@mars-sea/dsh-commandcode-provider 0.11.14 → 0.11.17

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.11.17] - 2026-09-27
+
+### Changed
+
+- **Synced with the official command-code@1.66.0 CLI.** `COMMAND_CODE_CLI_VERSION` and the `x-command-code-version` header now report `1.66.0`. The release is additive with exactly one change against `1.65.5` (the newest version the official changelog page still documents, so the bundle diff is the evidence): the CLI registry gains `stealth/pixel-canary` (Pixel Canary) — Vercel AI Gateway-served, text+image, 262,144-token context, reasoning with the selectable `low`/`medium`/`high` set, available on every plan from Go up, and **free while the stealth preview lasts**. The public catalog serves it too (82 models), on `/chat/completions` + `/responses`. It is the **second change to the ZDR exception set since the 1.62.0 check**: it enters through `modelSupportsZdr` alone (the 1.66.0 bundle's `knownModelSupportsZdr` set does not repeat it), the pricing page says it plainly ("Free while the preview lasts. Not routed under ZDR."), so `KNOWN_NON_ZDR_MODELS` grows 21 → 22 and `tests/zdr.test.ts` pins the new membership deliberately. It is also the second free stealth model to carry no vendored price row, exactly like Space Bunny Alpha — the price table's free-model branch prices it at $0. **The wire protocol is untouched**: the 26 `/alpha/*` and `/provider/v1/*` routes, the `x-command-code-version` / `x-cmd-zdr` header table, the account-rejection code vocabulary, the stream event names and the subscription-plan maps are the same set as in 1.65.5. Everything else was re-verified against the live catalog and the pricing/docs pages on 2026-09-27 and is unchanged: the catalog's 82 models and its 65 × chat/completions + responses / 9 Claude ids × messages / 8 × chat/completions route mix, the plan map at 52/60/74/82, the full effort map, the Vision set, every other deal, and the DeepSeek peak schedule.
+
+- **Two vendored price rows moved.** The official pricing page lowers Step 3.5 Flash's input rate from $0.10 to **$0.09** per 1M tokens, and publishes a `typesafe/jev` row the page did not carry before. Neither changes what the picker shows: Step 3.5 Flash's badge and plan tier are unchanged, and `typesafe/jev` is not in the public catalog and is not served by either chat transport — the System One decision client that used to price it is removed in this same release, so the row simply keeps the table in step with the page. One promotion is on its own clock rather than in this table: Grok 4.7's 40%-off deal lapses at `2026-09-27T23:59:59Z`, at which point the picker badge hides itself and the row returns to the $2.00 / $6.00 / $0.50 list rates on the next sync. Re-run `node scripts/sync-model-prices.mjs` to pick up either move.
+
+### Fixed
+
+- **The opt-in stream trace now fingerprints the request, not just the response.** `DSH_COMMANDCODE_TRACE` recorded the raw response chunks and how the stream ended, but nothing about what was asked, so a provider cache hit or miss could not be tied to a request shape. Every attempt now appends a `request` record before it is sent — transport, model, thread id, the message and tool counts, and a SHA-256 of the body, config, system prompt, tool list and message list. It is the same privacy contract as the rest of the trace (counts and hashes only, never the text, and a record that cannot be written never fails the request it observes), and it is skipped entirely when the trace is off, so the default path stays one environment read. `tests/stream-trace.test.ts` pins the record on both a finished request and a pre-stream failure, and asserts the prompt text is absent from the file.
+
+- CLI requests now derive a stable UUID thread ID from DSH's prefixed session IDs, so successive requests in an ordinary session keep the same provider thread ID. This preserves request correlation; a cache-hit improvement still requires live evidence.
+
+### Removed
+
+- **The AI command guard is gone; dsh's own approval tooling does this job now.** The opt-in `commandGuard` / `commandGuardLevel` settings, the `approval/request` answerer and the `tools/pre-execute` observer it registered, the `typesafe/jev` decision client for `POST /provider/v1/systemone`, their offline explainer script, and the settings-page / dsh-TUI controls and copy are all removed. The plugin no longer touches the `approval` seam at all and no longer calls the System One decision endpoint — Command Code chat, web search, cost readouts, accounts and ZDR are unaffected. A stored `commandGuard` / `commandGuardLevel` value in an existing profile is simply ignored (schemastery keeps unknown keys without validating them), so nothing needs migrating.
+
+## [0.11.16] - 2026-09-25
+
+### Changed
+
+- **Synced with the official command-code@1.65.2 CLI.** `COMMAND_CODE_CLI_VERSION` and the `x-command-code-version` header now report `1.65.2`. The public catalog already exposed Step 3.5 Flash's corrected 262,144-token context, so no picker or price row moves; the full effort, Vision, automatic-reasoning, plan, subscription, deal, peak-pricing and ZDR snapshots remain unchanged.
+
+- **Updated the exact DeepSeek Harness pairing from `0.1.7-rc.1` to `0.1.7-rc.2`.** Every Harness peer and development range, `dsh.compatibility.dsh`, `engines.dsh`, and the single `dshReleases` record now name rc.2 together. The rc.2 client graph no longer carries the obsolete `dsh-client-connection` edge or peer; the browser bundle still exports only the live `slots`, `locale`, and `remote` service face. `npm run test:engine` is the compatibility proof for this exact pairing.
+
+### Added
+
+- **Command Code models can receive newly enabled tools during an existing conversation.** The adapter advertises rc.2's `toolUpdate: 'addition-only'` capability. Both Command Code transports already send the complete active tool declaration list, so the harness can project a tool addition into the current request without a new conversation; tool removals are represented by omission from that active list. This is deliberately not advertised as `in-history`, because the provider wire has no native tool-removal event.
+
+- **The browser follows rc.2 credential updates and safer API-key autofill.** The client now refreshes key state for both `credentials/reference-updated` and rc.2's `credentials/record-updated`, and both Command Code API-key inputs use `autocomplete="new-password"` so browsers are less likely to fill a saved login password into a secret field.
+
+### Fixed
+
+- **CLI-stream cache writes are no longer under-reported.** command-code@1.65.2 added a standalone `cache-write-tokens` JSONL event for requests whose finish usage reports zero or omits `cacheWriteTokens`. The adapter now retains the last finite non-negative reading and uses it under the same zero/missing fallback as the official CLI, including when the finish event carries no `totalUsage`. Positive finish usage still wins, so the event cannot double-count cache writes.
+
 ## [0.11.14] - 2026-09-24
 
