@toddzheng024/dscode-bundle 0.7.6 → 0.7.7

package/plugins/providers/openrouter-account.mjs

@@ -0,0 +1,171 @@
+// OpenRouter account facts for /openrouter and the footer balance. The inference key
+// reads the account credits and its own limit and usage; an optional management key,
+// which cannot call models, adds every key's usage and the last 30 days of spend.
+// This directory also ships beside the TUI, so the module imports nothing.
+export const OPENROUTER_API = 'https://openrouter.ai/api/v1';
+export const MANAGEMENT_REF = 'OPENROUTER_MANAGEMENT_KEY';
+
+const finite = value => {
+  const number = Number(value);
+  return value !== null && value !== undefined && value !== '' && Number.isFinite(number) ? number : undefined;
+};
+
+export class OpenRouterAccountError extends Error {
+  constructor(message, status) {
+    super(message);
+    this.name = 'OpenRouterAccountError';
+    this.status = status;
+  }
+}
+
+async function get(path, key, { fetch: fetchImpl = globalThis.fetch, signal } = {}) {
+  let response;
+  try {
+    response = await fetchImpl(`${OPENROUTER_API}${path}`, { headers: { authorization: `Bearer ${key}`, accept: 'application/json' }, signal });
+  } catch (error) {
+    throw new OpenRouterAccountError(`OpenRouter is unreachable: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let body;
+  try { body = await response.json(); } catch { body = undefined; }
+  if (!response.ok) throw new OpenRouterAccountError(typeof body?.error?.message === 'string' ? body.error.message : `HTTP ${response.status}`, response.status);
+  return body;
+}
+
+/** Account credits from a `/credits` body, or undefined when it carries none. */
+export function creditsOf(body) {
+  const total = finite(body?.data?.total_credits), used = finite(body?.data?.total_usage);
+  if (total === undefined || used === undefined || total < 0 || used < 0) return undefined;
+  return { total, used, remaining: Math.max(0, total - used) };
+}
+
+/** Remaining USD account credits from a `/credits` body: purchased minus used. */
+export function parseOpenRouterCredits(body) {
+  return creditsOf(body)?.remaining ?? null;
+}
+
+/** Remaining USD credit limit from a `/key` body; null when the key has no limit. */
+export function parseOpenRouterKeyRemaining(body) {
+  const remaining = body?.data?.limit_remaining;
+  if (remaining == null) return null;
+  const value = Number(remaining);
+  return Number.isFinite(value) ? Math.max(0, value) : null;
+}
+
+function keyOf(raw) {
+  return {
+    label: typeof raw?.label === 'string' ? raw.label : undefined,
+    name: typeof raw?.name === 'string' && raw.name.length > 0 ? raw.name : undefined,
+    disabled: raw?.disabled === true,
+    limit: finite(raw?.limit),
+    limitRemaining: finite(raw?.limit_remaining),
+    usage: finite(raw?.usage),
+    usageDaily: finite(raw?.usage_daily),
+    usageWeekly: finite(raw?.usage_weekly),
+    usageMonthly: finite(raw?.usage_monthly),
+  };
+}
+
+/**
+ * Verify a management key before it is stored. Account activity is the reading OpenRouter
+ * refuses an inference key; `/credits`, though documented as management-only, serves both.
+ * @throws OpenRouterAccountError with a message fit for the key prompt.
+ */
+export async function verifyManagementKey(key, options) {
+  try {
+    await get('/activity', key, options);
+  } catch (error) {
+    if (error instanceof OpenRouterAccountError && (error.status === 401 || error.status === 403)) {
+      throw new OpenRouterAccountError('This is not a management key: OpenRouter refused it for account data. Create one under Settings → Management keys.', error.status);
+    }
+    throw error;
+  }
+}
+
+/** The `/activity` rows (last 30 completed UTC days) as totals and the top models with the providers that served them. */
+export function summarizeActivity(rows, top = 5) {
+  const models = new Map(), days = new Set();
+  let usage = 0, requests = 0;
+  for (const row of Array.isArray(rows) ? rows : []) {
+    if (typeof row?.model !== 'string') continue;
+    const cost = finite(row.usage) ?? 0, count = finite(row.requests) ?? 0;
+    usage += cost;
+    requests += count;
+    if (typeof row.date === 'string') days.add(row.date);
+    const entry = models.get(row.model) ?? { model: row.model, usage: 0, requests: 0, providers: new Map() };
+    entry.usage += cost;
+    entry.requests += count;
+    const name = typeof row.provider_name === 'string' && row.provider_name.length > 0 ? row.provider_name : 'unknown';
+    const served = entry.providers.get(name) ?? { name, usage: 0, requests: 0 };
