dsh-ssh-tui 0.7.4 → 0.8.0

package/lib/types/auth-failure.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Where an authentication failure came from.
+ *
+ * A turn can die with `code: "AUTH"` for two very different reasons, and the
+ * difference decides what the reader should do:
+ *
+ *  - **provider**: the request left the machine and the provider (or something
+ *    between it and the model) rejected it. The local credential is present, so
+ *    changing it is the wrong move — the usual causes are a transient upstream
+ *    failure, a plan/quota limit, or a model the account may not call. Retrying
+ *    is reasonable.
+ *  - **local**: nothing usable is configured on this machine, so every request
+ *    would fail the same way. Retrying changes nothing; the key has to be set.
+ *
+ * The host reports both as `AUTH`, and the only place the difference survives is
+ * the message body — which is why this is a text classifier and why it is kept
+ * pure: the caller resolves the actual credential and decides what to say.
+ *
+ * Observed bodies (2026-09-29, command-code):
+ *   provider → `OpenAI API error (403): {"message":"Authentication failed.
+ *               Please check your credentials.","type":"permission_error"}`
+ *   provider → `403 {"type":"error","error":{"type":"permission_error",
+ *               "message":"MODEL_NOT_IN_PLAN: …"}}`
+ *   local    → `dsh-llm: no API key for provider "x" (set X_API_KEY)`
+ * A *missing* credential on that gateway answered with a 401 and its own
+ * envelope (`{"success":false,"error":{"code":"UNAUTHORIZED"}}`), which is why
+ * an HTTP status alone cannot classify this: 401 and 403 both appear on the
+ * provider side.
+ *
+ * @module dsh-ssh-tui/auth-failure
+ */
+/** Which side rejected the request. */
+export type AuthFailureOrigin = 'provider' | 'local';
+export interface AuthFailure {
+    origin: AuthFailureOrigin;
+    /** The HTTP status, when the message carried one. */
+    status?: number;
+}
+/** The HTTP status inside a host-formatted failure, if there is one. */
+export declare function statusOf(message: string): number | undefined;
+/**
+ * Classify one failure message.
+ * @param message - the failure text the host attached to the turn.
+ * @returns the origin (and status when known), or undefined when the message
+ *   says nothing about authentication — an unrelated failure keeps its own row
+ *   and gets no advice.
+ */
+export declare function classifyAuthFailure(message: string): AuthFailure | undefined;

package/lib/types/commands.d.ts

@@ -39,6 +39,9 @@ export declare const LOCAL_COMMANDS: readonly [{
 }, {
     readonly name: "disconnect";
     readonly key: "cmd.disconnect";
+}, {
+    readonly name: "retryauth";
+    readonly key: "cmd.retryauth";
 }, {
     readonly name: "notify";
     readonly key: "cmd.notify";

package/lib/types/index.d.ts

@@ -46,6 +46,12 @@ export interface Config {
     autoApproval?: string;
     /** Milliseconds a leftover finished Host waits before exiting; 0 = never. */
     idleExit?: number;
+    /**
+     * Retry once when the *provider* rejects a request with 401/403 while a local
+     * credential is configured (see `auth-failure.ts`). Off by default: the retry
+     * re-sends the whole context, which in a long session is expensive.
+     */
+    retryProviderAuth?: boolean;
 }
 /** Every field above, as schemastery resolves them (all optional). */
 interface ConfigFields {
@@ -65,6 +71,7 @@ interface ConfigFields {
     disconnect?: string;
     autoApproval?: string;
     idleExit?: number;
+    retryProviderAuth?: boolean;
 }
 /**
  * The entry's schema. Everything a launch supplies (`config:` in

