@toddzheng024/dscode-desktop 0.7.38 → 0.7.40

package/README.md

@@ -3,7 +3,7 @@
 DSCODE adds a coding preset, browser workflows, cross-session collaboration,
 memory and task management to the official DeepSeek Harness Desktop application.
 
-**Version:** 0.7.38 · **Harness runtime:** 0.2.0-rc.2
+**Version:** 0.7.40 · **Harness runtime:** 0.2.0-rc.2
 
 Preview release candidate; publication is a separate step.
 
@@ -48,7 +48,7 @@ public release; a candidate build alone does not publish a package.
 ## Install a published version
 
 After this version is available on npm, enter
-`@toddzheng024/dscode-desktop@0.7.38` in **Plugins → Add plugin**,
+`@toddzheng024/dscode-desktop@0.7.40` in **Plugins → Add plugin**,
 review the installation, install, then choose **Enable now**. Using the exact
 version keeps the installation tied to these instructions and compatibility
 requirements. The `preview` tag tracks the current Desktop preview release.

package/docs/CHANGELOG.md

@@ -6,6 +6,33 @@ Per-release notes live in [`docs/releases/`](releases/); the entries below summa
 
 <!-- Add upcoming changes under Unreleased. -->
 
+## [Unreleased]
+
+## [0.7.40] - 2026-10-12
+
+### Added
+
+- `/status` in the TUI and ACP reports the selected provider, model, currency and a fresh balance without model inference. DeepSeek and OpenRouter report explicit unavailable, unsupported, timeout and failure states; account funds and key spending limits remain distinct.
+
+### Fixed
+
+- Invalidate cached footer and Desktop balances when credentials change or are removed, and reject obsolete query completions. Resolve the credential service at refresh time, including when it becomes available after plugin startup. Native credential updates clear old readings immediately; cached amounts retain their currency and distinguish account balances from fallback key spending limits. Malformed amounts remain unknown instead of becoming zero. `/status` continues to query fresh data independently.
+- Send a labeled ACP failure notice before the failed prompt response, with bounded error data and retry guidance. Preserve cancellation and normal completion semantics. Include recognized network error codes and elapsed time in DeepSeek transport summaries without copying raw error causes.
+- Guide model output to use correct Markdown delimiters for code containing backticks and literal backslashes, and concise labels for long file links. This guidance does not rewrite generated code or guarantee that every model response is valid Markdown.
+
+### Changed
+
+- Filter ACP model choices to providers with configured credentials or account login and saved custom services with no authentication. Retain the current model when credentials are missing, preserve exact routing and the TUI catalog, and check the Harness 0.2 DeepSeek account and API-key routes separately. This checks local configuration, not endpoint reachability, key validity or per-model access; reconnect after credential changes to refresh the picker.
+
+## [0.7.39] - 2026-10-10
+
+### Fixed
+
+- Load the native DeepSeek API-key and Account plugins from the terminal bundle, with both importing its patched shared adapter. Harness 0.2 split the adapter library from its plugin entry points; the 0.7.38 bundle incorrectly mounted the library as a plugin, leaving the API-key route unavailable. Preserve existing provider settings row IDs.
+- Require installed-bundle local diagnostics to have no plugin activation failures, and verify both native DeepSeek provider registrations and model resolution before any fixture adapter is introduced. These checks make provider startup part of the release gate without sending model requests.
+
+Version 0.7.38 reached npm and Hub before this fault was found in a fresh public install; its remaining release workflow was cancelled. Upgrade to 0.7.39.
+
 ## [0.7.38] - 2026-10-10
 
 The 0.7.37 candidate was cancelled before publication after its Node 22.19.0 coverage check failed. This release includes that upgrade and the test-fixture fix below.

package/docs/acp.md

@@ -14,18 +14,32 @@ dscode acp --model custom-your-provider-id/your-model-id
 
 Without `--model`, the bridge uses DSCODE's saved default provider and model. Set up credentials and custom services in the normal TUI first with `/login` or `/provider custom`. The stable custom provider ID is recorded in `~/.dscode/providers.yaml`; it is not the service's display name. API keys stay in the existing credential store. Clients supporting ACP configuration options can select an advertised model and reasoning effort after creating a session.
 
+The ACP model picker lists models from providers with configured credentials or account login, plus saved custom services using no authentication. Credential checks follow each provider's configured reference, including environment variables and saved keys. DeepSeek Account and DeepSeek API-key routes are checked separately. Providers with no recognized configuration metadata are omitted.
+
+The current model remains listed even when its credentials are missing, so an explicit selection or resumed session is never silently switched to another model. This exception retains only the current model, not that provider's entire catalog. Configured credentials do not prove that a key is valid, credits remain, the endpoint is reachable, or every advertised model is permitted; filtering makes no inference requests. After changing credentials, reconnect the ACP client to refresh its picker. Saved custom service changes also refresh options in connected sessions.
+
+## Current credential balance
+
+Send `/status` as a standalone text message. The command is advertised to clients and returns the selected provider, model, balance information and query time without a model turn. It also works after switching models or resuming a session. Attachments and ordinary text mentioning `/status` remain normal model input. Arguments are rejected with usage guidance.
+
+DeepSeek API keys show the official account balance and currency; DeepSeek account login shows recharge and bonus wallets separately. OpenRouter shows account credits and the current key's remaining spending limit separately, plus the effective budget when provided. A key without a spending cap does **not** mean unlimited account funds. If OpenRouter denies account-credit access but permits key inspection, the key information remains available. Only the active inference credential is used, never a separate management key.
+
+Each invocation makes a fresh query using the selected route's configured credential reference. Keys and raw provider errors are not printed. Missing credentials, failed queries and timeouts are reported explicitly; they are not shown as zero. The lookup waits at most eight seconds and supports cancellation. Other providers, including custom API endpoints and subscription routes, currently report that balance lookup is unsupported. An overridden DeepSeek/OpenRouter endpoint is not queried through the official billing API. The result is sent to the client without adding a model-history turn; replay of that display depends on the client.
+
 For a source checkout, the equivalent executable is `node` with arguments `["/absolute/path/to/dscode/bin/dscode.mjs", "acp"]`. Source and npm installations use their existing, separate state directories. `--patch FILE` adds a trusted composition overlay and can be repeated. `dscode acp --help` prints usage without starting the runtime or installing a profile.
 
 ## Behavior and limits
 
+- A failed model turn sends a clearly labeled `DSCODE — Request failed` text update before returning JSON-RPC error `-32603`. Error data includes the session ID, a bounded failure code and explanation, and HTTP status when available. The update is a transport diagnostic, not a model-generated answer or a successful completion. Clients that persist text updates can retain it in their history. User cancellation keeps the native `cancelled` result and does not emit a failure notice.
+- DeepSeek transport failures retain recognized low-level network error codes and request elapsed time in their summary. Raw error chains, credentials and response bodies are not added to ACP failure output. A repeated duration alone does not identify the network cause. This is bounded diagnostic feedback, not a complete network trace.
 - New and resumed ACP agents mount the `dscode` preset, including its tools and provider adapters. The bridge reuses DSH's native ACP implementation rather than translating terminal output.
 - ACP sessions use the `ask` permission preset. Tool requests requiring approval are sent to the ACP client; the client can allow once, reject, or cancel. Normal sandbox rules still apply. The terminal's automatic model review is not the approval decision maker for these sessions.
 - Standard session creation, prompts, cancellation, model configuration, listing, resume, close and MCP attachment are inherited from the pinned DSH bridge. Resume reconnects a session without replaying its transcript.
-- The inherited bridge identifies itself as `deepseek-harness-acp`. It does not advertise `session/load`, modes, slash commands, terminal delegation, client filesystem operations or interactive question forms. Clients requiring those features need additional integration; a successful protocol handshake does not establish full editor compatibility.
+- The inherited bridge identifies itself as `deepseek-harness-acp`. It advertises `/status`; other terminal slash commands are not exposed. It does not advertise `session/load`, modes, terminal delegation, client filesystem operations or interactive question forms. Clients requiring those features need additional integration; a successful protocol handshake does not establish full editor compatibility.
 - Title generation, session-card generation and memory generation are disabled in this transport. Configured providers, tools and other integrations remain available; ACP is not an offline mode.
 - Stdout is reserved for protocol frames. First-install progress and launcher diagnostics go to stderr. Trusted custom patches must also respect this rule.
 - Closing stdin shuts down the runtime. SIGTERM is forwarded by the launcher. Sessions persist in the same installation's state directory, and a running ACP process holds the normal installation lock against upgrades.
 
