acuvo-code 0.2.0 → 0.2.1

package/lib/model.mjs

@@ -91,6 +91,26 @@ export const DEEPSEEK_DIRECT_MODELS = Object.freeze({
  * @returns {{ url: string, apiKey: string, model: string } | null}
  */
 export function directDeepSeek(model, env = process.env) {
+  /**
+   * ── ⭐⭐⭐ OFF UNLESS EXPLICITLY ASKED FOR (Roman, 2026-08-22) ──────────────
+   *
+   * *"no direct deepseek api, we can just use the rest of it for testing."*
+   *
+   * ⚠️ A KEY BEING PRESENT IS NOT A REQUEST TO USE IT. Before this line, merely
+   * exporting `DEEPSEEK_API_KEY` silently re-routed every build onto the direct
+   * endpoint — which is 3.7x dearer on OUTPUT ($0.66/M vs OpenRouter's $0.18/M)
+   * and doubles for 7 hours a day under DeepSeek's peak billing (01:00-04:00 and
+   * 06:00-10:00 UTC = 11am-2pm / 4pm-8pm AEST). Measured over 95M tokens that is
+   * 62.3% margin against 85.6%.
+   *
+   * ⭐ Direct's cache READ is genuinely cheaper ($0.007/M vs $0.0154/M) and that
+   * is why it once led. It cannot pay for the cache MISSES (2.9x dearer) or the
+   * output (3.7x dearer), and output is ~60% of the bill.
+   *
+   * Mirrors `deepSeekDirectEnabled()` in `console/lib/llm.ts` — the builder and
+   * the CLI must not disagree about which vendor serves a build.
+   */
+  if (String(env?.ACUVO_DEEPSEEK_DIRECT ?? '') !== '1') return null;
   const key = String(env?.DEEPSEEK_API_KEY ?? '').trim();
   if (!key) return null;
   const mapped = DEEPSEEK_DIRECT_MODELS[String(model ?? '')];
@@ -325,17 +345,42 @@ export function readModelConfig(env = process.env) {
  * is stuck: it needs no key, runs offline, and every line it prints names the
  * variable that fixes it.
  */
+/**
+ * ── ⭐⭐⭐ THE GATEWAY SHIPPED, SO THIS MESSAGE CHANGED WITH IT (2026-08-22) ──
+ *
+ * The note above promised exactly that: *"When the gateway ships, this message
+ * changes with it."* It shipped — `acuvo --login` lands an Acuvo key, and the
+ * metered path recorded its first real usage row today after never once having
+ * worked.
+ *
+ * ⚠️⚠️ AND UNTIL THIS EDIT THE FRONT DOOR SOLD THE COMPETITION. The first thing
+ * a brand-new user saw was "create your own OpenRouter key" — BYOK, which Roman
+ * has ruled out twice, printed as step 1 of onboarding on a package anyone can
+ * now `npm i -g`. `--help` did list `--login`; the message people actually hit
+ * did not. Every stranger who installed this brought their own key, so we
+ * metered nothing and earned nothing.
+ *
+ * ⭐ BOTH PATHS STAY, ORDER REVERSED. BYOK is not removed — it is honest, it
+ * works, and hiding it would make the tool look locked. It is simply no longer
+ * the default answer to "how do I start".
+ *
+ * ⚠️ IT STILL PROMISES NOTHING THAT DOES NOT EXIST. No pricing, no "sign up
+ * free", no plan names — self-serve signup has never been walked end to end
+ * (every tenant today is operated · unmetered). It names the two commands that
+ * are real and stops there.
+ */
 export const MISSING_KEY_MESSAGE = [
   'Acuvo Code — a terminal coding agent that tells you the price before it runs,',
   'stops at the number you set, and can re-check every claim it ever made.',
   '',
-  'It needs a model key to think. Today that is your own OpenRouter key:',
+  'It needs a key. Two ways — then run the same command again:',
+  '',
+  '  A) Your Acuvo account, billed to your Acuvo credits:',
+  '       acuvo --login        (paste the key from Settings → API keys)',
   '',
-  '  1. Create one (free, about a minute):  https://openrouter.ai/keys',
-  '  2. Set it:',
+  '  B) Your own key, billed to you — https://openrouter.ai/keys',
   '       export OPENROUTER_API_KEY=sk-or-v1-...        (bash / zsh)',
   '       $env:OPENROUTER_API_KEY = "sk-or-v1-..."      (PowerShell)',
-  '  3. Run the same command again.',
   '',
   'A typical task costs $0.001-$0.003. The ceiling is $0.02 a run unless you',
   'raise it, so a mistake costs two cents to find.',