+    served.usage += cost;
+    served.requests += count;
+    entry.providers.set(name, served);
+    models.set(row.model, entry);
+  }
+  const ranked = [...models.values()].sort((left, right) => right.usage - left.usage || right.requests - left.requests).slice(0, top)
+    .map(entry => ({ ...entry, providers: [...entry.providers.values()].sort((left, right) => right.usage - left.usage) }));
+  return { usage, requests, days: days.size, modelCount: models.size, models: ranked };
+}
+
+/**
+ * Everything /openrouter shows. Each section settles on its own: `{ value }`, `{ error }`,
+ * or undefined when the key it needs is missing.
+ */
+export async function loadOpenRouterAccount({ apiKey, managementKey, fetch, signal } = {}) {
+  const options = { fetch, signal };
+  const section = (key, run) => key ? run().then(value => ({ value }), error => ({ error: error instanceof Error ? error.message : String(error) })) : Promise.resolve(undefined);
+  const [key, credits, keys, activity] = await Promise.all([
+    section(apiKey, async () => keyOf((await get('/key', apiKey, options))?.data)),
+    section(managementKey ?? apiKey, async () => {
+      const credits = creditsOf(await get('/credits', managementKey ?? apiKey, options));
+      if (!credits) throw new Error('OpenRouter returned no account credits');
+      return credits;
+    }),
+    section(managementKey, async () => {
+      const body = await get('/keys', managementKey, options);
+      return (Array.isArray(body?.data) ? body.data : []).map(keyOf);
+    }),
+    section(managementKey, async () => summarizeActivity((await get('/activity', managementKey, options))?.data)),
+  ]);
+  return { hasApiKey: Boolean(apiKey), hasManagementKey: Boolean(managementKey), key, credits, keys, activity };
+}
+
+const money = value => Number.isFinite(value) ? `$${value.toFixed(2)}` : '$--';
+const limitText = key => key.limit === undefined ? 'no limit' : `limit ${money(key.limit)}, ${money(key.limitRemaining)} left`;
+
+/**
+ * The panel's lines for a loaded account.
+ * @returns `{ text, tone }` rows; tone is `title`, `value`, `dim` or `error`.
+ */
+export function openRouterAccountLines(account, { maxKeys = 5 } = {}) {
+  const lines = [];
+  const push = (text, tone = 'value') => lines.push({ text, tone });
+  if (!account.hasApiKey) push('No OpenRouter API key: run /login openrouter.', 'error');
+  if (account.credits?.value) {
+    const { remaining, total, used } = account.credits.value;
+    push(`Account balance  ${money(remaining)} · credits ${money(total)} · used ${money(used)}`, 'title');
+  } else if (account.credits?.error) push(`Account balance unavailable: ${account.credits.error}`, 'error');
+  else push('Account balance  $--', 'dim');
+  if (account.key?.value) {
+    const key = account.key.value;
+    push(`This key  ${key.label ?? 'unnamed'} · ${limitText(key)}`, 'title');
+    push(`  today ${money(key.usageDaily)} · week ${money(key.usageWeekly)} · month ${money(key.usageMonthly)}`, 'dim');
+  } else if (account.key?.error) push(`This key unavailable: ${account.key.error}`, 'error');
+  if (!account.hasManagementKey) push('API keys and 30-day spend  press m to add a management key', 'dim');
+  if (account.keys?.value) {
+    const keys = [...account.keys.value].sort((left, right) => (right.usageMonthly ?? 0) - (left.usageMonthly ?? 0));
+    push(`API keys (${keys.length})`, 'title');
+    for (const key of keys.slice(0, maxKeys)) {
+      const current = account.key?.value?.label !== undefined && key.label === account.key.value.label;
+      push(`  ${key.name ?? key.label ?? 'unnamed'}${current ? ' (this key)' : ''}${key.disabled ? ' · disabled' : ''} · today ${money(key.usageDaily)} · month ${money(key.usageMonthly)} · ${limitText(key)}`, key.disabled ? 'dim' : 'value');
+    }
+    if (keys.length > maxKeys) push(`  +${keys.length - maxKeys} more`, 'dim');
+  } else if (account.keys?.error) push(`API keys unavailable: ${account.keys.error}`, 'error');
+  if (account.activity?.value) {
+    const activity = account.activity.value;
+    push(`Last 30 days  ${money(activity.usage)} · ${activity.requests} requests · ${activity.modelCount} models`, 'title');
+    for (const model of activity.models) {
+      push(`  ${model.model} · ${money(model.usage)} · ${model.requests} req · ${model.providers.map(provider => `${provider.name} ${money(provider.usage)}`).join(', ')}`);
+    }
+  } else if (account.activity?.error) push(`Activity unavailable: ${account.activity.error}`, 'error');
+  return lines;
+}

