@mars-sea/dsh-commandcode-provider 0.11.11 → 0.11.12

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.12] - 2026-09-24
+
+### Changed
+
+- **This release supports dsh 0.1.7-rc.1 alone, and the two-generation compatibility code is gone.** The plugin has carried a bridge between two Harness generations — the 0.1.2-0.1.6 line (settings.yaml document, `LegacySettingsSchema`, the pre-0.1.7 ApiProxy credential path, `legacy-credentials.ts`) and the 0.1.7 settings world (schema-derived Config forms, volatile fields, the `remote.settings` client scope) — and every release since 0.11.9 has paid for it twice: two schema registrations, two credential paths, a peer range that admitted nine engines and could pair with none of them exactly. This release drops the older line: every `@deepseek-ai/*` peer, `dsh.compatibility.dsh`, `engines.dsh` and the single `dshReleases` record now name `^0.1.7-rc.1` — a range semver resolves to that one release and nothing else — and `@deepseek-ai/schemastery` is tightened from `^3.18.2` to `~3.18.4`, because the unconditional `.volatile()` marking needs schemastery 3.18.3+ and a profile resolving 3.18.2 would mark nothing and render a blank settings form. The bridge itself is deleted, not disabled: `LegacySettingsSchema` and the duplicated config-fields factory (one schema now — every field volatile except the `apiKey` secret), `src/client/legacy-credentials.ts` and its tests, the deprecated `selectCommandCodeSearchProvider()` export (removed in command-code upstream and long superseded by `applyCommandCodeSearchSelection()`), and the legacy branches of the engine-load and install smoke scripts. **If you run dsh 0.1.2–0.1.6, stay on 0.11.11** (the 0.5.0-era Harness line's last release is 0.9.1); both are installed by exact version and unmaintained. On 0.1.7-rc.1 nothing changes behaviorally — same surfaces, same wire — the bundle is simply smaller and the pairing exact. `npm run test:engine` passes against 0.1.7-rc.1 (the published surface links and evaluates there — the durable request-image policy included — and the adapter is driven with the engine's own message constructors), and `npm run test:install` passes the pnpm 10 marketplace-generation smoke against the new peer metadata.
+
+- **Synced with the official command-code@1.65.0 CLI** (2026-09-24 check of the npm `latest`; the official changelog page and RSS still top out at 1.64.0, so the evidence is the bundle diff, the live catalog and the pricing/docs pages). `COMMAND_CODE_CLI_VERSION` is now `1.65.0`. The release is additive with exactly one change: the CLI registry gains `stealth/space-bunny-alpha` (Space Bunny Alpha) — OpenRouter-served (`chatComplete`), text+image, 1M context, reasoning with the selectable `low`/`medium`/`high` set, available on every plan from Go up, and **free while the stealth preview lasts**. The public catalog serves it too (81 models, 80 + this one), so the picker shows it as `Go · FREE · Image` at $0 rates through the price table's free-model branch — no vendored price row, exactly like the other free models. It is also the **first change to the ZDR exception set since the 1.62.0 check**: the CLI's `modelSupportsZdr`/`knownModelSupportsZdr` negation sets both carry it and the pricing page says it plainly ("Not routed under ZDR"), so `KNOWN_NON_ZDR_MODELS` grows 20 → 21 and `tests/zdr.test.ts` pins the new membership deliberately. Everything else re-verified unchanged: the effort map (one key added, none edited), the Vision set, the plan tiers (no tier moves; the map is 51/58/71/81), the subscription-plan maps, every deal and price, the peak membership and schedule, and the whole wire protocol — every `/alpha/*` and `/provider/v1/*` call site, the `x-command-code-version` / `x-cmd-zdr` header table, the stream vocabulary and the browser-login flow are identical between the 1.64.0 and 1.65.0 bundles apart from minifier renames. The bundle does add a `/alpha/sandbox/*` route family, which belongs to the CLI's own remote-sandbox feature and is never called by this adapter.
+
 ## [0.11.11] - 2026-09-23
 
 ### Fixed

package/README.md

@@ -27,7 +27,7 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 - **Plan-aware picker** — models above your subscription tier are hidden by default (toggleable); an optional **Model allowlist** keeps only your favorites in the picker.
