@mars-sea/dsh-commandcode-provider 0.11.11 → 0.11.13

package/lib/index.js

@@ -2,8 +2,7 @@ import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
-import * as dshLlm from "@deepseek-ai/dsh-llm";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, isContextWindowExceededError, offloadedImageText, resolveRetryPolicy, textOnlyImageText } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, IMAGE_OFFLOAD_REQUIRED_CODE, LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, assertUsableApiKey, attributionHeaders, errorChain, isContextWindowExceededError, offloadedImageText, projectOffloadedImages, requiredImageOffload, resolveRetryPolicy, textOnlyImageText } from "@deepseek-ai/dsh-llm";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
@@ -309,6 +308,11 @@ const KNOWN_EFFORTS = {
 		"low",
 		"medium",
 		"high"
+	],
+	"stealth/space-bunny-alpha": [
+		"low",
+		"medium",
+		"high"
 	]
 };
 /**
@@ -374,6 +378,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 	"moonshotai/Kimi-K2.7-Code-Highspeed",
 	"moonshotai/Kimi-K3",
 	"sakana/fugu-ultra",
+	"stealth/space-bunny-alpha",
 	"stepfun/Step-3.7-Flash",
 	"stepfun/Step-5-Preview",
 	"thinkingmachines/inkling",
@@ -390,7 +395,7 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 ]);
 /**
 * Models WITHOUT a zero-data-retention upstream, per the official CLI's own
-* registry (`command-code@1.64.0` `dist/cli.mjs`: `modelSupportsZdr(id)` is
+* registry (`command-code@1.65.0` `dist/cli.mjs`: `modelSupportsZdr(id)` is
 * exactly `!nonZdrSet.has(canonicalize(id))`, and `knownModelSupportsZdr`
 * carries the same membership in the sibling route table — the union is this
 * set). The official docs (commandcode.ai/docs/resources/zdr) put it in prose
@@ -416,9 +421,12 @@ const KNOWN_IMAGE_MODELS = /* @__PURE__ */ new Set([
 * is the snapshot of the exclusion set and nothing more. The 1.62.0 → 1.64.0
 * diff of that union is EMPTY: both anchors were extracted from both bundles
 * during the 2026-09-23 check and each carries the same 20 members — which is
-* how rare a change here is expected to be. `meituan/LongCat-2.0` is the one
-* member the two anchors disagree about (it is in `modelSupportsZdr`'s set in
-* both releases and in neither `knownModelSupportsZdr` set), so the union is
+* how rare a change here is expected to be. The 1.64.0 → 1.65.0 diff (2026-09-24)
+* is the counterexample that proves the check still runs: exactly one member
+* joins (`stealth/space-bunny-alpha`), and it is in both anchors. `meituan/
+* LongCat-2.0` is the one member the two anchors disagree about (it is in
+* `modelSupportsZdr`'s set in both releases and in neither `knownModelSupportsZdr`
+* set), so the union is
 * what this table follows; reading only the sibling route table would drop it.
 */
 const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
@@ -433,6 +441,7 @@ const KNOWN_NON_ZDR_MODELS = /* @__PURE__ */ new Set([
 	"minimax/minimax-m3-free",
 	"poolside/laguna-s-2.1-free",
 	"sakana/fugu-ultra",
+	"stealth/space-bunny-alpha",
 	"stepfun/Step-3.7-Flash",
 	"stepfun/Step-5-Preview",
 	"xai/grok-4.5",
@@ -565,7 +574,11 @@ function requiresMessagesEndpoint(modelId) {
 * and 1.60.0 added `stepfun/Step-5-Preview` (Go); command-code@1.62.0 added the
 * MiMo V2.6 family — `xiaomi/mimo-v2.6-flash` + `xiaomi/mimo-v2.6-pro` (Go) and
 * `xiaomi/mimo-v2.6-pro-ultraspeed` (GOAT) — so the 1.58.0 -> 1.62.0 window's
-* only tier changes are additions and the superset chain still holds.
+* only tier changes are additions and the superset chain still holds. The
+* 1.62.0 -> 1.65.0 window continues the pattern: 1.64.0 added
+* `claude-opus-5-5` (Provider/Max), `gpt-6-sol` (Pro) and `gpt-6-luna` (Go),
+* and 1.65.0 added `stealth/space-bunny-alpha` (Go, every tier) — additions
+* only, no tier moves.
 *
 * The Provider API exposes no plan metadata, so this snapshot is the source of
 * truth for the picker's plan annotation — it answers "which plan do I need to
@@ -610,6 +623,7 @@ const KNOWN_PLANS = {
 	"stepfun/Step-3.5-Flash": "go",
 	"stepfun/Step-3.7-Flash": "go",
 	"stepfun/Step-5-Preview": "go",
+	"stealth/space-bunny-alpha": "go",
 	"tencent/hy3-paid": "go",
 	"tencent/hy4-preview": "go",
 	"thinkingmachines/inkling": "go",
@@ -817,6 +831,10 @@ const KNOWN_DEALS = {
 	"inclusionai/ling-3.0-flash-sante:free": {
 		label: "FREE",
 		free: true
+	},
+	"stealth/space-bunny-alpha": {
+		label: "FREE",
+		free: true
 	}
 };
 /**
@@ -2600,9 +2618,11 @@ const REQUEST_IMAGE_MAX_ENCODED_BYTES = 1048576;
 * never returns a zero dimension (a 1-px degenerate side is what the round of
 * an extreme aspect ratio can produce, and a 0 would make the encoder refuse).
 *
-* A local restatement of the helper 0.1.6 exports from `dsh-attachment`, which
-* 0.1.2–0.1.5 do not have; the math is the whole contract, so keeping the copy
-* here costs less than a version probe would.
+* `dsh-attachment` exports an equivalent `longEdgeDimensions`, but it does not
+* guard its inputs: a reference whose declared size is 0 or NaN — a malformed
+* or fabricated attachment record — would project to a zero-sized target and
+* make the encoder refuse the whole request. The guard is the reason this stays
+* local; `tests/image-tokens.test.ts` pins the degenerate cases.
 */
 function longEdgeDimensions(width, height, longEdge) {
 	if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) return {
@@ -2623,16 +2643,11 @@ function longEdgeDimensions(width, height, longEdge) {
 }
 /**
 * The request target for one normalized attachment: its aspect ratio under the
-* long-edge budget, plus the byte budget every generation honours.
-*
-* The area is computed from the PROJECTED dimensions rather than the source's,
-* so ≤0.1.5's own pixel projection lands on the same geometry instead of
-* re-deriving a slightly different one from the original.
+* long-edge budget, plus the encoded-byte budget.
 */
 function requestImageTarget(ref) {
 	const projected = longEdgeDimensions(ref.width, ref.height, REQUEST_IMAGE_MAX_LONG_EDGE);
 	return {
-		maxPixels: projected.width * projected.height,
 		width: projected.width,
 		height: projected.height,
 		maxBytes: REQUEST_IMAGE_MAX_ENCODED_BYTES
@@ -3002,7 +3017,7 @@ function openStreamTrace(scope, options = {}) {
 * per-request options thunk and an API-key resolver from the plugin entry
 * (src/index.ts), so a settings change reaches the very next request.
