dsh-qoder-connect 0.1.8 → 0.2.0

package/lib/{variants-DE76gF0Y.js → variants-DuEgaUad.js}

@@ -362,6 +362,15 @@ function qoderOwnAuthPath(variant) {
 /** Plugin-owned status endpoint consumed by its browser half. */
 const QODER_STATUS_PATH = "/plugins/dsh-qoder-connect/status";
 /**
+* Plugin-owned settings endpoint consumed by its browser half.
+*
+* GET answers the whole entry configuration as three layers (value/base/user)
+* plus the write key; POST applies one patch. This is the plugin's own settings
+* surface, replacing writes through the host's settings service — see
+* {@link ./settings-store.ts} for why.
+*/
+const QODER_SETTINGS_FACE_PATH = "/plugins/dsh-qoder-connect/settings";
+/**
 * Plugin-owned probe control endpoint.
 *
 * Separate from the status route because it accepts writes: the status route's
@@ -844,6 +853,125 @@ async function probeModel(options) {
 	};
 }
 //#endregion
+//#region src/qoder/errors.ts
+/**
+* DSH-compatible LLM error representation.
+*
+* @module dsh-provider-qoder/qoder/errors
+*/
+var QoderLlmError = class extends LlmError {
+	constructor(message, code = "UNKNOWN_ERROR", options) {
+		super(message, code, options);
+	}
+};
+/** The queue/limit markers Qoder puts in a rejection body (observed 2026-09-26). */
+const QUEUE_BODY_MARKERS = [
+	/"code"\s*:\s*"?10605"?/u,
+	/"isQueued"\s*:\s*true/u,
+	/"queueCount"/u,
+	/"serviceAvailable"\s*:\s*false/u
+];
+/**
+* Whether an upstream rejection body is Qoder's **queue/limit** answer rather
+* than an authorization failure.
+*
+* Qoder answers a saturated per-model queue (and a region whose service is not
+* available) with an HTTP 401/403 — or a 200 SSE envelope carrying
+* `statusCodeValue: 403` — whose body says `code: 10605`, `isQueued: true`,
+* `queueCount`, `retryAfterSeconds` and sometimes `serviceAvailable: false`.
+* Observed verbatim on 2026-09-26:
+*
+*     {"code":"10605","message":"{\"isQueued\":true,\"modelKey\":\"qfmodel\",
+*      \"queueCount\":8887,\"queueType\":\"p3\",\"retryAfterSeconds\":30,
+*      \"serviceAvailable\":true,\"waitTime\":274}"}
+*
+* Reading that status as AUTH made the self-heal exchange fresh job tokens
+* against a queue no token can jump, and — because the host retries
+* `RATE_LIMIT` but deliberately not `AUTH` — it also suppressed the automatic
+* retry that would have sailed through the 30-second window. The body is the
+* only place the distinction is visible, so it gets the last say over status.
+*/
+function qoderQueueSignal(body) {
+	if (body === void 0 || body === "") return void 0;
+	const text = body.replace(/\\/gu, "");
+	if (!QUEUE_BODY_MARKERS.some((marker) => marker.test(text))) return void 0;
+	const match = /"retryAfterSeconds"\s*:\s*(\d+)/u.exec(text);
+	return match === null ? {} : { retryAfterMs: Number(match[1]) * 1e3 };
+}
+/**
+* Replace status digits that read as authorization failure with a neutral
+* word, for messages the upstream used to announce a queue.
+*
+* `dsh-llm-pi-ai`'s error classifier is a text matcher whose first test is
+* `/\b(?:401|403)\b/` — ahead of its 429/rate-limit test — so any message
+* carrying those digits classifies AUTH no matter the structured code
+* travelling beside it. A queue answer quoting the upstream's 403 (in the
+* message prefix, the envelope status, or the body's `"code":"403"`) must not
+* reach that matcher as-is, or the user sees "API 密钥无效" for a throttle
+* (observed verbatim on 2026-09-26 23:30 and again at 23:40).