 - **Reasoning-effort support** — models with selectable reasoning effort levels expose them in the picker.
 - **Image input** — Vision-capable models accept images.
-- **Plans & quota panel** — an optional Command Code card at the bottom of the sidebar (directly above Settings) shows the serving account's plan and its 5-hour and weekly windows; clicking it opens a dashboard with the billing period, both windows as progress bars with reset times, monthly credit consumption, and the purchased/free balances. The dashboard's **×** button hands the center column back to your conversation (the current session is untouched). **Off by default** — turn on *"Show the quota card in the sidebar"* under **Settings → Command Code → Advanced** to show it, and the same switch hides it again (a hidden card draws nothing at all and runs no background usage poll); the change lands as soon as you save. The panel follows your harness language (中文 / English) and needs dsh 0.1.5 (rc.1) or newer.
+- **Plans & quota panel** — an optional Command Code card at the bottom of the sidebar (directly above Settings) shows the serving account's plan and its 5-hour and weekly windows; clicking it opens a dashboard with the billing period, both windows as progress bars with reset times, monthly credit consumption, and the purchased/free balances. The dashboard's **×** button hands the center column back to your conversation (the current session is untouched). **Off by default** — turn on *"Show the quota card in the sidebar"* under **Settings → Command Code → Advanced** to show it, and the same switch hides it again (a hidden card draws nothing at all and runs no background usage poll); the change lands as soon as you save. The panel follows your harness language (中文 / English).
 - **Session cost estimate** — published-rate estimates (`≈`) beside the composer token counter and in its usage dialog, using each request's model, request time and context tier from durable session history. Model switches and viewing the session later do not reprice earlier requests. Mixed-provider or unpriced usage shows a labeled subtotal (`≥`); missing history or wholly unpriceable usage stays hidden. These are estimates from the installed price snapshot, not provider invoices. Also English on every harness language.
 - **Web search** — the dsh `web_search` tool is backed by the Command Code Provider API (`/alpha/web-search`) with the same key/endpoint as chat, so no separate search key or base URL is needed. See [Web search](#web-search).
 
@@ -35,26 +35,29 @@ See [Screenshots](#screenshots) below for what the UI looks like.
 
 ## Install
 
-Pick the release line that matches your DeepSeek Harness version:
+This release supports **dsh 0.1.7-rc.1 and nothing else** — the plugin's peer
+range is that one version, and its compatibility record names it alone:
 
-- **dsh 0.1.2-rc.1 or later** (the current 0.1.2 line — what `@latest` installs today):
-
-  ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
-  ```
+```sh
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
+```
 
-- **Older dsh releases** (the 0.5.0 line and earlier, which use the rc-era Host/browser APIs) — the last plugin version supporting them is 0.9.1, installed by exact version. That line is no longer under active maintenance:
+- **Older dsh releases.** The 0.1.2–0.1.6 line is no longer supported: those
+  engines predate the 0.1.7 settings rewrite, the `RequestMessage` envelope, and
+  the durable image-offload contract, and the compatibility code that bridged
+  the two was removed. The last plugin release covering them is 0.11.11; the
+  0.5.0-era Harness line's last release is 0.9.1. Both are installed by exact
+  version and neither is maintained:
 
   ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11   # dsh 0.1.2–0.1.6
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1     # dsh 0.5.0 line
   ```
 
-> The `latest` tag points at the current 0.1.2-line plugin release. Users on the old 0.5.0-era Harness line must pin `@0.9.1` explicitly.
-
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -66,14 +69,14 @@ Fresh pnpm 10 marketplace generations are supported directly. Do not add a separ
 Update with the same tag you installed with:
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.2-rc.1+
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # older dsh (0.5.0 line, unmaintained)
 ```
 
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.11
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -102,7 +105,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.11
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -140,7 +143,7 @@ cmd login                               # writes ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**Engine version.** The plugin needs a dsh engine that exports `ToolCallId` from `@deepseek-ai/dsh-llm` — **dsh 0.1.2-alpha.3 or later**. That includes the engine dsh-TUI recommends (0.1.2-rc.1) and every later release, but *not* the oldest engines its peer range nominally allows: on dsh 0.1.0-rc.6 or 0.1.1-rc.2 the plugin's module import fails and the TUI will not start. Upgrade the engine, or use the web profile.