 ### Fixed

package/README.md

@@ -35,7 +35,7 @@ See [Screenshots](#screenshots) below for what the UI looks like.
 
 ## Install
 
-This release supports **dsh 0.1.7-rc.1 and nothing else** — the plugin's peer
+This release supports **dsh 0.1.7-rc.2 and nothing else** — the plugin's peer
 range is that one version, and its compatibility record names it alone:
 
 ```sh
@@ -57,7 +57,7 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 **pnpm 11 holds back new releases.** Its `minimumReleaseAge` defaults to 1440 minutes, so a version published less than a day ago is skipped and `@latest` resolves to the *previous* release — silently, with a success exit code. To install a release from the last 24 hours, name it exactly:
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 The same applies to every profile you install into, including the terminal UI below.
@@ -69,14 +69,14 @@ Fresh pnpm 10 marketplace generations are supported directly. Do not add a separ
 Update with the same tag you installed with:
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.2
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # older dsh (0.5.0 line, unmaintained)
 ```
 
 Each profile updates separately — the terminal UI owns its own plugin list (see below):
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 To move to a version published less than 24 hours ago, name it exactly as in Install above; pnpm 11's age gate resolves `@latest` to the previous release instead.
@@ -105,7 +105,7 @@ After restart, enter your API key in **Settings → Command Code** and save; **S
 The plugin also works under a terminal front door. **Each dsh profile owns its own plugin list**, so the web install above does not reach the terminal — add the plugin to the `dsh-tui` profile as well:
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 Pin the exact version here. For the first 24 hours after a release, a bare package name (or `@latest`) is silently resolved to the previous one: the install succeeds, but the profile gets the older build — which is how a fresh terminal install ends up with no **`/settings` → Command Code** page and no `commandcode` models at all.
@@ -143,7 +143,7 @@ cmd login                               # writes ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.1**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.1` (semver resolves that to 0.1.7-rc.1 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
+**Engine version.** The plugin is maintained against exactly one engine: **dsh 0.1.7-rc.2**. Its `@deepseek-ai/dsh-*` peer range is `^0.1.7-rc.2` (semver resolves that to 0.1.7-rc.2 alone), and `dsh.compatibility.dshReleases` records that single release. On an older engine the settings page, the message envelope, or the request-image budget will not line up — install the last release that supported your engine (see [Install](#install)) instead of forcing this one.
 
