deepseek-cli-mode 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.5.0 — `/api` configuration and coloured permission footer
+
+- **`/api`** configures the DeepSeek endpoint from inside the CLI:
+  - `/api` opens a menu (Show status / Set API key / Set base URL / Remove key)
+  - `/api set <key>` or bare `/api <key>` stores the key through the Harness credential service, which writes
+    `$DSH_HOME/.credentials.yaml` immediately — no restart, the next request uses it
+  - `/api url <https://…>` writes `baseURL` into `$DSH_HOME/settings.yaml`
+  - `/api unset` removes the stored key; `/api status` prints key state, base URL, and both file paths
+  - The key prompt is masked (`*`) in the interactive editor
+- The permission footer is colour-coded: **`⏵ danger-full-access` in red**, `read-only` in green,
+  `workspace-write` in yellow; the rest of the line stays dim.
+- Security: keys are never printed back; the value is passed only to the credential service. `/api` is a user-typed
+  command — the model cannot change credentials.
+
 ## 1.4.0 — reasoning effort levels in the model picker
 
 - `/model` now asks for the reasoning effort after you pick a model, listing the adapter's real levels

package/README.md

@@ -145,10 +145,10 @@ Typing `/` opens a live command menu, like Claude Code:
 `↑`/`↓` moves the selection, `Tab` completes it, `Enter` runs it. The menu filters as you type.
 
 `/model`, `/reasoning`, `/permissions`, and `/resume` open the same kind of picker when called without an argument.
-**Shift+Tab** cycles the permission mode, and a dim footer above the prompt always shows the active one:
+**Shift+Tab** cycles the permission mode, and a footer above the prompt always shows the active one — `danger-full-access` in red, `read-only` in green, `workspace-write` in yellow:
 
 ```
-  ⏵⏵ workspace-write · deepseek-official/deepseek-chat · shift+tab to cycle
+  ⏵ workspace-write · deepseek-official/deepseek-chat · shift+tab to cycle
 > 
 ```
 
@@ -158,8 +158,9 @@ Typing `/` opens a live command menu, like Claude Code:
 | `/new` | start a fresh session (new id, keeps the process warm) |
 | `/sessions` | recent sessions in this directory (with a ▶ running marker) |
 | `/resume <id>` | switch to another session |
-| `/model [id]` | show or switch the model for the next message |
-| `/reasoning [off\|high\|max]` | show or set the reasoning effort |
+| `/model [id]` | pick a model and its reasoning effort |
+| `/reasoning [effort]` | pick a reasoning effort (low/medium/high/max) |
+| `/api [set <key>\|url <url>\|unset\|status]` | configure the API key and endpoint; writes `$DSH_HOME/.credentials.yaml` and `settings.yaml` |
 | `/permission [preset]` | switch the sandbox + approval preset |
 | `/skills` | list the skills discovered in this workspace |
 | `/jobs` | list this session's background jobs |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepseek-cli-mode",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Terminal (CLI) mode for DeepSeek Harness — an interactive, Claude Code-style coding agent for your shell.",
   "type": "module",
   "main": "index.js",

package/runner/line-editor.js

@@ -55,6 +55,7 @@ export class LineEditor {
     this.selectOptions = [];
     this.selectIndex = 0;
     this.hint = "";
+    this.secret = false;
     this._onData = (chunk) => this.handleData(chunk);
     this._onEnd = () => {
       this.onEnd();
@@ -99,11 +100,13 @@ export class LineEditor {
    * Ask one line.
    * @param {string} prompt prompt string (may contain ANSI)
    * @param {boolean} menuEnabled show slash-command suggestions
+   * @param {boolean} [secret] mask the typed value (API keys, tokens)
    * @returns {Promise<string|null>} line, or null on Ctrl+C / EOF
    */
-  ask(prompt, menuEnabled = false) {
+  ask(prompt, menuEnabled = false, secret = false) {
     this.prompt = prompt;
     this.menuEnabled = menuEnabled;
+    this.secret = secret === true;
     this.buffer = "";
     this.cursor = 0;
     this.menu = [];
@@ -118,6 +121,11 @@ export class LineEditor {
     });
   }
 