 ## Verification
 
-`node scripts/verify-acp.mjs` exercises the source CLI with a fixture model and custom API, without paid model requests. Unit tests cover argument validation, preset composition, source and npm launcher routing, cleanup and signal forwarding. Client-specific UI behavior must be verified in the intended editor.
+`node scripts/verify-acp.mjs` exercises the source CLI with a fixture model and custom API, without paid model requests. It checks configured model filtering on creation, selection and resume, rejects unadvertised model selections, and verifies current-model retention after a custom service starts requiring credentials. It also checks that a failure after a tool call sends exactly one diagnostic before the structured prompt error, and that cancellation does not emit a failure notice. Unit tests also cover credential references, account and login records, lookup failures, argument validation, preset composition, source and npm launcher routing, cleanup and signal forwarding. Client-specific UI behavior must be verified in the intended editor.

package/docs/releases/0.7.38.md

@@ -1,5 +1,7 @@
 # DSCODE 0.7.38
 
+Status: superseded by 0.7.39. This version reached npm and Hub, but a fresh public install exposed a broken DeepSeek provider entry point and the remaining release workflow was cancelled. Use 0.7.39 or later.
+
 This release upgrades the terminal to Harness 0.2.0-rc.2, restores native reminder integration, and documents optional Atomic Mail MCP support.
 
 The 0.7.37 candidate was cancelled before npm or Hub publication when its Node 22.19.0 coverage check failed. This version retains the upgrade and removes a stale source-map reference from the in-memory Ink test fixture. The failure was reproduced locally on Node 22.19.0; all 1,091 unit/component tests and coverage checks passed on that exact runtime after the fix. The original tag remains unchanged.

package/docs/releases/0.7.39.md

@@ -0,0 +1,11 @@
+# DSCODE 0.7.39
+
+This release repairs DeepSeek provider startup in the published terminal bundle and retains the Harness 0.2.0-rc.2 upgrade, native reminders, Computer Use 0.3.3 and optional Atomic Mail integration from 0.7.38.
+
+- **Working DeepSeek entries:** Harness 0.2 separates its shared adapter library from the API-key and Account plugins. The bundle now ships both native plugin entries and points them at its patched adapter, retaining DSCODE effort policies. Existing API-key and Account settings row IDs remain unchanged. This fixes the `invalid plugin` activation error and missing API-key provider seen in a fresh 0.7.38 installation.
+- **Installed provider verification:** the release gate now boots the installed launcher's local doctor and rejects plugin activation failures. The real Harness probe checks that both `deepseek-official` and `deepseek-account` register and resolve model information before it adds its offline fixture adapter. Fixture agent success can no longer hide this missing provider.
+- **Publication boundary:** 0.7.38 reached npm and Hub before the public installation check found this problem; its remaining workflow was cancelled. The existing version and tag are retained. Install 0.7.39 instead.
+
+Update the launcher with `npm install -g @toddzheng024/dscode@latest`, then run `dscode update` for an existing Hub profile. The Desktop extension remains qualified separately for official Harness 0.2.0-rc.2 on macOS Apple Silicon.
+
+Verification passed `npm run check`: lint, both TypeScript checks, 1,091 unit/component tests, native integration, package checks and 63 offline evaluations; measured first-party `.mjs` coverage was 80.35%. The exact candidate also passed `verify:hub` in a clean temporary workspace: native locked installation, installed local diagnostics, both DeepSeek provider registrations and model resolution, ACP, agent execution, session messaging, cards, memory, failed-upgrade preservation and successful upgrade/rollback. Running that verification directly from the developer checkout was blocked by its local `.env` bootstrap setting; no local credentials were copied to the clean workspace. Documentation and tag-version checks passed before tagging. Real provider inference, live OAuth login, interactive desktop actions and real mail delivery have no automated case. Computer Use retains the upstream saved-skill restoration limitation documented in [0.7.38](0.7.38.md).

package/docs/releases/0.7.40.md

@@ -0,0 +1,13 @@
+# DSCODE 0.7.40
+
+Credential-scoped balance snapshots, fresh status queries and clearer ACP failures.
+
+- **Cached balance identity:** footer and Desktop balances clear immediately when credentials change or are removed. Late responses from an obsolete request cannot restore the old reading, including during credential resolution or response-body parsing. Refreshes resolve the native credential service when it becomes available after plugin startup. Transient failures retain a previous reading only for the same credential and source; authentication refusal clears it. Billing fixtures cover these transitions without real credentials or paid inference.
+- **Currency and source:** cached amounts retain the reported currency and identify account funds versus a fallback key spending limit. CNY is displayed as CNY, malformed amounts remain unknown, and a valid zero remains zero. The public numeric balance API remains compatible; Desktop adds currency and source metadata. This does not change provider billing or currency conversion.
+- **Fresh `/status`:** the TUI and ACP expose the selected provider and model plus a fresh DeepSeek or OpenRouter balance query, independently of the footer cache. Account funds and key limits remain distinct, credentials are not printed, and unsupported providers, unavailable data, timeouts and request failures have explicit states. The command does not send a model request or change the selected model.
+- **ACP model choices and failures:** the picker lists providers with configured credentials or account login, plus saved custom services that require no authentication, while retaining the current model. Reconnect after credential changes to refresh the picker; local configuration does not prove endpoint reachability or model access. Failed prompts send a labeled notice before the failed response, with bounded transport details and retry guidance. Cancellation and successful completion keep their existing semantics.
+- **Markdown guidance:** model instructions explain delimiters for code containing backticks and literal backslashes, and concise labels for long file links. They do not rewrite generated code or guarantee valid Markdown in every response.
+
+Update the launcher with `npm install -g @toddzheng024/dscode@latest`, then run `dscode update` for an existing Hub profile. For official Harness Desktop 0.2.0-rc.2 on macOS Apple Silicon, install `@toddzheng024/dscode-desktop@0.7.40`, enable it, then fully quit and reopen Desktop.
+
+Verification of the code passed `npm run check`: lint, both TypeScript gates, 1,129 unit/component tests, native integration, package checks and 63 offline evaluations, with 80.55% first-party `.mjs` coverage. PR CI passed on Node 22 and Node 24, plus Linux e2e. An independent Harness 0.2.0-rc.2 native Host passed packed Desktop usage checks across generation, resume and unload, including temporary native credential updates, removal, obsolete responses, currency metadata and key-limit fallback. Billing and model responses in these probes are synthetic. Public release installation is checked after publication and recorded in issue #16. Real billing, paid model inference, signed Desktop GUI interaction and real mail delivery have no automated case in this change.

package/docs/session-metrics.md

@@ -12,6 +12,15 @@ work. Cost outside recorded turn windows is shown separately. Known cached
 provider balance or subscription figures are included; opening or refreshing the
 panel does not request new account data or start a model turn.
 
+Cached balances retain the provider's currency and identify account funds or a
+fallback key spending limit. USD values use `$`; other reported currencies carry
+their currency code. The terminal marks a fallback limit with `key` (localized),
+and Desktop labels it **Cached key spending limit**. The five-minute balance
+cache is invalidated on native credential updates; removing a credential clears
+its reading, and obsolete queries cannot restore it. Transient lookup failures
+may retain the last reading only for the same credential and balance source.
+Missing or malformed data stays unknown. `/status` makes a separate fresh query.
+
 The panel refreshes once per second while visible and clears its state when
 hidden or switched to another session. Refresh failures clear the old figures
 and display an error. Standard sessions and closed sessions have no DSCODE usage