package/lib/types/tui.d.ts

@@ -274,6 +274,14 @@ export declare class SshTui {
     private commandSuggestions;
     private suggestionIndex;
     private focusedRow;
+    /**
+     * The text of the last prompt the user sent, kept so an opted-in retry can
+     * send the same thing again after a provider-side auth failure. Cleared when
+     * the retry fires, which is what bounds it to one attempt per user message.
+     */
+    private lastUserText;
+    /** Set on every turn/start; a retry consumes it. */
+    private authRetryArmed;
     private pendingMessages;
     private lastActivity;
     private lastIdleCtrlCAt;
@@ -1216,6 +1224,21 @@ export declare class SshTui {
      */
     private runNotifyCommand;
     /** /disconnect: pause (default) or continue the turn after SSH drop. */
+    /**
+     * Say where an auth failure came from, and retry it if the user asked for that.
+     *
+     * `code: "AUTH"` collapses two opposite situations (see `auth-failure.ts`), and
+     * the host does not retry either of them: a provider-side 401/403 that lasted
+     * 45 seconds killed two turns in a row on 2026-09-29 while the same key, model
+     * and route answered 200 straight afterwards. The hint costs nothing and the
+     * retry is opt-in, because resending a long session re-sends its whole context.
+     */
+    private reportAuthFailure;
+    private explainAuthFailure;
+    /** Whether the opt-in retry is on (`/retryauth`, the settings form, or the env). */
+    private retryProviderAuthEnabled;
+    /** `/retryauth [on|off]` — the setting that lets one provider 401/403 retry itself. */
+    private runRetryAuthCommand;
     private runDisconnectCommand;
     /** /mode: pick an agent preset (standard / minimal / ptc / cordis / routing-suite / ...). */
     private runModeCommand;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ssh-tui",
-  "version": "0.7.4",
+  "version": "0.8.0",
   "description": "SSH-friendly interactive terminal TUI plugin for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
@@ -68,18 +68,19 @@
       "patch": "./cordis.patch.yml"
     },
     "compatibility": {
-      "dsh": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
+      "dsh": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
       "dshReleases": {
         "0.1.2-rc.1": "incompatible",
-        "0.1.3-alpha.1": "unknown",
-        "0.1.3-alpha.2": "compatible",
-        "0.1.5-alpha.1": "compatible",
-        "0.1.5-alpha.2": "compatible",
-        "0.1.5-rc.1": "compatible",
-        "0.1.5-rc.2": "compatible",
-        "0.1.5-rc.3": "compatible",
+        "0.1.3-alpha.1": "incompatible",
+        "0.1.3-alpha.2": "incompatible",
+        "0.1.5-alpha.1": "incompatible",
+        "0.1.5-alpha.2": "incompatible",
+        "0.1.5-rc.1": "incompatible",
+        "0.1.5-rc.2": "incompatible",
+        "0.1.5-rc.3": "incompatible",
         "0.1.7-rc.1": "compatible",
-        "0.1.7-rc.2": "compatible"
+        "0.1.7-rc.2": "compatible",
+        "0.2.0-rc.1": "compatible"
       },
       "profiles": [
         "tui"
@@ -112,22 +113,21 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-agent-default-model": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-agent-loop": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-agent-preset": ">=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-agent-preset-registry": ">=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-agent-presets": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-cmdline": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-commands": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-credentials": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-llm": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-session": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-session-persistence": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-settings": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-subagent": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-user-approval": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8",
-    "@deepseek-ai/dsh-user-questions": ">=0.1.3-alpha.2 <0.1.6 || >=0.1.5-alpha.1 <0.1.6 || >=0.1.7-rc.1 <0.1.8"
+    "@deepseek-ai/dsh-agent": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-agent-default-model": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-agent-loop": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-agent-preset": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-agent-preset-registry": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-cmdline": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-commands": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-credentials": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-session": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-session-persistence": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-subagent": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-user-approval": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1",
+    "@deepseek-ai/dsh-user-questions": ">=0.1.7-rc.1 <0.1.8 || >=0.2.0-rc.1 <0.2.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-agent-preset": {
@@ -136,9 +136,6 @@
     "@deepseek-ai/dsh-agent-preset-registry": {
       "optional": true
     },
-    "@deepseek-ai/dsh-agent-presets": {
-      "optional": true
-    },
     "@deepseek-ai/dsh-credentials": {
       "optional": true
     },
@@ -159,75 +156,75 @@
     "@deepseek-ai/cordis-plugin-include": "1.0.9",
     "@deepseek-ai/cordis-plugin-loader": "1.0.5",
     "@deepseek-ai/cordis-plugin-timer": "1.1.6",
-    "@deepseek-ai/dsh": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-default-model": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-loop": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-preset": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-preset-registry": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-attachment": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-brand": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-cmdline": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-commands": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-credentials": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-home-paths": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-jobs": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-llm-mock-server": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session-projection-cache": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-subagent": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-timeout": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-tools": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-user-approval": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-user-questions": "0.1.7-rc.1",
+    "@deepseek-ai/dsh": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-default-model": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-loop": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-preset": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-preset-registry": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-brand": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-cmdline": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-commands": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-jobs": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm-mock-server": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-scope": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-user-questions": "0.2.0-rc.1",
     "@types/node": "^24.0.0",
     "@xterm/headless": "^6.0.0",
     "semver": "^7.8.5",
     "typescript": "^5.9.0"
   },
   "overrides": {
-    "@deepseek-ai/dsh": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-default-model": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-loop": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-preset": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-agent-preset-registry": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-attachment": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-brand": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-cmdline": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-commands": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-credentials": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-home-paths": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-jobs": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-llm-mock-server": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session-projection-cache": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-subagent": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-timeout": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-tools": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-user-approval": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-user-questions": "0.1.7-rc.1"
+    "@deepseek-ai/dsh": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-default-model": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-loop": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-preset": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-preset-registry": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-brand": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-cmdline": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-commands": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-jobs": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm-mock-server": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-scope": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-user-questions": "0.2.0-rc.1"
   }
 }