or later** (the current alpha line) — use the matching alpha plugin release. Install explicitly with the `alpha` tag:
+
+  ```sh
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@alpha
+  ```
+
+- **Older dsh releases** (the 0.5.0 line and earlier, which use the rc-era Host/browser APIs) — the 0.9.1 plugin keeps working there and stays on the `latest` tag:
+
+  ```sh
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
+  ```
+
+> The `alpha` tag never moves `latest`: a plain `@latest` install always gets the newest stable release for older Harness versions, and upgrading to the alpha line is always an explicit opt-in.
+
+Fresh pnpm 10 marketplace generations are supported directly. Do not add a separate `@deepseek-ai/dsh-invariants` dependency; the plugin declares it as a Host peer so the active dsh profile remains the owner of Harness packages.
 
 ## Updating
 
+Update with the same tag you installed with:
+
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@alpha      # dsh 0.1.2-alpha.2+
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # older dsh (0.5.0 line)
 ```
 
 Then restart the web app.

package/README.zh-CN.md

@@ -18,7 +18,7 @@
 
 - **插件包**：一条 `dsh plugin add` 命令安装到任意 dsh 配置，注册 `commandcode` provider 路由，带实时模型目录。
 - **专属设置页**：API key 输入、连接参数、实时「账户用量」卡片和「隐藏套餐外模型」开关。
-- **Models 页快捷卡片**：在 dsh 0.1.2-alpha.1 及以上版本，**设置 → Models → Command Code** 卡片内直接显示 key 状态、粘贴输入框和登录按钮；旧版 dsh 上该卡片不出现，一切照旧走专属设置页。
+- **Models 页快捷卡片**：**设置 → Models → Command Code** 卡片内直接显示 key 状态、粘贴输入框和登录按钮。
 - **浏览器内登录获取 key**：设置页一键发起官方授权（与 `cmd login` 同一流程），完成后密钥自动写入本机凭据服务，无需手动创建或粘贴；不可用时随时退回手动粘贴。
 - **多账户轮换**：一个账户用量打满后，请求自动切换到下一个账户。详见[多账户轮换](#多账户轮换)。
 - **key 配置灵活**：设置页填写、环境变量或官方 CLI 登录文件均可。
@@ -29,14 +29,31 @@
 
 ## 安装
 
-```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
-```
+按你的 DeepSeek Harness 版本选择对应的发布线：
+
+- **dsh 0.1.2-alpha.2 或更高版本**（当前 alpha 线）——使用配套的 alpha 插件版本，显式用 `alpha` tag 安装：
+
+  ```sh
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@alpha
+  ```
+
+- **更早的 dsh 版本**（0.5.0 线及更早，使用 rc 时代的 Host/浏览器 API）——0.9.1 插件在这些版本上继续可用，并保持在 `latest` tag：
+
+  ```sh
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
+  ```
+
+> `alpha` tag 永远不会移动 `latest`：普通的 `@latest` 安装始终为旧版 dsh 拿到最新的稳定版，升级到 alpha 线永远是显式选择。
+
+插件可直接在 pnpm 10 的全新插件市场 generation 中安装。不要另行添加 `@deepseek-ai/dsh-invariants` dependency；插件已将其声明为 Host peer，Harness 包仍由当前 dsh profile 统一管理。
 
 ## 更新
 
+用与安装时相同的 tag 更新：
+
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@alpha      # dsh 0.1.2-alpha.2 及以上
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # 更早的 dsh（0.5.0 线）
 ```
 