package/plugins/session-metrics/balance.mjs

@@ -1,10 +1,18 @@
+import { OPENROUTER_API, parseOpenRouterCredits, parseOpenRouterKeyRemaining } from '../providers/openrouter-account.mjs';
+
+export { parseOpenRouterCredits, parseOpenRouterKeyRemaining };
+
 // Remaining provider balance, refreshed on a long cache. DeepSeek's response
 // also carries the trusted clock: its `Date` header anchors peak/off-peak pricing
-// without a second network call. OpenRouter has no peak window, so only its
-// remaining credits are read.
+// without a second network call. OpenRouter has no peak window. Its account
+// credits (`/credits`) are documented as management-only but are served to
+// inference keys too; a key refused them falls back to its own remaining limit (`/key`).
 const SOURCES = {
-  'deepseek-official': { url: 'https://api.deepseek.com/user/balance', env: 'DEEPSEEK_API_KEY', parse: body => parseBalance(body), clock: true },
-  openrouter: { url: 'https://openrouter.ai/api/v1/credits', env: 'OPENROUTER_API_KEY', parse: body => parseOpenRouterCredits(body), clock: false },
+  'deepseek-official': { env: 'DEEPSEEK_API_KEY', clock: true, requests: ({ key }) => [{ url: 'https://api.deepseek.com/user/balance', key, parse: body => parseBalance(body) }] },
+  openrouter: { env: 'OPENROUTER_API_KEY', managementEnv: 'OPENROUTER_MANAGEMENT_KEY', clock: false, requests: ({ key, managementKey }) => [
+    { url: `${OPENROUTER_API}/credits`, key: managementKey ?? key, parse: parseOpenRouterCredits },
+    { url: `${OPENROUTER_API}/key`, key, parse: parseOpenRouterKeyRemaining },
+  ] },
 };
 export const BALANCE_PROVIDERS = Object.freeze(Object.keys(SOURCES));
 const CACHE_MS = 5 * 60 * 1000;
@@ -22,14 +30,6 @@ export function parseBalance(body) {
   return body?.is_available === false ? null : total;
 }
 