+**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.1**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.1` (semver resolves that to 0.1.7-rc.1 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
 
 ## Usage dashboard
 

package/README.zh-CN.md

@@ -27,32 +27,29 @@
 - **按套餐过滤**：默认隐藏超出订阅套餐的模型，可一键关闭；「模型白名单」可进一步只保留常用模型。
 - **推理强度支持**：支持推理强度的模型可在选择器中选择档位。
 - **图片输入**：Vision 模型支持发送图片。
-- **套餐与配额面板**：可选的 Command Code 卡片位于侧边栏底部（Settings 正上方），显示当前服务账号的套餐与 5 小时 / 每周两个配额窗口；点击后在中间栏打开面板，包含计费周期、两个窗口的进度条与重置时间、月度额度消耗，以及已购买 / 赠送余额。面板右上角的 **×** 按钮可随时把中间栏交还给会话（不会切换当前会话）。**默认关闭**——在 **设置 → Command Code → 高级设置** 中打开「在侧边栏显示额度卡片」即可显示，同一开关也能随时隐藏（隐藏时左侧不渲染任何内容，也不会为其后台刷新用量）。面板文案跟随 Harness 显示语言（中文 / English），需要 dsh 0.1.5（rc.1）或更高版本。
+- **套餐与配额面板**：可选的 Command Code 卡片位于侧边栏底部（Settings 正上方），显示当前服务账号的套餐与 5 小时 / 每周两个配额窗口；点击后在中间栏打开面板，包含计费周期、两个窗口的进度条与重置时间、月度额度消耗，以及已购买 / 赠送余额。面板右上角的 **×** 按钮可随时把中间栏交还给会话（不会切换当前会话）。**默认关闭**——在 **设置 → Command Code → 高级设置** 中打开「在侧边栏显示额度卡片」即可显示，同一开关也能随时隐藏（隐藏时左侧不渲染任何内容，也不会为其后台刷新用量）。面板文案跟随 Harness 显示语言（中文 / English）。
 - **会话费用估算**：在输入框下方的 token 计数旁及用量对话框中显示估算金额（`≈`），根据持久化历史中每次请求的模型、请求时间和上下文阶梯分别计价。切换模型或稍后查看不会重新定价之前的请求。混合供应商或缺少费率时显示已定价部分的小计（`≥`）；缺少历史事实或完全无法定价时不显示金额。结果基于插件内的价格快照，不等同于供应商账单。同样固定为英文。
 - **联网搜索**：dsh 的 `web_search` 工具由 Command Code Provider API（`/alpha/web-search`）承载，复用聊天同一个 key 与端点，无需单独配置搜索 key 或地址。详见[联网搜索](#联网搜索)。
 
 ## 安装
 
-按你的 DeepSeek Harness 版本选择对应的发布线：
+本版本**只支持 dsh 0.1.7-rc.1**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
 
-- **dsh 0.1.2-rc.1 或更高版本**（当前 0.1.2 线，即 `@latest` 现在安装的版本）：
-
-  ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
-  ```
+```sh
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
+```
 
-- **更早的 dsh 版本**（0.5.0 线及更早，使用 rc 时代的 Host/浏览器 API）——支持它们的最后一个插件版本是 0.9.1，按精确版本安装。该线不再积极维护：
+- **更早的 dsh 版本。** 0.1.2–0.1.6 线已不再支持：那些引擎早于 0.1.7 的设置重写、`RequestMessage` 消息封装和持久化图片卸载契约，用来桥接两代引擎的兼容代码已经删除。覆盖它们的最后一个插件版本是 0.11.11；0.5.0 时代 Harness 线的最后一个版本是 0.9.1。两者都按精确版本安装，且都不再维护：
 
   ```sh
-  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11   # dsh 0.1.2–0.1.6
+  dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.9.1     # dsh 0.5.0 线
   ```
 
-> `latest` tag 指向当前 0.1.2 线的插件版本。旧 0.5.0 时代的 Harness 用户必须显式钉住 `@0.9.1`。
-
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -64,14 +61,14 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.11
 用与安装时相同的 tag 更新：
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.2-rc.1 及以上
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # 更早的 dsh（0.5.0 线，不再维护）
 ```
 
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.11
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -100,7 +97,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.11
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.12
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -138,7 +135,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**引擎版本要求。** 插件需要导出了 `ToolCallId` 的 dsh 引擎，即 **dsh 0.1.2-alpha.3 或更高**。这覆盖了 dsh-TUI 推荐的引擎（0.1.2-rc.1）以及之后的所有版本，但不包含它 peer 范围里名义上允许的最老引擎：在 dsh 0.1.0-rc.6 / 0.1.1-rc.2 上，插件的模块导入会失败，TUI 无法启动。请升级引擎，或改用 web profile。
+**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.1**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.1`（按 semver，这只会解析到 0.1.7-rc.1），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
 
 ## 用量面板
 

package/lib/client.js