 ## Usage dashboard
 
@@ -191,7 +191,7 @@ llm-commandcode:
 
 ## Configure
 
-**Settings → Command Code** is organized as **Accounts** (keys, sign-in, live quota, pinning, dedicated models), **Models** (hide out-of-plan models, visible models), **Privacy & security** (zero data retention and the AI command guard, both off by default, see below), **Integrations & display** (serve web search with Command Code, show the quota card in the sidebar, off by default), and a collapsed **Advanced** section (API base URL, request/stream timeouts, transport retries). The working directory is no longer on the page; `workingDir` in config still works.
+**Settings → Command Code** is organized as **Accounts** (keys, sign-in, live quota, pinning, dedicated models), **Models** (hide out-of-plan models, visible models), **Privacy & security** (zero data retention, off by default, see below), **Integrations & display** (serve web search with Command Code, show the quota card in the sidebar, off by default), and a collapsed **Advanced** section (API base URL, request/stream timeouts, transport retries). The working directory is no longer on the page; `workingDir` in config still works.
 
 The same options live in `$DSH_HOME/settings.yaml` (changes apply immediately, no restart):
 
@@ -204,8 +204,6 @@ llm-commandcode:
   requestTimeoutMs: 60000          # default 60s
   streamIdleTimeoutMs: 300000      # default 300s
   showSidebarQuota: true           # optional: show the plans & quota card in the sidebar (default off)
-  commandGuard: true               # optional: let the decision model auto-approve safe shell commands (default off)
-  commandGuardLevel: medium        # optional: auto-approve threshold, high (0.95) | medium (0.9, default) | low (0.8)
   zdr: true                        # optional: route requests only through zero-data-retention upstreams (default off)
 ```
 
@@ -221,21 +219,6 @@ When your deployment's dsh shell mounts the web capability (`@deepseek-ai/dsh-we
 
 > This reuses the Command Code Provider API directly (like the official CLI's built-in `web_search`), so it is distinct from a DeepSeek-native search backend.
 
-## AI command guard
-
-When dsh is about to ask you to approve a shell command (`bash`/`pwsh`) — a permission preset, a `PreToolUse` hook, or a sandbox escalation — this plugin can ask the Command Code decision model `typesafe/jev` whether the command is safe to run without asking. A confident *yes* turns into a one-shot `allowed-once` grant; everything else asks you exactly as before.
-
-**Off by default.** Turn it on with the *"Let AI judge shell commands"* toggle (`commandGuard`) in the Privacy & security card, or in your profile config. What the guard does and does not do:
-
-- It only ever sees commands dsh had **already decided to ask about** — it never widens a permission policy, and it never answers a session whose policy is "never ask".
-- A normal approval asks one `safe` question. A call carrying `sandboxPermissions` also asks `escalation_scope` and `escalation_necessity`; the primary safety probability and both escalation probabilities must reach the threshold of the chosen `commandGuardLevel` — **High** 0.95, **Medium** 0.9 (default) or **Low** 0.8; a higher level prompts more often. Thus a narrow case such as `go test ./...` needing an outside build cache can be approved by JEV without prompting the user every time.
-- A low-confidence answer, a broad or unnecessary escalation, a timeout (fixed at 3 seconds), a rate limit, a missing key, an unreadable answer, a command longer than 6000 characters, or a match against the built-in denylist (`sudo`, `rm -rf /`, `git push`, publish/upload commands, piping a download into a shell, …) all fall back to the normal prompt.
-- The **command text** (plus the agent's own one-line description, the working directory, the requested sandbox mode and the asker's reason) is sent to Command Code to be judged — with the same API key and base URL as chat.
-- The decision model has **no zero-data-retention upstream**, so this feature is incompatible with a ZDR-only policy. Leave it off if that matters to you.
-- The endpoint is free through 2026-09-24; after that it bills $0.042 per 1M input tokens (output free) — a single decision is a few hundred tokens, and an identical command with the same approval context in the same agent reuses the previous verdict for 10 minutes.
-
-Every AI decision is logged on the Host — an ordinary grant is `llm-commandcode: command guard auto-approved a bash call (safe probability 0.97, model): <the command>`; a sandbox grant also records its `sandbox scope` and `necessity` probabilities; everything that fell through is `… delegated a bash call: <reason> — <the command>` — and the outcome lands in the session's own approval audit (`approval/asked` / `approval/decided`), so a grant can always be traced back to the verdict that produced it. The log goes to the Host's console (the terminal running `dsh web`, or the desktop app's log), not to the browser.
-
 ## Zero data retention (ZDR)
 
 Command Code can serve a request only through upstreams that retain no prompts or completions and never train on them — the same opt-in the official CLI exposes as `CMD_ZDR=1`, and the `x-cmd-zdr: 1` header on the Provider API ([official docs](https://commandcode.ai/docs/resources/zdr)).
@@ -245,7 +228,6 @@ Command Code can serve a request only through upstreams that retain no prompts o
 - The header is sent on **every chat request** while ZDR is on. The plugin maintains an informational exception list (`KNOWN_NON_ZDR_MODELS`, synced from the official CLI — about 20 models, e.g. `xai/grok-4.5`, `stepfun/Step-3.7-Flash`, `meta/muse-spark-1.3`). A model without an available ZDR upstream fails with `422 cmd_zdr_no_providers`; the request is never retried without the header.
 - If a refusal still happens (coverage churn, or no ZDR upstream with spare capacity at that moment), the error names the cause and how to turn ZDR off, instead of surfacing as a bare HTTP 422.
 - **ZDR usually costs more**: capacity is limited and billed at each upstream's pass-through rates, and which upstream serves a request can change per request. The session-cost readout keeps quoting the ordinary catalog rates; the real per-request price shows in Command Code's Studio usage page.
-- The decision model behind the **AI command guard** has no ZDR upstream, so its requests never carry the header even with `zdr` on — the two features stay independent.
 - Works on every plan; plan credits meter ZDR requests at the plan's default allowance.
 
 ## Notes & limitations
@@ -260,7 +242,7 @@ Command Code can serve a request only through upstreams that retain no prompts o
 
 ## Permissions & privacy
 
-The plugin only communicates between your local dsh profile and your Command Code account: locally it touches only the credential store and the models cache (plus `~/.commandcode/auth.json` as a last-resort fallback); on the network it calls only the Command Code API. No telemetry. The one optional exception is the **AI command guard** (off by default), which sends the shell command it is asked to judge — see above. With **zero data retention** on (also off by default), chat requests require a ZDR upstream; models without one fail instead of running without the protection.
+The plugin only communicates between your local dsh profile and your Command Code account: locally it touches only the credential store and the models cache (plus `~/.commandcode/auth.json` as a last-resort fallback); on the network it calls only the Command Code API. No telemetry. With **zero data retention** on (also off by default), chat requests require a ZDR upstream; models without one fail instead of running without the protection.
 
 ## Disabling / uninstalling
 

package/README.zh-CN.md

@@ -33,7 +33,7 @@
 
 ## 安装
 
-本版本**只支持 dsh 0.1.7-rc.1**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
+本版本**只支持 dsh 0.1.7-rc.2**：插件的 peer 范围就是这一个版本，兼容性记录里也只列它。
 