 */
-const COMMAND_CODE_CLI_VERSION = "1.64.0";
+const COMMAND_CODE_CLI_VERSION = "1.65.0";
 const DEFAULT_API_BASE = "https://api.commandcode.ai";
 const DEFAULT_GENERATE_MAX_TOKENS = 64e3;
 const DEFAULT_MAX_OUTPUT_TOKENS = 65536;
@@ -3383,32 +3398,24 @@ async function writeModelsCache(cachePath, models) {
 	}
 }
 /**
-* >=0.1.7 puts toolCallId/isError on a role:'tool' message and carries raw
-* content blocks. Older engines wrap those fields in the first tool-result
-* block of a role:'user' message. Read structurally so the bundle still builds
-* and loads against older peers. Pairing and emission MUST use this same view:
-* otherwise a dropped result either drops its call too (making the model
-* forget completed work), or leaves an unanswered call on the wire.
+* The tool result one message answers, or undefined when it answers none.
 *
-* For the legacy envelope a present source tag remains authoritative; an
-* absent tag falls back to the first block (issue #47). The modern role is
-* itself the discriminator, as it is for the Harness's own serializers.
+* The harness models a tool result as its own `role: 'tool'` message carrying
+* `toolCallId`/`isError` beside raw content blocks (a closed role map:
+* `MessageRoleMap.tool` is the only role a tool result can arrive on). Pairing
+* and emission MUST agree on this same view: otherwise a dropped result either
+* drops its call too (making the model forget completed work), or leaves an
+* unanswered call on the wire.
 */
 function toolResultOf(message) {
-	const current = message;
-	if (current.role === "tool") {
-		if (typeof current.toolCallId !== "string" || current.toolCallId === "") return void 0;
-		return {
-			toolCallId: current.toolCallId,
-			isError: current.isError ?? false,
-			content: current.content
-		};
-	}
-	if (message.role !== "user") return void 0;
-	const kind = message.source?.kind;
-	if (kind !== void 0 && kind !== "tool") return void 0;
-	const block = message.content[0];
-	return block?.type === "tool-result" ? block : void 0;
+	if (message.role !== "tool") return void 0;
+	const { toolCallId, content } = message;
+	if (typeof toolCallId !== "string" || toolCallId === "") return void 0;
+	return {
+		toolCallId,
+		isError: message.isError ?? false,
+		content
+	};
 }
 /**
 * Collect the tool calls that have a paired tool result, plus each call's
@@ -3481,23 +3488,16 @@ function toolResultMedia(block) {
 	const chunks = [];
 	const images = [];
 	const seen = /* @__PURE__ */ new Set();
-	const walk = (blocks) => {
-		for (const nested of blocks) {
-			if (nested.type === "text" || nested.type === "reasoning") {
-				if (nested.text) chunks.push(nested.text);
-				continue;
-			}
-			if (nested.type === "image") {
-				if (!seen.has(nested.attachment.attachmentId)) {
-					seen.add(nested.attachment.attachmentId);
-					images.push(nested.attachment);
-				}
-				continue;
-			}
-			if (nested.type === "tool-result") walk(nested.content);
+	for (const nested of block.content) {
+		if (nested.type === "text" || nested.type === "reasoning") {
+			if (nested.text) chunks.push(nested.text);
+			continue;
 		}
-	};
-	walk(block.content);
+		if (nested.type === "image" && !seen.has(nested.attachment.attachmentId)) {
+			seen.add(nested.attachment.attachmentId);
+			images.push(nested.attachment);
+		}
+	}
 	return {
 		text: chunks.join("\n"),
 		images
@@ -3542,8 +3542,7 @@ function toolResultImageNote(media, toolCallId) {
 	return `${lead} ${media.images.length > 1 ? `${media.images.length} images, ` : ""}${dimensions}`;
 }
 function hasImageContent(message) {
-	const check = (blocks) => blocks.some((b) => b.type === "image" || b.type === "tool-result" && check(b.content));
-	return check(message.content);
+	return message.content.some((block) => block.type === "image");
 }
 /** The budget ladder: the primary rung first, the 413 eviction rung second. */
 const REQUEST_IMAGE_BUDGETS = [{
@@ -3557,68 +3556,13 @@ const REQUEST_IMAGE_BUDGETS = [{
 	byteQuantum: 8388608,
 	countQuantum: 12
 }];
+/** The engine's own helpers: what a process that injects nothing speaks. */
+const ENGINE_IMAGE_POLICY = {
+	projectOffloadedImages,
+	requiredImageOffload
+};
 /**
-* Project request history under one image budget (≤0.1.5 engines only): the
-* oldest images past it become placeholder text in place, the newest keep their
-* bytes, and a history already inside the budget is returned as the SAME array
-* — the caller uses that identity to tell "nothing evicted" from "evicted".
-*
-* Nested tool-result images ride the same core walk, which is exactly right
-* for this adapter: an evicted `read_image` result surfaces its placeholder as
-* the tool message's own text, so no carrier user message is emitted for it.
-*/
-function projectRequestImages(messages, budget, policy) {
-	const offload = policy.offloadRequestImagesWithPolicy;
-	if (typeof offload !== "function") return messages;
-	return offload(messages, {
-		representation: "base64",
-		maxBytes: budget.maxBytes,
-		maxImages: budget.maxImages,
-		byteQuantum: budget.byteQuantum,
-		countQuantum: budget.countQuantum,
-		placeholder: (ref) => offloadedImageText(ref)
-	});
-}
-/**
-* The request options one budget produced: the caller's own object when the
-* history was already inside the budget, else a copy carrying the projection.
-* The next rung of the ladder is applied to the CURRENT projection, never to
-* the raw history — otherwise a retry could reintroduce images the first rung
-* had already evicted.
-*/
-function withImageBudget(options, budget, policy) {
-	const projected = projectRequestImages(options.messages, budget, policy);
-	return projected === options.messages ? options : {
-		...options,
-		messages: [...projected]
-	};
-}
-/**
-* Stable provider-neutral code for "a request still carries more images than
-* this route will send; offload N of them and retry". Declared locally rather
-* than imported: the constant does not exist on the 0.1.2–0.1.5 peers this
-* plugin still supports, and importing it statically is the link-time failure
-* described above the budget constants.
-*/
-const IMAGE_OFFLOAD_REQUIRED_CODE = "IMAGE_OFFLOAD_REQUIRED";
-/** The installed engine's image policy; see {@link CoreImagePolicy}. */
-const CORE_IMAGE_POLICY = dshLlm;
-/**
-* The durable-offload contract this engine speaks, or undefined on ≤0.1.5.
-*
-* Both members are required together: a half-populated engine would either
-* lose the surface's marks (re-sending evicted images as pixels) or lose the
-* count (silently sending an over-budget body), and neither is worth a partial
-* opt-in. Absent, the adapter keeps its own transient projection instead.
-*/
-function surfaceImagePolicy(api = CORE_IMAGE_POLICY) {
-	return typeof api.projectOffloadedImages === "function" && typeof api.requiredImageOffload === "function" ? {
-		projectOffloadedImages: api.projectOffloadedImages,
-		requiredImageOffload: api.requiredImageOffload
-	} : void 0;
-}
-/**
-* The failure a route raises instead of evicting on its own (≥0.1.6). The
+* The failure a route raises instead of evicting on its own. The
 * count is the ONE thing the harness needs: `dsh-compaction-image-offload`
 * records it as an `image/offload` event, marks that many oldest retained
 * occurrences, and retries the step.