package/docs/tui-commands.md

@@ -12,6 +12,7 @@ If a provider rejects a request for content filtering, the turn stops with a `CO
 | `/model` | Picker for the session's current provider only, listed alphabetically by the displayed model name (digits compare naturally, so GLM 5.2 precedes GLM 5.3). Typing searches as you type (BM25 over model name, id and provider; the word being typed matches prefixes) and narrows the list without re-ranking it; Enter focuses the first match, a second Enter selects it, Esc clears the search then closes, Tab opens the provider picker. |
 | `/opencode [login\|cancel\|logout]` | Sign in to OpenCode Go with an OpenCode account, the route's only credential. `login` shows a code, opens the console in the browser and waits in the background for up to ten minutes; the consent page names the OpenCode CLI, whose login client DSCODE uses. Without an argument it shows who is signed in or how the last attempt ended. The login is stored in `~/.dscode/credentials.yaml` and renews itself. See [OpenCode Go](opencode-go.md). |
 | `/openrouter` | OpenRouter account panel: the account balance, this key's limit and its spend today, this week and this month; with a management key, also every API key's usage and the last 30 days of spend by model and serving provider. `r` refreshes, `m` sets the management key (checked against OpenRouter, stored in `~/.dscode/credentials.yaml`, read-only use; `OPENROUTER_MANAGEMENT_KEY` also works). Saving the OpenRouter API key through `/provider openrouter` or `/login openrouter` offers the management key as an optional step. |
+| `/status` | Query the current session's provider, model and credential balance without a model turn. Supports DeepSeek API/account login and OpenRouter; account funds and key limits are labeled separately. Uses the active credential, refreshes on every call, and reports unsupported endpoints, missing credentials and query failures explicitly. Also available in [ACP](acp.md#current-credential-balance), which documents the lookup limits. |
 | `/review` | Independent review of the current changes. `DSCODE_REVIEW_MODEL=provider/model` pins the reviewer to its own model and `DSCODE_REVIEW_EFFORT=<level>` sets its reasoning level, so a small session model cannot cap the review; the budget leaves room for reasoning plus the report. |
 | `/update [exact-version]` | Upgrade DSCODE after this session exits: the TUI starts a detached helper that waits for the session to end and then runs the same `dscode update` entry (npm/Hub launcher, or tar/source self-update). Progress and the outcome are written to `$DSH_HOME/update.log` and `$DSH_HOME/update-result.json`. |
 | `/login [deepseek\|openrouter]` | Paste an API key into the private input; it is saved to `~/.dscode/credentials.yaml` (`0600`, shared across projects and installed versions). Without an argument it targets the current provider. `DEEPSEEK_API_KEY` or `OPENROUTER_API_KEY` in the environment takes precedence and makes that key read-only here. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toddzheng024/dscode-desktop",
-  "version": "0.7.38",
+  "version": "0.7.40",
   "private": false,
   "description": "DSCODE for Harness Desktop: coding collaboration, session memory, browser workflows and task management.",
   "license": "MIT",

package/plugins/acp/index.mjs

@@ -1,5 +1,7 @@
 import { apply as applyAcp } from '@deepseek-ai/dsh-acp';
 import z from '@deepseek-ai/schemastery';
+import { configuredModels } from './models.mjs';
+import { acpStatus } from '../status/index.mjs';
 
 export const name = 'dscode-acp';
 export const inject = ['acpAppStartup', 'agents', 'agentPresets', 'agentDefaultModel', 'permissionPresets', 'llm', 'sessionPersistence', 'sessions', 'dscodeCustom'];
@@ -34,7 +36,7 @@ export function startAcp(ctx, config = {}, bridge = applyAcp) {
   const selection = config.model
     ? { provider: config.model.slice(0, config.model.indexOf('/')), model: config.model.slice(config.model.indexOf('/') + 1) }
     : ctx.agentDefaultModel.currentSelection();
-  const scoped = ctx.extend({ agents: presetAgents(ctx) });
+  const scoped = ctx.extend({ agents: presetAgents(ctx), llm: configuredModels(ctx), dscodeAcpStatus: (selection, prompt, signal) => acpStatus(ctx, selection, prompt, signal) });
   bridge(scoped, { provider: selection.provider, model: selection.model });
 }
 

package/plugins/acp/models.mjs

@@ -0,0 +1,47 @@
+import { credentialKeyId, credentialKeyScope } from '@deepseek-ai/dsh-credentials';
+import { isCustomId, keyRef } from '../custom/config.mjs';
+import { providerSpec } from '../providers/catalog.mjs';
+
+function credentialReference(ctx, provider) {
+  const entry = ctx.llm.listConfigurableProviders?.().find(entry => entry.provider === provider);
+  if (!entry) return providerSpec(provider)?.credentialRef;
+  const descriptor = ctx.get('settings')?.describe({ redactSecrets: true }).find(item => item.ns === entry.settingsNs);
+  const profile = entry.settingsPath.reduce((value, key) => value?.[key], descriptor?.value);
+  return typeof profile?.apiKeyEnv === 'string' ? profile.apiKeyEnv : undefined;
+}
+
+/** Local configuration facts only: no secret values or inference requests. */
+export async function configuredProvider(ctx, provider) {
+  try {
+    const credentials = ctx.get('credentials');
+    if (isCustomId(provider)) {
+      const profile = ctx.get('dscodeCustom')?.providers.find(profile => profile.id === provider);
+      return !!profile && (profile.auth === 'none' || (await credentials?.describe(keyRef(provider)))?.configured === true);
+    }
+    // Harness 0.2 separates the account route from the API-key route.
+    if (provider === 'deepseek-account') {
+      return (await ctx.get('deepseekAccount')?.getState())?.status === 'credential-stored';
+    }
+    const ref = credentialReference(ctx, provider);
+    if (ref && (await credentials?.describe(ref))?.configured === true) return true;
+    const entries = ctx.get('authorization')?.list() ?? [];
+    for (const { key } of entries) {
+      if (credentialKeyScope(key) === 'llm-pi-ai' && credentialKeyId(key) === provider
+        && (await credentials?.describeRecord(key))?.configured === true) return true;
+    }
+  } catch {
+    // One unavailable configuration source must not break the ACP picker.
+  }
+  return false;
+}
+
+/** Scope discovery to ACP; native routing and the shared TUI catalog stay intact. */
+export function configuredModels(ctx) {
+  return new Proxy(ctx.llm, {
+    get(target, key) {
+      if (key === 'listModels') return async provider => await configuredProvider(ctx, provider) ? target.listModels(provider) : [];
+      const value = Reflect.get(target, key, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+}

package/plugins/desktop/client.mjs

@@ -827,7 +827,7 @@ components.push({
   id: '@toddzheng024/dscode-desktop',
   factory: require => {
     const { createElement: h, useState, useEffect, useRef } = require('react');
-    const money = (cost, partial = false) => cost === null || partial && cost === 0 ? 'Unknown' : `$${cost.toFixed(4)}${partial ? '+' : ''}`;
+    const money = (cost, partial = false, currency = 'USD') => cost === null || partial && cost === 0 ? 'Unknown' : (currency === 'USD' ? `$${cost.toFixed(4)}` : `${cost.toFixed(4)} ${currency}`) + (partial ? '+' : '');
     const percent = value => value === null ? 'Unknown' : `${value.toFixed(1)}%`;
     const speed = value => value === null ? 'Unknown' : `${value.toFixed(1)} tokens/s`;
     const control = { padding: '7px 10px', border: '.5px solid var(--dsw-alias-border-l3, #8886)', borderRadius: 'var(--dsw-radius-md, 6px)', background: 'transparent', color: 'inherit', font: 'inherit' };
@@ -858,7 +858,7 @@ components.push({
             fact('Pending calls', state.pending ?? 'Unknown'), fact('Context estimate', percent(state.contextPercent)),
             fact('Input cache share', percent(state.cachePercent)), fact('Smoothed request speed', speed(state.currentTps)),
             fact('Session average speed', speed(state.averageTps)),
-            state.balance !== null && fact('Cached provider balance', money(state.balance)),
+            state.balance !== null && state.balanceCurrency && fact(state.balanceSource === 'key-limit' ? 'Cached key spending limit' : 'Cached account balance', money(state.balance, false, state.balanceCurrency)),
             state.subscription && fact('Cached subscription usage', state.subscription),
             state.budget && fact('Configured cost budget', `${money(state.budget.spent)} / ${money(state.budget.limit)} · ${state.budget.state}`)),
           h('p', { style: { fontSize: 12 } }, 'Unknown means a reading or price is unavailable. + marks a partial cost. Pending calls have not settled. Cached account figures may lag the provider.'),