@@ -625,7 +625,6 @@ window.__ModuleLoader__.load({
 			listeners = /* @__PURE__ */ new Set();
 			disposers = [];
 			disposed = false;
-			defaultWorkingDir;
 			/** The credential reference the default account resolves. */
 			credentialRef = DEFAULT_API_KEY_REF;
 			/** Host-reported configured/writable state per credential reference. */
@@ -669,10 +668,8 @@ window.__ModuleLoader__.load({
 			/**
 			* @param scope - bound scope for the `llm-commandcode` namespace.
 			* @param api - credentials wire face.
-			* @param hostDescription - the Host-description observable whose `cwd` is
-			*   shown as the placeholder a blank `workingDir` field resolves to.
 			*/
-			constructor(scope, api, hostDescription) {
+			constructor(scope, api) {
 				this.scope = scope;
 				this.api = api;
 				this.disposers.push(scope.subscribe(() => {
@@ -680,17 +677,6 @@ window.__ModuleLoader__.load({
 					this.describeAll();
 					this.publish();
 				}));
-				if (hostDescription !== void 0) {
-					this.defaultWorkingDir = hostDescription.getSnapshot()?.cwd;
-					this.disposers.push(hostDescription.subscribe(() => {
-						if (this.disposed) return;
-						const cwd = hostDescription.getSnapshot()?.cwd;
-						if (cwd !== this.defaultWorkingDir) {
-							this.defaultWorkingDir = cwd;
-							this.publish();
-						}
-					}));
-				}
 				this.recomputeCredentialRef();
 				this.describeAll();
 				this.refreshCatalog();
@@ -743,7 +729,6 @@ window.__ModuleLoader__.load({
 					apiKeyClearStaged: this.keyClears.has(this.credentialRef),
 					apiBase: this.field("apiBase"),
 					workingDir: this.field("workingDir"),
-					defaultWorkingDir: this.defaultWorkingDir,
 					requestTimeoutMs: this.field("requestTimeoutMs"),
 					streamIdleTimeoutMs: this.field("streamIdleTimeoutMs"),
 					transportMaxRetries: this.field("transportMaxRetries"),
@@ -1483,47 +1468,6 @@ window.__ModuleLoader__.load({
 			}
 		};
 		//#endregion
-		//#region src/client/legacy-credentials.ts
-		/** Convert a legacy credentials ApiProxy into the current settings-page face. */
-		function adaptLegacyCredentials(legacy) {
-			if (legacy === void 0) return void 0;
-			return { credentials: {
-				describe: async (refs) => {
-					const response = await legacy.describe({ refs });
-					return response.result.ok ? {
-						ok: true,
-						value: response.result.value.credentials
-					} : {
-						ok: false,
-						error: response.result.error
-					};
-				},
-				set: async (ref, value) => {
-					const response = await legacy.set({
-						ref,
-						value
-					});
-					return response.result.ok ? {
-						ok: true,
-						value: void 0
-					} : {
-						ok: false,
-						error: response.result.error
-					};
-				},
-				unset: async (ref) => {
-					const response = await legacy.unset({ ref });
-					return response.result.ok ? {
-						ok: true,
-						value: void 0
-					} : {
-						ok: false,
-						error: response.result.error
-					};
-				}
-			} };
-		}
-		//#endregion
 		//#region src/client/usage.ts
 		const IDLE$1 = {
 			status: "idle",
@@ -2129,7 +2073,6 @@ window.__ModuleLoader__.load({
 			return {
 				mode: "strict",
 				typeSymbol,
-				schema,
 				create: () => schema
 			};
 		}
@@ -2141,7 +2084,6 @@ window.__ModuleLoader__.load({
 		* only its own facts.