package/lib/turn.mjs

@@ -49,7 +49,7 @@ import { budgetedAsker } from './ask-user.mjs';
 import { normalizeRelativePath } from './workspace.mjs';
 import { stringifyForModel } from './model-json.mjs';
 import { callModel, DEFAULT_MAX_TOKENS, DEFAULT_TIMEOUT_MS, pinOutcome, providerOrderFor } from './model.mjs';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 /**
  * The pure prefix instrument. See the prefix-stability block in the round loop.
  * It was written, tested, and imported by nothing until 2026-08-20 —
@@ -71,8 +71,42 @@ import { detectDrift, driftNudge, reanchorDecision, reconcile, formatReconciliat
  * key OpenRouter groups by — and a resumed session passes its own id anyway,
  * which is exactly where the two need to agree and do.
  */
-function defaultStickyKey() {
-  return `acuvo-${randomUUID()}`;
+/**
+ * ── 💰⭐⭐⭐ DERIVED FROM THE WORKSPACE, NOT RANDOM (2026-08-22) ──────────────
+ *
+ * This returned `acuvo-${randomUUID()}` and the note below already recorded the
+ * damage without naming it as a bug: *"each cold process rolled the dice
+ * afresh"*, measured as a **65 / 98 / 31 / 98** cache alternation across runs.
+ *
+ * ⭐ THAT ALTERNATION *IS* THE MISSING CACHE. `session_id` is what OpenRouter
+ * groups by when choosing an upstream, and `deepseek-v4-flash-0731` has 28 of
+ * them. A fresh id every process means a fresh upstream every process — and a
+ * cold prompt cache each time, because a cache lives on ONE provider. Only
+ * resumed sessions escaped it, and the common case (`acuvo "do the thing"` in a
+ * project, over and over) never resumes.
+ *
+ * ⭐ THE WORKSPACE IS THE RIGHT ANCHOR. The same project returns to the same
+ * upstream every run, so its prefix stays warm across processes, across days,
+ * and across several terminals open on the same repo — which now SHARE a cache
+ * instead of each warming their own.
+ *
+ * ⚠️ IT IS A PREFERENCE, NOT A PIN. OpenRouter still falls back when that
+ * upstream is unhealthy, so this trades no availability for the cache.
+ *
+ * ⚠️ AND IT MUST NOT BE THE PATH ITSELF. The key goes over the wire to a third
+ * party; `C:/Projects/clients/<name>` would leak a customer list into request
+ * metadata. Hashed, so it is stable and says nothing.
+ */
+export function defaultStickyKey() {
+  let root;
+  try {
+    root = process.cwd();
+  } catch {
+    // A deleted cwd throws here. Falling back to a random id is correct — an
+    // unidentifiable workspace should not collide with a real one's cache.
+    return `acuvo-${randomUUID()}`;
+  }
+  return `acuvo-${createHash('sha256').update(root).digest('hex').slice(0, 32)}`;
 }
 /**
  * ⭐ THE DEFAULT IS THE CHAIN, NOT THE SINGLE CALL. `callModel` is still

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acuvo-code",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Acuvo Code — the terminal client for the Acuvo capability registry. Zero dependencies, by design.",
   "type": "module",
   "bin": {