@@ -3647,10 +3591,14 @@ function coreBudget(budget) {
 */
 const imageVersionBytes = (block) => block.attachment.bytes;
 /**
-* ≥0.1.6 request options: the surface's durable marks become placeholder text,
-* and an over-budget history FAILS with the count to offload instead of being
-* evicted here. Throws rather than returning, so no caller can accidentally
-* send a body this route already knows is too large.
+* Request options under one budget rung: the surface's durable marks become
+* placeholder text, and an over-budget history FAILS with the count to offload
+* instead of being evicted here. Throws rather than returning, so no caller can
+* accidentally send a body this route already knows is too large.
+*
+* The next rung is applied to the CURRENT projection, never to the raw history —
+* otherwise the 413 retry could reintroduce images the first rung had already
+* evicted.
 */
 function withSurfaceOffload(options, policy, budget) {
 	const marked = policy.projectOffloadedImages(options.messages, (ref) => offloadedImageText(ref));
@@ -3663,21 +3611,17 @@ function withSurfaceOffload(options, policy, budget) {
 	};
 }
 /**
-* One image's bytes for the wire: the attachment service's REQUEST VERSION when
-* it can produce one, else the normalized original.
+* One image's bytes for the wire: the attachment service's REQUEST VERSION.
 *
 * `readImage()` answers the stored original, which is what admission accepted —
 * not what a provider request should carry. `readImageRequest()` re-encodes to
 * the route target in `./image-request.ts` and caches the result under it, so
 * the same attachment costs one encode per target instead of one per occurrence,
 * and the base64 the wire expands is bounded (both the pixel budget and, more to
-* the point here, the encoded bytes). The fallback is for a backend that does
-* not implement the abstract method; every engine this plugin declares support
-* for does.
+* the point here, the encoded bytes).
 */
 async function readRequestImage(attachments, ref) {
-	if (typeof attachments.readImageRequest === "function") return (await attachments.readImageRequest(ref, requestImageTarget(ref))).data;
-	return (await attachments.readImage(ref)).data;
+	return (await attachments.readImageRequest(ref, requestImageTarget(ref))).data;
 }
 /**
 * Price one request occurrence.
@@ -3686,13 +3630,12 @@ async function readRequestImage(attachments, ref) {
 * model-visible TEXT so the caller's estimator can charge that instead: a model
 * that accepts text only (the harness projects those images to placeholder text
 * before the request), and an occurrence the session surface has already
-* offloaded (≥0.1.6 renders the same placeholder text in every later request).
-* A retained occurrence on this route contributes no text at all — the pixels
-* are inlined — so its price is the family's visual-token count and nothing else.
+* offloaded (the same placeholder text rides in every later request). A retained
+* occurrence on this route contributes no text at all — the pixels are inlined —
+* so its price is the family's visual-token count and nothing else.
 */
-function priceRequestImage(occurrence, model, imageCapable) {
-	const block = occurrence;
-	const ref = block.attachment ?? occurrence;
+function priceRequestImage(block, model, imageCapable) {
+	const ref = block.attachment;
 	if (!imageCapable) return {
 		visualTokens: 0,
 		text: textOnlyImageText(ref)
@@ -4225,13 +4168,9 @@ var CommandCodeAdapter = class extends LlmAdapter {
 	catalog = [];
 	fetchImpl;
 	resolveAttachments;
-	/** The engine's request-image policy, resolved once (tests may inject one). */
-	imagePolicy;
 	/**
-	* The ≥0.1.6 durable contract, or `undefined` on a ≤0.1.5 engine — where the
-	* adapter must evict its own history. Resolved once: the contract a process
-	* speaks cannot change while it runs, and resolving here keeps every request
-	* on the same branch (see {@link surfaceImagePolicy}).
+	* The durable-offload contract, resolved once (tests may inject a stub). The
+	* contract cannot change while the process runs.
 	*/
 	surfaceOffload;
 	billingAccess = /* @__PURE__ */ new Map();
@@ -4242,8 +4181,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		this.deps = deps;
 		this.fetchImpl = deps.fetchImpl ?? fetch;
 		this.resolveAttachments = deps.resolveAttachments;
-		this.imagePolicy = deps.imageOffload ?? CORE_IMAGE_POLICY;
-		this.surfaceOffload = surfaceImagePolicy(this.imagePolicy);
+		this.surfaceOffload = deps.imageOffload ?? ENGINE_IMAGE_POLICY;
 	}
 	/**
 	* Display metadata for the picker's provider group header. The base class
@@ -4727,8 +4665,7 @@ var CommandCodeAdapter = class extends LlmAdapter {
 		const reasoningEffort = effort && effort !== "off" && supported?.includes(effort) ? effort : void 0;
 		const systemText = [options.system ?? "", ...options.messages.filter((m) => m.role === "system").map((m) => m.content.map(blockText).filter(Boolean).join("\n"))].filter(Boolean).join("\n\n");
 		let protocol = this.resolveProtocol(apiKey, options.model);
-		let requestOptions = this.surfaceOffload === void 0 ? withImageBudget(options, REQUEST_IMAGE_BUDGETS[0], this.imagePolicy) : withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
-		let imageBudgetIndex = 0;
+		let requestOptions = withSurfaceOffload(options, this.surfaceOffload, REQUEST_IMAGE_BUDGETS[0]);
 		const buildBody = async (target) => target === "cli" ? buildCliBody(requestOptions, connection, {
 			maxTokens,
 			reasoningEffort,
@@ -4761,19 +4698,9 @@ var CommandCodeAdapter = class extends LlmAdapter {
 				body = await buildBody("cli");
 				continue;
 			}
-			if (attempt.status === 413 && imageBudgetIndex + 1 < REQUEST_IMAGE_BUDGETS.length) {
-				if (this.surfaceOffload !== void 0) {
-					const missing = this.surfaceOffload.requiredImageOffload(requestOptions.messages, coreBudget(REQUEST_IMAGE_BUDGETS[imageBudgetIndex + 1]), imageVersionBytes);
-					if (missing > 0) throw imageOffloadRequired(missing);
-				} else {
-					const tightened = withImageBudget(requestOptions, REQUEST_IMAGE_BUDGETS[imageBudgetIndex + 1], this.imagePolicy);
-					if (tightened !== requestOptions) {
-						imageBudgetIndex += 1;
-						requestOptions = tightened;
-						body = await buildBody(protocol);
-						continue;
-					}
-				}
+			if (attempt.status === 413 && REQUEST_IMAGE_BUDGETS.length > 1) {
+				const missing = this.surfaceOffload.requiredImageOffload(requestOptions.messages, coreBudget(REQUEST_IMAGE_BUDGETS[1]), imageVersionBytes);
+				if (missing > 0) throw imageOffloadRequired(missing);
 			}
 			const rotate = this.deps.rotateApiKey;
 			const rejection = classifyAccountRejection(attempt.status, attempt.errText);
@@ -5700,7 +5627,6 @@ function makeStrictCodec(typeSymbol, schema) {
 	return {
 		mode: "strict",
 		typeSymbol,
-		schema,
 		create: () => schema
 	};
 }
@@ -5712,7 +5638,6 @@ function makeStrictCodec(typeSymbol, schema) {
 * only its own facts.