 ```sh
 dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
@@ -49,7 +49,7 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest
 **pnpm 11 会拦下刚发布的新版本。** 它的 `minimumReleaseAge` 默认为 1440 分钟，发布不足一天的版本会被跳过，`@latest` 解析到**上一个**版本 —— 而且是静默的，命令照样以成功退出。想装 24 小时内发布的版本，必须写精确版本号：
 
 ```sh
-dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 这一点对每个 profile 都成立，包括下面的终端界面。
@@ -61,14 +61,14 @@ dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@0.11.13
 用与安装时相同的 tag 更新：
 
 ```sh
-dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.1
+dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@latest     # dsh 0.1.7-rc.2
 dsh plugin --profile web update @mars-sea/dsh-commandcode-provider@0.9.1      # 更早的 dsh（0.5.0 线，不再维护）
 ```
 
 每个 profile 各自更新 —— 终端界面有独立的插件列表（见下文）：
 
 ```sh
-dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui update @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 要更新到发布不足 24 小时的版本，和上面的安装一样写精确版本号；pnpm 11 的年龄门禁会把 `@latest` 解析成上一个版本。
@@ -97,7 +97,7 @@ cmd login        # macOS/Linux；Windows 原生版：cmdc login
 插件同样支持终端前端。**每个 dsh profile 有独立的插件列表**，所以上面那条 Web 安装命令不会装到终端里 —— 还要把插件装进 `dsh-tui` profile：
 
 ```sh
-dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.13
+dsh plugin --profile dsh-tui add @mars-sea/dsh-commandcode-provider@0.11.15
 ```
 