-/** Remaining USD credits from an OpenRouter `/credits` body: purchased minus used. */
-export function parseOpenRouterCredits(body) {
-  const credits = Number(body?.data?.total_credits), used = Number(body?.data?.total_usage);
-  if (body?.data?.total_credits == null || body?.data?.total_usage == null) return null;
-  if (!Number.isFinite(credits) || !Number.isFinite(used) || credits < 0 || used < 0) return null;
-  return Math.max(0, credits - used);
-}
-
 export function balanceNow(provider = 'deepseek-official') { return snapshotOf(provider).balance; }
 /** Clock anchored to the last DeepSeek balance response's `Date` header, else the local one. */
 export function trustedNow() {
@@ -43,29 +43,39 @@ export async function refreshBalance(options = {}) {
   const source = SOURCES[provider];
   if (!source) return null;
   const snapshot = snapshotOf(provider);
+  const key = options.key ?? process.env[source.env];
+  const managementKey = options.managementKey ?? (source.managementEnv ? process.env[source.managementEnv] : undefined);
+  const requests = source.requests({ key, managementKey }).filter(request => request.key);
+  const mode = managementKey ? 'management' : 'key';
   const now = Date.now();
-  if (snapshot.pending || now - snapshot.fetchedAt < CACHE_MS) return snapshot.balance;
+  // A newly added (or removed) management key changes the source; it is read at once.
+  if (snapshot.pending || snapshot.mode === mode && now - snapshot.fetchedAt < CACHE_MS) return snapshot.balance;
   const retrySoon = () => Date.now() - (CACHE_MS - RETRY_MS);
-  const key = options.key ?? process.env[source.env];
-  if (!key) { snapshots.set(provider, { ...snapshot, fetchedAt: retrySoon(), pending: false }); return snapshot.balance; }
+  if (requests.length === 0) { snapshots.set(provider, { ...snapshot, mode, fetchedAt: retrySoon(), pending: false }); return snapshot.balance; }
   const fetchImpl = options.fetch ?? globalThis.fetch;
   if (typeof fetchImpl !== 'function') return snapshot.balance;
   snapshots.set(provider, { ...snapshot, pending: true });
   try {
-    const response = await fetchImpl(source.url, { headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' } });
+    let response, body, request;
+    for (request of requests) {
+      response = await fetchImpl(request.url, { headers: { Authorization: `Bearer ${request.key}`, Accept: 'application/json' } });
+      body = await response.json();
+      // A key refused this reading falls through to the next source.
+      if (response.ok || (response.status !== 401 && response.status !== 403)) break;
+    }
     const header = source.clock ? response.headers?.get?.('date') : null;
     const anchor = header ? Date.parse(header) : NaN;
-    const body = await response.json();
-    const parsed = response.ok ? source.parse(body) : null;
+    const parsed = response.ok ? request.parse(body) : null;
     if (Number.isFinite(anchor)) clock = { anchor, skewMs: anchor - Date.now() };
     snapshots.set(provider, {
+      mode,
       balance: parsed === null && response.ok ? null : parsed ?? snapshot.balance,
       fetchedAt: parsed === null ? retrySoon() : Date.now(),
       pending: false,
     });
   } catch {
     // A transient failure keeps the last known balance and retries sooner.
-    snapshots.set(provider, { ...snapshot, fetchedAt: retrySoon(), pending: false });
+    snapshots.set(provider, { ...snapshot, mode, fetchedAt: retrySoon(), pending: false });
   }
   return snapshotOf(provider).balance;
 }