package/plugins/dscode/index.mjs

@@ -9,8 +9,9 @@ import { boardSummary, DelegateBoard, setBoardSource } from './board.mjs';
 import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { worktreeBase } from '../worktree-subagent/worktree.mjs';
 import { withChildTarget } from './child-target.mjs';
+import { registerStatus } from '../status/index.mjs';
 export const name = 'dscode-execution-policy';
-export const inject = ['systemPrompt', 'tools', 'agents', 'commands', 'terminals', 'subagents'];
+export const inject = ['systemPrompt', 'tools', 'agents', 'commands', 'terminals', 'subagents', 'llm'];
 export const SHELL_POLICY = `Use bash as the persistent shell for reading, searching and modifying files. Prefer rg/rg --files, sed and standard CLI tools. Use apply_patch with a standard unified diff on stdin (git apply format, a/ and b/ paths); apply_patch --check validates before writing. It is not the *** Begin Patch format. Quote heredoc delimiters to avoid shell interpolation.
 Each agent has its own persistent shell, initially in the session workspace. cd, exported variables, functions and background jobs persist only while this shell lives. Timeout, cancellation, exit, /shell reset and process restart discard shell state; resume restores conversation, not an OS process. Never assume an environment from a past session still exists. Inspect pwd when paths matter. Keep long-running processes controlled and clean them up when done.
 Normal bash remains confined by the active sandbox. After a genuine sandbox denial, shell_retry provides a fresh, one-shot shell with the existing approval/escalation mechanism. Set an explicit absolute workdir and reconstruct needed non-secret setup; it does not inherit the persistent shell's cd, exports, functions or jobs. Use existing credential-aware CLIs; never paste secrets into arguments. Approval rejection is final for that action; do not work around it.
@@ -21,6 +22,7 @@ Delegation to child agents (subagent, subagent_fork) is available at every effor
 // unrequested commits, invented test suites). Kept separate from the persona so
 // it stays one reviewable unit and does not lengthen the deployment block.
 export const CODE_DISCIPLINE = `Code discipline. Fix the problem at its root cause rather than with a surface patch, and keep the change inside the requested scope: do not fix unrelated bugs or failing tests, do not reformat or rename what the task did not ask for, and mention adjacent problems instead of taking them on. Match the surrounding code's style, naming and comment density; do not add inline comments, license or copyright headers unless the task or the neighbouring code requires it. Do not commit, create branches or rewrite history unless the user asks. Do not introduce a test suite to a repository that has none; where tests exist, extend the nearest relevant pattern. When the repository's own history would settle a question, read it with git log or git blame before guessing.`;
+export const MARKDOWN_POLICY = 'Markdown output. Inside a code span, backslashes are literal and cannot escape a backtick. Wrap code containing backticks in a longer backtick delimiter (for example, two backticks around a template literal containing single backticks); add one padding space at both ends when the content starts or ends with a backtick. Use a fenced code block for multiline code, with a fence longer than any matching run inside it. Preserve literal backslashes and code text. Keep prose and punctuation outside code spans. For long file paths in explanations, prefer a short filename label with the full path as the link target instead of repeating the full path inline.';
 
 // Claude-Code-derived working discipline: instruction precedence, acting instead
 // of re-deriving, and correction economy. The memory and session sections already
@@ -61,10 +63,12 @@ const DOCS_REPO = 'https://github.com/qiz029/dscode/blob/main/docs/';
 export const DOCS_SECTION = `To answer questions about DSCODE itself - what it supports, how a feature is configured, what a command does - treat the bundled user guides as the source of truth instead of guessing: ${existsSync(DOCS_DIR) ? `${DOCS_DIR} plus the repository root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, acp.md, email.md, browser-use.md, plugin-hub.md, computer-use.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, opencode-go.md, custom-providers.md, demo.md, triggers.md)` : `the repository documentation at ${DOCS_REPO} plus the root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, acp.md, email.md, browser-use.md, plugin-hub.md, computer-use.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, opencode-go.md, custom-providers.md, demo.md, triggers.md)`}. Read the relevant guide before answering rather than relying on memory of an earlier session. docs/CONTEXT-HANDOFF.md, docs/session-messaging-design.md, docs/cloud-webapp-host.md, docs/triggers-design.md, docs/verification.md, docs/maintainability.md and docs/vendored-tui-upgrade.md are internal development records, not user documentation: never quote them to a user or treat them as a specification. When the guides do not cover something, describe only what the running installation actually does and say plainly that it is not documented.`;
 
 export function apply(ctx, config = {}) {
+  registerStatus(ctx);
   const viewer = config.desktop ? 'Delegation board in the right sidebar' : '/delegate-dashboard';
   ctx.systemPrompt.section({ name: 'dscode:shell-policy', order: 1050, text: SHELL_POLICY });
   ctx.systemPrompt.section({ name: 'dscode:docs', order: 1052, text: DOCS_SECTION });
   ctx.systemPrompt.section({ name: 'dscode:code-discipline', order: 1053, text: CODE_DISCIPLINE });
+  ctx.systemPrompt.section({ name: 'dscode:markdown', order: 1054, text: MARKDOWN_POLICY });
   ctx.systemPrompt.section({ name: 'dscode:working-discipline', order: 1054, text: WORKING_DISCIPLINE });
   ctx.systemPrompt.section({ name: 'dscode:child-policy', order: 1051, text: ({ scope }) => scope?.session?.header?.origin === 'subagent' && scope.session.header.agentPreset === 'dscode'
     ? 'You are a delegated worker. Complete your assigned task yourself and return a concise result to the parent. You cannot start or wake another agent; ask the parent to make any new delegation decision. Your parent is addressed as / in send_message.' : '' });