 这里请写精确版本号。新版本发布后的 24 小时内，只写包名（或 `@latest`）会被静默解析到上一个版本 —— 安装命令照样成功，但 profile 里拿到的是旧版本，结果就是全新的终端安装里既没有 **`/settings` → Command Code** 页面，也看不到任何 `commandcode` 模型。
@@ -135,7 +135,7 @@ cmd login                               # 写入 ~/.commandcode/auth.json
         cwd: !!js process.cwd()
 ```
 
-**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.1**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.1`（按 semver，这只会解析到 0.1.7-rc.1），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
+**引擎版本要求。** 插件只针对一个引擎维护：**dsh 0.1.7-rc.2**。它的 `@deepseek-ai/dsh-*` peer 范围是 `^0.1.7-rc.2`（按 semver，这只会解析到 0.1.7-rc.2），`dsh.compatibility.dshReleases` 也只记录这一个版本。在更早的引擎上，设置页、消息封装或请求图片预算总有一处对不上——请改装支持你所用引擎的最后一个版本，而不是硬装这一个。
 
 ## 用量面板
 
@@ -183,7 +183,7 @@ llm-commandcode:
 
 ## 配置
 
-**设置 → Command Code** 分为：**账户**（密钥、网页登录、实时额度、固定账户、专用模型）、**模型**（隐藏套餐外模型、可见模型）、**隐私与安全**（零数据保留 ZDR 与 AI 命令安全预判，均默认关闭，见下）、**集成与显示**（用 Command Code 承载联网搜索、在侧边栏显示额度卡片，默认关闭），以及默认折叠的**高级设置**（API 地址、请求/流超时、传输重试次数）。工作目录已不在页面上显示，配置中的 `workingDir` 仍然有效。
+**设置 → Command Code** 分为：**账户**（密钥、网页登录、实时额度、固定账户、专用模型）、**模型**（隐藏套餐外模型、可见模型）、**隐私与安全**（零数据保留 ZDR，默认关闭，见下）、**集成与显示**（用 Command Code 承载联网搜索、在侧边栏显示额度卡片，默认关闭），以及默认折叠的**高级设置**（API 地址、请求/流超时、传输重试次数）。工作目录已不在页面上显示，配置中的 `workingDir` 仍然有效。
 
 同一组选项也位于 `$DSH_HOME/settings.yaml`（修改即刻生效，无需重启）：
 
@@ -196,8 +196,6 @@ llm-commandcode:
   requestTimeoutMs: 60000          # 默认 60s
   streamIdleTimeoutMs: 300000      # 默认 300s
   showSidebarQuota: true           # 可选：在侧边栏显示套餐与配额卡片（默认关闭）
-  commandGuard: true               # 可选：让决策模型自动放行安全的 shell 命令（默认关闭）
-  commandGuardLevel: medium        # 可选：自动放行阈值，high（0.95）| medium（0.9，默认）| low（0.8）
   zdr: true                        # 可选：请求只经由零数据保留上游（默认关闭）
 ```
 
@@ -213,21 +211,6 @@ llm-commandcode:
 
 > 这里直接使用 Command Code Provider API（与官方 CLI 内置的 `web_search` 相同），因此与 DeepSeek 原生搜索后端不同。
 