+*/
+function deauthorizeDigits(message) {
+	return message.replace(/\b(?:401|403)\b/gu, "throttled");
+}
+function qoderHttpError(message, response, body) {
+	const { status } = response;
+	const headerRetryAfterMs = retryAfterMs(response.headers?.get("retry-after") ?? null);
+	const requestId = qoderRequestId(response.headers);
+	const queue = status === 401 || status === 403 || status === 429 ? qoderQueueSignal(body ?? message) : void 0;
+	if (queue !== void 0) {
+		const retryAfterMs = queue.retryAfterMs ?? headerRetryAfterMs;
+		return new QoderLlmError(deauthorizeDigits(message), "RATE_LIMIT", {
+			status,
+			...retryAfterMs === void 0 ? {} : { providerRetryAfterMs: retryAfterMs },
+			...requestId === void 0 ? {} : { requestId }
+		});
+	}
+	return new QoderLlmError(message, status === 401 || status === 403 ? "AUTH" : status === 408 ? "TIMEOUT" : status === 429 ? "RATE_LIMIT" : status >= 500 && status <= 599 ? "SERVER" : status >= 400 && status <= 499 ? "INVALID_REQUEST" : "PROVIDER_ERROR", {
+		status,
+		...headerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs: headerRetryAfterMs },
+		...requestId === void 0 ? {} : { requestId }
+	});
+}
+function qoderRequestId(headers) {
+	const normalized = (headers?.get("x-request-id") ?? headers?.get("request-id") ?? headers?.get("x-amzn-requestid"))?.trim();
+	return normalized ? ProviderRequestId(normalized) : void 0;
+}
+/**
+* Whether this failure is an upstream authorization rejection worth one
+* re-auth retry.
+*
+* The job token the transport signs requests with is cached in memory; an
+* upstream that invalidates it mid-lifetime (gateway rotation or a fault
+* window) answers HTTP 401/403 before any payload is produced. That state is
+* distinguishable from a genuinely revoked PAT only by trying a fresh
+* exchange, so callers clear their credential cache and retry once before
+* reporting `AUTH` to the user.
+*
+* A `RATE_LIMIT` code is never a re-auth candidate, **even when its status is
+* 401/403**: that is the upstream's queue answer (code 10605 / isQueued /
+* retryAfterSeconds in the body), which keeps the status but says the
+* credential was not the problem. Healing it exchanged job tokens against a
+* queue no token can jump (observed 2026-09-26) and, by consuming the retry,
+* suppressed the rate-limit retry that would have ridden out the window.
+*/
+function isQoderAuthRejection(error) {
+	if (!(error instanceof LlmError)) return false;
+	if (error.code === "RATE_LIMIT") return false;
+	return error.code === "AUTH" || error.failure.status === 401 || error.failure.status === 403;
+}
+function retryAfterMs(value, nowMs = Date.now()) {
+	const normalized = value?.trim();
+	if (!normalized) return void 0;
+	if (/^\d+$/u.test(normalized)) {
+		const delayMs = Number(normalized) * 1e3;
+		return Number.isFinite(delayMs) && delayMs > 0 ? delayMs : void 0;
+	}
+	const retryAt = Date.parse(normalized);
+	if (Number.isNaN(retryAt)) return void 0;
+	const delayMs = retryAt - nowMs;
+	return delayMs > 0 ? delayMs : void 0;
+}
+//#endregion
 //#region src/qoder/transport/endpoints.ts
 const qoderRegionEndpoints = {
 	global: {
@@ -906,59 +1034,6 @@ function getQoderClaimCampaignUrl(region = "global", campaignId) {
 	return `${openApiUrl}/sash/api/v1/me/campaigns/${encodeURIComponent(campaignId)}/claim`;
 }
 //#endregion
-//#region src/qoder/errors.ts
-/**
-* DSH-compatible LLM error representation.