package/plugins/i18n/messages.mjs

@@ -41,7 +41,7 @@ export const MESSAGES = {
     'language.set': 'language → {name}', 'language.title': '/language — interface language', 'language.currentMark': 'current', 'language.unknown': 'Unknown language "{value}". Choose en, zh-CN, zh-TW, ja, ko or es.',
     'language.saveFailed': 'language save failed: {error}',
     'doctor.logs.new': 'Only warnings/errors since this TUI version started are recorded.',
-    'footer.average': 'avg', 'footer.context': 'ctx', 'footer.cache': 'cache', 'footer.grokUsed': 'used', 'footer.grokResets': 'resets', 'footer.goLimited': 'limited until', 'composer.placeholder': 'type a message', 'composer.shellMode': '! shell mode · esc exits',
+    'footer.average': 'avg', 'footer.context': 'ctx', 'footer.cache': 'cache', 'footer.grokUsed': 'used', 'footer.grokResets': 'resets', 'footer.goLimited': 'limited until', 'footer.keyLimit': 'key', 'composer.placeholder': 'type a message', 'composer.shellMode': '! shell mode · esc exits',
     'compaction.running': 'Compacting context, please wait', 'compaction.confirm.title': 'Switching to {model} will compact the conversation',
     'compaction.confirm.usage': 'context {used} ≥ compaction threshold {threshold} ({window} × {ratio})', 'compaction.confirm.next': 'the next step compacts older history first',
     'compaction.confirm.overflow': 'it already exceeds the {window} window: the next request compacts and retries', 'compaction.confirm.hint': 'y switch · n/esc back',
@@ -119,7 +119,7 @@ export const MESSAGES = {
     'language.set': '语言 → {name}', 'language.title': '/language — 界面语言', 'language.currentMark': '当前', 'language.unknown': '未知语言 "{value}"。可选 en、zh-CN、zh-TW、ja、ko、es。',
     'language.saveFailed': '语言设置保存失败：{error}',
     'doctor.logs.new': '仅记录新版 TUI 启动后的 warning/error。',
-    'footer.average': '平均', 'footer.context': 'ctx', 'footer.cache': '缓存', 'footer.grokUsed': '已用', 'footer.grokResets': '重置', 'footer.goLimited': '受限至', 'composer.placeholder': '输入消息', 'composer.shellMode': '! shell 模式 · esc 退出',
+    'footer.average': '平均', 'footer.context': 'ctx', 'footer.cache': '缓存', 'footer.grokUsed': '已用', 'footer.grokResets': '重置', 'footer.goLimited': '受限至', 'footer.keyLimit': '额度', 'composer.placeholder': '输入消息', 'composer.shellMode': '! shell 模式 · esc 退出',
     'compaction.running': '正在压缩上下文，请稍后', 'compaction.confirm.title': '切换到 {model} 会触发自动压缩',
     'compaction.confirm.usage': '当前上下文 {used} ≥ 压缩阈值 {threshold}（{window} × {ratio}）', 'compaction.confirm.next': '下一步开始前会先压缩较早的对话',
     'compaction.confirm.overflow': '已超出新模型的 {window} 上下文窗口：下一次请求会先压缩再重试', 'compaction.confirm.hint': 'y 确认切换 · n/esc 返回',
@@ -197,7 +197,7 @@ export const MESSAGES = {
     'language.set': '語言 → {name}', 'language.title': '/language — 介面語言', 'language.currentMark': '目前', 'language.unknown': '未知語言 "{value}"。可選 en、zh-CN、zh-TW、ja、ko、es。',
     'language.saveFailed': '語言設定儲存失敗：{error}',
     'doctor.logs.new': '僅記錄新版 TUI 啟動後的 warning/error。',
-    'footer.average': '平均', 'footer.context': 'ctx', 'footer.cache': '快取', 'footer.grokUsed': '已用', 'footer.grokResets': '重置', 'footer.goLimited': '受限至', 'composer.placeholder': '輸入訊息', 'composer.shellMode': '! shell 模式 · esc 離開',
+    'footer.average': '平均', 'footer.context': 'ctx', 'footer.cache': '快取', 'footer.grokUsed': '已用', 'footer.grokResets': '重置', 'footer.goLimited': '受限至', 'footer.keyLimit': '額度', 'composer.placeholder': '輸入訊息', 'composer.shellMode': '! shell 模式 · esc 離開',
     'compaction.running': '正在壓縮上下文，請稍候', 'compaction.confirm.title': '切換到 {model} 會觸發自動壓縮',
     'compaction.confirm.usage': '目前上下文 {used} ≥ 壓縮閾值 {threshold}（{window} × {ratio}）', 'compaction.confirm.next': '下一步開始前會先壓縮較早的對話',
     'compaction.confirm.overflow': '已超出新模型的 {window} 上下文視窗：下一次請求會先壓縮再重試', 'compaction.confirm.hint': 'y 確認切換 · n/esc 返回',
@@ -275,7 +275,7 @@ export const MESSAGES = {
     'language.set': '言語 → {name}', 'language.title': '/language — 表示言語', 'language.currentMark': '現在', 'language.unknown': '不明な言語 "{value}"。en、zh-CN、zh-TW、ja、ko、es から選んでください。',
     'language.saveFailed': '言語設定の保存に失敗しました：{error}',
     'doctor.logs.new': 'この TUI バージョンの起動以降の warning/error のみ記録されています。',
-    'footer.average': '平均', 'footer.context': 'ctx', 'footer.cache': 'キャッシュ', 'footer.grokUsed': '使用', 'footer.grokResets': 'リセット', 'footer.goLimited': '制限解除', 'composer.placeholder': 'メッセージを入力', 'composer.shellMode': '! shell モード · esc で終了',
+    'footer.average': '平均', 'footer.context': 'ctx', 'footer.cache': 'キャッシュ', 'footer.grokUsed': '使用', 'footer.grokResets': 'リセット', 'footer.goLimited': '制限解除', 'footer.keyLimit': 'キー上限', 'composer.placeholder': 'メッセージを入力', 'composer.shellMode': '! shell モード · esc で終了',
     'compaction.running': 'コンテキストを圧縮しています。しばらくお待ちください', 'compaction.confirm.title': '{model} に切り替えると自動圧縮が実行されます',
     'compaction.confirm.usage': '現在のコンテキスト {used} ≥ 圧縮しきい値 {threshold}（{window} × {ratio}）', 'compaction.confirm.next': '次のステップの前に古い履歴を圧縮します',
     'compaction.confirm.overflow': '新しいモデルの {window} ウィンドウを超えています。次のリクエストで圧縮して再試行します', 'compaction.confirm.hint': 'y 切り替え · n/esc 戻る',
@@ -353,7 +353,7 @@ export const MESSAGES = {
     'language.set': '언어 → {name}', 'language.title': '/language — 인터페이스 언어', 'language.currentMark': '현재', 'language.unknown': '알 수 없는 언어 "{value}". en, zh-CN, zh-TW, ja, ko, es 중에서 선택하세요.',
     'language.saveFailed': '언어 설정 저장 실패: {error}',
     'doctor.logs.new': '이 TUI 버전 시작 이후의 warning/error만 기록됩니다.',
-    'footer.average': '평균', 'footer.context': 'ctx', 'footer.cache': '캐시', 'footer.grokUsed': '사용', 'footer.grokResets': '재설정', 'footer.goLimited': '제한 해제', 'composer.placeholder': '메시지를 입력하세요', 'composer.shellMode': '! shell 모드 · esc 종료',
+    'footer.average': '평균', 'footer.context': 'ctx', 'footer.cache': '캐시', 'footer.grokUsed': '사용', 'footer.grokResets': '재설정', 'footer.goLimited': '제한 해제', 'footer.keyLimit': '키 한도', 'composer.placeholder': '메시지를 입력하세요', 'composer.shellMode': '! shell 모드 · esc 종료',
     'compaction.running': '컨텍스트를 압축하는 중입니다. 잠시만 기다려 주세요', 'compaction.confirm.title': '{model}(으)로 전환하면 자동 압축이 실행됩니다',
     'compaction.confirm.usage': '현재 컨텍스트 {used} ≥ 압축 임계값 {threshold} ({window} × {ratio})', 'compaction.confirm.next': '다음 단계 전에 이전 대화를 먼저 압축합니다',
     'compaction.confirm.overflow': '새 모델의 {window} 창을 이미 넘었습니다. 다음 요청에서 압축한 뒤 재시도합니다', 'compaction.confirm.hint': 'y 전환 · n/esc 뒤로',
@@ -431,7 +431,7 @@ export const MESSAGES = {
     'language.set': 'idioma → {name}', 'language.title': '/language — idioma de la interfaz', 'language.currentMark': 'actual', 'language.unknown': 'Idioma desconocido "{value}". Elige en, zh-CN, zh-TW, ja, ko o es.',
     'language.saveFailed': 'no se pudo guardar el idioma: {error}',
     'doctor.logs.new': 'Solo se registran los warnings/errores desde que arrancó esta versión del TUI.',
-    'footer.average': 'prom', 'footer.context': 'ctx', 'footer.cache': 'caché', 'footer.grokUsed': 'usado', 'footer.grokResets': 'reinicia', 'footer.goLimited': 'limitado hasta', 'composer.placeholder': 'escribe un mensaje', 'composer.shellMode': '! modo shell · esc sale',
+    'footer.average': 'prom', 'footer.context': 'ctx', 'footer.cache': 'caché', 'footer.grokUsed': 'usado', 'footer.grokResets': 'reinicia', 'footer.goLimited': 'limitado hasta', 'footer.keyLimit': 'límite key', 'composer.placeholder': 'escribe un mensaje', 'composer.shellMode': '! modo shell · esc sale',
     'compaction.running': 'Compactando el contexto, espera un momento', 'compaction.confirm.title': 'Cambiar a {model} compactará la conversación',
     'compaction.confirm.usage': 'contexto {used} ≥ umbral de compactación {threshold} ({window} × {ratio})', 'compaction.confirm.next': 'el siguiente paso compacta antes el historial antiguo',
     'compaction.confirm.overflow': 'ya supera la ventana de {window}: la siguiente petición compacta y reintenta', 'compaction.confirm.hint': 'y cambiar · n/esc volver',

package/plugins/providers/openrouter-account.mjs

@@ -6,8 +6,9 @@ export const OPENROUTER_API = 'https://openrouter.ai/api/v1';
 export const MANAGEMENT_REF = 'OPENROUTER_MANAGEMENT_KEY';
 
 const finite = value => {
+  if (!(typeof value === 'number' || typeof value === 'string' && value.trim())) return undefined;
   const number = Number(value);
-  return value !== null && value !== undefined && value !== '' && Number.isFinite(number) ? number : undefined;
+  return Number.isFinite(number) ? number : undefined;
 };
 
 export class OpenRouterAccountError extends Error {
@@ -45,10 +46,8 @@ export function parseOpenRouterCredits(body) {
 
 /** Remaining USD credit limit from a `/key` body; null when the key has no limit. */
 export function parseOpenRouterKeyRemaining(body) {
-  const remaining = body?.data?.limit_remaining;
-  if (remaining == null) return null;
-  const value = Number(remaining);
-  return Number.isFinite(value) ? Math.max(0, value) : null;
+  const value = finite(body?.data?.limit_remaining);
+  return value === undefined ? null : Math.max(0, value);
 }
 
 function keyOf(raw) {

package/plugins/session-metrics/balance.mjs

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { OPENROUTER_API, parseOpenRouterCredits, parseOpenRouterKeyRemaining } from '../providers/openrouter-account.mjs';
 
 export { parseOpenRouterCredits, parseOpenRouterKeyRemaining };
@@ -8,10 +9,10 @@ export { parseOpenRouterCredits, parseOpenRouterKeyRemaining };
 // credits (`/credits`) are documented as management-only but are served to
 // inference keys too; a key refused them falls back to its own remaining limit (`/key`).
 const SOURCES = {
-  'deepseek-official': { env: 'DEEPSEEK_API_KEY', clock: true, requests: ({ key }) => [{ url: 'https://api.deepseek.com/user/balance', key, parse: body => parseBalance(body) }] },
+  'deepseek-official': { env: 'DEEPSEEK_API_KEY', clock: true, requests: ({ key }) => [{ url: 'https://api.deepseek.com/user/balance', key, source: 'account', parse: parseBalanceInfo }] },
   openrouter: { env: 'OPENROUTER_API_KEY', managementEnv: 'OPENROUTER_MANAGEMENT_KEY', clock: false, requests: ({ key, managementKey }) => [
-    { url: `${OPENROUTER_API}/credits`, key: managementKey ?? key, parse: parseOpenRouterCredits },
-    { url: `${OPENROUTER_API}/key`, key, parse: parseOpenRouterKeyRemaining },
+    { url: `${OPENROUTER_API}/credits`, key: managementKey || key, source: 'account', parse: body => usdBalance(parseOpenRouterCredits(body), 'account') },
+    { url: `${OPENROUTER_API}/key`, key, source: 'key-limit', parse: body => usdBalance(parseOpenRouterKeyRemaining(body), 'key-limit') },
   ] },
 };
 export const BALANCE_PROVIDERS = Object.freeze(Object.keys(SOURCES));
@@ -21,16 +22,29 @@ const snapshots = new Map();
 let clock = { anchor: null, skewMs: 0 };
 const snapshotOf = provider => snapshots.get(provider) ?? { balance: null, fetchedAt: 0, pending: false };
 