 */
 function makeRemoteDescriptor(endpoint, method, typeSymbol, schema) {
-	const result = makeStrictCodec(typeSymbol, schema);
 	return {
 		id: `${REMOTE_PACKAGE}#${endpoint}`,
 		service: REMOTE_SERVICE,
@@ -5720,7 +5645,7 @@ function makeRemoteDescriptor(endpoint, method, typeSymbol, schema) {
 		method,
 		invocation: { kind: "direct" },
 		parameters: [],
-		result
+		result: makeStrictCodec(typeSymbol, schema)
 	};
 }
 //#endregion
@@ -6643,30 +6568,6 @@ const COMMANDCODE_SEARCH_PROVIDER_ID = "commandcode";
 * modsearch even with Command Code search turned off (issue #26).
 */
 const DEFAULT_WEB_SEARCH_PROVIDER_ID = "deepseek-official";
-/**
-* Point the web seam's search selection at this plugin's provider (`commandcode`).
-* Sets the runtime field; the next search call honours it because `search()`
-* re-reads `searchProviderId` each time. Returns the prior id (or undefined).
-* Never throws: a hardened/frozen runtime shape must not break the
-* settings-save path that calls this — the provider simply stays
-* registered-but-unselected (the boot-time `searchProvider: commandcode`
-* cordis patch is the durable alternative).
-*
-* @deprecated Prefer {@link applyCommandCodeSearchSelection}: this overload
-* always overwrites the displaced backend with the factory default on
-* disable, so turning Command Code search off silences whichever provider
-* was selected before (e.g. modsearch) instead of restoring it (issue #26).
-*/
-function selectCommandCodeSearchProvider(web, enable) {
-	try {
-		const field = web;
-		const prior = field.searchProviderId;
-		field.searchProviderId = enable ? COMMANDCODE_SEARCH_PROVIDER_ID : DEFAULT_WEB_SEARCH_PROVIDER_ID;
-		return prior;
-	} catch {
-		return;
-	}
-}
 /** Fresh selection state: the plugin starts out not owning the selection. */
 function commandCodeSearchSelection() {
 	return {
@@ -7049,8 +6950,8 @@ function buildCommandCodeTuiSection(deps) {
 				kind: "boolean",
 				label: "AI command guard",
 				descriptions: { zh: "AI 命令安全预判" },
-				hint: "typesafe/jev judges whether a shell command is safe and auto-approves it; everything else asks as usual. Off by default.",
-				hintDescriptions: { zh: "由 typesafe/jev 判断 shell 命令是否安全，安全则自动放行，其余照常弹窗。默认关闭。" },
+				hint: "typesafe/jev judges whether a shell command is safe; sandbox escalations also need separate scope and necessity verdicts. All must be confident enough; everything else asks as usual. Off by default.",
+				hintDescriptions: { zh: "由 typesafe/jev 判断 shell 命令是否安全；沙箱提权还要分别判断范围与必要性，三项都足够确定才自动放行，其余照常弹窗。默认关闭。" },
 				format: (value) => value === true ? "true" : "false",
 				parse: (text) => ({
 					kind: "set",
@@ -7058,38 +6959,36 @@ function buildCommandCodeTuiSection(deps) {
 				})
 			},
 			{
-				path: ["commandGuardThreshold"],
-				group: "advanced",
-				kind: "number",
-				label: "Auto-approve threshold (0.5-1)",
-				descriptions: { zh: "自动放行阈值（0.5-1）" },
-				hint: "Approve when typesafe/jev rates the command \"safe\" at least this likely; default 0.9.",
-				hintDescriptions: { zh: "typesafe/jev 判定\"安全\"的概率达到该值即放行，默认 0.9。" },
-				parse: (text) => {
-					const trimmed = text.trim();
-					if (trimmed === "") return { kind: "clear" };
-					const parsed = Number(trimmed);
-					return Number.isFinite(parsed) && parsed >= .5 && parsed <= 1 ? {
-						kind: "set",
-						value: parsed
-					} : void 0;
-				}
-			},
-			{
-				path: ["commandGuardTimeoutMs"],
+				path: ["commandGuardLevel"],
 				group: "advanced",
-				kind: "number",
-				label: "Judgement timeout (ms, 200-10000)",
-				descriptions: { zh: "判定超时（毫秒，200-10000）" },
-				hint: "If typesafe/jev does not answer in time, the normal prompt appears; default 1500.",
-				hintDescriptions: { zh: "typesafe/jev 超过该时间未返回就照常弹窗，默认 1500。" },
+				kind: "select",
+				label: "Auto-approve threshold",
+				descriptions: { zh: "自动放行阈值" },
+				hint: "How confident typesafe/jev must be before a command runs without asking. Default: medium.",
+				hintDescriptions: { zh: "typesafe/jev 需要多确定才免弹窗放行；默认「中」。" },
+				options: [
+					{
+						value: "high",
+						label: "High (0.95, approves least)",
+						descriptions: { zh: "高（0.95，放行最少）" }
+					},
+					{
+						value: "medium",
+						label: "Medium (0.9)",
+						descriptions: { zh: "中（0.9）" }
+					},
+					{
+						value: "low",
+						label: "Low (0.8, approves most)",
+						descriptions: { zh: "低（0.8，放行最多）" }
+					}
+				],
+				format: (value) => value === "high" || value === "low" ? value : "medium",
 				parse: (text) => {
 					const trimmed = text.trim();
-					if (trimmed === "") return { kind: "clear" };
-					const parsed = Number(trimmed);
-					return Number.isFinite(parsed) && parsed >= 200 && parsed <= 1e4 ? {
+					return trimmed === "high" || trimmed === "medium" || trimmed === "low" ? {
 						kind: "set",
-						value: parsed
+						value: trimmed
 					} : void 0;
 				}
 			},
@@ -7378,8 +7277,8 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 * as an internal advisor instead: the command guard in `./command-guard.ts`
 * asks it whether a shell command is safe to auto-approve.
 *
-* The three question types are the whole vocabulary (command-code@1.64.0
-* `systemOneRequestSchema`):
+* The three question types are the whole vocabulary (command-code@1.65.0
+* `systemOneRequestSchema`, unchanged since 1.64.0):
 *
 * - `noul` — "is this true?", optional `criteria: { true, false }` describing
 *   each verdict. Answers with `noul`, the probability of *yes*.