-## AI 命令安全预判
-
-当 dsh 准备就某条 shell 命令（`bash`/`pwsh`）征求你同意时——无论是权限预设、`PreToolUse` 钩子还是沙箱提权——本插件可以先让 Command Code 的决策模型 `typesafe/jev` 判断这条命令是否安全到无需询问。判断为「安全」且把握足够高时，直接放行这一次调用；其余情况一律照旧询问你。
-
-**默认关闭。** 在「隐私与安全」卡片里打开「用 AI 预判命令是否安全」（`commandGuard`），或写进 profile 配置。它的行为边界：
-
-- 它只会看到 dsh **本来就要询问你**的命令——不会放宽任何权限策略，也不会替「从不询问」（policy 为 `never`）的会话作答。
-- 普通审批只问一个 `safe` 问题；带有 `sandboxPermissions` 的沙箱提权会额外问 `escalation_scope` 与 `escalation_necessity`。只有主安全概率以及这两个提权概率都不低于所选「自动放行阈值」（`commandGuardLevel`：高 0.95、中 0.9（默认）、低 0.8；阈值越高弹窗越多）时才跳过弹窗；因此像 `go test ./...` 需要访问工作区外构建缓存的场景，只要 JEV 确认提权范围狭窄且必要，就能由 AI 放行，不必每次打扰用户。
-- 任一概率不足、提权范围过宽或没有必要、超时（固定 3 秒）、限流、缺 key、返回体读不懂、命令超过 6000 字符，或命中内置危险名单（`sudo`、`rm -rf /`、`git push`、发布/上传类命令、把下载内容管进 shell 等），全部回到普通弹窗。
-- 送往 Command Code 判断的内容包括**命令原文**、模型自己写的一行描述、工作目录、请求的 sandbox 模式与询问原因；使用与聊天相同的 API key 与 base URL。
-- 该决策模型**没有零数据保留（ZDR）上游**，因此本功能与「只走 ZDR」的合规要求不兼容；如果你在意这一点，请保持关闭。
-- 该端点 2026-09-24 前免费，之后按输入 $0.042/1M tokens 计费（输出免费）——单次判断只有几百 tokens；同一 agent 中命令和审批场景都相同时，10 分钟内复用上一次结论。
-
-每次 AI 决策都会在 Host 侧写日志——普通放行是 `llm-commandcode: command guard auto-approved a bash call (safe probability 0.97, model): <命令>`；沙箱提权还会附带 `sandbox scope` 与 `necessity` 概率；其余是 `… delegated a bash call: <原因> — <命令>`——并进入会话自身的审批审计（`approval/asked` / `approval/decided`），所以任何一次放行都能追溯到产生它的判断。日志打到 Host 控制台（运行 `dsh web` 的终端，或桌面端日志），不进浏览器。
-
 ## 零数据保留（ZDR）
 
 Command Code 可以让请求只经由「不留存提示词与回复、也不用于训练」的上游——官方 CLI 的开关是 `CMD_ZDR=1`，Provider API 上则是在请求头发 `x-cmd-zdr: 1`（[官方文档](https://commandcode.ai/docs/resources/zdr)）。
@@ -237,7 +220,6 @@ Command Code 可以让请求只经由「不留存提示词与回复、也不用
 - 开启后，**每次聊天请求**都会带上 ZDR 请求头。插件仍维护官方 CLI 的例外名单（`KNOWN_NON_ZDR_MODELS`，约 20 个模型，例如 `xai/grok-4.5`、`stepfun/Step-3.7-Flash`、`meta/muse-spark-1.3`）供查询。没有可用 ZDR 上游时，服务端返回 `422 cmd_zdr_no_providers`；插件不会去掉请求头重试。
 - 万一仍被拒绝（名单过期，或那一刻没有空闲的 ZDR 上游容量），错误信息会说明原因并给出关闭 ZDR 的办法，而不是抛出一个光秃秃的 HTTP 422。
 - **ZDR 通常更贵**：容量有限，按各上游实价透传计费，且每次请求落在哪个上游可能不同。会话费用读数仍按常规目录价估算；真实单价见 Command Code Studio 的用量页。
-- **AI 命令安全预判**背后的决策模型没有 ZDR 上游，因此即使打开 `zdr`，它的请求也永远不带该请求头——两个功能互不影响。
 - 各套餐均可使用；ZDR 请求按套餐的默认额度（而非提升额度）计量。
 
 ## 注意事项与限制
@@ -251,7 +233,7 @@ Command Code 可以让请求只经由「不留存提示词与回复、也不用
 
 ## 权限与隐私
 
-本插件只在本地与你的 Command Code 账号之间通信：本地仅读写凭据存储与模型缓存文件（兜底读取 `~/.commandcode/auth.json`）；网络仅访问 Command Code API。无遥测。唯一的可选例外是 **AI 命令安全预判**（默认关闭），它会把待判断的命令文本发送出去——见上文。打开**零数据保留**（同样默认关闭）后，聊天请求必须经由 ZDR 上游；没有可用 ZDR 上游的模型会报错，不会按常规方式继续发送。
+本插件只在本地与你的 Command Code 账号之间通信：本地仅读写凭据存储与模型缓存文件（兜底读取 `~/.commandcode/auth.json`）；网络仅访问 Command Code API。无遥测。打开**零数据保留**（同样默认关闭）后，聊天请求必须经由 ZDR 上游；没有可用 ZDR 上游的模型会报错，不会按常规方式继续发送。
 
 ## 关闭 / 卸载