dsh-cline-pass 0.2.7 → 0.2.9

package/lib/protocol.js

@@ -19,7 +19,7 @@
  * log instead, which turns "did the patched code actually load?" into a
  * question with an answer.
  */
-export const BUILD_TAG = 'dshfix-3'
+export const BUILD_TAG = 'dshfix-4'
 
 /**
  * The gateway wraps some answers in a `{ data: … }` envelope; unwrap it.
@@ -45,6 +45,12 @@ export function errorText(value) {
   }
 }
 
+/** Account authentication refusals, including responses with no useful body. */
+export function isAuthenticationError(message, status) {
+  const detail = String(message ?? '').replace(/[_-]/g, ' ')
+  return status === 401 || status === 403 || /unauthorized|re\s*authenticate|invalid\s*(?:api\s*key|token)|\b401\b|\b403\b/i.test(detail)
+}
+
 /**
  * Read the routing facts out of one completed gateway response.
  * @param json - raw decoded response body (enveloped or not).
@@ -181,11 +187,12 @@ export function injectPrefs(body, meta, attempt) {
   // Normalized here as well as in buildAttempts: this function is exported, so
   // a caller can hand it an attempt straight from configuration.
   const sort = normalizeSort(attempt?.sort)
-  const excluded = excludeList.filter((name) => name !== upstream)
+  const excluded = excludeList.filter((name) => normalizeSlug(name) !== normalizeSlug(upstream ?? ''))
+  const excludedIds = new Set(excluded.map(normalizeSlug))
   // Each spelling is written in the vocabulary its own router understands.
   const spell = (names, pipeline) => names.map((name) => channelNameFor(name, pipeline))
-  const gatewayAllow = excluded.length > 0 ? knownChannels(meta, 'planner').filter((name) => !excluded.includes(name)) : null
-  const openRouterAllow = excluded.length > 0 ? knownChannels(meta, 'direct').filter((name) => !excluded.includes(name)) : null
+  const gatewayAllow = excluded.length > 0 ? knownChannels(meta, 'planner').filter((name) => !excludedIds.has(normalizeSlug(name))) : null
+  const openRouterAllow = excluded.length > 0 ? knownChannels(meta, 'direct').filter((name) => !excludedIds.has(normalizeSlug(name))) : null
   const pipeline = meta?.pipeline ?? null
   const both = attempt?.spelling !== 'detected'
   const useGateway = both || pipeline === 'planner' || pipeline === null
@@ -278,13 +285,14 @@ export function isAdherenceOk(adherence) {
  */
 export function pinWarnings(attempt, meta) {
   const upstream = attempt?.upstream ?? null
-  const excluded = (attempt?.excludeList ?? []).filter((name) => name !== upstream)
+  const excluded = (attempt?.excludeList ?? []).filter((name) => normalizeSlug(name) !== normalizeSlug(upstream ?? ''))
+  const excludedIds = new Set(excluded.map(normalizeSlug))
   if (excluded.length === 0) return []
   const known = Array.isArray(meta?.upstreams) ? meta.upstreams : []
   if (known.length === 0) {
     return [`excludeUnresolved: this model has no channel list yet, so ${excluded.join(', ')} could not be compiled into an allow-list — run cline_pass_probe for it`]
   }
-  const remaining = known.filter((name) => !excluded.includes(name))
+  const remaining = known.filter((name) => !excludedIds.has(normalizeSlug(name)))
   if (remaining.length === 0 && upstream === null) {
     return [`PIN_UNRESOLVED: every known channel is excluded (${known.join(', ')}), so the request falls back to the gateway's own routing`]
   }
@@ -304,8 +312,8 @@ export function pinWarnings(attempt, meta) {
 export function buildAttempts(config) {
   const listed = (config?.upstreams ?? []).filter((name) => typeof name === 'string' && name.length > 0)
   const exclude = (config?.exclude ?? []).filter((name) => typeof name === 'string' && name.length > 0)
-  const excluded = new Set(exclude)
-  const wanted = listed.filter((name) => !excluded.has(name))
+  const excluded = new Set(exclude.map(normalizeSlug))
+  const wanted = listed.filter((name) => !excluded.has(normalizeSlug(name)))
   const strict = normalizePinMode(config?.pinMode) === 'strict'
   const sort = normalizeSort(config?.sort)
   const base = { strict, sort, excludeList: exclude }
@@ -332,7 +340,7 @@ export function classifyUpstreamError(message) {
   if (/empty response content/i.test(text)) return 'ok'
   if (/429|rate-?limited|temporarily rate/i.test(text)) return 'limited'
   if (/invalid_request|modelid|no allowed providers|no available providers|not found|unsupported/i.test(text)) return 'bad'
-  if (/unauthorized|re-authenticate|401/i.test(text)) return 'auth'
+  if (isAuthenticationError(text)) return 'auth'
   return 'unknown'
 }
 