 然后重启 Web 应用。

package/lib/client.js

@@ -4,10 +4,38 @@ window.__ModuleLoader__.load({
 		var module = { exports: {} };
 		var exports = module.exports;
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-		let _deepseek_ai_dsh_client_runtime_client = require("@deepseek-ai/dsh-client-runtime/client");
 		let react = require("react");
 		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
 		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/client/snapshot-store.ts
+		/** Notify every subscriber without letting one faulty UI consumer suppress the rest. */
+		function notifyListeners(listeners) {
+			for (const listener of listeners) try {
+				listener();
+			} catch (error) {
+				console.error("[dsh-commandcode-provider] snapshot subscriber failed:", error);
+			}
+		}
+		/** Create one observable snapshot store. */
+		function createSnapshotStore(initial) {
+			let snapshot = initial;
+			const listeners = /* @__PURE__ */ new Set();
+			return {
+				getSnapshot: () => snapshot,
+				subscribe(listener) {
+					listeners.add(listener);
+					return () => {
+						listeners.delete(listener);
+					};
+				},
+				set(value) {
+					if (Object.is(value, snapshot)) return;
+					snapshot = value;
+					notifyListeners(listeners);
+				}
+			};
+		}
+		//#endregion
 		//#region src/command-locales.ts
 		const commandcodeCommand = {
 			zh: {
@@ -137,12 +165,49 @@ window.__ModuleLoader__.load({
 				}
 			};
 		}
-		/** Install the wrapper on a connection's shared sessions face. */
+		/**
+		* Install the friendly-error wrapper when a legacy sessions face is present.
+		*
+		* @returns whether the wrapper was installed. The rewrite is only UX polish;
+		* a 0.1.2 connection has no `api.sessions`, and its absence must never block
+		* the plugin from mounting its settings, credential, or usage surfaces.
+		*/
 		function installFriendlyImageError(connection, getLocale) {
-			connection.api.sessions = withFriendlyImageError(connection.api.sessions, getLocale);
+			const api = connection.api;
+			const sessions = api?.sessions;
+			if (api === void 0 || sessions === void 0 || typeof sessions.selectModel !== "function") return false;
+			api.sessions = withFriendlyImageError(sessions, getLocale);
+			return true;
 		}
 		//#endregion
 		//#region src/client/settings.ts
+		/**
+		* Browser controller for the "Command Code" settings page.
+		*
+		* The page lives at the same settings-nav level as General / Models / Plugins
+		* (a `settings.section` entry, id `commandcode`). It exists because the
+		* Models page renders an unknown-adapter-family card for the `commandcode`
+		* provider and deliberately disables its submit — the API key cannot be
+		* configured there. This page owns the connection facts the plugin resolves
+		* per request:
+		*
+		*   - API key   -> written through the credentials domain under the reference
+		*                  the plugin resolves (`apiKeyEnv`, default
+		*                  `COMMANDCODE_API_KEY`). The literal never rides a response,
+		*                  so the control only reports whether one is configured.
+		*   - API base  -> the `llm-commandcode` settings namespace (`apiBase`), same
+		*                  namespace the Models page card addresses.
+		*   - Working dir, request/stream timeouts -> the same namespace.
+		*
+		* The controller mirrors the plugin-card pattern from the harness's own
+		* settings UI: it binds the `llm-commandcode` namespace through the
+		* `settingsScope` service, keeps a staged draft of edits, and writes them on
+		* save through `scope.set` / the credentials domain. The Host stays the
+		* single fact source; the snapshot is republished after each accepted write.
+		*
+		* This module is deliberately free of JSX — it only produces the state face
+		* the React component renders.
+		*/
 		/** The settings namespace the plugin registers (host half, src/index.ts). */
 		const COMMANDCODE_NS = "llm-commandcode";
 		/** Default credential reference the plugin resolves when none is named. */
@@ -607,10 +672,7 @@ window.__ModuleLoader__.load({
 			/** Write one account's key, then re-read the Host's credential states. */
 			async writeKeyTo(ref, value) {
 				try {
-					if (!(await this.api.credentials.set({
-						ref,
-						value
-					})).result.ok) return false;
+					if (!(await this.api.credentials.set(ref, value)).ok) return false;
 				} catch {
 					return false;
 				}
@@ -626,14 +688,14 @@ window.__ModuleLoader__.load({
 				];
 				let response;
 				try {
-					response = await this.api.credentials.describe({ refs });
+					response = await this.api.credentials.describe(refs);
 				} catch {
 					return;
 				}
-				if (!response.result.ok) return;
+				if (!response.ok) return;
 				let changed = false;
 				for (const ref of refs) {
-					const view = response.result.value.credentials[ref];
+					const view = response.value?.[ref];
 					const next = {
 						configured: view?.configured ?? false,
 						writable: view?.writable ?? true
@@ -711,7 +773,7 @@ window.__ModuleLoader__.load({
 			/** Unset one stored credential, then re-read the Host's credential states. */
 			async unsetKey(ref) {
 				try {
-					if (!(await this.api.credentials.unset({ ref })).result.ok) return false;
+					if (!(await this.api.credentials.unset(ref)).ok) return false;
 				} catch {
 					return false;
 				}
@@ -751,6 +813,47 @@ window.__ModuleLoader__.load({
 			}
 		};
 		//#endregion
+		//#region src/client/legacy-credentials.ts