-/** Best-effort positive USD balance from a `/user/balance` body. */
-export function parseBalance(body) {
+const usdBalance = (amount, source) => amount === null ? null : Object.freeze({ amount, currency: 'USD', source });
+
+function parseBalanceInfo(body) {
+  if (body?.is_available === false) return null;
   const infos = Array.isArray(body?.balance_infos) ? body.balance_infos : [];
-  const usd = infos.find(info => String(info?.currency ?? '').toUpperCase() === 'USD') ?? infos[0];
-  const total = Number(usd?.total_balance);
-  if (!Number.isFinite(total) || total < 0) return null;
-  return body?.is_available === false ? null : total;
+  const balances = infos.flatMap(info => {
+    const value = info?.total_balance, currency = String(info?.currency ?? '').toUpperCase();
+    if (!(typeof value === 'number' || typeof value === 'string' && value.trim()) || !/^[A-Z]{3}$/.test(currency)) return [];
+    const amount = Number(value);
+    return Number.isFinite(amount) && amount >= 0 ? [Object.freeze({ amount, currency, source: 'account' })] : [];
+  });
+  return balances.find(info => info.currency === 'USD') ?? balances[0] ?? null;
 }
 
-export function balanceNow(provider = 'deepseek-official') { return snapshotOf(provider).balance; }
+/** Numeric projection retained for callers that do not render currency or source. */
+export function parseBalance(body) { return parseBalanceInfo(body)?.amount ?? null; }
+export function balanceNow(provider = 'deepseek-official') { return balanceInfoNow(provider)?.amount ?? null; }
+export function balanceInfoNow(provider = 'deepseek-official') { return snapshotOf(provider).balance; }
+export function invalidateBalance(provider) { snapshots.delete(provider); }
+export function formatBalance(balance, digits = 2) {
+  if (!balance) return '';
+  return balance.currency === 'USD' ? `$${balance.amount.toFixed(digits)}` : `${balance.amount.toFixed(digits)} ${balance.currency}`;
+}
 /** Clock anchored to the last DeepSeek balance response's `Date` header, else the local one. */
 export function trustedNow() {
   const local = Date.now();
@@ -42,40 +56,43 @@ export async function refreshBalance(options = {}) {
   const provider = options.provider ?? 'deepseek-official';
   const source = SOURCES[provider];
   if (!source) return null;
-  const snapshot = snapshotOf(provider);
-  const key = options.key ?? process.env[source.env];
-  const managementKey = options.managementKey ?? (source.managementEnv ? process.env[source.managementEnv] : undefined);
+  const key = Object.hasOwn(options, 'key') ? options.key : process.env[source.env];
+  const managementKey = Object.hasOwn(options, 'managementKey') ? options.managementKey : source.managementEnv ? process.env[source.managementEnv] : undefined;
   const requests = source.requests({ key, managementKey }).filter(request => request.key);
-  const mode = managementKey ? 'management' : 'key';
+  const identity = createHash('sha256').update(JSON.stringify(requests.map(({ url, key }) => [url, key]))).digest('hex');
+  let snapshot = snapshots.get(provider);
+  if (!snapshot || snapshot.identity !== identity) {
+    snapshot = { balance: null, fetchedAt: 0, pending: false, identity };
+    snapshots.set(provider, snapshot);
+  }
   const now = Date.now();
-  // A newly added (or removed) management key changes the source; it is read at once.
-  if (snapshot.pending || snapshot.mode === mode && now - snapshot.fetchedAt < CACHE_MS) return snapshot.balance;
+  if (requests.length === 0) return null;
+  if (snapshot.pending || snapshot.fetchedAt && now - snapshot.fetchedAt < CACHE_MS) return balanceNow(provider);
   const retrySoon = () => Date.now() - (CACHE_MS - RETRY_MS);
-  if (requests.length === 0) { snapshots.set(provider, { ...snapshot, mode, fetchedAt: retrySoon(), pending: false }); return snapshot.balance; }
   const fetchImpl = options.fetch ?? globalThis.fetch;
-  if (typeof fetchImpl !== 'function') return snapshot.balance;
-  snapshots.set(provider, { ...snapshot, pending: true });
+  if (typeof fetchImpl !== 'function') return balanceNow(provider);
+  snapshot.pending = true;
   try {
     let response, body, request;
     for (request of requests) {
       response = await fetchImpl(request.url, { headers: { Authorization: `Bearer ${request.key}`, Accept: 'application/json' } });
-      body = await response.json();
+      try { body = await response.json(); } catch { body = undefined; }
+      if (snapshots.get(provider) !== snapshot) return balanceNow(provider);
       // A key refused this reading falls through to the next source.
       if (response.ok || (response.status !== 401 && response.status !== 403)) break;
+      if (snapshot.balance?.source === request.source) snapshot.balance = null;
     }
     const header = source.clock ? response.headers?.get?.('date') : null;
     const anchor = header ? Date.parse(header) : NaN;
     const parsed = response.ok ? request.parse(body) : null;
     if (Number.isFinite(anchor)) clock = { anchor, skewMs: anchor - Date.now() };
-    snapshots.set(provider, {
-      mode,
-      balance: parsed === null && response.ok ? null : parsed ?? snapshot.balance,
-      fetchedAt: parsed === null ? retrySoon() : Date.now(),
-      pending: false,
-    });
+    snapshot.balance = response.ok ? parsed : snapshot.balance?.source === request.source ? snapshot.balance : null;
+    snapshot.fetchedAt = parsed === null ? retrySoon() : Date.now();
   } catch {
     // A transient failure keeps the last known balance and retries sooner.
-    snapshots.set(provider, { ...snapshot, mode, fetchedAt: retrySoon(), pending: false });
+    if (snapshots.get(provider) === snapshot) snapshot.fetchedAt = retrySoon();
+  } finally {
+    snapshot.pending = false;
   }
-  return snapshotOf(provider).balance;
+  return balanceNow(provider);
 }

package/plugins/session-metrics/desktop-client.mjs

@@ -2,7 +2,7 @@ globalThis.__ModuleLoader__.load({
   id: '@toddzheng024/dscode-desktop',
   factory: require => {
     const { createElement: h, useState, useEffect, useRef } = require('react');
-    const money = (cost, partial = false) => cost === null || partial && cost === 0 ? 'Unknown' : `$${cost.toFixed(4)}${partial ? '+' : ''}`;
+    const money = (cost, partial = false, currency = 'USD') => cost === null || partial && cost === 0 ? 'Unknown' : (currency === 'USD' ? `$${cost.toFixed(4)}` : `${cost.toFixed(4)} ${currency}`) + (partial ? '+' : '');
     const percent = value => value === null ? 'Unknown' : `${value.toFixed(1)}%`;
     const speed = value => value === null ? 'Unknown' : `${value.toFixed(1)} tokens/s`;
     const control = { padding: '7px 10px', border: '.5px solid var(--dsw-alias-border-l3, #8886)', borderRadius: 'var(--dsw-radius-md, 6px)', background: 'transparent', color: 'inherit', font: 'inherit' };
@@ -33,7 +33,7 @@ globalThis.__ModuleLoader__.load({
             fact('Pending calls', state.pending ?? 'Unknown'), fact('Context estimate', percent(state.contextPercent)),
             fact('Input cache share', percent(state.cachePercent)), fact('Smoothed request speed', speed(state.currentTps)),
             fact('Session average speed', speed(state.averageTps)),
-            state.balance !== null && fact('Cached provider balance', money(state.balance)),
+            state.balance !== null && state.balanceCurrency && fact(state.balanceSource === 'key-limit' ? 'Cached key spending limit' : 'Cached account balance', money(state.balance, false, state.balanceCurrency)),
             state.subscription && fact('Cached subscription usage', state.subscription),
             state.budget && fact('Configured cost budget', `${money(state.budget.spent)} / ${money(state.budget.limit)} · ${state.budget.state}`)),
           h('p', { style: { fontSize: 12 } }, 'Unknown means a reading or price is unavailable. + marks a partial cost. Pending calls have not settled. Cached account figures may lag the provider.'),