package/lib/store.js

@@ -26,6 +26,7 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
   const models = new Map()
   /** @type {object[]} newest first */
   const history = []
+  let historyRevision = 0
   let catalog = { ids: [], sources: [], fetchedAt: 0 }
   /** Last quota reading, one entry per enabled account. */
   let usage = { ok: false, accounts: [], fetchedAt: 0 }
@@ -55,10 +56,10 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
       models.set(model, next)
       return next
     },
-    /** Record one upstream's availability verdict; an inconclusive one is dropped. */
-    learnUpstream(model, upstream, status, note, ms) {
+    /** Record a verdict; explicit validation also replaces stale results with unknown. */
+    learnUpstream(model, upstream, status, note, ms, { includeUnknown = false } = {}) {
       if (upstream === undefined || upstream === null || upstream === '') return
-      if (status === 'unknown') return
+      if (status === 'unknown' && !includeUnknown) return
       const current = models.get(model) ?? {}
       models.set(model, {
         ...current,
@@ -67,6 +68,7 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
     },
     /** Append one request-history row (newest first, bounded). */
     record(entry) {
+      historyRevision += 1
       history.unshift({ ts: Date.now(), ...entry })
       if (history.length > historyLimit) history.length = historyLimit
     },
@@ -85,6 +87,10 @@ export function createStore({ historyLimit = DEFAULT_HISTORY_LIMIT } = {}) {
     historySize() {
       return history.length
     },
+    /** Monotonic change counter, including replacements at the retention cap. */
+    historyRevision() {
+      return historyRevision
+    },
     /** The last cached official-catalog scan. */
     catalog() {
       return catalog

package/lib/tools.js

@@ -7,6 +7,7 @@
  * @module dsh-cline-pass/tools
  */
 import { defineTool } from '@deepseek-ai/dsh-tools'
+import { accountProfileFor } from './accounts.js'
 import { BUILD_TAG, normalizePinMode, pinWarnings } from './protocol.js'
 