@@ -7410,8 +7309,6 @@ function transportBudgetMessage(failureMessage, maxRetries) {
 */
 /** Path of the decision endpoint, relative to `apiBase`. */
 const SYSTEMONE_ROUTE = "/provider/v1/systemone";
-/** Milliseconds a decision may take before the caller gives up on it. */
-const SYSTEMONE_DEFAULT_TIMEOUT_MS = 1500;
 /** The one error type this client throws. Callers fail closed on it. */
 var SystemOneError = class extends Error {
 	kind;
@@ -7669,13 +7566,40 @@ async function runSystemOne(deps, request, options = {}) {
 //#region src/command-guard.ts
 /** Tool names whose `arguments.command` this guard judges. */
 const COMMAND_GUARD_SHELL_TOOLS = ["bash", "pwsh"];
-/** Question id the safety verdict is keyed by. */
+/** Question id the primary safety verdict is keyed by. */
 const COMMAND_GUARD_QUESTION_ID = "safe";
-/** Decision budget; the approval prompt must not wait longer than this. */
-const COMMAND_GUARD_DEFAULT_TIMEOUT_MS = SYSTEMONE_DEFAULT_TIMEOUT_MS;
-/** Bounds of the configurable probability, mirrored by the settings schemas. */
-const COMMAND_GUARD_MIN_THRESHOLD = .5;
-const COMMAND_GUARD_MAX_TIMEOUT_MS = 1e4;
+/** Question id for the narrow-purpose part of a sandbox escalation. */
+const COMMAND_GUARD_ESCALATION_SCOPE_QUESTION_ID = "escalation_scope";
+/** Question id for the necessity/proportionality part of a sandbox escalation. */
+const COMMAND_GUARD_ESCALATION_NECESSITY_QUESTION_ID = "escalation_necessity";
+/** The selectable levels, strictest first (the order the settings surfaces list them in). */
+const COMMAND_GUARD_LEVELS = [
+	"high",
+	"medium",
+	"low"
+];
+/** Each level's probability threshold. */
+const COMMAND_GUARD_LEVEL_THRESHOLDS = {
+	high: .95,
+	medium: .9,
+	low: .8
+};
+/** The level an unset config reads as. */
+const COMMAND_GUARD_DEFAULT_LEVEL = "medium";
+/** Probability of "safe" at or above which the guard grants `allowed-once` by default. */
+const COMMAND_GUARD_DEFAULT_THRESHOLD = COMMAND_GUARD_LEVEL_THRESHOLDS[COMMAND_GUARD_DEFAULT_LEVEL];
+/** The threshold for a stored level; anything unrecognized reads as the default level. */
+function commandGuardThreshold(level) {
+	return typeof level === "string" && Object.hasOwn(COMMAND_GUARD_LEVEL_THRESHOLDS, level) ? COMMAND_GUARD_LEVEL_THRESHOLDS[level] : COMMAND_GUARD_DEFAULT_THRESHOLD;
+}
+/**
+* Decision budget; the approval prompt must not wait longer than this. Fixed
+* rather than configurable: it only bounds how long a late verdict can delay
+* the prompt, and every failure (a timeout included) already falls back to
+* asking the user, so there is nothing for a user to tune. 3 s leaves room for
+* credential resolution plus one decision round trip on a slow link.
+*/
+const COMMAND_GUARD_TIMEOUT_MS = 3e3;
 /**
 * Longest command the guard will send for judgement. A longer one is delegated
 * instead of truncated: a verdict on the first N characters of a command is a
@@ -7714,7 +7638,7 @@ const COMMAND_GUARD_DENY_LIST = [
 	},
 	{
 		id: "device-redirect",
-		pattern: /(?:^|[^0-9\w])>{1,2}\s*\/dev\/(?:sd|disk|nvme|hd)/
+		pattern: />{1,2}\s*\/dev\/(?:sd|disk|nvme|hd)/
 	},
 	{
 		id: "fork-bomb",
@@ -7854,17 +7778,21 @@ function shellCommandOf(name, args) {
 /**
 * Build the decision request for one command.
 *
-* The question is deliberately one `noul`: a single probability is a decision
-* rule that can be explained, thresholded and logged in one line, and the
-* criteria carry the whole distinction between "reads, or writes reversibly
-* inside the project" and "everything else". The agent's own `description` is
-* included as context, but the criteria say the command text itself decides — a
+* A normal approval asks one question. A call that explicitly requests a wider
+* sandbox gets the same safety question plus two veto questions. This keeps the
+* common case cheap while making the broader permission change an explicit
+* decision: JEV must agree that the extra access has a narrow purpose and is
+* necessary, not merely that the command text looks familiar.
+*
+* The agent's own `description` and the harness's `reason` are included as
+* context, but the criteria say the command text itself decides — a
 * model-written description is a claim, not evidence.
 *
 * @param fact - the command and its context.
 * @returns the request to send.
 */
 function buildSafetyRequest(fact) {
+	const escalated = fact.sandboxPermissions !== void 0;
 	const lines = [
 		`Tool: ${fact.tool}`,
 		"Command:",
@@ -7876,24 +7804,43 @@ function buildSafetyRequest(fact) {
 	];
 	const question = {
 		type: "noul",
-		instructions: "Is it safe to run this command right now WITHOUT asking the user first? Judge the command text itself; a description is only a claim about it.",
+		instructions: escalated ? "Is it safe to run this command right now WITHOUT asking the user first, including the requested sandbox escalation? Judge the command text itself; a description or stated reason is only a claim about it." : "Is it safe to run this command right now WITHOUT asking the user first? Judge the command text itself; a description is only a claim about it.",
 		criteria: {
-			true: "Read-only, or its effects stay inside the current project and are trivially reversible: no data leaves the machine, nothing outside the project is modified, and no credentials, git history or remote state are touched.",
-			false: "Anything else. Deleting or overwriting files outside the project, rewriting or publishing git history, uploading data anywhere, installing system or global packages, changing permissions, ownership or credentials, killing processes, running as another user or as root, piping a download into a shell, or a command obfuscated enough that its effect cannot be read."
+			true: escalated ? "A normal, non-obfuscated read, build, or test operation whose outside-workspace effects are limited to conventional build/dependency caches or temporary files and are easily reversible: no unrelated user or system data is accessed, no data leaves the machine, and no credentials, git history or remote state are touched." : "Read-only, or its effects stay inside the current project and are trivially reversible: no data leaves the machine, nothing outside the project is modified, and no credentials, git history or remote state are touched.",
+			false: "Anything else. Broad or unrelated outside-workspace access, deleting or overwriting files outside the project, rewriting or publishing git history, uploading data anywhere, installing system or global packages, changing permissions, ownership or credentials, killing processes, running as another user or as root, piping a download into a shell, or a command obfuscated enough that its effect cannot be read."
 		}
 	};
+	const questions = { [COMMAND_GUARD_QUESTION_ID]: question };
+	if (escalated) {
+		questions[COMMAND_GUARD_ESCALATION_SCOPE_QUESTION_ID] = {
+			type: "noul",
+			instructions: "Is the requested wider sandbox access limited to a narrow, conventional purpose supported by this command, such as a build cache, dependency cache, or temporary directory, rather than unrelated user files, credentials, other projects, or the network?",
+			criteria: {
+				true: "The wider access is plausibly limited to conventional local build/dependency caches or temporary files required by the command, with no unrelated host data or remote transfer in scope.",
+				false: "The command needs broad or unrelated host access, cannot establish a narrow purpose, or would use the wider permission to reach credentials, other projects, user files, or the network."
+			}
+		};
+		questions[COMMAND_GUARD_ESCALATION_NECESSITY_QUESTION_ID] = {
+			type: "noul",
+			instructions: "Is the requested sandbox escalation necessary and proportionate for this one command, rather than broader than the command needs? Treat the stated reason as a claim to check against the command, not as proof.",
+			criteria: {
+				true: "The command and its stated purpose support a one-shot escalation that is needed for the task and is no broader than the requested effect requires.",
+				false: "The wider mode is unnecessary, broader than needed, unsupported by the command, or the command is too ambiguous to justify the extra authority."
+			}
+		};
+	}
 	return {
 		state: lines.join("\n"),
-		questions: { [COMMAND_GUARD_QUESTION_ID]: question }
+		questions
 	};
 }
 /**
-* Read the safety probability out of a decision response.