package/plugins/session-metrics/desktop-host.mjs

@@ -1,6 +1,6 @@
 import { clientRequestSchema } from '@deepseek-ai/dsh-client-connection';
 import { footerFor, goFooterFact, grokFooterFact } from './view.mjs';
-import { balanceNow } from './balance.mjs';
+import { balanceInfoNow } from './balance.mjs';
 import { canonicalProvider } from '../providers/catalog.mjs';
 import { grokSubscriptionNow } from '../grok/billing.mjs';
 import { goUsageNow } from '../opencode-go/usage.mjs';
@@ -13,12 +13,13 @@ export function desktopMetricsRequest(ctx, payload) {
   if (!agent || ctx.agentPresets.composedPreset(agent.ctx) !== 'dscode') throw Error('Usage is available for an open DSCODE session.');
   const route = agent.session.requestHeader()?.config ?? agent.options;
   const provider = canonicalProvider(route.provider);
+  const balance = balanceInfoNow(provider);
   return footerFor(agent.id, {}, 0, provider, 'en', (summary, context, _columns, rates) => ({
     sessionId: agent.id, provider: route.provider, model: route.model,
     cost: finite(summary.cost), partial: summary.unknown === true, calls: finite(summary.calls), pending: finite(summary.pending),
     contextPercent: finite(context), cachePercent: finite(summary.cache),
     currentTps: finite(rates.current), averageTps: finite(rates.average), requestActive: rates.active === true,
-    balance: finite(balanceNow(provider)),
+    balance: finite(balance?.amount), balanceCurrency: balance?.currency ?? null, balanceSource: balance?.source ?? null,
     subscription: provider === 'grok' ? grokFooterFact(grokSubscriptionNow()) : provider === 'opencode-go' ? goFooterFact(goUsageNow()) : null,
     turns: (summary.turns ?? []).slice(-50).reverse().map(turn => ({ turn: turn.turn, cost: finite(turn.cost), calls: turn.calls, partial: turn.unknown })),
     totalTurns: summary.turns?.length ?? 0, unattributed: finite(summary.unattributed),

package/plugins/session-metrics/index.mjs

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { appendMetric } from './store.mjs';
 import { estimateCost, priceVersionFor } from './pricing.mjs';
 import { setMetricSource } from './view.mjs';
-import { BALANCE_PROVIDERS, refreshBalance } from './balance.mjs';
+import { BALANCE_PROVIDERS, invalidateBalance, refreshBalance } from './balance.mjs';
 import { refreshOpenRouterModels } from '../openrouter/models.mjs';
 import { REPLAY_KIND } from '../openrouter/wire.mjs';
 import { providerSpec } from '../providers/catalog.mjs';
@@ -35,17 +35,22 @@ export function apply(ctx) {
   // Remaining balance is best-effort decoration: resolve the key lazily (never
   // inject the credentials service, so a missing one cannot fail startup), keep
   // the request on a five-minute cache, and never let it reach the render path.
-  const credentials = ctx.get?.('credentials');
-  const refresh = () => Promise.all(BALANCE_PROVIDERS.map(async provider => {
+  const generations = new Map();
+  let closed = false;
+  const refresh = (providers = BALANCE_PROVIDERS) => Promise.all(providers.map(async provider => {
+    const generation = (generations.get(provider) ?? 0) + 1;
+    generations.set(provider, generation);
     try {
       const spec = providerSpec(provider);
       const secret = async ref => {
         if (!ref) return undefined;
+        const credentials = ctx.get?.('credentials');
         const resolved = await credentials?.resolve?.(ref);
         return (typeof resolved === 'string' ? resolved : resolved?.value) || process.env[ref] || undefined;
       };
       // An OpenRouter management key, when stored, turns the balance into the account's credits.
       const [key, managementKey] = await Promise.all([secret(spec.credentialRef), secret(spec.managementRef)]);
+      if (closed || generations.get(provider) !== generation) return;
       await refreshBalance({ provider, key, managementKey });
       // The listing needs no key, but only a user with an OpenRouter key uses it; the adapter waits for it before its first call.
       if (provider === 'openrouter' && key) await refreshOpenRouterModels({ home });
@@ -53,10 +58,18 @@ export function apply(ctx) {
       /* balance stays unknown */
     }
   }));
+  ctx.on('credentials/reference-updated', ref => {
+    const providers = BALANCE_PROVIDERS.filter(provider => {
+      const spec = providerSpec(provider);
+      return ref === spec.credentialRef || ref === spec.managementRef;
+    });
+    for (const provider of providers) invalidateBalance(provider);
+    return refresh(providers);
+  });
   refresh();
   const balanceTimer = setInterval(refresh, 5 * 60 * 1000);
   if (typeof balanceTimer.unref === 'function') balanceTimer.unref();
-  ctx.effect(() => () => clearInterval(balanceTimer));
+  ctx.effect(() => () => { closed = true; clearInterval(balanceTimer); for (const provider of BALANCE_PROVIDERS) invalidateBalance(provider); });
   const record = (id, entry) => { try { appendMetric(home, id, entry); } catch { ctx.logger.warn('Session cost telemetry could not be saved.'); } };
   ctx.on('llm/stream', async function* (options, next) {
     // Plugin calls made for a session carry no sessionId on the wire; they are charged through the async context.

package/plugins/session-metrics/view.mjs

@@ -2,7 +2,7 @@ import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { readMetrics } from './store.mjs';
 import { t } from '../i18n/messages.mjs';
 import { estimateCost, peakEmoji } from './pricing.mjs';
-import { balanceNow, trustedNow } from './balance.mjs';
+import { balanceInfoNow, formatBalance, trustedNow } from './balance.mjs';
 import { grokSubscriptionNow } from '../grok/billing.mjs';
 import { goUsageNow } from '../opencode-go/usage.mjs';
 import { canonicalProvider } from '../providers/catalog.mjs';
@@ -166,7 +166,7 @@ function footerFigures(metrics, context, rates, locale = 'en', provider = 'deeps
   const ctx = figure(Number.isFinite(context) ? `${Math.round(context)}%` : '--', FIGURE.percent);
   const cache = figure(metrics.cache === null ? '--' : `${metrics.cache.toFixed(1)}%`, FIGURE.share);
   // The balance belongs to the provider serving the route; only DeepSeek's official one bills by a peak window.
-  const balance = balanceNow(provider);
+  const balance = balanceInfoNow(provider);
   const spend = metrics.unknown && metrics.cost === 0 ? '--' : `$${metrics.cost.toFixed(2)}${metrics.unknown ? '+' : ''}${metrics.pending ? '…' : ''}`;
   // The money is the one live figure whose digits are not reserved: they cross a
   // column a handful of times per session, and reserving them would evict a
@@ -174,7 +174,7 @@ function footerFigures(metrics, context, rates, locale = 'en', provider = 'deeps
   // provider cannot report is left out instead of parked as `$--`.
   const dollars = provider === 'grok' ? grokFooterFact(grokSubscriptionNow(), locale)
     : provider === 'opencode-go' ? goFooterFact(goUsageNow(), locale)
-    : spend + (balance === null ? '' : ' / $' + balance.toFixed(2)) + (provider === 'deepseek-official' ? ' ' + peakEmoji(trustedNow()) : '');
+    : spend + (balance === null ? '' : ' / ' + (balance.source === 'key-limit' ? label('footer.keyLimit') + ' ' : '') + formatBalance(balance)) + (provider === 'deepseek-official' ? ' ' + peakEmoji(trustedNow()) : '');
   // The budget slot rides the money figure: it answers "how much of the session's
   // limit is spent", which is a fact about the cost, not a second cost. A session
   // with no limit renders exactly as before, so the footer only grows by choice.