+  /** Ask for a secret value without echoing it. */
+  askSecret(prompt) {
+    return this.ask(prompt, false, true);
+  }
+
   /**
    * Ask the user to pick one option from a list.
    * @param {string} title prompt line
@@ -371,6 +379,7 @@ export class LineEditor {
     this.selectMode = false;
     this.selectOptions = [];
     this.hint = "";
+    this.secret = false;
     this.clearRender();
     this.menu = [];
     this.output.write("\x1b[?25h");
@@ -409,9 +418,10 @@ export class LineEditor {
     const prompt = this.prompt;
     const promptWidth = visibleWidth(prompt);
     const available = Math.max(8, columns - promptWidth - 1);
+    const display = this.secret ? "*".repeat(this.buffer.length) : this.buffer;
     let offset = 0;
-    if (this.buffer.length > available) offset = Math.max(0, this.cursor - available + 1);
-    const visible = this.buffer.slice(offset, offset + available);
+    if (display.length > available) offset = Math.max(0, this.cursor - available + 1);
+    const visible = display.slice(offset, offset + available);
     const column = promptWidth + (this.cursor - offset);
     this.output.write(prompt + visible);
 

package/runner/runner.js

@@ -23,6 +23,7 @@ import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { installModelSelection } from "@deepseek-ai/dsh-agent";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { LineEditor } from "./line-editor.js";
 
 /** Stable Cordis plugin name. */
@@ -497,6 +498,7 @@ function printBanner(model) {
 // Slash-command suggestions for the live menu (native Harness commands are
 // merged in at runtime).
 const BUILTIN_COMMANDS = [
+  { name: "api", description: "Set the API key or base URL" },
   { name: "clear", description: "Clear the screen" },
   { name: "exit", description: "Leave the session" },
   { name: "export", description: "Write this run's transcript as markdown" },
@@ -549,6 +551,7 @@ Interactive commands:
   /resume <id>       switch to another session
   /model [id]        pick a model and its reasoning effort (low/medium/high/max)
   /reasoning [off|high|max]   pick a reasoning effort
+  /api [set <key>|url <url>|unset|status]   configure the API key and endpoint
   /permissions [p]   pick a permission mode (native: /permission; Shift+Tab cycles)
   /skills            list the skills discovered in this workspace
   /jobs              list this session's background jobs
@@ -644,6 +647,8 @@ async function run(ctx, options, exit) {
   const attachments = ctx.get("attachments");
   const tokenMeter = ctx.get("tokenMeter");
   const llm = ctx.get("llm");
+  const credentials = ctx.get("credentials");
+  const settings = ctx.get("settings");
 
   if (options.list) {
     printSessionList(listSessions());
@@ -1029,10 +1034,23 @@ async function run(ctx, options, exit) {
     }
   }
 
+  /** Colour the active permission mode by risk. */
+  function modeColor(mode) {
+    if (mode.includes("danger")) return ansi.red;
+    if (mode.includes("read")) return ansi.green;
+    return ansi.yellow;
+  }
+
   /** Permanent one-line footer above the prompt. */
   function printStatusBar() {
     if (!tty || !interactive) return;
-    out(paint(ansi.dim, `  ⏵⏵ ${sanitize(currentPermission())} · ${sanitize(modelDesc())} · shift+tab to cycle`) + "\n");
+    const mode = currentPermission();
+    out(
+      "  " +
+        paint(modeColor(mode), `⏵ ${sanitize(mode)}`) +
+        paint(ansi.dim, ` · ${sanitize(modelDesc())} · shift+tab to cycle`) +
+        "\n"
+    );
   }
 
   /** One list picker shared by /model, /reasoning, /permissions, /resume. */
@@ -1051,6 +1069,83 @@ async function run(ctx, options, exit) {
     return options[index]?.value ?? null;
   }
 