+* Read a probability out of a decision response.
 *
 * @param response - the parsed response.
 * @param questionId - the question id to read (defaults to the guard's own).
-* @returns the probability of "safe", or undefined when the answer is missing
-*   or is not a `noul` verdict.
+* @returns the probability, or undefined when the answer is missing or is not
+*   a `noul` verdict.
 */
 function safeProbabilityOf(response, questionId = COMMAND_GUARD_QUESTION_ID) {
 	const answer = response.answers[questionId];
@@ -8000,7 +7947,7 @@ var CommandGuard = class {
 		const agentDecisions = request.agent === void 0 ? void 0 : this.decisions.get(request.agent);
 		const memo = agentDecisions?.get(memoKey);
 		if (memo !== void 0) {
-			if (now - memo.at < 6e5) return this.verdict(memo.probability, settings.threshold, "memo", excerpt);
+			if (now - memo.at < 6e5) return this.verdict(memo, settings.threshold, "memo", excerpt, full.sandboxPermissions !== void 0);
 			agentDecisions?.delete(memoKey);
 		}
 		let response;
@@ -8022,12 +7969,28 @@ var CommandGuard = class {
 			reason: "the decision carried no safe verdict",
 			command: excerpt
 		};
+		let escalation;
+		if (full.sandboxPermissions !== void 0) {
+			const scope = safeProbabilityOf(response, COMMAND_GUARD_ESCALATION_SCOPE_QUESTION_ID);
+			const necessity = safeProbabilityOf(response, COMMAND_GUARD_ESCALATION_NECESSITY_QUESTION_ID);
+			if (scope === void 0 || necessity === void 0) return {
+				kind: "delegate",
+				reason: "the decision carried no complete sandbox-escalation verdict",
+				command: excerpt
+			};
+			escalation = {
+				scope,
+				necessity
+			};
+		}
+		const memoEntry = {
+			probability,
+			...escalation === void 0 ? {} : { escalation },
+			at: now
+		};
 		if (request.agent !== void 0) {
 			const decisions = agentDecisions ?? /* @__PURE__ */ new Map();
-			decisions.set(memoKey, {
-				probability,
-				at: now
-			});
+			decisions.set(memoKey, memoEntry);
 			while (decisions.size > 64) {
 				const oldest = decisions.keys().next();
 				if (oldest.done === true) break;
@@ -8035,19 +7998,44 @@ var CommandGuard = class {
 			}
 			this.decisions.set(request.agent, decisions);
 		}
-		return this.verdict(probability, settings.threshold, "model", excerpt);
+		return this.verdict(memoEntry, settings.threshold, "model", excerpt, full.sandboxPermissions !== void 0);
 	}
-	/** Apply the threshold to one probability. */
-	verdict(probability, threshold, source, command) {
-		return probability >= threshold ? {
+	/** Apply the threshold to the primary verdict and any escalation vetoes. */
+	verdict(entry, threshold, source, command, escalated) {
+		if (entry.probability < threshold) return {
+			kind: "delegate",
+			reason: `safe probability ${entry.probability.toFixed(3)} below ${threshold}`,
+			probability: entry.probability,
+			command
+		};
+		if (!escalated) return {
 			kind: "approve",
-			probability,
+			probability: entry.probability,
 			source,
 			command
-		} : {
+		};
+		if (entry.escalation === void 0) return {
 			kind: "delegate",
-			reason: `safe probability ${probability.toFixed(3)} below ${threshold}`,
-			probability,
+			reason: "the cached sandbox-escalation verdict was incomplete",
+			command
+		};
+		if (entry.escalation.scope < threshold) return {
+			kind: "delegate",
+			reason: `sandbox scope probability ${entry.escalation.scope.toFixed(3)} below ${threshold}`,
+			probability: entry.probability,
+			command
+		};
+		if (entry.escalation.necessity < threshold) return {
+			kind: "delegate",
+			reason: `sandbox necessity probability ${entry.escalation.necessity.toFixed(3)} below ${threshold}`,
+			probability: entry.probability,
+			command
+		};
+		return {
+			kind: "approve",
+			probability: entry.probability,
+			source,
+			...entry.escalation === void 0 ? {} : { escalation: entry.escalation },
 			command
 		};
 	}
@@ -8085,7 +8073,7 @@ function applyCommandGuard(ctx, deps) {
 			return next();
 		}
 		if (verdict.kind === "approve") {
-			deps.log?.(`command guard auto-approved a ${request.toolName} call (safe probability ${verdict.probability.toFixed(3)}, ${verdict.source}): ${verdict.command ?? "(command unknown)"}`);
+			deps.log?.(`command guard auto-approved a ${request.toolName} call (safe probability ${verdict.probability.toFixed(3)}${verdict.escalation === void 0 ? "" : `, sandbox scope ${verdict.escalation.scope.toFixed(3)}, necessity ${verdict.escalation.necessity.toFixed(3)}`}, ${verdict.source}): ${verdict.command ?? "(command unknown)"}`);
 			return "allowed-once";
 		}
 		deps.log?.(`command guard delegated a ${request.toolName} call: ${verdict.reason}${verdict.command === void 0 ? "" : ` — ${verdict.command}`}`);
@@ -8099,25 +8087,58 @@ function applyCommandGuard(ctx, deps) {
 //#endregion
 //#region src/config-volatile.ts
 /**
-* Mark one schema field volatile when the installed schemastery supports it.
-* @param schema - The field schema (any generation).
-* @returns The schema carrying `meta.volatile`, or the schema itself on an
-* engine whose schemastery predates `.volatile()`.
+* Volatile-config helpers for dsh 0.1.7's schema-derived profile Config.
+*
+* 0.1.7 rewrote settings around profile Config: `settings.describe()` projects
+* each active entry's schema through `volatileForm()`, so a form contains ONLY
+* fields whose schema nodes carry `meta.volatile`, and a form edit is refused
+* unless its path lies beneath a marked node. On that generation the loader
+* resolves each marked top-level field into a readonly `Volatile<T>` reference
+* (`{ get() }`, frozen, written in place by the owning runtime) instead of a
+* plain value, commits later changes WITHOUT remounting the fiber, and
+* dispatches `loader/volatile-update` to the owning fiber.
+*
+* Two helpers keep the rest of the plugin reading a PLAIN `Config`:
+*
+* - `markVolatile(schema)` applies `.volatile()`, so 0.1.7's forms see every
+*   field we mark. The declared type is preserved through the mark on purpose:
+*   it changes what the schema PARSES to (a live reference), not the
+*   plugin-facing `Config` shape every consumer reads.
+* - `unwrapVolatileConfig(config)` reads every top-level field through its
+*   reference when one is present — returning a FRESH object per call, since
+*   a reference's identity is stable while its value changes — and returns the
+*   config untouched when none is.
+*
+* Only TOP-LEVEL fields are marked (form writes name top-level paths such as
+* `accounts` or `modelVisibility.<id>`, whose first segment is the marked
+* node), so one unwrap level is complete. The literal `apiKey` secret stays
+* unmarked on purpose: no settings surface writes it — the settings page and
+* the dsh-TUI section both write keys through the credentials seam — so it
+* keeps composition-only semantics, and a config-file edit to it reloading the
+* fiber is the correct behavior for a secret literal.