-*
-* @module dsh-provider-qoder/qoder/errors
-*/
-var QoderLlmError = class extends LlmError {
-	constructor(message, code = "UNKNOWN_ERROR", options) {
-		super(message, code, options);
-	}
-};
-function qoderHttpError(message, response) {
-	const { status } = response;
-	const code = status === 401 || status === 403 ? "AUTH" : status === 408 ? "TIMEOUT" : status === 429 ? "RATE_LIMIT" : status >= 500 && status <= 599 ? "SERVER" : status >= 400 && status <= 499 ? "INVALID_REQUEST" : "PROVIDER_ERROR";
-	const providerRetryAfterMs = retryAfterMs(response.headers?.get("retry-after") ?? null);
-	const requestId = qoderRequestId(response.headers);
-	return new QoderLlmError(message, code, {
-		status,
-		...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs },
-		...requestId === void 0 ? {} : { requestId }
-	});
-}
-function qoderRequestId(headers) {
-	const normalized = (headers?.get("x-request-id") ?? headers?.get("request-id") ?? headers?.get("x-amzn-requestid"))?.trim();
-	return normalized ? ProviderRequestId(normalized) : void 0;
-}
-/**
-* Whether this failure is an upstream authorization rejection worth one
-* re-auth retry.
-*
-* The job token the transport signs requests with is cached in memory; an
-* upstream that invalidates it mid-lifetime (gateway rotation or a fault
-* window) answers HTTP 401/403 before any payload is produced. That state is
-* distinguishable from a genuinely revoked PAT only by trying a fresh
-* exchange, so callers clear their credential cache and retry once before
-* reporting `AUTH` to the user.
-*/
-function isQoderAuthRejection(error) {
-	return error instanceof LlmError && (error.code === "AUTH" || error.failure.status === 401 || error.failure.status === 403);
-}
-function retryAfterMs(value, nowMs = Date.now()) {
-	const normalized = value?.trim();
-	if (!normalized) return void 0;
-	if (/^\d+$/u.test(normalized)) {
-		const delayMs = Number(normalized) * 1e3;
-		return Number.isFinite(delayMs) && delayMs > 0 ? delayMs : void 0;
-	}
-	const retryAt = Date.parse(normalized);
-	if (Number.isNaN(retryAt)) return void 0;
-	const delayMs = retryAt - nowMs;
-	return delayMs > 0 ? delayMs : void 0;
-}
-//#endregion
 //#region src/qoder/transport/machine-id.ts
 function defaultMachineIdPaths() {
 	return [join(homedir(), ".qoder", ".auth", "machine_id"), join(homedir(), ".dsh", "qoder", "machine_id")];
@@ -1285,7 +1360,7 @@ async function openApiJsonRequest(fetchImpl, options) {
 		const text = await readLimitedText(response, response.ok ? defaultMaxJsonBytes : defaultMaxErrorBytes, `Qoder ${options.operation} response`);
 		if (!response.ok) {
 			options.logger?.error?.(`[Qoder ${options.operation}] Request failed`, redactLogPayload(text));
-			throw qoderHttpError(`Failed to execute Qoder ${options.operation} with status ${response.status}.`, response);
+			throw qoderHttpError(`Failed to execute Qoder ${options.operation} with status ${response.status}.`, response, text);
 		}
 		let data;
 		try {
@@ -1323,6 +1398,14 @@ async function waitForFlight(promise, signal) {
 var QoderAuthService = class {
 	cache = /* @__PURE__ */ new Map();
 	inFlight = /* @__PURE__ */ new Map();
+	/**
+	* Self-heal exchanges in flight, keyed like the cache. Deliberately separate
+	* from {@link inFlight}: that flight may be aborted by a departing
+	* concurrent waiter (a quota poll, a catalog sweep) whose abort has nothing
+	* to do with the heal, so healers must not share its controller. Concurrent
+	* heals instead share this flight — see {@link exchangeFresh}.