 		*/
 		function makeRemoteDescriptor(endpoint, method, typeSymbol, schema) {
-			const result = makeStrictCodec(typeSymbol, schema);
 			return {
 				id: `${REMOTE_PACKAGE}#${endpoint}`,
 				service: REMOTE_SERVICE,
@@ -2149,7 +2091,7 @@ window.__ModuleLoader__.load({
 				method,
 				invocation: { kind: "direct" },
 				parameters: [],
-				result
+				result: makeStrictCodec(typeSymbol, schema)
 			};
 		}
 		//#endregion
@@ -2631,7 +2573,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region package.json
-		var version = "0.11.11";
+		var version = "0.11.12";
 		var repository = {
 			"type": "git",
 			"url": "git+https://github.com/Mars-Sea/dsh-commandcode-provider.git"
@@ -2953,7 +2895,6 @@ window.__ModuleLoader__.load({
 								hint: t("workingDirHint"),
 								state: state.workingDir,
 								disabled,
-								placeholder: state.defaultWorkingDir,
 								onEdit: (text) => onEdit("workingDir", text),
 								onReset: () => onReset("workingDir"),
 								t
@@ -5790,15 +5731,15 @@ window.__ModuleLoader__.load({
 		/**
 		* The shipped composer stats row (dsh-client-ui-chat `StatsPills`).
 		*
-		* A PREFERENCE, not a requirement: 0.1.6-alpha.2 dropped this attribute from the
-		* row's root while leaving the rest of the markup identical, so a lookup that
-		* insisted on it would silently stop finding the row on that engine. When it is
-		* absent the search falls back to the dock OUTLET — deliberately the outlet and
-		* never the outlet's parent, because from 0.1.6-alpha.2 the parent is the new
-		* composer footer, which holds the `ContextMeter` as well, and that meter's
-		* trigger is itself a `button[aria-haspopup="dialog"]` rendered AFTER the dock.
-		* A parent-scoped "last trigger wins" would therefore append the cost to the
-		* context ring instead of the token pill.
+		* A PREFERENCE, not a requirement: the attribute has already been dropped once
+		* upstream (0.1.6-alpha.2) while the rest of the row's markup stayed identical,
+		* so a lookup that insisted on it would silently stop finding the row. When it
+		* is absent the search falls back to the dock OUTLET — deliberately the outlet
+		* and never the outlet's parent, because the parent is the composer footer,
+		* which holds the `ContextMeter` as well, and that meter's trigger is itself a
+		* `button[aria-haspopup="dialog"]` rendered AFTER the dock. A parent-scoped
+		* "last trigger wins" would therefore append the cost to the context ring
+		* instead of the token pill.
 		*/
 		const STATS_ROOT = "[data-composer-stats]";
 		/**
@@ -5935,14 +5876,14 @@ window.__ModuleLoader__.load({
 			*
 			* The scope is the dock OUTLET (`display: contents`, one per slot), which holds
 			* exactly that slot's entries — the shipped `stats` cell and ours, in their
-			* registration order. {@link STATS_ROOT} narrows that to the stats row on the
-			* engines that still mark it; on the engines that do not, the outlet is
-			* already the narrowest correct container, because the composer footer's
-			* `ContextMeter` sits BESIDE the outlet rather than inside it.
+			* registration order. {@link STATS_ROOT} narrows that to the stats row where
+			* the markup marks it; where it does not, the outlet is already the narrowest
+			* correct container, because the composer footer's `ContextMeter` sits BESIDE
+			* the outlet rather than inside it.