 /** One model-facing text block. */
@@ -625,6 +626,7 @@ export function registerTools(ctx, { control, engine, store }) {
       apiKeyEnv: { type: 'string', description: 'Credential name holding this account key.' },
       displayName: { type: 'string', description: 'Human-readable label.' },
       enabled: { type: 'boolean', description: 'Whether the account takes part in routing.' },
+      baseURL: { type: 'string', description: 'Override the gateway address for this account; empty uses the provider address.' },
       mode: { type: 'string', enum: ['single', 'roundrobin'], description: 'Pool mode.' },
       active: { type: 'string', description: 'Account key used in single mode.' },
       accounts: {
@@ -638,6 +640,7 @@ export function registerTools(ctx, { control, engine, store }) {
             apiKeyEnv: { type: 'string' },
             displayName: { type: 'string' },
             enabled: { type: 'boolean' },
+            baseURL: { type: 'string' },
             key: { type: 'string' },
           },
         },
@@ -667,21 +670,22 @@ export function registerTools(ctx, { control, engine, store }) {
     async execute(args, exec) {
       const action = String(args.action)
       let note = ''
+      let ok = true
       const nameOf = (value) => String(value ?? '').trim()
       if (action === 'test') {
         let key = String(args.key ?? '').trim()
         let label = args.name === undefined ? '(supplied key)' : nameOf(args.name)
-        let baseURL = readConfig().baseURL
+        const account = args.name === undefined ? undefined : control.accounts().find((entry) => entry.key === nameOf(args.name))
+        if (args.name !== undefined && account === undefined) throw new Error(`no account named ${JSON.stringify(nameOf(args.name))}`)
+        const baseURL = account?.baseURL || readConfig().baseURL
         if (key === '') {
           if (args.name === undefined) throw new Error('cline_pass_accounts action="test" needs `key` or an existing `name`')
-          const account = control.accounts().find((entry) => entry.key === nameOf(args.name))
-          if (account === undefined) throw new Error(`no account named ${JSON.stringify(nameOf(args.name))}`)
           key = await control.readCredential(account.apiKeyEnv)
           if (key === '') throw new Error(`account ${JSON.stringify(account.key)} has no stored key at ${account.apiKeyEnv}; store one with action="add" key=… or through the dsh Models page`)
-          baseURL = account.baseURL || baseURL
         }
         const model = (readConfig().knownModels ?? [])[0] ?? 'cline-pass/glm-5.3-flash'
         const result = await engine.testAccount({ key, baseURL, model, signal: exec.signal })
+        ok = result.authorized === true
         note = result.authorized
           ? `key for ${label} authorized in ${result.ms}ms`
           : `key for ${label} FAILED: ${firstLine(result.error, 200)}`
@@ -693,18 +697,20 @@ export function registerTools(ctx, { control, engine, store }) {
           const next = {}
           for (const [index, entry] of args.accounts.entries()) {
             const key = nameOf(entry?.name) || `account-${index + 1}`
-            next[key] = {
-              displayName: String(entry?.displayName ?? key),
-              apiKeyEnv: String(entry?.apiKeyEnv ?? `CLINE_PASS_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_KEY`),
-              enabled: entry?.enabled !== false,
-              baseURL: '',
-            }
+            if (Object.hasOwn(next, key)) throw new Error(`duplicate account name ${JSON.stringify(key)}`)
+            next[key] = accountProfileFor(key, entry, { ...accounts, ...next }, config.apiKeyEnv)
+          }
+          // Validate every entry before any credential or configuration write.
+          for (const [index, entry] of args.accounts.entries()) {
+            const key = nameOf(entry?.name) || `account-${index + 1}`
             if (typeof entry?.key === 'string' && entry.key.trim() !== '') {
               await control.setCredential(next[key].apiKeyEnv, entry.key.trim())
               note = `stored the key for ${key} in the credential store`
             }
           }
-          await control.updateConfig({ accounts: next })
+          const removals = Object.keys(accounts).filter((key) => !Object.hasOwn(next, key)).map((key) => ['accounts', key])
+          const activeAccount = Object.hasOwn(next, String(config.activeAccount ?? '')) ? config.activeAccount : ''
+          await control.updateConfig({ accounts: next, activeAccount }, removals)
         } else if (action === 'add') {
           const key = nameOf(args.name)
           if (!/^[A-Za-z0-9._-]+$/.test(key)) throw new Error('cline_pass_accounts action="add" needs a `name` of letters, digits, dot, dash or underscore')
@@ -719,13 +725,9 @@ export function registerTools(ctx, { control, engine, store }) {
               baseURL: '',
             }
           }
-          const apiKeyEnv = String(args.apiKeyEnv ?? `CLINE_PASS_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_KEY`)
-          accounts[key] = {
-            displayName: String(args.displayName ?? key),
-            apiKeyEnv,
-            enabled: args.enabled !== false,
-            baseURL: '',
-          }
+          const profile = accountProfileFor(key, args, accounts, config.apiKeyEnv)
+          const apiKeyEnv = profile.apiKeyEnv
+          accounts[key] = profile
           await control.updateConfig({ accounts })
           if (typeof args.key === 'string' && args.key.trim() !== '') {
             await control.setCredential(apiKeyEnv, args.key.trim())
@@ -762,7 +764,7 @@ export function registerTools(ctx, { control, engine, store }) {
       }
       const config = readConfig()
       return {
-        ok: true,
+        ok,
         action,
         note,
         accountMode: config.accountMode === 'roundrobin' ? 'roundrobin' : 'single',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cline-pass",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Self-contained Cline Pass provider for dsh: register Cline Pass subscription models on the harness LLM seam, enumerate and validate the upstream channels behind each model, pin or exclude them with failover, and drive an account pool. No proxy process and no external cline-pass-switcher install required.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,7 +18,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node test/smoke.mjs && node test/client.mjs && node test/pin-adherence.mjs && node test/account-failover.mjs",
+    "test": "node test/smoke.mjs && node test/client.mjs && node test/pin-adherence.mjs && node test/account-failover.mjs && node test/review-regressions.mjs",
     "test:protocol": "node test/pin-adherence.mjs",
     "test:client": "node test/client.mjs",
     "test:mount": "node test/mount.mjs",