+  // ---- API key / endpoint management --------------------------------------
+  const API_KEY_REF = credentialRef("DEEPSEEK_API_KEY");
+  const DEFAULT_BASE_URL = "https://api.deepseek.com";
+
+  async function apiBaseUrl() {
+    try {
+      const descriptor = settings?.describe().find((entry) => String(entry.ns) === "llm-deepseek");
+      const value = descriptor?.value;
+      if (value && typeof value === "object" && typeof value.baseURL === "string" && value.baseURL !== "") return value.baseURL;
+    } catch {}
+    return DEFAULT_BASE_URL;
+  }
+
+  async function printApiStatus() {
+    let info = null;
+    try {
+      info = credentials === undefined ? null : await credentials.describe(API_KEY_REF);
+    } catch {}
+    const keyState = info?.configured
+      ? `configured (source: ${info.source}${info.writable === false ? ", read-only" : ""})`
+      : "not configured";
+    out(paint(ansi.bold, "  API configuration") + "\n");
+    out(`  key:     ${sanitize(keyState)}\n`);
+    out(`  base:    ${sanitize(await apiBaseUrl())}\n`);
+    out(paint(ansi.dim, `  credentials file: ${join(resolveDshHome(), ".credentials.yaml")}`) + "\n");
+    out(paint(ansi.dim, `  settings file:    ${join(resolveDshHome(), "settings.yaml")}`) + "\n");
+  }
+
+  async function storeApiKey(raw) {
+    const key = String(raw).trim();
+    if (key === "") {
+      out(paint(ansi.yellow, "  empty key — nothing stored\n"));
+      return false;
+    }
+    if (/\s/.test(key)) {
+      out(paint(ansi.red, "  API key must not contain whitespace\n"));
+      return false;
+    }
+    if (credentials === undefined) {
+      out(paint(ansi.yellow, "  this profile has no credential store\n"));
+      return false;
+    }
+    try {
+      await credentials.set(API_KEY_REF, key);
+      out(paint(ansi.green, `  ✓ API key saved to ${sanitize(join(resolveDshHome(), ".credentials.yaml"))}\n`));
+      out(paint(ansi.dim, "  new requests use it immediately\n"));
+      return true;
+    } catch (error) {
+      out(paint(ansi.red, `  ✘ ${sanitize(describeError(error))}\n`));
+      return false;
+    }
+  }
+
+  async function storeBaseUrl(raw) {
+    const url = String(raw).trim();
+    if (!/^https?:\/\//i.test(url)) {
+      out(paint(ansi.red, "  base URL must start with http:// or https://\n"));
+      return false;
+    }
+    if (settings === undefined) {
+      out(paint(ansi.yellow, "  this profile has no settings service\n"));
+      return false;
+    }
+    try {
+      await settings.update("llm-deepseek", { baseURL: url });
+      out(paint(ansi.green, `  ✓ base URL saved: ${sanitize(url)}\n`));
+      return true;
+    } catch (error) {
+      out(paint(ansi.red, `  ✘ ${sanitize(describeError(error))}\n`));
+      return false;
+    }
+  }
+
+  function askSecret(prompt) {
+    return editor ? editor.askSecret(prompt) : ask(prompt);
+  }
+
   /** Adapter-owned reasoning levels for the selected model, when exposed. */
   async function reasoningInfo() {
     try {
@@ -1391,6 +1486,69 @@ async function run(ctx, options, exit) {
           } catch {}
           continue;
         }
+        case "/api": {
+          const trimmed = argument.trim();
+          if (trimmed === "") {
+            if (!editor) {
+              await printApiStatus();
+              continue;
+            }
+            const action = await selectOption(
+              "API configuration",
+              [
+                { label: "Show status", description: "key, base URL, files", value: "status" },
+                { label: "Set DeepSeek API key", description: "saved to $DSH_HOME/.credentials.yaml", value: "key" },
+                { label: "Set base URL", description: "saved to $DSH_HOME/settings.yaml", value: "url" },
+                { label: "Remove stored API key", description: "falls back to environment", value: "unset" },
+              ],
+              0
+            );
+            if (action === "status") await printApiStatus();
+            else if (action === "key") {
+              const key = await askSecret(paint(ansi.green, "  API key: "));
+              if (key !== null) await storeApiKey(key);
+            } else if (action === "url") {
+              const url = await ask(paint(ansi.green, "  Base URL: "));
+              if (url !== null) await storeBaseUrl(url);
+            } else if (action === "unset") {
+              try {
+                await credentials?.unset(API_KEY_REF);
+                out(paint(ansi.green, "  ✓ stored API key removed\n"));
+              } catch (error) {
+                out(paint(ansi.red, `  ✘ ${sanitize(describeError(error))}\n`));
+              }
+            }
+            continue;
+          }
+          const [subcommand, ...rest] = trimmed.split(/\s+/);
+          const value = rest.join(" ").trim();
+          if (subcommand === "status" || subcommand === "show") {
+            await printApiStatus();
+            continue;
+          }
+          if (subcommand === "unset" || subcommand === "remove" || subcommand === "clear") {
+            try {
+              await credentials?.unset(API_KEY_REF);
+              out(paint(ansi.green, "  ✓ stored API key removed\n"));
+            } catch (error) {
+              out(paint(ansi.red, `  ✘ ${sanitize(describeError(error))}\n`));
+            }
+            continue;
+          }
+          if (subcommand === "url" || subcommand === "base" || subcommand === "base-url") {
+            if (value === "") out(paint(ansi.yellow, "  usage: /api url <https://endpoint>\n"));
+            else await storeBaseUrl(value);
+            continue;
+          }
+          if (subcommand === "set" || subcommand === "key") {
+            if (value === "") out(paint(ansi.yellow, "  usage: /api set <key>\n"));
+            else await storeApiKey(value);
+            continue;
+          }
+          // Bare value: treat it as the API key.
+          await storeApiKey(trimmed);
+          continue;
+        }
         case "/model": {
           if (argument !== "") {
             await applyModelSelection(argument);