 			*
 			* A missing scope is "no pill", never a document-wide search: the outlet is
 			* what makes this lookup per-composer, and a second composer can be live at
-			* once (0.1.6-alpha.2 mounts an embedded Conversation in the sidebar).
+			* once (the sidebar can mount an embedded Conversation).
 			*/
 			resolvePillButton() {
 				const scope = this.scope();
@@ -6292,9 +6233,18 @@ window.__ModuleLoader__.load({
 .cc-ruleCaret{flex-shrink:0;border-right:1.5px solid var(--dsw-alias-label-tertiary);border-bottom:1.5px solid var(--dsw-alias-label-tertiary);width:6px;height:6px;margin-right:4px;margin-bottom:2px;transform:rotate(45deg)}
 .cc-checkRow{align-items:center;gap:8px;display:inline-flex;min-width:0}
 .cc-checkRow:hover{cursor:pointer}
-.cc-check{appearance:none;flex-shrink:0;width:15px;height:15px;margin:0;border:1px solid var(--dsw-alias-border-l2);border-radius:4px;background:var(--dsw-alias-bg-layer-1);position:relative}
+/* A hand-drawn box rather than the platform's accent-color checkbox: the
+ * native control's colours come from color-scheme, which the theme sets once
+ * at BOOT (it is not re-applied when the theme is switched in-session), so a
+ * native box can paint light-chrome white on a dark page. Drawn from tokens it
+ * cannot. The mark rides a brand-primary fill, so it takes the theme's brand
+ * foreground — the platform's pairing for anything painted on that fill, and
+ * the only one that survives the dark mode's near-white brand. The box
+ * outline is a border-l3 hairline: border-l2 (#ffffff1f in dark) leaves an
+ * unchecked box all but invisible against the menu surface. */
+.cc-check{box-sizing:border-box;appearance:none;flex-shrink:0;width:16px;height:16px;margin:0;border:1px solid var(--dsw-alias-border-l3);border-radius:4px;background:0 0;position:relative}
 .cc-check:checked{background:var(--dsw-alias-brand-primary);border-color:var(--dsw-alias-brand-primary)}
-.cc-check:checked::after{content:'';position:absolute;top:2px;left:5px;width:3px;height:7px;border:solid #fff;border-width:0 1.5px 1.5px 0;transform:rotate(45deg)}
+.cc-check:checked::after{content:'';position:absolute;top:3px;left:5px;width:3px;height:7px;border:solid var(--dsw-alias-label-primary-foreground,#fff);border-width:0 1.5px 1.5px 0;transform:rotate(45deg)}
 .cc-checkName{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 /* The model multi-select search box: stacked under the trigger while the
  * dropdown is open, same input sizing so the pair reads as one control. The
@@ -6333,10 +6283,29 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 .cc-accountLoginHint{padding:0 0 12px}
 .cc-toggleRow{align-items:center;gap:8px;cursor:pointer;display:flex}
 .cc-toggleRow:has(.cc-toggle:disabled){cursor:default}
-.cc-toggle{appearance:none;flex-shrink:0;background:var(--dsw-alias-border-l2);border-radius:999px;width:30px;height:18px;margin:0;cursor:pointer;position:relative;transition:background .15s ease}
+/* Modelled on the platform's own Switch primitive (ui-primitives
+ * Switch.module.css, dsh 0.1.6+): a 36x20 capsule that pads its track by 2px
+ * and slides a 16px thumb across the 32px content box, so the control is the
+ * same shape, size and motion as every other switch in the app.
+ *
+ * Three things are load-bearing. (1) corner-shape:round on BOTH the track and
+ * the thumb: the theme sets a global superellipse corner shape on every
+ * element, and a superellipse capsule squares its ends off around a round
+ * thumb (the primitive's own comment is about exactly this).
+ * (2) No literal colours. --dsw-alias-brand-primary INVERTS between the two
+ * modes (near-black in light, near-white in dark, on every engine generation
+ * this plugin supports), so the old hardcoded white thumb vanished on the
+ * checked track in dark mode; the brand foreground is the token the platform
+ * paints on that fill, so it contrasts in both modes and in any brand pack.