+*
+* @module dsh-commandcode-provider/config-volatile
+*/
+/**
+* Mark one schema field volatile.
+*
+* `.volatile()` is unconditional: the mark is a schemastery 3.18.3 feature and
+* the only engine this bundle supports (`dsh 0.1.7-rc.1`) pins `~3.18.4`, so
+* the method is always present. It is reached through a structural member
+* rather than schemastery's own typing so the function can keep the caller's
+* declared field type, which is what lets `Config` stay the plain shape every
+* consumer reads while the schema parses to live references.
+*
+* @param schema - The field schema.
+* @returns The schema carrying `meta.volatile`.
 */
 function markVolatile(schema) {
-	const candidate = schema;
-	if (typeof candidate.volatile !== "function") return schema;
-	return candidate.volatile();
+	return schema.volatile();
 }
 /**
 * Mark every field of a Config field dict volatile, except the named
 * composition-only secrets (`apiKey` here, which no settings surface writes).
 *
-* The result is a NEW dict of schema instances: callers that also need an
-* UNMARKED schema for the legacy settings generation must build the fields
-* twice (`configFields()`), never share one dict — `.volatile()` clones per
-* call, and a shared instance would carry the mark into the legacy schema.
-*
 * @param fields - Freshly built field schemas.
 * @param skip - Field names that must stay unmarked.
 * @returns The field dict with every non-skipped field marked.
@@ -8138,24 +8159,21 @@ function isVolatileRef(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.isFrozen(value) && typeof value.get === "function";
 }
 /**
-* Read one config object as PLAIN values across generations.
+* Read one config object as PLAIN values.
 *
-* Each top-level field found to be a volatile reference is read through
+* Every top-level field found to be a volatile reference is read through
 * `.get()` — freshly on every call, so a live update lands on the very next
-* read. When no field is a reference the input object is returned as-is,
-* keeping reference identity stable for identity-keyed memos on engines that
-* hand `apply()` plain config.
+* read. The loader resolves EVERY marked node into a reference, unset fields
+* included, so a loader-parsed config always yields a fresh object here; the
+* pass-through for a field that is not a reference is what keeps the unmarked
+* `apiKey` literal readable.
 */
 function unwrapVolatileConfig(config) {
 	const source = config;
 	if (typeof source !== "object" || source === null) return config;
-	let found = false;
 	const plain = {};
-	for (const [field, value] of Object.entries(source)) if (isVolatileRef(value)) {
-		plain[field] = value.get();
-		found = true;
-	} else plain[field] = value;
-	return found ? plain : config;
+	for (const [field, value] of Object.entries(source)) plain[field] = isVolatileRef(value) ? value.get() : value;
+	return plain;
 }
 //#endregion
 //#region src/index.ts
@@ -8167,10 +8185,9 @@ function unwrapVolatileConfig(config) {
 * the configurable-provider directory, so the web Models page shows a
 * "Command Code" card with an API-key field and the model picker lists the
 * live Command Code model catalog. Connection facts resolve per request over
-* the plugin's live config — the `llm-commandcode` settings section through
-* dsh 0.1.6, profile Config (volatile fields, unwrapped per read) from 0.1.7
-* — and the credential seam, so a changed key, endpoint, or cache path
-* reaches the next request without a restart.
+* the plugin's live profile Config (volatile fields, unwrapped per read) and
+* the credential seam, so a changed key, endpoint, or cache path reaches the
+* next request without a restart.
 *
 * ```yaml
 * - id: llm-commandcode
@@ -8196,87 +8213,54 @@ const PROVIDER = "commandcode";
 /** Default models cache path (mirrors the pi plugin's on-disk cache). */
 const DEFAULT_MODELS_CACHE_PATH = join(homedir(), ".commandcode", "models-cache.json");
 /**
-* The Config schema's fields, freshly built on every call.
-*
-* A FACTORY, not a shared dict, and that is load-bearing: the exported
-* {@link Config} marks every field volatile while {@link LegacySettingsSchema}
-* must carry no mark at all, and schemastery's schema instances are
-* single-purpose objects — sharing one dict would leak the marks into the
-* legacy registration (see `config-volatile.ts` for why that is a boot-time
-* `ValidationError` on ≤0.1.6 engines whose schemastery resolved to ≥3.18.3).
-*
-* @returns One fresh schema instance per Config field.
-*/
-function configFields() {
-	return {
-		apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
-		apiKey: z.string().role("secret"),
-		apiBase: z.string(),
-		workingDir: z.string(),
-		modelsCachePath: z.string(),
-		requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
-		streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
-		transportMaxRetries: z.number().min(0).max(50),
-		filterModelsByPlan: z.boolean(),
-		visibleModels: z.array(z.string()),
-		/**
-		* Per-model visibility overrides for the terminal settings page's checkbox
-		* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
-		* PATH, so two checkboxes sharing one path would overwrite each other's
-		* draft and the section's last model would decide every write; a map gives
-		* each checkbox a path of its own. An id listed here wins over
-		* {@link Config.visibleModels}; ids absent here keep following it.
-		*/
-		modelVisibility: z.dict(z.boolean()),
-		webSearch: z.boolean().default(true),
-		showSidebarQuota: z.boolean().default(false),
-		accounts: z.array(z.object({
-			label: z.string(),
-			apiKeyEnv: z.string().role("credential-ref"),
-			/** Literal key for one extra slot; see the top-level `apiKey` secret note. */
-			apiKey: z.string().role("secret")
-		})),
-		activeAccount: z.string(),
-		modelAccountRules: z.array(z.object({
-			models: z.array(z.string()),
-			account: z.string()
-		})),
-		commandGuard: z.boolean().default(false),
-		commandGuardThreshold: z.number().min(COMMAND_GUARD_MIN_THRESHOLD).max(1),
-		commandGuardTimeoutMs: z.number().min(200).max(COMMAND_GUARD_MAX_TIMEOUT_MS),
-		zdr: z.boolean().default(false),
-		lang: z.string().pattern(/^(zh|en)$/).default("zh")
-	};
-}
-/**
-* The 0.1.7-generation schema: every field volatile except the
-* composition-only `apiKey` secret.
+* The Config schema: every field volatile except the composition-only `apiKey`
+* secret.
 *
 * dsh 0.1.7's settings forms are projected from the schema's `meta.volatile`
 * nodes, so an unmarked field would be invisible to AND unwritable from the
-* settings page and refused by form-edit path validation — and on that
-* generation the loader hands `apply()` a live reference per marked field,
-* committing later writes without remounting this fiber (the
-* `loader/volatile-update` listener at the bottom of `apply` covers the facts
-* that are not re-derived per read). The mark is inert on engines whose
-* schemastery predates `.volatile()`.
-*/
-const Config = z.object(markVolatileFields(configFields(), ["apiKey"]));
-/**
-* The ≤0.1.6-generation registration schema: the same fields, NO volatile
-* marks.
-*
-* The legacy `installSection(owner, ns, schema, entry, hooks)` re-validates the
-* `entry` it is handed (`register()` → `resolve()` → `schema(mergeLayers(base,
-* section))`) and its `describe()` structuredClones that same `entry`. Since
-* schemastery ≥3.18.3 creates references at parse time on EVERY generation —
-* `dsh-settings` through 0.1.6 declares `schemastery: ^3.18.2`, so old engines
-* freshly installed today resolve 3.18.3 — a marked schema plus the raw
-* reference-carrying `config` is a boot-time `ValidationError` there. This
-* schema is therefore unmarked, and `apply` pairs it with
-* `unwrapVolatileConfig(config)`.