+		/** Convert a legacy credentials ApiProxy into the current settings-page face. */
+		function adaptLegacyCredentials(legacy) {
+			if (legacy === void 0) return void 0;
+			return { credentials: {
+				describe: async (refs) => {
+					const response = await legacy.describe({ refs });
+					return response.result.ok ? {
+						ok: true,
+						value: response.result.value.credentials
+					} : {
+						ok: false,
+						error: response.result.error
+					};
+				},
+				set: async (ref, value) => {
+					const response = await legacy.set({
+						ref,
+						value
+					});
+					return response.result.ok ? {
+						ok: true,
+						value: void 0
+					} : {
+						ok: false,
+						error: response.result.error
+					};
+				},
+				unset: async (ref) => {
+					const response = await legacy.unset({ ref });
+					return response.result.ok ? {
+						ok: true,
+						value: void 0
+					} : {
+						ok: false,
+						error: response.result.error
+					};
+				}
+			} };
+		}
+		//#endregion
 		//#region src/client/usage.ts
 		const IDLE = {
 			status: "idle",
@@ -1299,7 +1402,7 @@ window.__ModuleLoader__.load({
 		};
 		//#endregion
 		//#region package.json
-		var version = "0.9.1";
+		var version = "0.10.0-alpha.1";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -2538,7 +2641,7 @@ window.__ModuleLoader__.load({
 		/**
 		* The Command Code provider card inside the harness Models settings page
 		* (browser half). Rendered through the `settings.models.provider-card` keyed
-		* slot introduced in dsh 0.1.2-alpha.1, registered with
+		* slot available in dsh 0.1.2-alpha.2, registered with
 		* `entryKey = 'llm-commandcode'` (the plugin's settings namespace, the key the
 		* Models page dispatches for every Command Code provider row).
 		*
@@ -3128,25 +3231,38 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			document.head.appendChild(tag);
 		}
 		/**
-		* Client plugin body. Gates on the services the settings page needs
-		* (`slots`, `locale`, `connection`, `remote`, `settingsScope`) plus the
-		* `connection` used by the friendly-error wrapper — the same inject list the
-		* harness's own settings-surface plugins declare.
+		* Client plugin body. Gates on the services shared by both client generations
+		* (`slots`, `locale`, `connection`, `remote`, `settingsScope`). Current clients
+		* mount the page after `remote.credentials` appears; legacy clients mount it
+		* from the connection ApiProxy credential face.
 		*/
 		function apply(ctx) {
 			injectPageCss();
 			const connection = ctx.get("connection");
-			if (connection !== void 0) installFriendlyImageError(connection, () => ctx.locale.getLocale().active);
+			if (connection !== void 0) installFriendlyImageError(connection, () => ctx.locale.getLocale().active === "zh" ? "zh" : "en");
 			ctx.effect(() => ctx.locale.register("settings.commandcode", {
 				zh,
 				en
 			}), "dsh-commandcode-provider: page copy");
-			const api = ctx.get("connection").api;
-			const hostDescription = ctx.get("connection").hostDescription;
-			const controller = new CommandCodeSettingsController(ctx.settingsScope.bind({ namespace: COMMANDCODE_NS }), { credentials: api.credentials }, hostDescription);
+			const legacyApi = adaptLegacyCredentials(connection?.api?.credentials);
+			if (legacyApi !== void 0) {
+				applyClientSurfaces(ctx, legacyApi, connection?.hostDescription);
+				return;
+			}
+			ctx.inject(["remote.credentials"], (remoteCtx) => {
+				const credentials = remoteCtx.remote.credentials;
+				applyClientSurfaces(remoteCtx, { credentials });
+			});
+		}
+		/** Mount the one shared UI implementation over either credential transport. */
+		function applyClientSurfaces(ctx, api, hostDescription) {
+			const controller = new CommandCodeSettingsController(ctx.settingsScope.bind({ namespace: COMMANDCODE_NS }), api, hostDescription);
 			ctx.effect(() => () => controller.dispose(), "dsh-commandcode-provider: settings controller");
-			const store = (0, _deepseek_ai_dsh_client_runtime_client.createSnapshotStore)(controller.state());
+			const store = createSnapshotStore(controller.state());
 			controller.subscribe(() => store.set(controller.state()));
+			ctx.effect(() => ctx.remote.$on("credentials/reference-updated", () => {
+				controller.refreshCredentials();
+			}), "dsh-commandcode-provider: credential invalidations");
 			let usageNamespace;
 			let usageMountError;
 			const contribution = {
@@ -3186,7 +3302,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 				return namespace.report();
 			} });
 			ctx.effect(() => () => usageController.dispose(), "dsh-commandcode-provider: usage controller");
-			const usageStore = (0, _deepseek_ai_dsh_client_runtime_client.createSnapshotStore)(usageController.state());
+			const usageStore = createSnapshotStore(usageController.state());
 			usageController.subscribe(() => usageStore.set(usageController.state()));
 			const loginRemote = {
 				loginBegin: async () => {
@@ -3213,7 +3329,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			};
 			const loginController = new CommandCodeLoginController(() => loginRemote);
 			ctx.effect(() => () => loginController.dispose(), "dsh-commandcode-provider: login controller");
-			const loginStore = (0, _deepseek_ai_dsh_client_runtime_client.createSnapshotStore)(loginController.state());
+			const loginStore = createSnapshotStore(loginController.state());
 			let lastLoginPhase = loginController.state().phase;
 			loginController.subscribe(() => {
 				const phase = loginController.state().phase;