+ * (3) --dsw-alias-border-l3 as the off track: --dsw-alias-border-l2
+ * (#ffffff1f in dark) left the unchecked track indistinguishable from the card
+ * — the dark-mode half of the same report. */
+.cc-toggle{box-sizing:border-box;appearance:none;flex-shrink:0;width:36px;height:20px;margin:0;padding:2px;border:0;border-radius:10px;corner-shape:round;background:var(--dsw-alias-border-l3);cursor:pointer;position:relative}
 .cc-toggle:checked{background:var(--dsw-alias-brand-primary)}
-.cc-toggle::after{content:'';background:#fff;border-radius:50%;width:14px;height:14px;position:absolute;top:2px;left:2px;transition:left .15s ease}
-.cc-toggle:checked::after{left:14px}
+.cc-toggle::after{content:'';display:block;width:16px;height:16px;border-radius:50%;corner-shape:round;background:var(--dsw-alias-label-primary-foreground);box-shadow:0 0 0 .5px var(--dsw-alias-border-l2);transition:transform .12s ease}
+/* 32px content box minus the 16px thumb. */
+.cc-toggle:checked::after{transform:translateX(16px)}
+.cc-toggle:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:2px}
 .cc-toggle:disabled{cursor:default;opacity:.5}
 .cc-failed{min-width:0;color:var(--dsw-alias-label-error);flex:1;margin:0;font-size:12px;line-height:1.5}
 .cc-usageCard{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;padding:14px 16px;flex-direction:column;gap:12px;display:flex}
@@ -6364,7 +6333,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 .cc-usageBar{overflow:hidden;background:var(--dsw-alias-bg-layer-1);border-radius:999px;height:6px}
 .cc-usageBarFill{background:var(--dsw-alias-brand-primary);border-radius:999px;height:100%;transition:width .3s ease}
 .cc-usageBarFillWarn{background:var(--dsw-alias-label-error)}
-@media (prefers-reduced-motion:reduce){.cc-chevron,.cc-toggle,.cc-toggle::after,.cc-usageBarFill{transition:none}}.cc-usageWindowReset{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:1.5}
+@media (prefers-reduced-motion:reduce){.cc-chevron,.cc-toggle::after,.cc-usageBarFill{transition:none}}.cc-usageWindowReset{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:1.5}
 .cc-usageMeta{align-items:center;gap:8px;display:flex}
 .cc-accountReport{flex-direction:column;gap:12px;display:flex}
 .cc-tabs{flex-wrap:wrap;gap:6px;display:flex}
@@ -6723,7 +6692,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			cardTitle: "Command Code",
 			cardRouteActive: "已启用",
 			cardLoadingHint: "正在读取 Command Code 配置…",
-			cardRegistrationHint: "此卡片随 Command Code 插件注册，需要较新版本的 DeepSeek Harness 才会显示完整内容。"
+			cardRegistrationHint: "此卡片由 Command Code 插件提供，正在等待设置页装配，稍后即可显示完整内容。"
 		};
 		const en = {
 			nav: "Command Code",
@@ -6871,7 +6840,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 			cardTitle: "Command Code",
 			cardRouteActive: "Active",
 			cardLoadingHint: "Loading the Command Code configuration…",
-			cardRegistrationHint: "This card is contributed by the Command Code plugin; a newer DeepSeek Harness is needed to show the full controls."
+			cardRegistrationHint: "This card is contributed by the Command Code plugin and is waiting for the settings page to finish assembling."
 		};
 		//#endregion
 		//#region src/client/index.ts
@@ -6911,15 +6880,6 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 		*/
 		const PANEL_ID = "commandcode-panel";
 		/**
-		* ui-conversation's reserved `main` key, used only as the exit fallback for a
-		* layout whose `selectPanel` predates the `null` "show the Conversation"
-		* selection (see `close` in {@link applyClientSurfaces}). Declared locally for
-		* the same reason as {@link PANEL_ID}: ui-conversation is not a dependency of
-		* this bundle, and the key is a published contract of the layout (its README
-		* names `conversation` as reserved for the Conversation).