+	*/
+	healFlights = /* @__PURE__ */ new Map();
 	fetchImpl;
 	timeoutMs;
 	resolveMachineId;
@@ -1345,10 +1428,31 @@ var QoderAuthService = class {
 	* (the quota poll, the catalog sweep), and a retry that joins it would then
 	* be cancelled by a path that has nothing to do with the chat. The result
 	* replaces the cache entry.
+	*
+	* Two heals for the same credential that overlap share one exchange instead
+	* of racing: each racer's `clear` deleted what the previous one had just
+	* cached, and its own `cache.set` overwrote the other's — so the cache could
+	* end up naming a token the losing request was no longer using, and with an
+	* upstream that retires the previous job token on a new exchange the racers
+	* also invalidated each other's credentials (one chat recovering while a
+	* concurrent one failed, exactly the 2026-09-26 22:36 observation). The
+	* shared exchange runs on its own timeout signal, so one healer's abort —
+	* its chat request went away — cannot cancel an exchange other healers, and
+	* the future `getCredentials` callers about to read the refreshed cache, are
+	* waiting on.
 	*/
 	async exchangeFresh(pat, signal) {
+		const cacheKey = `${this.region}:${opaqueCredentialKey(pat)}`;
+		const existing = this.healFlights.get(cacheKey);
+		if (existing !== void 0 && !existing.settled) return waitForFlight(existing.promise, signal);
 		this.clear(pat);
-		return await this.exchangeAndResolve(pat, signal ?? AbortSignal.timeout(this.timeoutMs));
+		const created = { settled: false };
+		created.promise = this.exchangeAndResolve(pat, AbortSignal.timeout(this.timeoutMs)).finally(() => {
+			created.settled = true;
+			if (this.healFlights.get(cacheKey) === created) this.healFlights.delete(cacheKey);
+		});
+		this.healFlights.set(cacheKey, created);
+		return waitForFlight(created.promise, signal);
 	}
 	async getCredentials(pat, signal) {
 		if (!pat || typeof pat !== "string") throw new QoderLlmError("Qoder Personal Access Token is missing or invalid. Configure Qoder in the Qoder settings page.", "MISSING_CREDENTIAL");
@@ -2784,7 +2888,7 @@ function parseEnvelope(rawData) {
 	if (envelope.statusCodeValue !== void 0 && (!Number.isInteger(envelope.statusCodeValue) || envelope.statusCodeValue < 100 || envelope.statusCodeValue > 599)) throw malformed("Qoder SSE envelope has an invalid status code.");
 	if (envelope.statusCodeValue !== void 0 && envelope.statusCodeValue !== 200) {
 		const status = envelope.statusCodeValue;
-		throw qoderHttpError(envelope.body ? `Qoder service returned upstream error status ${status}: ${envelope.body}` : `Qoder service returned upstream error status ${status}.`, { status });
+		throw qoderHttpError(envelope.body ? `Qoder service returned upstream error status ${status}: ${envelope.body}` : `Qoder service returned upstream error status ${status}.`, { status }, envelope.body);
 	}
 	if (envelope.body !== void 0 && typeof envelope.body !== "string") throw malformed("Qoder SSE envelope has an invalid model body.");
 	return envelope;
@@ -3119,7 +3223,15 @@ async function* streamQoderChat(options, model, credentials, messages, dependenc
 			...reqId === void 0 ? {} : { requestId: reqId }
 		});
 		resetIdleTimer();
-		if (!response.ok) throw qoderHttpError(`Qoder upstream service returned HTTP ${response.status}.`, response);
+		if (!response.ok) {
+			let errorBody;
+			try {
+				errorBody = await readLimitedText(response, defaultMaxErrorBytes, "Qoder chat error response");