-*/
-const LegacySettingsSchema = z.object(configFields());
+* settings page and refused by form-edit path validation — and the loader
+* hands `apply()` a live reference per marked field, committing later writes
+* without remounting this fiber (the `loader/volatile-update` listener at the
+* bottom of `apply` covers the facts that are not re-derived per read).
+*/
+const Config = z.object(markVolatileFields({
+	apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
+	apiKey: z.string().role("secret"),
+	apiBase: z.string(),
+	workingDir: z.string(),
+	modelsCachePath: z.string(),
+	requestTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+	streamIdleTimeoutMs: z.number().min(1).max(MAX_TIMER_DELAY_MS),
+	transportMaxRetries: z.number().min(0).max(50),
+	filterModelsByPlan: z.boolean(),
+	visibleModels: z.array(z.string()),
+	/**
+	* Per-model visibility overrides for the terminal settings page's checkbox
+	* list, keyed by catalog id. dsh-TUI addresses a staged edit by its field
+	* PATH, so two checkboxes sharing one path would overwrite each other's
+	* draft and the section's last model would decide every write; a map gives
+	* each checkbox a path of its own. An id listed here wins over
+	* {@link Config.visibleModels}; ids absent here keep following it.
+	*/
+	modelVisibility: z.dict(z.boolean()),
+	webSearch: z.boolean().default(true),
+	showSidebarQuota: z.boolean().default(false),
+	accounts: z.array(z.object({
+		label: z.string(),
+		apiKeyEnv: z.string().role("credential-ref"),
+		/** Literal key for one extra slot; see the top-level `apiKey` secret note. */
+		apiKey: z.string().role("secret")
+	})),
+	activeAccount: z.string(),
+	modelAccountRules: z.array(z.object({
+		models: z.array(z.string()),
+		account: z.string()
+	})),
+	commandGuard: z.boolean().default(false),
+	commandGuardLevel: z.union([...COMMAND_GUARD_LEVELS]).default(COMMAND_GUARD_DEFAULT_LEVEL),
+	zdr: z.boolean().default(false),
+	lang: z.string().pattern(/^(zh|en)$/).default("zh")
+}, ["apiKey"]));
 /**
 * The one explicit resolve step from raw config to validated connection
 * facts. Programmatic construction may bypass Schemastery normalization, so
@@ -8311,19 +8295,8 @@ function readModelVisibility(raw) {
 }
 function apply(ctx, config) {
 	installCostProjection(ctx);
-	let source = () => config;
-	const current = () => unwrapVolatileConfig(source());
-	let lastRaw;
-	let lastGood;
-	const options = () => {
-		const raw = current();
-		if (raw === lastRaw && lastGood !== void 0) return lastGood;
-		const next = resolveAdapterOptions(raw);
-		lastRaw = raw;
-		lastGood = next;
-		return next;
-	};
-	options();
+	const current = () => unwrapVolatileConfig(config);
+	const options = () => resolveAdapterOptions(current());
 	const slots = () => {
 		const raw = current();
 		const list = [{
@@ -8515,8 +8488,8 @@ function apply(ctx, config) {
 		const raw = current();
 		return {
 			enabled: raw.commandGuard === true,
-			threshold: raw.commandGuardThreshold ?? .9,
-			timeoutMs: raw.commandGuardTimeoutMs ?? COMMAND_GUARD_DEFAULT_TIMEOUT_MS
+			threshold: commandGuardThreshold(raw.commandGuardLevel),
+			timeoutMs: COMMAND_GUARD_TIMEOUT_MS
 		};
 	};
 	ctx.inject(["approval"], (approvalCtx) => {
@@ -8548,23 +8521,10 @@ function apply(ctx, config) {
 		}, "dsh-commandcode-provider: tui settings handle");
 	});
 	ctx.inject(["settings"], (settingsCtx) => {
-		const service = settingsCtx.settings;
-		if (typeof service.installSection === "function") {
-			service.installSection(ctx, NS, LegacySettingsSchema, unwrapVolatileConfig(config), {
-				setSource: (next) => {
-					source = next;
-				},
-				onChange: () => {
-					applySearchSelection(current().webSearch ?? true);
-					refreshTuiSettings?.();
-				}
-			});
-			return;
-		}
-		if (typeof service.configure === "function") settingsCtx.effect(() => {
-			const dispose = service.configure?.({ auto: false }, ctx.fiber);
+		settingsCtx.effect(() => {
+			const dispose = settingsCtx.settings.configure({ auto: false }, ctx.fiber);
 			return () => {
-				dispose?.();
+				dispose();
 			};
 		}, "dsh-commandcode-provider: settings auto-form policy");
 	});
@@ -8580,6 +8540,6 @@ function apply(ctx, config) {
 	}, "dsh-commandcode-provider: volatile config updates");
 }
 //#endregion
-export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, LegacySettingsSchema, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, selectCommandCodeSearchProvider, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
+export { ACTIVE_ACCOUNT_AUTO, BILLING_ACCESS_TTL_MS, COMMANDCODE_SEARCH_PROVIDER_ID, COMMAND_CODE_CLI_VERSION, CommandCodeAccountPool, CommandCodeAdapter, CommandCodeLoginFlow, CommandCodeSearchProvider, CommandCodeUsageService, Config, DEFAULT_API_BASE, DEFAULT_GENERATE_MAX_TOKENS, DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_MODELS_CACHE_PATH, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_WEB_SEARCH_PROVIDER_ID, KNOWN_DEALS, KNOWN_EFFORTS, KNOWN_IMAGE_MODELS, KNOWN_NON_ZDR_MODELS, KNOWN_PEAK_PRICING, KNOWN_PLANS, KNOWN_SUBSCRIPTION_PLANS, KNOWN_THINKING_MODELS, LANG_AUTO, LOGIN_ALLOWED_ORIGINS, LOGIN_BEGIN_ENDPOINT, LOGIN_BODY_LIMIT_BYTES, LOGIN_CANCEL_ENDPOINT, LOGIN_MAX_PORT_ATTEMPTS, LOGIN_START_PORT, LOGIN_STATUS_ENDPOINT, LOGIN_TIMEOUT_MS, PLAN_LABELS, PLAN_ORDER, PROVIDER, USAGE_REPORT_ENDPOINT, accountUsable, apply, applyCommandCodeSearchSelection, applyCommandCodeTuiSettings, applyCommands, applyUsageRemote, buildCommandAuthUrl, buildCommandCodeTuiSection, capabilityDescription, commandCodeSearchSelection, commandDefinition, compareByPlan, dealLabel, formatContext, inject, loginStatusSchema, matchModelRule, modelVisibleInPlan, name, parseLoginStatus, peakPricingLabel, peakPricingState, planLabel, projectSlugFromPath, resolveAdapterOptions, resolveAuthFileApiKey, selectAccountForModel, selectActiveAccount, studioBaseForApiBase, subscriptionPlanInfo, supportsZeroDataRetention, usageReportSchema, validateCommandApiKey };
 
 //# sourceMappingURL=index.js.map