-		*/
-		const CONVERSATION_PANEL_ID = "conversation";
-		/**
 		* The composer figure's entry id in `conversation.composer.dock`. Its own id,
 		* not the shipped `stats` cell's: reusing `stats` would REPLACE the tokens /
 		* cache-hit / throughput readout rather than inject into it, and that readout
@@ -6927,12 +6887,10 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 		*/
 		const SESSION_COST_ID = "commandcode-session-cost";
 		/**
-		* Client plugin body. Gates on the services shared by both client generations
-		* (`slots`, `locale`, `connection`, `remote`) — never on `settingsScope`,
-		* which 0.1.7 removed and which the settings scope here replaces for every
-		* generation. Current clients mount the page after `remote.credentials`
-		* appears; legacy clients mount it from the connection ApiProxy credential
-		* face.
+		* Client plugin body. Gates on `slots`, `locale` and `remote` — never on
+		* `settingsScope`, whose wrapper service the 0.1.7 settings rewrite removed
+		* (the settings scope here speaks the `remote.settings` wire directly). The
+		* page mounts once `remote.credentials` appears.
 		*/
 		function apply(ctx) {
 			injectPageCss();
@@ -6944,19 +6902,13 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 				zh: PANEL_COPY_ZH,
 				en: PANEL_COPY_EN
 			}), "dsh-commandcode-provider: panel copy");
-			const connection = ctx.get("connection");
-			const legacyApi = adaptLegacyCredentials(connection?.api?.credentials);
-			if (legacyApi !== void 0) {
-				applyClientSurfaces(ctx, legacyApi, connection?.hostDescription);
-				return;
-			}
 			ctx.inject(["remote.credentials"], (remoteCtx) => {
 				const credentials = remoteCtx.remote.credentials;
 				applyClientSurfaces(remoteCtx, { credentials });
 			});
 		}
-		/** Mount the one shared UI implementation over either credential transport. */
-		function applyClientSurfaces(ctx, api, hostDescription) {
+		/** Mount the one shared UI implementation. */
+		function applyClientSurfaces(ctx, api) {
 			let settingsNamespace;
 			const scope = createSettingsScope(ctx, COMMANDCODE_NS, () => settingsNamespace);
 			ctx.effect(() => () => {
@@ -6976,7 +6928,7 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 					ok: false,
 					error: { message: "commandcode/models remote is not mounted" }
 				})
-			}, hostDescription);
+			});
 			ctx.effect(() => () => controller.dispose(), "dsh-commandcode-provider: settings controller");
 			const store = createSnapshotStore(controller.state());
 			controller.subscribe(() => store.set(controller.state()));
@@ -7169,21 +7121,10 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 				},
 				startAutoRefresh: () => startPanelAutoRefresh(usageController, () => true),
 				open: () => {
-					const layout = ctx.get("layout");
-					if (typeof layout?.selectPanel === "function") layout.selectPanel(PANEL_ID);
+					ctx.get("layout")?.selectPanel(PANEL_ID);
 				},
 				close: () => {
-					const layout = ctx.get("layout");
-					if (typeof layout?.selectPanel !== "function") return;
-					try {
-						layout.selectPanel(null);
-					} catch {
-						try {
-							layout.selectPanel(CONVERSATION_PANEL_ID);
-						} catch (error) {
-							console.error("[dsh-commandcode-provider] could not close the plans & quota panel:", error);
-						}
-					}
+					ctx.get("layout")?.selectPanel(null);
 				}
 			});
 			ctx.effect(() => injectPanelCss(), "dsh-commandcode-provider: panel styles");
@@ -7198,7 +7139,6 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 				console.error("[dsh-commandcode-provider] could not register the plans & quota panel:", error);
 			}
 			ctx.inject(["layout"], (layoutCtx) => {
-				if (typeof layoutCtx.get("layout")?.selectPanel !== "function") return;
 				try {
 					layoutCtx.slots.inject("sidebar.footer.action", () => layoutCtx.slots.register({
 						name: "sidebar.footer.action",
@@ -7225,7 +7165,6 @@ select.cc-input{appearance:none;-webkit-appearance:none;-moz-appearance:none;box
 		const inject = [
 			"slots",
 			"locale",
-			"connection",
 			"remote"
 		];
 		//#endregion