package/plugins/status/index.mjs

@@ -0,0 +1,127 @@
+import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment';
+import { readLanguage } from '../i18n/messages.mjs';
+import { dscodeVersion } from '../opencode-go/version.mjs';
+import { canonicalProvider, providerSpec } from '../providers/catalog.mjs';
+import { statusSelection } from './selection.mjs';
+
+const words = {
+  en: { title: 'DSCODE status', provider: 'Provider', model: 'Model', balance: 'Account balance', key: 'This key remaining limit', unlimited: 'No key spending cap (not an unlimited account balance)', budget: 'Effective budget remaining', recharge: 'Recharge balance', bonus: 'Bonus balance', missing: 'Credentials are not configured.', unsupported: 'Balance lookup is not supported for this provider or endpoint.', failed: 'Balance unavailable. Check your connection or provider account and retry.', denied: 'The provider refused this credential for balance lookup.', timeout: 'Balance lookup timed out. Retry /status.', available: 'Account available', yes: 'yes', no: 'no', checked: 'Checked', usage: 'Usage: /status', unknown: 'unavailable' },
+  'zh-CN': { title: 'DSCODE 状态', provider: '服务商', model: '模型', balance: '账户余额', key: '当前 key 剩余额度', unlimited: '此 key 未设消费上限（不代表账户余额无限）', budget: '当前有效预算剩余', recharge: '充值余额', bonus: '赠送余额', missing: '尚未配置凭据。', unsupported: '此服务商或接口暂不支持余额查询。', failed: '余额暂不可用，请检查网络或服务商账户后重试。', denied: '服务商拒绝使用当前凭据查询余额。', timeout: '余额查询超时，请重试 /status。', available: '账户可用', yes: '是', no: '否', checked: '查询时间', usage: '用法：/status', unknown: '暂不可用' },
+};
+const decimal = value => (typeof value === 'number' && Number.isFinite(value)) || (typeof value === 'string' && /^-?\d+(?:\.\d+)?$/.test(value));
+const money = (value, currency) => decimal(value) && ['USD', 'CNY'].includes(currency) ? `${value} ${currency}` : undefined;
+
+/** Resolve the same configured reference as the active route, never a different saved key. */
+export function statusConnection(ctx, provider) {
+  const entry = ctx.llm.listConfigurableProviders().find(item => item.provider === provider);
+  if (entry) {
+    const descriptor = ctx.get('settings')?.describe({ redactSecrets: true }).find(item => item.ns === entry.settingsNs);
+    const profile = entry.settingsPath.reduce((value, key) => value?.[key], descriptor?.value);
+    if (!profile || typeof profile.apiKeyEnv !== 'string') return undefined;
+    return { ref: profile.apiKeyEnv, baseURL: profile.baseURL };
+  }
+  const ref = providerSpec(provider)?.credentialRef;
+  return ref ? { ref } : undefined;
+}
+
+function officialEndpoint(ctx, provider, baseURL) {
+  const fallback = provider === 'openrouter' ? 'https://openrouter.ai/api/v1' : 'https://api.deepseek.com/anthropic';
+  const configured = baseURL ?? (provider === 'deepseek-official' ? launchEnvironmentOf(ctx).get('DEEPSEEK_BASE_URL')?.value : undefined);
+  const url = new URL(configured ?? fallback);
+  const expected = new URL(fallback);
+  return url.origin === expected.origin && !url.username && !url.password && !url.search && !url.hash
+    && (provider === 'openrouter' ? /^\/api\/v1\/?$/.test(url.pathname) : /^\/(?:anthropic\/?|v1\/?)?$/.test(url.pathname));
+}
+
+async function json(url, key, fetchImpl, signal) {
+  const response = await fetchImpl(url, { headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' }, signal, redirect: 'error' });
+  if (!response.ok) throw Object.assign(new Error('Balance query failed'), { status: response.status });
+  return response.json();
+}
+
+/** No shared balance cache: every invocation belongs to this exact route and credential. */
+export async function providerStatus(ctx, selection, { signal, fetch: fetchImpl = globalThis.fetch, locale = readLanguage(), timeoutMs = 8000 } = {}) {
+  const w = words[locale] ?? words.en;
+  const provider = selection?.provider, model = selection?.model;
+  const lines = [`${w.title}`, `${w.provider}: ${provider ?? w.unknown}`, `${w.model}: ${model ?? w.unknown}`];
+  const deadline = AbortSignal.any([...(signal ? [signal] : []), AbortSignal.timeout(timeoutMs)]);
+  const run = async () => {
+    const route = canonicalProvider(provider);
+    if (route === 'deepseek-account') {
+      const account = ctx.get('deepseekAccount');
+      if ((await account?.getState())?.status !== 'credential-stored') return [w.missing];
+      const balance = await account.getBalance({ version: dscodeVersion(), locale, timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60 });
+      if (balance?.status !== 'ready') return [w.failed];
+      const result = [];
+      for (const [label, wallets] of [[w.recharge, balance.value], [w.bonus, balance.bonusWallets]]) {
+        for (const wallet of wallets ?? []) {
+          const amount = money(wallet.balance, wallet.currency);
+          if (amount !== undefined) result.push(`${label}: ${amount}`);
+        }
+      }
+      return result.length ? result : [w.failed];
+    }
+    if (!['deepseek-official', 'openrouter'].includes(route)) return [w.unsupported];
+    const connection = statusConnection(ctx, provider);
+    if (!connection) return [w.failed];
+    if (!officialEndpoint(ctx, route, connection.baseURL)) return [w.unsupported];
+    const credentials = ctx.get('credentials');
+    const key = credentials ? (await credentials.resolve(connection.ref))?.value : launchEnvironmentOf(ctx).get(connection.ref)?.value;
+    if (!key) return [w.missing];
+    if (route === 'deepseek-official') {
+      const body = await json('https://api.deepseek.com/user/balance', key, fetchImpl, deadline);
+      const amounts = (Array.isArray(body?.balance_infos) ? body.balance_infos : []).flatMap(info => {
+        const amount = money(info.total_balance, info.currency);
+        return amount === undefined ? [] : [`${w.balance}: ${amount}`];
+      });
+      if (!amounts.length) return [w.failed];
+      if (typeof body.is_available === 'boolean') amounts.push(`${w.available}: ${body.is_available ? w.yes : w.no}`);
+      return amounts;
+    }
+    // Never borrow a management key: it may belong to a different account.
+    const [credits, keyInfo] = await Promise.allSettled([
+      json('https://openrouter.ai/api/v1/credits', key, fetchImpl, deadline),
+      json('https://openrouter.ai/api/v1/key', key, fetchImpl, deadline),
+    ]);
+    const result = [];
+    const data = credits.status === 'fulfilled' ? credits.value?.data : undefined;
+    const remaining = decimal(data?.total_credits) && decimal(data?.total_usage) ? Number(data.total_credits) - Number(data.total_usage) : NaN;
+    result.push(`${w.balance}: ${Number.isFinite(remaining) ? `${Number(remaining.toFixed(8))} USD` : w.unknown}`);
+    const current = keyInfo.status === 'fulfilled' ? keyInfo.value?.data : undefined;
+    result.push(`${w.key}: ${current?.limit === null && current?.limit_remaining === null ? w.unlimited : money(current?.limit_remaining, 'USD') ?? w.unknown}`);
+    const effective = money(current?.effective_budget?.remaining_usd, 'USD');
+    if (effective !== undefined) result.push(`${w.budget}: ${effective}`);
+    if (credits.status === 'rejected' && keyInfo.status === 'rejected') throw keyInfo.reason;
+    return result;
+  };
+  let onAbort;
+  try {
+    deadline.throwIfAborted();
+    const cancelled = new Promise((_, reject) => {
+      onAbort = () => reject(deadline.reason);
+      deadline.addEventListener('abort', onAbort, { once: true });
+    });
+    lines.push(...await Promise.race([run(), cancelled]));
+  } catch (error) {
+    if (signal?.aborted) throw signal.reason;
+    lines.push(deadline.aborted ? w.timeout : [401, 403].includes(error?.status) ? w.denied : w.failed);
+  } finally {
+    if (onAbort) deadline.removeEventListener('abort', onAbort);
+  }
+  return [...lines, `${w.checked}: ${new Date().toISOString()}`].join('\n');
+}
+
+export function registerStatus(ctx) {
+  ctx.commands.register({ name: 'status', description: 'Show the current provider, model and available balance', handler: async ({ agent, rawInput, signal }) => {
+    if (rawInput.trim()) return { kind: 'error', text: (words[readLanguage()] ?? words.en).usage };
+    const selection = statusSelection(agent);
+    return { kind: 'success', text: await providerStatus(ctx, selection, { signal }) };
+  } });
+}
+
+/** Only a standalone text command is intercepted; paths and attached prompts stay model input. */
+export async function acpStatus(ctx, selection, prompt, signal) {
+  if (prompt.length !== 1 || prompt[0].type !== 'text' || !/^\/status(?:\s|$)/.test(prompt[0].text.trim())) return undefined;
+  if (prompt[0].text.trim() !== '/status') return (words[readLanguage()] ?? words.en).usage;
+  return providerStatus(ctx, selection, { signal });
+}

package/plugins/status/selection.mjs

@@ -0,0 +1,6 @@
+// The TUI's explicit picker choice takes precedence over its last request header.
+// Keep the live ref outside model history; WeakMap ownership follows the Agent.
+const selections = new WeakMap();
+export const registerStatusSelection = (agent, read) => { selections.set(agent, read); };
+export const statusSelection = agent => selections.get(agent)?.()
+  ?? { ...agent.options, ...agent.session.requestHeader()?.config };