+			} catch {
+				errorBody = void 0;
+			}
+			throw qoderHttpError(`Qoder upstream service returned HTTP ${response.status}.`, response, errorBody);
+		}
 		if (!response.body) throw new QoderLlmError("Qoder response contains no readable body stream.", "EMPTY_RESPONSE");
 		let firstChunkDurationMs;
 		let tokenUsage;
@@ -3407,9 +3519,11 @@ var DefaultQoderTransport = class {
 			this.logger?.warn?.("[Qoder Stream] Chat rejected as unauthorized; exchanging a fresh job token and retrying once", { status: error.failure.status });
 		}
 		let lastRejection;
+		let noticeAt;
 		for (let round = 0; round < 2; round++) {
 			const refreshed = await this.auth.exchangeFresh(pat, options.signal);
 			this.pendingRefreshAt = Date.now();
+			noticeAt = this.pendingRefreshAt;
 			try {
 				yield* this.streamChat(options, model, refreshed, messages, () => {
 					this.onChatAccepted();
@@ -3433,7 +3547,7 @@ var DefaultQoderTransport = class {
 				}
 			}
 		}
-		this.discardPendingRefreshNotice();
+		if (this.pendingRefreshAt === noticeAt) this.discardPendingRefreshNotice();
 		if (!this.refreshFailureAnnounced) {
 			this.refreshFailureAnnounced = true;
 			this.logger?.warn?.("[Qoder Stream] Job token refresh did not recover the chat; the upstream still rejects it", { status: lastRejection instanceof LlmError ? lastRejection.failure.status : void 0 });
@@ -3509,6 +3623,7 @@ function normalizeCredits(credits) {
 */
 function classifyUpstreamError(status, body) {
 	const lower = body.toLowerCase();
+	if (qoderQueueSignal(body) !== void 0) return "soft_rate";
 	if (status === 402) return "quota_exceeded";
 	if (status === 429) return "soft_rate";
 	if (status === 401 || status === 403) return "auth";
@@ -3542,11 +3657,18 @@ function classifyUpstreamError(status, body) {
 * The transport's taxonomy (`src/qoder/errors.ts`) codes an HTTP 402 as
 * `INVALID_REQUEST`, so the status gets the last say for the quota and auth
 * families before the code-based defaults apply.
+*
+* `RATE_LIMIT` is tested before the auth family because the upstream's queue
+* answer keeps its 401/403 status: a saturated qfmodel queue reads
+* `code: RATE_LIMIT, status: 403` (body carries 10605/isQueued/
+* retryAfterSeconds), and letting the status arm claim it reported a dead
+* credential — which the host never retries — instead of a throttle it would.
 */
 function kindFromQoderFailure(failure) {
 	if (failure.code === "MISSING_CREDENTIAL") return "missing_credential";
+	if (failure.code === "RATE_LIMIT") return "soft_rate";
 	if (failure.code === "AUTH" || failure.status === 401 || failure.status === 403) return "auth";
-	if (failure.code === "RATE_LIMIT" || failure.status === 429) return "soft_rate";
+	if (failure.status === 429) return "soft_rate";
 	if (failure.code === "QUOTA" || failure.status === 402) return "quota_exceeded";
 	if (failure.code.startsWith("INVALID_") || failure.code.startsWith("UNSUPPORTED_") || failure.code === "ATTACHMENT") return "client";
 	return "server";
@@ -4266,7 +4388,7 @@ const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_CONTEXT_WINDOW = 18e4;
 //#endregion
 //#region src/version.ts
-const QODER_CONNECT_VERSION = "0.1.8";
+const QODER_CONNECT_VERSION = "0.2.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -4463,4 +4585,4 @@ function variantFor(id) {
 	return QODER_VARIANTS.find((variant) => variant.id === id);
 }
 //#endregion