package/plugins/session-metrics/index.mjs

@@ -3,7 +3,8 @@ import { appendMetric } from './store.mjs';
 import { estimateCost, priceVersionFor } from './pricing.mjs';
 import { setMetricSource } from './view.mjs';
 import { BALANCE_PROVIDERS, refreshBalance } from './balance.mjs';
-import { refreshOpenRouterPrices } from './openrouter-prices.mjs';
+import { refreshOpenRouterModels } from '../openrouter/models.mjs';
+import { REPLAY_KIND } from '../openrouter/wire.mjs';
 import { providerSpec } from '../providers/catalog.mjs';
 import { createWindowRate } from './rate.mjs';
 import { currentCharge } from './attribution.mjs';
@@ -34,12 +35,17 @@ export function apply(ctx) {
   const credentials = ctx.get?.('credentials');
   const refresh = () => Promise.all(BALANCE_PROVIDERS.map(async provider => {
     try {
-      const ref = providerSpec(provider).credentialRef;
-      const resolved = await credentials?.resolve?.(ref);
-      const key = typeof resolved === 'string' ? resolved : resolved?.value;
-      await refreshBalance({ provider, key: key ?? process.env[ref] });
-      // OpenRouter list prices need no key, but only a session with an OpenRouter key uses them.
-      if (provider === 'openrouter' && (key ?? process.env[ref])) await refreshOpenRouterPrices({ home });
+      const spec = providerSpec(provider);
+      const secret = async ref => {
+        if (!ref) return undefined;
+        const resolved = await credentials?.resolve?.(ref);
+        return (typeof resolved === 'string' ? resolved : resolved?.value) || process.env[ref] || undefined;
+      };
+      // An OpenRouter management key, when stored, turns the balance into the account's credits.
+      const [key, managementKey] = await Promise.all([secret(spec.credentialRef), secret(spec.managementRef)]);
+      await refreshBalance({ provider, key, managementKey });
+      // The listing needs no key, but only a user with an OpenRouter key uses it; the adapter waits for it before its first call.
+      if (provider === 'openrouter' && key) await refreshOpenRouterModels({ home });
     } catch {
       /* balance stays unknown */
     }
@@ -64,19 +70,23 @@ export function apply(ctx) {
     }
     const save = entry => { for (const recipient of recipients) record(recipient, { ...entry, sessionId }); };
     save({ kind: 'start', id, time, provider: options.provider, model: options.model, purpose });
-    let usage, firstTokenTime;
+    let usage, firstTokenTime, billed;
     const liveSession = purpose === 'agent' ? ctx.agents.get(sessionId)?.session : undefined;
     try {
       for await (const chunk of next()) {
         if (chunk.type === 'usage') usage = chunk.usage;
         else if (firstTokenTime === undefined && OUTPUT_CHUNKS.has(chunk.type)) firstTokenTime = Date.now();
+        // OpenRouter reports what it charged; the finish of its response carries it.
+        if (chunk.type === 'finish' && chunk.replayState?.response?.kind === REPLAY_KIND && Number.isFinite(chunk.replayState.response.cost)) billed = chunk.replayState.response.cost;
         if (liveSession) liveRate.add(liveSession, chunk);
         yield chunk;
       }
     } finally {
       if (liveSession) liveRate.calibrate(liveSession, usage?.outputTokens);
       // `time` stays the start (it prices the call); `endTime` and `firstTokenTime` time it.
-      save({ kind: 'end', id, time, endTime: Date.now(), ...(firstTokenTime === undefined ? {} : { firstTokenTime }), usage: usage ?? null, cost: estimateCost(options.provider, options.model, usage, time), priceVersion: priceVersionFor(options.provider, options.model) });
+      save({ kind: 'end', id, time, endTime: Date.now(), ...(firstTokenTime === undefined ? {} : { firstTokenTime }), usage: usage ?? null, ...(billed === undefined
+        ? { cost: estimateCost(options.provider, options.model, usage, time), priceVersion: priceVersionFor(options.provider, options.model) }
+        : { cost: billed, priceVersion: 'openrouter-billed' }) });
     }
   });
 }

package/plugins/session-metrics/pricing.mjs

@@ -1,10 +1,10 @@
-import { openRouterPriceVersion, openRouterRates } from './openrouter-prices.mjs';
+import { openRouterPriceVersion, openRouterRates } from '../openrouter/models.mjs';
 
 // USD per million tokens. Snapshot of the official page opened 2026-09-11.
 // https://api-docs.deepseek.com/quick_start/pricing/
 export const PRICE_SOURCE = 'https://api-docs.deepseek.com/quick_start/pricing/';
 export const PRICE_VERSION = 'deepseek-2026-09-11';
-// OpenRouter calls are priced from its live model listing (openrouter-prices.mjs).
+// OpenRouter calls carry their billed cost; an unbilled one is estimated from the live model listing (plugins/openrouter/models.mjs).
 // Until that table loads, the DeepSeek models keep these list prices from the pinned
 // pi-ai 0.85.1 catalog. OpenRouter bills no peak window. [cache read, input, output].
 export const OPENROUTER_PRICE_VERSION = 'openrouter-pi-ai-0.85.1';
@@ -31,13 +31,33 @@ export function estimateCost(provider, model, usage, time) {
     return OPENROUTER_PRICES[model] ? charge(usage, OPENROUTER_PRICES[model]) : null;
   }
   if (provider !== 'deepseek-official') return null;
+  const rates = deepSeekRates(model, time);
+  if (!rates) return null;
+  const cost = charge(usage, rates);
+  return cost === null ? null : cost * (isPeak(time) ? 2 : 1);
+}
+
+/** DeepSeek list prices [cache read, input, output] at `time`, before the peak multiplier. */
+function deepSeekRates(model, time) {
   // Earlier requests require an older price table; never back-price them at today's rate.
-  if (time < Date.UTC(2026, 8, 11)) return null;
+  if (time < Date.UTC(2026, 8, 11)) return undefined;
   const flash = ['deepseek-flash', 'deepseek-v4-flash', 'deepseek-v4-flash-vision-exp'].includes(model)
     || model === 'deepseek-v4-pro' && time >= Date.UTC(2026, 8, 14, 4);
-  if (!flash && model !== 'deepseek-v4-pro') return null;
-  const cost = charge(usage, flash ? [0.003, 0.15, 0.6] : [0.022, 0.66, 1.98]);
-  return cost === null ? null : cost * (isPeak(time) ? 2 : 1);
+  if (!flash && model !== 'deepseek-v4-pro') return undefined;
+  return flash ? [0.003, 0.15, 0.6] : [0.022, 0.66, 1.98];
+}
+
+/**
+ * Cache-read price over input price for a route, or undefined when the route is unpriced.
+ * A model that lists no cache-read price bills cached input at the input rate (1).
+ */
+export function cacheReadRatio(provider, model, time = Date.now()) {
+  let rates;
+  if (provider === 'openrouter') {
+    const live = openRouterRates(model);
+    rates = live ? [live.cacheRead ?? live.input, live.input] : OPENROUTER_PRICES[model];
+  } else if (provider === 'deepseek-official') rates = deepSeekRates(model, time);
+  return rates && rates[1] > 0 ? rates[0] / rates[1] : undefined;
 }
 