-export { QODER_GLOBAL_AUTH_PATH as A, qoderCredentialIdentity as B, probeModel as C, FALLBACK_QODER_MODELS as D, qoderCatalogPath as E, QODER_AUTH_FILENAME as F, qoderPluginDataDir as G, QODER_DATA_DIR_ENV as H, QODER_PAT_ENV_CN as I, qoderStateDir as K, QODER_PAT_ENV_GLOBAL as L, QODER_GLOBAL_STATUS_PATH as M, QODER_PROBE_PATH as N, QoderCatalog as O, QODER_STATUS_PATH as P, QoderCredentialStore as R, PROBE_EFFORT_CANDIDATES as S, QoderCatalogStore as T, QODER_DATA_DIR_NAME as U, qoderOwnAuthPath as V, qoderMachineIdPath as W, modelInfoOf as _, QODER_HOST_HEARTBEAT_FILENAME as a, createQoderTransport as b, processStartTimeMs as c, writeHostHeartbeat as d, QODER_CONNECT_VERSION as f, kindFromQoderFailure as g, classifyUpstreamError as h, variantFor as i, QODER_GLOBAL_PROBE_PATH as j, QODER_AUTH_PATH as k, qoderHostHeartbeatPath as l, QoderUpstreamClient as m, GLOBAL_VARIANT as n, clearHostHeartbeat as o, KIND_STATUS as p, QODER_VARIANTS as r, isHeartbeatProcessAlive as s, CHINA_VARIANT as t, readHostHeartbeat as u, normalizeCredits as v, randomSentinel as w, getMachineId as x, validateApiKey as y, patTail as z };
+export { QODER_GLOBAL_AUTH_PATH as A, patTail as B, probeModel as C, FALLBACK_QODER_MODELS as D, qoderCatalogPath as E, QODER_STATUS_PATH as F, qoderMachineIdPath as G, qoderOwnAuthPath as H, QODER_AUTH_FILENAME as I, qoderPluginDataDir as K, QODER_PAT_ENV_CN as L, QODER_GLOBAL_STATUS_PATH as M, QODER_PROBE_PATH as N, QoderCatalog as O, QODER_SETTINGS_FACE_PATH as P, QODER_PAT_ENV_GLOBAL as R, PROBE_EFFORT_CANDIDATES as S, QoderCatalogStore as T, QODER_DATA_DIR_ENV as U, qoderCredentialIdentity as V, QODER_DATA_DIR_NAME as W, modelInfoOf as _, QODER_HOST_HEARTBEAT_FILENAME as a, createQoderTransport as b, processStartTimeMs as c, writeHostHeartbeat as d, QODER_CONNECT_VERSION as f, kindFromQoderFailure as g, classifyUpstreamError as h, variantFor as i, QODER_GLOBAL_PROBE_PATH as j, QODER_AUTH_PATH as k, qoderHostHeartbeatPath as l, QoderUpstreamClient as m, GLOBAL_VARIANT as n, clearHostHeartbeat as o, KIND_STATUS as p, qoderStateDir as q, QODER_VARIANTS as r, isHeartbeatProcessAlive as s, CHINA_VARIANT as t, readHostHeartbeat as u, normalizeCredits as v, randomSentinel as w, getMachineId as x, validateApiKey as y, QoderCredentialStore as z };

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Qoder Connector",
+    "description": "Connect Qoder CLI's model service: per-region model toggles, context windows, quota lookup, and daily check-in."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Qoder 连接器",
+    "description": "接入 Qoder CLI 的模型服务：双区域模型开关、上下文窗口、额度查询与每日签到。"
+  }
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-qoder-connect",
   "displayName": "DSH Qoder Connect",
   "description": "将 Qoder（国内版 / 国际版）的模型接入 DeepSeek Harness — bring Qoder (CN & international) models into DeepSeek Harness.",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",
@@ -13,6 +13,7 @@
   ],
   "type": "module",
   "engines": {
+    "dsh": ">=0.1.5-rc.2",
     "node": "^22.19.0 || >=24.0.0"
   },
   "main": "lib/index.js",
@@ -35,7 +36,8 @@
     },
     "./client": "./lib/client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "files": [
     "lib",
@@ -43,7 +45,8 @@
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
-    "LICENSE"
+    "LICENSE",
+    "locale/*.json"
   ],
   "license": "MIT",
   "repository": {
@@ -112,5 +115,9 @@
     "tsdown": "^0.22.2",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8"
-  }
+  },
+  "dependencies": {
+    "js-yaml": "^4.1.0"
+  },
+  "icon": "./assets/icon.svg"
 }