 /** Cost in USD; cache writes need a write price, or the call stays unpriced. */

package/plugins/session-metrics/view.mjs

@@ -34,7 +34,7 @@ export function summarize(rows, events = [], corrupt = false) {
     const u = row.usage;
     if (!u || !Number.isFinite(u.inputTokens) || !Number.isFinite(u.outputTokens)) { cacheUnknown = true; continue; }
     const total = u.inputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
-    // pi-ai (OpenRouter) reports cache reads only when there are some: a missing count is zero, not unknown.
+    // OpenRouter reports cache reads only when there are some: a missing count is zero, not unknown.
     input += total; hit += u.cacheReadTokens ?? 0;
   }
   return { cost, unknown, calls, pending, cache: input > 0 && !cacheUnknown ? Math.min(100, hit / input * 100) : null };

package/plugins/ultra/policy.mjs

@@ -16,22 +16,6 @@ export function flashRequest(options, messages) {
   return copy;
 }
 
-/**
- * The same shaping for pi-ai routes (OpenRouter), on harness-format options:
- * Ultra sends max and adds the collaboration policy. Delegation tools are offered
- * at every effort (the shell policy keeps delegation rare below Ultra); workflow
- * and ralph never are. Returns a copy; the logged input is never mutated.
- */
-export function piAiRequest(options) {
-  const ultra = options.reasoningEffort === 'ultra';
-  const next = { ...options, ...(options.tools ? { tools: options.tools.filter(tool => tool.name !== 'workflow' && tool.name !== 'ralph') } : {}), ...(ultra ? { reasoningEffort: 'max' } : {}) };
-  if (!ultra || options.purpose || !options.tools?.some(t => t.name === 'subagent' || t.name === 'subagent_fork')) return next;
-  if (typeof next.system === 'string') return { ...next, system: next.system + '\n\n' + ULTRA_POLICY };
-  const [first, ...rest] = next.messages ?? [];
-  if (first?.role === 'system' && Array.isArray(first.content)) return { ...next, messages: [{ ...first, content: [...first.content, { type: 'text', text: '\n\n' + ULTRA_POLICY }] }, ...rest] };
-  return { ...next, messages: [{ role: 'system', content: [{ type: 'text', text: ULTRA_POLICY }] }, ...(next.messages ?? [])] };
-}
-
 export function ultraRequest(options, messages) {
   if (options.reasoningEffort !== 'ultra' || options.purpose || !options.tools?.some(t => t.name === 'subagent' || t.name === 'subagent_fork')) return messages;
   const copy = messages.map(m => ({ ...m }));

package/presets/dscode/agent.cordis.yml

@@ -180,7 +180,7 @@
     toolResultPruner: true
   config:
     - id: compaction-basic
-      name: '@deepseek-ai/dsh-compaction-basic'
+      name: '@toddzheng024/dscode-bundle/compaction-basic'
 
     - id: command-compact
       name: '@deepseek-ai/dsh-command-compact'